深入KVM虚拟化之构建高效、可扩展的虚拟化环境

马哥Linux运维 2024-11-26 134

描述

KVM虚拟化

创建虚拟机

报错解决

虚拟化介绍

kvm介绍

KVM部署（基于CentOS7）

KVM管理界面安装

KVM web界面管理

虚拟化介绍

虚拟化：在一台计算机上虚拟出多个逻辑的计算机，而且每个逻辑计算机
它可以是不同操作系统

虚拟化技术：可以扩大硬件容量，单个cpu模拟出多个cpu并行，
允许一个平台上同时运行多个操作系统，应用程序都可以在相互独立
的空间内运行，而且互不影响。

为什么企业使用虚拟化技术

　　1、节约成本

　　2、提高效率，物理机我们一般称为宿主机（Host），宿主机上面的虚拟机称为客户机（Guest）。

　　那么 Host 是如何将自己的硬件资源虚拟化，并提供给 Guest 使用的呢？

　　这个主要是通过一个叫做 Hypervisor 的程序实现的。

　　Hypervisor：一种运行在物理服务器硬件与操作系统之间的中间软件层

　　可允许多个操作系统和应用来共享硬件资源

　　根据 Hypervisor 的实现方式和所处的位置，虚拟化又分为两种：

　　完全虚拟化：直接在物理机上部署虚拟化，且不需要修改操作系统内核

　　半虚拟化：需要修改操作系统内核，使其支持虚拟化驱动来实现虚拟化技术

1、完全虚拟化
Hypervisor 直接安装在物理机上，多个虚拟机在 Hypervisor 上运行。Hypervisor 实现方式一般是一个特殊定制的 Linux 系统。Xen 和 VMWare 的 ESXi 都属于这个类型

Web

2、半虚拟化

Web

　　理论上讲：

　　完全虚拟化一般对硬件虚拟化功能进行了特别优化，性能上比半虚拟化要高；

　　半虚拟化因为基于普通的操作系统，会比较灵活，比如支持虚拟机嵌套。嵌套意味着可以在KVM虚拟机中再运行KVM。

　　kvm介绍

　　kVM 全称是 Kernel-Based Virtual Machine。也就是说 KVM 是基于 Linux 内核实现的。

　　KVM有一个内核模块叫 kvm.ko，只用于管理虚拟 CPU 和内存。

　　那 IO 的虚拟化，比如存储和网络设备则是由 Linux 内核与Qemu来实现。

　　Qemu 是纯软件实现的虚拟化模拟器，几乎可以模拟任何硬件设备，我们最熟悉的就是能够模拟一台能够独立运行操作系统的虚拟机，虚拟机认为自己和硬件打交道，但其实是和 Qemu 模拟出来的硬件打交道，Qemu 将这些指令转译给真正的硬件。

　　正因为 Qemu 是纯软件实现的，所有的指令都要经 Qemu 过一手，性能非常低，所以，在生产环境中，大多数的做法都是配合 KVM 来完成虚拟化工作，因为 KVM 是硬件辅助的虚拟化技术，主要负责比较繁琐的 CPU 和内存虚拟化，而 Qemu 则负责 I/O 虚拟化，两者合作各自发挥自身的优势，相得益彰。

