A07. openstack架构实战-neutron控制节点安装
网络服务
OpenStack Networking（neutron），允许创建、插入接口设备，这些设备由其他的OpenStack服务管理。插件式的实现可以容纳不同的网络设备和软件，为OpenStack架构与部署提供了灵活性。
neutron组件：
neutron-server（9696）：接收和路由API请求到合适的OpenStack网络插件，（接受和响应外部的网络管理请求）
neutron-linuxbridge-agent：负责创建桥接网卡（给虚拟机创建桥接网卡，对外通信）
neutron-dhcp-agent：负责分配ip
neutron-metadata-agent：配合nova-metadata-api实现虚拟机网络的定制化操作
L3-agent：实现三层网络vxlan(网络层)
LBaas: load balance(阿里源的SLB)
neutron控制节点安装：
1：创建数据库，授权
MariaDB [nova]> CREATE DATABASE neutron;
Query OK, 1 row affected (0.00 sec)
2：授权认证
MariaDB [nova]> GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'localhost' \
-> IDENTIFIED BY 'huayun';
Query OK, 0 rows affected (0.00 sec)
MariaDB [nova]> GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'%' \
-> IDENTIFIED BY 'huayun';
Query OK, 0 rows affected (0.00 sec)
3：在keystone中创建neutron用户：
[root@controller01 ~]# openstack user create --domain default --password-prompt neutron
User Password:
Repeat User Password:
+---------------------+----------------------------------+
| Field | Value |
+---------------------+----------------------------------+
| domain_id | default |
| enabled | True |
| id | 1f4646e3119d42deb10817f2a3b61c57 |
| name | neutron |
| options | {} |
| password_expires_at | None |
+---------------------+----------------------------------+
4：将admin角色关联neutron用户中
[root@controller01 ~]# openstack role add --project service --user neutron admin
5：创建neutron服务：
[root@controller01 ~]# openstack service create --name neutron \
> --description "OpenStack Networking" network
+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | OpenStack Networking |
| enabled | True |
| id | d3e2f0455a434f4bb245716dcb5ed295 |
| name | neutron |
| type | network |
+-------------+----------------------------------+
6：创建网络服务的api接口
[root@controller01 ~]# openstack endpoint create --region RegionOne \
> network public http://controller01:9696
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | bcef092da5a842a0a1682e23302402c7 |
| interface | public |
| region | RegionOne |
| region_id | RegionOne |
| service_id | d3e2f0455a434f4bb245716dcb5ed295 |
| service_name | neutron |
| service_type | network |
| url | http://controller01:9696 |
+--------------+----------------------------------+
[root@controller01 ~]# openstack endpoint create --region RegionOne \
> network internal http://controller01:9696
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | 71608960c7f844f3b3618382fa20cde6 |
| interface | internal |
| region | RegionOne |
| region_id | RegionOne |
| service_id | d3e2f0455a434f4bb245716dcb5ed295 |
| service_name | neutron |
| service_type | network |
| url | http://controller01:9696 |
+--------------+----------------------------------+
[root@controller01 ~]# openstack endpoint create --region RegionOne \
> network admin http://controller01:9696
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | d003b4c9d94843d192bac75eb4a462ed |
| interface | admin |
| region | RegionOne |
| region_id | RegionOne |
| service_id | d3e2f0455a434f4bb245716dcb5ed295 |
| service_name | neutron |
| service_type | network |
| url | http://controller01:9696 |
+--------------+----------------------------------+
openstack网络提供有两个选择：
1：Provider networks（公共网络）
选项1采用尽可能简单的架构进行部署，只支持实例连接到公有网络（外部网络）。没有私有网络（个人网络），路由器以及浮动IP地址。只有``admin``或者其他特权用户才可以管理公有网络
选项2在选项1的基础上多了layer－3服务，支持实例连接到私有网络。``demo``或者其他没有特权的用户可以管理自己的私有网络，包含连接公网和私网的路由器。另外，浮动IP地址可以让实例使用私有网络连接到外部网络，例如互联网
我们选择选项1进行安装：（后期会有3层网络实现讲解）
1：安装网络相关软件包( ebtables和iptables类似，在linux中都可以实现网络的过滤)
[root@controller01 ~]# yum install -y openstack-neutron openstack-neutron-ml2 \
> openstack-neutron-linuxbridge ebtables
2：配置neutron的配置文件
a ： 编辑/etc/neutron/neutron.conf文件并完成以下操作：
配置neutron访问数据库连接：
[database]
connection = mysql+pymysql://neutron:huayun@controller01/neutron
