8-OpenStack启动虚拟机实例
我们知道在openstack中要启动一个虚拟机实例 , 通常会经过这样几步 , 第一步我们要有一个用户登录到openstack上 , 进行创建虚拟机的操作 , 而这一步通常由keystone服务来验证登录的用户 , 并返回一个token给用户 , 如果keystone验证成功 , 则用户就可以到openstack上进行对应的操作 , 反之亦然 ; 第二步 , 用户在keystone上完成登录验证 , 并拿到keystone给的token后 , 用户就可以在openstack上进行创建虚拟机 , 在创建虚拟机之前 , 用户要选择创建的虚拟机用那个模板进行创建 , 用那个镜像来安装系统 , 选择什么网络 , 安全组策略等等 ; 这些都必须事先创建好 ; 用户选择好必要的组件后 ; 用户就可以把创建虚拟机的需求发送给openstack 控制节点 , 由openstack的控制节点间的各服务调用 , 最后创建一个虚拟机实例 ; 这里需要强调一点 , 在openstack上创建虚拟机不能像我们使用kvm-qemu工具创建虚拟机指定要使用的虚拟cpu,内存 , 磁盘等等信息 ; 在openstack上创建虚拟机 , 它是通过模板来定义虚拟机的基础信息的 ; 专业术语叫flavor ; 了解了创建虚拟机的大致过程后 , 我们基于之前配置的环境来跑一个虚拟机实例在openstack上 ;
1. 创建模板
在控制节点上导出
admin环境变量，创建flavor[root@node01 ~]# . keystone_admin.rc [root@node01 ~]# openstack flavor create --id 0 --vcpus 1 --ram 64 --disk 1 m1.nano +----------------------------+---------+ | Field | Value | +----------------------------+---------+ | OS-FLV-DISABLED:disabled | False | | OS-FLV-EXT-DATA:ephemeral | 0 | | description | None | | disk | 1 | | id | 0 | | name | m1.nano | | os-flavor-access:is_public | True | | properties | | | ram | 64 | | rxtx_factor | 1.0 | | swap | 0 | | vcpus | 1 | +----------------------------+---------+导出
demo用户环境变量，创建一个keypair[root@node01 ~]# source demo.sh [root@node01 ~]# ssh-keygen -q -N "" Enter file in which to save the key (/root/.ssh/id_rsa): /root/.ssh/id_rsa already exists. Overwrite (y/n)? y [root@node01 ~]# openstack keypair create --public-key ~/.ssh/id_rsa.pub demo_key +-------------+-------------------------------------------------+ | Field | Value | +-------------+-------------------------------------------------+ | created_at | None | | fingerprint | cf:65:ae:5b:87:c5:48:bc:62:d9:42:60:3a:f6:2d:1b | | id | demo_key | | is_deleted | None | | name | demo_key | | type | ssh | | user_id | c6bab906341d42b99f0c1c714e45b0b7 | +-------------+-------------------------------------------------+ 列出安全组
[root@node01 ~]# openstack security group list +--------------------------------------+---------+------------------------+----------------------------------+------+ | ID | Name | Description | Project | Tags | +--------------------------------------+---------+------------------------+----------------------------------+------+ | 169e6cd1-b047-42dc-8f80-ad92223c06b2 | default | Default security group | a183bc3c4a4d4c83b78cf56b38804882 | [] | +--------------------------------------+---------+------------------------+----------------------------------+------+ 查看
default安全组中的规则[root@node01 ~]# openstack security group rule list +--------------------------------------+-------------+-----------+-----------+------------+-----------+--------------------------------------+----------------------+--------------------------------------+ | ID | IP Protocol | Ethertype | IP Range | Port Range | Direction | Remote Security Group | Remote Address Group | Security Group | +--------------------------------------+-------------+-----------+-----------+------------+-----------+--------------------------------------+----------------------+--------------------------------------+ | 59bfffc3-c042-4100-b509-e39bd8a6a12f | None | IPv6 | ::/0 | | egress | None | None | 169e6cd1-b047-42dc-8f80-ad92223c06b2 | | 86f068b4-30f3-49ad-ae58-d8c46e62b7a1 | None | IPv6 | ::/0 | | ingress | 169e6cd1-b047-42dc-8f80-ad92223c06b2 | None | 169e6cd1-b047-42dc-8f80-ad92223c06b2 | | d09d634d-72ca-432d-99a3-6260466c2a6a | None | IPv4 | 0.0.0.0/0 | | ingress | 169e6cd1-b047-42dc-8f80-ad92223c06b2 | None | 169e6cd1-b047-42dc-8f80-ad92223c06b2 | | f24cdf93-87b0-4b31-b2b6-3c1bcacd6f04 | None | IPv4 | 0.0.0.0/0 | | egress | None | None | 169e6cd1-b047-42dc-8f80-ad92223c06b2 | +--------------------------------------+-------------+-----------+-----------+------------+-----------+--------------------------------------+----------------------+--------------------------------------+ openstack上的安全组我们可以理解为一个虚拟的防火墙，里面的rule我们可以理解为iptabels规则；从上面查看default安全组中的规则来看，它默认是禁止任何ip任何协议连接内部虚拟机；这很显然不符合我们需求，至少我们应该把ssh端口开放出去；添加开放
