openstack实验（五）：网络服务

一、网络的概念

• OpenStack网络（neutron）管理OpenStack环境中所有虚拟网络基础设施（VNI），物理网络基础设施（PNI）的接入层。OpenStack网络允许租户创建包括像
  firewall， :term:"load balancer"和 :term:"virtual private network
  (VPN)"等这样的高级虚拟网络拓扑。
• 网络服务提供网络，子网以及路由这些对象的抽象概念。每个抽象概念都有自己的功能，可以模拟对应的物理设备：网络包括子网，路由在不同的子网和网络间进行路由转发。
• 对于任意一个给定的网络都必须包含至少一个外部网络。不像其他的网络那样，外部网络不仅仅是一个定义的虚拟网络。相反，它代表了一种OpenStack安装之外的能从物理的，外部的网络访问的视图。外部网络上的IP地址可供外部网络上的任意的物理设备所访问
• 外部网络之外，任何 Networking
  设置拥有一个或多个内部网络。这些软件定义的网络直接连接到虚拟机。仅仅在给定网络上的虚拟机，或那些在通过接口连接到相近路由的子网上的虚拟机，能直接访问连接到那个网络上的虚拟机。
• 如果外部网络想要访问实例或者相反实例想要访问外部网络，那么网络之间的路由就是必要的了。每一个路由都配有一个网关用于连接到外部网络，以及一个或多个连接到内部网络的接口。就像一个物理路由一样，子网可以访问同一个路由上其他子网中的机器，并且机器也可以访问路由的网关访问外部网络。
• 另外，你可以将外部网络的IP地址分配给内部网络的端口。不管什么时候一旦有连接连接到子网，那个连接被称作端口。你可以给实例的端口分配外部网络的IP地址。通过这种方式，外部网络上的实体可以访问实例.
• 网络服务同样支持安全组。安全组允许管理员在安全组中定义防火墙规则。一个实例可以属于一个或多个安全组，网络为这个实例配置这些安全组中的规则，阻止或者开启端口，端口范围或者通信类型。
• 每一个Networking使用的插件都有其自有的概念。虽然对操作VNI和OpenStack环境不是至关重要的，但理解这些概念能帮助你设置Networking。所有的Networking安装使用了一个核心插件和一个安全组插件(或仅是空操作安全组插件)。另外，防火墙即服务(FWaaS)和负载均衡即服务(LBaaS)插件是可用的。

二、安装并配置控制节点
1.数据库配置
（1）以 root 用户连接到数据库服务器

[root@controller ~]# mysql -p
Enter password:
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 68
Server version: 10.1.20-MariaDB MariaDB Server
Copyright © 2000, 2016, Oracle, MariaDB Corporation Ab and others.
Type ‘help;’ or ‘\h’ for help. Type ‘\c’ to clear the current input statement.

(2)创建neutron 数据库：

MariaDB [(none)]> CREATE DATABASE neutron;
Query OK, 1 row affected (0.00 sec)

(3)对neutron 数据库授予合适的访问权限

MariaDB [(none)]> GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'localhost' \
    ->   IDENTIFIED BY 'neutron';
Query OK, 0 rows affected (0.00 sec)

MariaDB [(none)]> GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'%'    IDENTIFIED BY 'neutron'; Query OK, 0 rows affected (0.00 sec)

MariaDB [(none)]> exit
Bye

4.创建neutron用户：

[root@controller ~]# openstack user create --domain default --password neutron neutron
+-----------+----------------------------------+
| Field     | Value                            |
+-----------+----------------------------------+
| domain_id | 63a9992134eb452da1c8d950231c2b06 |
| enabled   | True                             |
| id        | 3b4a64964e7e4c60ac8cd202587ebe69 |
| name      | neutron                          |
+-----------+----------------------------------+

5.添加admin角色到neutron 用户

[root@controller ~]# openstack role add --project service --user neutron admin

6.创建neutron服务实体

[root@controller ~]# openstack service create --name neutron \
>   --description "OpenStack Networking" network
+-------------+----------------------------------+
| Field       | Value                            |
+-------------+----------------------------------+
| description | OpenStack Networking             |
| enabled     | True                             |
| id          | 67959afba438465d9485b4b740fab8de |
| name        | neutron                          |
| type        | network                          |
+-------------+----------------------------------+

