KVM虚拟化安装

一、kvm虚拟化介绍

虚拟化分类
1、虚拟化，是指通过虚拟化技术将一台计算机虚拟为多台逻辑计算机。在一台计算机上同时运行多个逻辑计算机，每个逻辑计算机可运行不同的操作系统，并且应用程序都可以在相互独立的空间内运行而互相不影响，从而显著提高计算机的工作效率。

虚拟化使用软件的方法重新定义划分 IT 资源，可以实现 IT 资源的动态分配、灵活调度、跨域共享，提高 IT 资源利用率，使 IT 资源能够真正成为社会基础设施，服务于各行各业中灵活多变的应用需求。

2、虚拟化层次种类：

（1）完全虚拟化 — 最流行的虚拟化方法使用名为 hypervisor 的一种软件，在虚拟服务器和底层硬件之间建立一个抽象层。 VMware 和微软的VirtualPC 是代表该方法的两个商用产品，而基于核心的虚拟机 (KVM) 是面向 Linux 系统的开源产品hypervisor 可以捕获 CPU 指令，为指令访问硬件控制器和外设充当中介。因而，完全虚拟化技术几乎能让任何一款操作系统不用改动就能安装到虚拟服务器上，而它们不知道自己运行在虚拟化环境下。主要缺点是， hypervisor 给处理器带来开销

（2）准虚拟化 — 完全虚拟化是处理器密集型技术，因为它要求 hypervisor管理各个虚拟服务器，并让它们彼此独立。减轻这种负担的一种方法就是，改动客户端操作系统，让它以为自己运行在虚拟环境下，能够与hypervisor 协同工作。这种方法就叫准虚拟化 (para-virtualization)Xen 是开源准虚拟化技术的一个例子。操作系统作为虚拟服务器在 Xen hypervisor 上运行之前，它必须在核心层面进行某些改变。因此， Xen 适用于 BSD 、 Linux 、 Solaris 及其他开源操作系统，但不适合对像Windows 这些专有的操作系统进行虚拟化处理，因为它们无法改动。准虚拟化技术的优点是性能高。经过准虚拟化处理的服务器可与hypervisor 协同工作，其响应能力几乎不亚于未经过虚拟化处理的服务器。准虚拟化与完全虚拟化相比优点明显，以至于微软和 VMware 都在开发这项技术，以完善各自的产品。

（3）系统虚拟化 — 就操作系统层的虚拟化而言，没有独立的hypervisor 层。相反，主机操作系统本身就负责在多个虚拟服务器之间分配硬件资源，并且让这些服务器彼此独立。一个明显的区别是，如果使用操作系统层虚拟化，所有虚拟服务器必须运行同一操作系统 ( 不过每个实例有各自的应用程序和用户。

账户 ) 。虽然操作系统层虚拟化的灵活性比较差，但本机速度性能比较高。此外，由于架构在所有虚拟服务器上使用单一、标准的操作系统，管理起来比异构环境要容易。

（4）桌面虚拟化 — 服务器虚拟化主要针对服务器而言，而虚拟化最接近用户的还是要算的上桌面虚拟化了，桌面虚拟化主要功能是将分散的桌面环境集中保存并管理起来，包括桌面环境的集中下发，集中更新，集中管理。桌面虚拟化使得桌面管理变得简单，不用每台终端单独进行维护，每台终端进行更新。终端数据可以集中存储在中心机房里，安全性相对传统桌面应用要高很多。桌面虚拟化可以使得一个人拥有多个桌面环境，也可以把一个桌面环境供多人使用。

KVM — 全称是基于内核的虚拟机（Kernel-based Virtual Machine）

是一个开源软件，基于内核的虚拟化技术，实际是嵌入系统的一个虚拟化模块，通过优化内核来使用虚拟技术，该内核模块使得 Linux 变成了一个Hypervisor，虚拟机使用 Linux 自身的调度器进行管理。

KVM 是基于虚拟化扩展（Intel VT 或者 AMD-V）的 X86 硬件的开源的 Linux 原生的全虚拟化解决方案。KVM 中，虚拟机被实现为常规的 Linux 进程，由标准 Linux 调度程序进行调度；虚机的每个虚拟 CPU 被实现为一个常规的 Linux 进程。这使得 KMV 能够使用 Linux 内核的已有功能。但是，KVM 本身不执行任何硬件模拟，需要客户空间程序通过 /dev/kvm 接口设置一个客户机虚拟服务器的地址空间，向它提供模拟的 I/O，并将它的视频显示映射回宿主的显示屏。目前这个应用程序是 QEMU。