ssh端口的rule到default安全组中[root@node01 ~]# openstack security group rule create --proto tcp --dst-port 22 169e6cd1-b047-42dc-8f80-ad92223c06b2 +-------------------------+--------------------------------------+ | Field | Value | +-------------------------+--------------------------------------+ | created_at | 2024-09-25T16:55:07Z | | description | | | direction | ingress | | ether_type | IPv4 | | id | 6a76c6b6-f936-45fc-8c28-c8643b6f5b22 | | name | None | | normalized_cidr | 0.0.0.0/0 | | port_range_max | 22 | | port_range_min | 22 | | project_id | a183bc3c4a4d4c83b78cf56b38804882 | | protocol | tcp | | remote_address_group_id | None | | remote_group_id | None | | remote_ip_prefix | 0.0.0.0/0 | | revision_number | 0 | | security_group_id | 169e6cd1-b047-42dc-8f80-ad92223c06b2 | | tags | [] | | updated_at | 2024-09-25T16:55:07Z | +-------------------------+--------------------------------------+ [root@node01 ~]# 添加开放
icmp协议rule到default安全组中[root@node01 ~]# openstack security group rule create --proto icmp 169e6cd1-b047-42dc-8f80-ad92223c06b2 +-------------------------+--------------------------------------+ | Field | Value | +-------------------------+--------------------------------------+ | created_at | 2024-09-25T16:55:48Z | | description | | | direction | ingress | | ether_type | IPv4 | | id | 1250fac5-23dd-4bd4-8d43-31518b6424d9 | | name | None | | normalized_cidr | 0.0.0.0/0 | | port_range_max | None | | port_range_min | None | | project_id | a183bc3c4a4d4c83b78cf56b38804882 | | protocol | icmp | | remote_address_group_id | None | | remote_group_id | None | | remote_ip_prefix | 0.0.0.0/0 | | revision_number | 0 | | security_group_id | 169e6cd1-b047-42dc-8f80-ad92223c06b2 | | tags | [] | | updated_at | 2024-09-25T16:55:48Z | +-------------------------+--------------------------------------+ 验证：查看
default安全组中的规则，看看我们添加到规则是否都添加上了？[root@node01 ~]# openstack security group rule list +--------------------------------------+-------------+-----------+-----------+------------+-----------+--------------------------------------+----------------------+--------------------------------------+ | ID | IP Protocol | Ethertype | IP Range | Port Range | Direction | Remote Security Group | Remote Address Group | Security Group | +--------------------------------------+-------------+-----------+-----------+------------+-----------+--------------------------------------+----------------------+--------------------------------------+ | 1250fac5-23dd-4bd4-8d43-31518b6424d9 | icmp | IPv4 | 0.0.0.0/0 | | ingress | None | None | 169e6cd1-b047-42dc-8f80-ad92223c06b2 | | 59bfffc3-c042-4100-b509-e39bd8a6a12f | None | IPv6 | ::/0 | | egress | None | None | 169e6cd1-b047-42dc-8f80-ad92223c06b2 | | 6a76c6b6-f936-45fc-8c28-c8643b6f5b22 | tcp | IPv4 | 0.0.0.0/0 | 22:22 | ingress | None | None | 169e6cd1-b047-42dc-8f80-ad92223c06b2 | | 86f068b4-30f3-49ad-ae58-d8c46e62b7a1 | None | IPv6 | ::/0 | | ingress | 169e6cd1-b047-42dc-8f80-ad92223c06b2 | None | 169e6cd1-b047-42dc-8f80-ad92223c06b2 | | d09d634d-72ca-432d-99a3-6260466c2a6a | None | IPv4 | 0.0.0.0/0 | | ingress | 169e6cd1-b047-42dc-8f80-ad92223c06b2 | None | 169e6cd1-b047-42dc-8f80-ad92223c06b2 | | f24cdf93-87b0-4b31-b2b6-3c1bcacd6f04 | None | IPv4 | 0.0.0.0/0 | | egress | None | None | 169e6cd1-b047-42dc-8f80-ad92223c06b2 | +--------------------------------------+-------------+-----------+-----------+------------+-----------+--------------------------------------+----------------------+--------------------------------------+可以看到default安全组里多了两条
rule;
2. 基于provider network创建虚拟机实例
在控制节点导出
demo用户的环境变量，验证是否有可用模板[root@node01 ~]# source demo.sh [root@node01 ~]# openstack flavor list +----+---------+-----+------+-----------+-------+-----------+ | ID | Name | RAM | Disk | Ephemeral | VCPUs | Is Public | +----+---------+-----+------+-----------+-------+-----------+ | 0 | m1.nano | 64 | 1 | 0 | 1 | True | +----+---------+-----+------+-----------+-------+-----------+ [root@node01 ~]#验证是否有可用镜像
[root@node01 ~]# openstack image list +--------------------------------------+--------+--------+ | ID | Name | Status | +--------------------------------------+--------+--------+ | 94dd2ba0-1736-4307-865d-7cb86b85d32e | cirros | active | +--------------------------------------+--------+--------+ [root@node01 ~]#验证是否有安全组？