7.创建网络服务API端点

[root@controller ~]# openstack endpoint create --region RegionOne \
>   network public http://controller:9696
+--------------+----------------------------------+
| Field        | Value                            |
+--------------+----------------------------------+
| enabled      | True                             |
| id           | f021b8791ee743da8e9ea1d9774f8ef2 |
| interface    | public                           |
| region       | RegionOne                        |
| region_id    | RegionOne                        |
| service_id   | 67959afba438465d9485b4b740fab8de |
| service_name | neutron                          |
| service_type | network                          |
| url          | http://controller:9696           |
+--------------+----------------------------------+
[root@controller ~]# openstack endpoint create --region RegionOne \
>   network internal http://controller:9696
+--------------+----------------------------------+
| Field        | Value                            |
+--------------+----------------------------------+
| enabled      | True                             |
| id           | c471f8abc5634a4f8ce1040f68ccecc6 |
| interface    | internal                         |
| region       | RegionOne                        |
| region_id    | RegionOne                        |
| service_id   | 67959afba438465d9485b4b740fab8de |
| service_name | neutron                          |
| service_type | network                          |
| url          | http://controller:9696           |
+--------------+----------------------------------+
[root@controller ~]# openstack endpoint create --region RegionOne \
>   network admin http://controller:9696
+--------------+----------------------------------+
| Field        | Value                            |
+--------------+----------------------------------+
| enabled      | True                             |
| id           | efa56b7713b34a60afb40b14a5fb8ede |
| interface    | admin                            |
| region       | RegionOne                        |
| region_id    | RegionOne                        |
| service_id   | 67959afba438465d9485b4b740fab8de |
| service_name | neutron                          |
| service_type | network                          |
| url          | http://controller:9696           |
+--------------+----------------------------------+

8.配置公有网络

(1)安装组件

[root@controller ~]# yum install openstack-neutron openstack-neutron-ml2 \
>   openstack-neutron-linuxbridge ebtables

(2)编辑/etc/neutron/neutron.conf 文件

[root@controller ~]# vim /etc/neutron/neutron.conf

[DEFAULT]
core_plugin = ml2    ##启用ML2插件并禁用其他插件
service_plugins =
rpc_backend = rabbit   ##配置 “RabbitMQ” 消息队列的连接
auth_strategy = keystone   ##配置认证服务访问
notify_nova_on_port_status_changes = True    ##配置网络服务来通知计算节点的网络拓扑变化 
notify_nova_on_port_data_changes = True

##配置数据库访问
[database]
connection = mysql+pymysql://neutron:neutron@controller/neutron

##配置 “RabbitMQ” 消息队列的连接
[oslo_messaging_rabbit]
rabbit_host = controller
rabbit_userid = openstack
rabbit_password = openstack

##配置认证服务访问
[keystone_authtoken]
auth_uri = http://controller:5000
auth_url = http://controller:35357
memcached_servers = controller:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = neutron
password = neutron

##配置网络服务来通知计算节点的网络拓扑变化
[nova]
auth_url = http://controller:35357
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = nova
password = nova

配置锁路径
[oslo_concurrency]
lock_path = /var/lib/neutron/tmp

• 配置 Modular Layer 2 (ML2) 插件

(3)编辑/etc/neutron/plugins/ml2/ml2_conf.ini文件

[root@controller ~]# vim /etc/neutron/plugins/ml2/ml2_conf.ini

[ml2]
type_drivers = flat,vlan   ##启用flat和VLAN网络
tenant_network_types =    ##禁用私有网络
mechanism_drivers = linuxbridge    ##启用Linuxbridge机制
extension_drivers = port_security    ##启用端口安全扩展驱动

##配置公共虚拟网络为flat网络
[ml2_type_flat]
flat_networks = provider

##启用 ipset 增加安全组规则的高效性
[securitygroup]
enable_ipset = True

• 配置Linuxbridge代理
  （4）编辑/etc/neutron/plugins/ml2/linuxbridge_agent.ini文件

[root@controller ~]# vim /etc/neutron/plugins/ml2/linuxbridge_agent.ini

##将公共虚拟网络和公共物理网络接口对应起来
[linux_bridge]
physical_interface_mappings = provider:eth1
##禁止VXLAN覆盖网络
[vxlan]
enable_vxlan = False
##启用安全组并配置 Linuxbridge iptables firewall driver:
[securitygroup]
enable_security_group = True
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver

• 配置DHCP代理

（5）编辑/etc/neutron/dhcp_agent.ini文件

[root@controller ~]# vim /etc/neutron/dhcp_agent.ini
##配置Linuxbridge驱动接口，DHCP驱动并启用隔离元数据，这样在公共网络上的实例就可以通过网络来访问元数据
[DEFAULT]
interface_driver = neutron.agent.linux.interface.BridgeInterfaceDriver
dhcp_driver = neutron.agent.linux.dhcp.Dnsmasq
enable_isolated_metadata = True

• 配置元数据代理
  9.编辑/etc/neutron/metadata_agent.ini文件

[root@controller ~]# vim /etc/neutron/metadata_agent.ini

配置元数据主机以及共享密码
[DEFAULT]
nova_metadata_ip = controller
metadata_proxy_shared_secret = westos

• 为计算节点配置网络服务

10.编辑/etc/nova/nova.conf文件

[root@controller ~]# vim /etc/nova/nova.conf

配置访问参数，启用元数据代理并设置密码
[neutron]
url = http://controller:9696
auth_url = http://controller:35357
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = neutron
password = neutron

service_metadata_proxy = True
metadata_proxy_shared_secret = westos

11.制作超链接

[root@controller ~]# ln -s /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugin.ini

12.同步数据库

[root@controller ~]# su -s /bin/sh -c "neutron-db-manage --config-file /etc/neutron/neutron.conf \
>   --config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade head" neutron

13.重启计算API 服务

[root@controller ~]# systemctl restart openstack-nova-api.service

14.当系统启动时，启动 Networking 服务并配置它启动

[root@controller ~]# systemctl enable neutron-server.service \
>   neutron-linuxbridge-agent.service neutron-dhcp-agent.service \
>   neutron-metadata-agent.service
Created symlink from /etc/systemd/system/multi-user.target.wants/neutron-server.service to /usr/lib/systemd/system/neutron-server.service.
Created symlink from /etc/systemd/system/multi-user.target.wants/neutron-linuxbridge-agent.service to /usr/lib/systemd/system/neutron-linuxbridge-agent.service.
Created symlink from /etc/systemd/system/multi-user.target.wants/neutron-dhcp-agent.service to /usr/lib/systemd/system/neutron-dhcp-agent.service.
Created symlink from /etc/systemd/system/multi-user.target.wants/neutron-metadata-agent.service to /usr/lib/systemd/system/neutron-metadata-agent.service.
[root@controller ~]# systemctl start neutron-server.service \
>   neutron-linuxbridge-agent.service neutron-dhcp-agent.service \
>   neutron-metadata-agent.service

15.验证操作

[root@controller ~]# neutron agent-list
+--------------+--------------+------------+-------------------+-------+----------------+--------------+
| id           | agent_type   | host       | availability_zone | alive | admin_state_up | binary       |
+--------------+--------------+------------+-------------------+-------+----------------+--------------+
| 07a9d1c6-c8e | DHCP agent   | controller | nova              | :-)   | True           | neutron-     |
| e-4485-ac45- |              |            |                   |       |                | dhcp-agent   |
| 91d8e4bdbdc2 |              |            |                   |       |                |              |
| 1c0296e7     | Metadata     | controller |                   | :-)   | True           | neutron-     |
| -ca1b-499f-  | agent        |            |                   |       |                | metadata-    |
| 8bda-        |              |            |                   |       |                | agent        |
| 022200e76081 |              |            |                   |       |                |              |
| 4381db53-b54 | Linux bridge | controller |                   | :-)   | True           | neutron-     |
| 0-4864-b4fc- | agent        |            |                   |       |                | linuxbridge- |
| 36fbdc34e58e |              |            |                   |       |                | agent        |
+--------------+--------------+------------+-------------------+-------+----------------+--------------+

三、安装和配置计算节点

1.安装组件

[root@compute1 ~]# yum install openstack-neutron-linuxbridge ebtables ipset -y

2.编辑/etc/neutron/neutron.conf 文件

[root@compute1 ~]# vim /etc/neutron/neutron.conf

[DEFAULT]
rpc_backend = rabbit   ##配置 “RabbitMQ” 消息队列的连接
auth_strategy = keystone  ##配置认证服务访问
##配置 “RabbitMQ” 消息队列的连接
[oslo_messaging_rabbit]
rabbit_host = controller
rabbit_userid = openstack
rabbit_password = openstack

##配置认证服务访问
[keystone_authtoken]
auth_uri = http://controller:5000
auth_url = http://controller:35357
memcached_servers = controller:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = neutron
password = neutron

