1. 项目概述在当今云计算时代OpenStack作为开源云计算平台的标杆已经成为企业构建私有云和混合云的首选方案。作为一名在云计算领域摸爬滚打多年的工程师我最近在Ubuntu 22.04 LTS上完成了一个OpenStack部署项目实现了多租户虚拟化和弹性伸缩功能。这个方案特别适合中小型企业、教育机构和研发团队能够以较低成本获得接近商业云服务的体验。Ubuntu 22.04 LTS作为长期支持版本提供了稳定的基础环境而OpenStack则带来了完整的IaaS能力。通过这个组合我们可以实现虚拟机实例的快速部署、网络隔离、存储管理和自动扩缩容等核心功能。本文将详细记录我从零开始部署的全过程包括环境准备、核心组件配置、性能优化以及实际使用中遇到的坑和解决方案。2. 环境准备与基础配置2.1 硬件需求规划OpenStack对硬件资源有一定要求合理的规划可以避免后续性能瓶颈。根据我的经验最小化生产环境需要控制节点至少16核CPU64GB内存500GB SSD系统数据库1TB HDD镜像存储计算节点根据虚拟机密度规划每台建议32核CPU128GB内存2TB SSD实例存储网络万兆网卡至少2块建议使用bonding提高可靠性提示如果是测试环境可以使用一台配置较高的服务器如32核/128GB部署All-in-One模式但要注意这种配置不适合生产环境。2.2 操作系统基础配置首先在Ubuntu 22.04 LTS上做一些必要的系统级优化# 更新系统 sudo apt update sudo apt upgrade -y # 安装基础工具 sudo apt install -y git python3-dev python3-pip libffi-dev gcc libssl-dev # 禁用防火墙OpenStack会管理自己的防火墙规则 sudo systemctl stop ufw sudo systemctl disable ufw # 配置NTP时间同步 sudo apt install -y chrony sudo systemctl enable chrony sudo systemctl start chrony # 修改主机名并更新/etc/hosts sudo hostnamectl set-hostname controller echo 127.0.0.1 controller | sudo tee -a /etc/hosts2.3 网络规划与配置网络是OpenStack最复杂的部分之一建议提前规划好以下网络管理网络用于节点间通信如10.0.0.0/24租户网络虚拟机使用的网络如192.168.1.0/24外部网络提供浮动IP如公共IP段配置网络接口以双网卡为例# /etc/netplan/00-installer-config.yaml network: version: 2 renderer: networkd ethernets: enp1s0: addresses: [10.0.0.10/24] gateway4: 10.0.0.1 nameservers: addresses: [8.8.8.8, 8.8.4.4] enp2s0: {} bonds: bond0: interfaces: [enp2s0] addresses: []应用配置sudo netplan apply3. OpenStack核心组件部署3.1 数据库与消息队列安装OpenStack依赖MySQL和RabbitMQ# 安装MySQL sudo apt install -y mariadb-server python3-pymysql # 配置MySQL sudo mysql_secure_installation # 创建OpenStack数据库和用户 sudo mysql -u root -p EOF CREATE DATABASE keystone; CREATE DATABASE glance; CREATE DATABASE nova; CREATE DATABASE neutron; CREATE DATABASE cinder; CREATE DATABASE heat; GRANT ALL PRIVILEGES ON keystone.* TO keystonelocalhost IDENTIFIED BY KEYSTONE_DBPASS; GRANT ALL PRIVILEGES ON glance.* TO glancelocalhost IDENTIFIED BY GLANCE_DBPASS; GRANT ALL PRIVILEGES ON nova.* TO novalocalhost IDENTIFIED BY NOVA_DBPASS; GRANT ALL PRIVILEGES ON neutron.* TO neutronlocalhost IDENTIFIED BY NEUTRON_DBPASS; GRANT ALL PRIVILEGES ON cinder.* TO cinderlocalhost IDENTIFIED BY CINDER_DBPASS; GRANT ALL PRIVILEGES ON heat.* TO heatlocalhost IDENTIFIED BY HEAT_DBPASS; EOF # 安装RabbitMQ sudo apt install -y rabbitmq-server sudo rabbitmqctl add_user openstack RABBIT_PASS sudo rabbitmqctl set_permissions openstack .* .* .*3.2 Keystone身份服务部署Keystone是OpenStack的身份认证核心# 安装Keystone sudo apt install -y keystone apache2 libapache2-mod-wsgi-py3 # 配置/etc/keystone/keystone.conf [database] connection mysqlpymysql://keystone:KEYSTONE_DBPASScontroller/keystone [token] provider fernet # 初始化数据库 sudo su -s /bin/sh -c keystone-manage db_sync keystone # 初始化Fernet密钥 keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone keystone-manage credential_setup --keystone-user keystone --keystone-group keystone # 启动服务 keystone-manage bootstrap --bootstrap-password ADMIN_PASS \ --bootstrap-admin-url http://controller:5000/v3/ \ --bootstrap-internal-url http://controller:5000/v3/ \ --bootstrap-public-url http://controller:5000/v3/ \ --bootstrap-region-id RegionOne # 配置Apache echo ServerName controller | sudo tee /etc/apache2/conf-available/servername.conf sudo a2enconf servername sudo systemctl restart apache23.3 Glance镜像服务部署Glance管理虚拟机镜像# 创建Glance用户和端点 openstack user create --domain default --password GLANCE_PASS glance openstack role add --project service --user glance admin openstack service create --name glance --description OpenStack Image image openstack endpoint create --region RegionOne image public http://controller:9292 openstack endpoint create --region