[root@node01 ~]# openstack security group list +--------------------------------------+---------+------------------------+----------------------------------+------+ | ID | Name | Description | Project | Tags | +--------------------------------------+---------+------------------------+----------------------------------+------+ | 06b13f55-8beb-48d4-9994-490acc5488cf | default | Default security group | 1a918887f38a42c28f9d0d3774f34b16 | [] | +--------------------------------------+---------+------------------------+----------------------------------+------+ [root@node01 ~]#验证是否有可用网络？
[root@node01 ~]# openstack network list [root@node01 ~]#这里显示为空，表示没有任何可用网络；
创建
provider network在控制节点导出
admin用户的环境变量，创建provider network[root@node01 ~]# source admin.sh [root@node01 ~]# openstack network create --share --external --provider-physical-network external --provider-network-type flat provider-net +---------------------------+--------------------------------------+ | Field | Value | +---------------------------+--------------------------------------+ | admin_state_up | UP | | availability_zone_hints | | | availability_zones | | | created_at | 2024-09-27T11:08:54Z | | description | | | dns_domain | None | | id | 84d97504-ffd7-4c4e-b5b6-1066a7b1b97b | | ipv4_address_scope | None | | ipv6_address_scope | None | | is_default | None | | is_vlan_transparent | None | | mtu | 1500 | | name | provider-net | | port_security_enabled | False | | project_id | d2dd7a9d467a4c5dbd2faf6944986d1b | | provider:network_type | flat | | provider:physical_network | external | | provider:segmentation_id | None | | qos_policy_id | None | | revision_number | 1 | | router:external | External | | segments | None | | shared | True | | status | ACTIVE | | subnets | | | tags | | | tenant_id | d2dd7a9d467a4c5dbd2faf6944986d1b | | updated_at | 2024-09-27T11:08:54Z | +---------------------------+--------------------------------------+--share表示创建一个共享网络（桥接网络），--external表示创建一个外部的网络，如果希望创建的是内部网络，可以使用--internal选项来指明即可；--provider-network-type flat表示创建的网络类型为平面网络；最后是给我们创建的网络起一个名称叫provider-net；这里需要注意一点，--provider-physical-network这个选项的值要和我们在配置neutron服务时，在ml2_conf.ini文件中【ml2_type_flat】配置段中的flat_networks的值保持一致；如下所示
/etc/neutron/plugins/ml2/ml2_conf.ini这个配置文件中的【ml2_type_flat】配置段中的flat_networks的值要和/etc/neutron/plugins/ml2/openvswitch_agent.ini配置文件中的【ovs】配置段中的bridge_mappings中的provider名称保持一致；如下所示
以上两个配置文件中标记的部分都需要同这里创建网络时指定的
--provider-physical-network选项的值保持一致；创建子网
[root@node01 ~]# openstack subnet create --network provider-net --allocation-pool start=192.168.71.116,end=192.168.71.136 --dns-nameserver 223.5.5.5 --gateway 192.168.71.254 --subnet-range 192.168.71.0/24 provider-net-sub +----------------------+--------------------------------------+ | Field | Value | +----------------------+--------------------------------------+ | allocation_pools | 192.168.71.116-192.168.71.136 | | cidr | 192.168.71.0/24 | | created_at | 2024-09-27T11:10:28Z | | description | | | dns_nameservers | 223.5.5.5 | | dns_publish_fixed_ip | None | | enable_dhcp | True | | gateway_ip | 192.168.71.254 | | host_routes | | | id | c4485771-22be-4bed-8514-b87c14bbf1c9 | | ip_version | 4 | | ipv6_address_mode | None | | ipv6_ra_mode | None | | name | provider-net-sub | | network_id | 84d97504-ffd7-4c4e-b5b6-1066a7b1b97b | | project_id | d2dd7a9d467a4c5dbd2faf6944986d1b | | revision_number | 0 | | segment_id | None | | service_types | | | subnetpool_id | None | | tags | | | updated_at | 2024-09-27T11:10:28Z | +----------------------+--------------------------------------+--network使用来指定使用那个网络来创建子网，或者说给那个网络创建子网，这个名称要和我们创建网络时给的名称保持一致；这里需要说明一点，provider network是桥接到物理网卡上，所以这里的子网要根据你物理网络来划分子网；验证：导出
demo环境变量，看看demo用户是否有可用网络？[root@node01 ~]# source demo.sh [root@node01 ~]# openstack network list +--------------------------------------+--------------+--------------------------------------+ | ID | Name | Subnets | +--------------------------------------+--------------+--------------------------------------+ | 84d97504-ffd7-4c4e-b5b6-1066a7b1b97b | provider-net | c4485771-22be-4bed-8514-b87c14bbf1c9 | +--------------------------------------+--------------+--------------------------------------+创建虚拟机
