7.OpenStack管理（一）

OpenStack管理

OpenStack认证管理-Keystone

Keystone基本概念

术语	说明
Domain	域，Keystone中一个虚拟概念，一个域是一组User，Group或Project的容器
User	用户，是可以通过Keystone访问OpenStack服务的个人、系统或某个服务
Group	用户组，是一组User的容器，可以向Group中添加用户，并直接给Group分配角色
Project	项目，是各个服务中一些可以访问的资源集合，项目只需在某个域下唯一即可
Role	角色，具有一组定义的用户权限和特权以执行一组特定操作，角色不同，被赋予的权限不同
Service	服务，一种OpenStack服务，服务会对外暴露一个或多个端点，用户可以通过这些端点访问资源并执行操作
Endpoint	端点，是指一个可以用来访问某个具体服务的网络地址
Token	令牌，是允许访问特定资源的凭证
Credential	凭证，确认用户身份的数据，如用户的用户名和密码

域 domain

查看domain

[root@controller ~]# source keystonerc_admin 
[root@controller ~(keystone_admin)]# openstack domain list
+----------------------------------+---------+---------+--------------------+
| ID                               | Name    | Enabled | Description        |
+----------------------------------+---------+---------+--------------------+
| c4eb37ed8e444db2acf73739f2d7058f | heat    | True    |                    |
| default                          | Default | True    | The default domain |
+----------------------------------+---------+---------+--------------------+

创建domain

[root@controller ~(keystone_admin)]# openstack domain create domain-test
+-------------+----------------------------------+
| Field       | Value                            |
+-------------+----------------------------------+
| description |                                  |
| enabled     | True                             |
| id          | 949d85c6af2d42549ea0b04261a8e558 |
| name        | domain-test                      |
| options     | {}                               |
| tags        | []                               |
+-------------+----------------------------------+# 验证
[root@controller ~(keystone_admin)]# openstack domain list
+----------------------------------+-------------+---------+--------------------+
| ID                               | Name        | Enabled | Description        |
+----------------------------------+-------------+---------+--------------------+
| 949d85c6af2d42549ea0b04261a8e558 | domain-test | True    |                    |
| c4eb37ed8e444db2acf73739f2d7058f | heat        | True    |                    |
| default                          | Default     | True    | The default domain |
+----------------------------------+-------------+---------+--------------------+

删除domain

# 设置domain 禁用
[root@controller ~(keystone_admin)]# openstack domain set --disable domain-test
[root@controller ~(keystone_admin)]# openstack domain delete domain-test
[root@controller ~(keystone_admin)]# openstack domain list
+----------------------------------+---------+---------+--------------------+
| ID                               | Name    | Enabled | Description        |
+----------------------------------+---------+---------+--------------------+
| c4eb37ed8e444db2acf73739f2d7058f | heat    | True    |                    |
| default                          | Default | True    | The default domain |
+----------------------------------+---------+---------+--------------------+

开启多域登陆界面

[root@controller ~(keystone_admin)]# cd /etc/openstack-dashboard/
[root@controller openstack-dashboard(keystone_admin)]# ls
cinder_policy.json    local_settings       nova_policy.d
glance_policy.json    local_settings.d     nova_policy.json
keystone_policy.json  neutron_policy.json
[root@controller openstack-dashboard(keystone_admin)]# vim local_settings
# 修改配置文件83行 如下，开启keystone支持多域
#OPENSTACK_KEYSTONE_MULTIDOMAIN_SUPPORT = False
OPENSTACK_KEYSTONE_MULTIDOMAIN_SUPPORT = True[root@controller openstack-dashboard(keystone_admin)]# systemctl restart httpd

测试多域登陆界面效果：

用户 user

列出所有用户

[root@controller ~(keystone_admin)]# openstack user list
+----------------------------------+------------+
| ID                               | Name       |
+----------------------------------+------------+
| d1a0ae2a6ae4467fbe7d4f3f2948c490 | admin      |
| 9017b520336543068009b8233e94aea3 | heat_admin |
| 89b206457692472ab22f491f77bc364d | glance     |
| 4155180a93c64ab48cb60331e03d233a | cinder     |
| c965179f4e01476eaf307b647b1e6833 | nova       |
| 27e0030e1e38482a8114df07cc24b839 | placement  |
| 560341addde04c1a865649c1f06fe712 | neutron    |
| 4ed7f8c367fa4fcf983c964f417d37b6 | swift      |
| e5343a06c7d24cfa9b6a8eb7da4b4c79 | heat       |
| cf6be60c1d4542aa907841ccb41eb149 | heat-cfn   |
| 57e08255b8424a81aff8a3e2042ea90c | gnocchi    |
| 0c495008f0ae4181854c3baaa89a275f | ceilometer |
| 1121a2d9ee27433e92f76781e4ffff5f | aodh       |
| 1dba4573e3e549a2adeaee0eb97f46c3 | user1      |
+----------------------------------+------------+

