KVM虚拟化

虚拟化介绍
KVM
KVM部署
KVM web管理界面安装
- 连接KVM1
- 连接KVM2
故障案例

虚拟化介绍

虚拟化是云计算的基础。简单的说，虚拟化使得在一台物理的服务器上可以跑多台虚拟机，虚拟机共享物理机的 CPU、内存、IO 硬件资源，但逻辑上虚拟机之间是相互隔离的。

物理机我们一般称为宿主机（Host），宿主机上面的虚拟机称为客户机（Guest）。

那么 Host 是如何将自己的硬件资源虚拟化，并提供给 Guest 使用的呢？
这个主要是通过一个叫做 Hypervisor 的程序实现的。

根据 Hypervisor 的实现方式和所处的位置，虚拟化又分为两种：

全虚拟化
半虚拟化

虚拟化技术优势：

降低资金成本和运维成本
最大限度减少或消除停机
提高IT部门的工作效率、效益、敏捷性和响应能力
加快应用和资源的置备速度
提高业务连续性和灾难恢复能力
简化数据中心管理
提供真正的软件定义中心

KVM

kVM 全称是 Kernel-based Virtual Machine。也就是说 KVM 是基于 Linux 内核实现的。
KVM有一个内核模块叫 kvm.ko，只用于管理虚拟 CPU 和内存。

那 IO 的虚拟化，比如存储和网络设备则是由 Linux 内核与Qemu来实现。

作为一个 Hypervisor，KVM 本身只关注虚拟机调度和内存管理这两个方面。IO 外设的任务交给 Linux 内核和 Qemu。

大家在网上看 KVM 相关文章的时候肯定经常会看到 Libvirt 这个东西。

Libvirt 就是 KVM 的管理工具。

其实，Libvirt 除了能管理 KVM 这种 Hypervisor，还能管理 Xen，VirtualBox 等。

Libvirt 包含 3 个东西：后台 daemon 程序 libvirtd、API 库和命令行工具 virsh

libvirtd是服务程序，接收和处理 API 请求；
API 库使得其他人可以开发基于 Libvirt 的高级工具，比如 virt-manager，这是个图形化的 KVM 管理工具；
virsh 是我们经常要用的 KVM 命令行工具

KVM部署

部署前请确保你的CPU虚拟化功能已开启。分为两种情况：

虚拟机要关机设置CPU虚拟化
物理机要在BIOS里开启CPU虚拟化

环境:

	系统类型	IP
KVM1	redhat8	192.168.8.129
KVM2	centos7	192.168.8.127
KVM-web	centos7	192.168.8.128

KVM1操作

# 安装软件包
[root@KVM1 ~]# dnf -y install epel-release vim wget net-tools unzip zip gcc gcc-c++

#KVM安装
[root@KVM1 ~]# dnf -y install qemu-kvm qemu-kvm-common qemu-img virt-manager libvirt python3-libvirt libvirt-client virt-install virt-viewer bridge-utils libguestfs-tools

#检查cpu是否支持kvm
[root@KVM1 ~]# egrep -o 'vmx|svm' /proc/cpuinfo
vmx
vmx

桥接网卡

[root@KVM1 network-scripts]# cat ifcfg-br0 
TYPE="Bridge"
BOOTPROTO="static"
NAME="br0"
DEVICE="br0"
ONBOOT="yes"
IPADDR=192.168.8.129
PREFIX=24
GATEWAY=192.168.8.2
DNS1=8.8.8.8
[root@KVM network-scripts]# cat ifcfg-ens160 
TYPE="Ethernet"
BOOTPROTO="static"
NAME="ens160"
DEVICE="ens160"
ONBOOT="yes"
BRIDGE=br0

[root@KVM1 network-scripts]# systemctl restart NetworkManager
[root@KVM1 network-scripts]# ifdown ens160 ;ifup ens160 
错误："/etc/sysconfig/network-scripts/ifcfg-ens160" 不是活动的连接。
错误：未提供活动连接。
连接已成功激活（D-Bus 活动路径：/org/freedesktop/NetworkManager/ActiveConnection/3）
[root@KVM1 network-scripts]# ip a
1: lo:  mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: ens160:  mtu 1500 qdisc mq master br0 state UP group default qlen 1000
    link/ether 00:0c:29:2f:dc:34 brd ff:ff:ff:ff:ff:ff
3: br0:  mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 00:0c:29:2f:dc:34 brd ff:ff:ff:ff:ff:ff
    inet 192.168.8.129/24 brd 192.168.8.255 scope global noprefixroute br0
       valid_lft forever preferred_lft forever
    inet6 fe80::20c:29ff:fe2f:dc34/64 scope link 
       valid_lft forever preferred_lft forever

