$ mysql -u root -p
建立nova数据库:
<pre>CREATE DATABASE neutron;
</pre>python
把neutron数据库的访问权限赋予名为neutron,来自任何主机地址的用户,并设定访问密码为NEUTRON_DBPASS(替换为合适的密码):
<pre>GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'localhost' IDENTIFIED BY 'NEUTRON_DBPASS';
mysql
GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'%' IDENTIFIED BY 'NEUTRON_DBPASS';</pre>linux
退出数据库。sql
admin
证书: $ source admin-openrc.sh
neutron
用户:$ keystone user-create --name neutron --pass NEUTRON_PASS
Property | Value |
---|---|
enabled | True |
id | 03fdaa93a85b4879a898d031947b81af |
name | neutron |
username | neutron |
+----------+----------------------------------+</pre>
用合适的密码代替NEUTRON_PASS。数据库
把admin
角色赋予给neutron
用户:$ keystone user-role-add --user neutron --tenant service --role admin
这条命令不产生输出显示。api
建立neutron
服务实体:
<pre>$ keystone service-create --name neutron --type network \
网络
--description "OpenStack Networking" | |
---|---|
Property | Value |
description | OpenStack Networking |
enabled | True |
id | d3cf8211db414c069701f39e778d9765 |
name | neutron |
type | network |
+-------------+----------------------------------+</pre>app
$ keystone endpoint-create \
--service-id $(keystone service-list | awk '/ network / {print $2}') \
--publicurl http://controller:9696 \
--adminurl http://controller:9696 \
--internalurl http://controller:9696 \框架
--region regionOne | |
---|---|
Property | Value |
adminurl | http://controller:9696 |
id | eb7fd6b67e4d4479886d164486a3fb71 |
internalurl | http://controller:9696 |
publicurl | http://controller:9696 |
region | regionOne |
service_id | d3cf8211db414c069701f39e778d9765 |
+-------------+----------------------------------+</pre>curl
# apt-get install neutron-server neutron-plugin-ml2 python-neutronclient
编辑# vi /etc/neutron/neutron.conf
文件:
在[database]
部分,设定数据库的访问选项,需把原始设定注释掉:
<pre>[database]
</pre>
...
connection = mysql://neutron:NEUTRON_DBPASS@controller/neutron
NEUTRON_DBPASS为建立neutron数据库时设立的密码。
在[DEFAULT]
部分,设定RabbitMQ的访问选项:
<pre>[DEFAULT]
</pre>
...
rpc_backend = rabbit
rabbit_host = controller
rabbit_password = RABBIT_PASS
RABBIT_PASS为RabbitMQ guest帐户的密码。
在[DEFAULT]
和[keystone_authtoken]
部分,设定认证服务的访问选项:
<pre>[DEFAULT]
</pre>
...
auth_strategy = keystone
<pre>[keystone_authtoken]
</pre>
...
auth_uri = http://controller:5000/v2.0
identity_uri = http://controller:35357
admin_tenant_name = service
admin_user = neutron
admin_password = NEUTRON_PASS
NEUTRON_PASS为建立neutron用户时使用的密码。在[keystone_authtoken]部分,注释掉 auth_host,auth_port,和auth_protocol的选项,由于identity_uri选项是直接代替它们的。
在[DEFAULT]
部分,开启Modular Layer 2(ML2)plug-in选项,设定router service和overlapping IP addresses选项:
<pre>[DEFAULT]
</pre>
...
core_plugin = ml2
service_plugins = router
allow_overlapping_ips = True
在[DEFAULT]
部分,设定网络服务能够通知计算服务网络拓扑的变化:
<pre>[DEFAULT]
</pre>
...