创建新用户：user1

# 创建用户user1密码HUAWEI
[root@controller ~(keystone_admin)]# openstack user create --password HUAWEI user1# 验证
[root@controller ~(keystone_admin)]# openstack user list
+----------------------------------+------------+
| ID                               | Name       |
+----------------------------------+------------+
| d1a0ae2a6ae4467fbe7d4f3f2948c490 | admin      |
| 9017b520336543068009b8233e94aea3 | heat_admin |
| 89b206457692472ab22f491f77bc364d | glance     |
| 4155180a93c64ab48cb60331e03d233a | cinder     |
| c965179f4e01476eaf307b647b1e6833 | nova       |
| 27e0030e1e38482a8114df07cc24b839 | placement  |
| 560341addde04c1a865649c1f06fe712 | neutron    |
| 4ed7f8c367fa4fcf983c964f417d37b6 | swift      |
| e5343a06c7d24cfa9b6a8eb7da4b4c79 | heat       |
| cf6be60c1d4542aa907841ccb41eb149 | heat-cfn   |
| 57e08255b8424a81aff8a3e2042ea90c | gnocchi    |
| 0c495008f0ae4181854c3baaa89a275f | ceilometer |
| 1121a2d9ee27433e92f76781e4ffff5f | aodh       |
| 1dba4573e3e549a2adeaee0eb97f46c3 | user1      |
+----------------------------------+------------+# 查看user1用户详细信息
[root@controller ~(keystone_admin)]# openstack user show user1
+---------------------+----------------------------------+
| Field               | Value                            |
+---------------------+----------------------------------+
| default_project_id  | 6538330d9ce04926ba60cbdfd32fc1a4 |
| domain_id           | default                          |
| enabled             | True                             |
| id                  | 1dba4573e3e549a2adeaee0eb97f46c3 |
| name                | user1                            |
| options             | {'lock_password': False}         |
| password_expires_at | None                             |
+---------------------+----------------------------------+

组 group

创建group1，并将user1加入group1

# 创建组group1
[root@controller ~(keystone_admin)]# openstack group create group1
+-------------+----------------------------------+
| Field       | Value                            |
+-------------+----------------------------------+
| description |                                  |
| domain_id   | default                          |
| id          | e955c62e2e9e48218c47cbd57c996348 |
| name        | group1                           |
+-------------+----------------------------------+# 查看group1组的详细信息
[root@controller ~(keystone_admin)]# openstack group show group1
+-------------+----------------------------------+
| Field       | Value                            |
+-------------+----------------------------------+
| description |                                  |
| domain_id   | default                          |
| id          | e955c62e2e9e48218c47cbd57c996348 |
| name        | group1                           |
+-------------+----------------------------------+# 列出所有组
[root@controller ~(keystone_admin)]# openstack group list
+----------------------------------+--------+
| ID                               | Name   |
+----------------------------------+--------+
| e955c62e2e9e48218c47cbd57c996348 | group1 |
+----------------------------------+--------+# 将user1加入group1
[root@controller ~(keystone_admin)]# openstack group add user group1 user1# 查看user1是否隶属于group1
[root@controller ~(keystone_admin)]# openstack group contains user group1 user1
user1 in group group1

角色 role

查看角色role

[root@controller ~(keystone_admin)]# openstack role list
+----------------------------------+------------------+
| ID                               | Name             |
+----------------------------------+------------------+
| 23af44ab27224e5da00ff8d248858899 | _member_         |
| 2ec82f8fa09344718963cbfc1182bae5 | heat_stack_owner |
| 402c2a267e49491aa7c3e824a000ff54 | SwiftOperator    |
| 7895328276fc4b1289180f30bd94ca5b | ResellerAdmin    |
| bfde67644d054ad686a35f7f7332e248 | heat_stack_user  |
| e0e123b4642f4537a61bc7a746414cfe | member           |
| ea2ee3451a554249908610a0642e6e38 | reader           |
| ee67413dd21c4d8b81710a50ebaf1ff5 | admin            |
+----------------------------------+------------------+

