超详细Openstack核心组件——neutron部署

目录

OpenStack-neutron组件部署

nova部署完成后,继续部署neutron组件

创建数据库neutron,并进行授权

[root@ct ~]# mysql -u root -p
Enter password: 
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 139
Server version: 10.3.20-MariaDB MariaDB Server

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]> CREATE DATABASE neutron;
Query OK, 1 row affected (0.001 sec)

MariaDB [(none)]> GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'localhost' IDENTIFIED BY 'NEUTRON_DBPASS';
Query OK, 0 rows affected (0.001 sec)

MariaDB [(none)]> GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'%' IDENTIFIED BY 'NEUTRON_DBPASS';
Query OK, 0 rows affected (0.000 sec)

MariaDB [(none)]> flush privileges;
Query OK, 0 rows affected (0.001 sec)

MariaDB [(none)]> exit
Bye

ct控制节点配置

1. 创建neutron用户,用于在keystone做认证

[root@ct ~]# openstack user create --domain default --password NEUTRON_PASS neutron
+---------------------+----------------------------------+
| Field               | Value                            |
+---------------------+----------------------------------+
| domain_id           | default                          |
| enabled             | True                             |
| id                  | 0512de2dc615449f989c1a2df21580b8 |
| name                | neutron                          |
| options             | {}                               |
| password_expires_at | None                             |
+---------------------+----------------------------------+

2. 将neutron用户添加到service项目中拥有管理员权限

[root@ct ~]# openstack role add --project service --user neutron admin

3. 创建network服务,服务类型为network

[root@ct ~]# openstack service create --name neutron --description "OpenStack Networking" network 
+-------------+----------------------------------+
| Field       | Value                            |
+-------------+----------------------------------+
| description | OpenStack Networking             |
| enabled     | True                             |
| id          | 2ae3fcc1257f4bacafeab727bd97829a |
| name        | neutron                          |
| type        | network                          |
+-------------+----------------------------------+

4. 注册API到neutron服务,给neutron服务关联端口,即添加endpoint

[root@ct ~]# openstack endpoint create --region RegionOne network public http://ct:9696
+--------------+----------------------------------+
| Field        | Value                            |
+--------------+----------------------------------+
| enabled      | True                             |
| id           | 4b43372eb0034d99a6cbd1fcf80697d4 |
| interface    | public                           |
| region       | RegionOne                        |
| region_id    | RegionOne                        |
| service_id   | 2ae3fcc1257f4bacafeab727bd97829a |
| service_name | neutron                          |
| service_type | network                          |
| url          | http://ct:9696                   |
+--------------+----------------------------------+
[root@ct ~]#  openstack endpoint create --region RegionOne network internal http://ct:9696
+--------------+----------------------------------+
| Field        | Value                            |
+--------------+----------------------------------+
| enabled      | True                             |
| id           | 2c84ee43c15e4fb09fe8478ac828a337 |
| interface    | internal                         |
| region       | RegionOne                        |
| region_id    | RegionOne                        |
| service_id   | 2ae3fcc1257f4bacafeab727bd97829a |
| service_name | neutron                          |
| service_type | network                          |
| url          | http://ct:9696                   |
+--------------+----------------------------------+
[root@ct ~]#  openstack endpoint create --region RegionOne network admin http://ct:9696
+--------------+----------------------------------+
| Field        | Value                            |
+--------------+----------------------------------+
| enabled      | True                             |
| id           | 7aa9431365154ce590925215e324b667 |
| interface    | admin                            |
| region       | RegionOne                        |
| region_id    | RegionOne                        |
| service_id   | 2ae3fcc1257f4bacafeab727bd97829a |
| service_name | neutron                          |
| service_type | network                          |
| url          | http://ct:9696                   |
+--------------+----------------------------------+

5. 安装提供者网络(桥接)
6. ebtables包是用来管理iptables规则的

[root@ct ~]# yum -y install openstack-neutron openstack-neutron-ml2 openstack-neutron-linuxbridge ebtables conntrack-tools

