一、创建数据库neutron
1.1、创建数据库neutron,并进行授权
[root@controller ~]# mysql -uroot -p123456
MariaDB [(none)]> CREATE DATABASE neutron;
Query OK, 1 row affected (0.001 sec)
MariaDB [(none)]> GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'localhost' IDENTIFIED BY 'NEUTRON_DBPASS';
Query OK, 0 rows affected (0.001 sec)
MariaDB [(none)]> GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'%' IDENTIFIED BY 'NEUTRON_DBPASS';
Query OK, 0 rows affected (0.001 sec)
MariaDB [(none)]> flush privileges;
Query OK, 0 rows affected (0.002 sec)
MariaDB [(none)]> exit
Bye
二、neutron用户操作
2.1、创建neutron用户,用于在keystone做认证
[root@controller ~]# openstack user create --domain default --password NEUTRON_PASS neutron
+---------------------+----------------------------------+
| Field | Value |
+---------------------+----------------------------------+
| domain_id | default |
| enabled | True |
| id | 46f15738357a4730ba5e1c4678d12413 |
| name | neutron |
| options | {} |
| password_expires_at | None |
+---------------------+----------------------------------+
2.2、将neutron用户添加到service项目中拥有管理员权限
[root@controller ~]# openstack role add --project service --user neutron admin
2.3、创建network服务,服务类型为network
[root@controller ~]# openstack service create --name neutron --description "OpenStack Networking" network
+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | OpenStack Networking |
| enabled | True |
| id | b3bc02cc691143fea3b4b81eb07eb656 |
| name | neutron |
| type | network |
+-------------+----------------------------------+
2.4、注册API到neutron服务,给neutron服务关联端口,即添加endpoint
[root@controller ~]# openstack endpoint create --region RegionOne network public http://controller:9696
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | b23292d57a8745b89d7e398a50bb8088 |
| interface | public |
| region | RegionOne |
| region_id | RegionOne |
| service_id | b3bc02cc691143fea3b4b81eb07eb656 |
| service_name | neutron |
| service_type | network |
| url | http://controller:9696 |
+--------------+----------------------------------+
[root@controller ~]# openstack endpoint create --region RegionOne network internal http://controller:9696
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | 3d25ca78c48c4cbb90b566a7e30a0cdd |
| interface | internal |
| region | RegionOne |
| region_id | RegionOne |
| service_id | b3bc02cc691143fea3b4b81eb07eb656 |
| service_name | neutron |
| service_type | network |
| url | http://controller:9696 |
+--------------+----------------------------------+
[root@controller ~]# openstack endpoint create --region RegionOne network admin http://controller:9696
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | c48b8dafab93445c811921f66a8cc221 |
| interface | admin |
| region | RegionOne |
| region_id | RegionOne |
| service_id | b3bc02cc691143fea3b4b81eb07eb656 |
| service_name | neutron |
| service_type | network |
| url | http://controller:9696 |
+--------------+----------------------------------+
2.5、安装提供者网络(桥接)
ebtables包是用来管理iptables规则的
[root@controller ~]# yum -y install openstack-neutron openstack-neutron-ml2 openstack-neutron-linuxbridge ebtables conntrack-tools
2.6、 更改主配置文件
[root@controller ~]# openstack-config --set /etc/neutron/neutron.conf database connection mysql+pymysql://neutron:NEUTRON_DBPASS@controller/neutron
[root@controller ~]# openstack-config --set /etc/neutron/neutron.conf DEFAULT core_plugin ml2
[root@controller ~]# openstack-config --set /etc/neutron/neutron.conf DEFAULT service_plugins router
[root@controller ~]# openstack-config --set /etc/neutron/neutron.conf DEFAULT allow_overlapping_ips true
[root@controller ~]# openstack-config --set /etc/neutron/neutron.conf DEFAULT transport_url rabbit://openstack:RABBIT_PASS@controller
[root@controller ~]# openstack-config --set /etc/neutron/neutron.conf DEFAULT auth_strategy keystone
[root@controller ~]# openstack-config --set /etc/neutron/neutron.conf DEFAULT notify_nova_on_port_status_changes true
