Neutron相关介绍
早期的时候是没有neutron，早期所使用的网络的nova-network，经过版本改变才有个neutron。
quantum是因为商标和别的公司重名了，又改成的Neutron
OpenStack Networking
网络：在实际的物理环境下，我们使用交换机或者集线器把多个计算机连接起来形成了网络。在Neutron的世界里，网络也是将多个不同的云主机连接起来。
子网：在实际的物理环境下，在一个网络中。我们可以将网络划分成多为逻辑子网。在Neutron的世界里，子网也是隶属于网络下的。
端口：在实际的物理环境下，每个子网或者网络，都有很多的端口，比如交换机端口来供计算机连接。在Neutron的世界端口也是隶属于子网下，云主机的网卡会对应到一个端口上。
路由器：在实际的网络环境下，不同网络或者不同逻辑子网之间如果需要进行通信，需要通过路由器进行路由。在Neutron的实际里路由也是这个作用。用来连接不同的网络或者子网。
Neutron相关组件
不管是linux bridge 还是ovs，都要连接数据库，连接数据库的代码都是一样的。
就这样搞了个ML2， 在ML2下面才是linux bridge和ovs，linux bridge和ovs都是开源的
其它商业插件，ML2也支持
dhcp agent是分配ip地址的
L3-agent 是做3层网络的，路由的
LBAAS 是负载均衡的
宿主机和虚拟机在一个网络，叫单一扁平网络，在官方文档里叫提供者网络。比如下图
单一平面网络的缺点：
存在单一网络瓶颈，缺乏可伸缩性。
缺乏合适的多租户隔离。
网络介绍
配置网络选项，分公共网络和私有网络
部署网络服务使用公共网络和私有网络两种架构中的一种来部署网络服务。
公共网络：采用尽可能简单的架构进行部署，只支持实例连接到公有网络（外部网络）。没有私有网络（个人网络），路由器以及浮动IP地址。
只有admin或者其他特权用户才可以管理公有网络。
私有网络：在公共网络的基础上多了layer3服务，支持实例连接到私有网络
本次实验使用公共网络
控制节点安装配置Neutron
1、 控制节点安装组件
[root@linux-node1 ~]# yum install openstack-neutron openstack-neutron-ml2 openstack-neutron-linuxbridge ebtables Loaded plugins: fastestmirror Loading mirror speeds from cached hostfile * base: mirrors.163.com * epel: mirror01.idc.hinet.net * extras: mirrors.163.com * updates: mirrors.163.com Package 1:openstack-neutron-8.3.0-1.el7.noarch already installed and latest version Package 1:openstack-neutron-ml2-8.3.0-1.el7.noarch already installed and latest version Package 1:openstack-neutron-linuxbridge-8.3.0-1.el7.noarch already installed and latest version Package ebtables-2.0.10-15.el7.x86_64 already installed and latest version Nothing to do [root@linux-node1 ~]#
2、控制节点配置部分---数据库
编辑/etc/neutron/neutron.conf 文件并完成如下操作：
在 [database] 部分，配置数据库访问：
[database] ... connection = mysql+pymysql://neutron:neutron@192.168.56.11/neutron
neutron改完数据库连接配置之后，并不需要立即同步数据库，还需要继续配置
3、控制节点配置部分---keystone
在[DEFAULT]和[keystone_authtoken]部分，配置认证服务访问：
[DEFAULT] ... auth_strategy = keystone
[keystone_authtoken]模块配置
加入下面参数
auth_uri = http://192.168.56.11:5000 auth_url = http://192.168.56.11:35357 memcached_servers = 192.168.56.11:11211 auth_type = password project_domain_name = default user_domain_name = default project_name = service username = neutron password = neutron
4、控制节点配置部分---RabbitMQ
在 [DEFAULT] 和 [oslo_messaging_rabbit]部分，配置 RabbitMQ 消息队列的连接：
[DEFAULT] ... rpc_backend = rabbit
[oslo_messaging_rabbit]模块下面配置
[oslo_messaging_rabbit] ... rabbit_host = controller rabbit_userid = openstack rabbit_password = openstack
5、控制节点配置部分---Neutron核心配置
在[DEFAULT]部分，启用ML2插件并禁用其他插件，等号后面不写，就表示禁用其它插件的意思
[DEFAULT] ... core_plugin = ml2 service_plugins =
6、 控制节点配置部分---结合nova的配置
在[DEFAULT]和[nova]部分，配置网络服务来通知计算节点的网络拓扑变化
打开这两行的注释
意思是端口状态发生改变，通知nova
[DEFAULT] ... notify_nova_on_port_status_changes = True notify_nova_on_port_data_changes = True
[nova]模块下面配置（Neutron配置文件有nova模块）
因为它需要使用nova的用户连接keystone做一些操作
auth_url = http://192.168.56.11:35357 auth_type = password project_domain_name = default user_domain_name = default region_name = RegionOne project_name = service username = nova password = nova
7、控制节点配置部分---结合锁路径配置
