OpenStack API部分高可用配置（一）

 

1、概況與原理

 

 

 

 

1）所須要的配置組件有：pacemaker+corosync+HAProxy

2）主要原理：HAProxy做爲負載均衡器，將對openstack api服務的請求分發到兩個鏡像的控制節點上，因爲openstack api服務是無狀態的服務，因此不存在數據同步的問題。具體爲在pacemaker中配置一個VIP，HAProxy負責監聽這個VIP，將對這個VIP的請求分發到兩臺控制節點上，同時HAProxy自己做爲pacemaker的資源實現高可用性。另外，需在openstack中修改API服務的endpoint爲VIP，同時對於服務的調用地址改成VIP。

3) 目前只配置了keystone部分，其餘部分狀況相似。

 

2、pacemaker+corosync+crmsh安裝

1、前提條件

node1：

(1)各節點之間主機名互相解析

uname -n

>node1.test.com

 

vim /etc/hosts

>127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4

>::1         localhost localhost.localdomain localhost6 localhost6.localdomain6 

>192.168.18.201  node1.test.com  node1 

>192.168.18.202  node2.test.com  node2

ping node1

ping node2

(2).各節點之間時間同步   

ntpdate 210.72.145.44

(3).各節點之間ssh互信  

ssh-keygen  -t rsa -f ~/.ssh/id_rsa  -P ''  

ssh-copy-id -i .ssh/id_rsa.pub root@node2.test.com

 

node2:

(1).各節點之間主機名互相解析

uname -n

>node2.test.com

vim /etc/hosts

>127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4

>::1         localhost localhost.localdomain localhost6 localhost6.localdomain6 

>192.168.18.201  node1.test.com  node1 

>192.168.18.202  node2.test.com  node2

ping node1

ping node2

(2).各節點之間時間同步   

ntpdate 210.72.145.44

(3).各節點之間ssh互信  

ssh-keygen  -t rsa -f ~/.ssh/id_rsa  -P ''  

ssh-copy-id -i .ssh/id_rsa.pub root@node1.test.com

 

配置yum源(EPEL源)

node1:

wget http://download.fedoraproject.org/pub/epel/5/x86_64/epel-release-5-4.noarch.rpm

rpm -ivh epel-release-5-4.noarch.rpm

rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-5

yum list

 

node2:

wget http://download.fedoraproject.org/pub/epel/5/x86_64/epel-release-5-4.noarch.rpm

rpm -ivh epel-release-5-4.noarch.rpm

rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-5

yum list

 

關閉防火牆與SELinux

node1:

service iptables stop

vim /etc/selinux/config

># This file controls the state of SELinux on the system.

># SELINUX= can take one of these three values:

>#       enforcing - SELinux security policy is enforced.

>#       permissive - SELinux prints warnings instead of enforcing.

>#       disabled - SELinux is fully disabled.

>SELINUX=disabled

># SELINUXTYPE= type of policy in use. Possible values are:

>#       targeted - Only targeted network daemons are protected.

>#       strict - Full SELinux protection.

>SELINUXTYPE=targeted

 

node2:

service iptables stop

vim /etc/selinux/config

>SELINUX=disabled

>SELINUXTYPE=targeted

 

2、安裝pacemaker+corosync+crmsh

 

node1+node2:

安裝pacemaker+corosync

yum install -y corosync*

yum install -y pacemaker*

 

安裝crmsh

1）crmsh官方網站

https://savannah.nongnu.org/forum/forum.php?forum_id=7672

2）crmsh下載地址

http://download.opensuse.org/repositories/network:/ha-clustering:/Stable/

3）安裝crmsh【若是缺乏依賴包再安裝依賴包】

rpm -ivh crmsh-1.2.6-0.rc2.2.1.x86_64.rpm

4）驗證配置：

crm

 

 

 

 

3、Corosync 詳細配置

 

node1:

修改配置文件

vim  /etc/corosync/corosync.conf

>>> 

totem {

        version: 2

 

        # Time (in ms) to wait for a token  1

        token: 10000

 

        # How many token retransmits before forming a new

        # configuration

        token_retransmits_before_loss_const: 10

 

        # Turn off the virtual synchrony filter

        vsftype: none

 

        # Enable encryption  2

        secauth: on

 

        # How many threads to use for encryption/decryption

        threads: 0

 

        # This specifies the redundant ring protocol, which may be

        # none, active, or passive.  3

        rrp_mode: active

 

        # The following is a two-ring multicast configuration.  4

        interface {

                ringnumber: 1

                bindnetaddr: 10.0.42.0#心跳線網段

                mcastaddr: 239.255.42.2

                mcastport: 5405

        }

}

 

amf {

        mode: disabled

}

 

service {

        # Load the Pacemaker Cluster Resource Manager  5

        ver:       1

        name:      pacemaker

}

 

aisexec {

        user:   root

        group:  root

}

 

logging {

        fileline: off

        to_stderr: yes

        to_logfile: yes

        to_syslog: yes

logfile: /var/log/cluster/corosync.log #日誌位置  

        syslog_facility: daemon

        debug: off

        timestamp: on

        logger_subsys {

                subsys: AMF

                debug: off

                tags: enter|leave|trace1|trace2|trace3|trace4|trace6

        }

}

>>> 

 

生成密鑰文件

注：corosync生成key文件會默認調用/dev/random隨機數設備，一旦系統中斷的IRQS的隨機數不夠用，將會產生大量的等待時間，所以，爲了節約時間，咱們在生成key以前講random替換成urandom，以便節約時間。

 

mv /dev/{random,random.bak} 

ln -s /dev/urandom /dev/random

corosync-keygen 

 

查看生成的key文件

ll

>總用量 24 

>-r-------- 1 root root  128 8月  13 14:16 authkey 

>-rw-r--r-- 1 root root  521 8月  13 11:11 corosync.conf 

>-rw-r--r-- 1 root root  445 5月  15 05:09 corosync.conf.example 

>-rw-r--r-- 1 root root 1084 5月  15 05:09 corosync.conf.example.udpu 

>drwxr-xr-x 2 root root 4096 5月  15 05:09 service.d 

>drwxr-xr-x 2 root root 4096 5月  15 05:09 uidgid.d

 

將key文件authkey與配置文件corosync.conf複製到node2上

scp -p authkey corosync.conf node2:/etc/corosync/

 

檢查配置

node1+node2:

corosync-cfgtool -s

 

啓動corosync

node1+node2:

service corosync start

 

 

 

 

 

4、pacemaker詳細配置

 

啓動pacemaker

node1+node2:

service pacemaker start

 

node1 or node2:

配置集羣基本屬性

crm configure

>property no-quorum-policy="ignore" \ 

>  pe-warn-series-max="1000" \        

>  pe-input-series-max="1000" \

>  pe-error-series-max="1000" \

>  cluster-recheck-interval="5min"    

【具體資源的配置另當別論】