8.2. Install a Compute Node

Procedure 8.3. Creating the Compute Service Databases

1. Connect to the database service:

   # mysql -u root -p

   Copy to Clipboard Toggle word wrap
2. Create the nova and nova_api databases:

   mysql> CREATE DATABASE nova;

   Copy to Clipboard Toggle word wrap

   mysql> CREATE DATABASE nova_api;

   Copy to Clipboard Toggle word wrap
3. Create a nova database user and grant the user access to the nova and nova_api databases:

   mysql> GRANT ALL ON nova.* TO 'nova'@'localhost' IDENTIFIED BY 'PASSWORD';

   Copy to Clipboard Toggle word wrap

   mysql> GRANT ALL ON nova.* TO 'nova'@'%' IDENTIFIED BY 'PASSWORD';

   Copy to Clipboard Toggle word wrap

   mysql> GRANT ALL ON nova_api.* TO 'nova'@'localhost' IDENTIFIED BY 'PASSWORD';

   Copy to Clipboard Toggle word wrap

   mysql> GRANT ALL ON nova_api.* TO 'nova'@'%' IDENTIFIED BY 'PASSWORD';

   Copy to Clipboard Toggle word wrap
   Replace PASSWORD with a secure password that will be used to authenticate with the database server as this user.
4. Flush the database privileges to ensure that they take effect immediately:

   mysql> FLUSH PRIVILEGES;

   Copy to Clipboard Toggle word wrap
5. Exit the mysql client:

   mysql> quit

   Copy to Clipboard Toggle word wrap

Procedure 8.4. Configuring the Compute Service SQL Database Connection

• Set the value of the sql_connection configuration key:

  # openstack-config --set /etc/nova/nova.conf \
     DEFAULT sql_connection mysql://USER:PASS@IP/DB

  Copy to Clipboard Toggle word wrap
  Replace the following values:

  • Replace USER with the Compute service database user name, usually nova.
  • Replace PASS with the password of the database user.
  • Replace IP with the IP address or host name of the database server.
  • Replace DB with the name of the Compute service database, usually nova.

Procedure 8.5. Creating Identity Records for the Compute Service

1. Set up the shell to access keystone as the administrative user:

   # source ~/keystonerc_admin

   Copy to Clipboard Toggle word wrap
2. Create the compute user:

   [(keystone_admin)]# openstack user create --password PASSWORD compute
   +----------+----------------------------------+
   | Field    | Value                            |
   +----------+----------------------------------+
   | email    | None                             |
   | enabled  | True                             |
   | id       | 421665cdfaa24f93b4e904c81ff702ad |
   | name     | compute                          |
   | username | compute                          |
   +----------+----------------------------------+

   Copy to Clipboard Toggle word wrap
   Replace PASSWORD with a secure password that will be used by the Compute service when authenticating with the Identity service.
3. Link the compute user and the admin role together within the context of the services tenant:

   [(keystone_admin)]# openstack role add --project services --user compute admin

   Copy to Clipboard Toggle word wrap
4. Create the compute service entry:

   [(keystone_admin)]# openstack service create --name compute \
      --description "OpenStack Compute Service" \
      compute

   Copy to Clipboard Toggle word wrap
5. Create the compute endpoint entry:

   [(keystone_admin)]# openstack endpoint create \
      --publicurl "http://IP:8774/v2/%(tenant_id)s" \
      --adminurl "http://IP:8774/v2/%(tenant_id)s" \
      --internalurl "http://IP:8774/v2/%(tenant_id)s" \
      --region RegionOne \
      compute

   Copy to Clipboard Toggle word wrap
   Replace IP with the IP address or host name of the system hosting the Compute API service.

Procedure 8.6. Configuring the Compute Service to Authenticate Through the Identity Service

1. Set the authentication strategy to keystone:

   # openstack-config --set /etc/nova/nova.conf \
      DEFAULT auth_strategy keystone

   Copy to Clipboard Toggle word wrap
2. Set the Identity service host that the Compute service must use:

   # openstack-config --set /etc/nova/api-paste.ini \
      filter:authtoken auth_host IP

   Copy to Clipboard Toggle word wrap
   Replace IP with the IP address or host name of the server hosting the Identity service.
3. Set the Compute service to authenticate as the correct tenant:

   # openstack-config --set /etc/nova/api-paste.ini \
      filter:authtoken admin_tenant_name services

   Copy to Clipboard Toggle word wrap
   Replace services with the name of the tenant created for the use of the Compute service. Examples in this guide use services.
4. Set the Compute service to authenticate using the compute administrative user account:

   # openstack-config --set /etc/nova/api-paste.ini \
      filter:authtoken admin_user compute

   Copy to Clipboard Toggle word wrap
5. Set the Compute service to use the correct compute administrative user account password:

   # openstack-config --set /etc/nova/api-paste.ini \
      filter:authtoken admin_password PASSWORD

   Copy to Clipboard Toggle word wrap
   Replace PASSWORD with the password set when the compute user was created.