[root@controller ~]# openstack-config --set /etc/neutron/neutron.conf DEFAULT notify_nova_on_port_data_changes true
[root@controller ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken www_authenticate_uri http://controller:5000
[root@controller ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken auth_url http://controller:5000
[root@controller ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken memcached_servers controller:11211
[root@controller ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken auth_type password
[root@controller ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken project_domain_name default
[root@controller ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken user_domain_name default
[root@controller ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken project_name service
[root@controller ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken username neutron
[root@controller ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken password NEUTRON_PASS
[root@controller ~]# openstack-config --set /etc/neutron/neutron.conf oslo_concurrency lock_path /var/lib/neutron/tmp
[root@controller ~]# openstack-config --set /etc/neutron/neutron.conf nova auth_url http://controller:5000
[root@controller ~]# openstack-config --set /etc/neutron/neutron.conf nova auth_type password
[root@controller ~]# openstack-config --set /etc/neutron/neutron.conf nova project_domain_name default
[root@controller ~]# openstack-config --set /etc/neutron/neutron.conf nova user_domain_name default
[root@controller ~]# openstack-config --set /etc/neutron/neutron.conf nova region_name RegionOne
[root@controller ~]# openstack-config --set /etc/neutron/neutron.conf nova project_name service
[root@controller ~]# openstack-config --set /etc/neutron/neutron.conf nova username nova
[root@controller ~]# openstack-config --set /etc/neutron/neutron.conf nova password NOVA_PASS
[root@controller ~]# cat /etc/neutron/neutron.conf
[DEFAULT]
core_plugin = ml2 # 启用二层网络插件
service_plugins = router # 启用三层网络插件
allow_overlapping_ips = true
transport_url = rabbit://openstack:RABBIT_PASS@controller # 配置rabbitmq连接
auth_strategy = keystone # 认证的方式:keystone
notify_nova_on_port_status_changes = true # 当网络接口发生变化时,通知给计算节点
notify_nova_on_port_data_changes = true # 当端口数据发生变化,通知计算节点
[cors]
[database] # 配置数据库连接
connection = mysql+pymysql://neutron:NEUTRON_DBPASS@controller/neutron
[keystone_authtoken] # 配置keystone认证信息
www_authenticate_uri = http://controller:5000
auth_url = http://controller:5000
memcached_servers = controller:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = neutron
password = NEUTRON_PASS
[oslo_concurrency] # 配置锁路径
lock_path = /var/lib/neutron/tmp
[oslo_messaging_amqp]
[oslo_messaging_kafka]
[oslo_messaging_notifications]
[oslo_messaging_rabbit]
[oslo_middleware]
[oslo_policy]
[privsep]
[ssl]
[nova] # neutron需要给nova返回数据
auth_url = http://controller:5000 # 到keystone认证nova
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = nova # 通过nova的用户名和密码到keystone验证nova的token
password = NOVA_PASS
2.7、修改 ML2 plugin 配置文件 ml2_conf.ini
[root@controller ~]# cp -a /etc/neutron/plugins/ml2/ml2_conf.ini{,.bak}
[root@controller ~]# grep -Ev '^$|#' /etc/neutron/plugins/ml2/ml2_conf.ini.bak > /etc/neutron/plugins/ml2/ml2_conf.ini
[root@controller ~]# openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2 type_drivers flat,vlan,vxlan
[root@controller ~]# openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2 tenant_network_types vxlan
[root@controller ~]# openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2 mechanism_drivers linuxbridge,l2population
[root@controller ~]# openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2 extension_drivers port_security
[root@controller ~]# openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2_type_flat flat_networks provider
[root@controller ~]# openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2_type_vxlan vni_ranges 1:1000
[root@controller ~]# openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini securitygroup enable_ipset true