启动kvm

#启动服务
[root@KVM1 network-scripts]# systemctl enable --now libvirtd
[root@KVM1 network-scripts]# systemctl status libvirtd
● libvirtd.service - Virtualization daemon
   Loaded: loaded (/usr/lib/systemd/system/libvirtd.service; enabled; vendor preset: enabled)
   Active: active (running) since Wed 2021-10-20 14:24:31 CST; 6s ago
     Docs: man:libvirtd(8)
           https://libvirt.org
 Main PID: 8270 (libvirtd)
    Tasks: 19 (limit: 32768)
   Memory: 19.6M

#验证安装结果
[root@KVM1 ~]# lsmod |grep kvm
kvm_intel             294912  0
kvm                   786432  1 kvm_intel
irqbypass              16384  1 kvm

[root@KVM1 ~]# virsh -c qemu:///system list
 Id   名称   状态
-------------------

[root@KVM1 ~]# ln -s /usr/libexec/qemu-kvm /usr/bin/qemu-kvm

#查看网桥信息
[root@KVM1 ~]# brctl show
bridge name	bridge id		STP enabled	interfaces
br0		8000.000c292fdc34	no		ens160
virbr0		8000.525400f7b340	yes		virbr0-nic

KVM2操作

# 安装软件包
[root@KVM2 ~]# yum -y install epel-release vim wget net-tools unzip zip gcc gcc-c++

#KVM安装
[root@kvm2 ~]# yum -y install qemu-kvm qemu-kvm-tools qemu-img virt-manager libvirt libvirt-python libvirt-client virt-install virt-viewer bridge-utils libguestfs-tools

#检查cpu是否支持kvm
[root@KVM2 ~]# egrep -o 'vmx|svm' /proc/cpuinfo
vmx
vmx

桥接网卡

[root@KVM2 network-scripts]# cat ifcfg-br0 
TYPE="Bridge"
BOOTPROTO="static"
NAME="br0"
DEVICE="br0"
ONBOOT="yes"
IPADDR=192.168.8.127
PREFIX=24
GATEWAY=192.168.8.2
DNS1=8.8.8.8
[root@KVM2 network-scripts]# cat ifcfg-ens160 
TYPE="Ethernet"
BOOTPROTO="static"
NAME="ens160"
DEVICE="ens160"
ONBOOT="yes"
BRIDGE=br0

[root@KVM2 network-scripts]# systemctl restart network
[root@KVM1 network-scripts]# ifdown ens33 ;ifup ens33 
错误："/etc/sysconfig/network-scripts/ifcfg-ens160" 不是活动的连接。
错误：未提供活动连接。
连接已成功激活（D-Bus 活动路径：/org/freedesktop/NetworkManager/ActiveConnection/3）
[root@kvm2 network-scripts]# ip a
1: lo:  mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: ens33:  mtu 1500 qdisc pfifo_fast master br0 state UP group default qlen 1000
    link/ether 00:0c:29:2e:3f:cd brd ff:ff:ff:ff:ff:ff
3: br0:  mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 00:0c:29:2e:3f:cd brd ff:ff:ff:ff:ff:ff
    inet 192.168.8.127/24 brd 192.168.8.255 scope global noprefixroute br0
       valid_lft forever preferred_lft forever
    inet6 fe80::84e4:52ff:fe45:ed2/64 scope link 
       valid_lft forever preferred_lft forever

启动kvm

#启动服务
[root@KVM2 ~]# systemctl enable --now libvirtd
[root@KVM2 ~]# systemctl status libvirtd
● libvirtd.service - Virtualization daemon
   Loaded: loaded (/usr/lib/systemd/system/libvirtd.service; enabled; vendor preset: enabled)
   Active: active (running) since Wed 2021-10-20 14:24:31 CST; 6s ago
     Docs: man:libvirtd(8)
           https://libvirt.org
 Main PID: 8270 (libvirtd)
    Tasks: 19 (limit: 32768)
   Memory: 19.6M

#验证安装结果
[root@KVM2 ~]# lsmod |grep kvm
kvm_intel             294912  0
kvm                   786432  1 kvm_intel
irqbypass              16384  1 kvm