7. 更改主配置文件

  • 修改主配置文件neutron.conf
[root@ct ~]# cp -a /etc/neutron/neutron.conf{,.bak}
[root@ct ~]# grep -Ev '^$|#' /etc/neutron/neutron.conf.bak > /etc/neutron/neutron.conf
[root@ct ~]# openstack-config --set /etc/neutron/neutron.conf database connection mysql+pymysql://neutron:NEUTRON_DBPASS@ct/neutron
[root@ct ~]# openstack-config --set /etc/neutron/neutron.conf DEFAULT core_plugin ml2
[root@ct ~]# openstack-config --set /etc/neutron/neutron.conf DEFAULT service_plugins router
[root@ct ~]# openstack-config --set  /etc/neutron/neutron.conf DEFAULT allow_overlapping_ips true
[root@ct ~]# openstack-config --set /etc/neutron/neutron.conf DEFAULT transport_url rabbit://openstack:RABBIT_PASS@ct
[root@ct ~]# openstack-config --set /etc/neutron/neutron.conf DEFAULT auth_strategy keystone
[root@ct ~]# openstack-config --set /etc/neutron/neutron.conf DEFAULT notify_nova_on_port_status_changes true
[root@ct ~]# openstack-config --set /etc/neutron/neutron.conf DEFAULT notify_nova_on_port_data_changes true
[root@ct ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken www_authenticate_uri http://ct:5000
[root@ct ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken auth_url http://ct:5000
[root@ct ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken memcached_servers ct:11211
[root@ct ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken auth_type password
[root@ct ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken project_domain_name default
[root@ct ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken user_domain_name default
[root@ct ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken project_name service
[root@ct ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken username neutron
[root@ct ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken password NEUTRON_PASS
[root@ct ~]# openstack-config --set /etc/neutron/neutron.conf oslo_concurrency lock_path /var/lib/neutron/tmp
[root@ct ~]# openstack-config --set  /etc/neutron/neutron.conf nova  auth_url http://ct:5000
[root@ct ~]# openstack-config --set  /etc/neutron/neutron.conf nova  auth_type password
[root@ct ~]# openstack-config --set  /etc/neutron/neutron.conf nova  project_domain_name default
[root@ct ~]# openstack-config --set  /etc/neutron/neutron.conf nova  user_domain_name default
[root@ct ~]# openstack-config --set  /etc/neutron/neutron.conf nova  region_name RegionOne
[root@ct ~]# openstack-config --set  /etc/neutron/neutron.conf nova  project_name service
[root@ct ~]# openstack-config --set  /etc/neutron/neutron.conf nova  username nova
[root@ct ~]# openstack-config --set  /etc/neutron/neutron.conf nova  password NOVA_PASS
  • 查看配置文件
[root@ct ~]# cd /etc/neutron/
[root@ct neutron]# cat neutron.conf
[DEFAULT]
core_plugin = ml2						//启用二层网络插件
service_plugins = router					//启用三层网络插件
allow_overlapping_ips = true
transport_url = rabbit://openstack:RABBIT_PASS@ct		//配置rabbitmq连接
auth_strategy = keystone					//认证的方式:keystone
notify_nova_on_port_status_changes = true			//当网络接口发生变化时,通知给计算节点	
notify_nova_on_port_data_changes = true			//当端口数据发生变化,通知计算节点
[cors]
[database]						//配置数据库连接
connection = mysql+pymysql://neutron:NEUTRON_DBPASS@ct/neutron
[keystone_authtoken]					//配置keystone认证信息
www_authenticate_uri = http://ct:5000
auth_url = http://ct:5000
memcached_servers = ct:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = neutron
password = NEUTRON_PASS
[oslo_concurrency]						//配置锁路径
lock_path = /var/lib/neutron/tmp
[oslo_messaging_amqp]
[oslo_messaging_kafka]
[oslo_messaging_notifications]
[oslo_messaging_rabbit]
[oslo_middleware]
[oslo_policy]
[privsep]
[ssl]
[nova]							//neutron需要给nova返回数据
auth_url = http://ct:5000					//到keystone认证nova
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = nova						//通过nova的用户名和密码到keystone验证nova的token
password = NOVA_PASS

8. 修改 ML2 plugin 配置文件 ml2_conf.ini

  • 修改参数
[root@ct ~]# cp -a /etc/neutron/plugins/ml2/ml2_conf.ini{,.bak}
[root@ct ~]# grep -Ev '^$|#' /etc/neutron/plugins/ml2/ml2_conf.ini.bak > /etc/neutron/plugins/ml2/ml2_conf.ini
[root@ct ~]# openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2 type_drivers  flat,vlan,vxlan
[root@ct ~]# openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2 tenant_network_types vxlan
[root@ct ~]# openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2 mechanism_drivers  linuxbridge,l2population
[root@ct ~]# openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2 extension_drivers  port_security
[root@ct ~]# openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2_type_flat flat_networks  provider
[root@ct ~]# openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2_type_vxlan vni_ranges 1:1000
[root@ct ~]# openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini securitygroup enable_ipset  true
  • 查看配置文件
[root@ct neutron]# cat /etc/neutron/plugins/ml2/ml2_conf.ini
[DEFAULT]