给group1赋予角色admin

[root@controller ~(keystone_admin)]# openstack role add --project admin --group group1 admin# 验证group1角色
[root@controller ~(keystone_admin)]# openstack role assignment list --names --group group1
+-------+------+----------------+---------------+--------+--------+-----------+
| Role  | User | Group          | Project       | Domain | System | Inherited |
+-------+------+----------------+---------------+--------+--------+-----------+
| admin |      | group1@Default | admin@Default |        |        | False     |
+-------+------+----------------+---------------+--------+--------+-----------+

项目 project

创建ProjectA

# 创建项目ProjectA
[root@controller ~(keystone_admin)]# openstack project create ProjectA
+-------------+----------------------------------+
| Field       | Value                            |
+-------------+----------------------------------+
| description |                                  |
| domain_id   | default                          |
| enabled     | True                             |
| id          | bc87c6dd4106450aab94ac023f6a8836 |
| is_domain   | False                            |
| name        | ProjectA                         |
| options     | {}                               |
| parent_id   | default                          |
| tags        | []                               |
+-------------+----------------------------------+# 将ProjectA分配给用户user1
[root@controller ~(keystone_admin)]# openstack user set --project ProjectA user1# 给项目ProjectA里的用户user1赋予角色admin
[root@controller ~(keystone_admin)]# openstack role add --user user1 --project ProjectA admin

思考：同样的方式

创建一个项目ProjectB，分配给用户user2，角色admin

创建一个用户user3，在项目ProjectA中的角色为member

# 创建一个项目ProjectB，分配给用户user2，角色admin

修改ProjectA的配额

# 将ProjectA配额设置为实例3，vcpu 5，内存5000MB
[root@controller ~(keystone_admin)]# openstack quota set --instances 3 --cores 5 --ram 5000 ProjectA

验证，使用user1登陆，切换到ProjectA

服务 service

查看OpenStack的服务

[root@controller ~(keystone_admin)]# openstack service list
+----------------------------------+------------+----------------+
| ID                               | Name       | Type           |
+----------------------------------+------------+----------------+
| 0c5ff19a6a864da396d953b59590426c | heat       | orchestration  |
| 1cae26e01e434ff4ae620cc1929d6e41 | cinderv2   | volumev2       |
| 2773a522dca34943a4b0fe7fe605feab | gnocchi    | metric         |
| 45a05fc964734fde92c2236c0e8ae167 | placement  | placement      |
| 4d4626a7283941b084d99415873cb821 | cinderv3   | volumev3       |
| 584a2e1cfae5474ba9d28c2c37dc63df | aodh       | alarming       |
| 67cfa27ca3824e1493cdb53461e9549d | nova       | compute        |
| 834174494a2c453385c93ef4437fa152 | keystone   | identity       |
| ac8ce7d0cd924134a0364870fc6dcb48 | swift      | object-store   |
| c1c2d30f8b15473d952f5aaa1f2a4b07 | glance     | image          |
| cbffff6349e148ab88f008830a882328 | ceilometer | metering       |
| ef89150201f4465c9dde8c7f5a3314f1 | neutron    | network        |
| efcfe80e0d7c4e63bfe81c9825ad0058 | heat-cfn   | cloudformation |
+----------------------------------+------------+----------------+

端点 endpoint

查看OpenStack endpoint

[root@controller ~(keystone_admin)]# openstack service list

查看catalog

[root@controller ~(keystone_admin)]# openstack catalog list

理解Keystone核心概念

作为 OpenStack 的基础支持服务，Keystone 做下面这几件事情：

1. 管理用户及其权限
2. 维护 OpenStack Services 的 Endpoint
3. Authentication（认证）和 Authorization（鉴权）