[root@controller ~]# cat /etc/neutron/plugins/ml2/ml2_conf.ini
[DEFAULT]
[ml2]
type_drivers = flat,vlan,vxlan # 配置驱动类型;单一扁平网络(桥接)和vlan;让二层网络支持桥接,支持基于vlan做子网划分
tenant_network_types = vxlan # 租户网络类型(vxlan)
mechanism_drivers = linuxbridge,l2population # 启用Linuxbridge和l2机制,(l2population机制是为了简化网络通信拓扑,减少网络广播)
extension_drivers = port_security # 启用端口安全扩展驱动程序,基于iptables实现访问控制;但配置了扩展安全组会导致一些端口限制,造成一些服务无法启动
[ml2_type_flat]
flat_networks = provider # 配置公共虚拟网络为flat网络
[ml2_type_vxlan]
vni_ranges = 1:1000 # 为私有网络配置VXLAN网络识别的网络范围
[securitygroup]
enable_ipset = true # 启用 ipset 增加安全组的方便性
2.8、修改 linux bridge network provider 配置文件 linuxbridge_agent.ini
[root@controller ~]# cp -a /etc/neutron/plugins/ml2/linuxbridge_agent.ini{,.bak}
[root@controller ~]# grep -Ev '^$|#' /etc/neutron/plugins/ml2/linuxbridge_agent.ini.bak > /etc/neutron/plugins/ml2/linuxbridge_agent.ini
[root@controller ~]# openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini linux_bridge physical_interface_mappings provider:eth1
[root@controller ~]# openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini vxlan enable_vxlan true
[root@controller ~]# openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini vxlan local_ip 192.168.100.11
[root@controller ~]# openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini vxlan l2_population true
[root@controller ~]# openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini securitygroup enable_security_group true
[root@controller ~]# openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini securitygroup firewall_driver neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
[root@controller ~]# cat /etc/neutron/plugins/ml2/linuxbridge_agent.ini
[DEFAULT]
[linux_bridge]
physical_interface_mappings = provider:eth1 # 指定上个文件中的桥接网络名称,与eth0物理网卡做关联,后期给虚拟机分配external网络,就可以通过eth0上外网;物理网卡有可能是bind0、br0等
[vxlan] # 启用VXLAN覆盖网络,配置覆盖网络的物理网络接口的IP地址,启用layer-2 population
enable_vxlan = true # 允许用户创建自定义网络(3层网络)
local_ip = 192.168.100.11
l2_population = true
[securitygroup]
enable_security_group = true # 启用安全组并配置 Linux 桥接 iptables 防火墙驱动
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
2.9、修改内核参数
[root@controller ~]# echo 'net.bridge.bridge-nf-call-iptables=1' >> /etc/sysctl.conf
[root@controller ~]# echo 'net.bridge.bridge-nf-call-ip6tables=1' >> /etc/sysctl.conf
[root@controller ~]# modprobe br_netfilter # 表示向内核加入参数
[root@controller ~]# sysctl -p
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
2.10、配置Linuxbridge接口驱动和外部网络网桥
[root@controller ~]# cp -a /etc/neutron/l3_agent.ini{,.bak}
[root@controller ~]# grep -Ev '^$|#' /etc/neutron/l3_agent.ini.bak > /etc/neutron/l3_agent.ini
[root@controller ~]# openstack-config --set /etc/neutron/l3_agent.ini DEFAULT interface_driver linuxbridge
[root@controller ~]# cat /etc/neutron/l3_agent.ini
[DEFAULT]
interface_driver = linuxbridge
2.11、修改dhcp_agent 配置文件
[root@controller ~]# cp -a /etc/neutron/dhcp_agent.ini{,.bak}
[root@controller ~]# grep -Ev '^$|#' /etc/neutron/dhcp_agent.ini.bak > /etc/neutron/dhcp_agent.ini
[root@controller ~]# openstack-config --set /etc/neutron/dhcp_agent.ini DEFAULT interface_driver linuxbridge
[root@controller ~]# openstack-config --set /etc/neutron/dhcp_agent.ini DEFAULT dhcp_driver neutron.agent.linux.dhcp.Dnsmasq
[root@controller ~]# openstack-config --set /etc/neutron/dhcp_agent.ini DEFAULT enable_isolated_metadata true
[root@controller ~]# cat /etc/neutron/dhcp_agent.ini
[DEFAULT]
interface_driver = linuxbridge # 指定默认接口驱动为linux网桥
dhcp_driver = neutron.agent.linux.dhcp.Dnsmasq # 指定DHCP驱动
enable_isolated_metadata = true # 开启iso元数据
2.12、配置元数据代理、用于配置桥接与自服务网络的通用配置
[root@controller ~]# cp -a /etc/neutron/metadata_agent.ini{,.bak}
[root@controller ~]# grep -Ev '^$|#' /etc/neutron/metadata_agent.ini.bak > /etc/neutron/metadata_agent.ini
[root@controller ~]# openstack-config --set /etc/neutron/metadata_agent.ini DEFAULT nova_metadata_host controller
