Openstack（十一）部署网络服务neutron（控制节点）

11.1neutron服务介绍

neutron是openstack的网络组件，是OpenStack的网络服务，Openstack在2010年正式发布它的第一个版本Austin的时候，nova-network作为它的核心组件被包含其中，因为商标侵权的原因，Openstack在Havana版本上将Quantum(美国昆腾公司, 昆腾公司的硬盘驱动器业务于2000年4月2日被迈拓(Maxtor)公司收购，随后迈拓于2005年被希捷(Seagate)收购)更名为Neutron，以下是网络的简单介绍：

网络：在显示的网络环境中我们使用交换机将多个计算机连接起来从而形成了网络，而在neutron的环境里，网络的功能也是将多个不同的云主机连接起来。

子网：是现实的网络环境下可以将一个网络划分成多个逻辑上的子网络，从而实现网络隔离，在neutron里面子网也是属于网络。

端口：计算机连接交换机通过网线连，而网线插在交换机的不同端口，在neutron里面端口属于子网，即每个云主机的子网都会对应到一个端口。

路由器：用于连接不通的网络或者子网。

下面是插件图：

网络类型：

提供者网络：虚拟机桥接到物理机，并且虚拟机必须和物理机在同一个网络范围内。

自服务网络：可以自己创建网络，最终会通过虚拟路由器连接外网

11.2数据库准备

11.2.1 SQL服务器创建数据库并授权：

# mysql

> CREATE DATABASE neutron;

> GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'%'  IDENTIFIED BY 'neutron123';

> flush privileges;

11.2.2控制端测试连接

# mysql -uneutron -pneutron123 -h192.168.10.100

11.3创建neutron服务并注册

11.3.1创建neutron服务：

# openstack service create --name neutron --description "OpenStack Networking" network

+-------------+----------------------------------+

| Field       | Value                            |

+-------------+----------------------------------+

| description | OpenStack Networking             |

| enabled     | True                             |

| id          | 154c0450a2be4a8fa0d8819e5f045bc0 |

| name        | neutron                          |

| type        | network                          |

+-------------+----------------------------------+

11.3.2注册公共端点

# openstack endpoint create --region RegionOne  network public http://192.168.10.100:9696

+--------------+----------------------------------+

| Field        | Value                            |

+--------------+----------------------------------+

| enabled      | True                             |

| id           | ba022a5dd78c469bb4f82bc655d84720 |

| interface    | public                           |

| region       | RegionOne                        |

| region_id    | RegionOne                        |

| service_id   | 154c0450a2be4a8fa0d8819e5f045bc0 |

| service_name | neutron                          |

| service_type | network                          |

| url          | http://192.168.10.100:9696       |

+--------------+----------------------------------+

11.3.3注册私有端点

# openstack endpoint create --region RegionOne  network internal http://192.168.10.100:9696

+--------------+----------------------------------+

| Field        | Value                            |

+--------------+----------------------------------+

| enabled      | True                             |

| id           | b608eee2d21a4808953e5a9a9e761e92 |

| interface    | internal                         |

| region       | RegionOne                        |

| region_id    | RegionOne                        |

| service_id   | 154c0450a2be4a8fa0d8819e5f045bc0 |

| service_name | neutron                          |

| service_type | network                          |

| url          | http://192.168.10.100:9696       |

+--------------+----------------------------------+

11.3.4注册管理端点

# openstack endpoint create --region RegionOne  network admin http://192.168.10.100:9696

+--------------+----------------------------------+

| Field        | Value                            |

+--------------+----------------------------------+

| enabled      | True                             |

| id           | 00a1f952c49348e09f4ebfeb20233825 |

| interface    | admin                            |

| region       | RegionOne                        |

| region_id    | RegionOne                        |

| service_id   | 154c0450a2be4a8fa0d8819e5f045bc0 |

| service_name | neutron                          |

| service_type | network                          |

| url          | http://192.168.10.100:9696       |

+--------------+----------------------------------+

11.3.5验证端点添加成功

11.4配置haproxy负载

11.4.1配置haproxy

# vim /etc/haproxy/haproxy.cfg

listen neutron

bind 192.168.10.100:9696

mode tcp

log global

balance source

server neutron-server 192.168.10.201:9696 check inter 5000 rise 3 fall 3

#重启haproxy

# systemctl  restart haproxy

11.4.2验证端口

11.5安装neutron控制端

# yum install -y openstack-neutron openstack-neutron-ml2   openstack-neutron-linuxbridge ebtables

11.6配置neutron服务

11.6.1编辑neutron.conf

# vim /etc/neutron/neutron.conf

[DEFAULT]