　　作为一个 Hypervisor，KVM 本身只关注虚拟机调度和内存管理这两个方面。IO 外设的任务交给 Linux 内核和 Qemu。

　　Libvirt 就是 KVM 的管理工具。管理虚拟机和虚拟化功能的软件

　　其实，Libvirt 除了能管理 KVM 这种 Hypervisor，还能管理 Xen，VirtualBox 等。

　　Libvirt 包含 3 个东西：后台 daemon 程序 libvirtd、API 库和命令行工具 virsh

　　1、libvirtd是服务程序，接收和处理 API 请求；

　　2、API 库使得其他人可以开发基于 Libvirt 的高级工具，比如 virt-manager，这是个图形化的 KVM 管理工具；

　　3、virsh 是我们经常要用的 KVM 命令行工具

　　KVM部署（基于CentOS7）

　　虚拟机的安装步骤可以查看我之前centos8.5的安装，变化倒是不大修改一下对应参数就可以了

　　环境说明：

　　系统：CentOS7

　　ip ：192.168.222.140

　　CPU虚拟化功能

　　部署前请确保你的CPU虚拟化功能已开启，分为两种情况：

　　（1）虚拟机要关机设置CPU虚拟化

　　（2）物理机要在BIOS里开启CPU虚拟化

　　虚拟机设置（内存：8G 磁盘：80G（自定义可以大一点）虚拟化功能：开启）

　　//设置虚拟机内存，添加一块80G的硬盘

Web

开启虚拟化

Web

新建分区，将硬盘所有大小都给这个分区

[root@localhost ~]# lsblk  //查看一下分区
NAME            MAJ:MIN RM  SIZE RO TYPE MOUNTPOINT
sda               8:0    0   10G  0 disk 
├─sda1            8:1    0    1G  0 part /boot
└─sda2            8:2    0    9G  0 part 
  ├─centos-root 253:0    0    8G  0 lvm  /
  └─centos-swap 253:1    0    1G  0 lvm  [SWAP]
sdb               8:16   0   80G  0 disk 
sr0              11:0    1  4.2G  0 rom  
[root@localhost ~]# parted /dev/sdb
GNU Parted 3.1
使用 /dev/sdb
Welcome to GNU Parted! Type 'help' to view a list of commands.
(parted)       //Tab两下查看                                                           
align-check  help         mktable      quit         select       unit         
disk_set     mklabel      name         rescue       set          version      
disk_toggle  mkpart       print        rm           toggle       
(parted) mklabel 
新的磁盘标签类型？     //Tab两下查看                                                     
aix    amiga  bsd    dvh    gpt    loop   mac    msdos  pc98   sun    
新的磁盘标签类型？ msdos 
(parted)      //Tab两下查看                                                              
align-check  help         mktable      quit         select       unit         
disk_set     mklabel      name         rescue       set          version      
disk_toggle  mkpart       print        rm           toggle       
(parted) unit 
Unit?  [compact]?        //Tab两下查看                                                   
%        chs      cyl      GiB      kiB      MiB      TB       
B        compact  GB       kB       MB       s        TiB      
Unit?  [compact]? MiB 
(parted) p                                                                
Model: VMware, VMware Virtual S (scsi)
Disk /dev/sdb: 81920MiB    //创建磁盘的大小
Sector size (logical/physical): 512B/512B
Partition Table: msdos
Disk Flags: 

Number  Start  End  Size  Type  File system  标志

(parted)           //Tab两下查看                                                         
align-check  help         mktable      quit         select       unit         
disk_set     mklabel      name         rescue       set          version      
disk_toggle  mkpart       print        rm           toggle       
(parted) mkpart 
分区类型？  primary/主分区/extended/扩展分区? primary                     
文件系统类型？  [ext2]?         //Tab两下查看                                            
affs0            amufs            apfs2            hfs              linux-swap(v0)
affs1            amufs0           asfs             hfs+             linux-swap(v1)
affs2            amufs1           btrfs            hfsx             nilfs2
affs3            amufs2           ext2             hp-ufs           ntfs
affs4            amufs3           ext3             jfs              reiserfs
affs5            amufs4           ext4             linux-swap       sun-ufs
affs6            amufs5           fat16            linux-swap(new)  swsusp
affs7            apfs1            fat32            linux-swap(old)  xfs
文件系统类型？  [ext2]? xfs 
起始点？ 10MiB                                                            
结束点？ 81910MiB          //比刚刚创建的小10MiB就可以了                                           
(parted) p                                                                
Model: VMware, VMware Virtual S (scsi)
Disk /dev/sdb: 81920MiB
Sector size (logical/physical): 512B/512B
Partition Table: msdos
Disk Flags: 

Number  Start    End       Size      Type     File system  标志
 1      10.0MiB  81910MiB  81900MiB  primary

(parted) q                                                                
信息: You may need to update /etc/fstab.