[ml2]
type_drivers = flat,vlan,vxlan				//配置驱动类型;单一扁平网络(桥接)和vlan;让二层网络支持桥接,支持基于vlan做子网划分
tenant_network_types = vxlan				//租户网络类型(vxlan)
mechanism_drivers = linuxbridge,l2population		//启用Linuxbridge和l2机制,(l2population机制是为了简化网络通信拓扑,减少网络广播):
extension_drivers = port_security			//启用端口安全扩展驱动程序,基于iptables实现访问控制;但配置了扩展安全组会导致一些端口限制,造成一些服务无法启动 

[ml2_type_flat]
flat_networks = provider				//配置公共虚拟网络为flat网络

[ml2_type_vxlan]
vni_ranges = 1:1000				//为私有网络配置VXLAN网络识别的网络范围

[securitygroup]
enable_ipset = true					//启用 ipset 增加安全组的方便性

9. 修改 linux bridge network provider 配置文件

  • Linux网桥配置
[root@ct ~]# cp -a /etc/neutron/plugins/ml2/linuxbridge_agent.ini{,.bak}
[root@ct ~]# grep -Ev '^$|#' /etc/neutron/plugins/ml2/linuxbridge_agent.ini.bak > /etc/neutron/plugins/ml2/linuxbridge_agent.ini
[root@ct ~]# openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini linux_bridge physical_interface_mappings  provider:eth0    //eth0网卡名称(内网网卡)
[root@ct ~]# openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini vxlan enable_vxlan  true
[root@ct ~]# openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini vxlan local_ip 192.168.100.10   //控制节点IP地址
[root@ct ~]# openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini vxlan l2_population true
[root@ct ~]# openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini securitygroup enable_security_group  true
[root@ct ~]# openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini securitygroup firewall_driver  neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
  • 查看配置文件
[root@ct ~]# cat /etc/neutron/plugins/ml2/linuxbridge_agent.ini
[DEFAULT]

[linux_bridge]
physical_interface_mappings = provider:eth0			//指定上个文件中的桥接网络名称,与eth0物理网卡做关联,后期给虚拟机分配external网络,就可以通过eth0上外网;物理网卡有可能是bind0、br0等

[vxlan]							//启用VXLAN覆盖网络,配置覆盖网络的物理网络接口的IP地址,启用layer-2 population
enable_vxlan = true						//允许用户创建自定义网络(3层网络)
local_ip = 192.168.100.10
l2_population = true

[securitygroup]						//启用安全组并配置 Linux 桥接 iptables 防火墙驱动
enable_security_group = true
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver

10. 修改内核参数

[root@ct ~]# echo 'net.bridge.bridge-nf-call-iptables=1' >> /etc/sysctl.conf
[root@ct ~]# echo 'net.bridge.bridge-nf-call-ip6tables=1' >> /etc/sysctl.conf
[root@ct ~]# modprobe br_netfilter   //表示向内核加入参数
[root@ct ~]# sysctl -p
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1

11. 配置Linuxbridge接口驱动和外部网络网桥

[root@ct ~]# cp -a /etc/neutron/l3_agent.ini{,.bak}
[root@ct ~]# grep -Ev '^$|#' /etc/neutron/l3_agent.ini.bak > /etc/neutron/l3_agent.ini
[root@ct ~]# openstack-config --set /etc/neutron/l3_agent.ini DEFAULT interface_driver linuxbridge
  • 查看修改内容
[root@ct ~]# cat /etc/neutron/l3_agent.ini
[DEFAULT]
interface_driver = linuxbridge

12. 修改dhcp_agent 配置文件

[root@ct ~]# cp -a /etc/neutron/dhcp_agent.ini{,.bak}
[root@ct ~]# grep -Ev '^$|#' /etc/neutron/dhcp_agent.ini.bak > /etc/neutron/dhcp_agent.ini
[root@ct ~]# openstack-config --set /etc/neutron/dhcp_agent.ini DEFAULT interface_driver linuxbridge
[root@ct ~]#  openstack-config --set /etc/neutron/dhcp_agent.ini DEFAULT dhcp_driver neutron.agent.linux.dhcp.Dnsmasq
[root@ct ~]#  openstack-config --set /etc/neutron/dhcp_agent.ini DEFAULT enable_isolated_metadata true

