Centos7 OpenStack的部署之Neutron的构建

Neutron的概述

Neutron是OpenStack平台中负责提供网络服务的组件

Neutron的组件分类

• Neutron-server（接收用户的请求，通过消息队列告知Plugin处理请求）
• Plugin（处理Neutron-server的请求，维护网络状态，调用Agent处理请求）
• Agent（处理Plugin的请求，实现Network Provider上的各种网络功能 最终创建网络是由这个组件完成）
• Network Provider（提供网络的虚拟设备或者物理设备，比如：Linux Bridge，OpenVSwitch或者其他支持Neutron的物理交换机[网络功能是在这上面来实现的]）
• Queue（消息队列，组件之间沟通的桥梁）
• Database（存放OpenStack的网络状态信息，包括Network，Subnet，Port，Router等）

Plugin、Agent、Network Provider 是配套进行使用的，比如Network Provider采用的是Linux Bridge ，那么Plugin 和 Agent就必须采用Linux Bridge里面Plugin Agent

Neutron的部署

测试环境

主机	IP地址
controller	ens33:192.168.1.10 ens37:192.168.2.10
compute	ens33:192.168.1.20 ens37:192.168.2.20

controller节点的配置

创建neutron数据库

[root@controller ~]# mysql -uroot -p 
MariaDB [(none)]> create database neutron;
Query OK, 1 row affected (0.01 sec)

MariaDB [(none)]> grant all privileges on neutron.* to 'neutron'@'localhost' identified by 'neutron';
Query OK, 0 rows affected (0.06 sec)

MariaDB [(none)]> grant all privileges on neutron.* to 'neutron'@'%' identified by 'neutron';
Query OK, 0 rows affected (0.00 sec)

创建neutron用户以及角色权限的赋予

[root@controller ~]# openstack user create --domain default --password neutron neutron 
+---------------------+----------------------------------+
| Field               | Value                            |
+---------------------+----------------------------------+
| domain_id           | 81bf28300f9c474d9d26d64ec2c751f4 |
| enabled             | True                             |
| id                  | bf29ec2d1fb24dc58ad412f981e98979 |
| name                | neutron                          |
| options             | {}                               |
| password_expires_at | None                             |
+---------------------+----------------------------------+
[root@controller ~]# openstack role add --project service --user neutron admin 

创建neutron服务实体以及端点信息

[root@controller ~]# openstack service create --name neutron --description "Openstack Networking" network 
+-------------+----------------------------------+
| Field       | Value                            |
+-------------+----------------------------------+
| description | Openstack Networking             |
| enabled     | True                             |
| id          | ccc2a0cf729449d395b99b1bdc5d55aa |
| name        | neutron                          |
| type        | network                          |
+-------------+----------------------------------+

创建公有端点信息（public）
[root@controller ~]# openstack endpoint create --region RegionOne network public http://controller:9696 
+--------------+----------------------------------+
| Field        | Value                            |
+--------------+----------------------------------+
| enabled      | True                             |
| id           | 621dc8bfa97e41bb9d63d0ccefd821e4 |
| interface    | public                           |
| region       | RegionOne                        |
| region_id    | RegionOne                        |
| service_id   | ccc2a0cf729449d395b99b1bdc5d55aa |
| service_name | neutron                          |
| service_type | network                          |
| url          | http://controller:9696           |
+--------------+----------------------------------+

创建私有端点信息（internal）
[root@controller ~]# openstack endpoint create --region RegionOne network internal http://controller:9696 
+--------------+----------------------------------+
| Field        | Value                            |
+--------------+----------------------------------+
| enabled      | True                             |
| id           | 9156be5827464303ae2e8f3f58a023df |
| interface    | internal                         |
| region       | RegionOne                        |
| region_id    | RegionOne                        |
| service_id   | ccc2a0cf729449d395b99b1bdc5d55aa |
| service_name | neutron                          |
| service_type | network                          |
| url          | http://controller:9696           |
+--------------+----------------------------------+

创建admin管理员端点信息
[root@controller ~]# openstack endpoint create --region RegionOne network admin  http://controller:9696 
+--------------+----------------------------------+
| Field        | Value                            |
+--------------+----------------------------------+
| enabled      | True                             |
| id           | 60c6150bc88945dd8b387c2ea4f48f97 |
| interface    | admin                            |
| region       | RegionOne                        |
| region_id    | RegionOne                        |
| service_id   | ccc2a0cf729449d395b99b1bdc5d55aa |
| service_name | neutron                          |
| service_type | network                          |
| url          | http://controller:9696           |
+--------------+----------------------------------+