在 [oslo_concurrency] 部分，配置锁路径：
[oslo_concurrency] ... lock_path = /var/lib/neutron/tmp
8、控制节点检查主配置文件
控制节点neutron主配置文件的配置完毕
[root@linux-node1 ~]# grep -n '^[a-Z]' /etc/neutron/neutron.conf 27:auth_strategy = keystone 30:core_plugin = ml2 33:service_plugins = 137:notify_nova_on_port_status_changes = true 141:notify_nova_on_port_data_changes = true 511:rpc_backend = rabbit 684:connection = mysql+pymysql://neutron:neutron@192.168.56.11/neutron 762:auth_uri = http://192.168.56.11:5000 763:auth_url = http://192.168.56.11:35357 764:memcached_servers = 192.168.56.11:11211 765:auth_type = password 766:project_domain_name = default 767:user_domain_name = default 768:project_name = service 769:username = neutron 770:password = neutron 939:auth_url = http://192.168.56.11:35357 940:auth_type = password 941:project_domain_name = default 942:user_domain_name = default 943:region_name = RegionOne 944:project_name = service 945:username = nova 946:password = nova 1059:lock_path = /var/lib/neutron/tmp 1210:rabbit_host = 192.168.56.11 1216:rabbit_port = 5672 1228:rabbit_userid = openstack 1232:rabbit_password = openstack [root@linux-node1 ~]#
9、控制节点配置 Modular Layer 2 (ML2) 插件
ML2是2层网络的配置，ML2插件使用Linuxbridge机制来为实例创建layer－2虚拟网络基础设施
编辑/etc/neutron/plugins/ml2/ml2_conf.ini文件并完成以下操作：
在[ml2]部分，启用flat和VLAN网络：
vim /etc/neutron/plugins/ml2/ml2_conf.ini
取消注释，删除local，改成如下
启用flat和VLAN网络，其余的可以不删除，虽然用不到
在[ml2]部分，禁用私有网络，设置为空就表示不使用
[ml2] ... tenant_network_types =
在[ml2]部分，启用Linuxbridge机制：
这个的作用是你告诉neutron使用哪几个插件创建网络，此时是linuxbridge
[ml2] ... mechanism_drivers = linuxbridge
它是个列表，你可以写多个，比如再添加个openvswitch
在[ml2]部分，启用端口安全扩展驱动：
[ml2] ... extension_drivers = port_security
在[ml2_type_flat]部分，配置公共虚拟网络为flat网络，官方文档写的改为provider，我们改为flat_networks = public
[ml2_type_flat] ... flat_networks = provider
在[securitygroup]部分，启用 ipset 增加安全组规则的高效性：
[securitygroup] ... enable_ipset = True
10、控制节点检查ML2配置文件
至此控制节点，ML2的配置更改完毕，如下
[root@linux-node1 ~]# grep -n '^[a-Z]' /etc/neutron/plugins/ml2/ml2_conf.ini 107:type_drivers = flat,vlan,gre,vxlan,geneve 112:tenant_network_types = 116:mechanism_drivers = linuxbridge,openvswitch 121:extension_drivers = port_security 153:flat_networks = public 230:enable_ipset = true [root@linux-node1 ~]#
11、控制节点配置Linuxbridge代理
Linuxbridge代理为实例建立layer－2虚拟网络并且处理安全组规则。
编辑/etc/neutron/plugins/ml2/linuxbridge_agent.ini文件并且完成以下操作：
在[linux_bridge]部分，将公共虚拟网络和公共物理网络接口对应起来：
将PUBLIC_INTERFACE_NAME替换为底层的物理公共网络接口
[linux_bridge] physical_interface_mappings = provider:PROVIDER_INTERFACE_NAME
在[vxlan]部分，禁止VXLAN覆盖网络：
[vxlan] enable_vxlan = False
在 [securitygroup]部分，启用安全组并配置 Linuxbridge iptables firewall driver:
[securitygroup] ... enable_security_group = True firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
查看更改了哪些配置
[root@linux-node1 ~]# grep -n '^[a-Z]' /etc/neutron/plugins/ml2/linuxbridge_agent.ini 138:physical_interface_mappings = public:eth0 151:firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver 156:enable_security_group = true 171:enable_vxlan = False [root@linux-node1 ~]#
12、控制节点配置DHCP代理
编辑/etc/neutron/dhcp_agent.ini文件并完成下面的操作：