13. 修改dhcp_agent的配置文件内容

[root@ct ~]# cat /etc/neutron/dhcp_agent.ini
[DEFAULT]
interface_driver = linuxbridge  	//指定默认接口驱动为linux网桥
dhcp_driver = neutron.agent.linux.dhcp.Dnsmasq	  //指定DHCP驱动
enable_isolated_metadata = true			//开启iso元数据

14. 配置元数据代理、用于配置桥接与自服务网络的通用配置

[root@ct ~]# cp -a /etc/neutron/metadata_agent.ini{,.bak}
[root@ct ~]# grep -Ev '^$|#' /etc/neutron/metadata_agent.ini.bak > /etc/neutron/metadata_agent.ini
[root@ct ~]# openstack-config --set /etc/neutron/metadata_agent.ini DEFAULT nova_metadata_host ct
[root@ct ~]# openstack-config --set /etc/neutron/metadata_agent.ini DEFAULT metadata_proxy_shared_secret METADATA_SECRET
  • 查看配置文件内容
[root@ct ~]# cat /etc/neutron/metadata_agent.ini
[DEFAULT]
nova_metadata_host = ct
metadata_proxy_shared_secret = METADATA_SECRET
[cache]

15. 修改nova配置文件,用于neutron交互

  • 修改CT配置文件
[root@ct ~]# openstack-config --set /etc/nova/nova.conf neutron url http://ct:9696
[root@ct ~]# openstack-config --set /etc/nova/nova.conf neutron auth_url http://ct:5000
[root@ct ~]# openstack-config --set /etc/nova/nova.conf neutron auth_type password
[root@ct ~]# openstack-config --set /etc/nova/nova.conf neutron project_domain_name default
[root@ct ~]# openstack-config --set /etc/nova/nova.conf neutron user_domain_name default
[root@ct ~]# openstack-config --set /etc/nova/nova.conf neutron region_name RegionOne
[root@ct ~]# openstack-config --set /etc/nova/nova.conf neutron project_name service
[root@ct ~]# openstack-config --set /etc/nova/nova.conf neutron username neutron
[root@ct ~]# openstack-config --set /etc/nova/nova.conf neutron password NEUTRON_PASS
[root@ct ~]# openstack-config --set /etc/nova/nova.conf neutron service_metadata_proxy true
[root@ct ~]# openstack-config --set /etc/nova/nova.conf neutron metadata_proxy_shared_secret METADATA_SECRET
  • 查看配置文件
[root@ct ~]# cat /etc/nova/nova.conf
[DEFAULT]
enabled_apis = osapi_compute,metadata
my_ip = 192.168.100.10
use_neutron = true
firewall_driver = nova.virt.firewall.NoopFirewallDriver
transport_url = rabbit://openstack:RABBIT_PASS@ct
[api]
auth_strategy = keystone
[api_database]
connection = mysql+pymysql://nova:NOVA_DBPASS@ct/nova_api
[barbican]
[cache]
[cinder]
[compute]
[conductor]
[console]
[consoleauth]
[cors]
[database]
connection = mysql+pymysql://nova:NOVA_DBPASS@ct/nova
[devices]
[ephemeral_storage_encryption]
[filter_scheduler]
[glance]
api_servers = http://ct:9292
[guestfs]
[healthcheck]
[hyperv]
[ironic]
[key_manager]
[keystone]
[keystone_authtoken]
auth_url = http://ct:5000/v3
memcached_servers = ct:11211
auth_type = password
project_domain_name = Default
user_domain_name = Default
project_name = service
username = nova
password = NOVA_PASS
[libvirt]
[metrics]
[mks]
[neutron]
url = http://ct:9696
auth_url = http://ct:5000
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = neutron
password = NEUTRON_PASS
service_metadata_proxy = true
metadata_proxy_shared_secret = METADATA_SECRET
[notifications]
[osapi_v21]
[oslo_concurrency]
lock_path = /var/lib/nova/tmp
[oslo_messaging_amqp]
[oslo_messaging_kafka]
[oslo_messaging_notifications]
[oslo_messaging_rabbit]
[oslo_middleware]
[oslo_policy]
[pci]
[placement]
region_name = RegionOne
project_domain_name = Default
project_name = service
auth_type = password
user_domain_name = Default
auth_url = http://ct:5000/v3
username = placement
password = PLACEMENT_PASS
[powervm]
[privsep]
[profiler]
[quota]
[rdp]
[remote_debug]
[scheduler]
discover_hosts_in_cells_interval = 300
[serial_console]
[service_user]
[spice]
[upgrade_levels]
[vault]
[vendordata_dynamic_auth]
[vmware]
[vnc]
enabled = true
server_listen =  $my_ip
server_proxyclient_address =  $my_ip
[workarounds]
[wsgi]
[xenserver]
[xvp]
[zvm]


