kvm虚拟化

环境说明：

• 关闭防火墙和selinux

[root@192 ~]# systemctl disable --now firewalld 
Removed symlink /etc/systemd/system/multi-user.target.wants/firewalld.service.
Removed symlink /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service.
[root@192 ~]# sed -i 's/SELINUX=enforcing/SELINUX=disabled/' /etc/selinux/config
[root@kvm ~]# systemctl disable --now firewalld 
[root@kvm ~]# sed -i 's/SELINUX=enforcing/SELINUX=disabled/' /etc/selinux/config
[root@kvm ~]# reboot

• kvm安装

//安装依赖包
[root@kvm ~]# yum -y install epel-release vim wget net-tools unzip zip gcc gcc-c++

//kvm安装
[root@kvm ~]# yum -y install qemu-kvm qemu-kvm-tools qemu-img virt-manager libvirt libvirt-python libvirt-client virt-install virt-viewer bridge-utils libguestfs-tools

//因为虚拟机中网络，我们一般都是和公司的其他服务器是同一个网段，所以我们需要把 
KVM服务器的网卡配置成桥接模式。这样的话KVM的虚拟机就可以通过该桥接网卡和公司内部 
其他服务器处于同一网段
//查看网卡信息
[root@kvm ~]# ip a 
1: lo:  mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: ens33:  mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 00:0c:29:df:75:4c brd ff:ff:ff:ff:ff:ff
    inet 192.168.218.139/24 brd 192.168.218.255 scope global noprefixroute dynamic ens33
       valid_lft 1455sec preferred_lft 1455sec
    inet6 fe80::85bb:54ea:c3cb:5d54/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever

//此处我的网卡是ens33，所以用br0来桥接ens33网卡
[root@kvm ~]# cd /etc/sysconfig/network-scripts/
[root@kvm network-scripts]# ls 
ifcfg-ens33     //其他文件不展示了
[root@kvm network-scripts]# cp ifcfg-ens33 ifcfg-br0
[root@kvm network-scripts]# vi ifcfg-br0 
TYPE=Bridge
DEVICE=br0
NM_ConTROLLED=no
BOOTPROTO=static
NAME=br0
onBOOT=yes
IPADDR=192.168.218.139
NETMASK=255.255.255.0
GATEWAY=192.168.218.2
DNS1=114.114.114.114
DNS2=8.8.8.8

[root@kvm network-scripts]# vi ifcfg-ens33 
TYPE=Ethernet
BOOTPROTO=static
NAME=ens33
DEVICE=ens33
onBOOT=yes
BRIDGE=br0
NM_ConTROLLED=no

//重启网络
[root@kvm ~]# systemctl restart network
[root@kvm network-scripts]# ip a
1: lo:  mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: ens33:  mtu 1500 qdisc pfifo_fast master br0 state UP group default qlen 1000
    link/ether 00:0c:29:df:75:4c brd ff:ff:ff:ff:ff:ff
    inet6 fe80::20c:29ff:fedf:754c/64 scope link 
       valid_lft forever preferred_lft forever
4: br0:  mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 00:0c:29:df:75:4c brd ff:ff:ff:ff:ff:ff
    inet 192.168.218.139/24 brd 192.168.218.255 scope global br0
       valid_lft forever preferred_lft forever
    inet6 fe80::20c:29ff:fedf:754c/64 scope link 
       valid_lft forever preferred_lft forever

//启动服务
[root@kvm ~]# systemctl start libvirtd
[root@kvm ~]# systemctl enable libvirtd

//验证安装结果
[root@kvm ~]# lsmod|grep kvm
kvm_intel             174841  0 
kvm                   578518  1 kvm_intel
irqbypass              13503  1 kvm

//创建软链接
[root@kvm ~]# ln -s /usr/libexec/qemu-kvm /usr/bin/qemu-kvm
[root@kvm ~]# which qemu-kvm
/usr/bin/qemu-kvm

//安装依赖包
[root@kvm ~]# yum -y install git python-pip libvirt-python libxml2-python python-websockify supervisor nginx python-devel

//从github上下载webvirtmgr代码
[root@kvm ~]# cd /usr/local/src/
[root@kvm src]# git clone git://github.com/retspen/webvirtmgr.git

//安装webvirtmgr
[root@kvm src]# cd webvirtmgr/
[root@kvm webvirtmgr]# pip install -r requirements.txt