RegionOne image internal http://controller:9292 openstack endpoint create --region RegionOne image admin http://controller:9292 # 安装Glance sudo apt install -y glance # 配置/etc/glance/glance-api.conf [database] connection mysqlpymysql://glance:GLANCE_DBPASScontroller/glance [keystone_authtoken] www_authenticate_uri http://controller:5000 auth_url http://controller:5000 memcached_servers controller:11211 auth_type password project_domain_name Default user_domain_name Default project_name service username glance password GLANCE_PASS [paste_deploy] flavor keystone [glance_store] stores file,http default_store file filesystem_store_datadir /var/lib/glance/images/ # 初始化数据库 sudo su -s /bin/sh -c glance-manage db_sync glance # 启动服务 sudo systemctl enable glance-api sudo systemctl start glance-api # 上传测试镜像 wget http://download.cirros-cloud.net/0.5.2/cirros-0.5.2-x86_64-disk.img openstack image create cirros \ --file cirros-0.5.2-x86_64-disk.img \ --disk-format qcow2 --container-format bare \ --public4. 计算服务与网络部署4.1 Nova计算服务配置Nova负责虚拟机生命周期管理# 创建Nova用户和端点 openstack user create --domain default --password NOVA_PASS nova openstack role add --project service --user nova admin openstack service create --name nova --description OpenStack Compute compute openstack endpoint create --region RegionOne compute public http://controller:8774/v2.1 openstack endpoint create --region RegionOne compute internal http://controller:8774/v2.1 openstack endpoint create --region RegionOne compute admin http://controller:8774/v2.1 # 安装Nova组件 sudo apt install -y nova-api nova-conductor nova-novncproxy nova-scheduler # 配置/etc/nova/nova.conf [api_database] connection mysqlpymysql://nova:NOVA_DBPASScontroller/nova_api [database] connection mysqlpymysql://nova:NOVA_DBPASScontroller/nova [default] transport_url rabbit://openstack:RABBIT_PASScontroller:5672/ my_ip 10.0.0.10 use_neutron true firewall_driver nova.virt.firewall.NoopFirewallDriver [api] auth_strategy keystone [keystone_authtoken] www_authenticate_uri http://controller:5000/ auth_url http://controller:5000/ memcached_servers controller:11211 auth_type password project_domain_name default user_domain_name default project_name service username nova password NOVA_PASS [vnc] enabled true server_listen $my_ip server_proxyclient_address $my_ip [glance] api_servers http://controller:9292 [oslo_concurrency] lock_path /var/lib/nova/tmp [placement] region_name RegionOne project_domain_name Default project_name service auth_type password user_domain_name Default auth_url http://controller:5000/v3 username placement password PLACEMENT_PASS # 初始化数据库 sudo su -s /bin/sh -c nova-manage api_db sync nova sudo su -s /bin/sh -c nova-manage cell_v2 map_cell0 nova sudo su -s /bin/sh -c nova-manage cell_v2 create_cell --namecell1 --verbose nova sudo su -s /bin/sh -c nova-manage db sync nova # 启动服务 sudo systemctl enable nova-api nova-conductor nova-novncproxy nova-scheduler sudo systemctl start nova-api nova-conductor nova-novncproxy nova-scheduler4.2 Neutron网络服务配置Neutron提供网络虚拟化功能# 创建Neutron用户和端点 openstack user create --domain default --password NEUTRON_PASS neutron openstack role add --project service --user neutron admin openstack service create --name neutron --description OpenStack Networking network openstack endpoint create --region RegionOne network public http://controller:9696 openstack endpoint create --region RegionOne network internal http://controller:9696 openstack endpoint create --region RegionOne network admin http://controller:9696 # 安装Neutron组件 sudo apt install -y neutron-server neutron-plugin-ml2 \ neutron-linuxbridge-agent neutron-l3-agent neutron-dhcp-agent \ neutron-metadata-agent # 配置/etc/neutron/neutron.conf [database] connection mysqlpymysql://neutron:NEUTRON_DBPASScontroller/neutron [default] core_plugin ml2 service_plugins router allow_overlapping_ips true transport_url rabbit://openstack:RABBIT_PASScontroller:5672/ auth_strategy keystone [keystone_authtoken] www_authenticate_uri http://controller:5000 auth_url http://controller:5000 memcached_servers controller:11211 auth_type password project_domain_name default user_domain_name default project_name service username neutron password NEUTRON_PASS [oslo_concurrency] lock_path /var/lib/neutron/tmp # 配置/etc/neutron/plugins/ml2/ml2_conf.ini [ml2] type_drivers flat,vlan,vxlan tenant_network_types vxlan mechanism_drivers linuxbridge,l2population extension_drivers port_security [ml2_type_flat] flat_networks provider [ml2_type_vxlan] vni_ranges 1:1000 [securitygroup] enable_ipset true # 配置/etc/neutron/plugins/ml2/linuxbridge_agent.ini [linux_bridge] physical_interface_mappings provider:enp2s0 [vxlan] enable_vxlan true local_ip 10.0.0.10 l2_population true [securitygroup] enable_security_group true firewall_driver neutron.agent.linux.iptables_firewall.IptablesFirewallDriver # 配置/etc/neutron/l3_agent.ini [default] interface_driver linuxbridge # 配置/etc/neutron/dhcp_agent.ini [default] interface_driver linuxbridge dhcp_driver neutron.agent.linux.dhcp.Dnsmasq enable_isolated_metadata true # 配置/etc/neutron/metadata_agent.ini [default] nova_metadata_host controller metadata_proxy_shared_secret METADATA_SECRET # 链接配置文件 sudo ln -s /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugin.ini # 初始化数据库 sudo su -s /bin/sh -c neutron-db-manage --config-file /etc/neutron/neutron.conf \ --config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade head neutron # 重启服务 sudo systemctl restart nova-api sudo systemctl enable neutron-server neutron-linuxbridge-agent neutron-dhcp-agent \ neutron-metadata-agent neutron-l3-agent sudo systemctl start neutron-server neutron-linuxbridge-agent neutron-dhcp-agent \ neutron-metadata-agent neutron-l3-agent5. 多租户与弹性伸缩实现5.1 多租户隔离配置OpenStack通过项目和用户实现多租户隔离# 创建示例租户和用户 openstack project create --description Demo Project demo openstack user create --domain default --password DEMO_PASS demo openstack role add --project demo --user demo user # 创建网络和安全组 openstack network create demo-net openstack subnet create --network demo-net --subnet-range 192.168.1.0/24 \ --gateway 192.168.1.1 --dns-nameserver 8.8.8.8 demo-subnet openstack security group create demo-sg openstack security group rule create --ingress --protocol tcp --dst-port 22 demo-sg openstack security group rule create --ingress --protocol icmp demo-sg # 创建路由器并连接外部网络 openstack router create demo-router openstack router set --external-gateway public demo-router openstack router add subnet demo-router demo-subnet5.2 弹性伸缩配置使用Heat和Ceilometer实现自动伸缩# 安装Ceilometer和Heat sudo apt install -y ceilometer-api ceilometer-collector \ ceilometer-agent-central ceilometer-agent-notification \ ceilometer-alarm-evaluator ceilometer-alarm-notifier \ python3-ceilometerclient heat-api heat-api-cfn heat-engine # 配置/etc/ceilometer/ceilometer.conf [database] connection mysqlpymysql://ceilometer:CEILOMETER_DBPASScontroller/ceilometer [default] transport_url rabbit://openstack:RABBIT_PASScontroller:5672/ [service_credentials] auth_url http://controller:5000/v3 project_name service username ceilometer password CEILOMETER_PASS interface internalURL region_name RegionOne # 配置/etc/heat/heat.conf [database] connection mysqlpymysql://heat:HEAT_DBPASScontroller/heat [default] transport_url rabbit://openstack:RABBIT_PASScontroller:5672/ heat_metadata_server_url