openstack Neutron 组件 命名空间问题介绍

Neutron 组件 命名空间问题介绍

network namespace简称netns

 Linux 中，命名空间（namespace)可以被认为是隔离的拥有单独网络栈（网卡、路由转发表、iptables）的环境。
 网络名字空间经常用来隔离网络设备和服务，只有拥有同样网络名字空间的设备，才能看到彼此

[root@controller02 ~]# ip net list
qdhcp-0a388da0-4bba-4f31-8511-7580820358f6
qdhcp-c7bafb36-4c6d-4790-a1e8-53d2bda4bc35
qrouter-c6f52d30-4b50-4bc0-9d9b-5b75af654c55
qrouter-7bcd933c-ab0e-465c-9b60-1c25faeb6312
qdhcp-75fef252-8381-4ddf-8107-fcfe04837052
qdhcp-1aaca46e-29e2-4734-bc26-32dccb88c831
qdhcp-aa7e3414-d491-4431-9241-68cf5f421609
qdhcp-756e2637-b4a1-4af2-83a9-90a2602181ff
qdhcp-92e2c23e-ed31-4aca-8275-03a5078d12b1
qdhcp-347d3e07-f96d-435d-ae9f-5753968db8e9
qdhcp-3c0887dd-fa13-47cd-a788-67f73bd5b037
qdhcp-660582c8-5145-4dfd-811c-d7b8ca535fd1
qdhcp-beeec023-0c44-41ff-821a-f6a65de47297
qdhcp-1cc45e24-9f4e-496d-959d-c18a84860828
qdhcp-38931dcf-6604-45f3-b13d-6f89a0b32fb6
qdhcp-92bee597-bbdd-4bb5-b5a3-0c9035f88c9a
qdhcp-d2f7c2c7-214f-41fb-9dfe-c314c6685f3b

[root@node1 ~]#
##具体可以用ip net help 来查看使用方法

[root@ansible ~]# ip net help
Usage: ip netns list
       ip netns add NAME
       ip netns set NAME NETNSID
       ip [-all] netns delete [NAME]
       ip netns identify [PID]
       ip netns pids NAME
       ip [-all] netns exec [NAME] cmd ...
       ip netns monitor
       ip netns list-id

[root@ansible ~]#

[root@controller02 ~]# ip netns exec qdhcp-c7bafb36-4c6d-4790-a1e8-53d2bda4bc35 ip addr

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
53: tap3b0e89ea-ff: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9000 qdisc pfifo_fast state UNKNOWN qlen 1000
    link/ether fa:16:3e:e1:84:32 brd ff:ff:ff:ff:ff:ff
    inet 10.xx.x.2/24 brd 10.20.2.255 scope global tap3b0e89ea-ff
       valid_lft forever preferred_lft forever
    inet 169.254.169.254/16 brd 169.254.255.255 scope global tap3b0e89ea-ff
       valid_lft forever preferred_lft forever
    inet6 fe80::f816:3eff:fee1:8432/64 scope link
       valid_lft forever preferred_lft forever

[root@controller02 ~]#
#可以看到，dhcp服务的网络命名空间只有有一个网络接口"3b0e89ea-ff",它通过"tap3b0e89ea-ff"连接到br-int上 这个是dhcp 的port

 

路由服务

首先，要理解什么是 router，router是提供跨 subnet 的互联功能的。比如用户的内部网络中主机想要访问外部互联网的地址，
就需要router来转发（因此，所有跟外部网络的流量都必须经过router）。目前router的实现是通过iptables进行的

[root@controller02 ~]# ip net list
qdhcp-0a388da0-4bba-4f31-8511-7580820358f6
qdhcp-c7bafb36-4c6d-4790-a1e8-53d2bda4bc35
qrouter-c6f52d30-4b50-4bc0-9d9b-5b75af654c55
qrouter-7bcd933c-ab0e-465c-9b60-1c25faeb6312
qdhcp-75fef252-8381-4ddf-8107-fcfe04837052
qdhcp-1aaca46e-29e2-4734-bc26-32dccb88c831
qdhcp-aa7e3414-d491-4431-9241-68cf5f421609
qdhcp-756e2637-b4a1-4af2-83a9-90a2602181ff
qdhcp-92e2c23e-ed31-4aca-8275-03a5078d12b1
qdhcp-347d3e07-f96d-435d-ae9f-5753968db8e9
qdhcp-3c0887dd-fa13-47cd-a788-67f73bd5b037
qdhcp-660582c8-5145-4dfd-811c-d7b8ca535fd1
qdhcp-beeec023-0c44-41ff-821a-f6a65de47297
qdhcp-1cc45e24-9f4e-496d-959d-c18a84860828
qdhcp-38931dcf-6604-45f3-b13d-6f89a0b32fb6
qdhcp-92bee597-bbdd-4bb5-b5a3-0c9035f88c9a
qdhcp-d2f7c2c7-214f-41fb-9dfe-c314c6685f3b

[root@controller02 ~]# ip netns exec qrouter-c6f52d30-4b50-4bc0-9d9b-5b75af654c55 ip route
169.254.192.0/18 dev ha-327f3319-05  proto kernel  scope link  src 169.254.192.1
[root@controller02 ~]# ip netns exec qrouter-7bcd933c-ab0e-465c-9b60-1c25faeb6312 ip route
169.254.192.0/18 dev ha-b18961b1-af  proto kernel  scope link  src 169.254.192.1
[root@controller02 ~]#
 

[root@controller02 ~]# ip netns exec qrouter-7bcd933c-ab0e-465c-9b60-1c25faeb6312 ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: ingress_qos: <BROADCAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc htb state UNKNOWN qlen 32
    link/ether 12:6b:8f:c4:74:66 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::106b:8fff:fec4:7466/64 scope link
       valid_lft forever preferred_lft forever
52: ha-b18961b1-af: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9000 qdisc pfifo_fast state UNKNOWN qlen 1000
    link/ether fa:16:3e:9c:74:ba brd ff:ff:ff:ff:ff:ff
    inet 169.254.192.1/18 brd 169.254.255.255 scope global ha-b18961b1-af
       valid_lft forever preferred_lft forever
    inet6 fe80::f816:3eff:fe9c:74ba/64 scope link
       valid_lft forever preferred_lft forever
55: qg-d685e09d-9c: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9000 qdisc htb state UNKNOWN qlen 1000
    link/ether fa:16:3e:f1:13:43 brd ff:ff:ff:ff:ff:ff
[root@controller02 ~]#

#ha-b18961b1-af

[root@controller02 ~]# ip netns exec qrouter-c6f52d30-4b50-4bc0-9d9b-5b75af654c55 iptables -t nat -S

-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT
-N neutron-postrouting-bottom
-N neutron-vp-agen-OUTPUT
-N neutron-vp-agen-POSTROUTING
-N neutron-vp-agen-PREROUTING
-N neutron-vp-agen-float-snat
-N neutron-vp-agen-snat
-A PREROUTING -j neutron-vp-agen-PREROUTING
-A OUTPUT -j neutron-vp-agen-OUTPUT
-A POSTROUTING -j neutron-vp-agen-POSTROUTING
-A POSTROUTING -j neutron-postrouting-bottom
-A neutron-postrouting-bottom -m comment --comment "Perform source NAT on outgoing traffic." -j neutron-vp-agen-snat
-A neutron-vp-agen-PREROUTING -d 169.254.169.254/32 -i qr-+ -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 9697
-A neutron-vp-agen-snat -j neutron-vp-agen-float-snat

[root@controller02 ~]#