学习 Keystone，得理解下面这些概念：

User

指代任何使用OpenStack的实体，可以是真正的用户，其他系统或者服务

Credentials

Credentials是User用来证明自己身份的信息，可以是：

1. 用户名/密码
2. Token
3. API Key
4. 其他高级方式

Authentication

Authentication是Keystone 验证User身份的过程

Token

Token 是由数字和字母组成的字符串，User 成功 Authentication 后 Keystone 生成 Token 并分配给 User

Token的有效期默认是24小时

Project

project用于将OpenStack的资源（计算，存储，网络）进行分组和隔离

根据 OpenStack 服务的对象不同，Project 可以是一个客户（公有云，也叫租户）、部门或者项目组 （私有云）

注意：

1. 资源的所有权是属于 Project 的，而不是 User。
2. 在 OpenStack 的界面和文档中，Tenant / Project / Account 这几个术语是通用的，但长期看会倾 向使用 Project
3. 每个 User（包括 admin）必须挂在 Project 里才能访问该 Project 的资源。 一个User可以属于多 个 Project
4. admin 相当于 root 用户，具有最高权限

Service

OpenStack 的 Service 包括 Compute (Nova)、Block Storage (Cinder)、Object Storage (Swift)、 Image Service (Glance) 、Networking Service (Neutron) 等

每个 Service 都会提供若干个 Endpoint，User 通过 Endpoint 访问资源和执行操作

Endpoint

Endpoint 是一个网络上可访问的地址，通常是一个 URL

Service 通过 Endpoint 暴露自己的 API

Role

安全包含两部分：Authentication（认证）和 Authorization（鉴权）

Authentication 解决的是“你是谁？”的问题

Authorization 解决的是“你能干什么？”的问题

OpenStack镜像管理-glance

公有云（华为云）镜像概念

1. 镜像基本概念

镜像（Image） 是一个包含了软件配置（如操作系统、应用程序等）的模板，用于创建云服务器实例。

2. 镜像的主要特性

• 预配置环境：包含完整的操作系统和预装软件
• 快速部署：基于镜像可快速创建多个相同配置的云服务器
• 标准化：确保环境一致性，便于运维管理
• 版本管理：支持镜像的创建、更新、删除等生命周期管理

3. 华为云镜像分类

1. 公共镜像

   • 由华为云官方提供
   • 包含正版操作系统（Windows、Linux等）
   • 经过安全性测试和优化
   • 定期更新补丁

2. 私有镜像

   • 用户自定义创建的镜像
   • 基于云服务器实例创建
   • 包含用户特定的应用环境
   • 支持跨区域复制

3. 共享镜像

   • 其他用户共享的私有镜像
   • 需要在同一区域内
   • 接受方需确认使用

4. 市场镜像

   • 第三方提供商提供的镜像
   • 包含特定行业解决方案
   • 经过华为云认证

4. 镜像格式支持

• RAW：原始磁盘镜像格式
• QCOW2：QEMU模拟器支持格式（推荐）
• VHD：虚拟硬盘格式
• VMDK：VMware虚拟磁盘格式
• ISO：光盘镜像格式

最主要的作用：节约时间

glance在OpenStack中的作用

glance架构

Glance 是 OpenStack 的镜像服务组件，负责虚拟机的镜像发现、注册和交付

镜像、实例和规格的关系：

用户可以从同一个镜像启动任意数量的实例

每个启动的实例都是基于镜像的一个副本，实例上的任何修改都不会影响到镜像

启动实例时，必须指定一个规格，实例按照规格使用资源

上传镜像实验

实验上传两个镜像：

cirros-0.5.2-x86_64-disk.img

TinyCore-12.0.iso

直接先将这2个文件，拖放到controller节点的/root目录。观察两个文件磁盘格式

[root@controller ~]# ls
TinyCore-12.0.iso  answers.txt.bak               keystonerc_user1
anaconda-ks.cfg    cirros-0.5.2-x86_64-disk.img
answers.txt        keystonerc_admin[root@controller ~]# qemu-img info cirros-0.5.2-x86_64-disk.img 
image: cirros-0.5.2-x86_64-disk.img
file format: qcow2
virtual size: 112 MiB (117440512 bytes)
disk size: 15.5 MiB
cluster_size: 65536
Format specific information:compat: 1.1compression type: zliblazy refcounts: falserefcount bits: 16corrupt: falseextended l2: false[root@controller ~]# qemu-img info TinyCore-12.0.iso 
image: TinyCore-12.0.iso
file format: raw
virtual size: 20 MiB (20971520 bytes)
disk size: 20 MiB