http://controller:8000 heat_waitcondition_server_url http://controller:8000/v1/waitcondition [keystone_authtoken] www_authenticate_uri http://controller:5000 auth_url http://controller:5000 memcached_servers controller:11211 auth_type password project_domain_name default user_domain_name default project_name service username heat password HEAT_PASS [trustee] auth_type password auth_url http://controller:5000 username heat password HEAT_PASS user_domain_name default [clients_keystone] auth_uri http://controller:5000 [oslo_messaging_notifications] driver messagingv2 transport_url rabbit://openstack:RABBIT_PASScontroller:5672/ # 初始化数据库 sudo su -s /bin/sh -c ceilometer-upgrade --skip-gnocchi-resource-types ceilometer sudo su -s /bin/sh -c heat-manage db_sync heat # 启动服务 sudo systemctl enable ceilometer-api ceilometer-collector \ ceilometer-agent-central ceilometer-agent-notification \ ceilometer-alarm-evaluator ceilometer-alarm-notifier \ heat-api heat-api-cfn heat-engine sudo systemctl start ceilometer-api ceilometer-collector \ ceilometer-agent-central ceilometer-agent-notification \ ceilometer-alarm-evaluator ceilometer-alarm-notifier \ heat-api heat-api-cfn heat-engine5.3 创建自动伸缩模板创建一个HOT模板实现基于CPU使用率的自动伸缩# autoscaling.yaml heat_template_version: 2015-04-30 description: Auto-scaling example with CPU monitoring parameters: image: type: string default: cirros flavor: type: string default: m1.tiny network: type: string default: demo-net subnet: type: string default: demo-subnet security_group: type: string default: demo-sg scaling_min: type: number default: 1 scaling_max: type: number default: 3 cpu_threshold: type: number default: 50.0 resources: server_group: type: OS::Heat::AutoScalingGroup properties: min_size: { get_param: scaling_min } max_size: { get_param: scaling_max } resource: type: OS::Nova::Server properties: image: { get_param: image } flavor: { get_param: flavor } networks: - network: { get_param: network } security_groups: - { get_param: security_group } cpu_alarm_high: type: OS::Ceilometer::Alarm properties: description: Scale-up if CPU 50% for 1 minute meter_name: cpu_util statistic: avg period: 60 evaluation_periods: 1 threshold: { get_param: cpu_threshold } comparison_operator: gt alarm_actions: - { get_attr: [server_group, scaleup_url] } matching_metadata: {metadata.user_metadata.stack: {get_param: OS::stack_id}} cpu_alarm_low: type: OS::Ceilometer::Alarm properties: description: Scale-down if CPU 15% for 5 minutes meter_name: cpu_util statistic: avg period: 300 evaluation_periods: 1 threshold: 15.0 comparison_operator: lt alarm_actions: - { get_attr: [server_group, scaledown_url] } matching_metadata: {metadata.user_metadata.stack: {get_param: OS::stack_id}} outputs: group_size: description: Current size of the server group value: { get_attr: [server_group, current_size] }部署模板openstack stack create -t autoscaling.yaml autoscale-demo6. 性能优化与运维技巧6.1 数据库优化OpenStack重度依赖数据库优化MariaDB配置# /etc/mysql/mariadb.conf.d/99-openstack.cnf [mysqld] innodb_buffer_pool_size 4G innodb_log_file_size 512M innodb_flush_log_at_trx_commit 2 innodb_flush_method O_DIRECT innodb_file_per_table ON innodb_thread_concurrency 0 query_cache_size 0 max_connections 1000重启MySQLsudo systemctl restart mariadb6.2 消息队列优化调整RabbitMQ配置提高性能# /etc/rabbitmq/rabbitmq.conf vm_memory_high_watermark.relative 0.6 disk_free_limit.absolute 2GB loopback_users none重启RabbitMQsudo systemctl restart rabbitmq-server6.3 Nova调度优化修改Nova调度策略提高效率# /etc/nova/nova.conf [scheduler] driver filter_scheduler available_filters nova.scheduler.filters.all_filters enabled_filters RetryFilter, AvailabilityZoneFilter, ComputeFilter, ComputeCapabilitiesFilter, ImagePropertiesFilter, ServerGroupAntiAffinityFilter, ServerGroupAffinityFilter [filter_scheduler] max_attempts 10重启Nova调度器sudo systemctl restart nova-scheduler6.4 网络性能优化针对Neutron网络组件的优化建议启用巨帧Jumbo Frame提高网络吞吐sudo ip link set enp2s0 mtu 9000调整Linux网桥参数echo net.bridge.bridge-nf-call-iptables0 | sudo tee -a /etc/sysctl.conf echo net.bridge.bridge-nf-call-ip6tables0 | sudo tee -a /etc/sysctl.conf sudo sysctl -p优化Neutron的DHCP租期# /etc/neutron/dhcp_agent.ini [DEFAULT] dhcp_lease_duration 864007. 