在[DEFAULT]部分，配置Linuxbridge驱动接口，DHCP驱动并启用隔离元数据，这样在公共网络上的实例就可以通过网络来访问元数据
[DEFAULT] ... interface_driver = neutron.agent.linux.interface.BridgeInterfaceDriver dhcp_driver = neutron.agent.linux.dhcp.Dnsmasq enable_isolated_metadata = True
查看更改了哪些配置
第一行是底层接口的配置
第二行dnsmasq是一个小的dhcp开源项目
第三行是刷新路由用的
[root@linux-node1 ~]# grep -n '^[a-Z]' /etc/neutron/dhcp_agent.ini 23:interface_driver = neutron.agent.linux.interface.BridgeInterfaceDriver 39:dhcp_driver = neutron.agent.linux.dhcp.Dnsmasq 48:enable_isolated_metadata = True [root@linux-node1 ~]#
13、控制节点配置元数据代理
编辑/etc/neutron/metadata_agent.ini文件并完成以下操作：
在[DEFAULT] 部分，配置元数据主机以及共享密码：
[DEFAULT] ... nova_metadata_ip = controller metadata_proxy_shared_secret = METADATA_SECRET
用你为元数据代理设置的密码替换 METADATA_SECRET。下面的zyx是自定义的共享密钥
这个共享密钥，在nova里还要配置一遍，你要保持一致的
查看更改了哪些配置
[root@linux-node1 ~]# grep -n '^[a-Z]' /etc/neutron/metadata_agent.ini 22:nova_metadata_ip = 192.168.56.11 34:metadata_proxy_shared_secret = zyx [root@linux-node1 ~]#
14、在控制节点的nova上面配置neutron
下面配置的是neutron的keystone的认证地址。9696是neutron-server的端口
编辑/etc/nova/nova.conf文件并完成以下操作：
在[neutron]部分，配置访问参数，启用元数据代理并设置密码：
url = http://192.168.56.11:9696 auth_url = http://192.168.56.11:35357 auth_type = password project_domain_name = default user_domain_name = default region_name = RegionOne project_name = service username = neutron password = neutron
然后打开下面并配置如下
service_metadata_proxy = True metadata_proxy_shared_secret = zyx
15、控制节点配置超链接
网络服务初始化脚本需要一个超链接 /etc/neutron/plugin.ini指向ML2插件配置文件/etc/neutron/plugins/ml2/ml2_conf.ini 如果超链接不存在，使用下面的命令创建它：
[root@linux-node1 ~]# ln -s /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugin.ini [root@linux-node1 ~]#
16、控制节点同步数据库
同步数据库命令如下
su -s /bin/sh -c "neutron-db-manage --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade head" neutron
同步过程如下，它用到了2个配置文件
[root@linux-node1 ~]# su -s /bin/sh -c "neutron-db-manage --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade head" neutron No handlers could be found for logger "oslo_config.cfg" INFO [alembic.runtime.migration] Context impl MySQLImpl. INFO [alembic.runtime.migration] Will assume non-transactional DDL. Running upgrade for neutron ... INFO [alembic.runtime.migration] Context impl MySQLImpl. INFO [alembic.runtime.migration] Will assume non-transactional DDL. INFO [alembic.runtime.migration] Running upgrade -> kilo, kilo_initial INFO [alembic.runtime.migration] Running upgrade kilo -> 354db87e3225, nsxv_vdr_metadata.py INFO [alembic.runtime.migration] Running upgrade 354db87e3225 -> 599c6a226151, neutrodb_ipam INFO [alembic.runtime.migration] Running upgrade 599c6a226151 -> 52c5312f6baf, Initial operations in support of address scopes INFO [alembic.runtime.migration] Running upgrade 52c5312f6baf -> 313373c0ffee, Flavor framework INFO [alembic.runtime.migration] Running upgrade 313373c0ffee -> 8675309a5c4f, network_rbac INFO [alembic.runtime.migration] Running upgrade 8675309a5c4f -> 45f955889773, quota_usage INFO [alembic.runtime.migration] Running upgrade 45f955889773 -> 