Linux 上的用户空间、内核空间、虚机：

Guest：客户机系统，包括CPU（vCPU）、内存、驱动（Console、网卡、I/O 设备驱动等），被 KVM 置于一种受限制的 CPU 模式下运行。

KVM：运行在内核空间，提供CPU 和内存的虚级化，以及客户机的 I/O 拦截。Guest 的 I/O 被 KVM 拦截后，交给 QEMU 处理。

QEMU：修改过的为 KVM 虚机使用的 QEMU 代码，运行在用户空间，提供硬件 I/O 虚拟化，通过IOCTL /dev/kvm 设备和 KVM 交互。

4、KVM有一个内核模块叫 kvm.ko，只用于管理虚拟 CPU 和内存。IO 的虚拟化，就交给 Linux 内核和qemu来实现。

Libvirt：是 KVM 的管理工具。Libvirt 除了能管理 KVM 这种 Hypervisor，还能管理 Xen，VirtualBox 等。OpenStack 底层也使用 Libvirt。

Libvirt 包含 3 个东西：后台 daemon 程序 libvirtd、API 库和命令行工具 virsh

（1）libvirtd是服务程序，接收和处理 API 请求；

（2）API 库使得其他人可以开发基于 Libvirt 的高级工具，比如 virt-manager，这是个图形化的 KVM 管理工具，后面我们也会介绍；

（3）virsh 是我们经常要用的 KVM 命令行工具，后面会有使用的示例。作为 KVM 和 OpenStack 的实施人员，virsh 和 virt-manager 是一定要会用的。

二、安装

环境：Centos7

外网：10.0.0.43

内网：172.16.1.43

1、关闭防火墙与selinux

[[email protected] c7-43 ~]# systemctl stop firewalld
[[email protected] c7-43 ~]# systemctl disable firewalld
[[email protected] c7-43 ~]# setenforce 0
[[email protected] c7-43 ~]# sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config

2、安装环境依赖

[[email protected] c7-43 ~]# yum -y install epel-release vim wget net-tools unzip zip gcc gcc-c++

3、配置环境修改网站访问并发量

#末尾添加星号代表全局， soft为软件，hard为硬件，nofile为这里指可打开文件数。
[[email protected] c7-43 ~]# vim /etc/security/limits.conf
* soft nofile 65535
* hard nofile 65535

#末尾添加
[[email protected] c7-43 ~]# vim /etc/pam.d/login
session required /lib/security/pam_limits.so

#末尾添加
[[email protected] c7-43 ~]# vim /etc/profile
ulimit -n 65535

[[email protected] c7-43 ~]# source /etc/profile
[[email protected] c7-43 ~]# ulimit -n

4、验证CPU是否支持KVM；如果结果中有vmx（Intel）或svm(AMD)字样，就说明CPU的支持的

KVM虚拟化安装

[[email protected] c7-43 ~]# egrep -o 'vmx|svm' /proc/cpuinfo
vmx
vmx

5、kvm安装

[[email protected] c7-43 ~]# yum -y install qemu-kvm qemu-kvm-tools qemu-img virt-manager libvirt libvirt-python libvirt-client virt-install virt-viewer bridge-utils libguestfs-tools

6、启动服务，验证安装结果

[[email protected] c7-43 ~]# systemctl start libvirtd

[[email protected] c7-43 ~]# systemctl enable libvirtd
[[email protected] c7-43 ~]# lsmod|grep kvm
kvm_intel 188644 0
kvm 621480 1 kvm_intel
irqbypass 13503 1 kvm

[[email protected] c7-43 ~]# virsh -c qemu:///system list
Id Name State
----------------------------------------------------

[[email protected] c7-43 ~]# ln -s /usr/libexec/qemu-kvm /usr/bin/qemu-kvm #软链接
[[email protected] c7-43 ~]# ll /usr/bin/qemu-kvm
lrwxrwxrwx 1 root root 21 May 9 15:28 /usr/bin/qemu-kvm -> /usr/libexec/qemu-kvm

三、kvm web管理界面安装

kvm 的 web 管理界面是由 webvirtmgr 程序提供的

1、安装依赖包

[[email protected] c7-43 ~]# yum -y install git python-pip libvirt-python libxml2-python python-websockify supervisor nginx python-devel