[placement_database]
connection = mysql+pymysql://placement:PLACEMENT_DBPASS@ct/placement

16. 创建ML2插件文件符号连接

  • 网络服务初始化脚本需要/etc/neutron/plugin.ini指向ML2插件配置文件的符号链接
[root@ct ~]# ln -s /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugin.ini

17. 初始化数据库

[root@ct ~]# su -s /bin/sh -c "neutron-db-manage --config-file /etc/neutron/neutron.conf \
--config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade head" neutron

超详细Openstack核心组件——neutron部署
18. 重启计算节点nova-api服务

[root@ct ~]# systemctl restart openstack-nova-api.service

19. 开启neutron服务、设置开机自启动

[root@ct ~]# systemctl enable neutron-server.service \
> neutron-linuxbridge-agent.service neutron-dhcp-agent.service \
> neutron-metadata-agent.service
Created symlink from /etc/systemd/system/multi-user.target.wants/neutron-server.service to /usr/lib/systemd/system/neutron-server.service.
Created symlink from /etc/systemd/system/multi-user.target.wants/neutron-linuxbridge-agent.service to /usr/lib/systemd/system/neutron-linuxbridge-agent.service.
Created symlink from /etc/systemd/system/multi-user.target.wants/neutron-dhcp-agent.service to /usr/lib/systemd/system/neutron-dhcp-agent.service.
Created symlink from /etc/systemd/system/multi-user.target.wants/neutron-metadata-agent.service to /usr/lib/systemd/system/neutron-metadata-agent.service.
[root@ct ~]# systemctl start neutron-server.service \
> neutron-linuxbridge-agent.service neutron-dhcp-agent.service \
> neutron-metadata-agent.service
  • 查看服务开启状态
[root@ct ~]# netstat -anutp |grep 9696
tcp        0      0 0.0.0.0:9696            0.0.0.0:*               LISTEN      3270/server.log     

20. 因为配置了第三层L3网络服务、所以需要启动第三层服务

[root@ct ~]# systemctl enable neutron-l3-agent.service
Created symlink from /etc/systemd/system/multi-user.target.wants/neutron-l3-agent.service to /usr/lib/systemd/system/neutron-l3-agent.service.
[root@ct ~]# systemctl restart neutron-l3-agent.service

c1 节点操作

[root@c1 ~]# yum -y install openstack-neutron-linuxbridge ebtables ipset conntrack-tools
//ipset:iptables的扩展,允许匹配规则的集合而不仅仅是一个IP

1. 修改neutron.conf文件

[root@c1 ~]# cp -a /etc/neutron/neutron.conf{,.bak}
[root@c1 ~]# grep -Ev '^$|#' /etc/neutron/neutron.conf.bak > /etc/neutron/neutron.conf
[root@c1 ~]# openstack-config --set /etc/neutron/neutron.conf DEFAULT transport_url rabbit://openstack:RABBIT_PASS@ct
[root@c1 ~]# openstack-config --set /etc/neutron/neutron.conf DEFAULT auth_strategy keystone
[root@c1 ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken www_authenticate_uri http://ct:5000
[root@c1 ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken auth_url http://ct:5000
[root@c1 ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken memcached_servers ct:11211
[root@c1 ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken auth_type password
[root@c1 ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken project_domain_name default
[root@c1 ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken user_domain_name default
[root@c1 ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken project_name service
[root@c1 ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken username neutron
[root@c1 ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken password NEUTRON_PASS
[root@c1 ~]# openstack-config --set /etc/neutron/neutron.conf oslo_concurrency lock_path /var/lib/neutron/tmp
  • 查看配置文件
[root@c1 ~]# cat /etc/neutron/neutron.conf
[DEFAULT]					//neutron的server端与agent端通讯也是通过rabbitmq进行通讯的
transport_url = rabbit://openstack:RABBIT_PASS@ct
auth_strategy = keystone				//认证策略:keystone
[cors]
[database]

[keystone_authtoken]				//指定keystone认证的信息
www_authenticate_uri = http://ct:5000
auth_url = http://ct:5000
memcached_servers = ct:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = neutron
password = NEUTRON_PASS