26c371498592, subnetpool hash INFO [alembic.runtime.migration] Running upgrade 26c371498592 -> 1c844d1677f7, add order to dnsnameservers INFO [alembic.runtime.migration] Running upgrade 1c844d1677f7 -> 1b4c6e320f79, address scope support in subnetpool INFO [alembic.runtime.migration] Running upgrade 1b4c6e320f79 -> 48153cb5f051, qos db changes INFO [alembic.runtime.migration] Running upgrade 48153cb5f051 -> 9859ac9c136, quota_reservations INFO [alembic.runtime.migration] Running upgrade 9859ac9c136 -> 34af2b5c5a59, Add dns_name to Port INFO [alembic.runtime.migration] Running upgrade 34af2b5c5a59 -> 59cb5b6cf4d, Add availability zone INFO [alembic.runtime.migration] Running upgrade 59cb5b6cf4d -> 13cfb89f881a, add is_default to subnetpool INFO [alembic.runtime.migration] Running upgrade 13cfb89f881a -> 32e5974ada25, Add standard attribute table INFO [alembic.runtime.migration] Running upgrade 32e5974ada25 -> ec7fcfbf72ee, Add network availability zone INFO [alembic.runtime.migration] Running upgrade ec7fcfbf72ee -> dce3ec7a25c9, Add router availability zone INFO [alembic.runtime.migration] Running upgrade dce3ec7a25c9 -> c3a73f615e4, Add ip_version to AddressScope INFO [alembic.runtime.migration] Running upgrade c3a73f615e4 -> 659bf3d90664, Add tables and attributes to support external DNS integration INFO [alembic.runtime.migration] Running upgrade 659bf3d90664 -> 1df244e556f5, add_unique_ha_router_agent_port_bindings INFO [alembic.runtime.migration] Running upgrade 1df244e556f5 -> 19f26505c74f, Auto Allocated Topology - aka Get-Me-A-Network INFO [alembic.runtime.migration] Running upgrade 19f26505c74f -> 15be73214821, add dynamic routing model data INFO [alembic.runtime.migration] Running upgrade 15be73214821 -> b4caf27aae4, add_bgp_dragent_model_data INFO [alembic.runtime.migration] Running upgrade b4caf27aae4 -> 15e43b934f81, rbac_qos_policy INFO [alembic.runtime.migration] Running upgrade 15e43b934f81 -> 31ed664953e6, Add resource_versions row to agent table INFO [alembic.runtime.migration] Running upgrade 31ed664953e6 -> 2f9e956e7532, tag support INFO [alembic.runtime.migration] Running upgrade 2f9e956e7532 -> 3894bccad37f, add_timestamp_to_base_resources INFO [alembic.runtime.migration] Running upgrade 3894bccad37f -> 0e66c5227a8a, Add desc to standard attr table INFO [alembic.runtime.migration] Running upgrade kilo -> 30018084ec99, Initial no-op Liberty contract rule. INFO [alembic.runtime.migration] Running upgrade 30018084ec99 -> 4ffceebfada, network_rbac INFO [alembic.runtime.migration] Running upgrade 4ffceebfada -> 5498d17be016, Drop legacy OVS and LB plugin tables INFO [alembic.runtime.migration] Running upgrade 5498d17be016 -> 2a16083502f3, Metaplugin removal INFO [alembic.runtime.migration] Running upgrade 2a16083502f3 -> 2e5352a0ad4d, Add missing foreign keys INFO [alembic.runtime.migration] Running upgrade 2e5352a0ad4d -> 11926bcfe72d, add geneve ml2 type driver INFO [alembic.runtime.migration] Running upgrade 11926bcfe72d -> 4af11ca47297, Drop cisco monolithic