OpenStack 运维 - 部署Neutron组件[T版]

╰半夏微凉° 2022-10-16 01:56 242阅读 0赞

### OpenStack 运维 - 部署Neutron组件 ###

*  一、Neutron 概述
 *  二、创建数据库neutron，并进行授权
 *  三、计算节点 C1/C2
 *  四、CT 验证服务组件

# 一、Neutron 概述 #

Neutron是 OpenStack项目中负责提供网络服务的组件，它基于软件定义网络的思想，实现了网络虚拟化下的资源管理。Neutron 的设计目标是实现“网络即服务(Networking as a Service)，在设计上遵循了基于 SDN 实现网络虚拟化的原则，在实现上充分利用了 Linux 系统上的各种网络相关的技术

# 二、创建数据库neutron，并进行授权 #

**CT控制节点**

mysql -u root -p
    
    grant all privileges on neutron.* to 'neutron'@'localhost' identified by 'NEUTRON_DBPASS';
    grant all privileges on neutron.* to 'neutron'@'%' identified by 'NE
    UTRON_DBPASS';
    
    flush privileges;
    exit

创建neutron用户，用于在keystone做认证
    openstack user create --domain default --password NEUTRON_PASS neutron

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQyNDI3OTcx_size_16_color_FFFFFF_t_70][]

将neutron用户添加到service项目中拥有管理员权限
    openstack role add --project service --user neutron admin

创建network服务，服务类型为network
    openstack service create --name neutron --description "OpenStack Networking" network

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQyNDI3OTcx_size_16_color_FFFFFF_t_70 1][]

注册API到neutron服务，给neutron服务关联端口，即添加endpoint
    openstack endpoint create --region RegionOne network public http://ct:9696
    openstack endpoint create --region RegionOne network internal http://ct:9696	
    openstack endpoint create --region RegionOne network admin http://ct:9696

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQyNDI3OTcx_size_16_color_FFFFFF_t_70 2][]

安装提供者网络(桥接)
    ebtables包是用来管理iptables规则的
    yum -y install openstack-neutron openstack-neutron-ml2 openstack-neutron-linuxbridge ebtables conntrack-tools

更改主配置文件
    #修改主配置文件neutron.conf
    cp -a /etc/neutron/neutron.conf{
        ,.bak}
    grep -Ev '^$|#' /etc/neutron/neutron.conf.bak > /etc/neutron/neutron.conf
    
    openstack-config --set /etc/neutron/neutron.conf database connection mysql+pymysql://neutron:NEUTRON_DBPASS@ct/neutron
    openstack-config --set /etc/neutron/neutron.conf DEFAULT core_plugin ml2
    openstack-config --set /etc/neutron/neutron.conf DEFAULT service_plugins router
    openstack-config --set  /etc/neutron/neutron.conf DEFAULT allow_overlapping_ips true
    openstack-config --set /etc/neutron/neutron.conf DEFAULT transport_url rabbit://openstack:RABBIT_PASS@ct
    openstack-config --set /etc/neutron/neutron.conf DEFAULT auth_strategy keystone
    openstack-config --set /etc/neutron/neutron.conf DEFAULT notify_nova_on_port_status_changes true
    openstack-config --set /etc/neutron/neutron.conf DEFAULT notify_nova_on_port_data_changes true
    openstack-config --set /etc/neutron/neutron.conf keystone_authtoken www_authenticate_uri http://ct:5000
    openstack-config --set /etc/neutron/neutron.conf keystone_authtoken auth_url http://ct:5000
    openstack-config --set /etc/neutron/neutron.conf keystone_authtoken memcached_servers ct:11211
    openstack-config --set /etc/neutron/neutron.conf keystone_authtoken auth_type password
    openstack-config --set /etc/neutron/neutron.conf keystone_authtoken project_domain_name default
    openstack-config --set /etc/neutron/neutron.conf keystone_authtoken user_domain_name default
    openstack-config --set /etc/neutron/neutron.conf keystone_authtoken project_name service
    openstack-config --set /etc/neutron/neutron.conf keystone_authtoken username neutron
    openstack-config --set /etc/neutron/neutron.conf keystone_authtoken password NEUTRON_PASS
    openstack-config --set /etc/neutron/neutron.conf oslo_concurrency lock_path /var/lib/neutron/tmp
    openstack-config --set  /etc/neutron/neutron.conf nova  auth_url http://ct:5000
    openstack-config --set  /etc/neutron/neutron.conf nova  auth_type password
    openstack-config --set  /etc/neutron/neutron.conf nova  project_domain_name default
    openstack-config --set  /etc/neutron/neutron.conf nova  user_domain_name default
    openstack-config --set  /etc/neutron/neutron.conf nova  region_name RegionOne
    openstack-config --set  /etc/neutron/neutron.conf nova  project_name service
    openstack-config --set  /etc/neutron/neutron.conf nova  username nova
    openstack-config --set  /etc/neutron/neutron.conf nova  password NOVA_PASS
    