Procedure 8.7. Configuring the Firewall to Allow Compute Service Traffic

1. Open the /etc/sysconfig/iptables file in a text editor.
2. Add an INPUT rule allowing TCP traffic on ports in the ranges 5900 to 5999. The new rule must appear before any INPUT rules that REJECT traffic:

   -A INPUT -p tcp -m multiport --dports 5900:5999 -j ACCEPT

   Copy to Clipboard Toggle word wrap
3. Add an INPUT rule allowing TCP traffic on port 8774. The new rule must appear before any INPUT rules that REJECT traffic:

   -A INPUT -p tcp -m multiport --dports 8774 -j ACCEPT

   Copy to Clipboard Toggle word wrap
4. Save the changes to the /etc/sysconfig/iptables file.
5. Restart the iptables service to ensure that the change takes effect:

   # systemctl restart iptables.service

   Copy to Clipboard Toggle word wrap

Procedure 8.8. Configuring the Compute Service to use the RabbitMQ Message Broker

1. Set RabbitMQ as the RPC back end:

   # openstack-config --set /etc/nova/nova.conf \
      DEFAULT rpc_backend rabbit

   Copy to Clipboard Toggle word wrap
2. Set the Compute service to connect to the RabbitMQ host:

   # openstack-config --set /etc/nova/nova.conf \
      DEFAULT rabbit_host RABBITMQ_HOST

   Copy to Clipboard Toggle word wrap
   Replace RABBITMQ_HOST with the IP address or host name of the message broker.
3. Set the message broker port to 5672:

   # openstack-config --set /etc/nova/nova.conf \
      DEFAULT rabbit_port 5672

   Copy to Clipboard Toggle word wrap
4. Set the RabbitMQ user name and password created for the Compute service when RabbitMQ was configured:

   # openstack-config --set /etc/nova/nova.conf \
      DEFAULT rabbit_userid nova
   # openstack-config --set /etc/nova/nova.conf \
      DEFAULT rabbit_password NOVA_PASS

   Copy to Clipboard Toggle word wrap
   Replace nova and NOVA_PASS with the RabbitMQ user name and password created for the Compute service.
5. When RabbitMQ was launched, the nova user was granted read and write permissions to all resources: specifically, through the virtual host /. Configure the Compute service to connect to this virtual host:

   # openstack-config --set /etc/nova/nova.conf \
      DEFAULT rabbit_virtual_host /

   Copy to Clipboard Toggle word wrap

Procedure 8.9. Enabling SSL Communication Between the Compute Service and the RabbitMQ Message Broker

1. Enable SSL communication with the message broker:

   # openstack-config --set /etc/nova/nova.conf \
      DEFAULT rabbit_use_ssl True
   # openstack-config --set /etc/nova/nova.conf \
      DEFAULT kombu_ssl_certfile /path/to/client.crt
   # openstack-config --set /etc/nova/nova.conf \
      DEFAULT kombu_ssl_keyfile /path/to/clientkeyfile.key

   Copy to Clipboard Toggle word wrap
   Replace the following values:
   • Replace /path/to/client.crt with the absolute path to the exported client certificate.
   • Replace /path/to/clientkeyfile.key with the absolute path to the exported client key file.
2. If your certificates were signed by a third-party Certificate Authority (CA), you must also run the following command:

   # openstack-config --set /etc/nova/nova.conf \
      DEFAULT kombu_ssl_ca_certs /path/to/ca.crt

   Copy to Clipboard Toggle word wrap
   Replace /path/to/ca.crt with the absolute path to the CA file provided by the third-party CA (see Section 2.3.4, “Enable SSL on the RabbitMQ Message Broker” for more information).

Procedure 8.11. Populating the Compute Service Database

1. Log in to a system hosting an instance of the openstack-nova-conductor service.
2. Switch to the nova user:

   # su nova -s /bin/sh

   Copy to Clipboard Toggle word wrap
3. Initialize and populate the database identified in /etc/nova/nova.conf:

   $ nova-manage db sync

   Copy to Clipboard Toggle word wrap

Procedure 8.12. Launching Compute Services

1. Libvirt requires that the messagebus service be enabled and running. Start the service:

   # systemctl start messagebus.service

   Copy to Clipboard Toggle word wrap
2. The Compute service requires that the libvirtd service be enabled and running. Start the service and configure it to start at boot time:

   # systemctl start libvirtd.service
   # systemctl enable libvirtd.service

   Copy to Clipboard Toggle word wrap
3. Start the API service on each system that is hosting an instance of it. Note that each API instance should either have its own endpoint defined in the Identity service database or be pointed to by a load balancer that is acting as the endpoint. Start the service and configure it to start at boot time:

   # systemctl start openstack-nova-api.service
   # systemctl enable openstack-nova-api.service

   Copy to Clipboard Toggle word wrap
4. Start the scheduler on each system that is hosting an instance of it. Start the service and configure it to start at boot time:

   # systemctl start openstack-nova-scheduler.service
   # systemctl enable openstack-nova-scheduler.service

   Copy to Clipboard Toggle word wrap
5. Start the conductor on each system that is hosting an instance of it. Note that it is recommended that this service is not run on every Compute node as this eliminates the security benefits of restricting direct database access from the Compute nodes. Start the service and configure it to start at boot time:

   # systemctl start openstack-nova-conductor.service
   # systemctl enable openstack-nova-conductor.service

   Copy to Clipboard Toggle word wrap
6. Start the Compute service on every system that is intended to host virtual machine instances. Start the service and configure it to start at boot time:

   # systemctl start openstack-nova-compute.service
   # systemctl enable openstack-nova-compute.service

   Copy to Clipboard Toggle word wrap
7. Depending on your environment configuration, you may also need to start the following services:

   openstack-nova-cert

   The X509 certificate service, required if you intend to use the EC2 API to the Compute service.

   Note

   To use the EC2 API to the Compute service, you must set the options in the nova.conf configuration file. For more information, see Configuring the EC2 API section in the Red Hat OpenStack Platform Configuration Reference Guide. This document is available from the following link:

   https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux_OpenStack_Platform

   openstack-nova-network

   The Nova networking service. Note that you must not start this service if you have installed and configured, or intend to install and configure, OpenStack Networking.

   openstack-nova-objectstore

   The Nova object storage service. It is recommended that the Object Storage service (Swift) is used for new deployments.