openstack私有云布署实践【12.1 网络Neutron-controller节点配置（科兴环境）】
网络这一块推荐使用的是 Neutron--LinuxBirdge的Ha高可用，此高可用方案对Public作用不是很大，Public只用到DHCP，而Private则会用到L3 Agent，则此方案是有用的，但要关掉和牺牲一个L3 population的特性--抑制ARP报文广播。原因在下文的配置文件有说明，并因我们布的是私有云，不像公有云的多租户private网络数量之大，这个特性牺牲在中小私有云是可接受的。
一、首先登录kxcontroller1创建kx_neutron数据库，并赋于远程和本地访问的权限。
mysql -u root -p
CREATE DATABASE kx_neutron;
GRANT ALL PRIVILEGES ON kx_neutron.* TO 'neutron'@'localhost' IDENTIFIED BY 'venic8888';
GRANT ALL PRIVILEGES ON kx_neutron.* TO 'neutron'@'%' IDENTIFIED BY 'venic8888';
flush PRIVILEGES;
二、身份认证调用
其中一台controller创建身份认证调用
source admin-openrc.sh
openstack user create --domain default --password-prompt neutron
User Password:
Repeat User Password:
+-----------+----------------------------------+
| Field | Value |
+-----------+----------------------------------+
| domain_id | default |
| enabled | True |
| id | b20a6692f77b4258926881bf831eb683 |
| name | neutron |
+-----------+----------------------------------+
openstack role add --project service --user neutron admin
openstack service create --name neutron --description "OpenStack Networking" network
+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | OpenStack Networking |
| enabled | True |
| id | f71529314dab4a4d8eca427e701d209e |
| name | neutron |
| type | network |
+-------------+----------------------------------+
openstack endpoint create --region RegionTwo network public http://kxcontroller:9696
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | 85d80a6d02fc4b7683f611d7fc1493a3 |
| interface | public |
| region | RegionTwo |
| region_id | RegionTwo |
| service_id | f71529314dab4a4d8eca427e701d209e |
| service_name | neutron |
| service_type | network |
| url | http://kxcontroller:9696 |
+--------------+----------------------------------+
openstack endpoint create --region RegionTwo network internal http://kxcontroller:9696
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | 09753b537ac74422a68d2d791cf3714f |
| interface | internal |
| region | RegionOne |
| region_id | RegionOne |
| service_id | f71529314dab4a4d8eca427e701d209e |
| service_name | neutron |
| service_type | network |
| url | http://kxcontroller:9696 |
+--------------+----------------------------------+
openstack endpoint create --region RegionTwo network admin http://kxcontroller:9696
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | 1ee14289c9374dffb5db92a5c112fc4e |
| interface | admin |
| region | RegionOne |
| region_id | RegionOne |
| service_id | f71529314dab4a4d8eca427e701d209e |
| service_name | neutron |
| service_type | network |
| url | http://kxcontroller:9696 |
+--------------+----------------------------------+
三、下载安装neutron组件
1公有网络配置+私有网络配置
2台kxcontroller配置
# yum install openstack-neutron openstack-neutron-ml2 openstack-neutron-linuxbridge python-neutronclient ebtables ipset -y
修改新增内核参数：
vi /etc/sysctl.conf
net.ipv4.ip_forward=1
net.ipv4.conf.default.rp_filter=0
net.ipv4.conf.all.rp_filter=0
sysctl -p
配置neutron.conf服务
在kxcontroller1
vi /etc/neutron/neutron.conf
[DEFAULT]
core_plugin = ml2
service_plugins = router
allow_overlapping_ips = True
rpc_backend = rabbit
auth_strategy = keystone
bind_host = 10.120.42.1
bind_port = 9696
l3_ha = True
max_l3_agents_per_router = 3
min_l3_agents_per_router = 2
allow_automatic_l3agent_failover = True
dhcp_agents_per_network = 2
notify_nova_on_port_status_changes = True
notify_nova_on_port_data_changes = True
nova_url = http://kxcontroller:8774/v2
verbose = True
[database]
connection = mysql://neutron:venic8888@kxcontroller/kx_neutron
[keystone_authtoken]
auth_uri = http://kxcontroller:5000
auth_url = http://kxcontroller:35357
auth_plugin = password
project_domain_id = default
user_domain_id = default
project_name = service
username = neutron
password = neutron
[nova]
auth_url = http://kxcontroller:35357
auth_plugin = password
project_domain_id = default
user_domain_id = default
region_name = RegionTwo
project_name = service
username = nova
password = nova
[oslo_messaging_rabbit]
rabbit_host=kxcontroller
rabbit_userid = openstack
rabbit_password = openstack
[oslo_concurrency]
lock_path = /var/lib/neutron/tmp
[quotas]
quota_port = 10000
在kxcontroller2
vi /etc/neutron/neutron.conf
[DEFAULT]
core_plugin = ml2
service_plugins = router
allow_overlapping_ips = True
rpc_backend = rabbit
auth_strategy = keystone
bind_host = 10.120.42.2
bind_port = 9696
l3_ha = True
max_l3_agents_per_router = 3
min_l3_agents_per_router = 2
allow_automatic_l3agent_failover = True
dhcp_agents_per_network = 2
notify_nova_on_port_status_changes = True
notify_nova_on_port_data_changes = True
