Openstack Train配置手册-07Neutron网络实现

3.1 拓扑

------------+---------------------------+---------------------------+------------ | | | eth0|192.168.10.11 eth0|192.168.10.12 eth0|192.168.10.13 +-----------+-----------+ +-----------+-----------+ +-----------+-----------+ | [ Control Node ] | | [ Network Node ] | | [ Compute Node ] | | [node1.1000cc.net] | | [node1.1000cc.net] | | [node1.1000cc.net] | | MariaDB RabbitMQ | | Open vSwitch | | Libvirt | | Memcached httpd | | L2 Agent | | Nova Compute | | Keystone Glance | | L3 Agent | | Open vSwitch | | Nova API | | Metadata Agent | | L2 Agent | | Neutron Server | | | | | | Metadata Agent | | | | | +-----------------------+ +-----------+-----------+ +-----------------------+ |eth1

3.2 配置及实现VxLAN

1) 配置Controll节点 (1) 配置ML2 [root@node1 ~(keystone)]# vim /etc/neutron/plugins/ml2/ml2_conf.ini ...... ...... ...... ...... ...... ...... # 于文件最后，设定租户网络类型 [ml2] type_drivers = flat,vlan,gre,vxlan tenant_network_types = vxlan # 并定义物理网络信息 [ml2_type_flat] flat_networks = physnet1 # 定义vxlanID [ml2_type_vxlan] vni_ranges = 1:1000 (2) 重启Neutron服务 [root@node1 ~(keystone)]# systemctl restart neutron-server 2) 配置Network节点 (1) 创建桥接,以允许Vxlan与物理网络映射 # 添加桥接设备br0 [root@node3 ~]# ovs-vsctl add-br br0 # 将eth1加入至桥接设备br0 [root@node3 ~]# ovs-vsctl add-port br0 eth1 (2) 配置ML2 [root@node3 ~]# vim /etc/neutron/plugins/ml2/ml2_conf.ini ...... ...... ...... ...... ...... ...... # 于文件最底部,设定租户网络类型 [ml2] type_drivers = flat,vlan,gre,vxlan tenant_network_types = vxlan ...... ...... # 定义物理网络信息 [ml2_type_flat] flat_networks = physnet1 # 定义vxlanID [ml2_type_vxlan] vni_ranges = 1:1000 (3) 配置ovs代理 [root@node3 ~]# vim /etc/neutron/plugins/ml2/openvswitch_agent.ini ...... ...... ...... ...... ...... ...... # 于文件最底部，添加如下内容 [agent] tunnel_types = vxlan prevent_arp_spoofing = True # 并定义本地IP地址及网络映射 [ovs] local_ip = 192.168.10.13 bridge_mappings = physnet1:br0 (4) 重启服务 [root@node3 ~]# systemctl restart neutron-dhcp-agent neutron-l3-agent neutron-metadata-agent neutron-openvswitch-agent # 关闭防火墙 [root@node3 ~]# systemctl disable --now firewalld 3) 配置Compute节点 (1) 配置ML2 [root@node2 ~]# vim /etc/neutron/plugins/ml2/ml2_conf.ini ...... ...... ...... ...... ...... ...... # 于文件最底部，定义租户网络类型 [ml2] type_drivers = flat,vlan,gre,vxlan tenant_network_types = vxlan # 定义物理网络信息 [ml2_type_flat] flat_networks = physnet1 # 定义VxLAN ID范围 [ml2_type_vxlan] vni_ranges = 1:1000 (2) 配置ovs agent [root@node2 ~]# vim /etc/neutron/plugins/ml2/openvswitch_agent.ini ...... ...... ...... ...... ...... ...... # 于文件最底部,添加VxLAN信息 [agent] tunnel_types = vxlan prevent_arp_spoofing = True # 定义本地IP [ovs] local_ip = 192.168.10.12 [root@node01 ~]# systemctl restart neutron-openvswitch-agent # 关闭防火墙 [root@node01 ~]# systemctl disable --now firewalld

3.3 创建VxLAN(控制节点)

1) 创建路由(由VxLAN至物理网络vRouter) [root@node1 ~(keystone)]# openstack router create r1 +-------------------------+--------------------------------------+ | Field | Value | +-------------------------+--------------------------------------+ | admin_state_up | UP | | availability_zone_hints | | | availability_zones | | | created_at | 2020-03-02T18:38:26Z | | description | | | distributed | False | | external_gateway_info | None | | flavor_id | None | | ha | False | | id | e36d0ac6-fa95-43d7-96e3-fdf9765173ec | | location | cloud='', project.domain_id=,...... | | name | r1 | | project_id | 558ed85c8f84439a876cfd35150d0fe1 | | revision_number | 1 | | routes | | | status | ACTIVE | | tags | | | updated_at | 2020-03-02T18:38:26Z | +-------------------------+--------------------------------------+ 2) 