tables INFO [alembic.runtime.migration] Running upgrade 4af11ca47297 -> 1b294093239c, Drop embrane plugin table INFO [alembic.runtime.migration] Running upgrade 1b294093239c -> 8a6d8bdae39, standardattributes migration INFO [alembic.runtime.migration] Running upgrade 8a6d8bdae39 -> 2b4c2465d44b, DVR sheduling refactoring INFO [alembic.runtime.migration] Running upgrade 2b4c2465d44b -> e3278ee65050, Drop NEC plugin tables INFO [alembic.runtime.migration] Running upgrade e3278ee65050 -> c6c112992c9, rbac_qos_policy INFO [alembic.runtime.migration] Running upgrade c6c112992c9 -> 5ffceebfada, network_rbac_external INFO [alembic.runtime.migration] Running upgrade 5ffceebfada -> 4ffceebfcdc, standard_desc OK [root@linux-node1 ~]#
17、控制节点重启nova服务以及启动neutron服务
重启计算nova-api 服务，在控制节点上操作：
[root@linux-node1 ~]# systemctl restart openstack-nova-api.service [root@linux-node1 ~]#
启动以下neutron相关服务，并设置开机启动
操作命令如下
systemctl enable neutron-server.service neutron-linuxbridge-agent.service neutron-dhcp-agent.service neutron-metadata-agent.service systemctl start neutron-server.service neutron-linuxbridge-agent.service neutron-dhcp-agent.service neutron-metadata-agent.service
执行过程如下
[root@linux-node1 ~]# systemctl enable neutron-server.service neutron-linuxbridge-agent.service neutron-dhcp-agent.service neutron-metadata-agent.service Created symlink from /etc/systemd/system/multi-user.target.wants/neutron-server.service to /usr/lib/systemd/system/neutron-server.service. Created symlink from /etc/systemd/system/multi-user.target.wants/neutron-linuxbridge-agent.service to /usr/lib/systemd/system/neutron-linuxbridge-agent.service. Created symlink from /etc/systemd/system/multi-user.target.wants/neutron-dhcp-agent.service to /usr/lib/systemd/system/neutron-dhcp-agent.service. Created symlink from /etc/systemd/system/multi-user.target.wants/neutron-metadata-agent.service to /usr/lib/systemd/system/neutron-metadata-agent.service. [root@linux-node1 ~]# [root@linux-node1 ~]# systemctl start neutron-server.service neutron-linuxbridge-agent.service neutron-dhcp-agent.service neutron-metadata-agent.service [root@linux-node1 ~]#
官方文档提到下面，我们用不到，不用操作，这里以删除线标识
对于网络选项2，同样启用layer－3服务并设置其随系统自启动
# systemctl enable neutron-l3-agent.service
# systemctl start neutron-l3-agent.service
查看监听，多了9696端口
[root@linux-node1 ~]# netstat -nltp Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:8774 0.0.0.0:* LISTEN 21243/python2 tcp 0 0 0.0.0.0:8775 0.0.0.0:* LISTEN 21243/python2 tcp 0 0 0.0.0.0:9191 0.0.0.0:* LISTEN 1157/python2 tcp 0 0 0.0.0.0:25672 0.0.0.0:* LISTEN 1154/beam.smp tcp 0 0 0.0.0.0:5000 0.0.0.0:* LISTEN 1175/httpd tcp 0 0 0.0.0.0:3306 0.0.0.0:* LISTEN 1613/mysqld tcp 0 0 0.0.0.0:11211 0.0.0.0:* LISTEN 1162/memcached tcp 0 0 0.0.0.0:9292 0.0.0.0:* LISTEN 1158/python2 tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 1175/httpd tcp 0 0 0.0.0.0:4369 0.0.0.0:* LISTEN 1/systemd tcp 0 0 192.168.122.1:53 0.0.0.0:* LISTEN 1757/dnsmasq tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 1159/sshd tcp 0 0 0.0.0.0:15672 0.0.0.0:* LISTEN 1154/beam.smp tcp 0 0 0.0.0.0:35357 0.0.0.0:* LISTEN 1175/httpd tcp 0 0 0.0.0.0:9696 0.0.0.0:* LISTEN 21324/python2 tcp 0 0 0.0.0.0:6080 0.0.0.0:* LISTEN 13967/python2 tcp6 0 0 :::5672 :::* LISTEN 1154/beam.smp tcp6 0 0 :::22 :::* LISTEN 1159/sshd [root@linux-node1 ~]#
