1. 程式人生 > 實用技巧 >openstack搭建10、 Neutron控制/網路節點叢集

openstack搭建10、 Neutron控制/網路節點叢集

10、 Neutron控制/網路節點叢集
neutron-server 埠9696 api:接受和響應外部的網路管理請求
neutron-linuxbridge-agent: 負責建立橋接網絡卡
neturon-dhcp-agent: 負責分配IP
neturon-metadata-agent: 配合Nova-metadata-api實現虛擬機器的定製化操作
L3-agent 實現三層網路vxlan(網路層)
**Neutron Server:**對外提供Openstack網路API,接收請求,並呼叫Plugin處理請求。
**Plugin:**處理Neturon Server發來的請求,維護Openstack邏輯網路狀態,並呼叫Agent處理請求。
**Agent:**處理Plugin的請求,負責在network provider上真正實現各種網路功能。
**Network provider:**提供網路服務的虛擬或物理網路裝置,例如Linux Bridge,Open vSwitch或者其他支援Neutron的物理交換機。
**Queue:**Neutron Server,Plugin和Agent之間通過Messagings Queue通訊和呼叫。
**Database:**存放OpenStack的網路狀態資訊,包括Network,Subnet,Port,Router等。

10.1 建立neutron資料庫(在任意控制節點建立資料庫,後臺資料自動同步)

[root@controller1:/root]# mysql -uroot -p"123456"
MariaDB [(none)]> CREATE DATABASE neutron;
Query OK, 1 row affected (0.009 sec)
MariaDB [(none)]> GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'localhost' IDENTIFIED BY 'NEUTRON_szh';
Query OK, 0 rows affected (0.009
sec) MariaDB [(none)]> GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'%' IDENTIFIED BY 'NEUTRON_szh'; Query OK, 0 rows affected (0.011 sec) MariaDB [(none)]> flush privileges; MariaDB [(none)]> exit Bye

10.2 建立neutron使用者、賦權、服務實體

[root@controller1:/root]# source openrc 
[root@controller1:
/root]# openstack user create --domain default --password=neutron_szh neutron +---------------------+----------------------------------+ | Field | Value | +---------------------+----------------------------------+ | domain_id | default | | enabled | True | | id | a80531c8a7534a30954246b1eefd74d1 | | name | neutron | | options | {} | | password_expires_at | None | +---------------------+----------------------------------+ // 為neutron使用者賦予admin許可權 [root@controller1:/root]# openstack role add --project service --user neutron admin // neutron服務實體型別”network” [root@controller1:/root]# openstack service create --name neutron --description "OpenStack Networking" network +-------------+----------------------------------+ | Field | Value | +-------------+----------------------------------+ | description | OpenStack Networking | | enabled | True | | id | 78246c2a2efa4c95864a22630886bfa0 | | name | neutron | | type | network | +-------------+----------------------------------+ [root@controller1:/root]# openstack service list +----------------------------------+-----------+-----------+ | ID | Name | Type | +----------------------------------+-----------+-----------+ | eac467e3e05f464e8fa2bec9237f2338 | nova | compute | | d0311e554ec742069c267963d4c3acfa | glance | image | | 5c44c9890e7744d8b322531192aa12db | keystone | identity | | 78246c2a2efa4c95864a22630886bfa0 | neutron | network | | 850824217408494daa58f31293918560 | placement | placement | +----------------------------------+-----------+-----------+