[root@localhost ~]# udevadm settle

格式化

[root@localhost ~]# lsblk 
NAME            MAJ:MIN RM  SIZE RO TYPE MOUNTPOINT
sda               8:0    0   10G  0 disk 
├─sda1            8:1    0    1G  0 part /boot
└─sda2            8:2    0    9G  0 part 
  ├─centos-root 253:0    0    8G  0 lvm  /
  └─centos-swap 253:1    0    1G  0 lvm  [SWAP]
sdb               8:16   0   80G  0 disk 
└─sdb1            8:17   0   80G  0 part 
sr0              11:0    1  4.2G  0 rom  
[root@localhost ~]# mkfs.xfs /dev/sdb1
meta-data=/dev/sdb1              isize=512    agcount=4, agsize=5241600 blks
         =                       sectsz=512   attr=2, projid32bit=1
         =                       crc=1        finobt=0, sparse=0
data     =                       bsize=4096   blocks=20966400, imaxpct=25
         =                       sunit=0      swidth=0 blks
naming   =version 2              bsize=4096   ascii-ci=0 ftype=1
log      =internal log           bsize=4096   blocks=10237, version=2
         =                       sectsz=512   sunit=0 blks, lazy-count=1
realtime =none                   extsz=4096   blocks=0, rtextents=0
[root@localhost ~]# blkid /dev/sdb1
/dev/sdb1: UUID="09888ad8-a1ef-42fb-9c36-937e071bf897" TYPE="xfs"

创建挂载点,并进行永久挂载

[root@localhost ~]# yum -y install vim
[root@localhost ~]# mkdir /kvmdata
[root@localhost ~]# vim /etc/fstab 
UUID="09888ad8-a1ef-42fb-9c36-937e071bf897"  /kvmdata   xfs  defaults 0 0  //添加这一行
[root@localhost ~]# mount -a
[root@localhost ~]# df -Th
文件系统                类型      容量  已用  可用 已用% 挂载点
/dev/mapper/centos-root xfs       8.0G  1.2G  6.9G   15% /
devtmpfs                devtmpfs  3.9G     0  3.9G    0% /dev
tmpfs                   tmpfs     3.9G     0  3.9G    0% /dev/shm
tmpfs                   tmpfs     3.9G  8.7M  3.9G    1% /run
tmpfs                   tmpfs     3.9G     0  3.9G    0% /sys/fs/cgroup
/dev/sda1               xfs      1014M  143M  872M   15% /boot
tmpfs                   tmpfs     781M     0  781M    0% /run/user/0
/dev/sdb1               xfs        80G   33M   80G    1% /kvmdata

KVM安装
关闭防火墙和selinux

[root@localhost ~]# systemctl stop firewalld
[root@localhost ~]# vim /etc/selinux/config 
SELINUX=disabled
[root@localhost ~]# setenforce 0
[root@localhost ~]# systemctl disable --now firewalld
Removed symlink /etc/systemd/system/multi-user.target.wants/firewalld.service.
Removed symlink /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service.
[root@localhost ~]# reboot

部署yum源
可以配置阿里云的网络源
阿里云官网

[root@localhost ~]# cd /etc/yum.repos.d/
[root@localhost yum.repos.d]# ls
CentOS-Base.repo  CentOS-Debuginfo.repo  CentOS-Media.repo    CentOS-Vault.repo  epel-testing.repo
CentOS-CR.repo    CentOS-fasttrack.repo  CentOS-Sources.repo  epel.repo
[root@localhost yum.repos.d]# rm -rf *
[root@localhost yum.repos.d]# ls
[root@localhost yum.repos.d]# curl -o /etc/yum.repos.d/CentOS-Base.repo https://mirrors.aliyun.com/repo/Centos-7.repo
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  2523  100  2523    0     0   9299      0 --:--:-- --:--:-- --:--:--  9309
[root@localhost yum.repos.d]# sed -i -e '/mirrors.cloud.aliyuncs.com/d' -e '/mirrors.aliyuncs.com/d' /etc/yum.repos.d/CentOS-Base.repo
[root@localhost yum.repos.d]# ls
CentOS-Base.repo

安装所需软件包

[root@localhost yum.repos.d]# cd
[root@localhost ~]# yum -y install epel-release  wget net-tools unzip zip gcc gcc-c++

验证cpu是否支持kvm，vmx是intel的 svm是AMD的

[root@localhost ~]# egrep -o 'vmx|svm' /proc/cpuinfo
vmx

安装kvm

[root@localhost ~]# yum -y install qemu-kvm 
>  qemu-kvm-tools 
>  qemu-img 
>  virt-manager 
>  libvirt 
>  libvirt-python 
>  libvirt-client 
>  virt-install 
>  virt-viewer 
>  bridge-utils 
> libguestfs-tools

