保护企业私有云,构建 Openstack yum 源操作示例

云计算 云安全 OpenStack
对于企业的 Openstack 私有云,出于安全和某些因素的考虑,有些服务器无法访问公网,导致服务器无法更新某些 RPM 包,同时内部常有 Openstack 新特性开发需求、版本的维护与升级,因此非常有必要构建企业私有的 openstack yum 源。

[[124049]]

对于企业的 Openstack 私有云,出于安全和某些因素的考虑,有些服务器无法访问公网,导致服务器无法更新某些 RPM 包,同时内部常有 Openstack 新特性开发需求、版本的维护与升级,因此非常有必要构建企业私有的 openstack yum 源。 构建 openstack yum 源有两个步骤:1.同步(下载)官方的源至企业 yum 服务器中;2. 重新创建 repo 并通过 nginx(apache)发布。

Overview

以 Redhat Openstack 官网安装手册为例,安装 Openstack 需要用到两类共计 8 个 repo,

1). Centos 源

CentOS-Base.repo CentOS-Debuginfo.repo CentOS-Media.repo CentOS-Vault.repo

2). openstack 源及相关依赖源(epel, foreman, puppet):

epel.repo foreman.repo puppetlabs.repo rdo-release.repo

构建本地源步骤

1.yum源文件下载

(1).下载必要工具:

[root@yumserver ~]# yum -y install wget

[root@yumserver ~]# yum -y install createrepo

(2).下载yum源到本地:

[root@yumserver ~]# mkdir -p /wget-yum

[root@yumserver ~]# cd /wget-yum

下载Centos 源:

[root@yumserver wget-yum]# wget -S -c -r -np -L http://mirrors.sohu.com/centos/6.5/

下载foreman源:

[root@yumserver wget-yum]# wget -S -c -r -np -L http://yum.theforeman.org/plugins/1.5/el6/

[root@yumserver wget-yum]# wget -S -c -r -np -L http://yum.theforeman.org/releases/1.5/el6/

下载epel源:

[root@yumserver wget-yum]# wget -S -c -r -np -L http://mirrors.yun-idc.com/epel/6/

下载puppetlabs源:

[root@yumserver wget-yum]# wget -S -c -r -np -L https://yum.puppetlabs.com/el/6/

下载openstack源:

[root@yumserver wget-yum]# wget -S -c -r -np -L https://repos.fedorapeople.org/repos/openstack/openstack-havana/

[root@yumserver wget-yum]# wget -S -c -r -np -L https://repos.fedorapeople.org/repos/openstack/openstack-icehouse/

(3).删除不需要的软件包和文件:

[root@yumserver wget-yum]# find ./ -name index.html* | xarge rm -rf

[root@yumserver wget-yum]# find ./ -name fedora-20 | xarge rm -rf

[root@yumserver wget-yum]# find ./ -name fedora-19 | xarge rm -rf

[root@yumserver wget-yum]# find ./ -name i386 | xarge rm -rf

(4).调整目录结构:

[root@yumserver wget-yum]# mkdir foreman

[root@yumserver wget-yum]# mv yum.theforeman.org/plugins foreman/

[root@yumserver wget-yum]# mv yum.theforeman.org/releases foreman/

[root@yumserver wget-yum]# rm -rf yum.theforeman.org

[root@yumserver wget-yum]# mv mirrors.yun-idc.com/epel ./

[root@yumserver wget-yum]# rm -rf mirrors.yun-idc.com

[root@yumserver wget-yum]# mkdir puppetlabs

[root@yumserver wget-yum]# mv yum.puppetlabs.com/el /puppetlabs/

[root@yumserver wget-yum]# rm -rf yum.puppetlabs.com

[root@yumserver wget-yum]# mv repos.fedorapeople.org/repos/openstack ./

[root@yumserver wget-yum]# rm -rf repos.fedorapeople.org

[root@yumserver wget-yum]# ls

centos epel foreman openstack puppetlabs

#p#

2.nginx配置:

[root@yumserver wget-yum]# rpm -ivh http://nginx.org/packages/centos/6/noarch/RPMS/nginx-release-centos-6-0.el6.ngx.noarch.rpm