    查看配置文件
    [root@ct neutron]# cat neutron.conf
    [DEFAULT]
    core_plugin = ml2						#启用二层网络插件
    service_plugins = router					#启用三层网络插件
    allow_overlapping_ips = true
    transport_url = rabbit://openstack:RABBIT_PASS@ct		#配置rabbitmq连接
    auth_strategy = keystone					#认证的方式:keystone
    notify_nova_on_port_status_changes = true			#当网络接口发生变化时，通知给计算节点	
    notify_nova_on_port_data_changes = true			#当端口数据发生变化，通知计算节点
    [cors]
    [database]						#配置数据库连接
    connection = mysql+pymysql://neutron:NEUTRON_DBPASS@ct/neutron
    [keystone_authtoken]					#配置keystone认证信息
    www_authenticate_uri = http://ct:5000
    auth_url = http://ct:5000
    memcached_servers = ct:11211
    auth_type = password
    project_domain_name = default
    user_domain_name = default
    project_name = service
    username = neutron
    password = NEUTRON_PASS
    [oslo_concurrency]						#配置锁路径
    lock_path = /var/lib/neutron/tmp
    [oslo_messaging_amqp]
    [oslo_messaging_kafka]
    [oslo_messaging_notifications]
    [oslo_messaging_rabbit]
    [oslo_middleware]
    [oslo_policy]
    [privsep]
    [ssl]
    [nova]							#neutron需要给nova返回数据
    auth_url = http://ct:5000					#到keystone认证nova
    auth_type = password
    project_domain_name = default
    user_domain_name = default
    region_name = RegionOne
    project_name = service
    username = nova						#通过nova的用户名和密码到keystone验证nova的token
    password = NOVA_PASS

修改 ML2 plugin 配置文件 ml2_conf.ini
    cp -a /etc/neutron/plugins/ml2/ml2_conf.ini{
        ,.bak}
    grep -Ev '^$|#' /etc/neutron/plugins/ml2/ml2_conf.ini.bak > /etc/neutron/plugins/ml2/ml2_conf.ini
    
    openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2 type_drivers  flat,vlan,vxlan
    openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2 tenant_network_types vxlan
    openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2 mechanism_drivers  linuxbridge,l2population
    openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2 extension_drivers  port_security
    openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2_type_flat flat_networks  provider
    openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2_type_vxlan vni_ranges 1:1000
    openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini securitygroup enable_ipset  true

