Networking service:
neutron组件:
Neutron Server(网络服务器节点):可部署在CON节点上(控制节点)
创建用户(neutron)
openstack user create --domain default --password-prompt neutron
将用户neutron关联至租户(项目service)和role上:
openstack role add --project service --user neutron admin
创建neutron服务实体:
openstack service create --name neutron --description "OpenStack Networking" network
创建neutron服务 API 端点(endpoint):
openstack endpoint create --region RegionOne network public http://con.colinshi.top:9696
openstack endpoint create --region RegionOne network internal http://con.colinshi.top:9696
openstack endpoint create --region RegionOne network admin http://con.colinshi.top:9696
安装neutron服务包:
yum install openstack-neutron openstack-neutron-ml2 openstack-neutron-linuxbridge ebtables
从以下开始neutron分为两种网络模型:
公共网络和私有网络
公共网络配置:
采用尽可能简单的架构进行部署,只支持实例连接到公有网络(外部网络)。没有私有网络(个人网络),路由器以及浮动IP地址。只有admin或者其他特权用户才可以管理公有网络
编辑配置文件/etc/neutron/neutron.conf:
[DEFAULT]
core_plugin = ml2
service_plugins =
transport_url = rabbit://rabbit:rabbit@con.colinshi.top
auth_strategy = keystone
notify_nova_on_port_status_changes = true
notify_nova_on_port_data_changes = true
[keystone_authtoken]
auth_uri = http://con.colinshi.top:5000
auth_url = http://con.colinshi.top:35357
memcached_servers = con.colinshi.top:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = neutron
password = neutron
[nova]
auth_url = http://cont.colinshi.top:35357
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = nova
password = nova
[database]
connection = mysql+pymysql://root:123456@con.colinshi.top/neutron
[oslo_concurrency]
lock_path = /var/lib/neutron/tmp
编辑Modular Layer 2 (ML2) 插件配置文件/etc/neutron/plugins/ml2/ml2_conf.ini:
[ml2]
type_drivers = flat,vlan #启用flat和VLAN网络
tenant_network_types = #禁用私有网络
mechanism_drivers = linuxbridge #启用Linuxbridge机制
extension_drivers = port_security #启用端口安全扩展驱动
[ml2_type_flat]
flat_networks = provider #配置公共虚拟网络为flat网络
[securitygroup]
enable_ipset = True #启用ipset增加安全组规则的高效性
Linuxbridge代理配置文件/etc/neutron/plugins/ml2/linuxbridge_agent.ini:
[linux_bridge]
physical_interface_mappings = provider:ens38 #将公共虚拟网络和公共物理网络接口对应起来
[vxlan]
enable_vxlan = False #禁止VXLAN覆盖网络
[securitygroup] #启用安全组并配置 Linuxbridge iptables firewall driver
enable_security_group = True
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
编辑DHCP代理配置文件/etc/neutron/dhcp_agent.ini:
[DEFAULT]
interface_driver = linuxbridge
dhcp_driver = neutron.agent.linux.dhcp.Dnsmasq
enable_isolated_metadata = True
私有网络配置(在公有网络基础上配置):
公共网络的基础上多了layer-3服务,支持实例连接到私有网络。其他没有特权的用户(租户)可以管理自己的私有网络,包含连接公网和私网的路由器。另外,浮动IP地址可以让实例使用私有网络连接到外部网络,例如互联网
编辑配置文件/etc/neutron/neutron.conf:
[DEFAULT]#路由服务和重叠的IP地址
service_plugins = router
allow_overlapping_ips = True
编辑Modular Layer 2 (ML2) 插件配置文件/etc/neutron/plugins/ml2/ml2_conf.ini:
[ml2]
type_drivers = flat,vlan,vxlan #启用flat、VLAN和VxLAN网络
tenant_network_types = vxlan #私有网络为VxLAN
mechanism_drivers = linuxbridge,l2population #启用Linuxbridge和layer-2机制
[ml2_type_vxlan]#私有网络配置VXLAN网络识别的网络范围
vni_ranges = 1:1000
Linuxbridge代理配置文件/etc/neutron/plugins/ml2/linuxbridge_agent.ini:
[vxlan]#启用VXLAN覆盖网络,配置覆盖网络的物理网络接口的IP地址,启用layer-2 population
enable_vxlan = True
local_ip = 10.0.0.51
l2_population = true
编辑layer-3代理配置文件/etc/neutron/l3_agent.ini:
[DEFAULT]
interface_driver = linuxbridge
配置元数据代理:
编辑配置文件/etc/neutron/metadata_agent.ini:
[DEFAULT]
nova_metadata_ip = con.colinshi.top #元数据主机地址,控制节点
