Openstack I版部署安装(六)

部署配置Neutron网络组件

配置Neutron控制节点

在controller上
创建neutron用户、角色、端点服务

keystone user-create --name neutron --pass NEUTRON_PASS --email neutron@example.com
keystone user-role-add --user neutron --tenant service --role admin
keystone service-create --name neutron --type network --description "OpenStack Networking"
keystone endpoint-create \
--service-id $(keystone service-list | awk '/ network / {print $2}') \
--publicurl http://controller:9696 \
--adminurl http://controller:9696 \
--internalurl http://controller:9696

安装neutron-server组件

yum install openstack-neutron openstack-neutron-ml2 python-neutronclient -y

备份配置文件

mv /etc/neutron/neutron.conf /etc/neutron/neutron.conf.bak

创建neutron配置文件
vi /etc/neutron/neutron.conf

[DEFAULT]
auth_strategy = keystone
rpc_backend = neutron.openstack.common.rpc.impl_qpid
qpid_hostname = controller
notify_nova_on_port_status_changes = True
notify_nova_on_port_data_changes = True
nova_url = http://controller:8774/v2
nova_admin_username = nova
nova_admin_password = NOVA_PASS
nova_admin_auth_url = http://controller:35357/v2.0
core_plugin = ml2
service_plugins = router
verbose = True
[quotas]
[agent]
[keystone_authtoken]
auth_uri = http://controller:5000
auth_host = controller
auth_protocol = http
auth_port = 35357
admin_tenant_name = service
admin_user = neutron
admin_password = NEUTRON_PASS
[database]
connection = mysql://neutron:NEUTRON_DBPASS@controller/neutron
service_provider=VPN:openswan:neutron.services.vpn.service_drivers.ipsec.IPsecVPNDriver:default

修改配置文件权限

chown -R root:neutron /etc/neutron/neutron.conf

配置文件写入服务身份 的租户ID

uuid=`keystone tenant-list | awk '/ service / { print $2 }'`
sed -i '/1/a\'"$uuid"'' /etc/neutron/neutron.conf

备份ml2配置文件

mv /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugins/ml2/ml2_conf.ini.bak

创建ml2配置文件
vi /etc/neutron/plugins/ml2/ml2_conf.ini

[ml2]
type_drivers = gre
tenant_network_types = gre
mechanism_drivers = openvswitch
[ml2_type_flat]
[ml2_type_vlan]
[ml2_type_gre]
tunnel_id_ranges = 1:1000
[ml2_type_vxlan]
[securitygroup]
firewall_driver = neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver
enable_security_group = True

修改ml2配置权限

chown -R root:neutron /etc/neutron/plugins/ml2/ml2_conf.ini

创建软连接指向ml2配置

ln -s /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugin.ini

启动neutron-server服务

service openstack-nova-api restart
service openstack-nova-scheduler restart
service openstack-nova-conductor restart
service neutron-server start
chkconfig neutron-server on

配置Neutron网络组件

在neutron主机上
配置第三块网卡
vi /etc/sysconfig/network-scripts/ifcfg-eth2

DEVICE=eth2
TYPE=Ethernet
ONBOOT=yes
BOOTPROTO=none

开启内核转发,以便多网卡之间的数据包转发
vi /etc/sysctl.conf

net.ipv4.ip_forward=1
net.ipv4.conf.all.rp_filter=0
net.ipv4.conf.default.rp_filter=0

应用修改生效

sysctl -p

安装neutron必要组件,包括ovs

yum install openstack-neutron openstack-neutron-ml2 openstack-neutron-openvswitch MySQL-python -y

备份neutron配置文件

mv /etc/neutron/neutron.conf /etc/neutron/neutron.conf.bak

创建neutron配置文件
vi /etc/neutron/neutron.conf

[DEFAULT]
auth_strategy = keystone
rpc_backend = neutron.openstack.common.rpc.impl_qpid
qpid_hostname = controller
core_plugin = ml2
service_plugins = router
verbose = True
[quotas]
[agent]
[keystone_authtoken]
auth_uri = http://controller:5000
auth_host = controller
auth_protocol = http
auth_port = 35357
admin_tenant_name = service
admin_user = neutron
admin_password = NEUTRON_PASS
[database]
service_provider=VPN:openswan:neutron.services.vpn.service_drivers.ipsec.IPsecVPNDriver:default

修改neutron配置文件权限

chown -R root:neutron /etc/neutron/neutron.conf

备份ml2,route,dhcp,metadata的配置文件

mv /etc/neutron/l3_agent.ini /etc/neutron/l3_agent.ini.bak
mv /etc/neutron/dhcp_agent.ini /etc/neutron/dhcp_agent.ini.bak
mv /etc/neutron/metadata_agent.ini /etc/neutron/metadata_agent.ini.bak
mv /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugins/ml2/ml2_conf.ini.bak

分别创建ml2,route,dhcp,metadata的配置文件
vi /etc/neutron/l3_agent.ini

[DEFAULT]
interface_driver = neutron.agent.linux.interface.OVSInterfaceDriver
use_namespaces = True
verbose = True

vi /etc/neutron/dhcp_agent.ini

[DEFAULT]
interface_driver = neutron.agent.linux.interface.OVSInterfaceDriver
dhcp_driver = neutron.agent.linux.dhcp.Dnsmasq
use_namespaces = True
verbose = True

vi /etc/neutron/metadata_agent.ini

[DEFAULT]
verbose = True
auth_url = http://controller:5000/v2.0
auth_region = regionOne
admin_tenant_name = service
admin_user = neutron
admin_password = NEUTRON_PASS
nova_metadata_ip = controller
metadata_proxy_shared_secret = neutron

vi /etc/neutron/plugins/ml2/ml2_conf.ini

[ml2]
type_drivers = gre
tenant_network_types = gre
mechanism_drivers = openvswitch
[ml2_type_flat]
[ml2_type_vlan]
[ml2_type_gre]
tunnel_id_ranges = 1:1000
[ml2_type_vxlan]
[securitygroup]
firewall_driver = neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver
enable_security_group = True
[ovs]
local_ip = 10.0.1.21
tunnel_type = gre
enable_tunneling = True

启动ovs服务

service openvswitch start
chkconfig openvswitch on

创建虚拟网桥br-int作为内部连接网桥,br-ex作为实例访问外网的桥

ovs-vsctl add-br br-int
ovs-vsctl add-br br-ex

绑定br-ex在eth2接口,并且禁用GRO

现在大多数网卡都具有LRO/GRO功能，即网卡收包时将同一流的小包合并成大包,LVS内核模块在处理>MTU的数据包时会丢弃；
因此我们可以选择禁用

ovs-vsctl add-port br-ex eth2
ethtool -K eth2 gro off

创建ml2配置文件软连接

ln -s /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugin.ini

OVS_Agent的软件包有一个BUG,初始化脚本是从/etc/neutron/plugin.ini中获取插件配置,需要执行下面的命令修复它

cp /etc/init.d/neutron-openvswitch-agent /etc/init.d/neutron-openvswitch-agent.orig
sed -i 's,plugins/openvswitch/ovs_neutron_plugin.ini,plugin.ini,g' /etc/init.d/neutron-openvswitch-agent

启动服务

service neutron-openvswitch-agent start
service neutron-l3-agent start
service neutron-dhcp-agent start
service neutron-metadata-agent start
chkconfig neutron-openvswitch-agent on
chkconfig neutron-l3-agent on
chkconfig neutron-dhcp-agent on
chkconfig neutron-metadata-agent on