安装neutron相关组件包

[root@controller ~]# yum install openstack-neutron openstack-neutron-ml2 openstack-neutron-linuxbridge ebtables -y

配置neutron的配置文件

配置数据库连接
[root@controller ~]# vi /etc/neutron/neutron.conf 
[database]
729 connection = mysql+pymysql://neutron:neutron@controller/neutron

配置keystone用户认证信息
[keystone_authtoken]
847 auth_uri = http://controller:5000
848 auth_url = http://controller:35357
898 memcached_servers = controller:11211
1006 project_domain_name = default
1007 user_domain_name = default
1008 project_name = service
1009 username = neutron
1010 password = neutron

[DEFAULT]
27 auth_strategy = keystone

配置rabbitmq消息队列
577 rpc_backend = rabbit
1535 rabbit_host = controller
1544 rabbit_port = 5672
1556 rabbit_userid = guest
1562 rabbit_password = guest

neutron核心配置，启用ML2插件并禁用其他插件
[DEFAULT]
30 core_plugin = ml2
33 service_plugins =
备注：service_plugins等号后面什么都不写就是禁用其他插件

配置网络服务来通知计算节点的网络拓扑变化
[DEFAULT]
98 notify_nova_on_port_status_changes = true
102 notify_nova_on_port_data_changes = true
[nova]
1086 auth_url = http://controller:35357
1090 auth_type = password
1091 project_domain_name = default
1092 user_domain_name = default
1093 region_name = RegionOne
1094 project_name = service
1095 username = nova
1096 password = nova

配置锁路径
[oslo_concurrency]
1186 lock_path = /var/lib/neutron/tmp

配置Modular Layer 2 （ML2）
[root@controller ~]# vi /etc/neutron/plugins/ml2/ml2_conf.ini
驱动的选择
[ml2]
136 type_drivers = flat,vlan,gre,vxlan,geneve

使用什么插件来创建网络
145 mechanism_drivers = linuxbridge,openvswitch

禁用私有网络（租户的网络类型）
141 tenant_network_types = 

启动端口安全扩展驱动
150 extension_drivers = port_security

配置公共的网络
[ml2_type_flat]
186 flat_networks = public

在 [securitygroup]部分，启用 ipset增加安全组规则的高效性
[securitygroup]
263 enable_ipset = true

配置Linuxbridge代理
[root@controller ~]# vi /etc/neutron/plugins/ml2/linuxbridge_agent.ini 
[linux_bridge]
157 physical_interface_mappings = public:ens33

在[vxlan]部分，禁止VXLAN覆盖网络
[vxlan]
212 enable_vxlan = false

在[securitygroup]部分，启用安全组并配置防火墙驱动
93 enable_security_group = true
188 firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDr        iver

配置DHCP代理
[root@controller ~]# vi /etc/neutron/dhcp_agent.ini
配置Linuxbridge驱动接口，DHCP驱动并启用隔离元数据，这样在公共网络上的实例就可以通过网络来访问元数据
[DEFAULT]
16 interface_driver = neutron.agent.linux.interface.BridgeInterfaceDriver
28 dhcp_driver = neutron.agent.linux.dhcp.Dnsmasq
37 enable_isolated_metadata = true

配置元数据代理
在[DEFAULT]部分，配置元数据主机以及共享密码
[root@controller ~]# vi /etc/neutron/metadata_agent.ini 
[DEFAULT]
22 nova_metadata_host = controller      元数据主机
34 metadata_proxy_shared_secret = controller  共享密码

为nova-api配置网络服务
在[neutron]部分，配置访问参数
[root@controller ~]# vi /etc/nova/nova.conf
[neutron]
7622 url=http://controller:9696
7698 auth_url=http://controller:35357
7692 auth_type=password
7693 project_domain_name = default
7694 user_domain_name = default
7695 region_name = RegionOne
7696 project_name = service
7697 username = neutron
7698 password = neutron

在[neutron]部分，启用元数据代理并设置密码
[neutron]
7661 service_metadata_proxy=true
7673 metadata_proxy_shared_secret = controller