在web界面上传镜像

点击镜像

在命令行中查找

[root@controller ~]# find / -name 0fbd7698-9f03-420c-b941-9903c11af5a3
find: '/proc/157278': No such file or directory
find: '/proc/157300': No such file or directory
/var/lib/glance/images/0fbd7698-9f03-420c-b941-9903c11af5a3

去数据库中查看现象

[root@controller ~]# mysql
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 14921
Server version: 10.3.28-MariaDB MariaDB ServerCopyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.MariaDB [(none)]> show databases;
+--------------------+
| Database           |
+--------------------+
| aodh               |
| cinder             |
| glance             |
| gnocchi            |
| heat               |
| information_schema |
| keystone           |
| mysql              |
| neutron            |
| nova               |
| nova_api           |
| nova_cell0         |
| performance_schema |
| placement          |
| test               |
+--------------------+
15 rows in set (0.001 sec)MariaDB [(none)]> use glance;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -ADatabase changed
MariaDB [glance]> show tables;
+----------------------------------+
| Tables_in_glance                 |
+----------------------------------+
| alembic_version                  |
| image_locations                  |
| image_members                    |
| image_properties                 |
| image_tags                       |
| images                           |
| metadef_namespace_resource_types |
| metadef_namespaces               |
| metadef_objects                  |
| metadef_properties               |
| metadef_resource_types           |
| metadef_tags                     |
| migrate_version                  |
| task_info                        |
| tasks                            |
+----------------------------------+
15 rows in set (0.000 sec)MariaDB [glance]> select id,value from image_locations;
+----+--------------------------------------------------------------------+
| id | value                                                              |
+----+--------------------------------------------------------------------+
|  1 | file:///var/lib/glance/images/0fbd7698-9f03-420c-b941-9903c11af5a3 |
|  2 | file:///var/lib/glance/images/7e3eb0af-ddab-4d2f-8084-cf2acef0dc60 |
+----+--------------------------------------------------------------------+
2 rows in set (0.000 sec)

使用swift作为glance后端存储

[root@controller ~]# grep -Ev '^#' /etc/glance/glance-api.conf | grep -Ev '^$'
[DEFAULT]
bind_host=0.0.0.0
bind_port=9292
workers=2
image_cache_dir=/var/lib/glance/image-cache
debug=False
log_file=/var/log/glance/api.log
log_dir=/var/log/glance
transport_url=rabbit://guest:guest@192.168.108.10:5672/
[cinder]
[cors]
[database]
connection=mysql+pymysql://glance:huawei@192.168.108.10/glance
[file]
[glance.store.http.store]
[glance.store.rbd.store]
[glance.store.s3.store]
[glance.store.swift.store]
[glance.store.vmware_datastore.store]
[glance_store]
stores=file,http,swift
default_store=file
filesystem_store_datadir=/var/lib/glance/images/
[image_format]
[keystone_authtoken]
www_authenticate_uri=http://192.168.108.10:5000/v3
auth_type=password
auth_url=http://192.168.108.10:5000
username=glance
password=huawei
user_domain_name=Default
project_name=services
project_domain_name=Default
[oslo_concurrency]
[oslo_messaging_amqp]
[oslo_messaging_kafka]
[oslo_messaging_notifications]
driver=messagingv2
topics=notifications
[oslo_messaging_rabbit]
ssl=False
default_notification_exchange=glance
[oslo_middleware]
[oslo_policy]
policy_file=/etc/glance/policy.json
[paste_deploy]
flavor=keystone
[profiler]
[store_type_location_strategy]
[task]
[taskflow_executor]
[wsgi]# 查看swift密码方式
[root@controller ~]# vim answers.txt
1137 CONFIG_SWIFT_HASH=... ...  这个密码修改到上面的配置文件[root@controller ~]# vim /etc/glance/glance-api.conf
4408 swift_store_key = ... ...
3111 default_store=swift
3982 swift_store_region = RegionOne
4090 swift_store_container = gqdglance
4118 swift_store_large_object_size = 5120
4160 swift_store_create_container_on_put = true
4182 swift_store_multi_tenant = true
4230 swift_store_admin_tenants = services
4391 swift_store_auth_address = http://192.168.108.10:5000/v3
4399 swift_store_user = swift# 重启glance进程
[root@controller ~]# systemctl restart openstack-glance*