创建inet_net(vNetwork)类型为vxlan [root@node1 ~(keystone)]# openstack network create int_net --provider-network-type vxlan +---------------------------+--------------------------------------+ | Field | Value | +---------------------------+--------------------------------------+ | admin_state_up | UP | | availability_zone_hints | | | availability_zones | | | created_at | 2020-03-02T18:39:40Z | | description | | | dns_domain | None | | id | 67c8409d-4051-4cc5-a3d1-5a17151e800e | | ipv4_address_scope | None | | ipv6_address_scope | None | | is_default | False | | is_vlan_transparent | None | | location | cloud='', project.domain_id=,...... | | mtu | 1450 | | name | int_net | | port_security_enabled | False | | project_id | 558ed85c8f84439a876cfd35150d0fe1 | | provider:network_type | vxlan | | provider:physical_network | None | | provider:segmentation_id | 95 | | qos_policy_id | None | | revision_number | 1 | | router:external | Internal | | segments | None | | shared | False | | status | ACTIVE | | subnets | | | tags | | | updated_at | 2020-03-02T18:39:40Z | +---------------------------+--------------------------------------+ 3) 创建vNetwork子网 [root@node1 ~(keystone)]# openstack subnet create subnet1 \ --network int_net \ --subnet-range 192.168.188.0/24 \ --gateway 192.168.188.1 \ --dns-nameserver 192.168.10.10 +-------------------+--------------------------------------+ | Field | Value | +-------------------+--------------------------------------+ | allocation_pools | 192.168.188.2-192.168.188.254 | | cidr | 192.168.188.0/24 | | created_at | 2020-03-02T18:41:35Z | | description | | | dns_nameservers | 192.168.10.10 | | enable_dhcp | True | | gateway_ip | 192.168.188.1 | | host_routes | | | id | 5d951598-e4aa-4932-8410-fcf94e520747 | | ip_version | 4 | | ipv6_address_mode | None | | ipv6_ra_mode | None | | location | cloud='', project.domain_id=,...... | | name | subnet1 | | network_id | 67c8409d-4051-4cc5-a3d1-5a17151e800e | | prefix_length | None | | project_id | 558ed85c8f84439a876cfd35150d0fe1 | | revision_number | 0 | | segment_id | None | | service_types | | | subnetpool_id | None | | tags | | | updated_at | 2020-03-02T18:41:35Z | +-------------------+--------------------------------------+ 4) 将子网subne1与vRouer(r1)相连 [root@node1 ~(keystone)]# openstack router add subnet r1 subnet1 5) 创建flat扩展网络physnet1 [root@node1 ~(keystone)]# openstack network create \ --provider-physical-network physnet1 \ --provider-network-type flat \ --external ext_net +---------------------------+--------------------------------------+ | Field | Value | +---------------------------+--------------------------------------+ | admin_state_up | UP | | availability_zone_hints | | | availability_zones | | | created_at | 2020-03-02T18:43:10Z | | description | | | dns_domain | None | | id | 28c92a79-3ec6-460e-ae64-f486dc088063 | | ipv4_address_scope | None | | ipv6_address_scope | None | | is_default | False | | is_vlan_transparent | None | | location | cloud='', project.domain_id=, ...... | | mtu | 1500 | | name | ext_net | | port_security_enabled | False | | project_id | 558ed85c8f84439a876cfd35150d0fe1 | | provider:network_type | flat | | provider:physical_network | physnet1 | | provider:segmentation_id | None | | qos_policy_id | None | | revision_number | 4 | | router:external | External | | segments | None | | shared | False | | status | ACTIVE | | subnets | | | tags | | | updated_at | 2020-03-02T18:43:10Z | +---------------------------+--------------------------------------+ 6) 创建flat子网subnet2,并划分地址及相关信息，实例IP由手工指定，关闭DHCP [root@node1 ~(keystone)]# openstack