10.3 建立neutron-api

// neutron-api 服務型別為network;
[root@controller1:/root]# openstack endpoint create --region RegionOne network public http://VirtualIP:9997
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | 670dfb6bb8ba4b0eb29cf5ce117fa7f7 |
| interface | public |
| region | RegionOne |
| region_id | RegionOne |
| service_id | 78246c2a2efa4c95864a22630886bfa0 |
| service_name | neutron |
| service_type | network |
| url | http://VirtualIP:9997 |
+--------------+----------------------------------+
[root@controller1:/root]# openstack endpoint create --region RegionOne network internal http://VirtualIP:9997
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | 2c6b3657b8bd431586934cc9dde33f84 |
| interface | internal |
| region | RegionOne |
| region_id | RegionOne |
| service_id | 78246c2a2efa4c95864a22630886bfa0 |
| service_name | neutron |
| service_type | network |
| url | http://VirtualIP:9997 |
+--------------+----------------------------------+
[root@controller1:/root]# openstack endpoint create --region RegionOne network admin http://VirtualIP:9997
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | 5ff90d7cff57495d80338ef7299319d3 |
| interface | admin |
| region | RegionOne |
| region_id | RegionOne |
| service_id | 78246c2a2efa4c95864a22630886bfa0 |
| service_name | neutron |
| service_type | network |
| url | http://VirtualIP:9997 |
+--------------+----------------------------------+
[root@controller1:/root]# openstack endpoint list
+----------------------------------+-----------+--------------+--------------+---------+----
| ID | Region | Service Name | Service Type | Enabled | Interface | URL |
+----------------------------------+-----------+--------------+--------------+---------+----
| 2c6b3657b8bd431586934cc9dde33f84 | RegionOne | neutron | network | True | internal | http://VirtualIP:9697 |
| 2e109052bb4a4affa30fe3b9e3e5fcc3 | RegionOne | keystone | identity | True | internal | http://VirtualIP:5001/v3/ |
| 3ae6c07e8c1844b3a21c3fc073cd3da9 | RegionOne | nova | compute | True | public | http://VirtualIP:9774/v2.1 |
| 40e4fa83731d4933afe694481b5e0464 | RegionOne | glance | image | True | admin | http://VirtualIP:9293 |
| 53be3d592dfa4060b46ca6a488067191 | RegionOne | placement | placement | True | admin | http://VirtualIP:9778 |
| 5ff90d7cff57495d80338ef7299319d3 | RegionOne | neutron | network | True | admin | http://VirtualIP:9997 |
| 670dfb6bb8ba4b0eb29cf5ce117fa7f7 | RegionOne | neutron | network | True | public | http://VirtualIP:9997 |
| 7bff1a44974a42a59e49eebffad550c0 | RegionOne | nova | compute | True | admin | http://VirtualIP:9774/v2.1 |
| 8ddb366df7e94af9af298b5f11774fb4 | RegionOne | keystone | identity | True | admin | http://VirtualIP:5001/v3/ |
| 9035afba42be4b4387571d02b16c168c | RegionOne | placement | placement | True | internal | http://VirtualIP:9778 |
| a592cb41c0bb424c9817633ed1946b45 | RegionOne | keystone | identity | True | public | http://VirtualIP:5001/v3/ |
| b0f71d34aedf41a9a8fb9d56313efb00 | RegionOne | nova | compute | True | internal | http://VirtualIP:9774/v2.1 |
| b7b0084313744b8a91a142b1221e0443 | RegionOne | glance | image | True | internal | http://VirtualIP:9293 |
| c2a1f308b3c04a448667967afb6016fe | RegionOne | placement | placement | True | public | http://VirtualIP:9778 |
| fdb2cdadfb7544abad1f216ca719f478 | RegionOne | glance | image | True | public | http://VirtualIP:9293 |
+----------------------------------+-----------+--------------+--------------+---------+----
注:誤操作,刪除命令://# openstack endpoint delete ff76f2ea08914c98ad6e8fee3a789498