在该[DEFAULT]部分中，启用模块化第2层（ML2）插件并禁用其他插件：（2层网络中不需要配置服务插件service_plugins。3层网络需要进行配置）
[DEFAULT]
core_plugin = ml2
service_plugins =
在该[DEFAULT]部分中，配置RabbitMQ 消息队列访问：
[DEFAULT]
。。。。。
transport_url = rabbit://openstack:huayun@controller01
在[DEFAULT]和[keystone_authtoken]部分中，配置身份服务访问：
[DEFAULT]
。。。。。
auth_strategy = keystone
在[DEFAULT]和[nova]部分中，将网络配置为通知Compute网络拓扑更改：
[DEFAULT]
notify_nova_on_port_status_changes = true
notify_nova_on_port_data_changes = true
[nova]
auth_url = http://controller01:35357
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = nova
password = huayun
在该[oslo_concurrency]部分中，配置锁定路径：
[oslo_concurrency]
lock_path = /var/lib/neutron/tmp
b:配置模块化层2（ML2）插件
ML2插件使用Linux桥接器机制为实例构建第2层（桥接和交换）虚拟网络基础架构
编辑/etc/neutron/plugins/ml2/ml2_conf.ini文件并完成以下操作：
在[ml2]节中，启用平面网络(flat)和VLAN(需要交换机的支持)网络：
[ ml2]
type_drivers = flat,vlan
在该[ml2]部分中，禁用私有网络：
[ml2]
。。。。
tenant_network_types =
在[ml2]中，启用Linux桥接机制：
[ml2]
mechanism_drivers = linuxbridge
在此[ml2]部分中，启用端口安全扩展驱动程序：
[ml2]
extension_drivers = port_security
在``[ml2_type_flat]``部分，配置公共虚拟网络为flat网络（后排你配置需要指定物理网卡）
[ml2_type_flat]
flat_networks = provider
在 ``[securitygroup]``部分，启用 ipset 增加安全组规则的高效性：
[securitygroup]
enable_ipset = true
c：配置Linuxbridge代理
Linuxbridge代理为实例建立layer－2虚拟网络并且处理安全组规则。
编辑``/etc/neutron/plugins/ml2/linuxbridge_agent.ini``文件并且完成以下操作：
在``[linux_bridge]``部分，将公共虚拟网络和公共物理网络接口对应起来
[linux_bridge]
physical_interface_mappings = provider:ens192
在``[vxlan]``部分，禁止VXLAN覆盖网络：
[vxlan]
enable_vxlan = false
在 ``[securitygroup]``部分，启用安全组并配置 Linuxbridge iptables firewall driver
[securitygroup]
enable_security_group = true
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
确认操作系统内核支持桥接：
[root@controller01 ~]# echo "net.bridge.bridge-nf-call-iptables = 1" >> /etc/sysctl.conf
[root@controller01 ~]# echo "net.bridge.bridge-nf-call-ip6tables = 1" >> /etc/sysctl.conf
[root@controller01 ~]# sysctl -p
sysctl: cannot stat /proc/sys/net/bridge/bridge-nf-call-iptables: No such file or directory
sysctl: cannot stat /proc/sys/net/bridge/bridge-nf-call-ip6tables: No such file or directory
我们需要进行啊加载模块：
[root@controller01 ~]# modinfo br_netfilter
filename: /lib/modules/3.10.0-862.el7.x86_64/kernel/net/bridge/br_netfilter.ko.xz
description: Linux ethernet netfilter firewall bridge
author: Bart De Schuymer <bdschuym@pandora.be>
author: Lennert Buytenhek <buytenh@gnu.org>
license: GPL
retpoline: Y
rhelversion: 7.5
srcversion: C4DE536495D55C12BA6A8A8
depends: bridge
intree: Y
vermagic: 3.10.0-862.el7.x86_64 SMP mod_unload modversions
signer: CentOS Linux kernel signing key
sig_key: 3A:F3:CE:8A:74:69:6E:F1:BD:0F:37:E5:52:62:7B:71:09:E3:2B:96
sig_hashalgo: sha256
[root@controller01 ~]# modprobe br_netfilter
加载成功：
[root@controller01 ~]# sysctl -p
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
d:配置DHCP代理
DHCP代理为虚拟网络提供DHCP服务。
-
编辑
/etc/neutron/dhcp_agent.ini文件并完成以下操作
在``[DEFAULT]``部分，配置Linuxbridge驱动接口，DHCP驱动并启用隔离元数据，这样在公共网络上的实例就可以通过网络来访问元数据
[DEFAULT]
interface_driver = linuxbridge
dhcp_driver = neutron.agent.linux.dhcp.Dnsmasq
enable_isolated_metadata = true
配置元数据代理
元数据代理提供配置信息，例如实例的凭据。
编辑/etc/neutron/metadata_agent.ini文件并完成以下操作：
在``[DEFAULT]`` 部分，配置元数据主机以及共享密码：
[DEFAULT]
nova_metadata_host = controller01
metadata_proxy_shared_secret = huayun
配置控制节点的nova配置网络服务
编辑``/etc/nova/nova.conf``文件并完成以下操作：
在``[neutron]``部分，配置访问参数，启用元数据代理并设置密码
[neutron]
url = http://controller01:9696
auth_url = http://controller01:35357
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = neutron
password = huayun
service_metadata_proxy = true
metadata_proxy_shared_secret = huayun
完成安装
网络服务初始化脚本需要一个超链接 /etc/neutron/plugin.ini``指向ML2插件配置文件/etc/neutron/plugins/ml2/ml2_conf.ini``。如果超链接不存在，使用下面的命令创建它：
[root@controller01 ~]# ln -s /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugin.ini
同步数据库：