18、控制节点创建服务实体和注册端点
在keystone上创建服务和注册端点
创建neutron服务实体：
[root@linux-node1 ~]# source admin-openstack.sh [root@linux-node1 ~]# openstack service create --name neutron --description "OpenStack Networking" network +-------------+----------------------------------+ | Field | Value | +-------------+----------------------------------+ | description | OpenStack Networking | | enabled | True | | id | bc2a5e5fbfed4d6f8d36c972438bd6d8 | | name | neutron | | type | network | +-------------+----------------------------------+ [root@linux-node1 ~]#
创建网络服务API端点
创建public端点
[root@linux-node1 ~]# openstack endpoint create --region RegionOne network public http://192.168.56.11:9696 +--------------+----------------------------------+ | Field | Value | +--------------+----------------------------------+ | enabled | True | | id | fed066647ffa40d1879bf438215cf0c2 | | interface | public | | region | RegionOne | | region_id | RegionOne | | service_id | bc2a5e5fbfed4d6f8d36c972438bd6d8 | | service_name | neutron | | service_type | network | | url | http://192.168.56.11:9696 | +--------------+----------------------------------+ [root@linux-node1 ~]#
创建internal端点
[root@linux-node1 ~]# openstack endpoint create --region RegionOne network internal http://192.168.56.11:9696 +--------------+----------------------------------+ | Field | Value | +--------------+----------------------------------+ | enabled | True | | id | 1ee57aced55540929045be8bef12617b | | interface | internal | | region | RegionOne | | region_id | RegionOne | | service_id | bc2a5e5fbfed4d6f8d36c972438bd6d8 | | service_name | neutron | | service_type | network | | url | http://192.168.56.11:9696 | +--------------+----------------------------------+ [root@linux-node1 ~]#
创建admin端点
[root@linux-node1 ~]# openstack endpoint create --region RegionOne network admin http://192.168.56.11:9696 +--------------+----------------------------------+ | Field | Value | +--------------+----------------------------------+ | enabled | True | | id | 37686201b1ec4dbd894ab4229f7aa202 | | interface | admin | | region | RegionOne | | region_id | RegionOne | | service_id | bc2a5e5fbfed4d6f8d36c972438bd6d8 | | service_name | neutron | | service_type | network | | url | http://192.168.56.11:9696 | +--------------+----------------------------------+ [root@linux-node1 ~]#
检查，看到下面3行，说明没问题，右边alive是笑脸状态。表示正常
