OpenStack(Kilo) + Tenant-OVS-VXLAN(ml2) + Multi-Ext-Net

from:  http://blog.sina.com.cn/s/blog_6de3aa8a0102vl7m.html

使用VirualBox创建CentOS7虚拟机

资源分配视宿主windows而定，由于要部署OpenStack，建议配置为CPU 4个，内存6144MB，硬盘80GB。并且为虚拟机分配四个网卡，分别为：【视情况新建和设置全局网络，2个Host-Only网络和1个NAT网络】

网卡名称	IP地址	网络模式	网络	备注
eth0	192.168.10.123	Host-Only#1	192.168.10.0/24	管理网络
eth1	192.168.100.123	Host-Only#2	192.168.100.0/24	数据网络（tunnel）
eth2	10.10.10.123	NAT网络	10.10.10.0/24	外部网络NAT 混杂模式为全部允许
eth3	192.168.137.123	Host-Only#3	192.168.137.0/24	外部网络Host 混杂模式为全部允许

 

VirualBox中CentOS7虚拟机的网卡配置

cat/etc/sysconfig/network-scripts/ifcfg-eth0

TYPE=Ethernet

BOOTPROTO=static

DEFROUTE=yes

IPV6INIT=no

NAME=eth0

DEVICE=eth0

ONBOOT=yes

IPADDR=192.168.10.123

NETMASK=255.255.255.0

 

cat/etc/sysconfig/network-scripts/ifcfg-eth1

TYPE=Ethernet

BOOTPROTO=static

DEFROUTE=yes

IPV6INIT=no

NAME=eth1

DEVICE=eth1

ONBOOT=yes

IPADDR=192.168.100.123

NETMASK=255.255.255.0

 

cat/etc/sysconfig/network-scripts/ifcfg-eth2

TYPE=Ethernet

BOOTPROTO=static

DEFROUTE=yes

IPV6INIT=no

NAME=eth2

DEVICE=eth2

BOOTPROTO=static

IPADDR=10.10.10.123

NETMASK=255.255.255.0

GATEWAY=10.10.10.1

DNS1=114.114.114.114

ONBOOT=yes

 

cat/etc/sysconfig/network-scripts/ifcfg-eth3

TYPE=Ethernet

BOOTPROTO=static

DEFROUTE=yes

IPV6INIT=no

NAME=eth3

DEVICE=eth3

BOOTPROTO=static

IPADDR=192.168.137.123

NETMASK=255.255.255.0

GATEWAY=192.168.137.1

DNS1=114.114.114.114

ONBOOT=yes

systemctl restartnetwork

 

 

使用RDO部署OpenStack（kilo）

sudo yum update-y

sudo rpm -ivhhttps://repos.fedorapeople.org/repos/openstack/openstack-kilo/rdo-release-kilo-1.noarch.rpm

sudo yum install -yopenstack-packstack

packstack--gen-answer-file=/root/openstack-kilo.cfg

注意：RDO配置文件/root/openstack-kilo.cfg

（1）注意修改常用的密码，比如CONFIG_MARIADB_PW，CONFIG_KEYSTONE_ADMIN_PW等。

（2）将自动生成的IP地址换为指定管理网络eth0的地址192.168.10.123

（3） CONFIG_NEUTRON_ML2_TYPE_DRIVERS=vxlan,flat

       CONFIG_NEUTRON_ML2_TENANT_NETWORK_TYPES=vxlan

 CONFIG_NEUTRON_ML2_VNI_RANGES=1:1000

       CONFIG_NEUTRON_L2_AGENT=openvswitch

       CONFIG_NEUTRON_OVS_TUNNEL_IF=eth1

packstack--answer-file=/root/openstack-kilo.cfg

 

此时VirualBox中CentOS7虚拟机的网卡配置，注意br-ex,eth2,br-ex1,eth3

cat/etc/sysconfig/network-scripts/ifcfg-eth0

TYPE=Ethernet

BOOTPROTO=static

DEFROUTE=yes

IPV6INIT=no

NAME=eth0

DEVICE=eth0

ONBOOT=yes

IPADDR=192.168.10.123

NETMASK=255.255.255.0

 

cat/etc/sysconfig/network-scripts/ifcfg-eth1

TYPE=Ethernet

BOOTPROTO=static

DEFROUTE=yes

IPV6INIT=no

NAME=eth1

DEVICE=eth1

ONBOOT=yes

IPADDR=192.168.100.123

NETMASK=255.255.255.0

  