[root@controller ~]# openstack-config --set /etc/neutron/metadata_agent.ini DEFAULT metadata_proxy_shared_secret METADATA_SECRET
[root@controller ~]# cat /etc/neutron/metadata_agent.ini
[DEFAULT]
nova_metadata_host = controller
metadata_proxy_shared_secret = METADATA_SECRET
[cache]
2.13、修改nova配置文件,用于neutron交互
[root@controller ~]# openstack-config --set /etc/nova/nova.conf neutron url http://controller:9696
[root@controller ~]# openstack-config --set /etc/nova/nova.conf neutron auth_url http://controller:5000
[root@controller ~]# openstack-config --set /etc/nova/nova.conf neutron auth_type password
[root@controller ~]# openstack-config --set /etc/nova/nova.conf neutron project_domain_name default
[root@controller ~]# openstack-config --set /etc/nova/nova.conf neutron user_domain_name default
[root@controller ~]# openstack-config --set /etc/nova/nova.conf neutron region_name RegionOne
[root@controller ~]# openstack-config --set /etc/nova/nova.conf neutron project_name service
[root@controller ~]# openstack-config --set /etc/nova/nova.conf neutron username neutron
[root@controller ~]# openstack-config --set /etc/nova/nova.conf neutron password NEUTRON_PASS
[root@controller ~]# openstack-config --set /etc/nova/nova.conf neutron service_metadata_proxy true
[root@controller ~]# openstack-config --set /etc/nova/nova.conf neutron metadata_proxy_shared_secret METADATA_SECRET
2.14、创建ML2插件文件符号连接
网络服务初始化脚本需要/etc/neutron/plugin.ini指向ML2插件配置文件的符号链接
[root@controller ~]# ln -s /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugin.ini
2.15、初始化数据库
[root@controller ~]# su -s /bin/sh -c "neutron-db-manage --config-file /etc/neutron/neutron.conf \
--config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade head" neutron
2.16、重启计算节点nova-api服务
[root@controller ~]# systemctl restart openstack-nova-api.service
2.17、开启neutron服务、设置开机自启动
[root@controller ~]# systemctl restart openstack-nova-api.service
[root@controller ~]# systemctl enable neutron-server.service \
> neutron-linuxbridge-agent.service neutron-dhcp-agent.service \
> neutron-metadata-agent.service
[root@controller ~]# systemctl start neutron-server.service \
> neutron-linuxbridge-agent.service neutron-dhcp-agent.service \
> neutron-metadata-agent.service
[root@controller ~]# netstat -anutp |grep 9696
tcp 0 0 0.0.0.0:9696 0.0.0.0:* LISTEN 55374/server.log
2.18、因为配置了第三层L3网络服务、所以需要启动第三层服务
[root@controller ~]# systemctl enable neutron-l3-agent.service
[root@controller ~]# systemctl restart neutron-l3-agent.service
三、compute01 节点操作
3.1、安装软件
[root@compute01 ~]# yum -y install openstack-neutron-linuxbridge ebtables ipset conntrack-tools # ipset:iptables的扩展,允许匹配规则的集合而不仅仅是一个IP
3.2、修改neutron.conf文件
[root@compute01 ~]# cp -a /etc/neutron/neutron.conf{,.bak}
[root@compute01 ~]# grep -Ev '^$|#' /etc/neutron/neutron.conf.bak > /etc/neutron/neutron.conf
[root@compute01 ~]# openstack-config --set /etc/neutron/neutron.conf DEFAULT transport_url rabbit://openstack:RABBIT_PASS@controller
[root@compute01 ~]# openstack-config --set /etc/neutron/neutron.conf DEFAULT auth_strategy keystone
[root@compute01 ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken www_authenticate_uri http://controller:5000
[root@compute01 ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken auth_url http://controller:5000
[root@compute01 ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken memcached_servers controller:11211
[root@compute01 ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken auth_type password
[root@compute01 ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken project_domain_name default
[root@compute01 ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken user_domain_name default
[root@compute01 ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken project_name service
[root@compute01 ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken username neutron
[root@compute01 ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken password NEUTRON_PASS