配置网络，因为虚拟机中的网络，我们一般是都和公司服务器处在同一网段的，所以我们需要把kvm的网卡配置成桥接模式

[root@localhost ~]# cd /etc/sysconfig/network-scripts/
[root@localhost network-scripts]# ls
ifcfg-ens33  ifdown-ipv6    ifdown-TeamPort  ifup-ippp   ifup-routes       network-functions
ifcfg-lo     ifdown-isdn    ifdown-tunnel    ifup-ipv6   ifup-sit          network-functions-ipv6
ifdown       ifdown-post    ifup             ifup-isdn   ifup-Team
ifdown-bnep  ifdown-ppp     ifup-aliases     ifup-plip   ifup-TeamPort
ifdown-eth   ifdown-routes  ifup-bnep        ifup-plusb  ifup-tunnel
ifdown-ib    ifdown-sit     ifup-eth         ifup-post   ifup-wireless
ifdown-ippp  ifdown-Team    ifup-ib          ifup-ppp    init.ipv6-global
[root@localhost network-scripts]# cp ifcfg-ens33 ifcfg-br0
[root@localhost network-scripts]# vim ifcfg-br0 
[root@localhost network-scripts]# cat ifcfg-br0 
TYPE=bridge
BOOTPROTO=none
NAME=br0
DEVICE=br0
ONBOOT=yes
IPADDR=192.168.222.140
PREFIX=24
GATEWAY=192.168.222.2
DNS1=192.168.222.2
[root@localhost network-scripts]# vim ifcfg-ens33 
[root@localhost network-scripts]# cat ifcfg-ens33 
TYPE=Ethernet
BOOTPROTO=none
NAME=ens33
DEVICE=ens33
ONBOOT=yes
BRIDGE=br0
[root@localhost network-scripts]# systemctl restart NetworkManager
[root@localhost network-scripts]# ifdown ens33;ifup ens33
成功断开设备 'ens33'。
连接已成功激活（D-Bus 活动路径：/org/freedesktop/NetworkManager/ActiveConnection/3）
[root@localhost network-scripts]# cd
[root@localhost ~]# ifconfig 
br0: flags=4163  mtu 1500
        inet 192.168.222.140  netmask 255.255.255.0  broadcast 192.168.222.255
        inet6 fe80:5bffba71  prefixlen 64  scopeid 0x20
        ether 0029f0:0d  txqueuelen 1000  (Ethernet)
        RX packets 494  bytes 34964 (34.1 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 813  bytes 143186 (139.8 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

ens33: flags=4163  mtu 1500
        ether 0029f0:0d  txqueuelen 1000  (Ethernet)
        RX packets 201496  bytes 194698973 (185.6 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 108153  bytes 10993998 (10.4 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10
        loop  txqueuelen 1  (Local Loopback)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

重启libvirtd服务，并设置开机自启

[root@localhost ~]# systemctl enable --now libvirtd
[root@localhost ~]# systemctl status libvirtd
● libvirtd.service - Virtualization daemon
   Loaded: loaded (/usr/lib/systemd/system/libvirtd.service; enabled; vendor preset: enabled)
   Active: active (running) since 三 2022-10-05 02:57:06 CST; 10s ago
     Docs: man:libvirtd(8)
           https://libvirt.org
 Main PID: 106910 (libvirtd)
    Tasks: 19 (limit: 32768)
   CGroup: /system.slice/libvirtd.service
           ├─106910 /usr/sbin/libvirtd
           ├─107058 /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf --leasefil...
           └─107060 /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf --leasefil...

10月 05 02:57:07 localhost.example.com dnsmasq[107052]: listening on virbr0(#4): 192.168.122.1
10月 05 02:57:07 localhost.example.com dnsmasq[107058]: started, version 2.76 cachesize 150
10月 05 02:57:07 localhost.example.com dnsmasq[107058]: compile time options: IPv6 GNU-getopt D...fy
10月 05 02:57:07 localhost.example.com dnsmasq-dhcp[107058]: DHCP, IP range 192.168.122.2 -- 192...h
10月 05 02:57:07 localhost.example.com dnsmasq-dhcp[107058]: DHCP, sockets bound exclusively to ...0
10月 05 02:57:07 localhost.example.com dnsmasq[107058]: reading /etc/resolv.conf
10月 05 02:57:07 localhost.example.com dnsmasq[107058]: using nameserver 192.168.222.2#53
10月 05 02:57:07 localhost.example.com dnsmasq[107058]: read /etc/hosts - 2 addresses
10月 05 02:57:07 localhost.example.com dnsmasq[107058]: read /var/lib/libvirt/dnsmasq/default.a...es
10月 05 02:57:07 localhost.example.com dnsmasq-dhcp[107058]: read /var/lib/libvirt/dnsmasq/defau...e
Hint: Some lines were ellipsized, use -l to show in full.