[root@controller1:/root]# openstack catalog list
+-----------+-----------+----------------------------------------+
| Name | Type | Endpoints |
+-----------+-----------+----------------------------------------+
| nova | compute | RegionOne |
| | | public: http://VirtualIP:9774/v2.1 |
| | | RegionOne |
| | | admin: http://VirtualIP:9774/v2.1 |
| | | RegionOne |
| | | internal: http://VirtualIP:9774/v2.1 |
| | | |
| glance | image | RegionOne |
| | | admin: http://VirtualIP:9293 |
| | | RegionOne |
| | | internal: http://VirtualIP:9293 |
| | | RegionOne |
| | | public: http://VirtualIP:9293 |
| | | |
| keystone | identity | RegionOne |
| | | internal: http://VirtualIP:5001/v3/ |
| | | RegionOne |
| | | admin: http://VirtualIP:5001/v3/ |
| | | RegionOne |
| | | public: http://VirtualIP:5001/v3/ |
| | | |
| neutron | network | RegionOne |
| | | internal: http://VirtualIP:9997 |
| | | RegionOne |
| | | admin: http://VirtualIP:9997 |
| | | RegionOne |
| | | public: http://VirtualIP:9997 |
| | | |
| placement | placement | RegionOne |
| | | admin: http://VirtualIP:9778 |
| | | RegionOne |
| | | internal: http://VirtualIP:9778 |
| | | RegionOne |
| | | public: http://VirtualIP:9778 |
| | | |
+-----------+-----------+----------------------------------------+

10.4 部署Neutron
10.4.1 安裝Neutron程式

[root@controller1:/root]# yum install openstack-neutron openstack-neutron-ml2 openstack-neutron-linuxbridge ebtables -y
[root@controller2:/root]# yum install openstack-neutron openstack-neutron-ml2 openstack-neutron-linuxbridge ebtables -y
[root@controller3:/root]# yum install openstack-neutron openstack-neutron-ml2 openstack-neutron-linuxbridge ebtables -y

10.4.2 配置neutron.conf

[root@controller1:/root]# cp -p /etc/neutron/neutron.conf{,.bak}
[root@controller2:/root]# cp -p /etc/neutron/neutron.conf{,.bak}
[root@controller3:/root]# cp -p /etc/neutron/neutron.conf{,.bak}
//注意neutron.conf檔案的許可權:root:neutron
//配置neutron.conf
[root@controller1:/root]# vim /etc/neutron/neutron.conf
[DEFAULT]
#
bind_host = 192.168.110.121
auth_strategy = keystone
core_plugin = ml2
allow_overlapping_ips = true
notify_nova_on_port_status_changes = true
notify_nova_on_port_data_changes = true
service_plugins = router
transport_url = rabbit://openstack:adminopenstack@controller1:5672,openstack:adminopenstack@controller2:5672,openstack:adminopenstack@controller3:5672

[database]
connection = mysql+pymysql://neutron:NEUTRON_szh@VirtualIP:3307/neutron

[keystone_authtoken]
www_authenticate_uri = http://VirtualIP:5001/v3
auth_url = http://VirtualIP:5001/v3
memcache_servers=controller1:11211,controller2:11211,controller3:11211
auth_type = password
project_domain_name = Default
user_domain_name = Default
project_name = service
username = neutron
password = neutron_szh

[nova]
auth_url = http://VirtualIP:5001/v3
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = nova
password = nova_szh

[oslo_concurrency]
lock_path = /var/lib/neutron/tmp

[root@controller2:/root]# vim /etc/neutron/neutron.conf
#
bind_host = 192.168.110.122
auth_strategy = keystone
core_plugin = ml2
allow_overlapping_ips = true
notify_nova_on_port_status_changes = true
notify_nova_on_port_data_changes = true
service_plugins = router
transport_url = rabbit://openstack:adminopenstack@controller1:5672,openstack:adminopenstack@controller2:5672,openstack:adminopenstack@controller3:5672

[database]
connection = mysql+pymysql://neutron:NEUTRON_szh@VirtualIP:3307/neutron

[keystone_authtoken]
www_authenticate_uri = http://VirtualIP:5001/v3
auth_url = http://VirtualIP:5001/v3
memcache_servers=controller1:11211,controller2:11211,controller3:11211
auth_type = password
project_domain_name = Default
user_domain_name = Default
project_name = service
username = neutron
password = neutron_szh