//检查sqlite3是否安装
[root@kvm webvirtmgr]# python
Python 2.7.5 (default, Nov 16 2020, 22:23:17) 
[GCC 4.8.5 20150623 (Red Hat 4.8.5-44)] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import sqlite3     //输入此命令以后不能有任何返回值，只要有就是错误的
>>> exit()

//初始化帐号信息
[root@kvm webvirtmgr]# python manage.py syncdb
WARNING:root:No local_settings file found.
Creating tables ...
Creating table auth_permission
Creating table auth_group_permissions
Creating table auth_group
Creating table auth_user_groups
Creating table auth_user_user_permissions
Creating table auth_user
Creating table django_content_type
Creating table django_session
Creating table django_site
Creating table servers_compute
Creating table instance_instance
Creating table create_flavor

You just installed Django's auth system, which means you don't have any superusers defined.
Would you like to create one now? (yes/no): yes
Username (leave blank to use 'root'): admin
Email address: 1@2.com
Password: 
Password (again): 
Superuser created successfully.
Installing custom SQL ...
Installing indexes ...
Installed 6 object(s) from 1 fixture(s)

//拷贝web网页至指定目录
[root@kvm webvirtmgr]# mkdir /var/www
[root@kvm webvirtmgr]# cp -r /usr/local/src/webvirtmgr /var/www/
[root@kvm webvirtmgr]# chown -R nginx.nginx /var/www/webvirtmgr/

//生成密钥
[root@kvm ~]# ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa): 
Created directory '/root/.ssh'.
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:dW5mT5nCFtb1+xHqGc6n0hHh7tmM42Zd6FvwYDH+RF0 root@kvm
The key's randomart image is:
+---[RSA 2048]----+
|                E|
|             o .+|
|          . = =.+|
|         . = =.*o|
|        S   XoX+.|
|           =+B+*+|
|            o*O.*|
|           . O+= |
|            =oo. |
+----[SHA256]-----+
//由于这里webvirtmgr和kvm服务部署在同一台机器，所以这里本地信任。如果kvm部署在其他机器，那么这个是它的ip
[root@kvm ~]# ssh-copy-id 192.168.218.139

//配置端口转发
[root@kvm ~]# ssh 192.168.218.139 -L localhost:8000:localhost:8000 -L localhost:6080:localhost:60
[root@kvm ~]# ss -antl 
State       Recv-Q Send-Q Local Address:Port               Peer Address:Port              
LISTEN      0      128    127.0.0.1:6080                *:*                  
LISTEN      0      128    127.0.0.1:8000                *:*                  
LISTEN      0      5      192.168.122.1:53                  *:*                  
LISTEN      0      128     *:22                  *:*                  
LISTEN      0      100    127.0.0.1:25                  *:*                  
LISTEN      0      128       ::1:6080               :::*                  
LISTEN      0      128       ::1:8000               :::*                  
LISTEN      0      128    :::22                 :::*                  
LISTEN      0      100       ::1:25                 :::*         

//配置nginx
[root@kvm ~]# cd /etc/nginx/
[root@kvm nginx]# vi nginx.conf
server {
    listen 80 default_server;

    server_name $hostname;
    #access_log /var/log/nginx/webvirtmgr_access_log;

    location /static/ {
        root /var/www/webvirtmgr/webvirtmgr;
        expires max;
    }

    location / {
        proxy_pass http://127.0.0.1:8000;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-for $proxy_add_x_forwarded_for;
        proxy_set_header Host $host:$server_port;
        proxy_set_header X-Forwarded-Proto $remote_addr;
        proxy_connect_timeout 600;
        proxy_read_timeout 600;
        proxy_send_timeout 600;
        client_max_body_size 1024M;
    }
}
[root@kvm ~]# vim /etc/nginx/conf.d/webvirtmgr.conf
server {
    listen 80 default_server;

    server_name $hostname;
    #access_log /var/log/nginx/webvirtmgr_access_log;

    location /static/ {
        root /var/www/webvirtmgr/webvirtmgr;
        expires max;
    }

    location / {
        proxy_pass http://127.0.0.1:8000;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-for $proxy_add_x_forwarded_for;
        proxy_set_header Host $host:$server_port;
        proxy_set_header X-Forwarded-Proto $remote_addr;
        proxy_connect_timeout 600;
        proxy_read_timeout 600;
        proxy_send_timeout 600;
        client_max_body_size 1024M;
    }
}