cat/etc/sysconfig/network-scripts/ifcfg-br-ex

DEVICE=br-ex

DEVICETYPE=ovs

TYPE=OVSBridge

BOOTPROTO=static

IPADDR=10.10.10.123

NETMASK=255.255.255.0

GATEWAY=10.10.10.1

DNS1=114.114.114.114

ONBOOT=yes

 

cat/etc/sysconfig/network-scripts/ifcfg-eth2

DEVICE=eth2

TYPE=OVSPort

DEVICETYPE=ovs

OVS_BRIDGE=br-ex

ONBOOT=yes

 

cat/etc/sysconfig/network-scripts/ifcfg-br-ex1

DEVICE=br-ex1

DEVICETYPE=ovs

TYPE=OVSBridge

BOOTPROTO=static

IPADDR=192.168.137.123

NETMASK=255.255.255.0

GATEWAY=192.168.137.1

DNS1=114.114.114.114

ONBOOT=yes

 

cat/etc/sysconfig/network-scripts/ifcfg-eth3

DEVICE=eth3

TYPE=OVSPort

DEVICETYPE=ovs

OVS_BRIDGE=br-ex1

ONBOOT=yes

 

在OVS上创建网桥

ovs-vsctl add-brbr-ex

ovs-vsctl add-portbr-ex eth2

ovs-vsctl add-brbr-ex1

ovs-vsctl add-portbr-ex1 eth3

systemctl restart network

 

修改neutron的配置文件

vim/etc/neutron/l3_agent.ini

[DEFAULT]

debug =False

interface_driver=neutron.agent.linux.interface.OVSInterfaceDriver

use_namespaces =True

gateway_external_network_id =

handle_internal_only_routers = True

external_network_bridge =

metadata_port =9697

send_arp_for_ha =3

periodic_interval =40

periodic_fuzzy_delay = 5

enable_metadata_proxy = True

router_delete_namespaces = False

agent_mode =legacy

 

vim/etc/neutron/plugins/ml2/ml2_conf.ini

[ml2]                                                                                                                                                                   

type_drivers =vxlan,vlan,flat

tenant_network_types = vxlan

mechanism_drivers=openvswitch

[ml2_type_flat]

flat_networks =phyExtNat,phyExtHost

[ml2_type_vlan]

network_vlan_ranges= phyExtNat,phyExtHost

[ml2_type_gre]

[ml2_type_vxlan]

vni_ranges=1:1000

vxlan_group=224.0.0.1

[securitygroup]

enable_security_group = True

 

vim/etc/neutron/plugins/openvswitch/ovs_neutron_plugin.ini

[ovs]

integration_bridge= br-int

tunnel_bridge =br-tun

local_ip=192.168.100.123

bridge_mappings =phyExtNat:br-ex,phyExtHost:br-ex1

enable_tunneling=True

[agent]

polling_interval =2

tunnel_types=vxlan

vxlan_udp_port=4789

l2_population =False

arp_responder =False

enable_distributed_routing = False

[securitygroup]

firewall_driver =neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver

 

重启neutron服务

openstack-servicerestart neutron

[root@localhost~(keystone_admin)]# ovs-vsctl show

32a17404-c314-4afd-b19e-607c4b0a43ca

   Bridge br-ex

       Port "eth2"

           Interface "eth2"

       Port br-ex

           Interface br-ex

               type: internal

       Port phy-br-ex

           Interface phy-br-ex

               type: patch

               options: {peer=int-br-ex}

   Bridge "br-ex1"

       Port "phy-br-ex1"

           Interface "phy-br-ex1"

               type: patch

               options: {peer="int-br-ex1"}

       Port "br-ex1"

           Interface "br-ex1"

               type: internal

       Port "eth3"

           Interface "eth3"

   Bridge br-int

       fail_mode: secure

       Port int-br-ex

           Interface int-br-ex

               type: patch

               options:{peer=phy-br-ex}

       Port "int-br-ex1"

           Interface "int-br-ex1"

               type: patch

               options: {peer="phy-br-ex1"}

       Port br-int

           Interface br-int

               type: internal

       Port patch-tun

           Interface patch-tun

               type: patch

               options:{peer=patch-int}

   Bridge br-tun

       fail_mode: secure

       Port patch-int

           Interface patch-int

               type: patch

               options:{peer=patch-tun}

       Port br-tun

           Interface br-tun

               type: internal

   ovs_version: "2.3.1"