notify_nova_on_port_status_changes = True
notify_nova_on_port_data_changes = True
nova_url = http://controller:8774/v2
nova_admin_auth_url = http://controller:35357/v2.0
nova_region_name = regionOne
nova_admin_username = nova
nova_admin_tenant_id = SERVICE_TENANT_ID
nova_admin_password = NOVA_PASS
NEUTRON_PASS为建立neutron用户时使用的密码。SERVICE_TENANT_ID为认证服务中service
租户的ID,能够经过如下命令取得:
<pre>$ source admin-openrc.sh
$ keystone tenant-get service | |
---|---|
Property | Value |
description | Service Tenant |
enabled | True |
id | 5ab4d5c513f543cfbf8e3be97f5df5fb |
name | service |
+-------------+----------------------------------+</pre>
在[DEFAULT]
部分,开启“详细输出日志”选项:
<pre>[DEFAULT]
</pre>
...
verbose = True
ML2 plug-in使用Open vSwitch(OVS)机制(agent)来建立虚拟网络框架。因为controller节点不处理实例之间的网络通讯,故不须要OVS组件。
编辑# vi /etc/neutron/plugins/ml2/ml2_conf.ini
文件:
在[ml2]
部分,启用flat和generic routing encapsulation(GRE)网络类型的驱动( network type drivers),GRE 租户网络和OVS机制的驱动:
<pre>[ml2]
</pre>
...
type_drivers = flat,gre
tenant_network_types = gre
mechanism_drivers = openvswitch
在[ml2_type_gre]
部分,配置tunnel ID的范围:
<pre>[ml2_type_gre]
</pre>
...
tunnel_id_ranges = 1:1000
在[securitygroup]
部分,启用security groups,ipset, and configure,设定OVS iptables firewall driver:
<pre>[securitygroup]
</pre>
...
enable_security_group = True
enable_ipset = True
firewall_driver = neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver
编辑# vi /etc/nova/nova.conf
文件:
在[DEFAULT]
部分,设定API和驱动:
<pre>[DEFAULT]
</pre>
...
network_api_class = nova.network.neutronv2.api.API
security_group_api = neutron
linuxnet_interface_driver = nova.network.linux_net.LinuxOVSInterfaceDriver
firewall_driver = nova.virt.firewall.NoopFirewallDriver
在[neutron]
部分,设定访问参数:
<pre>[neutron]
</pre>
...
url = http://controller:9696
auth_strategy = keystone
admin_auth_url = http://controller:35357/v2.0
admin_tenant_name = service
admin_username = neutron
admin_password = NEUTRON_PASS
NEUTRON_PASS为建立neutron用户时使用的密码。
# neutron-db-manage --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade juno
# service nova-api restart
# service nova-scheduler restart
# service nova-conductor restart
# service neutron-server restart
admin
证书:$ source admin-openrc.sh
$ neutron ext-list
alias | name |
---|---|
security-group | security-group |
l3_agent_scheduler | L3 Agent Scheduler |
ext-gw-mode | Neutron L3 Configurable external gateway mode |
binding | Port Binding |
provider | Provider Network |
agent | agent |
quotas | Quota management support |
dhcp_agent_scheduler | DHCP Agent Scheduler |
l3-ha | HA Router extension |
multi-provider | Multi Provider Network |
external-net | Neutron external network |
router | Neutron L3 Router |
allowed-address-pairs | Allowed Address Pairs |
extraroute | Neutron Extra Route |
extra_dhcp_opt | Neutron Extra DHCP opts |
dvr | Distributed Virtual Router |
+-----------------------+-----------------------------------------------+</pre>
# vi /etc/sysctl.conf
文件:<pre>net.ipv4.ip_forward=1
</pre>
net.ipv4.conf.all.rp_filter=0
net.ipv4.conf.default.rp_filter=0
# sysctl -p
# apt-get install neutron-plugin-ml2 neutron-plugin-openvswitch-agent \
neutron-l3-agent neutron-dhcp-agent
编辑# vi /etc/neutron/neutron.conf
文件:
在[database]
部分,注释掉connection选项,由于network节点不须要直接访问数据库。
在[DEFAULT]
部分,设定RabbitMQ的访问选项:
<pre>[DEFAULT]
</pre>
...