修改 linux bridge network provider 配置文件
    
    #Linux网桥
    cp -a /etc/neutron/plugins/ml2/linuxbridge_agent.ini{
        ,.bak}
    grep -Ev '^$|#' /etc/neutron/plugins/ml2/linuxbridge_agent.ini.bak > /etc/neutron/plugins/ml2/linuxbridge_agent.ini
    openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini linux_bridge physical_interface_mappings  provider:eth1		###eth1网卡名称
    openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini vxlan enable_vxlan  true
    openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini vxlan local_ip 192.168.1.100	##控制节点IP地址	
    openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini vxlan l2_population true
    openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini securitygroup enable_security_group  true
    openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini securitygroup firewall_driver  neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
    
    #查看配置文件
    [DEFAULT]
    
    [linux_bridge]
    physical_interface_mappings = provider:eth1			#指定上个文件中的桥接网络名称，与eth0物理网卡做关联，后期给虚拟机分配external网络，就可以通过eth0上外网；物理网卡有可能是bind0、br0等
    
    [vxlan]							#启用VXLAN覆盖网络，配置覆盖网络的物理网络接口的IP地址，启用layer－2 population
    enable_vxlan = true						#允许用户创建自定义网络(3层网络)
    local_ip = 192.168.1.100
    l2_population = true
    
    [securitygroup]						#启用安全组并配置 Linux 桥接 iptables 防火墙驱动
    enable_security_group = true
    firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver

修改内核参数
    echo 'net.bridge.bridge-nf-call-iptables=1' >> /etc/sysctl.conf
    echo 'net.bridge.bridge-nf-call-ip6tables=1' >> /etc/sysctl.conf
    modprobe br_netfilter	#表示向内核加入参数
    sysctl -p

配置Linuxbridge接口驱动和外部网络网桥
    cp -a /etc/neutron/l3_agent.ini{
        ,.bak}
    grep -Ev '^$|#' /etc/neutron/l3_agent.ini.bak > /etc/neutron/l3_agent.ini
    openstack-config --set /etc/neutron/l3_agent.ini DEFAULT interface_driver linuxbridge

修改dhcp_agent 配置文件
    cp -a /etc/neutron/dhcp_agent.ini{
        ,.bak}
    grep -Ev '^$|#' /etc/neutron/dhcp_agent.ini.bak > /etc/neutron/dhcp_agent.ini 
    openstack-config --set /etc/neutron/dhcp_agent.ini DEFAULT interface_driver linuxbridge
    openstack-config --set /etc/neutron/dhcp_agent.ini DEFAULT dhcp_driver neutron.agent.linux.dhcp.Dnsmasq
    openstack-config --set /etc/neutron/dhcp_agent.ini DEFAULT enable_isolated_metadata true

配置元数据代理、用于配置桥接与自服务网络的通用配置
    cp -a /etc/neutron/metadata_agent.ini{
        ,.bak}
    grep -Ev '^$|#' /etc/neutron/metadata_agent.ini.bak > /etc/neutron/metadata_agent.ini
    openstack-config --set /etc/neutron/metadata_agent.ini DEFAULT nova_metadata_host ct
    openstack-config --set /etc/neutron/metadata_agent.ini DEFAULT metadata_proxy_shared_secret METADATA_SECRET

修改nova配置文件
    openstack-config --set /etc/nova/nova.conf neutron url http://ct:9696
    openstack-config --set /etc/nova/nova.conf neutron auth_url http://ct:5000
    openstack-config --set /etc/nova/nova.conf neutron auth_type password
    openstack-config --set /etc/nova/nova.conf neutron project_domain_name default
    openstack-config --set /etc/nova/nova.conf neutron user_domain_name default
    openstack-config --set /etc/nova/nova.conf neutron region_name RegionOne
    openstack-config --set /etc/nova/nova.conf neutron project_name service
    openstack-config --set /etc/nova/nova.conf neutron username neutron
    openstack-config --set /etc/nova/nova.conf neutron password NEUTRON_PASS
    openstack-config --set /etc/nova/nova.conf neutron service_metadata_proxy true
    openstack-config --set /etc/nova/nova.conf neutron metadata_proxy_shared_secret METADATA_SECRET

