2021-11-08

OpenStack Rocky版本原生Firewall、LB、VPN部署

一、软件安装

yum install openstack-neutron-fwaas -y
neutron-db-manage --subproject neutron-fwaas upgrade head

yum install openstack-neutron-lbaas -y
neutron-db-manage --subproject neutron-lbaas upgrade head

yum install openstack-neutron-vpnaas -y
neutron-db-manage --subproject neutron-vpnaas upgrade head

二、编辑文件

[root@rocky-ctrl ~]# cat /etc/neutron/neutron.conf |grep ^[^#]
[DEFAULT]
...
service_plugins = router,firewall,neutron_lbaas.services.loadbalancer.plugin.LoadBalancerPluginv2,vpnaas
...
[service_providers]
service_provider = FIREWALL:Iptables:neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver:default
service_provider = LOADBALANCERV2:Haproxy:neutron_lbaas.drivers.haproxy.plugin_driver.HaproxyOnHostPluginDriver:default

vim /etc/openstack-dashboard/local_settings
OPENSTACK_NEUTRON_NETWORK = {
...
    'enable_firewall': True,
    'enable_lb': True,
    'enable_vpn': True,
...

[root@rocky-ctrl neutron]# cat /etc/neutron/fwaas_driver.ini |grep ^[^#]
[DEFAULT]
[fwaas]
driver = iptables
enabled = true
agent_version = v2
conntrack_driver = conntrack
[service_providers]
service_provider = FIREWALL:Iptables:neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver:default
[root@rocky-ctrl neutron]# 

[root@rocky-ctrl neutron]# cat /etc/neutron/lbaas_agent.ini |grep ^[^#]
[DEFAULT]
interface_driver = openvswitch
[haproxy]
[root@rocky-ctrl neutron]# 
[root@rocky-ctrl neutron]# cat /etc/neutron/neutron_lbaas.conf |grep ^[^#]
[DEFAULT]
[certificates]
[quotas]
[service_auth]
[service_providers]
[root@rocky-ctrl neutron]#

[root@rocky-ctrl neutron]# cat /etc/neutron/neutron_vpnaas.conf |grep ^[^#]
[DEFAULT]
[service_providers]
service_provider = VPN:openswan:neutron_vpnaas.services.vpn.service_drivers.ipsec.IPsecVPNDriver:default
[root@rocky-ctrl neutron]# 
[root@rocky-ctrl neutron]# cat /etc/neutron/vpn_agent.ini |grep ^[^#]
[DEFAULT]
[ipsec]
[pluto]
[strongswan]
[vpnagent]
[root@rocky-ctrl neutron]# 

三、安装相关dashboard软件

pip install --no-deps neutron-fwaas-dashboard-1.5.0.tar
cp /usr/lib/python2.7/site-packages/neutron_fwaas_dashboard/enabled/_70*_*.py /usr/share/openstack-dashboard/openstack_dashboard/enabled/
cd /usr/share/openstack-dashboard
./manage.py collectstatic --noinput
./manage.py compress --force 

pip install --no-deps neutron-lbaas-dashboard-5.0.0.tar.gz
cp /usr/lib/python2.7/site-packages/neutron_lbaas_dashboard/enabled/_1481_project_ng_loadbalancersv2_panel.py /usr/share/openstack-dashboard/openstack_dashboard/enabled/
cd /usr/share/openstack-dashboard
./manage.py collectstatic --noinput
./manage.py compress --force 

pip install --no-deps neutron-vpnaas-dashboard-1.4.0.tar.gz
cp /usr/lib/python2.7/site-packages/neutron_vpnaas_dashboard/enabled/ _7100_project_vpn_panel.py /usr/share/openstack-dashboard/openstack_dashboard/enabled/
cd /usr/share/openstack-dashboard
./manage.py collectstatic --noinput
./manage.py compress --force 

systemctl restart neutron-server httpd 

四、效果图