web界面上传镜像，测试效果

数据库中观察现象

[root@controller ~]# mysql
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 23399
Server version: 10.3.28-MariaDB MariaDB ServerCopyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.MariaDB [(none)]> use glance
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -ADatabase changed
MariaDB [glance]> select id,value from image_locations;
+----+---------------------------------------------------------------------------------------------------------------------------------------------------------------+
| id | value                                                                                                                                                         |
+----+---------------------------------------------------------------------------------------------------------------------------------------------------------------+
|  1 | file:///var/lib/glance/images/0fbd7698-9f03-420c-b941-9903c11af5a3                                                                                            |
|  2 | file:///var/lib/glance/images/7e3eb0af-ddab-4d2f-8084-cf2acef0dc60                                                                                            |
|  3 | swift+http://192.168.108.10:8080/v1/AUTH_6538330d9ce04926ba60cbdfd32fc1a4/gqdglance_1beb226f-d266-4a13-9f63-e2f4d49daa27/1beb226f-d266-4a13-9f63-e2f4d49daa27 |
+----+---------------------------------------------------------------------------------------------------------------------------------------------------------------+
3 rows in set (0.001 sec)

命令行上传大文件镜像-带进度条

web界面上传文件没有进度条，只会转圈

命令行上传大文件

[root@controller ~]# source keystonerc_admin 
[root@controller ~(keystone_admin)]# glance image-create --name image_cen
tos --file CentOS-7-x86_64-Minimal-1810.iso --disk-format raw --container bare --progress

建议：OpenStack 上传大文件使用命令行，web界面可能上传失败

glance镜像管理实验

通过OpenStack Dashboard和OpenStack CLI两种方式进行镜像的下载、创建、注册、 共享以及镜像格式转换等基本操作

实验目的

• 了解下载镜像的方法
• 熟悉OpenStack Dashboard 和OpenStack CLI 创建、注册以及修改镜像方法
• 熟悉OpenStack Dashboard和OpenStack CLI共享镜像、转换镜像格式以及导出和删除镜像的 方法

实验流程

OpenStack Dashboard 操作

1.下载镜像

cirros 镜像是一个比较小（12 M左右）的Linux镜像，镜像格式为QCOW2，下载后可直接注册使用。以 下将以cirros 镜像为例进行介绍，其他镜像获取方法参考如下链接：https://docs.openstack.org/image-guide/obtain-images.html

2.创建并注册镜像

3.修改镜像

OpenStack Cli 操作

1.下载镜像

[root@controller ~]# source keystonerc_admin# 上传镜像cirros-0.5.2-x86_64-disk.img
[root@controller ~(keystone_admin)]# ls
anaconda-ks.cfg  cirros-0.5.2-x86_64-disk.img  keystonerc_admin
answers.txt      keystonerc_User_cli_01
answers.txt.bak  keystonerc_User_cli_02[root@controller ~(keystone_admin)]# qemu-img info cirros-0.5.2-x86_64-disk.img 
image: cirros-0.5.2-x86_64-disk.img
file format: qcow2
virtual size: 112 MiB (117440512 bytes)
disk size: 15.5 MiB
cluster_size: 65536
Format specific information:compat: 1.1compression type: zliblazy refcounts: falserefcount bits: 16corrupt: falseextended l2: false

2.创建并注册镜像

[root@controller ~(keystone_admin)]# openstack image create --disk-format qcow2 --container-format bare --min-disk 1 --min-ram 128 --private --file ./cirros-0.5.2-x86_64-disk.img Img_cli
+------------------+---------------------------------------------------------------------------------------------------------------------------------------------+
| Field            | Value                                                                                                                                       |
+------------------+---------------------------------------------------------------------------------------------------------------------------------------------+
| container_format | bare                                                                                                                                        |
| created_at       | 2025-10-28T02:13:11Z                                                                                                                        |
| disk_format      | qcow2                                                                                                                                       |
| file             | /v2/images/fc5531bc-f4c5-4442-a0a8-dacc610026bd/file                                                                                        |
| id               | fc5531bc-f4c5-4442-a0a8-dacc610026bd                                                                                                        |
| min_disk         | 1                                                                                                                                           |
| min_ram          | 128                                                                                                                                         |
| name             | Img_cli                                                                                                                                     |
| owner            | 6538330d9ce04926ba60cbdfd32fc1a4                                                                                                            |
| properties       | os_hidden='False', owner_specified.openstack.md5='', owner_specified.openstack.object='images/Img_cli', owner_specified.openstack.sha256='' |
| protected        | False                                                                                                                                       |
| schema           | /v2/schemas/image                                                                                                                           |
| status           | queued                                                                                                                                      |
| tags             |                                                                                                                                             |
| updated_at       | 2025-10-28T02:13:11Z                                                                                                                        |
| visibility       | private                                                                                                                                     |
+------------------+---------------------------------------------------------------------------------------------------------------------------------------------+# 查看镜像列表
[root@controller ~(keystone_admin)]# openstack image list
+--------------------------------------+---------+--------+
| ID                                   | Name    | Status |
+--------------------------------------+---------+--------+
| fc5531bc-f4c5-4442-a0a8-dacc610026bd | Img_cli | active |
| efec5f1d-ee48-43ee-bdfc-dc1ee2c0a590 | Img_web | active |
+--------------------------------------+---------+--------+