[root@controller01 ~]# su -s /bin/sh -c "neutron-db-manage --config-file /etc/neutron/neutron.conf \
> --config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade head" neutron
INFO [alembic.runtime.migration] Context impl MySQLImpl.
INFO [alembic.runtime.migration] Will assume non-transactional DDL.
Running upgrade for neutron ...
INFO [alembic.runtime.migration] Context impl MySQLImpl.
INFO [alembic.runtime.migration] Will assume non-transactional DDL.
INFO [alembic.runtime.migration] Running upgrade -> kilo, kilo_initial
INFO [alembic.runtime.migration] Running upgrade kilo -> 354db87e3225, nsxv_vdr_metadata.py
INFO [alembic.runtime.migration] Running upgrade 354db87e3225 -> 599c6a226151, neutrodb_ipam
INFO [alembic.runtime.migration] Running upgrade 599c6a226151 -> 52c5312f6baf, Initial operations in support of address scopes
INFO [alembic.runtime.migration] Running upgrade 52c5312f6baf -> 313373c0ffee, Flavor framework
INFO [alembic.runtime.migration] Running upgrade 313373c0ffee -> 8675309a5c4f, network_rbac
INFO [alembic.runtime.migration] Running upgrade 8675309a5c4f -> 45f955889773, quota_usage
INFO [alembic.runtime.migration] Running upgrade 45f955889773 -> 26c371498592, subnetpool hash
INFO [alembic.runtime.migration] Running upgrade 26c371498592 -> 1c844d1677f7, add order to dnsnameservers
INFO [alembic.runtime.migration] Running upgrade 1c844d1677f7 -> 1b4c6e320f79, address scope support in subnetpool
INFO [alembic.runtime.migration] Running upgrade 1b4c6e320f79 -> 48153cb5f051, qos db changes
INFO [alembic.runtime.migration] Running upgrade 48153cb5f051 -> 9859ac9c136, quota_reservations
INFO [alembic.runtime.migration] Running upgrade 9859ac9c136 -> 34af2b5c5a59, Add dns_name to Port
INFO [alembic.runtime.migration] Running upgrade 34af2b5c5a59 -> 59cb5b6cf4d, Add availability zone
INFO [alembic.runtime.migration] Running upgrade 59cb5b6cf4d -> 13cfb89f881a, add is_default to subnetpool
INFO [alembic.runtime.migration] Running upgrade 13cfb89f881a -> 32e5974ada25, Add standard attribute table
INFO [alembic.runtime.migration] Running upgrade 32e5974ada25 -> ec7fcfbf72ee, Add network availability zone
INFO [alembic.runtime.migration] Running upgrade ec7fcfbf72ee -> dce3ec7a25c9, Add router availability zone
INFO [alembic.runtime.migration] Running upgrade dce3ec7a25c9 -> c3a73f615e4, Add ip_version to AddressScope
INFO [alembic.runtime.migration] Running upgrade c3a73f615e4 -> 659bf3d90664, Add tables and attributes to support external DNS integration
INFO [alembic.runtime.migration] Running upgrade 659bf3d90664 -> 1df244e556f5, add_unique_ha_router_agent_port_bindings
INFO [alembic.runtime.migration] Running upgrade 1df244e556f5 -> 19f26505c74f, Auto Allocated Topology - aka Get-Me-A-Network
INFO [alembic.runtime.migration] Running upgrade 19f26505c74f -> 15be73214821, add dynamic routing model data
INFO [alembic.runtime.migration] Running upgrade 15be73214821 -> b4caf27aae4, add_bgp_dragent_model_data
INFO [alembic.runtime.migration] Running upgrade b4caf27aae4 -> 15e43b934f81, rbac_qos_policy
INFO [alembic.runtime.migration] Running upgrade 15e43b934f81 -> 31ed664953e6, Add resource_versions row to agent table
INFO [alembic.runtime.migration] Running upgrade 31ed664953e6 -> 2f9e956e7532, tag support
INFO [alembic.runtime.migration] Running upgrade 2f9e956e7532 -> 3894bccad37f, add_timestamp_to_base_resources
INFO [alembic.runtime.migration] Running upgrade 3894bccad37f -> 0e66c5227a8a, Add desc to standard attr table
INFO [alembic.runtime.migration] Running upgrade 0e66c5227a8a -> 45f8dd33480b, qos dscp db addition
INFO [alembic.runtime.migration] Running upgrade 45f8dd33480b -> 5abc0278ca73, Add support for VLAN trunking
INFO [alembic.runtime.migration] Running upgrade kilo -> 30018084ec99, Initial no-op Liberty contract rule.