[root@yumserver wget-yum]# yum -y install nginx

[root@yumserver wget-yum]# vi /etc/nginx/nginx.conf

  1. <span style="color: rgb(69, 69, 69); font-family: Arial, sans-serif; font-size: 14px; line-height: 20px;">[root@yumserver&nbsp;wget-yum]# vi&nbsp;/etc/nginx/nginx.conf</span> 
  2. user  nginx; 
  3. worker_processes  8
  4. error_log  /var/log/nginx/error.log warn; 
  5. pid        /var/run/nginx.pid; 
  6. events { 
  7.     worker_connections  8192
  8. http { 
  9.     autoindex on; 
  10.     autoindex_exact_size off; 
  11.     autoindex_localtime on; 
  12.     charset utf-8,gbk;  
  13.     include       /etc/nginx/mime.types; 
  14.     default_type  application/octet-stream; 
  15.     log_format  main  '$remote_addr - $remote_user [$time_local] "$request" ' 
  16.                       '$status $body_bytes_sent "$http_referer" ' 
  17.                       '"$http_user_agent" "$http_x_forwarded_for"'
  18.     access_log  /var/log/nginx/access.log  main; 
  19.     sendfile        on; 
  20.     keepalive_timeout  65
  21.     include /etc/nginx/conf.d/*.conf; 
  22. [root@yumserver wget-yum]# vi /etc/nginx/conf.d/default.conf 
  23.   
  24. server { 
  25.     listen       80
  26.     server_name  openstack-yum-server.cn; 
  27.     location / { 
  28.         #root   html; 
  29.         root /wget-yum; 
  30.         autoindex on; 
  31.         index  index.html index.htm; 
  32.     } 
  33.     error_page   500 502 503 504  /50x.html; 
  34.     location = /50x.html { 
  35.         root   /usr/share/nginx/html; 
  36.     } 

[root@yumserver wget-yum]# /etc/init.d/nginx restart

3. release.rpm制作:

(1).下载icehouse源码包:

[root@yumserver ~]# wget https://repos.fedorapeople.org/repos/openstack/openstack-icehouse/rdo-release-icehouse-4.src.rpm

(2).创建padraig用户和组:

[root@yumserver ~]# groupadd -g 2000 padraig

[root@yumserver ~]# useradd -u 2000 -g padraig -m padraig -d /home -s /bin/bash

(3).解压rpm,并修改各个 .repo 文件的 url:

[root@yumserver ~]# rpm -i rdo-release-icehouse-4.src.rpm

修改 .repo 文件,以 rdo-release.repo 为例

  1. [openstack-havana] 
  2. name=OpenStack Havana Repository 
  3. baseurl=http://openstack-yum-server.cn/openstack/openstack-havana/epel-6/ 
  4. enabled=1 
  5. skip_if_unavailable=0 
  6. gpgcheck=0 
  7. gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-RDO-Havana 
  8. priority=98 

(4).修改 .spec 文件内容:

[root@yumserver ~]# cd rpmbuild/

[root@yumserver rpmbuild]#

SOURCES SPECS

[root@yumserver ~]# cd SPECS

[root@yumserver SPECS]# vi rdo-release.spec

URL: https://github.com/redhat-openstack/rdo-release

Source0: rdo-release.repo

Source1: RPM-GPG-KEY-RDO-Icehouse

Source2: foreman.repo

Source3: RPM-GPG-KEY-foreman

Source4: puppetlabs.repo

Source5: RPM-GPG-KEY-puppetlabs

Source6: epel.repo

Source7: RPM-GPG-KEY-EPEL-6

 