rpc_backend = rabbit
rabbit_host = controller
rabbit_password = RABBIT_PASS
RABBIT_PASS为RabbitMQ guest帐户的密码。
在[DEFAULT]
和[keystone_authtoken]
部分,设定认证服务的访问选项:
<pre>[DEFAULT]
</pre>
...
auth_strategy = keystone
<pre>[keystone_authtoken]
</pre>
...
auth_uri = http://controller:5000/v2.0
identity_uri = http://controller:35357
admin_tenant_name = service
admin_user = neutron
admin_password = NEUTRON_PASS
NEUTRON_PASS为建立neutron用户时使用的密码。在[keystone_authtoken]部分,注释掉 auth_host,auth_port,和auth_protocol的选项,由于identity_uri选项是直接代替它们的。
在[DEFAULT]
部分,开启Modular Layer 2(ML2)plug-in选项,设定router service和overlapping IP addresses选项:
<pre>[DEFAULT]
</pre>
...
core_plugin = ml2
service_plugins = router
allow_overlapping_ips = True
在[DEFAULT]
部分,开启“详细输出日志”选项:
<pre>[DEFAULT]
</pre>
...
verbose = True
编辑# vi /etc/neutron/plugins/ml2/ml2_conf.ini
文件:
在[ml2]
部分,启用flat和generic routing encapsulation(GRE)网络类型的驱动( network type drivers),GRE 租户网络和OVS机制的驱动:
<pre>[ml2]
</pre>
...
type_drivers = flat,gre
tenant_network_types = gre
mechanism_drivers = openvswitch
在[ml2_type_flat]
部分,设定external flat provider network:
<pre>[ml2_type_flat]
</pre>
...
flat_networks = external
在[ml2_type_gre]
部分,设定tunnel ID范围:
<pre>[ml2_type_gre]
</pre>
...
tunnel_id_ranges = 1:1000
在[securitygroup]
部分,启用security groups,ipset, and configure,设定OVS iptables firewall driver:
<pre>[securitygroup]
</pre>
...
enable_security_group = True
enable_ipset = True
firewall_driver = neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver
在[ovs]
部分,启用tunnel,设定local tunnel endpoint,把external flat provider network和br-ex external network brigde绑定起来:
<pre>[ovs]
</pre>
...
local_ip = INSTANCE_TUNNELS_INTERFACE_IP_ADDRESS
enable_tunneling = True
bridge_mappings = external:br-ex
INSTANCE_TUNNELS_INTERFACE_IP_ADDRESS为network节点在tunnel network中的IP地址。
在[agent]
部分,启用GRE tunnels:
<pre>[agent]
</pre>
...
tunnel_types = gre
Layer-3(L3)agent为虚拟网络提供了routing service。
编辑# vi /etc/neutron/l3_agent.ini
文件:
在[DEFAULT]
部分,设定驱动,启用network namespace,设定external network bridge,启用deletion of defunct router namespaces:
<pre>[DEFAULT]
</pre>
...
interface_driver = neutron.agent.linux.interface.OVSInterfaceDriver
use_namespaces = True
external_network_bridge = br-ex
router_delete_namespaces = True
在[DEFAULT]
部分,开启“详细输出日志”选项:
<pre>[DEFAULT]
</pre>
...
verbose = True
DHCP agent为虚拟网络提供了DHCP服务。
编辑# vi /etc/neutron/dhcp_agent.ini
文件:
在[DEFAULT]
部分,设定驱动,启用namespaces,启用deletion of defunct DHCP namespaces:
<pre>[DEFAULT]
</pre>
...
interface_driver = neutron.agent.linux.interface.OVSInterfaceDriver
dhcp_driver = neutron.agent.linux.dhcp.Dnsmasq
use_namespaces = True
dhcp_delete_namespaces = True
在[DEFAULT]
部分,开启“详细输出日志”选项:
<pre>[DEFAULT]
</pre>
...