创建ML2插件文件符号连接
    网络服务初始化脚本需要/etc/neutron/plugin.ini指向ML2插件配置文件的符号链接
    ln -s /etc/neutron/plugins/ml2/ml2_conf.ini
    
    初始化数据库
    su -s /bin/sh -c "neutron-db-manage --config-file /etc/neutron/neutron.conf \
    --config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade head" neutron
    
    重启计算节点nova-api服务
    systemctl restart openstack-nova-api.service
    
    systemctl enable neutron-server.service \
    neutron-linuxbridge-agent.service neutron-dhcp-agent.service \
    neutron-metadata-agent.service
    systemctl start neutron-server.service \
    neutron-linuxbridge-agent.service neutron-dhcp-agent.service \
    neutron-metadata-agent.service
    
    netstat -anutp |grep 9696

![20210526160834818.png][]

systemctl enable neutron-l3-agent.service && systemctl restart neutron-l3-agent.service
    '//因为配置了第三层L3网络服务、所以需要启动第三层服务'
    
    systemctl status neutron-l3-agent.service

# 三、计算节点 C1/C2 #

yum -y install openstack-neutron-linuxbridge ebtables ipset conntrack-tools

修改neutron.conf文件
    cp -a /etc/neutron/neutron.conf{
        ,.bak}
    grep -Ev '^$|#' /etc/neutron/neutron.conf.bak > /etc/neutron/neutron.conf
    openstack-config --set /etc/neutron/neutron.conf DEFAULT transport_url rabbit://openstack:RABBIT_PASS@ct
    openstack-config --set /etc/neutron/neutron.conf DEFAULT auth_strategy keystone
    openstack-config --set /etc/neutron/neutron.conf keystone_authtoken www_authenticate_uri http://ct:5000
    openstack-config --set /etc/neutron/neutron.conf keystone_authtoken auth_url http://ct:5000
    openstack-config --set /etc/neutron/neutron.conf keystone_authtoken memcached_servers ct:11211
    openstack-config --set /etc/neutron/neutron.conf keystone_authtoken auth_type password
    openstack-config --set /etc/neutron/neutron.conf keystone_authtoken project_domain_name default
    openstack-config --set /etc/neutron/neutron.conf keystone_authtoken user_domain_name default
    openstack-config --set /etc/neutron/neutron.conf keystone_authtoken project_name service
    openstack-config --set /etc/neutron/neutron.conf keystone_authtoken username neutron
    openstack-config --set /etc/neutron/neutron.conf keystone_authtoken password NEUTRON_PASS
    openstack-config --set /etc/neutron/neutron.conf oslo_concurrency lock_path /var/lib/neutron/tmp
    
    
    【查看配置文件】
    
    [root@c1 neutron]# cat neutron.conf
    
    [DEFAULT]					#neutron的server端与agent端通讯也是通过rabbitmq进行通讯的
    transport_url = rabbit://openstack:RABBIT_PASS@ct
    auth_strategy = keystone				#认证策略：keystone
    [cors]
    [database]
    
    [keystone_authtoken]				#指定keystone认证的信息
    www_authenticate_uri = http://ct:5000
    auth_url = http://ct:5000
    memcached_servers = ct:11211
    auth_type = password
    project_domain_name = default
    user_domain_name = default
    project_name = service
    username = neutron
    password = NEUTRON_PASS
    
    [oslo_concurrency]					#配置锁路径（管理线程库）
    lock_path = /var/lib/neutron/tmp
    
    [oslo_messaging_amqp]
    [oslo_messaging_kafka]
    [oslo_messaging_notifications]
    [oslo_messaging_rabbit]
    [oslo_middleware]
    [oslo_policy]
    [privsep]
    [ssl]

