转一篇好手顺！
原文地址：http://silverskysoft.com/open-stack-xwrpr/2015/07/enable-spice-html5-console-access-in-openstack-kilo/
原文：
Spice Console Access to Instances
Documentation is a bit sparse on what configuration parameters to enable for SPICE console access. This article provides our notes for enabling SPICE on CentOS 7.1 with OpenStack Kilo.
Essentially, the Control node acts a proxy to the Compute node which has the SPICE server. Control node is client of the compute node.
Required Packages
On both Control & Compute:
yum install spice-html5
On Control:
yum install openstack-nova-spicehtml5proxy
Config Files
The file to modify is
/etc/nova/nova.conf
in compute and control nodes.
In both config files, ensure vnc_enabled=False is explicitly set. If novnc is enabled, ensure that is disabled too.
Control IP = 192.168.1.100 Compute IP = 172.16.1.100 [Internal IP - ports may need to be opened if not already there]
On Control Node
/etc/nova/nova.conf
[DEFAULT] web=/usr/share/spice-html5 . . . [spice] html5proxy_host=0.0.0.0 html5proxy_port=6082 html5proxy_base_url=https://192.168.1.100:6082/spice_auto.html # Enable spice related features (boolean value) enabled=True # Enable spice guest agent support (boolean value) agent_enabled=true # Keymap for spice (string value) keymap=en-us
Iptables rule on control node
Since we are allowing access to console via port 6082 on the control node, open this port in iptables.
iptables -I INPUT -p tcp -m multiport --dports 6082 -m comment --comment "Allow SPICE connections for console access " -j ACCEPT
You can make permanent by adding the above rule to /etc/sysconfig/iptables (before the reject rules) saving and restarting iptables.
Config Changes on Compute Node
/etc/nova/nova.conf
[DEFAULT] web=/usr/share/spice-html5 . . . [spice] html5proxy_base_url=https://192.168.1.100:6082/spice_auto.html server_listen=0.0.0.0 server_proxyclient_address=172.16.10.100 # Enable spice related features (boolean value) enabled=True # Enable spice guest agent support (boolean value) agent_enabled=true # Keymap for spice (string value) keymap=en-us
Restart services
On Compute
# service openstack-nova-compute restart
On Control
# service httpd restart # service openstack-nova-spicehtml5proxy start # service openstack-nova-spicehtml5proxy status # systemctl enable openstack-nova-spicehtml5proxy
Concepts
Here the control node is an HTML proxy that connects to the SPICE server+port that is running when a VM is instantiated.
Here are some notes on some of the unclear options:
html5proxy_host
This line indicates the HTML5 proxy should run on localhost without IP binding (0.0.0.0) – control node in this case.
html5proxy_base_url
This indicates the base URL to use when you click ‘console’ on the Horizon dashboard. Its noted that this URL must be accessible in the same network as the Horizon dashboard. In our case, this URL is the control node.
server_listen=0.0.0.0
Server listen specifies where the VM instances should listen for SPICE connections. This is the local IP address (compute node)
server_proxyclient_address=172.16.10.100
Server_proxyclient_address is the address which clients such as HTML5 proxy will use to connect to the VMs running on the Compute Node. This is an internal address most likely not accessible to the outside world but accessible to the control node. This address is the internal IP address of the compute node.
Gotchas
Be sure about what config change goes in which node. Iptables is another to look out for, if you plan to use consoles regularly, make the iptables rules permanent.
“console is currently unavailable. Please try again later.”
Under the hood,
You’ll see
“ERROR: Invalid console type spice-html5 (HTTP 400)”
when you do
nova get-spice-console spice-html5
This generally means, the VM did not start with SPICE enabled. The causes for that could be one of the services did not restart after config change.
Double check the config file – make sure ‘enabled=true’ is set.
References
http://blog.felipe-alfaro.com/2014/05/13/html5-spice-console-in-openstack/ http://docs.openstack.org/admin-guide-cloud/content/spice-console.html http://docs.openstack.org/admin-guide-cloud/content/getting-started-with-vnc-proxy.html http://docs.openstack.org/developer/nova/runnova/vncconsole.html http://www.slideshare.net/YukihiroKawada/rdo-spice