7.1 Neutorn說明(略)
不廢話了
7.2 部署Neutorn(Crontroller節(jié)點)
在 controller節(jié)點部署；
7.2.1 創(chuàng)建Neutron數(shù)據(jù)庫
CREATE DATABASE neutron;
GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'localhost' IDENTIFIED BY 'neutron';
GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'%' IDENTIFIED BY 'neutron';
FLUSH PRIVILEGES;
7.2.2 創(chuàng)建Neutron用戶
source admin-openrc
創(chuàng)建
neutron用戶
openstack user create --domain default --password-prompt neutron
User Password:neutron
Repeat User Password:neutron
+---------------------+----------------------------------+
| Field | Value |
+---------------------+----------------------------------+
| domain_id | default |
| enabled | True |
| id | b5fb09e2e84a43308a860fb732d72c84 |
| name | neutron |
| options | {} |
| password_expires_at | None |
+---------------------+----------------------------------+
給
neutron用戶分配admin角色，并加入到service項目
openstack role add --project service --user neutron admin
創(chuàng)建
neutron服務
openstack service create --name neutron --description "OpenStack Networking" network
+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | OpenStack Networking |
| enabled | True |
| id | 0f45506dab5c4917a7678bd57d997483 |
| name | neutron |
| type | network |
+-------------+----------------------------------+
創(chuàng)建
neutronAPI 端點
openstack endpoint create --region RegionOne network public http://controller:9696
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | 5c3908dc3b1a40008b5f395e6542699d |
| interface | public |
| region | RegionOne |
| region_id | RegionOne |
| service_id | 0f45506dab5c4917a7678bd57d997483 |
| service_name | neutron |
| service_type | network |
| url | http://controller:9696 |
+--------------+----------------------------------+
openstack endpoint create --region RegionOne network internal http://controller:9696
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | e432464cd5614537a98223b2b369746e |
| interface | internal |
| region | RegionOne |
| region_id | RegionOne |
| service_id | 0f45506dab5c4917a7678bd57d997483 |
| service_name | neutron |
| service_type | network |
| url | http://controller:9696 |
+--------------+----------------------------------+
openstack endpoint create --region RegionOne network admin http://controller:9696
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | a3ed7b3e88ad41f8b75b2bcb43c31ae7 |
| interface | admin |
| region | RegionOne |
| region_id | RegionOne |
| service_id | 0f45506dab5c4917a7678bd57d997483 |
| service_name | neutron |
| service_type | network |
| url | http://controller:9696 |
+--------------+----------------------------------+
7.2.3 安裝配置Neutron
Neutron 有兩種網(wǎng)絡選項：
- 公共網(wǎng)絡：簡單答捕，但是只支持實例連接到公有網(wǎng)絡(外部網(wǎng)絡)广恢；沒有私有網(wǎng)絡（個人網(wǎng)絡）实胸，路由器以及浮動IP地址叙甸；只有
admin或者其他特權用戶才可以管理公有網(wǎng)絡史翘； - 私有網(wǎng)絡：在
公共網(wǎng)絡的基礎上多了layer－3服務枉长，支持實例連接到私有網(wǎng)絡。demo或者其他沒有特權的用戶可以管理自己的私有網(wǎng)絡琼讽，包含連接公網(wǎng)和私網(wǎng)的路由器必峰；另外，浮動IP地址可以讓實例使用私有網(wǎng)絡連接到外部網(wǎng)絡钻蹬；
這里使用 共有網(wǎng)絡吼蚁；
私有網(wǎng)絡配置失敗，起來后DashBoard各種報錯；先弄公有的跑通再說肝匆；
# 安裝 Neutron
yum install openstack-neutron openstack-neutron-ml2 openstack-neutron-linuxbridge ebtables
# 配置Neutron
vim /etc/neutron/neutron.conf
數(shù)據(jù)庫配置
[database]
connection = mysql+pymysql://neutron:neutron@controller.alec.com/neutron
配置
the Modular Layer 2 (ML2) plug-inrouter service缺省
[DEFAULT]
core_plugin = ml2
service_plugins =
配置RabbitMQ消息隊列
[DEFAULT]
transport_url = rabbit://alec:alec@controller
# 用戶 密碼
配置認證服務訪問
[DEFAULT]
auth_strategy = keystone
[keystone_authtoken]
www_authenticate_uri = http://controller:5000
auth_url = http://controller:5000
memcached_servers = controller:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = neutron
password = neutron
配置網(wǎng)絡服務通知計算節(jié)點的網(wǎng)絡拓撲變化
[DEFAULT]
notify_nova_on_port_status_changes = true
notify_nova_on_port_data_changes = true
[nova]
auth_url = http://controller:5000
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = nova
password = nova
配置鎖路徑
[oslo_concurrency]
lock_path = /var/lib/neutron/tmp
7.2.4 配置 Modular Layer 2 (ML2) 插件
vim /etc/neutron/plugins/ml2/ml2_conf.ini
啟用flat粒蜈，VLAN
配置完ML2插件后，移除type_drivers項旗国，否則會導致數(shù)據(jù)庫不一致
[ml2]
type_drivers = flat,vlan
禁用私有網(wǎng)絡
[ml2]
tenant_network_types =
啟用Linuxbridge
[ml2]
mechanism_drivers = linuxbridge
啟用端口安全擴展驅動
[ml2]
extension_drivers = port_security
配置公共虛擬網(wǎng)絡為flat網(wǎng)絡
[ml2_type_flat]
flat_networks = provider
啟用 ipset 增加安全組規(guī)則的高效性
[securitygroup]
enable_ipset = true