INFO [alembic.runtime.migration] Running upgrade 30018084ec99 -> 4ffceebfada, network_rbac
INFO [alembic.runtime.migration] Running upgrade 4ffceebfada -> 5498d17be016, Drop legacy OVS and LB plugin tables
INFO [alembic.runtime.migration] Running upgrade 5498d17be016 -> 2a16083502f3, Metaplugin removal
INFO [alembic.runtime.migration] Running upgrade 2a16083502f3 -> 2e5352a0ad4d, Add missing foreign keys
INFO [alembic.runtime.migration] Running upgrade 2e5352a0ad4d -> 11926bcfe72d, add geneve ml2 type driver
INFO [alembic.runtime.migration] Running upgrade 11926bcfe72d -> 4af11ca47297, Drop cisco monolithic tables
INFO [alembic.runtime.migration] Running upgrade 4af11ca47297 -> 1b294093239c, Drop embrane plugin table
INFO [alembic.runtime.migration] Running upgrade 1b294093239c -> 8a6d8bdae39, standardattributes migration
INFO [alembic.runtime.migration] Running upgrade 8a6d8bdae39 -> 2b4c2465d44b, DVR sheduling refactoring
INFO [alembic.runtime.migration] Running upgrade 2b4c2465d44b -> e3278ee65050, Drop NEC plugin tables
INFO [alembic.runtime.migration] Running upgrade e3278ee65050 -> c6c112992c9, rbac_qos_policy
INFO [alembic.runtime.migration] Running upgrade c6c112992c9 -> 5ffceebfada, network_rbac_external
INFO [alembic.runtime.migration] Running upgrade 5ffceebfada -> 4ffceebfcdc, standard_desc
INFO [alembic.runtime.migration] Running upgrade 4ffceebfcdc -> 7bbb25278f53, device_owner_ha_replicate_int
INFO [alembic.runtime.migration] Running upgrade 7bbb25278f53 -> 89ab9a816d70, Rename ml2_network_segments table
INFO [alembic.runtime.migration] Running upgrade 5abc0278ca73 -> d3435b514502, Add device_id index to Port
INFO [alembic.runtime.migration] Running upgrade d3435b514502 -> 30107ab6a3ee, provisioning_blocks.py
INFO [alembic.runtime.migration] Running upgrade 30107ab6a3ee -> c415aab1c048, add revisions table
INFO [alembic.runtime.migration] Running upgrade c415aab1c048 -> a963b38d82f4, add dns name to portdnses
INFO [alembic.runtime.migration] Running upgrade 89ab9a816d70 -> c879c5e1ee90, Add segment_id to subnet
INFO [alembic.runtime.migration] Running upgrade c879c5e1ee90 -> 8fd3918ef6f4, Add segment_host_mapping table.
INFO [alembic.runtime.migration] Running upgrade 8fd3918ef6f4 -> 4bcd4df1f426, Rename ml2_dvr_port_bindings
INFO [alembic.runtime.migration] Running upgrade 4bcd4df1f426 -> b67e765a3524, Remove mtu column from networks.
