openstack-neutron(queens)

介绍

neutron 为 open stack 所有组件提供网络通讯提供服务。

功能:

网络(network)  构建一个独立的网络分为提供者网络和自服务网络

子网(subnet)   在网络中各个独立网段的子网

端口(port)     代表虚拟交换机上的一个虚拟机端口,在每个子网中虚拟机的网卡连接端口后就会拥有MC 地址和IP 地址。PORT 的IP地址是从子网地址池中分配来的。

路由       每个子网都是独立网段,想要不同网段相互通讯就需要路由系统完成

组成部分

neutron-server(api)

可以理解为类似于nova-api那样的一个组件,一个专门用来接收neutron REST API调用的服务器。负责将不同的rest api发送到不同的neutron-plugin
neutron-plugin(例如:ml2)

可以理解为不同网络功能实现的入口,现在大部分都是软件定义网络,各个厂商都开发自己的plugin(插件)。neutron-plugin接收netron-server发过来的rest api,向neutron database完成一些信息注册(比如用户要建端口)。然后将具体要执行的业务操作和参数通知给自身对应的neutron-agent

neutron-plugin分为core-plugin个service-plugin两类(我们主要研究core-pulgin)

Core-plugin,在neutron中有一个Core-plugin叫做ML2(Modular Layer 2),就是负责管理L2的网络连接(二层交换机概念)。ML2中主要包括network,subent,port三类核心资源,对三类资源进行操作的REST API被neutron-server看做Core API 由neutron原生支持,其中

openstack-neutron(queens)

注意**:学习openstack重中之重network的类型包括:Flat,Vlan,Vxlan,GRE,还有一个local 五种网络模式指的是二层网络

Service-plugin,即为出Core-plugin以外的其它的plugin,包括L3router,firewall,loadblancer,vpn,metering等等,主要实现L3-L7的网络服务。

ml2介绍

Neutron对Quantum(neutron的原名)的插件机制进行了优化,将各个厂商L2插件中独立的数据库实现提取出来,作为公共的ML2插件存储租户的业务需求,使得厂商可以专注于L2设备驱动的实现,而ML2作为总控可以协调多厂商L2设备共同运行”。在Quantum中,厂家都是开发各自的Service-plugin,不能兼容而且开发重复度很高,于是在Neutron中就为设计了ML2机制,使得各厂家的L2插件完全变成了可插拔的,方便了L2中network资源扩展与使用。ML2可以支持在一个环境中同时运行五种模式

ml2是一个可插拔插件,支持的模式有openvswitch和linuxbridge(默认)

linuxbridge-agent、dhcp-agent、metadata-agent

可以直观的理解为neutron-plugin在设备上的代理,接受相应的neutron-plugin通知的业务操作和参数,并转换为具体的设备级操作,以指导设备的动作。当本地设备发生问题时,neutron-agent会将情况通知给neutron-plugin(说白了就是neutron-server就是与各个组件交互的,接收请求,neutron-plugin是操作数据库的,neutron-agent就是具体干活的)

安装配置

控制节点配置

数据库已经在前面创建,keystone 用户创建角色授权,服务注册也已经完成

数据库操作

mysql -u root -p
CREATE DATABASE neutron;
MariaDB [(none)]> GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'localhost' \
  IDENTIFIED BY 'NEUTRON_DBPASS';
MariaDB [(none)]> GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'%' \
  IDENTIFIED BY 'NEUTRON_DBPASS';
keystone 操作
source admin-openstack
openstack user create --domain default --password-prompt neutron
openstack role add --project service --user neutron admin
openstack service create --name neutron --description "OpenStack Networking" network
openstack endpoint create --region RegionOne network public http://controller:9696
openstack endpoint create --region RegionOne  network internal http://controller:9696
openstack endpoint create --region RegionOne  network admin http://controller:9696

注意:neutron 网络分为两种一种是提供网络模式另一种是自服务网络,此处选择前者

安装软件包
yum install openstack-neutron openstack-neutron-ml2 openstack-neutron-linuxbridge ebtables

配置文件配置

/etc/neutron/neutron.conf
[database]
# ...
connection = mysql+pymysql://neutron:neutron@controller/neutron

auth_strategy = keystone
core_plugin = ml2          #内核插件使用ml2
# The service plugins Neutron will use (list value)
service_plugins =         #服务插件为空

[keystone_authtoken]        #keystone 连接配置,直接添加即可
auth_uri = http://controller:5000
auth_url = http://controller:35357
memcached_servers = controller:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = neutron
password = neutron

[DEFAULT]            #注意一定要在DEFAULT 下配置
transport_url = rabbit://openstack:openstack@controller
# 当网络端口状态和数据变化时通知NOVA
[DEFAULT]            #取消注释即可
notify_nova_on_port_status_changes = true
notify_nova_on_port_data_changes = true

[nova]              #连接nova
auth_url = http://controller:5000
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = nova
password = nova

lock_path = /var/lib/neutron/tmp   #锁路径


vi /etc/neutron/plugins/ml2/ml2_conf.ini
[ml2]
type_drivers = flat,vlan
tenant_network_types =         #租户网络为空
mechanism_drivers = linuxbridge    #插件选择网桥(还有openvswitch)
extension_drivers = port_security    #使用端口安全

[ml2_type_flat]
flat_networks = provider        #网络名称命名
[securitygroup]
enable_ipset = true          #启用安全组

 

vi /etc/neutron/plugins/ml2/linuxbridge_agent.ini
[linux_bridge]
physical_interface_mappings = provider:eth0  #网络provider通过网卡eth0映射出去
enable_vxlan = false              #禁用vxlan
[securitygroup]
enable_security_group = true
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver  #启用防火墙(前面nova 禁用了自带的防火强就是要用此处的防火墙来替代)
注意一下步骤在有必要请况下执行。
Ensure your Linux operating system kernel supports network bridge filters by verifying all the following sysctl values are set to 1:
net.bridge.bridge-nf-call-iptables
net.bridge.bridge-nf-call-ip6tables
To enable networking bridge support, typically the br_netfilter kernel module needs to be loaded. Check your operating system’s documentation for additional details on enabling this module.