 

 

创建两个External Networks

(1)Create ExternalNetwork(For NAT) 【通向internet】

neutron net-createExt-Nat --provider:network_type flat --provider:physical_network phyExtNat --router:external

neutronsubnet-create  --allocation-poolstart=10.10.10.200,end=10.10.10.252 --gateway10.10.10.1  Ext-Nat 10.10.10.0/24 --enable_dhcp=False

 

(2)Create ExternalNetwork(For Host-Only) 【通向windows宿主机】

neutron net-createExt-Host --provider:network_type flat --provider:physical_network phyExtHost --router:external

neutronsubnet-create  --allocation-poolstart=192.168.137.100,end=192.168.137.252 --gateway192.168.137.1  Ext-Host 192.168.137.0/24--enable_dhcp=False

(3)为租户创建两个路由器RA和RB，网关分别设置到Ext-Nat网络和Ext-Host网络；创建两个网络NA和NB，对应的子网分别是SA10.0.0.0/24和SB 10.1.0.0/24。

 

创建云主机，两个网卡分别为NA（10.0.0.0/24），NB(10.1.0.0/24)，并分别为它们绑定Ext-Nat和Ext-Host的两个floatingip

eth0 NA      10.0.0.12    浮动IP: 10.10.10.202

eth1  NB      10.1.0.10   浮动IP:192.168.137.102

 

[root@localhost~(keystone_admin)]# ovs-vsctl show

32a17404-c314-4afd-b19e-607c4b0a43ca

   Bridge br-ex

       Port "eth2"

           Interface "eth2"

       Port br-ex

           Interface br-ex

               type: internal

       Port phy-br-ex

           Interface phy-br-ex

               type: patch

               options: {peer=int-br-ex}

   Bridge "br-ex1"

       Port "phy-br-ex1"

           Interface "phy-br-ex1"

               type: patch

               options: {peer="int-br-ex1"}

       Port "br-ex1"

           Interface "br-ex1"

               type: internal

       Port "eth3"

           Interface "eth3"

   Bridge br-int

       fail_mode: secure

       Port "qr-2cf23ed1-3e"

           tag: 1

           Interface "qr-2cf23ed1-3e"

               type: internal

       Port "qg-baf84a70-bb"

           tag: 4

           Interface "qg-baf84a70-bb"

               type: internal

       Port "tap312521b2-71"

           tag: 1

           Interface "tap312521b2-71"

               type: internal

       Port int-br-ex

           Interface int-br-ex

               type: patch

               options: {peer=phy-br-ex}

       Port "qr-b01119c3-2a"

           tag: 3

           Interface "qr-b01119c3-2a"

               type: internal

       Port "int-br-ex1"

           Interface "int-br-ex1"

               type: patch

               options: {peer="phy-br-ex1"}

       Port br-int

           Interface br-int

               type: internal

       Port "qvo6f61d935-f4"

           tag: 1

           Interface"qvo6f61d935-f4"

       Port "qg-c268082a-af"

           tag: 2

           Interface "qg-c268082a-af"

               type: internal

       Port "tape36d2666-40"

           tag: 3

           Interface "tape36d2666-40"

               type: internal

       Port patch-tun

           Interface patch-tun

               type: patch

               options: {peer=patch-int}

       Port "qvo4206e211-1a"

           tag: 3

           Interface "qvo4206e211-1a"

   Bridge br-tun

       fail_mode: secure

       Port patch-int

           Interface patch-int

               type: patch

               options: {peer=patch-tun}

       Port br-tun

           Interface br-tun

               type: internal

ovs_version:"2.3.1"

 

[root@localhost~(keystone_admin)]# brctl show

bridgename              bridgeid                   STPenabled    interfaces

qbr4206e211-1a         8000.7acb76b4800a      no               qvb4206e211-1a

                                                                                           tap4206e211-1a

qbr6f61d935-f4          8000.8639eef37064      no                 qvb6f61d935-f4

                                                                                            tap6f61d935-f4

 

测试连通性

（1）云主机内ping外网

 （2）分别ping云主机的两个浮动IP

左边是在云主机的宿主机上ping Ext-Nat的浮动IP：10.10.10.202

右边是在windows中pingExt-Host的浮动IP：192.168.137.102