3.修改镜像

[root@controller ~(keystone_admin)]# source keystonerc_admin # 将镜像“Img_cli”设置为“public”
[root@controller ~(keystone_admin)]# openstack image set --public Img_cli
[root@controller ~(keystone_admin)]# openstack image show Img_cli

导入用户“User_cli_01”的环境变量，查看镜像列表中是否会显示镜像 “Img_cli”

[root@controller ~(keystone_admin)]# source keystonerc_User_cli_01[root@controller ~(keystone_User_cli_01)]# openstack image list
+--------------------------------------+---------+--------+
| ID                                   | Name    | Status |
+--------------------------------------+---------+--------+
| fc5531bc-f4c5-4442-a0a8-dacc610026bd | Img_cli | active |
| efec5f1d-ee48-43ee-bdfc-dc1ee2c0a590 | Img_web | active |
+--------------------------------------+---------+--------+

4.共享镜像

[root@controller ~(keystone_User_cli_01)]# source keystonerc_admin # 将镜像设置为“shared”
[root@controller ~(keystone_admin)]# openstack image set --shared Img_cli
[root@controller ~(keystone_admin)]# source keystonerc_User_cli_01
[root@controller ~(keystone_User_cli_01)]# openstack image list
+--------------------------------------+---------+--------+
| ID                                   | Name    | Status |
+--------------------------------------+---------+--------+
| efec5f1d-ee48-43ee-bdfc-dc1ee2c0a590 | Img_web | active |
+--------------------------------------+---------+--------+# 导入用户admin的环境变量，并查看镜像列表和项目列表
[root@controller ~(keystone_User_cli_01)]# source keystonerc_admin 
[root@controller ~(keystone_admin)]# openstack image list
+--------------------------------------+---------+--------+
| ID                                   | Name    | Status |
+--------------------------------------+---------+--------+
| fc5531bc-f4c5-4442-a0a8-dacc610026bd | Img_cli | active |
| efec5f1d-ee48-43ee-bdfc-dc1ee2c0a590 | Img_web | active |
+--------------------------------------+---------+--------+
[root@controller ~(keystone_admin)]# openstack project list
+----------------------------------+-------------+
| ID                               | Name        |
+----------------------------------+-------------+
| 170a2a62b1f044909d8f287cca4b9040 | Project_cli |
| 48ed70898bd64fe5a0ab8429d04527d3 | services    |
| 6538330d9ce04926ba60cbdfd32fc1a4 | admin       |
| d1bed3db026e45b39ab37fa4eb725d9a | Project_web |
+----------------------------------+-------------+# 记录镜像“Img_cli”和项目“Project_cli”的ID[root@controller ~(keystone_admin)]# openstack image add project fc5531bc-f4c5-4442-a0a8-dacc610026bd 170a2a62b1f044909d8f287cca4b9040
+------------+--------------------------------------+
| Field      | Value                                |
+------------+--------------------------------------+
| created_at | 2025-10-28T02:59:39Z                 |
| image_id   | fc5531bc-f4c5-4442-a0a8-dacc610026bd |
| member_id  | 170a2a62b1f044909d8f287cca4b9040     |
| schema     | /v2/schemas/member                   |
| status     | pending                              |
| updated_at | 2025-10-28T02:59:39Z                 |
+------------+--------------------------------------+
# 执行完后，查看状态为“pending”[root@controller ~(keystone_admin)]# source keystonerc_User_cli_01
[root@controller ~(keystone_User_cli_01)]# openstack image list 
+--------------------------------------+---------+--------+
| ID                                   | Name    | Status |
+--------------------------------------+---------+--------+
| efec5f1d-ee48-43ee-bdfc-dc1ee2c0a590 | Img_web | active |
+--------------------------------------+---------+--------+
# 若状态为“pending”，用户还是无法查看共享的镜像
# 记录Img_cli的id
# 更新状态为“accept”，接收共享镜像
[root@controller ~(keystone_User_cli_01)]# openstack image set --accept fc5531bc-f4c5-4442-a0a8-dacc610026bd
[root@controller ~(keystone_User_cli_01)]# openstack image list 
+--------------------------------------+---------+--------+
| ID                                   | Name    | Status |
+--------------------------------------+---------+--------+
| fc5531bc-f4c5-4442-a0a8-dacc610026bd | Img_cli | active |
| efec5f1d-ee48-43ee-bdfc-dc1ee2c0a590 | Img_web | active |
+--------------------------------------+---------+--------+