verbose = True
metadata agent提供了配置信息,好比实例的证书。
# vi /etc/neutron/metadata_agent.ini
文件:在[DEFAULT]
部分,设定访问参数:
<pre>[DEFAULT]
...
auth_url = http://controller:5000/v2.0
auth_region = regionOne
admin_tenant_name = service
admin_user = neutron
admin_password = NEUTRON_PASS</pre>
NEUTRON_PASS为建立neutron用户时使用的密码。
在[DEFAULT]
部分,设定metadata host:
<pre>[DEFAULT]
</pre>
...
nova_metadata_ip = controller
在[DEFAULT]
部分,设定metadata proxy shared secret:
<pre>[DEFAULT]
</pre>
...
metadata_proxy_shared_secret = METADATA_SECRET
把METADATA_SECRET替换为合适的密码。
在[DEFAULT]
部分,开启“详细输出日志”选项:
<pre>[DEFAULT]
</pre>
...
verbose = True
# vi /etc/nova/nova.conf
文件:[neutron]
部分,启用metadata proxy,设定密码选项:[neutron]
...
service_metadata_proxy = True
metadata_proxy_shared_secret = METADATA_SECRET</pre>
把METADATA_SECRET替换为metadata proxy中设定的密码。
# service nova-api restart
OVS服务为实例提供虚拟网络框架。integration bridge br-int处理内网通讯,external bridge br-ex处理外网通讯。external bridge须要物理外网提供一个访问端口,来链接物理网络和虚拟网络。
# service openvswitch-switch restart
# ovs-vsctl add-br br-ex
# ovs-vsctl add-port br-ex INTERFACE_NAME
INTERFACE_NAME替换为实际的interface name,本文的网络配置方案下为eth2
重启网络服务:# service neutron-plugin-openvswitch-agent restart
# service neutron-l3-agent restart
# service neutron-dhcp-agent restart
# service neutron-metadata-agent restart
在controller节点上进行以下操做。
admin
证书: $ source admin-openrc.sh
$ neutron agent-list
id | agent_type | host | alive | admin_state_up | binary |
---|---|---|---|---|---|
2be5bff5-2d4b-4308-9d8e-218f86f0884e | DHCP agent | network | :-) | True | neutron-dhcp-agent |
35e5874c-0e45-44b1-95e5-f5ac94a1b9d5 | L3 agent | network | :-) | True | neutron-l3-agent |
7debcbec-b316-490e-baa1-1a6bb74fcbbb | Open vSwitch agent | network | :-) | True | neutron-openvswitch-agent |
c35af91b-9f6b-4632-bc10-aa67c8a75ae1 | Metadata agent | network | :-) | True | neutron-metadata-agent |
+--------------------------------------+--------------------+---------+-------+----------------+---------------------------+</pre>
# vi /etc/sysctl.conf
文件:net.ipv4.conf.all.rp_filter=0
net.ipv4.conf.default.rp_filter=0</pre>
# sysctl -p
# apt-get install neutron-plugin-ml2 neutron-plugin-openvswitch-agent
编辑# vi /etc/neutron/neutron.conf
文件:
在[database]
部分,注释掉connection选项,由于compute节点不须要直接访问数据库。
在[DEFAULT]
部分,设定RabbitMQ的访问选项:
<pre>[DEFAULT]
</pre>
...
rpc_backend = rabbit
rabbit_host = controller
rabbit_password = RABBIT_PASS
RABBIT_PASS为RabbitMQ guest帐户的密码。
在[DEFAULT]
和[keystone_authtoken]
部分,设定认证服务的访问选项:
<pre>[DEFAULT]
</pre>
...
auth_strategy = keystone
<pre>[keystone_authtoken]
</pre>
...
