OpenStack_Rocky版-6.安装Neutron服务(控制节点)

1.网络服务neutron安装及配置

1.1 安装配置控制节点

1.1.1 创建数据库及用户

[root@controller ~]# mysql -uroot -p000000
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 76
Server version: 10.1.20-MariaDB MariaDB Server

Copyright (c) 2000, 2016, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]> CREATE DATABASE neutron;
Query OK, 1 row affected (0.00 sec)

MariaDB [(none)]> GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'localhost' IDENTIFIED BY '000000';
Query OK, 0 rows affected (0.00 sec)

MariaDB [(none)]> GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'%' IDENTIFIED BY '000000';
Query OK, 0 rows affected (0.00 sec)

1.1.2 创建neutron用户(密码000000)

[root@controller ~]# openstack user create --domain default --password 000000 neutron

1.1.3 添加admin角色到neutron用户

[root@controller ~]# openstack role add --project service --user neutron admin

1.1.4 创建neutron服务实体

[root@controller ~]# openstack service create --name neutron --description "OpenStack Networking" network

1.1.5 创建网络服务API端点

[root@controller ~]# openstack endpoint create --region RegionOne network public http://controller:9696
[root@controller ~]# openstack endpoint create --region RegionOne network internal http://controller:9696
[root@controller ~]# openstack endpoint create --region RegionOne network admin http://controller:9696

1.2 配置网络

Networking Option 1：Provide networks
Networking Option 2：Self-service networks
openstack提供了两种体系结构来部署网络服务

第一个部署了仅支持将实例附加到提供者(外部)网络的最简单的可能架构。没有自助服务(专用)网络，路由器或浮动IP地址。
只有管理员或其他特权用户才能管理提供商网络

第二个在第一个的基础上增加了支持将实例附加到自助服务网络的第三层服务。
普通用户或其他非特权用户可以管理自助服务网络，包括提供自助服务和提供商网络之间连接的路由器。
此外，浮动IP地址可提供与使用来自外部网络的自助服务网络的实例连接。自助服务网络通常使用隧道网络。隧道网络协议(如VXLAN)，还支持将实例附加到提供商网络。

这里选择使用Networking Option 2：Self-service networks

1.2.1 配置Self-service networks

1.安装组件

[root@controller ~]# yum install openstack-neutron openstack-neutron-ml2 openstack-neutron-linuxbridge ebtables

2.配置服务组件

[root@controller ~]# cp /etc/neutron/neutron.conf{,.bak}
[root@controller ~]# grep -Ev '^$|#' /etc/neutron/neutron.conf.bak > /etc/neutron/neutron.conf
[root@controller ~]# vim /etc/neutron/neutron.conf
[database]
connection = mysql+pymysql://neutron:000000@controller/neutron
[DEFAULT]
core_plugin = ml2
service_plugins = router
allow_overlapping_ips = true
transport_url = rabbit://openstack:000000@controller
auth_strategy = keystone
notify_nova_on_port_status_changes = true
notify_nova_on_port_data_changes = true
[keystone_authtoken]
auth_uri = http://controller:5000
auth_url = http://controller:35357
memcached_servers = controller:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = neutron
password = 000000
[nova]
auth_url = http://controller:35357
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = nova
password = 000000
[oslo_concurrency]
lock_path = /var/lib/neutron/tmp

3.配置网络二层插件

[root@controller ~]# cp /etc/neutron/plugins/ml2/ml2_conf.ini{,.bak}
[root@controller ~]# grep -Ev '$^|#' /etc/neutron/plugins/ml2/ml2_conf.ini.bak > /etc/neutron/plugins/ml2/ml2_conf.ini
[root@controller ~]# vim /etc/neutron/plugins/ml2/ml2_conf.ini
[ml2]
type_drivers = flat,vlan,vxlan
tenant_network_types = vxlan #租户创建的默认网络类型
mechanism_drivers = linuxbridge,l2population
extension_drivers = port_security
[ml2_type_flat]
flat_networks = provider 
[ml2_type_vlan]
network_vlan_ranges = provider:1001:2000 #VLAN范围(租户)
[ml2_type_vxlan] #VXLAN范围(租户)
vni_ranges = 1:1000
[securitygroup]
enable_ipset = true

4.配置linux网桥代理

[root@controller ~]# cp /etc/neutron/plugins/ml2/linuxbridge_agent.ini{,.bak}
[root@controller ~]# grep -Ev '^$|#' /etc/neutron/plugins/ml2/linuxbridge_agent.ini.bak > /etc/neutron/plugins/ml2/linuxbridge_agent.ini
[root@controller ~]# vim /etc/neutron/plugins/ml2/linuxbridge_agent.ini
[linux_bridge] # vlan network 与物理网卡的对应关系
physical_interface_mappings = provider:ens32
#这里的ens32物理网卡是外部网络的网卡
[vxlan]
# 启用vxlan隧道网络，配置处理隧道网络的物理网络接口的IP地址，并启用
enable_vxlan = true
local_ip = 192.168.2.10 #这里的ip地址192.168.2.10为隧道网络的ip地址
l2_population = true
[securitygroup]
enable_security_group = true
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver

5.配置内核支持网桥过滤

[root@controller ~]# vim /usr/lib/sysctl.d/00-system.conf 
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
[root@controller ~]# sysctl -p

6.配置三层代理

[root@controller ~]# cp /etc/neutron/l3_agent.ini{,.bak}
[root@controller ~]# grep -Ev '^$|#' /etc/neutron/l3_agent.ini.bak > /etc/neutron/l3_agent.ini
[root@controller ~]# vim /etc/neutron/l3_agent.ini
[DEFAULT]
interface_driver = linuxbridge

7.配置DHCP agent

[root@controller ~]# cp /etc/neutron/dhcp_agent.ini{,.bak}
[root@controller ~]# grep -Ev '^$|#' /etc/neutron/dhcp_agent.ini.bak > /etc/neutron/dhcp_agent.ini
[root@controller ~]# vim /etc/neutron/dhcp_agent.ini
[DEFAULT]
interface_driver = linuxbridge
dhcp_driver = neutron.agent.linux.dhcp.Dnsmasq
enable_isolated_metadata = true

8.配置metadata

[root@controller ~]# vim /etc/neutron/metadata_agent.ini
[DEFAULT]
nova_metadata_host = controller
metadata_proxy_shared_secret = 000000
[root@controller ~]# vim /etc/nova/nova.conf
[neutron]
url = http://controller:9696
auth_url = http://controller:35357
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = neutron
password = 000000
service_metadata_proxy = true
metadata_proxy_shared_secret = 000000

1.2.2 完成安装启动服务

1.创建软连接

[root@controller ~]# ln -s /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugin.ini

2.同步数据库

[root@controller neutron]# su -s /bin/sh -c "neutron-db-manage --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade head" neutron

3.重启nova-api

[root@controller ~]# systemctl restart openstack-nova-api.service

4.启动服务

[root@controller ~]# systemctl enable neutron-server.service neutron-linuxbridge-agent.service neutron-dhcp-agent.service neutron-metadata-agent.service
[root@controller ~]# systemctl start neutron-server.service neutron-linuxbridge-agent.service neutron-dhcp-agent.service neutron-metadata-agent.service      
[root@controller ~]# systemctl enable neutron-l3-agent.service && systemctl start neutron-l3-agent.service