##配置锁路径
[oslo_concurrency]
lock_path = /var/lib/neutron/tmp

3.配置公共网络

• 配置Linuxbridge代理

（1）编辑/etc/neutron/plugins/ml2/linuxbridge_agent.ini文件

[root@compute1 ~]# vim /etc/neutron/plugins/ml2/linuxbridge_agent.ini

##将公共虚拟网络和公共物理网络接口对应起来
[linux_bridge]
physical_interface_mappings = provider:eth1

##禁止VXLAN覆盖网络：
[vxlan]
enable_vxlan = False

##启用安全组并配置 Linuxbridge iptables firewall driver:
[securitygroup]
enable_security_group = True
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver

• 为计算节点配置网络服务
  4.编辑/etc/nova/nova.conf文件

[root@compute1 ~]# vim /etc/nova/nova.conf
配置访问参数
[neutron]
url = http://controller:9696
auth_url = http://controller:35357
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = neutron
password = neutron

5.重启计算服务

[root@compute1 ~]# systemctl restart openstack-nova-compute.service

6.启动Linuxbridge代理并配置它开机自启动

[root@compute1 ~]# systemctl enable neutron-linuxbridge-agent.service
Created symlink from /etc/systemd/system/multi-user.target.wants/neutron-linuxbridge-agent.service to /usr/lib/systemd/system/neutron-linuxbridge-agent.service.
[root@compute1 ~]# systemctl start neutron-linuxbridge-agent.service

• 验证操作

1.列出加载的扩展来验证neutron-server进程是否正常启动

[root@controller ~]# neutron ext-list
+---------------------------+-----------------------------------------------+
| alias                     | name                                          |
+---------------------------+-----------------------------------------------+
| default-subnetpools       | Default Subnetpools                           |
| availability_zone         | Availability Zone                             |
| network_availability_zone | Network Availability Zone                     |
| auto-allocated-topology   | Auto Allocated Topology Services              |
| binding                   | Port Binding                                  |
| agent                     | agent                                         |
| subnet_allocation         | Subnet Allocation                             |
| dhcp_agent_scheduler      | DHCP Agent Scheduler                          |
| tag                       | Tag support                                   |
| external-net              | Neutron external network                      |
| net-mtu                   | Network MTU                                   |
| network-ip-availability   | Network IP Availability                       |
| quotas                    | Quota management support                      |
| provider                  | Provider Network                              |
| multi-provider            | Multi Provider Network                        |
| address-scope             | Address scope                                 |
| timestamp_core            | Time Stamp Fields addition for core resources |
| extra_dhcp_opt            | Neutron Extra DHCP opts                       |
| security-group            | security-group                                |
| rbac-policies             | RBAC Policies                                 |
| standard-attr-description | standard-attr-description                     |
| port-security             | Port Security                                 |
| allowed-address-pairs     | Allowed Address Pairs                         |
+---------------------------+-----------------------------------------------+

[root@controller ~]# neutron agent-list
+-------------------+-------------------+------------+-------------------+-------+----------------+---------------------+
| id                | agent_type        | host       | availability_zone | alive | admin_state_up | binary              |
+-------------------+-------------------+------------+-------------------+-------+----------------+---------------------+
| 07a9d1c6-c8ee-448 | DHCP agent        | controller | nova              | :-)   | True           | neutron-dhcp-agent  |
| 5-ac45-91d8e4bdbd |                   |            |                   |       |                |                     |
| c2                |                   |            |                   |       |                |                     |
| 1c0296e7-ca1b-    | Metadata agent    | controller |                   | :-)   | True           | neutron-metadata-   |
| 499f-8bda-        |                   |            |                   |       |                | agent               |
| 022200e76081      |                   |            |                   |       |                |                     |
| 4381db53-b540-486 | Linux bridge      | controller |                   | :-)   | True           | neutron-            |
| 4-b4fc-           | agent             |            |                   |       |                | linuxbridge-agent   |
| 36fbdc34e58e      |                   |            |                   |       |                |                     |
| cb14378d-667f-480 | Linux bridge      | compute1   |                   | :-)   | True           | neutron-            |
| 9-9c56-cbcea696e5 | agent             |            |                   |       |                | linuxbridge-agent   |
| 76                |                   |            |                   |       |                |                     |
+-------------------+-------------------+------------+-------------------+-------+----------------+---------------------+