 

vi /etc/neutron/dhcp_agent.ini
[DEFAULT]
# ...
interface_driver = linuxbridge
dhcp_driver = neutron.agent.linux.dhcp.Dnsmasq  #使用Dnsmasq服务进行动态地址分配(相对于dhcpd 服务而言此服务为轻量级)

enable_isolated_metadata = True


切换到如下页面,继续配置元数据代理(Configure the metadata agent)
https://docs.openstack.org/neutron/queens/install/controller-install-rdo.html
/etc/neutron/metadata_agent.ini

[DEFAULT]
# ...
nova_metadata_host = controller
metadata_proxy_shared_secret = fanggege    #neutron 与nova 通讯使用的共享密钥
配置控制节点上的nova 服务的配置文件,添加关于neutron 连接配置信息


/etc/nova/nova.conf
[neutron]     #在neutron 下面直接添加,共享密钥必须与neutron 上一致
# ...
url = http://controller:9696
auth_url = http://controller:5000
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = neutron
password = neutron
service_metadata_proxy = true
metadata_proxy_shared_secret = fanggege

建立连接文件、初始化数据库、开启自启、重启nova-api、启动neutron服务

网络服务初始化的时候需要一个连接文件/etc/neutron/plugin.ini,所以创建此软连接
ln -s /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugin.ini
#数据库初始化
su -s /bin/sh -c "neutron-db-manage --config-file /etc/neutron/neutron.conf \
--config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade head" neutron

# systemctl restart openstack-nova-api.service

# systemctl enable neutron-server.service neutron-linuxbridge-agent.service neutron-dhcp-agent.service \
neutron-metadata-agent.service
# systemctl restart neutron-server.service neutron-linuxbridge-agent.service neutron-dhcp-agent.service \
neutron-metadata-agent.service

计算节点配置

安装

yum install openstack-neutron-linuxbridge ebtables ipset

配置

/etc/neutron/neutron.conf
[DEFAULT]
# ...
transport_url = rabbit://openstack:RABBIT_PASS@controller

[DEFAULT]
# ...
auth_strategy = keystone

[keystone_authtoken]
# ...
auth_uri = http://controller:5000
auth_url = http://controller:5000
memcached_servers = controller:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = neutron
password = neutron

[oslo_concurrency]
# ...
lock_path = /var/lib/neutron/tmp

 

/etc/neutron/plugins/ml2/linuxbridge_agent.ini     #(无需配置只需把控制节点上配置文件复制过来即可)
[linux_bridge]
physical_interface_mappings = provider:eth0         #注意计算节点网络是否通过网卡eth0提供,否则请更改
[vxlan]
enable_vxlan = false
[securitygroup]
# ...
enable_security_group = true
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver

计算节点的nova 服务配置连接控制节点的neutron 服务
vi /etc/nova/nova.conf

[neutron]
# ...
url = http://controller:9696
auth_url = http://controller:5000
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = neutron
password = neutron

systemctl restart openstack-nova-compute.service
systemctl enable neutron-linuxbridge-agent.service
systemctl start neutron-linuxbridge-agent.service

验证查看

在控制节点执行
neutron agent-list 显示有计算节点的linuxbridge-agent 信息则为正常
服务自己起来了不行,必须是控制节点看到他起来了才行
nova service-list 查看服务是否正常(up),包括在计算节点的nova 服务
+--------------------------------------+------------------+------------+----------+---------+-------+----------------------------+-----------------+-------------+
| Id | Binary | Host | Zone | Status | State | Updated_at | Disabled Reason | Forced down |
+--------------------------------------+------------------+------------+----------+---------+-------+----------------------------+-----------------+-------------+
| 4e65d5f4-6f5e-40ed-b5db-fade12e80bd5 | nova-consoleauth | controller | internal | enabled | up | 2019-03-16T20:04:24.000000 | - | False |
| 8f3b2aee-8da1-4d57-956a-19ca7224db4c | nova-scheduler | controller | internal | enabled | up | 2019-03-16T20:04:23.000000 | - | False |
| 3659d1cf-53cb-4906-acb9-159c2cc5666f | nova-conductor | controller | internal | enabled | up | 2019-03-16T20:04:25.000000 | - | False |
| ca14d9c2-f0d1-4363-bd80-a2473f8af3d4 | nova-compute | compute | nova | enabled | up | 2019-03-16T20:04:19.000000 | - | False |
+--------------------------------------+------------------+------------+----------+---------+-------+----------------------------+-----------------+-------------+

 



 

 


上一篇:Java回溯解决八皇后问题


下一篇:"Queens"女王喜欢对别人开战? 已婚vs未婚