[root@compute01 ~]# openstack-config --set /etc/neutron/neutron.conf oslo_concurrency lock_path /var/lib/neutron/tmp
[root@compute01 ~]# cat /etc/neutron/neutron.conf
[DEFAULT] # neutron的server端与agent端通讯也是通过rabbitmq进行通讯的
transport_url = rabbit://openstack:RABBIT_PASS@controller
auth_strategy = keystone # 认证策略:keystone
[cors]
[database]
[keystone_authtoken] # 指定keystone认证的信息
www_authenticate_uri = http://controller:5000
auth_url = http://controller:5000
memcached_servers = controller:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = neutron
password = NEUTRON_PASS
[oslo_concurrency] # 配置锁路径(管理线程库)
lock_path = /var/lib/neutron/tmp
[oslo_messaging_amqp]
[oslo_messaging_kafka]
[oslo_messaging_notifications]
[oslo_messaging_rabbit]
[oslo_middleware]
[oslo_policy]
[privsep]
[ssl]
3.3、配置Linux网桥代理
[root@compute01 ~]# cp -a /etc/neutron/plugins/ml2/linuxbridge_agent.ini{,.bak}
[root@compute01 ~]# grep -Ev '^$|#' /etc/neutron/plugins/ml2/linuxbridge_agent.ini.bak > /etc/neutron/plugins/ml2/linuxbridge_agent.ini
[root@compute01 ~]# openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini linux_bridge physical_interface_mappings provider:eth1
[root@compute01 ~]# openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini vxlan enable_vxlan true
[root@compute01 ~]# openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini vxlan local_ip 192.168.100.12
[root@compute01 ~]# openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini vxlan l2_population true
[root@compute01 ~]# openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini securitygroup enable_security_group true
[root@compute01 ~]# openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini securitygroup firewall_driver neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
[root@compute01 ~]# cat /etc/neutron/plugins/ml2/linuxbridge_agent.ini
[DEFAULT]
[linux_bridge]
physical_interface_mappings = provider:eth1
● 直接将node节点external网络绑定在当前节点的指定的物理网卡,不需要node节点配置网络名称,node节点只需要接收controller节点指令即可;
controller节点上配置的external网络名称是针对整个openstack环境生效的,所以指定external网络绑定在当前node节点的eth0物理网卡上(也可能是bind0或br0)
[vxlan] # 开启Vxlan网络
enable_vxlan = true
local_ip = 192.168.100.12
l2_population = true # L2 Population 是用来提高 VXLAN 网络扩展能力的组件
[securitygroup]
enable_security_group = true # 开启安全组
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver # 指定安全组驱动文件
3.4、修改内核
[root@compute01 ~]# echo 'net.bridge.bridge-nf-call-iptables=1' >> /etc/sysctl.conf # 允许虚拟机的数据通过物理机出去
[root@compute01 ~]# echo 'net.bridge.bridge-nf-call-ip6tables=1' >> /etc/sysctl.conf
[root@compute01 ~]# modprobe br_netfilter # modprobe:用于向内核中加载模块或者从内核中移除模块。modprobe -r 表示移除
[root@compute01 ~]# sysctl -p
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
3.5、修改nova.conf配置文件
[root@compute01 ~]# openstack-config --set /etc/nova/nova.conf neutron auth_url http://controller:5000
[root@compute01 ~]# openstack-config --set /etc/nova/nova.conf neutron auth_type password
[root@compute01 ~]# openstack-config --set /etc/nova/nova.conf neutron project_domain_name default
[root@compute01 ~]# openstack-config --set /etc/nova/nova.conf neutron user_domain_name default
[root@compute01 ~]# openstack-config --set /etc/nova/nova.conf neutron region_name RegionOne
[root@compute01 ~]# openstack-config --set /etc/nova/nova.conf neutron project_name service
[root@compute01 ~]# openstack-config --set /etc/nova/nova.conf neutron username neutron
[root@compute01 ~]# openstack-config --set /etc/nova/nova.conf neutron password NEUTRON_PASS
[root@compute01 ~]# cat /etc/nova/nova.conf
部分
[neutron]
auth_url = http://controller:5000
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = neutron
password = NEUTRON_PASS
3.6、compute02节点部署neutron服务(与compute01节点相同)
验证服务组件【controller节点】
[root@controller ~]# openstack extension list --network
+----------------------------------------------------------------------------------------------------------------------------------------------------------------+---------------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------+