[root@node01 ~]# openstack server create --flavor m1.nano --image cirros --nic net-id=84d97504-ffd7-4c4e-b5b6-1066a7b1b97b --security-group default --key-name demo_key provider-instance +-------------------------------------+-----------------------------------------------+ | Field | Value | +-------------------------------------+-----------------------------------------------+ | OS-DCF:diskConfig | MANUAL | | OS-EXT-AZ:availability_zone | | | OS-EXT-SRV-ATTR:host | None | | OS-EXT-SRV-ATTR:hypervisor_hostname | None | | OS-EXT-SRV-ATTR:instance_name | | | OS-EXT-STS:power_state | NOSTATE | | OS-EXT-STS:task_state | scheduling | | OS-EXT-STS:vm_state | building | | OS-SRV-USG:launched_at | None | | OS-SRV-USG:terminated_at | None | | accessIPv4 | | | accessIPv6 | | | addresses | | | adminPass | TsVzd3Xz9tHF | | config_drive | | | created | 2024-09-27T12:58:23Z | | flavor | m1.nano (0) | | hostId | | | id | e8b34357-91b8-4fdb-9477-c758e5159d9a | | image | cirros (514c6db8-1866-4ee4-b464-2c9eca88f0f9) | | key_name | demo_key | | name | provider-instance | | progress | 0 | | project_id | d2dd7a9d467a4c5dbd2faf6944986d1b | | properties | | | security_groups | name='bb511975-5f8d-4a08-8775-c4ac29f6c7a5' | | status | BUILD | | updated | 2024-09-27T12:58:23Z | | user_id | c4c0a73ca297489c9771b3d7e7814b53 | | volumes_attached | | +-------------------------------------+-----------------------------------------------+查看虚拟机状态
[root@node01 ~]# openstack server list +--------------------------------------+-------------------+--------+-----------------------------+--------+---------+ | ID | Name | Status | Networks | Image | Flavor | +--------------------------------------+-------------------+--------+-----------------------------+--------+---------+ | e8b34357-91b8-4fdb-9477-c758e5159d9a | provider-instance | ACTIVE | provider-net=192.168.71.136 | cirros | m1.nano | +--------------------------------------+-------------------+--------+-----------------------------+--------+---------+可以看到
provider-instance处于active状态，使用的网络上provicder-net，ip地址为192.168.71.136，使用的镜像是cirros镜像，使用的模板是m1.nano；验证：在计算节点使用
virsh命令看看是否能够看到启动的虚拟机？[root@node03 ~]# virsh list Id Name State ----------------------------------- 1 instance-0000000b running验证：使用其他主机
ping虚拟机的ip地址，看看是否能够ping通？
[root@node02 ~]# ping 192.168.71.136
PING 192.168.71.136 (192.168.71.136) 56(84) bytes of data.
64 bytes from 192.168.71.136: icmp_seq=1 ttl=64 time=9.37 ms
64 bytes from 192.168.71.136: icmp_seq=2 ttl=64 time=1.57 ms
64 bytes from 192.168.71.136: icmp_seq=3 ttl=64 time=0.976 ms查看虚拟机实例的vnc地址
[root@node01 ~]# openstack console url show provider-instance +----------+--------------------------------------------------------------------------------------------------+ | Field | Value | +----------+--------------------------------------------------------------------------------------------------+ | protocol | vnc | | type | novnc | | url | http://openstack-vip.net:6080/vnc_auto.html?path=%3Ftoken%3D6812dd5f-6ea7-4787-be01-81f869e1adc0 | +----------+--------------------------------------------------------------------------------------------------+ [root@node01 ~]#使用浏览器访问上述命令返回的
url，看看是否能够访问到对应虚拟机的vnc控制台？
使用
windows访问，需要在windows上对openstack-vip.net做地址解析；验证：登录虚拟机系统，看看虚拟机是否可正常访问外部网络？
可以看到使用虚拟机
ping外部网络能够正常ping通，并且虚拟机获取到地址和我们宿主机在同一网段中；说明我们基于provider network启动的虚拟机实例运行正常；
3. 基于self-sevice network创建虚拟机实例
在控制节点导出
demo用户环境变量，创建self-service network[root@node01 ~]# . demo.sh [root@node01 ~]# openstack network list +--------------------------------------+--------------+--------------------------------------+ | ID | Name | Subnets | +--------------------------------------+--------------+--------------------------------------+ | 84d97504-ffd7-4c4e-b5b6-1066a7b1b97b | provider-net | c4485771-22be-4bed-8514-b87c14bbf1c9 | | abc5cb2f-8c3f-446c-93f5-abca2c025455 | internal-net | fef662c5-ad1d-42ff-adc5-09583a911885 | +--------------------------------------+--------------+--------------------------------------+ [root@node01 ~]# openstack network create demo_selfservice_net +---------------------------+--------------------------------------+ | Field | Value | +---------------------------+--------------------------------------+ | admin_state_up | UP | | availability_zone_hints | | | availability_zones | | | created_at | 2024-10-04T23:30:59Z | | description | | | dns_domain | None | | id | f2ba3d1d-6c3f-46f0-bd6a-f7b004adaf28 | | ipv4_address_scope | None | | ipv6_address_scope | None | | is_default | False | | is_vlan_transparent | None | | mtu | 1450 | | name | demo_selfservice_net | | port_security_enabled | True | | project_id | d2dd7a9d467a4c5dbd2faf6944986d1b | | provider:network_type | vxlan | | provider:physical_network | None | | provider:segmentation_id | 616 | | qos_policy_id | None | | revision_number | 1 | | router:external | Internal | | segments | None | | shared | False | | status | ACTIVE | | subnets | | | tags | | | tenant_id | d2dd7a9d467a4c5dbd2faf6944986d1b | | updated_at | 2024-10-04T23:30:59Z | +---------------------------+--------------------------------------+创建
self-service network请确保/etc/neutron/plugins/ml2/ml2_conf.ini配置文件中的[ml2]配置段中配置的tenant_network_types = vxlan，以及[ml2_type_vxlan]配置段中配置的有vxlan的标识范围，如下所示
创建子网
[root@node01 ~]# openstack subnet create --network demo_selfservice_net --dns-nameserver 223.5.5.5 --gateway 10.0.0.254 --subnet-range 10.0.0.0/8 demo_selfservice_net_sub +----------------------+-----------------------------------------------+ | Field | Value | +----------------------+-----------------------------------------------+ | allocation_pools | 10.0.0.1-10.0.0.253,10.0.0.255-10.255.255.254 | | cidr | 10.0.0.0/8 | | created_at | 2024-10-04T23:31:27Z | | description | | | dns_nameservers | 223.5.5.5 | | dns_publish_fixed_ip | None | | enable_dhcp | True | | gateway_ip | 10.0.0.254 | | host_routes | | | id | d6fc6e40-9b4c-4f32-8fd5-1c4f43101004 | | ip_version | 4 | | ipv6_address_mode | None | | ipv6_ra_mode | None | | name | demo_selfservice_net_sub | | network_id | f2ba3d1d-6c3f-46f0-bd6a-f7b004adaf28 | | project_id | d2dd7a9d467a4c5dbd2faf6944986d1b | | revision_number | 0 | | segment_id | None | | service_types | | | subnetpool_id | None | | tags | | | updated_at | 2024-10-04T23:31:27Z | +----------------------+-----------------------------------------------+这里我们创建子网就不用
admin用户的环境变量，用demo用户的环境变量即可；因为self-service network创建的就是一个租户网络，由租户自行管理创建虚拟路由器
[root@node01 ~]# openstack router create demo_selfservice_net_sub_router1 +-------------------------+--------------------------------------+ | Field | Value | +-------------------------+--------------------------------------+ | admin_state_up | UP | | availability_zone_hints | | | availability_zones | | | created_at | 2024-10-04T23:31:49Z | | description | | | distributed | False | | enable_ndp_proxy | None | | external_gateway_info | null | | flavor_id | None | | ha | False | | id | f0411e8c-aab8-414b-9704-0322062a6bc8 | | name | demo_selfservice_net_sub_router1 | | project_id | d2dd7a9d467a4c5dbd2faf6944986d1b | | revision_number | 1 | | routes | | | status | ACTIVE | | tags | | | tenant_id | d2dd7a9d467a4c5dbd2faf6944986d1b | | updated_at | 2024-10-04T23:31:49Z | +-------------------------+--------------------------------------+将上面创建的子网添加到路由器
[root@node01 ~]# openstack router add subnet demo_selfservice_net_sub_router1 demo_selfservice_net_sub [root@node01 ~]#openstack router add subnet后面跟虚拟路由启动名称（或id）和子网的名称（或id）；设置虚拟路由器的上游网络，有点类似设置路由器的
wlan口网络[root@node01 ~]# openstack router set demo_selfservice_net_sub_router1 --external-gateway provider-net [root@node01 ~]#到此虚拟路由器就创建和配置完成
这里需要注意, 创建过程中, 新建的
route的内部接口显示为DOWN。这个应该是最新版本的bug。如果需要处理这个问题需要重启这个接口。可以在这个接口中, 点击取消掉启用管理员状态。取消之后再启用即可
或者直接运行命令关闭管理员状态
[root@node01 ~]# openstack port list | grep 10.0.0.253 | 21cfae2c-fd63-477d-93ff-af04c340298f | | fa:16:3e:a7:24:95 | ip_address='10.0.0.253', subnet_id='d6fc6e40-9b4c-4f32-8fd5-1c4f43101004' | DOWN | [root@node01 ~]# openstack port set --disable 21cfae2c-fd63-477d-93ff-af04c340298f [root@node01 ~]# openstack port set --enable 21cfae2c-fd63-477d-93ff-af04c340298f验证：在控制节点导出
admin用户环境变量，查看网络名称空间信息[root@node01 ~]# ip netns qdhcp-abc5cb2f-8c3f-446c-93f5-abca2c025455 (id: 0) qdhcp-84d97504-ffd7-4c4e-b5b6-1066a7b1b97b (id: 1) [root@node06 ~]# ip netns qrouter-f0411e8c-aab8-414b-9704-0322062a6bc8 (id: 1) qdhcp-f2ba3d1d-6c3f-46f0-bd6a-f7b004adaf28 (id: 0)能看到一个