INFO [alembic.runtime.migration] Running upgrade a963b38d82f4 -> 3d0e74aa7d37, Add flavor_id to Router
INFO [alembic.runtime.migration] Running upgrade 3d0e74aa7d37 -> 030a959ceafa, uniq_routerports0port_id
INFO [alembic.runtime.migration] Running upgrade 030a959ceafa -> a5648cfeeadf, Add support for Subnet Service Types
INFO [alembic.runtime.migration] Running upgrade a5648cfeeadf -> 0f5bef0f87d4, add_qos_minimum_bandwidth_rules
INFO [alembic.runtime.migration] Running upgrade 0f5bef0f87d4 -> 67daae611b6e, add standardattr to qos policies
INFO [alembic.runtime.migration] Running upgrade 67daae611b6e -> 6b461a21bcfc, uniq_floatingips0floating_network_id0fixed_port_id0fixed_ip_addr
INFO [alembic.runtime.migration] Running upgrade 6b461a21bcfc -> 5cd92597d11d, Add ip_allocation to port
INFO [alembic.runtime.migration] Running upgrade 5cd92597d11d -> 929c968efe70, add_pk_version_table
INFO [alembic.runtime.migration] Running upgrade 929c968efe70 -> a9c43481023c, extend_pk_with_host_and_add_status_to_ml2_port_binding
INFO [alembic.runtime.migration] Running upgrade a9c43481023c -> 804a3c76314c, Add data_plane_status to Port
INFO [alembic.runtime.migration] Running upgrade 804a3c76314c -> 2b42d90729da, qos add direction to bw_limit_rule table
INFO [alembic.runtime.migration] Running upgrade 2b42d90729da -> 62c781cb6192, add is default to qos policies
INFO [alembic.runtime.migration] Running upgrade 62c781cb6192 -> c8c222d42aa9, logging api
INFO [alembic.runtime.migration] Running upgrade c8c222d42aa9 -> 349b6fd605a6, Add dns_domain to portdnses
INFO [alembic.runtime.migration] Running upgrade 349b6fd605a6 -> 7d32f979895f, add mtu for networks
INFO [alembic.runtime.migration] Running upgrade 7d32f979895f -> 594422d373ee, fip qos
INFO [alembic.runtime.migration] Running upgrade b67e765a3524 -> a84ccf28f06a, migrate dns name from port
INFO [alembic.runtime.migration] Running upgrade a84ccf28f06a -> 7d9d8eeec6ad, rename tenant to project
INFO [alembic.runtime.migration] Running upgrade 7d9d8eeec6ad -> a8b517cff8ab, Add routerport bindings for L3 HA
INFO [alembic.runtime.migration] Running upgrade a8b517cff8ab -> 3b935b28e7a0, migrate to pluggable ipam
INFO [alembic.runtime.migration] Running upgrade 3b935b28e7a0 -> b12a3ef66e62, add standardattr to qos policies
INFO [alembic.runtime.migration] Running upgrade b12a3ef66e62 -> 97c25b0d2353, Add Name and Description to the networksegments table
INFO [alembic.runtime.migration] Running upgrade 97c25b0d2353 -> 2e0d7a8a1586, Add binding index to RouterL3AgentBinding
INFO [alembic.runtime.migration] Running upgrade 2e0d7a8a1586 -> 5c85685d616d, Remove availability ranges.
OK
重启计算API 服务
[root@controller01 ~]# systemctl restart openstack-nova-api.service
当系统启动时，启动 Networking 服务并配置它启动。
[root@controller01 ~]# systemctl enable neutron-server.service \
> neutron-linuxbridge-agent.service neutron-dhcp-agent.service \
> neutron-metadata-agent.service
[root@controller01 ~]# systemctl start neutron-server.service \
> neutron-linuxbridge-agent.service neutron-dhcp-agent.service \
> neutron-metadata-agent.service
检验：
[root@controller01 ~]# neutron agent-list
neutron CLI is deprecated and will be removed in the future. Use openstack CLI instead.
+--------------------------------------+--------------------+--------------+-------------------+-------+----------------+---------------------------+
| id | agent_type | host | availability_zone | alive | admin_state_up | binary |
+--------------------------------------+--------------------+--------------+-------------------+-------+----------------+---------------------------+
| af066e09-2b33-4742-a342-917c0e55b4d3 | DHCP agent | controller01 | nova | :-) | True | neutron-dhcp-agent |
| cf9adb65-b6c4-4088-9d22-96967b4505c5 | Linux bridge agent | controller01 | | :-) | True | neutron-linuxbridge-agent |
| ee2e8e9a-4512-48e9-8dc2-e3f262f433bc | Metadata agent | controller01 | | :-) | True | neutron-metadata-agent |
+--------------------------------------+--------------------+--------------+-------------------+-------+----------------+---------------------------+
发现只有3个服务：