| Name | Alias | Description |
+----------------------------------------------------------------------------------------------------------------------------------------------------------------+---------------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------+
| Subnet Pool Prefix Operations | subnetpool-prefix-ops | Provides support for adjusting the prefix list of subnet pools |
| Default Subnetpools | default-subnetpools | Provides ability to mark and use a subnetpool as the default. |
| Availability Zone | availability_zone | The availability zone extension. |
| Network Availability Zone | network_availability_zone | Availability zone support for network. |
| Subnet Onboard | subnet_onboard | Provides support for onboarding subnets into subnet pools |
| Auto Allocated Topology Services | auto-allocated-topology | Auto Allocated Topology Services. |
| Neutron L3 Configurable external gateway mode | ext-gw-mode | Extension of the router abstraction for specifying whether SNAT should occur on the external gateway |
| Port Binding | binding | Expose port bindings of a virtual port to external application |
| agent | agent | The agent management extension. |
| Subnet Allocation | subnet_allocation | Enables allocation of subnets from a subnet pool |
| DHCP Agent Scheduler | dhcp_agent_scheduler | Schedule networks among dhcp agents |
| Neutron external network | external-net | Adds external network attribute to network resource. |
| Empty String Filtering Extension | empty-string-filtering | Allow filtering by attributes with empty string value |
| Tag support for resources with standard attribute: subnet, trunk, network_segment_range, router, network, policy, subnetpool, port, security_group, floatingip | standard-attr-tag | Enables to set tag on resources with standard attribute. |
| Neutron Service Flavors | flavors | Flavor specification for Neutron advanced services. |
| Network MTU | net-mtu | Provides MTU attribute for a network resource. |
| Network IP Availability | network-ip-availability | Provides IP availability data for each network and subnet. |
| Quota management support | quotas | Expose functions for quotas management per tenant |
| If-Match constraints based on revision_number | revision-if-match | Extension indicating that If-Match based on revision_number is supported. |
| Prevent L3 router ports IP address change extension | l3-port-ip-change-not-allowed | Prevent change of IP address for some L3 router ports |
| Availability Zone Filter Extension | availability_zone_filter | Add filter parameters to AvailabilityZone resource |
| HA Router extension | l3-ha | Adds HA capability to routers. |
| Enforce Router's Admin State Down Before Update Extension | router-admin-state-down-before-update | Ensure that the admin state of a router is down (admin_state_up=False) before updating the distributed attribute |
| Filter parameters validation | filter-validation | Provides validation on filter parameters. |
| Multi Provider Network | multi-provider | Expose mapping of virtual networks to multiple physical networks |
| Quota details management support | quota_details | Expose functions for quotas usage statistics per project |
| Address scope | address-scope | Address scopes extension. |
| Neutron Extra Route | extraroute | Extra routes configuration for L3 router |
| Network MTU (writable) | net-mtu-writable | Provides a writable MTU attribute for a network resource. |
| Agent's Resource View Synced to Placement | agent-resources-synced | Stores success/failure of last sync to Placement |
| Subnet service types | subnet-service-types | Provides ability to set the subnet service_types field |
| Floating IP Pools Extension | floatingip-pools | Provides a floating IP pools API. |
| Neutron Port MAC address regenerate | port-mac-address-regenerate | Network port MAC address regenerate |
| Add security_group type to network RBAC | rbac-security-groups | Add security_group type to network RBAC |