qrouter名称空间和两个qdhcp名称空间。就表示我们创建的虚拟路由器没有问题；验证：列出路由器上的端口信息，看看对应端口是否是我们设置的网络ip地址信息？
[root@node01 ~]# openstack router list +--------------------------------------+----------------------------------+--------+-------+----------------------------------+-------------+-------+ | ID | Name | Status | State | Project | Distributed | HA | +--------------------------------------+----------------------------------+--------+-------+----------------------------------+-------------+-------+ | f0411e8c-aab8-414b-9704-0322062a6bc8 | demo_selfservice_net_sub_router1 | ACTIVE | UP | d2dd7a9d467a4c5dbd2faf6944986d1b | False | False | +--------------------------------------+----------------------------------+--------+-------+----------------------------------+-------------+-------+ [root@node01 ~]# openstack port list --router demo_selfservice_net_sub_router1 +--------------------------------------+------+-------------------+-------------------------------------------------------------------------------+--------+ | ID | Name | MAC Address | Fixed IP Addresses | Status | +--------------------------------------+------+-------------------+-------------------------------------------------------------------------------+--------+ | 16830365-e009-4cb8-a9b9-72f7137e7874 | | fa:16:3e:a6:cb:12 | ip_address='10.0.0.254', subnet_id='d6fc6e40-9b4c-4f32-8fd5-1c4f43101004' | ACTIVE | | e01dbda8-b833-4126-b9a8-dcf1cd3f63ae | | fa:16:3e:47:ac:d5 | ip_address='192.168.71.119', subnet_id='c4485771-22be-4bed-8514-b87c14bbf1c9' | ACTIVE | +--------------------------------------+------+-------------------+-------------------------------------------------------------------------------+--------+验证：查看路由器的网络接口信息
[root@node06 ~]# ip netns qrouter-f0411e8c-aab8-414b-9704-0322062a6bc8 (id: 1) qdhcp-f2ba3d1d-6c3f-46f0-bd6a-f7b004adaf28 (id: 0) [root@node06 ~]# ip netns exec qrouter-f0411e8c-aab8-414b-9704-0322062a6bc8 ifconfig lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536 inet 127.0.0.1 netmask 255.0.0.0 inet6 ::1 prefixlen 128 scopeid 0x10<host> loop txqueuelen 1000 (Local Loopback) RX packets 0 bytes 0 (0.0 B) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 0 bytes 0 (0.0 B) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 qg-e01dbda8-b8: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 inet 192.168.71.119 netmask 255.255.255.0 broadcast 192.168.71.255 inet6 fe80::f816:3eff:fe47:acd5 prefixlen 64 scopeid 0x20<link> ether fa:16:3e:47:ac:d5 txqueuelen 1000 (Ethernet) RX packets 592 bytes 88171 (86.1 KiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 18 bytes 1348 (1.3 KiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 qr-16830365-e0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1450 inet 10.0.0.254 netmask 255.0.0.0 broadcast 10.255.255.255 inet6 fe80::f816:3eff:fea6:cb12 prefixlen 64 scopeid 0x20<link> ether fa:16:3e:a6:cb:12 txqueuelen 1000 (Ethernet) RX packets 0 bytes 0 (0.0 B) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 13 bytes 998 (998.0 B) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0验证：在其他主机上
ping虚拟路由器地址，看看是否能够ping通？[root@node01 ~]# ping -c 4 192.168.71.119 PING 192.168.71.119 (192.168.71.119) 56(84) bytes of data. 64 bytes from 192.168.71.119: icmp_seq=1 ttl=64 time=1.60 ms 64 bytes from 192.168.71.119: icmp_seq=2 ttl=64 time=0.479 ms 64 bytes from 192.168.71.119: icmp_seq=3 ttl=64 time=0.755 ms 64 bytes from 192.168.71.119: icmp_seq=4 ttl=64 time=0.619 ms --- 192.168.71.119 ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 3045ms rtt min/avg/max/mdev = 0.479/0.864/1.604/0.438 ms到此，
self-service network就创建完成；启动一个虚拟机实例
在控制节点导出
demo用户环境变量，验证是否有可用的网络？[root@node01 ~]# . demo.sh [root@node01 ~]# openstack network list +--------------------------------------+----------------------+--------------------------------------+ | ID | Name | Subnets | +--------------------------------------+----------------------+--------------------------------------+ | 84d97504-ffd7-4c4e-b5b6-1066a7b1b97b | provider-net | c4485771-22be-4bed-8514-b87c14bbf1c9 | | abc5cb2f-8c3f-446c-93f5-abca2c025455 | internal-net | fef662c5-ad1d-42ff-adc5-09583a911885 | | f2ba3d1d-6c3f-46f0-bd6a-f7b004adaf28 | demo_selfservice_net | d6fc6e40-9b4c-4f32-8fd5-1c4f43101004 | +--------------------------------------+----------------------+--------------------------------------+可以看到现在又多了一个网络；