subnet create subnet2 \ --network ext_net \ --subnet-range 192.168.10.0/24 \ --allocation-pool start=192.168.10.220,end=192.168.10.229 \ --gateway 192.168.10.1 \ --dns-nameserver 192.168.10.10 \ --no-dhcp +-------------------+--------------------------------------+ | Field | Value | +-------------------+--------------------------------------+ | allocation_pools | 192.168.10.220-192.168.10.229 | | cidr | 192.168.10.0/24 | | created_at | 2020-03-02T18:44:20Z | | description | | | dns_nameservers | 192.168.10.10 | | enable_dhcp | False | | gateway_ip | 192.168.10.1 | | host_routes | | | id | 6d8669f5-dae0-4240-9b80-49c21218cd1a | | ip_version | 4 | | ipv6_address_mode | None | | ipv6_ra_mode | None | | location | cloud='', project.domain_id=, ...... | | name | subnet2 | | network_id | 28c92a79-3ec6-460e-ae64-f486dc088063 | | prefix_length | None | | project_id | 558ed85c8f84439a876cfd35150d0fe1 | | revision_number | 0 | | segment_id | None | | service_types | | | subnetpool_id | None | | tags | | | updated_at | 2020-03-02T18:44:20Z | +-------------------+--------------------------------------+ 7) 将子网subne2与vRouer(r1)相连 [root@node1 ~(keystone)]# openstack router set r1 --external-gateway ext_net 8) 授权网络访问 # 默认情况下，所有项目都可以访问外部网络，但对于内部网络，只有管理项目可以访问它，因此请将内部网络的访问权限授予希望让项目中的用户使用的项目。 [root@node1 ~(keystone)]# openstack network rbac list +--------------------------------------+-------------+--------------------------------------+ | ID | Object Type | Object ID | +--------------------------------------+-------------+--------------------------------------+ | 6a835c06-11de-45df-8b4c-1a311514ed4a | network | 28c92a79-3ec6-460e-ae64-f486dc088063 | +--------------------------------------+-------------+--------------------------------------+ [root@node1 ~(keystone)]# openstack network rbac show 6a835c06-11de-45df-8b4c-1a311514ed4a +-------------------+--------------------------------------+ | Field | Value | +-------------------+--------------------------------------+ | action | access_as_external | | id | 6a835c06-11de-45df-8b4c-1a311514ed4a | | location | cloud='', project.domain_id=, ...... | | name | None | | object_id | 28c92a79-3ec6-460e-ae64-f486dc088063 | | object_type | network | | project_id | 558ed85c8f84439a876cfd35150d0fe1 | | target_project_id | * | +-------------------+--------------------------------------+ [root@node1 ~(keystone)]# openstack network list +--------------------------------------+---------+--------------------------------------+ | ID | Name | Subnets | +--------------------------------------+---------+--------------------------------------+ | 28c92a79-3ec6-460e-ae64-f486dc088063 | ext_net | 6d8669f5-dae0-4240-9b80-49c21218cd1a | | 67c8409d-4051-4cc5-a3d1-5a17151e800e | int_net | 5d951598-e4aa-4932-8410-fcf94e520747 | +--------------------------------------+---------+--------------------------------------+ [root@node1 ~(keystone)]# openstack project list +----------------------------------+---------+ | ID | Name | +----------------------------------+---------+ | 558ed85c8f84439a876cfd35150d0fe1 | admin | | 70e9c932884544eea84190f7fb42f9f6 | 1000cc | | 7972f61f4a1c4f2592d2bb6dc7711e81 | service | +----------------------------------+---------+ **授权inet_net访问1000cc租户 [root@node1 ~(keystone)]# netID=$(openstack network list | grep int_net | awk '{ print $2 }') [root@node1 ~(keystone)]# prjID=$(openstack project list | grep 1000cc | awk '{ print $2 }') [root@node1 ~(keystone)]# openstack network rbac create \ --target-project $prjID \ --type network \ --action access_as_shared $netID +-------------------+--------------------------------------+ | Field | Value | +-------------------+--------------------------------------+ | action | access_as_shared | | id | 6c7838c2-578c-4abc-93b8-b16db6517bd9 | | location | cloud='', project.domain_id=, ...... | | name | None | | object_id | 67c8409d-4051-4cc5-a3d1-5a17151e800e | | object_type | network | | project_id | 558ed85c8f84439a876cfd35150d0fe1 | | target_project_id | 70e9c932884544eea84190f7fb42f9f6 | +-------------------+--------------------------------------+