%install

install -p -D -m 644 %{SOURCE0} %{buildroot}%{_sysconfdir}/yum.repos.d/rdo-release.repo

install -p -D -m 644 %{SOURCE2} %{buildroot}%{_sysconfdir}/yum.repos.d/foreman.repo

install -p -D -m 644 %{SOURCE4} %{buildroot}%{_sysconfdir}/yum.repos.d/puppetlabs.repo

install -p -D -m 644 %{SOURCE6} %{buildroot}%{_sysconfdir}/yum.repos.d/epel.repo


#GPG Keys

install -Dpm 644 %{SOURCE1} %{buildroot}%{_sysconfdir}/pki/rpm-gpg/RPM-GPG-KEY-RDO-Icehouse

install -Dpm 644 %{SOURCE3} %{buildroot}%{_sysconfdir}/pki/rpm-gpg/RPM-GPG-KEY-foreman

install -Dpm 644 %{SOURCE5} %{buildroot}%{_sysconfdir}/pki/rpm-gpg/RPM-GPG-KEY-puppetlabs

install -Dpm 644 %{SOURCE7} %{buildroot}%{_sysconfdir}/pki/rpm-gpg/RPM-GPG-KEY-EPEL-6

 

for repo in rdo-release foreman puppetlabs epel ; do

(5).修改SOURCES文件内容,并增加相应文件:

[root@yumserver SPECS]# cd ../SOURCES

[root@yumserver SOURCES]# ls

epel.repo foreman.repo puppetlabs.repo rdo-release.repo RPM-GPG-KEY-EPEL-6 RPM-GPG-KEY-foreman RPM-GPG-KEY-puppetlabs RPM-GPG-KEY-RDO-Icehouse

(6).重新打包rpm:

[root@yumserver SPECS]# yum -y install rpm-build

[root@yumserver SPECS]# pwd

/root/rpmbuild/SPECS

[root@yumserver SPECS]# rpmbuild -ba rdo-release.spec

#p#

4. 解决依赖关系,创建仓库:

[root@yumserver updates]# ls

repodata x86_64

[root@yumserver updates]# pwd

yum-repo/openstack/openstack-icehouse/updates

[root@yumserver updates]# createrepo x86_64

5. repo 更新 RPM 包:

createrepo x86_64 --update

**********************************************************************************************************************************

编译后的rpm源码包示例:

new-rdo-release-havana-8.0.src.rpm
new-rdo-release-icehouse-4.0.src.rpm


troubleshooting:

yum repolist 出现

[root@controller yum.repos.d]# yum repolist
Loaded plugins: axelget, fastestmirror, security
Loading mirror speeds from cached hostfile

http://openstack-yum-server/ceph/el6/x86_64/repodata/repomd.xml: [Errno 14] PYCURL ERROR 22 - "The requested URL returned error: 403 Forbidden"
Trying other mirror.
http://openstack-yum-server/ceph/el6/noarch/repodata/repomd.xml: [Errno 14] PYCURL ERROR 22 - "The requested URL returned error: 403 Forbidden"
Trying other mirror.
.....


解决方案:
1)
每个 repo 配置新增 proxy=None
[openstack-havana-updates]

.....
_proxy_=None
2)

关闭防火墙, service iptables stop

原文出自:http://blog.csdn.net/wsfdl/article/details/41808939

责任编辑:Ophira 来源: wsfdl的专栏
相关推荐

2011-06-08 14:24:11

CitrixOpenStack私有云

2020-03-04 15:52:38

OpenStack私有云技术

2013-05-27 09:32:07

构建私有云OpenStack开源云计算

2013-10-25 11:14:46

云发展OpenStack私有云

2017-11-07 06:28:11

2015-05-28 13:42:08

2014-05-12 11:00:42

红帽

2014-12-10 09:36:09

OpenStack企业私有云

2015-07-21 16:59:22

OpenStack

2018-06-11 08:41:48

云存储技巧私有

2017-03-01 14:30:48

存储云私有云公有云

2017-03-03 10:18:13

存储云APIGUI

2016-10-25 12:59:49

私有云OpenStack选项

2017-05-03 09:49:14

OpenStack私有云搭建

2016-09-12 17:17:06

OpenStack云计算私有云

2013-08-30 16:19:30

私有云OATOSOATOS私有云

2016-10-12 17:18:26

私有云持续交付华为

2015-08-06 09:45:14

私有云OpenStackVMware

2013-08-01 10:09:09

亚马逊公有云OpenStack私有

2022-03-21 09:50:45

私有云云计算
点赞
收藏

51CTO技术栈公众号