766 connection = mysql+pymysql://neutron:neutron123@192.168.10.100/neutron

30 core_plugin = ml2

33 service_plugins =

570 transport_url = rabbit://openstack:123456@192.168.10.205

27 auth_strategy = keystone

99 notify_nova_on_port_status_changes = true

103 notify_nova_on_port_data_changes = true

846 [keystone_authtoken]

847 auth_uri = http://192.168.10.100:5000

848 auth_url = http://192.168.10.100:35357

849 memcached_servers = 192.168.10.100:11211

850 auth_type = password

851 project_domain_name = default

852 user_domain_name = default

853 project_name = service

854 username = neutron

855 password = neutron

1075 [nova]

1076 auth_url = http://192.168.10.100:35357

1077 auth_type = password

1078 project_domain_name = default

1079 user_domain_name = default

1080 region_name = RegionOne

1081 project_name = service

1082 username = nova

1083 password = nova

[oslo_concurrency]

1197 lock_path = /var/lib/neutron/tmp

11.6.2Modular Layer2

# ML2插件使用Linuxbridge机制来为实例创建layer－2虚拟网络基础设施

# vim /etc/neutron/plugins/ml2/ml2_conf.ini

1:[DEFAULT]

113:[ml2]

122:type_drivers = flat,vlan

127:tenant_network_types =

131:mechanism_drivers = linuxbridge

136:extension_drivers = port_security

163:[ml2_type_flat]

172:flat_networks = internal

233:[securitygroup]

249:enable_ipset = true

11.6.3配置linuxbridge代理

# vim /etc/neutron/plugins/ml2/linuxbridge_agent.ini

1:[DEFAULT]

113:[agent]

144:[linux_bridge]

155:physical_interface_mappings = internal:band0

161:[securitygroup]

168:firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver

173:enable_security_group = true

180:[vxlan]

188:enable_vxlan = false

11.6.4配置DHCP代理

# vim /etc/neutron/dhcp_agent.ini

16 interface_driver = linuxbridge

32 dhcp_driver =  neutron.agent.linux.dhcp.Dnsmasq

41 enable_isolated_metadata = true

11.6.5配置元数据

# vim /etc/neutron/metadata_agent.ini

1:[DEFAULT]

22:nova_metadata_ip = 192.168.10.100

34:metadata_proxy_shared_secret = 20170912

185:[agent]

200:[cache]

11.6.6配置nova调用neutron

# vim  /etc/nova/nova.conf

6935 [neutron]

6936 url = http://192.168.10.100:9696

6937 auth_url = http://192.168.10.100:35357

6938 auth_type = password

6939 project_domain_name = default

6940 user_domain_name = default

6941 region_name = RegionOne

6942 project_name = service

6943 username = neutron

6944 password = neutron

6945 service_metadata_proxy = true

6946 metadata_proxy_shared_secret = 20170912

11.6.7创建软链接

# ln -sv /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugin.ini

11.6.8初始化数据库

# su -s /bin/sh -c "neutron-db-manage --config-file /etc/neutron/neutron.conf  --config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade head" neutron

11.6.9重启nova API服务

# systemctl restart openstack-nova-api.service

# tail -n200 /var/log/nova/nova-api.log  -f

11.6.10配置haproxy代理

# 负载服务器

# vim /etc/haproxy/haproxy.cfg

listen nova-api

bind 192.168.10.100:8775

mode tcp

log global

balance source

server nova-server1 192.168.10.201:8775 check inter 5000 rise 3 fall 3

# systemctl restart haproxy

11.7启动neutron服务

# systemctl enable neutron-server.service   neutron-linuxbridge-agent.service neutron-dhcp-agent.service   neutron-metadata-agent.service

# systemctl start neutron-server.service   neutron-linuxbridge-agent.service neutron-dhcp-agent.service   neutron-metadata-agent.service

11.8验证neutron日志

# tail -f /var/log/neutron/*.log

11.9验证neutron控制端日否注册成功

#此步骤要求各服务器时间必须一致

# neutron agent-list

11.10neutron控制端重启脚本

# vim neutron-restart.sh

#!/bin/bash

systemctl restart openstack-nova-api.service  neutron-server.service  neutron-linuxbridge-agent.service neutron-dhcp-agent.service neutron-metadata-agent.service

# chmod  a+x neutron-restart.sh