常见问题排查与解决7.1 虚拟机启动失败现象实例状态显示为Error日志中出现no valid host was found排查步骤检查Nova计算服务状态nova service-list查看调度日志grep Filtering /var/log/nova/nova-scheduler.log检查计算节点资源nova hypervisor-show hypervisor-id解决方案确保计算节点有足够资源检查网络连接和防火墙规则验证镜像和规格兼容性7.2 网络连接问题现象虚拟机无法获取IP或无法访问外网排查步骤检查DHCP代理neutron agent-list | grep DHCP查看命名空间ip netns list检查路由表neutron router-show router-id解决方案重启Neutron服务sudo systemctl restart neutron-*检查外部网络配置验证安全组规则7.3 弹性伸缩不生效现象CPU负载高但未触发扩容排查步骤检查Ceilometer数据ceilometer statistics -m cpu_util -q resource_idinstance-id查看告警状态openstack alarm list检查Heat引擎日志journalctl -u heat-engine解决方案确保Ceilometer服务正常运行验证告警阈值设置检查自动伸缩组策略7.4 性能监控与日志收集建议部署以下工具辅助运维Prometheus Grafana监控# 安装Node Exporter wget https://github.com/prometheus/node_exporter/releases/download/v1.3.1/node_exporter-1.3.1.linux-amd64.tar.gz tar xvfz node_exporter-*.tar.gz cd node_exporter-* ./node_exporter ELK日志收集# 安装Filebeat curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-8.4.1-amd64.deb sudo dpkg -i filebeat-8.4.1-amd64.deb # 配置/etc/filebeat/filebeat.yml filebeat.inputs: - type: log enabled: true paths: - /var/log/nova/*.log - /var/log/neutron/*.log - /var/log/keystone/*.log定期数据库备份# 创建备份脚本 #!/bin/bash mysqldump -u root -p --all-databases /backup/openstack-db-$(date %Y%m%d).sql8. 安全加固建议8.1 Keystone安全配置启用多因素认证openstack identity provider create --remote-id https://idp.example.com --domain default example_idp openstack mapping create --rules rules.json example_mapping openstack federation protocol create --identity-provider example_idp --mapping example_mapping saml2限制管理员访问# /etc/keystone/keystone.conf [oslo_policy] enforce_scope true enforce_new_defaults true8.2 实例安全最佳实践使用SSH密钥对openstack keypair create --public-key ~/.ssh/id_rsa.pub mykey最小化安全组规则openstack security group rule create --protocol tcp --dst-port 22 --ingress default定期更新镜像openstack image set --property os_distroubuntu --property os_version22.04 my-image8.3 网络隔离策略启用安全组# /etc/neutron/plugins/ml2/ml2_conf.ini [securitygroup] enable_security_group true firewall_driver neutron.agent.linux.iptables_firewall.IptablesFirewallDriver配置网络分段openstack network segment create --network demo-net --physical-network physnet1 \ --network-type vlan --segment 100 demo-segment启用端口安全# /etc/neutron/plugins/ml2/ml2_conf.ini [ml2] extension_drivers port_security9. 升级与维护策略9.1 版本升级路径Ubuntu 22.04 LTS支持的OpenStack版本升级顺序备份所有数据库和配置文件按顺序升级Queens → Rocky → Stein → Train → Ussuri → Victoria → Wallaby → Yoga每次升级后运行健康检查9.2 日常维护任务数据库维护nova-manage db archive_deleted_rows --max_rows 1000 neutron-db-manage --config-file /etc/neutron/neutron.conf purge日志轮转配置# /etc/logrotate.d/openstack /var/log/nova/*.log { daily missingok rotate 7 compress delaycompress notifempty create 640 nova nova }资源清理脚本#!/bin/bash # 清理超过30天的未使用镜像 openstack image list --status active --property created_atgt:$(date -d 30 days ago %Y-%m-%d) -f value -c ID | xargs -r openstack image delete9.3 监控指标阈值建议关键监控指标及告警阈值指标警告阈值严重阈值检查频率CPU使用率70%90%1分钟内存使用率80%95%1分钟磁盘空间使用率85%95%5分钟API响应时间500ms1000ms1分钟数据库连接数80%最大连接数90%最大连接数5分钟在实际部署中我发现OpenStack的性能很大程度上取决于底层硬件的质量。特别是网络性能使用万兆网卡和适当的交换机配置可以显著提高虚拟机的网络吞吐量。另一个关键点是数据库优化通过合理配置InnoDB缓冲池大小和日志文件大小可以大幅提升整体性能。