[oslo_concurrency]					//配置锁路径(管理线程库)
lock_path = /var/lib/neutron/tmp

[oslo_messaging_amqp]
[oslo_messaging_kafka]
[oslo_messaging_notifications]
[oslo_messaging_rabbit]
[oslo_middleware]
[oslo_policy]
[privsep]
[ssl]

2. 配置Linux网桥代理

[root@c1 ~]# cp -a /etc/neutron/plugins/ml2/linuxbridge_agent.ini{,.bak}
[root@c1 ~]# grep -Ev '^$|#' /etc/neutron/plugins/ml2/linuxbridge_agent.ini.bak > /etc/neutron/plugins/ml2/linuxbridge_agent.ini
[root@c1 ~]# openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini linux_bridge physical_interface_mappings  provider:eth0
[root@c1 ~]# openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini vxlan enable_vxlan  true
[root@c1 ~]# openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini vxlan local_ip 192.168.100.11
[root@c1 ~]# openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini vxlan l2_population true
[root@c1 ~]# openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini securitygroup enable_security_group  true
[root@c1 ~]# openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini securitygroup firewall_driver  neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
  • 查看修改配置
[root@c1 ~]# cat /etc/neutron/plugins/ml2/linuxbridge_agent.ini
[DEFAULT]
[linux_bridge]
physical_interface_mappings = provider:eth0
//直接将node节点external网络绑定在当前节点的指定的物理网卡,不需要node节点配置网络名称,node节点只需要接收controller节点指令即可;controller节点上配置的external网络名称是针对整个openstack环境生效的,所以指定external网络绑定在当前node节点的eth0物理网卡上(也可能是bind0或br0)

[vxlan]
enable_vxlan = true							//开启Vxlan网络
local_ip = 192.168.100.11
l2_population = true						//L2 Population 是用来提高 VXLAN 网络扩展能力的组件

[securitygroup]
enable_security_group = true						//开启安全组
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver	//指定安全组驱动文件

3. 修改内核

[root@c1 ~]# echo 'net.bridge.bridge-nf-call-iptables=1' >> /etc/sysctl.conf    //允许虚拟机的数据通过物理机出去
[root@c1 ~]# echo 'net.bridge.bridge-nf-call-ip6tables=1' >> /etc/sysctl.conf
[root@c1 ~]# modprobe br_netfilter   //modprobe:用于向内核中加载模块或者从内核中移除模块。modprobe -r 表示移除
[root@c1 ~]# sysctl -p
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1

4. 修改nova.conf配置文件

[root@c1 ~]# openstack-config --set /etc/nova/nova.conf neutron auth_url http://ct:5000
[root@c1 ~]# openstack-config --set /etc/nova/nova.conf neutron auth_type password
[root@c1 ~]# openstack-config --set /etc/nova/nova.conf neutron project_domain_name default
[root@c1 ~]# openstack-config --set /etc/nova/nova.conf neutron user_domain_name default
[root@c1 ~]# openstack-config --set /etc/nova/nova.conf neutron region_name RegionOne
[root@c1 ~]# openstack-config --set /etc/nova/nova.conf neutron project_name service
[root@c1 ~]# openstack-config --set /etc/nova/nova.conf neutron username neutron
[root@c1 ~]# openstack-config --set /etc/nova/nova.conf neutron password NEUTRON_PASS
  • 查看修改内容
[root@c1 ~]# cat /etc/nova/nova.conf
[neutron]
auth_url = http://ct:5000
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = neutron
password = NEUTRON_PASS

5. 验证服务组件(在CT服务器)