[root@linux-node1 ~]# neutron agent-list +-----------------------+--------------------+----------------------+-------------------+-------+----------------+------------------------+ | id | agent_type | host | availability_zone | alive | admin_state_up | binary | +-----------------------+--------------------+----------------------+-------------------+-------+----------------+------------------------+ | 6da34bbb-edc8-40e5-a8 | DHCP agent | linux-node1.nmap.com | nova | :-) | True | neutron-dhcp-agent | | 85-61c1d80937b7 | | | | | | | | 92d765f2-3519-458f-93 | Linux bridge agent | linux-node1.nmap.com | | :-) | True | neutron-linuxbridge- | | 82-148287317e16 | | | | | | agent | | bede206f-aabf-4265 | Metadata agent | linux-node1.nmap.com | | :-) | True | neutron-metadata-agent | | -8e4f-bb1ad53af906 | | | | | | | +-----------------------+--------------------+----------------------+-------------------+-------+----------------+------------------------+ [root@linux-node1 ~]#
计算节点安装和配置neutron
早期版本nova-compute可以直接连接数据库，那么存在一个问题，任何一个计算节点被入侵了。那么数据库整个就危险了。后来就出现了个nova-condutor，它作为中间访问的
1、安装组件
[root@linux-node2 ~]# yum install openstack-neutron-linuxbridge ebtables ipset -y Loaded plugins: fastestmirror Loading mirror speeds from cached hostfile * base: mirrors.aliyun.com * epel: mirrors.tuna.tsinghua.edu.cn * extras: mirrors.aliyun.com * updates: mirrors.aliyun.com Package 1:openstack-neutron-linuxbridge-8.3.0-1.el7.noarch already installed and latest version Package ebtables-2.0.10-15.el7.x86_64 already installed and latest version Package ipset-6.19-6.el7.x86_64 already installed and latest version Nothing to do [root@linux-node2 ~]#
计算节点要改2个文件配置通用组件和配置网络选项
配置通用组件
Networking 通用组件的配置包括认证机制、消息队列和插件。
/etc/neutron/neutron.conf
配置网络选项
配置Linuxbridge代理
/etc/neutron/plugins/ml2/linuxbridge_agent.ini
文档连接可以参照
https://docs.openstack.org/mitaka/zh_CN/install-guide-rdo/neutron-compute-install-option1.html
因为计算节点和控制节点neutron配置相似，可以在控制节点配置文件基础上完善下
[root@linux-node1 ~]# rsync -avz /etc/neutron/neutron.conf root@192.168.56.12:/etc/neutron/ root@192.168.56.12's password: sending incremental file list neutron.conf sent 86 bytes received 487 bytes 163.71 bytes/sec total size is 53140 speedup is 92.74 [root@linux-node1 ~]#
2、计算节点更改配置
删除mysql的配置，并注释这行
把下面nova的下面配置删除
改成如下
把下面两行注释掉
注释下面2行
3、查看更改后的配置
[root@linux-node2 ~]# vim /etc/neutron/neutron.conf [root@linux-node2 ~]# grep -n '^[a-Z]' /etc/neutron/neutron.conf 27:auth_strategy = keystone 511:rpc_backend = rabbit 762:auth_uri = http://192.168.56.11:5000 763:auth_url = http://192.168.56.11:35357 764:memcached_servers = 192.168.56.11:11211 765:auth_type = password 766:project_domain_name = default 767:user_domain_name = default 768:project_name = service 769:username = neutron 770:password = neutron 1051:lock_path = /var/lib/neutron/tmp 1202:rabbit_host = 192.168.56.11 1208:rabbit_port = 5672 1220:rabbit_userid = openstack 1224:rabbit_password = openstack [root@linux-node2 ~]#
4、计算节点更改nova主配置文件
编辑/etc/nova/nova.conf文件并完成下面的操作：
在[neutron] 部分，配置访问参数：
[neutron] ... url = http://192.168.56.11:9696 auth_url = http://192.168.56.11:35357 auth_type = password project_domain_name = default user_domain_name = default region_name = RegionOne project_name = service username = neutron password = neutron
下面更改的地方，控制节点也改过，可以复制过来
下面这是控制节点
复制这些行
下面这里是计算节点，粘贴
[root@linux-node2 ~]# vim /etc/nova/nova.conf [root@linux-node2 ~]#
5、计算节点配置Linuxbridge代理