3.4 测试

1) 设定租户管理员环境 [root@node1 ~(keystone)]# su - snow [snow@node1 ~]$ vim keystonerc export OS_PROJECT_DOMAIN_NAME=default export OS_USER_DOMAIN_NAME=default export OS_PROJECT_NAME=1000cc export OS_USERNAME=snow export OS_PASSWORD=userpassword export OS_AUTH_URL=http://192.168.10.11:5000/v3 export OS_IDENTITY_API_VERSION=3 export OS_IMAGE_API_VERSION=2 export PS1='[\u@\h \W(keystone)]\$ ' [snow@node1 ~]$ chmod 600 ~/keystonerc [snow@node1 ~]$ source ~/keystonerc [snow@node1 ~(keystone)]$ echo "source ~/keystonerc " >> ~/.bash_profile 2) 确认实例创建所需要的信息 [snow@node1 ~(keystone)]$ openstack flavor list +----+----------+-----+------+-----------+-------+-----------+ | ID | Name | RAM | Disk | Ephemeral | VCPUs | Is Public | +----+----------+-----+------+-----------+-------+-----------+ | 0 | m1.small | 800 | 5 | 0 | 1 | True | +----+----------+-----+------+-----------+-------+-----------+ [snow@node1 ~(keystone)]$ openstack image list +--------------------------------------+------+--------+ | ID | Name | Status | +--------------------------------------+------+--------+ | d848c42d-801b-437b-a8ab-4b86a67eb584 | c77 | active | +--------------------------------------+------+--------+ [snow@node1 ~(keystone)]$ openstack network list +--------------------------------------+---------+--------------------------------------+ | ID | Name | Subnets | +--------------------------------------+---------+--------------------------------------+ | 28c92a79-3ec6-460e-ae64-f486dc088063 | ext_net | 6d8669f5-dae0-4240-9b80-49c21218cd1a | | 67c8409d-4051-4cc5-a3d1-5a17151e800e | int_net | 5d951598-e4aa-4932-8410-fcf94e520747 | +--------------------------------------+---------+--------------------------------------+ 3) 创建安全组 [snow@node1 ~(keystone)]$ openstack security group create secgroup1 +-----------------+-------------------------------------------------------------------------------+ | Field | Value | +-----------------+-------------------------------------------------------------------------------+ | created_at | 2020-03-02T18:56:35Z | description | secgroup1 | id | 8cbeca34-25f7-45e8-a153-d119d63d250b | location | cloud='', project.domain_id=,...... | name | secgroup1 | project_id | 7146a34d5b744320b2ed45af5b2e761b | revision_number | 1 | rules | created_at='2020-03-02T18:56:35Z', direction='egress', ethertype='IPv4',...... | | created_at='2020-03-02T18:56:35Z', direction='egress', ethertype='IPv6'...... | updated_at | 2020-03-02T18:56:35Z +-----------------+-------------------------------------------------------------------------------+ 4) 设定连接秘钥并添加公钥 [snow@node1 ~(keystone)]$ ssh-keygen -q -N '' Enter file in which to save the key (/home/snow/.ssh/id_rsa): [snow@node1 ~(keystone)]$ openstack keypair create --public-key ~/.ssh/id_rsa.pub snowkey +-------------+-------------------------------------------------+ | Field | Value | +-------------+-------------------------------------------------+ | fingerprint | 71:05:35:30:3c:67:1b:76:5a:04:18:69:97:ba:88:94 | | name | snowkey | | user_id | d3a4d7927ebd4dfb8b6fa00d11f778f0 | +-------------+-------------------------------------------------+ 5) 创建实例 (1) 获取inet_net的ID,作为实例所使用的网络 [snow@node1 ~(keystone)]$ netID=$(openstack network list | grep int_net | awk '{ print $2 }') (2) 创建实例 [snow@node1 ~(keystone)]$ openstack server create \ --flavor m1.small \ --image c77 \ --security-group secgroup1 \ --nic net-id=$netID \ --key-name snowkey \ c7 +-----------------------------+---------------------------------------------+ | Field | Value | +-----------------------------+---------------------------------------------+ | OS-DCF:diskConfig | MANUAL | | OS-EXT-AZ:availability_zone | | | OS-EXT-STS:power_state | NOSTATE | | OS-EXT-STS:task_state | scheduling | | OS-EXT-STS:vm_state | building | | OS-SRV-USG:launched_at | None | | OS-SRV-USG:terminated_at | None | | accessIPv4 | | | accessIPv6 | | | addresses | | | adminPass | tLuPE72x3Lgx | | config_drive | | | created | 2020-03-02T18:59:16Z | | flavor | m1.small (0) | | hostId | | | id | aed6d985-d2e7-4382-8eb6-a602c04c89e6 | | image | c77 (d848c42d-801b-437b-a8ab-4b86a67eb584) | | key_name | snowkey | | name | c7 | | progress | 0 | | project_id | 70e9c932884544eea84190f7fb42f9f6 | | properties | | | security_groups | name='8cbeca34-25f7-45e8-a153-d119d63d250b' | | status | BUILD | | updated | 2020-03-02T18:59:17Z | | user_id | d3a4d7927ebd4dfb8b6fa00d11f778f0 | | volumes_attached | | +-----------------------------+---------------------------------------------+ [snow@node1 ~(keystone)]$ openstack server list +--------------------------------------+------+--------+-----------------------+-------+----------+ | ID | Name | Status | Networks | Image | Flavor | +--------------------------------------+------+--------+-----------------------+-------+----------+ | be6d5223-8374-49e9-8e0c-552559d01143 | c7 | ACTIVE | int_net=192.168.188.5 | c77 | m1.small | +--------------------------------------+------+--------+-----------------------+-------+----------+ 6) 为实例添加floating IP (1) 获取flating ip [snow@node1 ~(keystone)]$ openstack floating ip create ext_net +---------------------+--------------------------------------+ | Field | Value | +---------------------+--------------------------------------+ | created_at | 2020-03-02T19:12:01Z | | description | | | fixed_ip_address | None | | floating_ip_address | 192.168.10.225 | | floating_network_id | 28c92a79-3ec6-460e-ae64-f486dc088063 | | id | 61b25e5b-26a4-427a-82c9-dd9d49c7a322 | | location | Munch({'project': Munch({'domain... | name | 192.168.10.225 | | port_id | None | | project_id | 70e9c932884544eea84190f7fb42f9f6 | | qos_policy_id | None | | revision_number | 0 | | router_id | None | | status | DOWN | | subnet_id | None | | updated_at | 2020-03-02T19:12:01Z | +---------------------+--------------------------------------+ (2) 将flating ip与实例关联 [snow@node1 ~(keystone)]$ openstack server add floating ip c7 192.168.10.225 [snow@node1 ~(keystone)]$ openstack server list +-------+------+--------+---------------------------------------+-------+----------+ | ID | Name | Status | Networks | Image | Flavor | +-------+------+--------+---------------------------------------+-------+----------+ | be6d..