[root@KVM2 ~]# virsh -c qemu:///system list
 Id   名称   状态
-------------------

[root@KVM2 ~]# ln -s /usr/libexec/qemu-kvm /usr/bin/qemu-kvm

#查看网桥信息
[root@kvm2 ~]# brctl show
bridge name	bridge id		STP enabled	interfaces
br0		8000.000c292e3fcd	no		ens33
virbr0		8000.525400832ca1	yes		virbr0-nic

KVM web管理界面安装

kvm 的 web 管理界面是由 webvirtmgr 程序提供的。

#安装epel源
[root@kvm-web ~]# yum -y install epel-release
#安装软件包
[root@kvm-web ~]# yum -y install git python-pip libvirt-python libxml2-python python-websockify supervisor nginx python-devel

#从github上下载webvirtmgr代码
[root@kvm-web ~]# cd /usr/local/src
[root@kvm-web src]# git clone git://github.com/retspen/webvirtmgr.git
正克隆到 'webvirtmgr'...
remote: Enumerating objects: 5614, done.
remote: Total 5614 (delta 0), reused 0 (delta 0), pack-reused 5614
接收对象中: 100% (5614/5614), 2.97 MiB | 225.00 KiB/s, 完成.
处理 delta 中: 100% (3606/3606), 完成.

#安装webvirtmgr
[root@kvm-web src]# cd webvirtmgr/
[root@kvm-web webvirtmgr]# pip install -r requirements.txt 
Collecting django==1.5.5 (from -r requirements.txt (line 1))
  Downloading https://files.pythonhosted.org/packages/38/49/93511c5d3367b6b21fc2995a0e53399721afc15e4cd6eb57be879ae13ad4/Django-1.5.5.tar.gz (8.1MB)
    100% |████████████████████████████████| 8.1MB 91kB/s 
Collecting gunicorn==19.5.0 (from -r requirements.txt (line 2))
  Downloading https://files.pythonhosted.org/packages/f9/4e/f4076a1a57fc1e75edc0828db365cfa9005f9f6b4a51b489ae39a91eb4be/gunicorn-19.5.0-py2.py3-none-any.whl (113kB)
    100% |████████████████████████████████| 122kB 1.5MB/s 
Collecting lockfile>=0.9 (from -r requirements.txt (line 5))
  Downloading https://files.pythonhosted.org/packages/c8/22/9460e311f340cb62d26a38c419b1381b8593b0bb6b5d1f056938b086d362/lockfile-0.12.2-py2.py3-none-any.whl
Installing collected packages: django, gunicorn, lockfile
  Running setup.py install for django ... done
Successfully installed django-1.5.5 gunicorn-19.5.0 lockfile-0.12.2
You are using pip version 8.1.2, however version 21.3 is available.
You should consider upgrading via the 'pip install --upgrade pip' command.


#初始化账号信息
[root@kvm-web webvirtmgr]# python
Python 2.7.5 (default, Nov 16 2020, 22:23:17) 
[GCC 4.8.5 20150623 (Red Hat 4.8.5-44)] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import sqlite3
>>> exit()
[root@kvm-web webvirtmgr]# python manage.py syncdb
WARNING:root:No local_settings file found.
Creating tables ...
Creating table auth_permission
Creating table auth_group_permissions
Creating table auth_group
Creating table auth_user_groups
Creating table auth_user_user_permissions
Creating table auth_user
Creating table django_content_type
Creating table django_session
Creating table django_site
Creating table servers_compute
Creating table instance_instance
Creating table create_flavor

You just installed Django's auth system, which means you don't have any superusers defined.
Would you like to create one now? (yes/no): yes		//问你是否创建超级管理员帐号
Username (leave blank to use 'root'): admin		//指定超级管理员帐号用户名，默认留空为root
Email address: 1@2.com		//设置超级管理员邮箱
Password: 		//设置超级管理员密码
Password (again): 		 //再次输入超级管理员密码
Superuser created successfully.
Installing custom SQL ...
Installing indexes ...
Installed 6 object(s) from 1 fixture(s)

#拷贝web网页至指定目录
[root@kvm-web webvirtmgr]# mkdir /var/www
[root@kvm-web webvirtmgr]# cp -r /usr/local/src/webvirtmgr/ /var/www/
[root@kvm-web webvirtmgr]# chown -R nginx.nginx /var/www/webvirtmgr