[[email protected] c7-43 ~]# pip install --upgrade pip -i https://pypi.tuna.tsinghua.edu.cn/simple #升级pip
Collecting pip
Downloading https://pypi.tuna.tsinghua.edu.cn/packages/54/2e/df11ea7e23e7e761d484ed3740285a34e38548cf2bad2bed3dd5768ec8b9/pip-20.1-py2.py3-none-any.whl (1.5MB)
100% |████████████████████████████████| 1.5MB 703kB/s
Installing collected packages: pip
Found existing installation: pip 8.1.2
Uninstalling pip-8.1.2:
Successfully uninstalled pip-8.1.2
Successfully installed pip-20.1

从github上下载webvirtmgr代码

[[email protected] c7-43 ~]# cd /usr/local/src/

[[email protected] c7-43 src]# git clone git://github.com/retspen/webvirtmgr.git
Cloning into 'webvirtmgr'...
remote: Enumerating objects: 5614, done.
remote: Total 5614 (delta 0), reused 0 (delta 0), pack-reused 5614
Receiving objects: 100% (5614/5614), 2.98 MiB | 9.00 KiB/s, done.
Resolving deltas: 100% (3602/3602), done.

安装webvirtmgr

[[email protected] c7-43 src]# cd /usr/local/src/webvirtmgr/
[[email protected] c7-43 webvirtmgr]# pip install -r requirements.txt -i https://pypi.tuna.tsinghua.edu.cn/simple
DEPRECATION: Python 2.7 reached the end of its life on January 1st, 2020. Please upgrade your Python as Python 2.7 is no longer maintained. pip 21.0 will drop support for Python 2.7 in January 2021. More details about Python 2 support in pip, can be found at https://pip.pypa.io/en/latest/development/release-process/#python-2-support
Looking in indexes: https://pypi.tuna.tsinghua.edu.cn/simple
Collecting django==1.5.5
Downloading https://pypi.tuna.tsinghua.edu.cn/packages/38/49/93511c5d3367b6b21fc2995a0e53399721afc15e4cd6eb57be879ae13ad4/Django-1.5.5.tar.gz (8.1 MB)
|████████████████████████████████| 8.1 MB 375 kB/s
Collecting gunicorn==19.5.0
Downloading https://pypi.tuna.tsinghua.edu.cn/packages/f9/4e/f4076a1a57fc1e75edc0828db365cfa9005f9f6b4a51b489ae39a91eb4be/gunicorn-19.5.0-py2.py3-none-any.whl (113 kB)
|████████████████████████████████| 113 kB 4.7 MB/s
Collecting lockfile>=0.9
Downloading https://pypi.tuna.tsinghua.edu.cn/packages/c8/22/9460e311f340cb62d26a38c419b1381b8593b0bb6b5d1f056938b086d362/lockfile-0.12.2-py2.py3-none-any.whl (13 kB)
Could not build wheels for django, since package 'wheel' is not installed.
Installing collected packages: django, gunicorn, lockfile
Running setup.py install for django ... done
Successfully installed django-1.5.5 gunicorn-19.5.0 lockfile-0.12.2

检查sqlite3是否安装

[[email protected] c7-43 webvirtmgr]# python
Python 2.7.5 (default, Apr 2 2020, 13:16:51)
[GCC 4.8.5 20150623 (Red Hat 4.8.5-39)] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import sqlite3
>>> exit()

2、初始化帐号信息

[[email protected] c7-43 webvirtmgr]# python manage.py syncdb
WARNING:root:No local_settings file found.
Creating tables ...
Creating table auth_permission
Creating table auth_group_permissions
Creating table auth_group
Creating table auth_user_groups
Creating table auth_user_user_permissions
Creating table auth_user
Creating table django_content_type
Creating table django_session
Creating table django_site
Creating table servers_compute
Creating table instance_instance
Creating table create_flavor

You just installed Django's auth system, which means you don't have any superusers defined.
Would you like to create one now? (yes/no): yes
Username (leave blank to use 'root'): root
Email address: [email protected]
Password: #123456
Password (again): #123456
Superuser created successfully.
Installing custom SQL ...
Installing indexes ...
Installed 6 object(s) from 1 fixture(s)

拷贝web网页至指定目录

[[email protected] c7-43 webvirtmgr]# mkdir /var/www
[[email protected] c7-43 webvirtmgr]# cp -r /usr/local/src/webvirtmgr/ /var/www/
[ro[email protected] c7-43 webvirtmgr]# chown -R nginx.nginx /var/www/webvirtmgr/