| c7 | ACTIVE | int_net=192.168.188.5, 192.168.10.225 | c77 | m1.small | +-------+------+--------+---------------------------------------+-------+----------+ (3) 开放ping及ssh安全组规则 [snow@node1 ~(keystone)]$ openstack security group rule create --protocol icmp --ingress secgroup1 +-------------------+--------------------------------------+ | Field | Value | +-------------------+--------------------------------------+ | created_at | 2020-03-02T19:14:45Z | | description | | | direction | ingress | | ether_type | IPv4 | | id | 5d51d93b-a188-4d6a-9d15-643420f6eae0 | | location | cloud='', project.domain_id=, ...... | | name | None | | port_range_max | None | | port_range_min | None | | project_id | 70e9c932884544eea84190f7fb42f9f6 | | protocol | icmp | | remote_group_id | None | | remote_ip_prefix | 0.0.0.0/0 | | revision_number | 0 | | security_group_id | 8cbeca34-25f7-45e8-a153-d119d63d250b | | updated_at | 2020-03-02T19:14:45Z | +-------------------+--------------------------------------+ [snow@node1 ~(keystone)]$ openstack security group rule create --protocol tcp --dst-port 22:22 secgroup1 +-------------------+--------------------------------------+ | Field | Value | +-------------------+--------------------------------------+ | created_at | 2020-03-02T19:15:53Z | | description | | | direction | ingress | | ether_type | IPv4 | | id | 1f91657e-e75e-4756-b7ab-e86469c0f304 | | location | cloud='', project.domain_id=, ...... | | name | None | | port_range_max | 22 | | port_range_min | 22 | | project_id | 70e9c932884544eea84190f7fb42f9f6 | | protocol | tcp | | remote_group_id | None | | remote_ip_prefix | 0.0.0.0/0 | | revision_number | 0 | | security_group_id | 8cbeca34-25f7-45e8-a153-d119d63d250b | | updated_at | 2020-03-02T19:15:53Z | +-------------------+--------------------------------------+ [snow@node1 ~(keystone)]$ openstack security group rule list +---------+-------------+-----------+------------+----------------------+---------------+ | ID | IP Protocol | IP Range | Port Range | Remote Security Group| Security Group| +---------+------------+------------+------------+----------------------+---------------+ | 0c16... | None | 0.0.0.0/0 | | None | 8cbe......... | | 1f91... | None | 0.0.0.0/0 | 22:22 | None | 8cbe......... | | 55d5... | None | 0.0.0.0/0 | | None | 47d9......... | | 5a7c... | None | 0.0.0.0/0 | | 47d9... | 47d9......... | | 5d51... | icmp | 0.0.0.0/0 | | None | 8cbe......... | | 6209... | None | ::/0 | | None | 47d9......... | | 6ecb... | None | ::/0 | | 47d9... | 8cbe......... | | ed06... | None | ::/0 | | None | c7d9......... | +---------+-------------+-----------+------------+----------------------+---------------+ 7) 测试 (1) ping测试 [snow@node1 ~(keystone)]$ ping -c 2 192.168.10.225 PING 192.168.10.223 (192.168.10.223) 56(84) bytes of data. 64 bytes from 192.168.10.223: icmp_seq=1 ttl=63 time=4.07 ms 64 bytes from 192.168.10.223: icmp_seq=2 ttl=63 time=2.23 ms --- 192.168.10.223 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 1001ms rtt min/avg/max/mdev = 2.230/3.151/4.073/0.923 ms (2) ssh登录测试 [snow@node1 ~(keystone)]$ ssh centos@192.168.10.223 The authenticity of host '192.168.10.223 (192.168.10.223)' can't be established. ECDSA key fingerprint is SHA256:CRRhDDjIZPnKTrKw5T/Dtp2vQO8uuWfrfFCjqD0A7+A. ECDSA key fingerprint is MD5:a7:c9:2a:c4:d4:0e:89:ad:48:46:e9:b0:51:f3:29:2f. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added '192.168.10.223' (ECDSA) to the list of known hosts. [centos@c7 ~]$ (3) vmc测试 # 获取url地址并复制 [snow@node1 ~(keystone)]$ openstack console url show c7 +-------+------------------------------------------------------------------------------------+ | Field | Value | +-------+------------------------------------------------------------------------------------+ | type | novnc | | url | http://192.168.10.11:6080/vnc_auto.html?path=%3Ftoken%3D94eb1756-f664-4682-90ef... | +-------+------------------------------------------------------------------------------------+ # 使用浏览器访问 [浏览器]==>复制rul地址==>打开实例