[root@ct ~]# openstack extension list --network
+----------------------------------------------------------------------------------------------------------------------------------------------------------------+---------------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------+
| Name                                                                                                                                                           | Alias                                 | Description                                                                                                                                              |
+----------------------------------------------------------------------------------------------------------------------------------------------------------------+---------------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------+
| Subnet Pool Prefix Operations                                                                                                                                  | subnetpool-prefix-ops                 | Provides support for adjusting the prefix list of subnet pools                                                                                           |
| Default Subnetpools                                                                                                                                            | default-subnetpools                   | Provides ability to mark and use a subnetpool as the default.                                                                                            |
| Availability Zone                                                                                                                                              | availability_zone                     | The availability zone extension.                                                                                                                         |
| Network Availability Zone                                                                                                                                      | network_availability_zone             | Availability zone support for network.                                                                                                                   |
| Subnet Onboard                                                                                                                                                 | subnet_onboard                        | Provides support for onboarding subnets into subnet pools                                                                                                |
| Auto Allocated Topology Services                                                                                                                               | auto-allocated-topology               | Auto Allocated Topology Services.                                                                                                                        |
| Neutron L3 Configurable external gateway mode                                                                                                                  | ext-gw-mode                           | Extension of the router abstraction for specifying whether SNAT should occur on the external gateway                                                     |
| Port Binding                                                                                                                                                   | binding                               | Expose port bindings of a virtual port to external application                                                                                           |
| agent                                                                                                                                                          | agent                                 | The agent management extension.                                                                                                                          |
| Subnet Allocation                                                                                                                                              | subnet_allocation                     | Enables allocation of subnets from a subnet pool                                                                                                         |
| DHCP Agent Scheduler                                                                                                                                           | dhcp_agent_scheduler                  | Schedule networks among dhcp agents                                                                                                                      |
| Neutron external network                                                                                                                                       | external-net                          | Adds external network attribute to network resource.                                                                                                     |
| Empty String Filtering Extension                                                                                                                               | empty-string-filtering                | Allow filtering by attributes with empty string value                                                                                                    |
| Tag support for resources with standard attribute: subnet, trunk, network_segment_range, router, network, policy, subnetpool, port, security_group, floatingip | standard-attr-tag                     | Enables to set tag on resources with standard attribute.                                                                                                 |
| Neutron Service Flavors                                                                                                                                        | flavors                               | Flavor specification for Neutron advanced services.                                                                                                      |
| Network MTU                                                                                                                                                    | net-mtu                               | Provides MTU attribute for a network resource.                                                                                                           |
| Network IP Availability                                                                                                                                        | network-ip-availability               | Provides IP availability data for each network and subnet.                                                                                               |
| Quota management support                                                                                                                                       | quotas                                | Expose functions for quotas management per tenant                                                                                                        |
| If-Match constraints based on revision_number                                                                                                                  | revision-if-match                     | Extension indicating that If-Match based on revision_number is supported.                                                                                |
| Prevent L3 router ports IP address change extension                                                                                                            | l3-port-ip-change-not-allowed         | Prevent change of IP address for some L3 router ports                                                                                                    |
| Availability Zone Filter Extension                                                                                                                             | availability_zone_filter              | Add filter parameters to AvailabilityZone resource                                                                                                       |
| HA Router extension                                                                                                                                            | l3-ha                                 | Adds HA capability to routers.                                                                                                                           |
| Enforce Router's Admin State Down Before Update Extension                                                                                                      | router-admin-state-down-before-update | Ensure that the admin state of a router is down (admin_state_up=False) before updating the distributed attribute                                         |
| Filter parameters validation                                                                                                                                   | filter-validation                     | Provides validation on filter parameters.                                                                                                                |
| Multi Provider Network                                                                                                                                         | multi-provider                        | Expose mapping of virtual networks to multiple physical networks                                                                                         |
| Quota details management support                                                                                                                               | quota_details                         | Expose functions for quotas usage statistics per project                                                                                                 |
| Address scope                                                                                                                                                  | address-scope                         | Address scopes extension.                                                                                                                                |
| Neutron Extra Route                                                                                                                                            | extraroute                            | Extra routes configuration for L3 router                                                                                                                 |
| Network MTU (writable)                                                                                                                                         | net-mtu-writable                      | Provides a writable MTU attribute for a network resource.                                                                                                |
| Agent's Resource View Synced to Placement                                                                                                                      | agent-resources-synced                | Stores success/failure of last sync to Placement                                                                                                         |
| Subnet service types                                                                                                                                           | subnet-service-types                  | Provides ability to set the subnet service_types field                                                                                                   |
| Floating IP Pools Extension                                                                                                                                    | floatingip-pools                      | Provides a floating IP pools API.                                                                                                                        |
| Neutron Port MAC address regenerate                                                                                                                            | port-mac-address-regenerate           | Network port MAC address regenerate                                                                                                                      |
| Add security_group type to network RBAC                                                                                                                        | rbac-security-groups                  | Add security_group type to network RBAC                                                                                                                  |
| Provider Network                                                                                                                                               | provider                              | Expose mapping of virtual networks to physical networks                                                                                                  |
| Neutron Service Type Management                                                                                                                                | service-type                          | API for retrieving service providers for Neutron advanced services                                                                                       |
| Router Flavor Extension                                                                                                                                        | l3-flavors                            | Flavor support for routers.                                                                                                                              |
| Port Security                                                                                                                                                  | port-security                         | Provides port security                                                                                                                                   |
| Neutron Extra DHCP options                                                                                                                                     | extra_dhcp_opt                        | Extra options configuration for DHCP. For example PXE boot options to DHCP clients can be specified (e.g. tftp-server, server-ip-address, bootfile-name) |
| Port filtering on security groups                                                                                                                              | port-security-groups-filtering        | Provides security groups filtering when listing ports                                                                                                    |
| Resource timestamps                                                                                                                                            | standard-attr-timestamp               | Adds created_at and updated_at fields to all Neutron resources that have Neutron standard attributes.                                                    |
| Resource revision numbers                                                                                                                                      | standard-attr-revisions               | This extension will display the revision number of neutron resources.                                                                                    |
| Pagination support                                                                                                                                             | pagination                            | Extension that indicates that pagination is enabled.                                                                                                     |
| Sorting support                                                                                                                                                | sorting                               | Extension that indicates that sorting is enabled.                                                                                                        |
| security-group                                                                                                                                                 | security-group                        | The security groups extension.                                                                                                                           |
| L3 Agent Scheduler                                                                                                                                             | l3_agent_scheduler                    | Schedule routers among l3 agents                                                                                                                         |
| Floating IP Port Details Extension                                                                                                                             | fip-port-details                      | Add port_details attribute to Floating IP resource                                                                                                       |
| Router Availability Zone                                                                                                                                       | router_availability_zone              | Availability zone support for router.                                                                                                                    |
| RBAC Policies                                                                                                                                                  | rbac-policies                         | Allows creation and modification of policies that control tenant access to resources.                                                                    |
| Atomically add/remove extra routes                                                                                                                             | extraroute-atomic                     | Edit extra routes of a router on server side by atomically adding/removing extra routes                                                                  |
| standard-attr-description                                                                                                                                      | standard-attr-description             | Extension to add descriptions to standard attributes                                                                                                     |
| IP address substring filtering                                                                                                                                 | ip-substring-filtering                | Provides IP address substring filtering when listing ports                                                                                               |
| Neutron L3 Router                                                                                                                                              | router                                | Router abstraction for basic L3 forwarding between L2 Neutron networks and access to external networks via a NAT gateway.                                |
| Allowed Address Pairs                                                                                                                                          | allowed-address-pairs                 | Provides allowed address pairs                                                                                                                           |
| Port Bindings Extended                                                                                                                                         | binding-extended                      | Expose port bindings of a virtual port to external application                                                                                           |
| project_id field enabled                                                                                                                                       | project-id                            | Extension that indicates that project_id field is enabled.                                                                                               |
| Distributed Virtual Router                                                                                                                                     | dvr                                   | Enables configuration of Distributed Virtual Routers.                                                                                                    |
+----------------------------------------------------------------------------------------------------------------------------------------------------------------+---------------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------+

