踩的坑大部分都是selinux的权限问题,如果不想关,以下配置可以参考:
SELinux配置
semanage port -m -t http_port_t -p tcp 5000
setsebool -P httpd_can_network_connect_db 1
setsebool -P httpd_can_network_connect 1
setsebool -P glance_api_can_network 1
# 对应如下selinux报错日志
# type=AVC msg=audit(1666868587.049:588): avc: denied { name_connect } for pid=7612 comm="glance-api" dest=11211 scontext=system_u:system_r:glance_api_t:s0 tcontext=system_u:object_r:memcache_port_t:s0 tclass=tcp_socket permissive=0
setsebool -P neutron_can_network 1
# neutron error: [Errno 13] Permission denied
# type=AVC msg=audit(1666884571.298:455): avc: denied { search } for pid=3487 comm="neutron-linuxbr" name="httpd" dev="dm-0" ino=34023364 scontext=system_u:system_r:neutron_t:s0 tcontext=system_u:object_r:httpd_config_t:s0 tclass=dir permissive=0
setsebool -P haproxy_connect_any 1
setsebool -P httpd_can_network_memcache 1
semanage port -a -t http_port_t -p tcp 8778
以上配置不一定全,最后还有个问题没解决,只能彻底关掉了
type=AVC msg=audit(1666924895.437:714): avc: denied { create } for pid=4083 comm="/usr/bin/python" name="privsep.sock" scontext=system_u:system_r:neutron_t:s0 tcontext=system_u:object_r:neutron_tmp_t:s0 tclass=sock_file permissive=0
防火墙配置
控制节点防火墙放通端口:
5000:(控制节点)
5672:rabbit(控制节点)
8778:placement(控制节点)
9292:glance(控制节点)
9696:neutron(控制节点)
6080:vnc远程控制台(控制节点)
5900-5901:vnc(计算节点)