创建虚拟机
[root@node01 ~]# openstack server create --flavor m1.nano --image cirros --nic net-id=f2ba3d1d-6c3f-46f0-bd6a-f7b004adaf28 --security-group bb511975-5f8d-4a08-8775-c4ac29f6c7a5 --key-name demo_key demo_vm2 +-------------------------------------+-----------------------------------------------+ | Field | Value | +-------------------------------------+-----------------------------------------------+ | OS-DCF:diskConfig | MANUAL | | OS-EXT-AZ:availability_zone | | | OS-EXT-SRV-ATTR:host | None | | OS-EXT-SRV-ATTR:hypervisor_hostname | None | | OS-EXT-SRV-ATTR:instance_name | | | OS-EXT-STS:power_state | NOSTATE | | OS-EXT-STS:task_state | scheduling | | OS-EXT-STS:vm_state | building | | OS-SRV-USG:launched_at | None | | OS-SRV-USG:terminated_at | None | | accessIPv4 | | | accessIPv6 | | | addresses | | | adminPass | 8pdJoU7FyLuU | | config_drive | | | created | 2024-10-04T23:36:24Z | | flavor | m1.nano (0) | | hostId | | | id | 3c1686c1-0068-41a7-9c55-33c7026940f1 | | image | cirros (514c6db8-1866-4ee4-b464-2c9eca88f0f9) | | key_name | demo_key | | name | demo_vm2 | | progress | 0 | | project_id | d2dd7a9d467a4c5dbd2faf6944986d1b | | properties | | | security_groups | name='bb511975-5f8d-4a08-8775-c4ac29f6c7a5' | | status | BUILD | | updated | 2024-10-04T23:36:24Z | | user_id | c4c0a73ca297489c9771b3d7e7814b53 | | volumes_attached | | +-------------------------------------+-----------------------------------------------+查看当前用户虚拟机列表
[root@node01 ~]# openstack server list +--------------------------------------+----------+---------+----------------------------------------------------------+--------+---------+ | ID | Name | Status | Networks | Image | Flavor | +--------------------------------------+----------+---------+----------------------------------------------------------+--------+---------+ | 3c1686c1-0068-41a7-9c55-33c7026940f1 | demo_vm2 | ACTIVE | demo_selfservice_net=10.0.0.121 | cirros | m1.nano | | a16ee05b-32db-4ed1-9b3f-f5a5bb654ed1 | 111111 | SHUTOFF | internal-net=192.168.10.172; provider-net=192.168.71.131 | cirros | m2.nano | | 57ebe263-ba50-4602-b49a-23d312169119 | test | SHUTOFF | internal-net=192.168.10.161; provider-net=192.168.71.130 | cirros | m2.nano | +--------------------------------------+----------+---------+----------------------------------------------------------+--------+---------+可以看到
demo_vm2已经运行，并且所使用的ip地址是10.0.0.21；查看虚拟机的
vnc地址[root@node01 ~]# openstack console url show demo_vm2 +----------+--------------------------------------------------------------------------------------------------+ | Field | Value | +----------+--------------------------------------------------------------------------------------------------+ | protocol | vnc | | type | novnc | | url | http://openstack-vip.net:6080/vnc_auto.html?path=%3Ftoken%3De4acb442-10e3-437a-a35c-514ff91da3ad | +----------+--------------------------------------------------------------------------------------------------+验证：使用浏览器访问，看看是否能够访问到对应的虚拟机vnc界面？
可以看到能够使用返回的
url访问到demo_vm2实例；验证：登录虚拟机系统，查看
ip地址是否是我们指定的网络？
验证：是否可以和外部网络通信？
可以看到虚拟机是可以正常和外部网络通信；
查看虚拟机的路由，看看网关是否是我们指定的网关呢？
验证：在控制节点使用
ssh连接demo_vm2,看看是否能够正常连接呢？
很明显使用外部网络是无法正常连接到虚拟机；
使用路由器的网络名称空间，连接虚拟机
[root@node06 ~]# ip netns qrouter-f0411e8c-aab8-414b-9704-0322062a6bc8 (id: 1) qdhcp-f2ba3d1d-6c3f-46f0-bd6a-f7b004adaf28 (id: 0) [root@node06 ~]# ip netns exec qrouter-f0411e8c-aab8-414b-9704-0322062a6bc8 ssh cirros@10.0.0.121 The authenticity of host '10.0.0.121 (10.0.0.121)' can't be established. ECDSA key fingerprint is SHA256:Ry5iRF4ttb7ZBYkvGJTGrlDNLQxxwibcWJNShWs6SKU. This key is not known by any other names Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '10.0.0.121' (ECDSA) to the list of known hosts. cirros@10.0.0.121's password: $ ip a 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc pfifo_fast qlen 1000 link/ether fa:16:3e:67:05:7c brd ff:ff:ff:ff:ff:ff inet 10.0.0.121/8 brd 10.255.255.255 scope global eth0 valid_lft forever preferred_lft forever inet6 fe80::f816:3eff:fe67:57c/64 scope link valid_lft forever preferred_lft forever $使用虚拟路由器的网络名称空间是可以正常从外部网络访问到虚拟机；