[nova]
auth_url = http://VirtualIP:5001/v3
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = nova
password = nova_szh

[oslo_concurrency]
lock_path = /var/lib/neutron/tmp

[root@controller3:/root]# vim /etc/neutron/neutron.conf
#
bind_host = 192.168.110.123
auth_strategy = keystone
core_plugin = ml2
allow_overlapping_ips = true
notify_nova_on_port_status_changes = true
notify_nova_on_port_data_changes = true
service_plugins = router
transport_url = rabbit://openstack:adminopenstack@controller1:5672,openstack:adminopenstack@controller2:5672,openstack:adminopenstack@controller3:5672

[database]
connection = mysql+pymysql://neutron:NEUTRON_szh@VirtualIP:3307/neutron

[keystone_authtoken]
www_authenticate_uri = http://VirtualIP:5001/v3
auth_url = http://VirtualIP:5001/v3
memcache_servers=controller1:11211,controller2:11211,controller3:11211
auth_type = password
project_domain_name = Default
user_domain_name = Default
project_name = service
username = neutron
password = neutron_szh

[nova]
auth_url = http://VirtualIP:5001/v3
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = nova
password = nova_szh

[oslo_concurrency]
lock_path = /var/lib/neutron/tmp

[root@controller$:/root]# egrep -v "^$|^#" /etc/neutron/neutron.conf

10.4.3 配置ml2_conf.ini

[root@controller1:/root]# cp -p /etc/neutron/plugins/ml2/ml2_conf.ini{,.bak}
[root@controller2:/root]# cp -p /etc/neutron/plugins/ml2/ml2_conf.ini{,.bak}
[root@controller3:/root]# cp -p /etc/neutron/plugins/ml2/ml2_conf.ini{,.bak}

[root@controller2:/root]# vim /etc/neutron/plugins/ml2/ml2_conf.ini
[ml2]
type_drivers = flat,vxlan
tenant_network_types = vxlan
mechanism_drivers = linuxbridge,l2population
extension_drivers = port_security

[ml2_type_vxlan]
vni_ranges = 1:1000

[securitygroup]
enable_ipset = true

[root@controller1:/root]# vim /etc/neutron/plugins/ml2/ml2_conf.ini
[ml2]
type_drivers = flat,vxlan
tenant_network_types = vxlan
mechanism_drivers = linuxbridge,l2population
extension_drivers = port_security

[ml2_type_vxlan]
vni_ranges = 1:1000

[securitygroup]
enable_ipset = true

[root@controller3:/root]# vim /etc/neutron/plugins/ml2/ml2_conf.ini
[ml2]
type_drivers = flat,vxlan
tenant_network_types = vxlan
mechanism_drivers = linuxbridge,l2population
extension_drivers = port_security

[ml2_type_vxlan]
vni_ranges = 1:1000

[securitygroup]
enable_ipset = true

10.4.4 配置linuxbridge_agent.ini

[root@controller1:/root]# cp -p /etc/neutron/plugins/ml2/linuxbridge_agent.ini{,.bak}
[root@controller2:/root]# cp -p /etc/neutron/plugins/ml2/linuxbridge_agent.ini{,.bak}
[root@controller3:/root]# cp -p /etc/neutron/plugins/ml2/linuxbridge_agent.ini{,.bak}

[DEFAULT]
[agent]
[linux_bridge]
physical_interface_mappings = provider:ens160 # 外網網絡卡名
[securitygroup]
enable_security_group = True
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
[vxlan]
enable_vxlan = True
local_ip = 192.168.110.121 # 這裡使用的管理地址,做vxlan隧道,每個節點填寫本地管理地址

l2_population = True

10.4.5 配置l3_agent.ini

l3_agent.ini配置:
[DEFAULT]
interface_driver = neutron.agent.linux.interface.BridgeInterfaceDriver
external_network_bridge =
# 藍色部分為網路高可用切換設定
ha_confs_path = $state_path/ha_confs
ha_vrrp_auth_type = PASS
ha_vrrp_auth_password = 
ha_vrrp_advert_int = 2
[AGENT]


