目录

目录... 1

nimbus简单测试环境的搭建... 3

一、环境介绍... 3

二、环境部署... 5

我们先在nimbus server进行安装部署... 5

1.安装java和apache-ant，及XML-Parser. 5

2. 安装GT. 6

3.创建配置证书... 6

(1)创建CA.. 6

（2）配置CA.. 9

（3）创建主机证书... 9

（4）签发主机证书... 10

(5)创建用户证书... 11

（6）签发用户证书... 12

（7）确保主机证书可以被容器访问... 12

(8)为用户增加授权... 13

(9)验证基础安全... 13

4. 配置gridftp服务... 14

5. 验证调整GT. 15

6.安装Nimbus-TP2.2. 16

7. 配置nimbus-tp2.2. 17

(1)配置nimbus server端和VMM节点的globus用户无需密码互登陆... 17

（2）配置nimbus 18

(3)添加xen虚机的网络地址... 26

（4）调整一些云的设置... 26

8.创建云目录... 30

我们在nimbus client进行安装部署... 30

我们对VMM进行安装部署... 34

一.安装配置nimbus-control 34

二. 创建半虚拟化镜像... 36

1.用于半虚拟化安装NFS. 36

2.半虚拟化安装rhel5.2. 38

3. 创建我们所需的镜像... 52

三、环境测试... 54

四、实现One Click Clusters 60

1. 介绍... 60

2. 安装部署... 61

在nimbus server上进行的操作... 61

（1）安装 nimbus-context-broker. 61

（2）配置无密码的CA Certificates 61

（3）配置jndi-config.xml文件... 61

（4）重启container. 62

在虚机镜像中执行的操作... 63

3. 验证... 64

五、 总结... 67

1. 一些机制的认识... 67

（1）nimbus如何分配VMM资源？... 67

（2）如何处理手工关掉的vm？... 68

（3）Cloud Schedule的一些理解... 68

2. 一些不足... 70

(1)nimbus目前不支持高可用... 70

(2)nimbus的镜像不能使windows 70

(3)镜像根分区必须挂载到sda1. 70

(4)nimbus支持的vm，只能在启动时dhcp配置一个网卡... 71

nimbus简单测试环境的搭建

Nimbus（workspace.globus.org）是基于Globus（www.globus.org）网格软件包GT中的java core(ws-core)组件而开发的IaaS平台软件。

一、环境介绍

这里为了搭建一个简单的环境，我们选取了三台机器：

Role

Hostname

IP

OS

User

Software

nimbus client

wang135.hrwang.com

172.20.86.135

RHEL5.2/CentOS5.2

nimbus

jdk-1_5_0_17-linux

nimbus-cloud-client-011.tar.gz

nimbus server

wang136.hrwang.com

172.20.86.136

RHEL5.2/CentOS5.2

globus

nimbus

jdk-1_5_0_17-linux

apache-ant-1.7.1-bin.tar.gz

XML-Parser-2.36.tar.gz

gt4.0.8-all-source-installer.tar.bz2

nimbus-TP2.2.tar.gz

VMM

cloud.jsgl.com

172.20.86.174

RHEL5.2/CentOS5.2

globus

dhcpd

python2.3+

sudo

ebtables-v2.0.8-2.tar.gz

nimbus-controls-TP2.2.tar.gz

结合上面的结构图，wang135.hrwang.com可以当做cloud-client； wang136.hrwang.com可以当做Workspace Service+Repository； node可以当做VMMs。

二、环境部署

下面以#开头的命令是root用户执行的，以$开头的命令是普通用户执行的。

首先确保，每台机器的/etc/hosts内容都如下：

172.20.86.135   wang135.hrwang.com wang135

172.20.86.136   wang136.hrwang.com wang136

172.20.86.169   cloud.jsgl.com cloud

另外将相应的用户在相应的机器上创建起来。

我们先在nimbus server进行安装部署

1.安装java和apache-ant，及XML-Parser

[root@wang136 opt]# pwd

/opt

[root@wang136 opt]# ./jdk-1_5_0_17-linux-amd64.bin              解压安装

[root@wang136 opt]# tar zxvf apache-ant-1.7.1-bin.tar.gz            解压安装

[root@wang136 opt]# vi /etc/profile                         在文件末添加环境变量

export ANT_HOME=/opt/apache-ant-1.7.1/

PATH=/opt/apache-ant-1.7.1/bin:/opt/jdk1.5.0_17/bin:/opt/jdk1.5.0_17/jre/bin:$PATH

JAVA_HOME=/opt/jdk1.5.0_17

CLASSPATH=/opt/jdk1.5.0_17/lib:/opt/jdk1.5.0_17/jre/lib:/opt/apache-ant-1.7.1/lib

export PATH

export JAVA_HOME

export CLASSPATH

[root@wang136 opt]# source /etc/profile                        生效环境变量

[root@wang136 opt]# java –version                            验证

java version "1.5.0_17"

Java(TM) 2 Runtime Environment, Standard Edition (build 1.5.0_17-b04)

Java HotSpot(TM) 64-Bit Server VM (build 1.5.0_17-b04, mixed mode)