//确保bind绑定的是本机的8000端口
[root@kvm ~]#  vim /var/www/webvirtmgr/conf/gunicorn.conf.py
bind = '0.0.0.0:8000'     //确保此处绑定的是本机的8000端口，这个在nginx配置中定义了，被代理的端口
backlog = 2048

//重启nginx
[root@kvm ~]# systemctl restart nginx
[root@kvm ~]# ss -antl 
State       Recv-Q Send-Q Local Address:Port               Peer Address:Port              
LISTEN      0      128    127.0.0.1:6080                *:*                  
LISTEN      0      128    127.0.0.1:8000                *:*                  
LISTEN      0      128     *:80                  *:*                  
LISTEN      0      5      192.168.122.1:53                  *:*                  
LISTEN      0      128     *:22                  *:*                  
LISTEN      0      100    127.0.0.1:25                  *:*                  
LISTEN      0      128       ::1:6080               :::*                  
LISTEN      0      128       ::1:8000               :::*                  
LISTEN      0      128    :::22                 :::*                  
LISTEN      0      100       ::1:25                 :::*     

//设置supervisor
在文件最后加上以下内容
[program:webvirtmgr]
command=/usr/bin/python2 /var/www/webvirtmgr/manage.py run_gunicorn -c /var/www/webvirtmgr/conf/gunicorn.conf.py
directory=/var/www/webvirtmgr
autostart=true
autorestart=true
logfile=/var/log/supervisor/webvirtmgr.log
log_stderr=true
user=nginx

[program:webvirtmgr-console]
command=/usr/bin/python2 /var/www/webvirtmgr/console/webvirtmgr-console
directory=/var/www/webvirtmgr
autostart=true
autorestart=true
stdout_logfile=/var/log/supervisor/webvirtmgr-console.log
redirect_stderr=true
user=nginx

//启动supervisor并设置开机自启
[root@kvm ~]# systemctl start supervisord
[root@kvm ~]# systemctl enable supervisord

//配置nginx用户
[root@kvm ~]# su - nginx -s /bin/bash
-bash-4.2$ ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/var/lib/nginx/.ssh/id_rsa): 
Created directory '/var/lib/nginx/.ssh'.
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /var/lib/nginx/.ssh/id_rsa.
Your public key has been saved in /var/lib/nginx/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:BOvdXxmHcTxly/BPt174DqQcqgU5hofK4Z/CAWxD47M nginx@kvm
The key's randomart image is:
+---[RSA 2048]----+
|      .      ...=|
|  o    o      +*o|
| + .  . .     o+=|
|  B  . = o     *+|
| . =. + S . . =.o|
|  Eo.o o o + =...|
|   .+.    o + ...|
|    o. . o     o |
|     .o .       .|
+----[SHA256]-----+
-bash-4.2$ touch ~/.ssh/config && echo -e "StrictHostKeyChecking=nonUserKnownHostsFile=/dev/null" >> ~/.ssh/config
-bash-4.2$ chmod 0600 ~/.ssh/config
-bash-4.2$ ssh-copy-id root@192.168.218.139
/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/var/lib/nginx/.ssh/id_rsa.pub"
/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
Warning: Permanently added '192.168.218.139' (ECDSA) to the list of known hosts.
root@192.168.218.139's password: 
Permission denied, please try again.
root@192.168.218.139's password: 
Permission denied, please try again.
root@192.168.218.139's password: 
Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).
-bash-4.2$ exit
logout

[root@kvm ~]# vim /etc/polkit-1/localauthority/50-local.d/50-libvirt-remote-access.pkla
[Remote libvirt SSH access]
Identity=unix-user:root
Action=org.libvirt.unix.manage
ResultAny=yes
ResultInactive=yes
ResultActive=yes

[root@kvm ~]# systemctl restart nginx libvirtd

• 网页访问
  

• 创建SSH连接：
  
  
  
• kvm存储管理
  

• 通过远程连接软件上传ISO镜像文件至存储目录/var/lib/libvirt/images/

[root@kvm ~]# cd /var/lib/libvirt/images/
[root@kvm images]# ls 
CentOS-8.2.2004-x86_64-minimal.iso

• 创建系统安装镜像
  
  
• 添加成功如下图所示
  

• 添加桥接网络
  
  
  

• 实例(虚拟机)创建
  
  
  
  
• 设置在 web 上访问虚拟机的密码
  
  
• 虚拟机安装
  
  看到此界面就可以安装了