10.4.6 配置dhcp_agent.ini

dhcp_agent.ini 配置如下:
[DEFAULT]
interface_driver = neutron.agent.linux.interface.BridgeInterfaceDriver
external_network_bridge =
[AGENT]

10.4.7 配置metadata_agent.ini

metadata_agent.ini 配置如下:
[DEFAULT]
nova_metadata_ip = controller
metadata_proxy_shared_secret = METADATA_SECRET
[AGENT]

10.4.8 配置nova.conf (在全部控制節點操作 controller1 controller2 controller3)

[root@controller$:/root]# vim /etc/nova/nova.conf
[neutron]
url = http://VirtualIP:9997
auth_url = http://VirtualIP:5001
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = neutron
password = neutron_szh
service_metadata_proxy = true
metadata_proxy_shared_secret = METADATA_SECRET
//*注:節後在[default]下加上以下內容:(優化DHCP Agent服務的高可用)*//
agent_down_time = 30
report_interval=15
dhcp_agents_per_network = 3

10.4.9 建立軟連結 (在全部控制節點操作 controller1 controller2 controller3)

[root@controller$:/root]#
ln -s /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugin.ini

10.4.10 同步neutron資料庫並驗證

[root@controller3:/root]# su -s /bin/sh -c "neutron-db-manage --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade head" neutron
[root@controller2:/root]# mysql -u neutron -p"NEUTRON_szh" -e "use neutron;show tables;"

10.4.11 重啟nova服務並啟動neutron服務

[root@controller$:/root]#systemctl restart openstack-nova-api.service
執行完成,再次確認nova各項服務是否正常

各項服務正常。
啟動neutron各項服務,建議一項一項啟動,監測日誌有無報錯資訊

[root@controller1 ~]# systemctl start neutron-server.service
[root@controller1 ~]# systemctl start neutron-linuxbridge-agent.service
[root@controller1 ~]# systemctl start neutron-dhcp-agent.service
[root@controller1 ~]# systemctl start neutron-metadata-agent.service
[root@controller1 ~]# systemctl start neutron-l3-agent.service

全部啟動成功,日誌列印都是 info 資訊,設定開機啟動,前面的服務都是設定為開機啟動的。
[root@controller1 ~]# systemctl enable neutron-server.service \
neutron-linuxbridge-agent.service neutron-dhcp-agent.service \
neutron-metadata-agent.service neutron-l3-agent.service

10.4.12 設定PCS資源(在任意控制節點操作)

//新增資源neutron-server,neutron-linuxbridge-agent,neutron-l3-agent,neutron-dhcp-agent與neutron-metadata-agent
//在任意控制節點操作
pcs resource create neutron-server systemd:neutron-server --clone interleave=true
pcs resource create neutron-openvswitch-agent systemd:neutron-linuxbridge-agent --clone interleave=true
pcs resource create neutron-l3-agent systemd:neutron-l3-agent --clone interleave=true
pcs resource create neutron-dhcp-agent systemd:neutron-dhcp-agent --clone interleave=true
pcs resource create neutron-metadata-agent systemd:neutron-metadata-agent --clone interleave=true
//檢視PCS資源
pcs resource

10.5 部署計算節點上的Neutron
10.5.1 安裝openstack-neutron-linuxbridge服務

[root@compute1:/root]# yum install openvswitch openstack-neutron-linuxbridge ebtables ipset -y
[root@compute2:/root]# yum install openvswitch openstack-neutron-linuxbridge ebtables ipset -y
[root@compute3:/root]# yum install openvswitch openstack-neutron-linuxbridge ebtables ipset -y

10.5.2 配置neutron.conf

[root@compute1:/root]# cp -p /etc/neutron/neutron.conf{,.bak}
[root@compute2:/root]# cp -p /etc/neutron/neutron.conf{,.bak}
[root@compute3:/root]# cp -p /etc/neutron/neutron.conf{,.bak}