5.转换镜像格式

上传环境文件

[root@controller ~(keystone_User_cli_01)]# source keystonerc_admin 
[root@controller ~(keystone_admin)]# 
[root@controller ~(keystone_admin)]# ls
anaconda-ks.cfg                    cirros-0.5.2-x86_64-disk.img
answers.txt                        keystonerc_User_cli_01
answers.txt.bak                    keystonerc_User_cli_02
bionic-server-cloudimg-amd64.vmdk  keystonerc_admin[root@controller ~(keystone_admin)]# qemu-img info bionic-server-cloudimg-amd64.vmdk 
image: bionic-server-cloudimg-amd64.vmdk
file format: vmdk
virtual size: 10 GiB (10737418240 bytes)
disk size: 370 MiB
cluster_size: 65536
Format specific information:cid: 2119925927parent cid: 4294967295create type: streamOptimizedextents:[0]:compressed: truevirtual size: 10737418240filename: bionic-server-cloudimg-amd64.vmdkcluster size: 65536format:

将镜像从VMDK格式转换为QCOW2格式

[root@controller ~(keystone_admin)]# qemu-img convert -f vmdk -O qcow2 -c -p bionic-server-cloudimg-amd64.vmdk bionic-server-cloudimg-amd64.qcow2

-f：指定输入磁盘镜像格式

-O：指定输出格式

-c：目标只能被压缩成QCOW2格式

-p：显示转换进度

[root@controller ~(keystone_admin)]# qemu-img info bionic-server-cloudimg-amd64.qcow2 
image: bionic-server-cloudimg-amd64.qcow2
file format: qcow2
virtual size: 10 GiB (10737418240 bytes)
disk size: 387 MiB
cluster_size: 65536
Format specific information:compat: 1.1compression type: zliblazy refcounts: falserefcount bits: 16corrupt: falseextended l2: false

创建镜像“Ubuntu_cli”，镜像格式为“QCOW2”，镜像状态为 “public”

[root@controller ~(keystone_admin)]# openstack image create --disk-format qcow2 --container-format bare --min-disk 1 --min-ram 128 --public --file ./bionic-server-cloudimg-amd64.qcow2 Ubuntu_cli

6.导出镜像

[root@controller ~(keystone_admin)]# openstack image list
+--------------------------------------+------------+--------+
| ID                                   | Name       | Status |
+--------------------------------------+------------+--------+
| fc5531bc-f4c5-4442-a0a8-dacc610026bd | Img_cli    | active |
| efec5f1d-ee48-43ee-bdfc-dc1ee2c0a590 | Img_web    | active |
| 083fb830-7d06-4296-a907-0fba621c58a0 | Ubuntu_cli | active |
+--------------------------------------+------------+--------+# 保存镜像“Ubuntu_cli”到本地
[root@controller ~(keystone_admin)]# openstack image save --file Ubuntu.qcow2 Ubuntu_cli

7.删除镜像

[root@controller ~(keystone_admin)]# openstack image delete Ubuntu_cli# 验证
[root@controller ~(keystone_admin)]# openstack image list
+--------------------------------------+---------+--------+
| ID                                   | Name    | Status |
+--------------------------------------+---------+--------+
| fc5531bc-f4c5-4442-a0a8-dacc610026bd | Img_cli | active |
| efec5f1d-ee48-43ee-bdfc-dc1ee2c0a590 | Img_web | active |
+--------------------------------------+---------+--------+