| Provider Network | provider | Expose mapping of virtual networks to physical networks |
| Neutron Service Type Management | service-type | API for retrieving service providers for Neutron advanced services |
| Router Flavor Extension | l3-flavors | Flavor support for routers. |
| Port Security | port-security | Provides port security |
| Neutron Extra DHCP options | extra_dhcp_opt | Extra options configuration for DHCP. For example PXE boot options to DHCP clients can be specified (e.g. tftp-server, server-ip-address, bootfile-name) |
| Port filtering on security groups | port-security-groups-filtering | Provides security groups filtering when listing ports |
| Resource timestamps | standard-attr-timestamp | Adds created_at and updated_at fields to all Neutron resources that have Neutron standard attributes. |
| Resource revision numbers | standard-attr-revisions | This extension will display the revision number of neutron resources. |
| Pagination support | pagination | Extension that indicates that pagination is enabled. |
| Sorting support | sorting | Extension that indicates that sorting is enabled. |
| security-group | security-group | The security groups extension. |
| L3 Agent Scheduler | l3_agent_scheduler | Schedule routers among l3 agents |
| Floating IP Port Details Extension | fip-port-details | Add port_details attribute to Floating IP resource |
| Router Availability Zone | router_availability_zone | Availability zone support for router. |
| RBAC Policies | rbac-policies | Allows creation and modification of policies that control tenant access to resources. |
| Atomically add/remove extra routes | extraroute-atomic | Edit extra routes of a router on server side by atomically adding/removing extra routes |
| standard-attr-description | standard-attr-description | Extension to add descriptions to standard attributes |
| IP address substring filtering | ip-substring-filtering | Provides IP address substring filtering when listing ports |
| Neutron L3 Router | router | Router abstraction for basic L3 forwarding between L2 Neutron networks and access to external networks via a NAT gateway. |
| Allowed Address Pairs | allowed-address-pairs | Provides allowed address pairs |
| Port Bindings Extended | binding-extended | Expose port bindings of a virtual port to external application |
| project_id field enabled | project-id | Extension that indicates that project_id field is enabled. |
| Distributed Virtual Router | dvr | Enables configuration of Distributed Virtual Routers. |
+----------------------------------------------------------------------------------------------------------------------------------------------------------------+---------------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------+
[root@controller ~]# openstack network agent list
+--------------------------------------+--------------------+------------+-------------------+-------+-------+---------------------------+
| ID | Agent Type | Host | Availability Zone | Alive | State | Binary |
+--------------------------------------+--------------------+------------+-------------------+-------+-------+---------------------------+
| 0e81ad37-1cc5-4309-a5f3-6063ebc59c2d | L3 agent | controller | nova | :-) | UP | neutron-l3-agent |
| 2575a12c-bcc9-4b27-bab5-383369f22908 | Metadata agent | controller | None | :-) | UP | neutron-metadata-agent |
| 93ad39cc-b85b-4718-8d02-c6d288e90e7a | Linux bridge agent | controller | None | :-) | UP | neutron-linuxbridge-agent |
| d6a445bc-6d91-44a8-9e74-632a75a0e398 | DHCP agent | controller | nova | :-) | UP | neutron-dhcp-agent |
+--------------------------------------+--------------------+------------+-------------------+-------+-------+---------------------------+
小结
三个节点都需要配置neutron网络,以下为部署思路:配置neutron组件的用户、认证、endpoint设置提供者provider网络(这里是桥接模式)
① 配置二层网络
② 配置网桥(插件)
③ 优化内核
④ 配置网桥接口与外部对接
⑤ 修改DHCP配置(修改配置文件、代理)
⑥ 配置网桥与内部组件的配置(修改配置文件、代理)
设置neutron与nova对接的配置
其中compute01、compute02节点配置相同