生成** 首次生成直接回车，不是则Overwrite (y/n)? y 选择覆盖

[[email protected] c7-43 webvirtmgr]# ssh-****** -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):
Created directory '/root/.ssh'.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:7FUfzfw74gLFJ29OsUxaiAYEnBeSIuOL/R5j8an8ulU [email protected]
The key's randomart image is:
+---[RSA 2048]----+
| .o=o. |
| o . +.o + |
|. o . . . o o . +|
| . . o * * ..|
|... . E o O + .|
|... o + o . * .|
| .+ + . . +. o |
| o.= .... .|
| .*+. .. |
+----[SHA256]-----+

由于这里webvirtmgr和kvm服务部署在同一台机器，所以这里本地信任。如果kvm部署在其他机器，则需要更换ip

[[email protected] c7-43 webvirtmgr]# ssh-copy-id 10.0.0.43
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
The authenticity of host '10.0.0.43 (10.0.0.43)' can't be established.
ECDSA key fingerprint is SHA256:ihgyyttZVhvGxuD9w+JrngGo4GsK2YV2Ll9ioZqXjk4.
ECDSA key fingerprint is MD5:5f:9a:57:fb:8f:85:1b:d2:04:3c:29:54:e4:3e:e2:3d.
Are you sure you want to continue connecting (yes/no)?
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
The authenticity of host '10.0.0.43 (10.0.0.43)' can't be established.
ECDSA key fingerprint is SHA256:ihgyyttZVhvGxuD9w+JrngGo4GsK2YV2Ll9ioZqXjk4.
ECDSA key fingerprint is MD5:5f:9a:57:fb:8f:85:1b:d2:04:3c:29:54:e4:3e:e2:3d.
Are you sure you want to continue connecting (yes/no)? yes
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
[email protected]'s password:

Number of key(s) added: 1

Now try logging into the machine, with: "ssh '10.0.0.43'"
and check to make sure that only the key(s) you wanted were added.

配置nginx

[[email protected] c7-43 webvirtmgr]# vim /etc/nginx/nginx.conf

user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;

include /usr/share/nginx/modules/*.conf;

events {
    worker_connections 1024;
}

http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;
    keepalive_timeout   65;
    types_hash_max_size 2048;

    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;

    include /etc/nginx/conf.d/*.conf;

    server {
        listen       80;
        server_name  localhost;

        include /etc/nginx/default.d/*.conf;

        location / {
                root html;
                index index.html index.htm;
        }

        error_page 404 /404.html;
            location = /40x.html {
        }

        error_page 500 502 503 504 /50x.html;
            location = /50x.html {
        }
    }
}

添加webvirtmgr.conf

[[email protected] c7-43 webvirtmgr]# vim /etc/nginx/conf.d/webvirtmgr.conf

server {
listen 80 default_server;

server_name $hostname;
#access_log /var/log/nginx/webvirtmgr_access_log;

location /static/ {
root /var/www/webvirtmgr/webvirtmgr;
expires max;
}

location / {
proxy_pass http://127.0.0.1:8000;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-for $proxy_add_x_forwarded_for;
proxy_set_header Host $host:$server_port;
proxy_set_header X-Forwarded-Proto $remote_addr;
proxy_connect_timeout 600;
proxy_read_timeout 600;
proxy_send_timeout 600;
client_max_body_size 1024M;
}
}

确保bind绑定的是本机的8000端口

[[email protected] c7-43 webvirtmgr]# cat /var/www/webvirtmgr/conf/gunicorn.conf.py | sed -n "23,24p"
bind = '127.0.0.1:8000'
backlog = 2048

启动nginx

[[email protected] c7-43 nginx]# systemctl start nginx

设置supervisor

[[email protected] c7-43 nginx]# vim /etc/supervisord.conf

#末尾添加

[program:webvirtmgr]
command=/usr/bin/python2 /var/www/webvirtmgr/manage.py run_gunicorn -c /var/www/webvirtmgr/conf/gunicorn.conf.py
directory=/var/www/webvirtmgr
autostart=true
autorestart=true
logfile=/var/log/supervisor/webvirtmgr.log
log_stderr=true
user=nginx

[program:webvirtmgr-console]
command=/usr/bin/python2 /var/www/webvirtmgr/console/webvirtmgr-console
directory=/var/www/webvirtmgr
autostart=true
autorestart=true
stdout_logfile=/var/log/supervisor/webvirtmgr-console.log
redirect_stderr=true
user=nginx