metadata_proxy_shared_secret = metadata #元数据共享密码,自己设置一个
为计算节点配置网络服务(是在控制节点上配置)
编辑配置文件/etc/nova/nova.conf:启用元数据代理并设置密码
[neutron]
url = http://con.colinshi.top:9696
auth_url = http://con.colinshi.top:35357
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = neutron
password = neutron
service_metadata_proxy = True
metadata_proxy_shared_secret = metadata
创建软连接:
ln -s /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugin.ini
同步数据库:
su -s /bin/sh -c "neutron-db-manage --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade head" neutron
重启NOVA-API服务:
systemctl restart openstack-nova-api.service
启动Networking Server(公共网络)并设置其随系统启动:
systemctl enable neutron-server.service neutron-linuxbridge-agent.service neutron-dhcp-agent.service neutron-metadata-agent.service
systemctl start neutron-server.service neutron-linuxbridge-agent.service neutron-dhcp-agent.service neutron-metadata-agent.service
启用layer-3服务(私有网络)并设置其随系统自启动:
systemctl enable neutron-l3-agent.service
systemctl start neutron-l3-agent.service
Computer Node(计算节点):部署在计算节点上
安装neutron服务包:
yum install openstack-neutron-linuxbridge ebtables ipset
编辑配置文件/etc/neutron/neutron.conf:
[DEFAULT]
transport_url = rabbit://rabbit:rabbit@con.colinshi.top
auth_strategy = keystone
[keystone_authtoken]
auth_uri = http://con.colinshi.top:5000
auth_url = http://con.colinshi.top:35357
memcached_servers = con.colinshi.top:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = neutron
password = neutron
[oslo_concurrency]
lock_path = /var/lib/neutron/tmp
这里依然分为两种网络模型(可以直接拷贝控制节点的文件):
公共网络配置:
编辑Linuxbridge代理配置文件/etc/neutron/plugins/ml2/linuxbridge_agent.ini:
[linux_bridge]
physical_interface_mappings = provider:ens38 #将公共虚拟网络和公共物理网络接口对应起来
[vxlan]
enable_vxlan = False #禁止VXLAN覆盖网络
[securitygroup] #启用安全组并配置 Linuxbridge iptables firewall driver
enable_security_group = True
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
私有网络配置(在公有网络基础上配置和修改):
Linuxbridge代理配置文件/etc/neutron/plugins/ml2/linuxbridge_agent.ini:
[vxlan]#启用VXLAN覆盖网络,配置覆盖网络的物理网络接口的IP地址,启用layer-2 population
enable_vxlan = True
local_ip = 10.0.0.51
l2_population = true
私有网络的验证:
openstack network agent list
+--------------------------------------+--------------------+------------------------+-------------------+-------+-------+---------------------------+
| ID | Agent Type | Host | Availability Zone | Alive | State | Binary |
+--------------------------------------+--------------------+------------------------+-------------------+-------+-------+---------------------------+
| 6300fe62-d569-41b2-a75e-0071db0c9e5a | Linux bridge agent | computer1.colinshi.top | None | :-) | UP | neutron-linuxbridge-agent |
| 6a149e01-4a13-4c6d-8991-f679ded09c4a | Linux bridge agent | con.colinshi.top | None | :-) | UP | neutron-linuxbridge-agent |
| be06cf87-4e22-43c8-b482-389787c72a47 | Metadata agent | con.colinshi.top | None | :-) | UP | neutron-metadata-agent |
| cb69b3e1-9ab7-4a22-b881-623db51d16ce | L3 agent | con.colinshi.top | nova | :-) | UP | neutron-l3-agent |
| ffa8489c-022a-426b-a236-2accaeb5a7be | DHCP agent | con.colinshi.top | nova | :-) | UP | neutron-dhcp-agent |
+--------------------------------------+--------------------+------------------------+-------------------+-------+-------+---------------------------+
这个组件同上一个nova一样重要,他是Openstack整个架构中的重中之重。我这边之后所有的部署均使用的是私有网络模型。