[root@ct ~]# openstack network agent list
+--------------------------------------+--------------------+------+-------------------+-------+-------+---------------------------+
| ID                                   | Agent Type         | Host | Availability Zone | Alive | State | Binary                    |
+--------------------------------------+--------------------+------+-------------------+-------+-------+---------------------------+
| 1e4bea03-2d7b-4e48-bff2-c20b29e5a39e | DHCP agent         | ct   | nova              | :-)   | UP    | neutron-dhcp-agent        |
| 7459f32d-dbf2-4ae7-8d0a-06e7b4d29ec2 | Linux bridge agent | ct   | None              | :-)   | UP    | neutron-linuxbridge-agent |
| 7741ff4c-3126-4083-90c9-7516eeb22b63 | L3 agent           | ct   | nova              | :-)   | UP    | neutron-l3-agent          |
| 8fbc9004-1b24-4c78-bd89-69409b4d82a4 | Metadata agent     | ct   | None              | :-)   | UP    | neutron-metadata-agent    |
+--------------------------------------+--------------------+------+-------------------+-------+-------+---------------------------+

c2节点操作

操作与c1相同,将/etc/neutron/plugins/ml2/linuxbridge_agent.ini 配置文件的local_ip改为自身ip即可

总结

三个节点都需要配置neutron网络,以下为部署思路:
配置neutron组件的用户、认证、endpoint
设置提供者provider网络(这里是桥接模式)

  1. 配置二层网络
  2. 配置网桥(插件)
  3. 优化内核
  4. 配置网桥接口与外部对接
  5. 修改DHCP配置(修改配置文件、代理)
  6. 配置网桥与内部组件的配置(修改配置文件、代理)

设置neutron与nova对接的配置
其中C1、C2节点配置相同

上一篇:VTK笔记-图像融合-01-功能概述


下一篇:YbtOJ#643-机器决斗【贪心,李超树】