auth_uri = http://controller:5000/v2.0
identity_uri = http://controller:35357
admin_tenant_name = service
admin_user = neutron
admin_password = NEUTRON_PASS
NEUTRON_PASS为建立neutron用户时使用的密码。在[keystone_authtoken]部分,注释掉 auth_host,auth_port,和auth_protocol的选项,由于identity_uri选项是直接代替它们的。
在[DEFAULT]
部分,开启Modular Layer 2(ML2)plug-in选项,设定router service和overlapping IP addresses选项:
<pre>[DEFAULT]
</pre>
...
core_plugin = ml2
service_plugins = router
allow_overlapping_ips = True
在[DEFAULT]
部分,开启“详细输出日志”选项:
<pre>[DEFAULT]
</pre>
...
verbose = True
编辑# vi /etc/neutron/plugins/ml2/ml2_conf.ini
文件:
在[ml2]
部分,启用flat和generic routing encapsulation(GRE)网络类型的驱动( network type drivers),GRE 租户网络和OVS机制的驱动:
<pre>[ml2]
</pre>
...
type_drivers = flat,gre
tenant_network_types = gre
mechanism_drivers = openvswitch
在[ml2_type_gre]
部分,设定tunnel ID范围:
<pre>[ml2_type_gre]
</pre>
...
tunnel_id_ranges = 1:1000
在[securitygroup]
部分,启用security groups,ipset, and configure,设定OVS iptables firewall driver:
<pre>[securitygroup]
</pre>
...
enable_security_group = True
enable_ipset = True
firewall_driver = neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver
在[ovs]
部分,启用tunnel,设定local tunnel endpoint,把external flat provider network和br-ex external network brigde绑定起来:
<pre>[ovs]
</pre>
...
local_ip = INSTANCE_TUNNELS_INTERFACE_IP_ADDRESS
enable_tunneling = True
bridge_mappings = external:br-ex
INSTANCE_TUNNELS_INTERFACE_IP_ADDRESS为network节点在tunnel network中的IP地址。
在[agent]
部分,启用GRE tunnels:
<pre>[agent]
</pre>
...
tunnel_types = gre
重启OVS服务:# service openvswitch-switch restart
编辑# vi /etc/nova/nova.conf
文件:
在[DEFAULT]
部分,设定API和驱动:
<pre>[DEFAULT]
</pre>
...
network_api_class = nova.network.neutronv2.api.API
security_group_api = neutron
linuxnet_interface_driver = nova.network.linux_net.LinuxOVSInterfaceDriver
firewall_driver = nova.virt.firewall.NoopFirewallDriver
在[neutron]
部分,设定访问参数:
<pre>[neutron]
</pre>
...
url = http://controller:9696
auth_strategy = keystone
admin_auth_url = http://controller:35357/v2.0
admin_tenant_name = service
admin_username = neutron
admin_password = NEUTRON_PASS
NEUTRON_PASS为建立neutron用户时使用的密码。
# service nova-compute restart
# service neutron-plugin-openvswitch-agent restart
在controller节点上执行以下操做:
admin
证书: $ source admin-openrc.sh
$ neutron agent-list
id | agent_type | host | alive | admin_state_up | binary |
---|---|---|---|---|---|
03586491-fbf0-495f-93d9-77704ffdba61 | Open vSwitch agent | compute | :-) | True | neutron-openvswitch-agent |
2be5bff5-2d4b-4308-9d8e-218f86f0884e | DHCP agent | network | xxx | True | neutron-dhcp-agent |
35e5874c-0e45-44b1-95e5-f5ac94a1b9d5 | L3 agent | network | xxx | True | neutron-l3-agent |
7debcbec-b316-490e-baa1-1a6bb74fcbbb | Open vSwitch agent | network | xxx | True | neutron-openvswitch-agent |
c35af91b-9f6b-4632-bc10-aa67c8a75ae1 | Metadata agent | network | xxx | True | neutron-metadata-agent |
+--------------------------------------+--------------------+---------+-------+----------------+---------------------------+</pre>