（1）Linuxbridge代理为实例建立layer－2虚拟网络并且处理安全组规则。
编辑/etc/neutron/plugins/ml2/linuxbridge_agent.ini文件并且完成以下操作：
在[linux_bridge]部分，将公共虚拟网络和公共物理网络接口对应起来：
[linux_bridge] physical_interface_mappings = provider:PROVIDER_INTERFACE_NAME
将PUBLIC_INTERFACE_NAME 替换为底层的物理公共网络接口
（2）在[vxlan]部分，禁止VXLAN覆盖网络：
[vxlan] enable_vxlan = False
（2）在 [securitygroup]部分，启用安全组并配置 Linuxbridge iptables firewall driver:
[securitygroup] ... enable_security_group = True firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
由于上面3处的配置和控制节点的一模一样，直接拷贝控制节点文件到此替换即可
[root@linux-node1 ~]# rsync -avz /etc/neutron/plugins/ml2/linuxbridge_agent.ini root@192.168.56.12:/etc/neutron/plugins/ml2/ root@192.168.56.12's password: sending incremental file list sent 56 bytes received 12 bytes 27.20 bytes/sec total size is 7924 speedup is 116.53 [root@linux-node1 ~]#
6、在计算节点检查linuxbridge_agent配置文件
[root@linux-node2 ~]# grep -n '^[a-Z]' /etc/neutron/plugins/ml2/linuxbridge_agent.ini 138:physical_interface_mappings = public:eth0 151:firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver 156:enable_security_group = true 171:enable_vxlan = False [root@linux-node2 ~]#
7、重启nova服务并启动neutron服务
因为改动了nova主配置文件，需要重启nova服务
同时启动neutron服务，并设置开机启动
[root@linux-node2 ~]# systemctl restart openstack-nova-compute.service [root@linux-node2 ~]# systemctl enable neutron-linuxbridge-agent.service Created symlink from /etc/systemd/system/multi-user.target.wants/neutron-linuxbridge-agent.service to /usr/lib/systemd/system/neutron-linuxbridge-agent.service. [root@linux-node2 ~]# systemctl start neutron-linuxbridge-agent.service [root@linux-node2 ~]#
8、控制节点检查
看到多了个计算节点Linux bridge agent
[root@linux-node1 ~]# source admin-openstack.sh [root@linux-node1 ~]# neutron agent-list +-----------------------+--------------------+----------------------+-------------------+-------+----------------+------------------------+ | id | agent_type | host | availability_zone | alive | admin_state_up | binary | +-----------------------+--------------------+----------------------+-------------------+-------+----------------+------------------------+ | 1451fc85-d7db-4034-8f | Linux bridge agent | linux-node2.nmap.com | | :-) | True | neutron-linuxbridge- | | c5-38375b442826 | | | | | | agent | | 6da34bbb-edc8-40e5-a8 | DHCP agent | linux-node1.nmap.com | nova | :-) | True | neutron-dhcp-agent | | 85-61c1d80937b7 | | | | | | | | 92d765f2-3519-458f-93 | Linux bridge agent | linux-node1.nmap.com | | :-) | True | neutron-linuxbridge- | | 82-148287317e16 | | | | | | agent | | bede206f-aabf-4265 | Metadata agent | linux-node1.nmap.com | | :-) | True | neutron-metadata-agent | | -8e4f-bb1ad53af906 | | | | | | | +-----------------------+--------------------+----------------------+-------------------+-------+----------------+------------------------+ [root@linux-node1 ~]#
下面映射，可以理解为给网卡起个别名，便于区分用途
同时你的物理网卡名字必须是eth0，对应上配置文件。或者说配置文件对用上实际的网卡名
[root@linux-node2 ~]# grep physical_interface_mappings /etc/neutron/plugins/ml2/linuxbridge_agent.ini physical_interface_mappings = public:eth0 [root@linux-node2 ~]#