查看kvm模块是否加载

[root@localhost ~]# lsmod |grep kvm
kvm_intel             170086  0 
kvm                   566340  1 kvm_intel
irqbypass              13503  1 kvm

验证安装结果

[root@localhost ~]# virsh -c qemu:///system list
 Id    名称                         状态
----------------------------------------------------

[root@localhost ~]# virsh --version
4.5.0
[root@localhost ~]# virt-install --version
1.5.0

将qemu-kvm这个命令做一个软链接到/usr/bin/qemu-kvm

[root@localhost ~]# ln -s /usr/libexec/qemu-kvm /usr/bin/qemu-kvm
[root@localhost ~]# ll /usr/bin/qemu-kvm
lrwxrwxrwx 1 root root 21 10月  5 03:01 /usr/bin/qemu-kvm -> /usr/libexec/qemu-kvm

查看网桥信息

[root@localhost ~]# brctl show
bridge name     bridge id               STP enabled     interfaces
br0             8000.000c295af00d       no              ens33
virbr0          8000.525400e562ac       yes             virbr0-nic

KVM管理界面安装

Kvm的web界面是由webvirtmgr程序提供的
安装依赖包

[root@localhost ~]# yum -y install git python-pip libvirt-python libxml2-python python-websockify supervisor nginx python-devel
.....
已安装:
  git.x86_64 0:1.8.3.1-23.el7_8                    nginx.x86_64 1:1.20.1-9.el7                       
  python-devel.x86_64 0:2.7.5-92.el7_9             python-websockify.noarch 0:0.6.0-2.el7            
  python2-pip.noarch 0:8.1.2-14.el7                supervisor.noarch 0:3.4.0-1.el7                   

作为依赖被安装:
  centos-indexhtml.noarch 0:7-9.el7.centos           nginx-filesystem.noarch 1:1.20.1-9.el7          
  openssl11-libs.x86_64 1:1.1.1k-4.el7               perl-Error.noarch 1:0.17020-2.el7               
  perl-Git.noarch 0:1.8.3.1-23.el7_8                 perl-TermReadKey.x86_64 0:2.30-20.el7           
  python-meld3.x86_64 0:0.6.10-1.el7                 python-rpm-macros.noarch 0:3-34.el7             
  python-setuptools.noarch 0:0.9.8-7.el7             python-srpm-macros.noarch 0:3-34.el7            
  python2-rpm-macros.noarch 0:3-34.el7               rsync.x86_64 0:3.1.2-11.el7_9                   

作为依赖被升级:
  python.x86_64 0:2.7.5-92.el7_9                 python-libs.x86_64 0:2.7.5-92.el7_9                

完毕！

可以提前做一个映射，防止访问不了github

[root@localhost ~]# vim /etc/hosts
[root@localhost ~]# cat /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
20.205.243.166 github.com    //添加

从github上下载webvirtmgr代码

[root@localhost ~]# cd /usr/local/src/
[root@localhost src]# git clone http://github.com/retspen/webvirtmgr.git
正克隆到 'webvirtmgr'...
remote: Enumerating objects: 5614, done.
remote: Total 5614 (delta 0), reused 0 (delta 0), pack-reused 5614
接收对象中: 100% (5614/5614), 2.97 MiB | 689.00 KiB/s, done.
处理 delta 中: 100% (3606/3606), done.

安装webvirtmgr

[root@localhost src]# ls
webvirtmgr
[root@localhost src]# cd webvirtmgr/
[root@localhost webvirtmgr]# pip install -r requirements.txt
Collecting django==1.5.5 (from -r requirements.txt (line 1))
  Downloading https://files.pythonhosted.org/packages/38/49/93511c5d3367b6b21fc2995a0e53399721afc15e4cd6eb57be879ae13ad4/Django-1.5.5.tar.gz (8.1MB)
    100% |████████████████████████████████| 8.1MB 42kB/s 
Collecting gunicorn==19.5.0 (from -r requirements.txt (line 2))
  Downloading https://files.pythonhosted.org/packages/f9/4e/f4076a1a57fc1e75edc0828db365cfa9005f9f6b4a51b489ae39a91eb4be/gunicorn-19.5.0-py2.py3-none-any.whl (113kB)
    100% |████████████████████████████████| 122kB 104kB/s 
Collecting lockfile>=0.9 (from -r requirements.txt (line 5))
  Downloading https://files.pythonhosted.org/packages/c8/22/9460e311f340cb62d26a38c419b1381b8593b0bb6b5d1f056938b086d362/lockfile-0.12.2-py2.py3-none-any.whl
Installing collected packages: django, gunicorn, lockfile
  Running setup.py install for django ... done
Successfully installed django-1.5.5 gunicorn-19.5.0 lockfile-0.12.2
You are using pip version 8.1.2, however version 22.2.2 is available.
You should consider upgrading via the 'pip install --upgrade pip' command.