7.2.5 配置Linuxbridge代理
vim /etc/neutron/plugins/ml2/linuxbridge_agent.ini
將公共虛擬網(wǎng)絡和公共物理網(wǎng)絡接口對應起來
# 只有一塊網(wǎng)卡枯怖，直接用就好；
[linux_bridge]
physical_interface_mappings = provider:ens33
禁用VXLAN覆蓋網(wǎng)絡
[vxlan]
enable_vxlan = false
啟用安全組并配置 Linuxbridge iptables firewall driver
[securitygroup]
enable_security_group = true
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
配置網(wǎng)絡參數(shù)
# 加載br_netfilter模塊
depmod
modprobe br_netfilter
lsmod | grep br_netfilter
br_netfilter 22256 0
bridge 151336 1 br_netfilter
sysctl -w net.bridge.bridge-nf-call-iptables=1
sysctl -w net.bridge.bridge-nf-call-ip6tables=1
7.2.6 配置DHCP代理
vim /etc/neutron/dhcp_agent.ini
配置Linuxbridge驅動接口能曾，DHCP驅動并啟用隔離元數(shù)據(jù)度硝，這樣在公共網(wǎng)絡上的實例就可以通過網(wǎng)絡來訪問元數(shù)據(jù)
[DEFAULT]
interface_driver = linuxbridge
dhcp_driver = neutron.agent.linux.dhcp.Dnsmasq
enable_isolated_metadata = true
7.2.7 配置元數(shù)據(jù)代理
vim /etc/neutron/metadata_agent.ini
配置元數(shù)據(jù)主機以及共享密碼
# 共享密碼使用默認的就行，和nova里的配置保持一致就好寿冕；
[DEFAULT]
nova_metadata_host = controller
metadata_proxy_shared_secret = METADATA_SECRET
7.2.9 配置Nova使用Neutron
vim /etc/nova/nova.conf
auth_url = http://controller:5000
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = neutron
password = neutron
service_metadata_proxy = true
metadata_proxy_shared_secret = METADATA_SECRET
7.2.10 啟動服務
網(wǎng)絡服務初始化腳本需要一個超鏈接
/etc/neutron/plugin.ini指向ML2插件配置文件/etc/neutron/plugins/ml2/ml2_conf.ini蕊程。如果超鏈接不存在，使用下面的命令創(chuàng)建它
ln -sv /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugin.ini
同步數(shù)據(jù)庫
su -s /bin/sh -c "neutron-db-manage --config-file /etc/neutron/neutron.conf \
--config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade head" neutron
重啟nova服務
systemctl restart openstack-nova-api.service
啟動服務
systemctl start neutron-server neutron-linuxbridge-agent neutron-dhcp-agent neutron-metadata-agent
systemctl enable neutron-server neutron-linuxbridge-agent neutron-dhcp-agent neutron-metadata-agent
7.3 部署Neutorn(Compute節(jié)點)
7.3.1 安裝配置neutron
# 安裝配置 Neutron
yum install openstack-neutron-linuxbridge ebtables ipset
# 配置 Neutron
vim /etc/neutron/neutron.conf
配置rabbitmq
[DEFAULT]
transport_url = rabbit://alec:alec@controller
配置認證服務訪問
[DEFAULT]
auth_strategy = keystone
[keystone_authtoken]
www_authenticate_uri = http://controller:5000
auth_url = http://controller:5000
memcached_servers = controller:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = neutron
password = neutron
配置鎖路徑
[oslo_concurrency]
lock_path = /var/lib/neutron/tmp
7.3.2 配置Linuxbridge代理
vim /etc/neutron/plugins/ml2/linuxbridge_agent.ini
將公共虛擬網(wǎng)絡和公共物理網(wǎng)絡接口對應起來
# 只有一塊網(wǎng)卡蚂斤，直接用就好
[linux_bridge]
physical_interface_mappings = provider:ens33
禁用VXLAN覆蓋網(wǎng)絡
[vxlan]
enable_vxlan = False
啟用安全組并配置 Linuxbridge iptables firewall driver
[securitygroup]
enable_security_group = True
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
配置網(wǎng)絡參數(shù)
# 加載br_netfilter模塊
depmod
modprobe br_netfilter
lsmod | grep br_netfilter
br_netfilter 22256 0
bridge 151336 1 br_netfilter
sysctl -w net.bridge.bridge-nf-call-iptables=1
sysctl -w net.bridge.bridge-nf-call-ip6tables=1
3.7.3 配置Nova使用Neutron
vim /etc/nova/nova.conf
auth_url = http://controller:5000
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = neutron
password = neutron
3.7.5 啟動服務
重啟nova服務
systemctl restart openstack-nova-compute.service
啟動Linux bridge agent
systemctl enable neutron-linuxbridge-agent.service
systemctl start neutron-linuxbridge-agent.service
7.4 檢查服務狀態(tài)
openstack network agent list
+--------------------------------------+--------------------+------------+-------------------+-------+-------+---------------------------+
| ID | Agent Type | Host | Availability Zone | Alive | State | Binary |
+--------------------------------------+--------------------+------------+-------------------+-------+-------+---------------------------+
| 0947fd08-bc7d-4735-bd84-40a058e4fb3a | Linux bridge agent | controller | None | :-) | UP | neutron-linuxbridge-agent |
| b21a5f68-f293-4562-a3d3-920043da63c1 | Metadata agent | controller | None | :-) | UP | neutron-metadata-agent |
| e0cb00ff-df6d-44aa-8136-36b9afaf2c8f | DHCP agent | controller | nova | :-) | UP | neutron-dhcp-agent |
| f29dfff9-fed0-406f-b287-c74932f0fc8e | Linux bridge agent | compute | None | :-) | UP | neutron-linuxbridge-agent |
+--------------------------------------+--------------------+------------+-------------------+-------+-------+---------------------------+
