network

安装控制节点
mysql -u root -p
create database neutronp;
grant all privileges privileges on neutron.* to 'neutron'@'localhost'
identified by 'neutron_dbpass';
grant all privileges privileges on neutron.* to 'neutron'@'%'
identified by 'neutron_dbpass';
. admin-openrc
openstack user create --domain default  --passeord-prompt  neutron

openstack role add  --project service --user neutron admin
 
create service create --name neutron --description "Openstack Networking" Network
openstack enpoint create --region regionOne network public http://controller:9696
openstack enpoint create --region regionOne network internal http://controller:9696
openstack enpoint create --region regionOne network admin http://controller:9696
 配置私有网络
yum install openstack-neutron openstack-neutron-ml2
openstaco-neutron-linux-linuxbrige ebtales

配置服务组件
/etc/neutron/neutron.conf
[database]
connection = mysql+pymysql://neutron:dbpass@controller/neutron
[default] 启用Modular Layyer2 (ML2)插件，路由服务和重叠的地址
core_plugin = ml2
service_plugins=router
allow_overlapping_ips = True
配置 消息队列的连接：
[DEFAULT]
...
rpc_backend = rabbit

[oslo_messaging_rabbit]
...
rabbit_host = controller
rabbit_userid = openstack
rabbit_password = RABBIT_PASS

配置认证服务访问：

[DEFAULT]
...
auth_strategy = keystone

[keystone_authtoken]
...
auth_uri = http://controller:5000
auth_url = http://controller:35357
memcached_servers = controller:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = neutron
password = NEUTRON_PASS  //删除其他内容

 

[default] [nova]配置网络服务来通知计算节点的网络拓扑变化
[default]
notify_nova_on_port_status_changes = True
notify_nova_on_port_data_changes  = True
[nova]
auth_url = http://controller:35357
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = nova
password = NOVA_PASS
  [oslo_concurrency]
lock_path = /etc/lib/neutron/tmp

配置ML2 插件
/etc/neutron/plugins/ml2/ml2.conf.ini

[ml2]
type_dirves=flat,vlan,vxlan  //启用flat VLAN 以及vxlan 网络

 tenant_network_types=vxlan   //启用私有网络 (tenant)私有的

mechainsm-dirvers = linuxbridge,12population      启用LinxuBridge 和Layer-2 机制 ！删除可能导致数据库不一致的“type_dirves”的值  linuxbridge 只支持vxlan
extention_dirvers = port_security     //启用端口安全扩展驱动

[ml2_type_flat]   //配置公共虚拟网络为flat网络
[ml2_type_flat]  
 flat_networks = provoder

[ml2_type_vxlan] 私有网络范围
 vni_ranges = 1:1000
[securitygroup]
 enable_ipset = true  //启用ipset 提高安全组规则的高效性

配置LinuxBridge 代理
 
/etc/neutron/plugins/ml2/linuxbridge_agent.ini
 
[linuxbridge]  //将公共网络的虚拟和物理对接起来
 
pysical_interface_mappings = provider:(controller's 外网卡)

[vxlan] 启用vxlan 覆盖网络 配置覆盖网络的物理地址  启用lay-2population
[vxlan]
enable_vxlan = True
local_ip = (controller ’s internal address)
l2_population = True

[securitygroup] 启用安全组 并配置Firewall

[securitygroup]
...
enable_security_group = True
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver

配置lay-3代理
 /etc/neutron/l3_agent.ini
[default]  配置网桥接口驱动和外部网络网桥

[default]
interface_dirver = neutron.agent.linux.interface.BridgeInterfaceDriver
external_network_bridge=    设为缺省值 允许多种外部网络

配置DHCP代理

/etc/neutron/dhcp_agent.ini
 [default] // 配置桥接驱动接口 DHCP 驱动并启用隔离元数据 这样在公共网络上的实例就可以通过网络来访问元数据

[DEFAULT]
...
interface_driver = neutron.agent.linux.interface.BridgeInterfaceDriver
dhcp_driver = neutron.agent.linux.dhcp.Dnsmasq
enable_isolated_metadata = True

配置元数据代理
vi /etc/neutron/metadata_agent.ini
[default] //配置元数据主机以及共享密码
nova_metadate_ip= controller
metadata_proxy_shared_secret = 000000

为计算节点配置网络服务
/etc/nova/nova.conf
[neutron]  配置访问参数，启用元数据代理并设置密码
[neutron]
...
url = http://controller:9696
auth_url = http://controller:35357
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = neutron
password = NEUTRON_PASS

service_metadata_proxy = True
metadata_proxy_shared_secret = 000000

1.网络服务初始化脚本需要一个超链接 /etc/neutron/plugin.ini``指向ML2插件配置文件/etc/neutron/plugins/ml2/ml2_conf.ini``。如果超链接不存在，使用下面的命令创建它：
ln -s /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugin.ini

su -s /bin/sh -c "neutron-db-manage --config-file /etc/neutron/neutron.conf \
  --config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade head" neutron

systemctl restart openstack-nova-api.service  重启计算API
systemctl enable neutron-server.service \
  neutron-linuxbridge-agent.service neutron-dhcp-agent.service \
  neutron-metadata-agent.service neutron-l3-agent.service

systemctl start neutron-server.service \
  neutron-linuxbridge-agent.service neutron-dhcp-agent.service \
  neutron-metadata-agent.service neutron-l3-agent.service

配置计算节点

yum install openstack-neutron-linuxbridge ebtables ipset
Networking 通用组件的配置包括认证机制、消息队列和插件。
vi /etc/neutron/neutron.conf
[database]  注释所有connection 项
[DEFAULT]
...
rpc_backend = rabbit

[oslo_messaging_rabbit]
...
rabbit_host = controller
rabbit_userid = openstack
rabbit_password = RABBIT_PASS
认证服务
[DEFAULT]
...
auth_strategy = keystone

[keystone_authtoken] //删除其他
...
auth_uri = http://controller:5000
auth_url = http://controller:35357
memcached_servers = controller:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = neutron
password = NEUTRON_PASS
 
◦在 [oslo_concurrency] 部分，配置锁路径：
[oslo_concurrency]
lock_path = /var/lib/neutron/tmp

配置网络
 
配置桥接代理
vi /etc/neutron/plugins/ml2/linuxbridge_agent.ini

 ◦在``[linux_bridge]``部分，将公共虚拟网络和公共物理网络接口对应起来：

linux_bridge]
physical_interface_mappings = provider:eno1666
◦在``[vxlan]``部分，启用VXLAN覆盖网络，配置覆盖网络的物理网络接口的IP地址，启用layer－2 population：

[vxlan]
enable_vxlan = True
local_ip =  控制内网ip
l2_population = True

[securitygroup]  启用安全组
enable_security_group = True
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver

为计算节点配置网络

vi /etc/nova/nova.conf

[neutron]

url = http://controller:9696
auth_url = http://controller:35357
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = neutron
password = NEUTRON_PASS

systemctl restart opentack-nova-compute
systemctl enable neutron-linuxbridge-agent.service
systemctl start neutron-linuxbridge-agent.service
 
验证操作

. admin-openrc
 neutron ext-list
neutron agent-list