检查sqlite3是否安装

[root@localhost ~]# python
Python 2.7.5 (default, Jun 28 2022, 15:30:04) 
[GCC 4.8.5 20150623 (Red Hat 4.8.5-44)] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import sqlite3
>>> exit()

初始化账号信息

[root@localhost ~]# cd /usr/local/src/webvirtmgr/
[root@localhost webvirtmgr]# python manage.py syncdb
WARNINGNo local_settings file found.
Creating tables ...
Creating table auth_permission
Creating table auth_group_permissions
Creating table auth_group
Creating table auth_user_groups
Creating table auth_user_user_permissions
Creating table auth_user
Creating table django_content_type
Creating table django_session
Creating table django_site
Creating table servers_compute
Creating table instance_instance
Creating table create_flavor

You just installed Django's auth system, which means you don't have any superusers defined.
Would you like to create one now? (yes/no): yes //是否创建超级管理员账号
Username (leave blank to use 'root'):   //指定超级管理员账号用户名，默认留空为root
Email address: lnh136@78.com   //设置超级管理员邮箱
Password:    //设置超级管理员密码
Password (again):    //再次输入确认超级管理员密码
Superuser created successfully.
Installing custom SQL ...
Installing indexes ...
Installed 6 object(s) from 1 fixture(s)

拷贝web网页到指定目录

root@localhost webvirtmgr]# mkdir /var/www
[root@localhost webvirtmgr]# cp -r /usr/local/src/webvirtmgr/ /var/www/
[root@localhost webvirtmgr]# chown -R nginx.nginx /var/www/webvirtmgr/

生成一对公钥与私钥，由于这里webvirtmgr和kvm服务部署在同一台主机中，所以这里本地信任。如果kvm部署在其他机器上的时候，那么就需要把公钥发送到kvm主机中

[root@localhost webvirtmgr]# ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):  //直接回车
Created directory '/root/.ssh'.
Enter passphrase (empty for no passphrase):   /直接回车
Enter same passphrase again:  /直接回车
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:    
SHA256:GM4Wtczgi6KVA8VnhunqFApm06RP221yf9hwbhE63Ig root@localhost.example.com
The key's randomart image is:
+---[RSA 2048]----+
| ..o  . .        |
| .+.+. = .       |
|..++  + +        |
|.B.+ + =   .     |
|=.X + B S + .    |
|o+ = + E * +     |
|+     + . B .    |
| .       o =     |
|          o      |
+----[SHA256]-----+
[root@localhost webvirtmgr]# ssh-copy-id -i ~/.ssh/id_rsa.pub root@192.168.222.140
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
The authenticity of host '192.168.222.140 (192.168.222.140)' can't be established.
ECDSA key fingerprint is SHA256:FkmNy5vPRVhOZGwZpvDsgPmo4WjilEinC9gpRbRiZQQ.
ECDSA key fingerprint is MD5:570017:10:5d:1cac:197b:6662.
Are you sure you want to continue connecting (yes/no)? yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
root@192.168.222.140's password: 

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh 'root@192.168.222.140'"
and check to make sure that only the key(s) you wanted were added.