[root@compute3:/root]# vim /etc/neutron/neutron.conf
[DEFAULT]
auth_strategy = keystone
state_path = /var/lib/neutron
transport_url = rabbit://openstack:adminopenstack@controller1:5672,openstack:adminopenstack@controller2:5672,openstack:adminopenstack@controller3:5672
[keystone_authtoken]
www_authenticate_uri = http://VirtualIP:5001
auth_url = http://VirtualIP:5001
memcached_servers = controller1:11211,controller2:11211,controller3:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = neutron
password = neutron_szh
[oslo_concurrency]
lock_path = /var/lib/neutron/tmp

[root@compute3:/root]# scp /etc/neutron/neutron.conf compute2:/etc/neutron/
[root@compute3:/root]# scp /etc/neutron/neutron.conf compute1:/etc/neutron/

10.5.3 配置linuxbridge_agent.ini

[root@compute1 ~]# vim /etc/neutron/plugins/ml2/linuxbridge_agent.ini
[DEFAULT]
[agent]
[linux_bridge]
physical_interface_mappings = provider:ens160
[securitygroup]
enable_security_group = True
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
[vxlan]
enable_vxlan = True
local_ip = 192.168.110.117
l2_population = True
[root@compute2 ~]# vim /etc/neutron/plugins/ml2/linuxbridge_agent.ini
[DEFAULT]
[agent]
[linux_bridge]
physical_interface_mappings = provider:ens160
[securitygroup]
enable_security_group = True
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
[vxlan]
enable_vxlan = True
local_ip = 192.168.110.118
l2_population = True
[root@compute3 ~]# vim /etc/neutron/plugins/ml2/linuxbridge_agent.ini
[DEFAULT]
[agent]
[linux_bridge]
physical_interface_mappings = provider:ens160
[securitygroup]
enable_security_group = True
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
[vxlan]
enable_vxlan = True
local_ip = 192.168.110.119
l2_population = True

10.5.4 配置 nova.conf

[root@compute1:/root]# vim /etc/nova/nova.conf
[neutron]
url = http://VirtualIP:9997
auth_url = http://VirtualIP:5001
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = neutron
password = neutron_szh

[root@compute2:/root]# vim /etc/nova/nova.conf
[neutron]
url = http://VirtualIP:9997
auth_url = http://VirtualIP:5001
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = neutron
password = neutron_szh

[root@compute3:/root]# vim /etc/nova/nova.conf
[neutron]
url = http://VirtualIP:9997
auth_url = http://VirtualIP:5001
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = neutron
password = neutron_szh

10.5.5 重啟nova服務並啟動neutron服務

[root@compute1:/root]#systemctl restart openstack-nova-compute.service
[root@compute1:/root]#systemctl enable openvswitch neutron-linuxbridge-agent.service
[root@compute1:/root]#systemctl restart openvswitch neutron-linuxbridge-agent.service
[root@compute1:/root]#systemctl status openvswitch neutron-linuxbridge-agent.service
[root@compute2:/root]#systemctl restart openstack-nova-compute.service
[root@compute2:/root]#systemctl enable openvswitch neutron-linuxbridge-agent.service
[root@compute2:/root]#systemctl restart openvswitch neutron-linuxbridge-agent.service
[root@compute2:/root]#systemctl status openvswitch neutron-linuxbridge-agent.service
[root@compute3:/root]#systemctl restart openstack-nova-compute.service
[root@compute3:/root]#systemctl enable openvswitch neutron-linuxbridge-agent.service
[root@compute3:/root]#systemctl restart openvswitch neutron-linuxbridge-agent.service
[root@compute3:/root]#systemctl status openvswitch neutron-linuxbridge-agent.service

驗證網路服務#
在任意controller節點上執行:

. admin-openrc
neutron ext-list
neutron agent-list

網路服務正常,再次確認計算服務

nova service-list

計算服務正常。neutron配置成功。