配置Linux网桥代理
    cp -a /etc/neutron/plugins/ml2/linuxbridge_agent.ini{
        ,.bak}
    grep -Ev '^$|#' /etc/neutron/plugins/ml2/linuxbridge_agent.ini.bak > /etc/neutron/plugins/ml2/linuxbridge_agent.ini
    openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini linux_bridge physical_interface_mappings  provider:eth1
    openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini vxlan enable_vxlan  true
    openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini vxlan local_ip 192.168.1.200
    openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini vxlan l2_population true
    openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini securitygroup enable_security_group  true
    openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini securitygroup firewall_driver  neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
    
    
    [root@c1 ml2]# cat linuxbridge_agent.ini
    [DEFAULT]
    [linux_bridge]
    physical_interface_mappings = provider:eth1
    ● 直接将node节点external网络绑定在当前节点的指定的物理网卡，不需要node节点配置网络名称，node节点只需要接收controller节点指令即可；controller节点上配置的external网络名称是针对整个openstack环境生效的，所以指定external网络绑定在当前node节点的eth0物理网卡上(也可能是bind0或br0)
    
    [vxlan]
    enable_vxlan = true							#开启Vxlan网络
    local_ip = 192.168.1.200
    l2_population = true						#L2 Population 是用来提高 VXLAN 网络扩展能力的组件
    
    [securitygroup]
    enable_security_group = true						#开启安全组
    firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver	#指定安全组驱动文件

echo 'net.bridge.bridge-nf-call-iptables=1' >> /etc/sysctl.conf
    echo 'net.bridge.bridge-nf-call-ip6tables=1' >> /etc/sysctl.conf
    '//允许虚拟机的数据通过物理机出去'
    
    modprobe br_netfilter
    '//用于向内核中加载模块或者从内核中移除模块'
    '//modprobe -r 表示移除'
    
    sysctl -p

【修改nova.conf配置文件的neutron字段-C1、C2节点】
    openstack-config --set /etc/nova/nova.conf neutron auth_url http://ct:5000
    openstack-config --set /etc/nova/nova.conf neutron auth_type password
    openstack-config --set /etc/nova/nova.conf neutron project_domain_name default
    openstack-config --set /etc/nova/nova.conf neutron user_domain_name default
    openstack-config --set /etc/nova/nova.conf neutron region_name RegionOne
    openstack-config --set /etc/nova/nova.conf neutron project_name service
    openstack-config --set /etc/nova/nova.conf neutron username neutron
    openstack-config --set /etc/nova/nova.conf neutron password NEUTRON_PASS
    
    #以下为修改字段内容
    [neutron]
    auth_url = http://ct:5000
    auth_type = password
    project_domain_name = default
    user_domain_name = default
    region_name = RegionOne
    project_name = service
    username = neutron
    password = NEUTRON_PASS

重新启动计算节点上的Nova服
    systemctl restart openstack-nova-compute.service 
    启动网桥代理并设置开机自启
    systemctl enable neutron-linuxbridge-agent.service
    systemctl start neutron-linuxbridge-agent.service

# 四、CT 验证服务组件 #

openstack extension list --network
    '//列出加载的扩展来验证neutron-server是否成功运行'
    
    openstack network agent list
    '//在控制节点上，列出所有的代理'

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQyNDI3OTcx_size_16_color_FFFFFF_t_70 3][]

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQyNDI3OTcx_size_16_color_FFFFFF_t_70]: /images/20221014/f860e31612c44b4aa3c8958068218a5c.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQyNDI3OTcx_size_16_color_FFFFFF_t_70 1]: /images/20221014/0be8502bd7bb46a78f08f55367a3f920.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQyNDI3OTcx_size_16_color_FFFFFF_t_70 2]: /images/20221014/28763757df04406688213cd7f4a92318.png
[20210526160834818.png]: /images/20221014/94f7835a16084fa7a106c0613ecb59dc.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQyNDI3OTcx_size_16_color_FFFFFF_t_70 3]: /images/20221014/55f9239aed304154ab2da52ccf2de995.png