配置端口转发
可以使用ss -antl查看端口情况

[root@localhost webvirtmgr]# ssh 192.168.222.140 -L localhostlocalhost:8000 -L localhostlocalhost:60
Last login: Wed Oct  5 17:08:52 2022 from 192.168.222.1
[root@localhost ~]# ss -antl
State      Recv-Q Send-Q        Local Address:Port                       Peer Address:Port              
LISTEN     0      5             192.168.122.1:53                                    *:*                  
LISTEN     0      128                       *:22                                    *:*                  
LISTEN     0      100               127.0.0.1:25                                    *:*                  
LISTEN     0      128               127.0.0.1:6080                                  *:*                  
LISTEN     0      128               127.0.0.1:8000                                  *:*                  
LISTEN     0      128                      :::22                                   :::*                  
LISTEN     0      100                     ::1:25                                   :::*                  
LISTEN     0      128                     ::1:6080                                 :::*                  
LISTEN     0      128                     ::1:8000                                 :::*

配置nginx

[root@localhost ~]# cp /etc/nginx/nginx.conf /etc/nginx/nginx.conf.bak
[root@localhost ~]# vim /etc/nginx/nginx.conf
//在server参数中进行修改
删除listen       [::]:80;行
参数server_name行改成server_name  localhost;
删除root         /usr/share/nginx/html;行
在include /etc/nginx/default.d/*.conf;行下添加
location / {
       root    html;
       index   index.html index.htm;
     }

配置nginx虚拟主机

[root@localhost ~]# vim /etc/nginx/conf.d/webvirtmgr.conf
[root@localhost ~]# cat /etc/nginx/conf.d/webvirtmgr.conf
server {
    listen 80 default_server;

    server_name $hostname;
    #access_log /var/log/nginx/webvirtmgr_access_log;

    location /static/ {
        root /var/www/webvirtmgr/webvirtmgr;
        expires max;
    }

    location / {
        proxy_pass http://127.0.0.1:8000;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-for $proxy_add_x_forwarded_for;
        proxy_set_header Host $host:$server_port;
        proxy_set_header X-Forwarded-Proto $remote_addr;
        proxy_connect_timeout 600;
        proxy_read_timeout 600;
        proxy_send_timeout 600;
        client_max_body_size 1024M;
    }
}

确保bind绑定本机的8000端口

[root@localhost ~]# vim /var/www/webvirtmgr/conf/gunicorn.conf.py
bind = '127.0.0.1:8000'   //默认
backlog = 2048            //默认
[root@localhost ~]# grep bind /var/www/webvirtmgr/conf/gunicorn.conf.py
# bind - The socket to bind.
bind = '127.0.0.1:8000'
//确保此处绑定的是本机的8000端口，这个在nginx配置中定义了，被代理的端口

重启nginx服务设置开机自启，查看端口是否开启

[root@localhost ~]# systemctl enable --now nginx
Created symlink from /etc/systemd/system/multi-user.target.wants/nginx.service to /usr/lib/systemd/system/nginx.service.
[root@localhost ~]# ss -antl
State      Recv-Q Send-Q        Local Address:Port                       Peer Address:Port              
LISTEN     0      128                       *:80                                    *:*                  
LISTEN     0      5             192.168.122.1:53                                    *:*                  
LISTEN     0      128                       *:22                                    *:*                  
LISTEN     0      100               127.0.0.1:25                                    *:*                  
LISTEN     0      128               127.0.0.1:6080                                  *:*                  
LISTEN     0      128               127.0.0.1:8000                                  *:*                  
LISTEN     0      128                      :::22                                   :::*                  
LISTEN     0      100                     ::1:25                                   :::*                  
LISTEN     0      128                     ::1:6080                                 :::*                  
LISTEN     0      128                     ::1:8000                                 :::*

设置supervisor

[root@localhost ~]# vim /etc/supervisord.conf
//在文件最后添加如下信息
#这里command是一行
[program:webvirtmgr]
command=/usr/bin/python2 /var/www/webvirtmgr/manage.py run_gunicorn -c /var/www/webvirtmgr/conf/gunicorn.conf.py
directory=/var/www/webvirtmgr
autostart=true
autorestart=true
logfile=/var/log/supervisor/webvirtmgr.log
log_stderr=true
user=nginx

[program:webvirtmgr-console]
command=/usr/bin/python2 /var/www/webvirtmgr/console/webvirtmgr-console
directory=/var/www/webvirtmgr
autostart=true
autorestart=true
stdout_logfile=/var/log/supervisor/webvirtmgr-console.log
redirect_stderr=true
user=nginx

启动supervisor并设置开机自启

[root@localhost ~]# systemctl enable --now supervisord.service
Created symlink from /etc/systemd/system/multi-user.target.wants/supervisord.service to /usr/lib/systemd/system/supervisord.service.