初始化数据库

[root@controller ~]# ln -s /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugin.ini 
[root@controller ~]# su -s /bin/sh -c "neutron-db-manage --config-file /etc/neutron/neutron.conf  --config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade head" neutron

重启Nova API 服务

[root@controller ~]# systemctl restart openstack-nova-api.service

启动Neutron服务并配置开机自启动

[root@controller ~]# systemctl enable neutron-server.service neutron-linuxbridge-agent.service neutron-dhcp-agent.service neutron-metadata-agent.service

[root@controller ~]# systemctl start neutron-server.service neutron-linuxbridge-agent.service neutron-dhcp-agent.service neutron-metadata-agent.service

检查neutron是否安装成功

[root@controller ~]# openstack network agent list
+--------------------------------------+--------------------+------------+-------------------+-------+-------+---------------------------+
| ID                                   | Agent Type         | Host       | Availability Zone | Alive | State | Binary                    |
+--------------------------------------+--------------------+------------+-------------------+-------+-------+---------------------------+
| 19549127-403a-4d77-9bea-8466a8716e37 | Linux bridge agent | controller | None              | :-)   | UP    | neutron-linuxbridge-agent |
| 385c5f75-d4f7-4d29-8556-5181b8a754a2 | Metadata agent     | controller | None              | :-)   | UP    | neutron-metadata-agent    |
| 9c8ef131-6136-403f-835a-1e5d96749d87 | DHCP agent         | controller | nova              | :-)   | UP    | neutron-dhcp-agent        |
+--------------------------------------+--------------------+------------+-------------------+-------+-------+---------------------------+

compute节点的部署

安装相关软件包

[root@compute ~]# yum install openstack-neutron-linuxbridge ebtables ipset net-tools -y

修改配置文件

复制controller配置文件过来进行修改即可
[root@controller ~]# scp /etc/neutron/neutron.conf root@compute:/etc/neutron/neutron.conf 

配置Neutron服务
[root@compute ~]# vi /etc/neutron/neutron.conf 
注释以下选项
#connection = mysql+pymysql://neutron:neutron@controller/neutron

30 #core_plugin = ml2
33 #service_plugins =

98 #notify_nova_on_port_status_changes = true
102 #notify_nova_on_port_data_changes = true

为nova计算节点配置网络服务

[root@compute ~]# vi /etc/nova/nova.conf 
[neutron]
7622 url=http://controller:9696
7698 auth_url=http://controller:35357
7699 auth_type = password
7700 project_domain_name = default 
7701 user_domain_name = default
7702 region_name = RegionOne
7703 project_name = service
7704 username = neutron
7705 password = neutron

配置Linuxbridge代理

[root@compute ~]# vi /etc/neutron/plugins/ml2/linuxbridge_agent.ini 
157 physical_interface_mappings = public:ens33
212 enable_vxlan = false
188 firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDr        iver
193 enable_security_group = true

重启计算节点nova-compute

[root@compute ~]# systemctl restart openstack-nova-compute.service
启动Linuxbridge代理并配置它开机自启动
[root@compute ~]# systemctl start neutron-linuxbridge-agent.service
[root@compute ~]# systemctl enable  neutron-linuxbridge-agent.service

控制节点查看是否生效

[root@controller ~]# openstack network agent list 
+--------------------------------------+--------------------+------------+-------------------+-------+-------+---------------------------+
| ID                                   | Agent Type         | Host       | Availability Zone | Alive | State | Binary                    |
+--------------------------------------+--------------------+------------+-------------------+-------+-------+---------------------------+
| 19549127-403a-4d77-9bea-8466a8716e37 | Linux bridge agent | controller | None              | :-)   | UP    | neutron-linuxbridge-agent |
| 385c5f75-d4f7-4d29-8556-5181b8a754a2 | Metadata agent     | controller | None              | :-)   | UP    | neutron-metadata-agent    |
| 9c8ef131-6136-403f-835a-1e5d96749d87 | DHCP agent         | controller | nova              | :-)   | UP    | neutron-dhcp-agent        |
| de6a2e73-ec15-4298-b971-6203201944d6 | Linux bridge agent | compute    | None              | :-)   | UP    | neutron-linuxbridge-agent |
+--------------------------------------+--------------------+------------+-------------------+-------+-------+---------------------------

至此，Neutron网络服务部署完成