OpenStack Rocky 版本部署之五——neutron部署

1、向ketstone注册服务

（1）创建neutron网络服务目录:

# openstack service create --name neutron \

--description "OpenStack Networking" network

 

（2）创建网络服务API访问点

# openstack endpoint create --region RegionOne \

network public http://controller:9696

 

# openstack endpoint create --region RegionOne \

network internal http://controller:9696

 

# openstack endpoint create --region RegionOne \

network admin http://controller:9696

 

2、修改neutron配置文件

（1）编辑/etc/neutron/neutron.conf

[database]

connection = mysql+pymysql://neutron:neutron@controller/neutron

 [DEFAULT]

transport_url = rabbit://openstack:openstack@controller

auth_strategy = keystone

#开启nova访问，通过nova访问虚拟机

notify_nova_on_port_status_changes = true

notify_nova_on_port_data_changes = true

[keystone_authtoken]

www_authenticate_uri = http://controller:5000

auth_url = http://controller:5000

memcached_servers = controller:11211

auth_type = password

project_domain_name = default

user_domain_name = default

project_name = service

username = neutron

password = neutron

[nova]

auth_url = http://controller:5000

auth_type = password

project_domain_name = default

user_domain_name = default

region_name = RegionOne

project_name = service

username = nova

password = nova

# 设置neutron运行文件位置:

[oslo_concurrency]

lock_path = /var/lib/neutron/tmp

（2）编辑 /etc/neutron/plugins/ml2/ml2_conf.ini

#配置二层协议

[ml2]

type_drivers = flat,vlan

tenant_network_types =

mechanism_drivers = linuxbridge

#开启端口安全管理

extension_drivers = port_security

#设置flat网络名称:

[ml2_type_flat]

flat_networks = public

#开启安全组规则管理

[securitygroup]

enable_ipset = true

（3）编辑 /etc/neutron/plugins/ml2/linuxbridge_agent.ini

[linux_bridge]

physical_interface_mappings = public:ens33

#关闭vxlan:

[vxlan]

enable_vxlan = false

#开启安全组规则功能

[securitygroup]

enable_security_group = true

firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver

（4）配置sysctl.conf，将数据链路层的策略上升到网络层

net.bridge.bridge-nf-call-iptables = 1

net.bridge.bridge-nf-call-ip6tables = 1

（5）配置/etc/neutron/dhcp_agent.ini

#DHCP功能管理

[DEFAULT]

interface_driver = linuxbridge

dhcp_driver = neutron.agent.linux.dhcp.Dnsmasq

enable_isolated_metadata = true

#配置网络服务元数据管理模块/etc/neutron/metadata_agent.ini

[DEFAULT]

nova_metadata_host = controller

metadata_proxy_shared_secret = directsoft

（6）配置/etc/nova/nova.conf连接neutron

[neutron]

url = http://controller:9696

auth_url = http://controller:5000

auth_type = password

project_domain_name = default

user_domain_name = default

region_name = RegionOne

project_name = service

username = neutron

password = neutron

service_metadata_proxy = true

metadata_proxy_shared_secret = directsoft

# ml2的配置文件需要放到neutron的主配置文件目录下

# ln -s /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugin.ini

3、同步数据库数据

# su -s /bin/sh -c "neutron-db-manage --config-file /etc/neutron/neutron.conf \

--config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade head" neutron

 

（1）重启nova服务

# systemctl restart openstack-nova-api.service

4、启动并设置开机自启

# systemctl enable neutron-server.service \

neutron-linuxbridge-agent.service neutron-dhcp-agent.service \

neutron-metadata-agent.service

# systemctl start neutron-server.service \

neutron-linuxbridge-agent.service neutron-dhcp-agent.service \

neutron-metadata-agent.service

5、验证查看列表

# openstack network agent list

 

发现有不是3个带笑脸服务，到/var/log/neutron下查看相应日志。

5、创建网络 network

# openstack network create --share \

--provider-physical-network public \

--provider-network-type flat pub

 

注解：

--share        #指定网络为共享网络

--external   #指定网络为外部网络

--internal   #指定网络为内部网络

--provider-physical-network 网络名称  #指定配置文件中设置网络名称

--provider-network-type flat   #网络类型为flat

对应以下配置项

ml2_conf.ini

[ml2_type_flat]

flat_networks = public

linuxbridge_agent.ini:

[linux_bridge]

physical_interface_mappings = public:ens33

# 创建子网

# openstack subnet create --network pub \

--allocation-pool start=192.168.44.100,end=192.168.44.150 \

--dns-nameserver 192.168.44.2 --gateway 192.168.44.2 \

--subnet-range 192.168.44.0/24 pub-subnet

 

6、验证添加安全组策略

（1）开启ICMP协议访问

# openstack security group rule create --proto icmp default

 

（2）开放ssh服务

# openstack security group rule create --proto tcp --dst-port 22 default

（3）查看安全组策略