配置nginx用户

[root@localhost ~]# su - nginx -s /bin/bash
-bash-4.2$ ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/var/lib/nginx/.ssh/id_rsa): 
Created directory '/var/lib/nginx/.ssh'.
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /var/lib/nginx/.ssh/id_rsa.
Your public key has been saved in /var/lib/nginx/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:U+al0qUqjCY2+jySrqJYJ/+mc9fkaVtgPovqsa9+qCE nginx@localhost.example.com
The key's randomart image is:
+---[RSA 2048]----+
|                 |
|                 |
|          o o    |
|         = =     |
|        S B      |
|     o   *..     |
| .E = +..+o..    |
|==.O..++o.=+     |
|X+o.+XB*o.o.     |
+----[SHA256]-----+
-bash-4.2$ touch ~/.ssh/config
-bash-4.2$ echo -e "StrictHostKeyChecking=no
UserKnownHostsFile=/dev/null" >> ~/.ssh/config 
-bash-4.2$ chmod 0600 ~/.ssh/config
-bash-4.2$ ssh-copy-id -i ~/.ssh/id_rsa.pub root@192.168.222.140
/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/var/lib/nginx/.ssh/id_rsa.pub"
/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
Warning: Permanently added '192.168.222.140' (ECDSA) to the list of known hosts.
root@192.168.222.140's password: 

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh 'root@192.168.222.140'"
and check to make sure that only the key(s) you wanted were added.

-bash-4.2$ ssh root@192.168.222.140
Warning: Permanently added '192.168.222.140' (ECDSA) to the list of known hosts.
Last login: Wed Oct  5 17:34:44 2022 from 192.168.222.140
[root@localhost ~]# exit
logout
Connection to 192.168.222.140 closed.
-bash-4.2$ exit
logout
[root@localhost ~]# 
root@localhost ~]# vim /etc/polkit-1/localauthority/50-local.d/50-libvirt-remote-access.pkla
[root@localhost ~]# cat /etc/polkit-1/localauthority/50-local.d/50-libvirt-remote-access.pkla
bvirt SSH access]
Identity=unix-user:root
Action=org.libvirt.unix.manage
ResultAny=yes
ResultInactive=yes
ResultActive=yes
[root@localhost ~]# chown -R root.root /etc/polkit-1/localauthority/50-local.d/50-libvirt-remote-access.pkla
[root@localhost ~]# systemctl enable --now nginx
[root@localhost ~]# systemctl enable --now libvirtd

KVM web界面管理

修改nginx配置文件

[root@localhost ~]# vim /etc/nginx/nginx.conf
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;
worker_rlimit_nofile 655350;  //添加此行

对系统参数进行设置

[root@localhost ~]# vim /etc/security/limits.conf
//在文件最末尾写入
* soft nofile 655350
* hard nofile 655350

重启服务，重读文件

[root@localhost ~]# sysctl -p
[root@localhost ~]# systemctl enable --now nginx

安装novnc，并通过novnc_server启动一个vnc

[root@localhost ~]# yum -y install novnc
[root@localhost ~]# chmod +x /etc/rc.d/rc.local
[root@localhost ~]# vim /etc/rc.d/rc.local
//在最末尾加入如下行
nohup novnc_server 192.168.222.140:5920 &
[root@localhost ~]# . /etc/rc.d/rc.local
[root@localhost ~]# nohup: 忽略输入并把输出追加到"nohup.out"
这里会一直停在这里

使用浏览器访问

Web

登录用户是之前设置的默认root，密码也是之前设置的

Web

添加连接

Web

创建虚拟机

1、新建存储

Web

2、上传镜像，使用FinalShell,xftp或者xshell，再或者其他工具，将镜像文件上传到服务器的/kvmdata目录下存放

再开一个终端:
[root@localhost ~]# cd /kvmdata/
[root@localhost kvmdata]# ls
CentOS-7.4-x86_64-DVD-1708.iso

刷新一下网页界面

Web

添加网络

Web

实例管理，现在去创建一个虚拟机

Web

报错解决

报错:
fatal: unable to access 'http://github.com/retspen/webvirtmgr.git/': Failed connect to github.com:443; Connection refused

fatal: unable to access 'http://github.com/retspen/webvirtmgr.git/': TCP connection reset by peer


解决:
[root@localhost src]# git config --global -l
fatal: unable to read config file '/root/.gitconfig': ?????????
[root@localhost src]# env|grep -i proxy

打开APP阅读更多精彩内容