设定
nat一对一绑定，实现外部网络能够正常访问到虚拟机在
provider-net网络中创建一个流动ip，用于外部访问内部虚拟机的流量接入地址[root@node01 ~]# openstack floating ip create provider-net +---------------------+--------------------------------------+ | Field | Value | +---------------------+--------------------------------------+ | created_at | 2024-10-04T23:45:39Z | | description | | | dns_domain | None | | dns_name | None | | fixed_ip_address | None | | floating_ip_address | 192.168.71.120 | | floating_network_id | 84d97504-ffd7-4c4e-b5b6-1066a7b1b97b | | id | d30cde40-df60-4f5c-b2fd-8f5b13eef1cf | | name | 192.168.71.120 | | port_details | None | | port_id | None | | project_id | d2dd7a9d467a4c5dbd2faf6944986d1b | | qos_policy_id | None | | revision_number | 0 | | router_id | None | | status | DOWN | | subnet_id | None | | tags | [] | | updated_at | 2024-10-04T23:45:39Z | +---------------------+--------------------------------------+ [root@node01 ~]# openstack floating ip list +--------------------------------------+---------------------+------------------+------+--------------------------------------+----------------------------------+ | ID | Floating IP Address | Fixed IP Address | Port | Floating Network | Project | +--------------------------------------+---------------------+------------------+------+--------------------------------------+----------------------------------+ | 639bdab0-fdee-45ea-a15c-871d3b49959f | 192.168.71.128 | None | None | 84d97504-ffd7-4c4e-b5b6-1066a7b1b97b | d2dd7a9d467a4c5dbd2faf6944986d1b | | d30cde40-df60-4f5c-b2fd-8f5b13eef1cf | 192.168.71.120 | None | None | 84d97504-ffd7-4c4e-b5b6-1066a7b1b97b | d2dd7a9d467a4c5dbd2faf6944986d1b | +--------------------------------------+---------------------+------------------+------+--------------------------------------+----------------------------------+可以看到流动
ip地址为192.168.71.120；将生成的流动
ip地址和虚拟机实例做绑定[root@node01 ~]# openstack server add floating ip demo_vm2 192.168.71.120 [root@node01 ~]#再次查看当前用户虚拟机实例
[root@node01 ~]# openstack server list +--------------------------------------+----------+---------+----------------------------------------------------------+--------+---------+ | ID | Name | Status | Networks | Image | Flavor | +--------------------------------------+----------+---------+----------------------------------------------------------+--------+---------+ | 3c1686c1-0068-41a7-9c55-33c7026940f1 | demo_vm2 | ACTIVE | demo_selfservice_net=10.0.0.121, 192.168.71.120 | cirros | m1.nano | | a16ee05b-32db-4ed1-9b3f-f5a5bb654ed1 | 111111 | SHUTOFF | internal-net=192.168.10.172; provider-net=192.168.71.131 | cirros | m2.nano | | 57ebe263-ba50-4602-b49a-23d312169119 | test | SHUTOFF | internal-net=192.168.10.161; provider-net=192.168.71.130 | cirros | m2.nano | +--------------------------------------+----------+---------+----------------------------------------------------------+--------+---------+可以看到流动
ip已经在demo_vm2的网卡上了；验证：使用其他主机
ping192.168.71.120是否可ping通？
验证：使用外部主机用
ssh连接192.168.71.120，看看是否连接至虚拟机？[root@node01 ~]# ssh cirros@192.168.71.120 The authenticity of host '192.168.71.120 (192.168.71.120)' can't be established. ECDSA key fingerprint is SHA256:Ry5iRF4ttb7ZBYkvGJTGrlDNLQxxwibcWJNShWs6SKU. This key is not known by any other names Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '192.168.71.120' (ECDSA) to the list of known hosts. cirros@192.168.71.120's password: $ ip a 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc pfifo_fast qlen 1000 link/ether fa:16:3e:67:05:7c brd ff:ff:ff:ff:ff:ff inet 10.0.0.121/8 brd 10.255.255.255 scope global eth0 valid_lft forever preferred_lft forever inet6 fe80::f816:3eff:fe67:57c/64 scope link valid_lft forever preferred_lft forever $可以看到现在外部主机通过连接流动
ip地址，就可以直接和虚拟机通信；其实在我们给虚拟机添加浮动ip时，它就在虚拟路由器的iptables表中增加了一条DNAT规则，如下所示
上面的
DANT规则说明了为什么外部网络访问浮动ip地址能够访问到内网虚拟机；到此基于
self-service network启动的虚拟机实例配置测试就完成了；
参考链接
云计算管理平台之OpenStack启动虚拟机实例 - Linux-1874 - 博客园 (cnblogs.com)