#生成密钥
[root@kvm-web ~]# ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa): 
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:V73NQ4AADyxZb3tXVzfDnzOJCFWagswOxZ/m4X0d9gA root@kvm-web
The key's randomart image is:
+---[RSA 2048]----+
|      ==..o.oo.oo|
|     o+o=. .E...=|
|     ..+.=ooo.oo=|
|      o .=oo .+@o|
|       .S.+. .+oB|
|         +.... .o|
|            .    |
|                 |
|                 |
+----[SHA256]-----+
[root@kvm-web ~]# ssh-copy-id 192.168.8.129
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
The authenticity of host '192.168.8.129 (192.168.8.129)' can't be established.
ECDSA key fingerprint is SHA256:M55K1WE4IQkTBu6mvhszdufPrKh0hripkeHuF9Em52k.
ECDSA key fingerprint is MD5:11:9b:42:bc:29:ae:63:96:04:de:b7:35:97:d9:5a:7d.
Are you sure you want to continue connecting (yes/no)? yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
root@192.168.8.129's password: 

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh '192.168.8.129'"
and check to make sure that only the key(s) you wanted were added.

[root@kvm-web ~]# ssh-copy-id 192.168.8.127
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
The authenticity of host '192.168.8.127 (192.168.8.127)' can't be established.
ECDSA key fingerprint is SHA256:8veN2gRCEGW8xJoabzr641fWdLy1/G7WRu623euckfI.
ECDSA key fingerprint is MD5:b9:56:ca:f1:c5:82:98:68:5d:e8:25:22:e1:cb:25:b4.
Are you sure you want to continue connecting (yes/no)? yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
root@192.168.8.127's password: 

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh '192.168.8.127'"
and check to make sure that only the key(s) you wanted were added.



#配置端口转发
[root@kvm-web ~]# ssh 192.168.8.129 -L localhost:8000:localhost:8000 -L localhost:6080:localhost:60
Last login: Wed Oct 20 20:01:05 2021 from 192.168.8.1
[root@kvm-web ~]# ssh 192.168.8.127 -L localhost:8000:localhost:8000 -L localhost:6080:localhost:60
bind: Address already in use
bind: Address already in use
Last login: Thu Oct 21 10:45:45 2021 from 192.168.8.1



#配置nginx
[root@kvm-web ~]# vim /etc/nginx/nginx.conf
    server {
        listen       80;
        server_name  localhost;

        # Load configuration files for the default server block.
        include /etc/nginx/default.d/*.conf;

        location / {
            root html;
            index index.html index.htm;
        }

        error_page 404 /404.html;
        location = /404.html {
        }

        error_page 500 502 503 504 /50x.html;
        location = /50x.html {
        }
    }


[root@kvm-web ~]# vim /etc/nginx/conf.d/webvirtmgr.conf
server {
    listen 80 default_server;

    server_name $hostname;
    #access_log /var/log/nginx/webvirtmgr_access_log;

    location /static/ {
        root /var/www/webvirtmgr/webvirtmgr;
        expires max;
    }

    location / {
        proxy_pass http://127.0.0.1:8000;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-for $proxy_add_x_forwarded_for;
        proxy_set_header Host $host:$server_port;
        proxy_set_header X-Forwarded-Proto $remote_addr;
        proxy_connect_timeout 600;
        proxy_read_timeout 600;
        proxy_send_timeout 600;
        client_max_body_size 1024M;
    }
}

#确保绑定的端口为8000
[root@kvm-web ~]# vim /var/www/webvirtmgr/conf/gunicorn.conf.py 
bind = '0.0.0.0:8000'

#重启nginx
[root@kvm-web ~]# systemctl enable --now nginx
Created symlink /etc/systemd/system/multi-user.target.wants/nginx.service → /usr/lib/systemd/system/nginx.service.

#设置supervisor
[root@kvm-web ~]# vim /etc/supervisord.conf		//文件最后加上以下内容
[program:webvirtmgr]
command=/usr/bin/python2 /var/www/webvirtmgr/manage.py run_gunicorn -c /var/www/webvirtmgr/conf/gunicorn.conf.py
directory=/var/www/webvirtmgr
autostart=true
autorestart=true
logfile=/var/log/supervisor/webvirtmgr.log
log_stderr=true
user=nginx

[program:webvirtmgr-console]
command=/usr/bin/python2 /var/www/webvirtmgr/console/webvirtmgr-console
directory=/var/www/webvirtmgr
autostart=true
autorestart=true
stdout_logfile=/var/log/supervisor/webvirtmgr-console.log
redirect_stderr=true
user=nginx