启动supervisor并设置开机自动启动

[[email protected] c7-43 nginx]# systemctl start supervisord
[[email protected] c7-43 nginx]# systemctl enable supervisord
Created symlink from /etc/systemd/system/multi-user.target.wants/supervisord.service to /usr/lib/systemd/system/supervisord.service.
[[email protected] c7-43 nginx]# systemctl status supervisord
● supervisord.service - Process Monitoring and Control Daemon
Loaded: loaded (/usr/lib/systemd/system/supervisord.service; enabled; vendor preset: disabled)
Active: active (running) since Sat 2020-05-09 16:10:40 CST; 12s ago
Main PID: 3342 (supervisord)
CGroup: /system.slice/supervisord.service
├─3342 /usr/bin/python /usr/bin/supervisord -c /etc/supervisord.conf
├─3343 /usr/bin/python2 /var/www/webvirtmgr/console/webvirtmgr-console
├─3344 /usr/bin/python2 /var/www/webvirtmgr/manage.py run_gunicorn -c /var/www/webvirtmgr/conf/gunicorn.conf.py
├─3350 /usr/bin/python2 /var/www/webvirtmgr/manage.py run_gunicorn -c /var/www/webvirtmgr/conf/gunicorn.conf.py
├─3351 /usr/bin/python2 /var/www/webvirtmgr/manage.py run_gunicorn -c /var/www/webvirtmgr/conf/gunicorn.conf.py
├─3352 /usr/bin/python2 /var/www/webvirtmgr/manage.py run_gunicorn -c /var/www/webvirtmgr/conf/gunicorn.conf.py
├─3353 /usr/bin/python2 /var/www/webvirtmgr/manage.py run_gunicorn -c /var/www/webvirtmgr/conf/gunicorn.conf.py
└─3354 /usr/bin/python2 /var/www/webvirtmgr/manage.py run_gunicorn -c /var/www/webvirtmgr/conf/gunicorn.conf.py

May 09 16:10:40 c7-43 systemd[1]: Starting Process Monitoring and Control Daemon...
May 09 16:10:40 c7-43 systemd[1]: Started Process Monitoring and Control Daemon.

配置nginx用户未创建nginx用户，所以用su命令赋予它交互式登录的权限

[[email protected] c7-43 nginx]# su - nginx -s /bin/bash
[[email protected] c7-43 ~]$ ssh-****** -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/var/lib/nginx/.ssh/id_rsa):
Created directory '/var/lib/nginx/.ssh'.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /var/lib/nginx/.ssh/id_rsa.
Your public key has been saved in /var/lib/nginx/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:kS1vMC++J/vdSsHySMWfR8gDnBL7rdtPYAUsiQIXtMw [email protected]
The key's randomart image is:
+---[RSA 2048]----+
| .o+..+.+. |
| +.+oo=o.o |
| E.o.o.+ o|
| B + o = |
| S * + * .|
| . + + + o |
| . . + .|
| ...o + . |
| o=. +.o..|
+----[SHA256]-----+

[[email protected] c7-43 ~]$ touch ~/.ssh/config && echo -e "StrictHostKeyChecking=no\nUserKnownHostsFile=/dev/null" >> ~/.ssh/config
[[email protected] c7-43 ~]$ chmod 0600 ~/.ssh/config
[[email protected] c7-43 ~]$ ssh-copy-id [email protected]
/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/var/lib/nginx/.ssh/id_rsa.pub"
/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
Warning: Permanently added '10.0.0.43' (ECDSA) to the list of known hosts.
[email protected]'s password:

Number of key(s) added: 1

Now try logging into the machine, with: "ssh '[email protected]'"
and check to make sure that only the key(s) you wanted were added.

[[email protected] c7-43 ~]$ exit #退出
logout

[[email protected] c7-43 nginx]# vim /etc/polkit-1/localauthority/50-local.d/50-libvirt-remote-access.pkla

[Remote libvirt SSH access]
Identity=unix-user:root
Action=org.libvirt.unix.manage
ResultAny=yes
ResultInactive=yes
ResultActive=yes

[[email protected] c7-43 nginx]# chown -R root.root /etc/polkit-1/localauthority/50-local.d/50-libvirt-remote-access.pkla
[[email protected] c7-43 nginx]# systemctl restart supervisord
[[email protected] c7-43 nginx]# systemctl restart libvirtd

kvm web界面管理

KVM虚拟化安装

通过远程连接软件上传ISO镜像文件至存储目录/var/lib/libvirt/images/

#上传镜像
[[email protected] c7-43 ~]# cd /var/lib/libvirt/images
[[email protected] c7-43 images]# ll
total 4554752
-rw-r--r-- 1 root root 4664066048 May 9 16:36 CentOS-7-x86_64-DVD-1908.iso