[root@wang136 opt]# ant -version

Apache Ant version 1.7.1 compiled on June 27 2008

[root@wang136 opt]# tar zxvf XML-Parser-2.36.tar.gz       安这个包是为了以后装GRAM

[root@wang136 opt]# cd XML-Parser-2.36

[root@wang136 XML-Parser-2.36]# perl Makefile.PL

[root@wang136 XML-Parser-2.36]# make

[root@wang136 XML-Parser-2.36]# make install

2. 安装GT

[root@wang136 ~]# useradd globus                        创建globus用户

[root@wang136 ~]# passwd globus

[root@wang136 ~]# mkdir /usr/local/globus-4.0.8             创建安装目录

[root@wang136 ~]# chown -R globus:globus /usr/local/globus-4.0.8

[root@wang136 ~]# cd /opt/                              软件放在opt目录下

[root@wang136 opt]# tar jxvf gt4.0.8-all-source-installer.tar.bz2

[root@wang136 opt]# chown -R globus:globus gt4.0.8-all-source-installer

切换到globus登陆的终端

[globus@wang136 gt4.0.8-all-source-installer]$ pwd

/opt/gt4.0.8-all-source-installer

[globus@wang136 gt4.0.8-all-source-installer]$ export GLOBUS_LOCATION=/usr/local/globus-4.0.8                  （将这行添加到/home/globus/.bash_profile的末尾）

[globus@wang136 gt4.0.8-all-source-installer]$ ./configure --prefix=/usr/local/globus-4.0.8

[globus@wang136 gt4.0.8-all-source-installer]$ make wsjava gridftp

[globus@wang136 gt4.0.8-all-source-installer]$ make wsjava gridftp install

3.创建配置证书

(1)创建CA

使用globus用户执行下面的操作

[globus@wang136 gt4.0.8-all-source-installer]$ cd /usr/local/globus-4.0.8/   

[globus@wang136 globus-4.0.8]$ sh etc/globus-user-env.sh     

将下面这行添加到/home/globus/.bash_profile的末尾：

source /usr/local/globus-4.0.8/etc/globus-user-env.sh

[globus@wang136 globus-4.0.8]$ ./setup/globus/setup-simple-ca             生成CA

WARNING: GPT_LOCATION not set, assuming:

         GPT_LOCATION=/usr/local/globus-4.0.8

    C e r t i f i c a t e    A u t h o r i t y    S e t u p

This script will setup a Certificate Authority for signing Globus

users certificates.  It will also generate a simple CA package

that can be distributed to the users of the CA.

The CA information about the certificates it distributes will

be kept in:

/home/globus/.globus/simpleCA/

The unique subject name for this CA is:

cn=Globus Simple CA, ou=simpleCA-wang136.hrwang.com, ou=GlobusTest, o=Grid

Do you want to keep this as the CA subject (y/n) [y]:y

Enter the email of the CA (this is the email where certificate

requests will be sent to be signed by the CA):wanghongrui@ceopen.cn

The CA certificate has an expiration date. Keep in mind that

once the CA certificate has expired, all the certificates

signed by that CA become invalid.  A CA should regenerate

the CA certificate and start re-issuing ca-setup packages

before the actual CA certificate expires.  This can be done

by re-running this setup script.  Enter the number of DAYS

the CA certificate should last before it expires.

[default: 5 years (1825 days)]:

Enter PEM pass phrase:

Verifying - Enter PEM pass phrase:

creating CA config package...done.

A self-signed certificate has been generated

for the Certificate Authority with the subject:

/O=Grid/OU=GlobusTest/OU=simpleCA-wang136.hrwang.com/CN=Globus Simple CA

If this is invalid, rerun this script

./setup/globus/setup-simple-ca

and enter the appropriate fields.

-------------------------------------------------------------------

The private key of the CA is stored in /home/globus/.globus/simpleCA//private/cakey.pem

The public CA certificate is stored in /home/globus/.globus/simpleCA//cacert.pem

The distribution package built for this CA is stored in

/home/globus/.globus/simpleCA//globus_simple_ca_2f982487_setup-0.19.tar.gz

This file must be distributed to any host wishing to request

certificates from this CA.

CA setup complete.

The following commands will now be run to setup the security

configuration files for this CA:

$GLOBUS_LOCATION/sbin/gpt-build /home/globus/.globus/simpleCA//globus_simple_ca_2f982487_setup-0.19.tar.gz

$GLOBUS_LOCATION/sbin/gpt-postinstall

-------------------------------------------------------------------

setup-ssl-utils: Configuring ssl-utils package

Running setup-ssl-utils-sh-scripts...

***************************************************************************

Note: To complete setup of the GSI software you need to run the

following script as root to configure your security configuration

directory:

/usr/local/globus-4.0.8/setup/globus_simple_ca_2f982487_setup/setup-gsi

For further information on using the setup-gsi script, use the -help

option.  The -default option sets this security configuration to be

the default, and -nonroot can be used on systems where root access is

not available.

***************************************************************************

setup-ssl-utils: Complete

注1： 上面选择的都是默认答案，只有邮箱和密码根据情况填写。

（2）配置CA

使用root执行：

[root@wang136 opt]# export GLOBUS_LOCATION=/usr/local/globus-4.0.8

[root@wang136 opt]# /usr/local/globus-4.0.8/setup/globus_simple_ca_2f982487_setup/setup-gsi -default

setup-gsi: Configuring GSI security

Making /etc/grid-security...

mkdir /etc/grid-security

Making trusted certs directory: /etc/grid-security/certificates/

mkdir /etc/grid-security/certificates/

Installing /etc/grid-security/certificates//grid-security.conf.2f982487...

Running grid-security-config...

Installing Globus CA certificate into trusted CA certificate directory...

Installing Globus CA signing policy into trusted CA certificate directory...

setup-gsi: Complete