#设置开机自启supervisor
[root@kvm-web ~]# systemctl enable --now supervisord
Created symlink /etc/systemd/system/multi-user.target.wants/supervisord.service → /usr/lib/systemd/system/supervisord.service.
[root@kvm-web ~]# ss -antl
State       Recv-Q Send-Q              Local Address:Port                             Peer Address:Port              
LISTEN      0      100                             *:6080                                        *:*                  
LISTEN      0      128                             *:8000                                        *:*                  
LISTEN      0      128                             *:80                                          *:*                  
LISTEN      0      128                             *:22                                          *:*                  
LISTEN      0      100                     127.0.0.1:25                                          *:*                  
LISTEN      0      128                            :::22                                         :::*                  
LISTEN      0      100                           ::1:25                                         :::*   

#配置nginx用户
[root@kvm-web ~]# su - nginx -s /bin/bash
-bash-4.2$ ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/var/lib/nginx/.ssh/id_rsa): 
Created directory '/var/lib/nginx/.ssh'.
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /var/lib/nginx/.ssh/id_rsa.
Your public key has been saved in /var/lib/nginx/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:hX/6QlHkMXiEyq0L2bk/A9nXoSuzRphoS8oORGom3+o nginx@kvm-web
The key's randomart image is:
+---[RSA 2048]----+
|           ==    |
|         .o.oo   |
|  .    ..o.o.    |
| o      ooo   .  |
|oo.    +SB...o . |
|+o .  * O +oo .  |
|  o..+ o *.. .   |
|   oo . o B..    |
| .E..    ooB.    |
+----[SHA256]-----+
-bash-4.2$ touch ~/.ssh/config && echo -e "StrictHostKeyChecking=nonUserKnownHostsFile=/dev/null" >> ~/.ssh/config
-bash-4.2$ chmod 0600 ~/.ssh/config
-bash-4.2$ ssh-copy-id root@192.168.8.129
/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/var/lib/nginx/.ssh/id_rsa.pub"
/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
Warning: Permanently added '192.168.8.129' (ECDSA) to the list of known hosts.
root@192.168.8.129's password: 

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh 'root@192.168.8.129'"
and check to make sure that only the key(s) you wanted were added.

-bash-4.2$ ssh-copy-id root@192.168.8.127
/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/var/lib/nginx/.ssh/id_rsa.pub"
/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
Warning: Permanently added '192.168.8.127' (ECDSA) to the list of known hosts.
root@192.168.8.127's password: 

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh 'root@192.168.8.127'"
and check to make sure that only the key(s) you wanted were added.

-bash-4.2$ exit
登出

[root@kvm-web ~]# vim /etc/polkit-1/localauthority/50-local.d/50-libvirt-remote-access.pkla
[Remote libvirt SSH access]
Identity=unix-user:root
Action=org.libvirt.unix.manage
ResultAny=yes
ResultInactive=yes
ResultActive=yes


[root@kvm-web ~]# systemctl restart nginx

[root@KVM ~]# systemctl restart libvirtd

连接KVM1

KVM连接管理
创建ssh连接

KVM存储管理

创建存储：

#创建存储目录
[root@KVM ~]# mkdir /test

进入存储：

通过xftp将ISO镜像文件传至存储目录

[root@kvm ~]# cd /test/
[root@kvm test]# ls
CentOS-7-x86_64-DVD-1804-7.5.iso

创建系统安装镜像

kvm网络管理

添加桥接网络

实例管理
虚拟机创建

虚拟机插入光盘

设置在web上访问虚拟机的密码

启动虚拟机

连接KVM2

故障案例

1、无法创建存储

[root@kvm ~]# rpm -qa | grep libgcrypt	//升级libcrypyt
libgcrypt-1.8.3-4.el8.x86_64
[root@kvm ~]# yum update libgcrypt
[root@kvm ~]# rpm -qa | grep libgcrypt
libgcrypt-1.8.5-4.el8.x86_64

2、web界面配置完成后可能会出现以下错误界面

安装novnc并通过novnc_server启动一个vnc

[root@kvm-web ~]# yum -y install novnc
[root@kvm-web ~]# vim /etc/rc.d/rc.local
nohup novnc_server 192.168.8.128:5920 &
[root@kvm-web ~]# . /etc/rc.d/rc.local

KVM虚拟化

Linux相关栏目本月热门文章