nova_url = http://kxcontroller:8774/v2
verbose = True
[database]
connection = mysql://neutron:venic8888@kxcontroller/kx_neutron
[keystone_authtoken]
auth_uri = http://kxcontroller:5000
auth_url = http://kxcontroller:35357
auth_plugin = password
project_domain_id = default
user_domain_id = default
project_name = service
username = neutron
password = neutron
[nova]
auth_url = http://kxcontroller:35357
auth_plugin = password
project_domain_id = default
user_domain_id = default
region_name = RegionTwo
project_name = service
username = nova
password = nova
[oslo_messaging_rabbit]
rabbit_host=kxcontroller
rabbit_userid = openstack
rabbit_password = openstack
[oslo_concurrency]
lock_path = /var/lib/neutron/tmp
[quotas]
quota_port = 10000
配置ML2服务配置
2台kxcontroller上配置一样
vi /etc/neutron/plugins/ml2/ml2_conf.ini
[ml2]
type_drivers = flat,vlan,vxlan
tenant_network_types = vxlan
extension_drivers = port_security
mechanism_drivers = linuxbridge
[ml2_type_flat]
flat_networks = public
[ml2_type_vxlan]
vni_ranges = 1:10000
vxlan_group = 239.2.1.1
[securitygroup]
enable_ipset = True
配置Linux bridge服务，跟单服务的自由版本的配法不同，这次使用的l3 HA，不用使用l2_population机制，因有BGU还没修复（切换时，虽然publick的VRRP切换成功。private网段的网关不会触发更新，VM虚拟是PING不通private的网关）
在kxcontroller1上
vi /etc/neutron/plugins/ml2/linuxbridge_agent.ini
[linux_bridge]
physical_interface_mappings = public:bond0
[vxlan]
enable_vxlan = True
local_ip = 10.120.42.1
l2_population = False
[agent]
prevent_arp_spoofing = True
[securitygroup]
enable_security_group = True
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
在kxcontroller2上
vi /etc/neutron/plugins/ml2/linuxbridge_agent.ini
[linux_bridge]
physical_interface_mappings = public:bond0
[vxlan]
enable_vxlan = True
local_ip = 10.120.42.2
l2_population = False
[agent]
prevent_arp_spoofing = True
[securitygroup]
enable_security_group = True
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
配置L3-agent服务
2台kxcontroller配置一样
vi /etc/neutron/l3_agent.ini
[DEFAULT]
interface_driver = neutron.agent.linux.interface.BridgeInterfaceDriver
external_network_bridge =
verbose = True
router_delete_namespaces = True
agent_mode = legacy
配置DHCP服务
2台kxcontroller配置一样
vi /etc/neutron/dhcp_agent.ini
[DEFAULT]
interface_driver = neutron.agent.linux.interface.BridgeInterfaceDriver
dhcp_driver = neutron.agent.linux.dhcp.Dnsmasq
enable_isolated_metadata = True
verbose = True
use_namespaces = True
dhcp_delete_namespaces = True
dnsmasq_config_file = /etc/neutron/dnsmasq-neutron.conf
额外配置DHCP MTU配置
2台kxcontroller配置一样
vi /etc/neutron/dnsmasq-neutron.conf
dhcp-option-force=26,1450
配置metadata agent
2台kxcontroller配置一样
vi /etc/neutron/metadata_agent.ini
[DEFAULT]
auth_uri = http://kxcontroller:5000
auth_url = http://kxcontroller:35357
auth_region = RegionTwo
auth_plugin = password
project_domain_id = default
user_domain_id = default
project_name = service
username = neutron
password = neutron
nova_metadata_ip = kxcontroller
metadata_proxy_shared_secret = venicchina
新加配置nova与neutron关联-----在11节中我就有提到的那个紫色的配置，这里再提一次
vi /etc/nova/nova.conf
[neutron]
url = http://kxcontroller:9696
auth_url = http://kxcontroller:35357
auth_plugin = password
project_domain_id = default
user_domain_id = default
region_name = RegionTwo
project_name = service
username = neutron
password = neutron
service_metadata_proxy = True
metadata_proxy_shared_secret = venicchina
验证：
1、两台kxcontroller软链接
ln -s /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugin.ini
2、其中一台kxcontroller同步数据
# su -s /bin/sh -c "neutron-db-manage --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade head" neutron
3、两台kxcontroller重启nova api
# systemctl restart openstack-nova-api.service
4、两台controller开启网络服务，加入开机自启
# systemctl enable neutron-server.service neutron-linuxbridge-agent.service neutron-dhcp-agent.service neutron-metadata-agent.service neutron-l3-agent.service
# systemctl start neutron-server.service neutron-linuxbridge-agent.service neutron-dhcp-agent.service neutron-metadata-agent.service neutron-l3-agent.service
openstack私有云布署实践【12.1 网络Neutron-controller节点配置（科兴环境）】的更多相关文章
- openstack私有云布署实践【4.1 上层代理haproxy配置 (科兴环境)】
官方文档上的高可用配置,它推荐的是使用haproxy的上层代理来实现服务组件的主备访问.或者负载均衡访问 一开始我也是使用haproxy来做的,但后来方式改了 测试环境:haproxy + n ...
- openstack私有云布署实践【9.1 Glance镜像管理（科兴环境）】
首先登录kxcontroller1创建kx_glance数据库,并赋于远程和本地访问的权限. mysql -u root -p CREATE DATABASE kx_glance; GR ...
- openstack私有云布署实践【14.1 登录页dashboard-controller（科兴环境）】
2台kxcontroller安装组件 # yum install openstack-dashboard -y 修改一样的配置 vi /etc/openstack-dashboard/local_ ...
- openstack私有云布署实践【9.3 主从controller单向同步glance-image目录】
采用Rysnc单向同步,而不用双方实时同步,原因是在历史的运行过程中,我们发现,有些镜像包太大,当在主用的glance将镜像保存时,并不是一时半会就把镜像保存好,当主用在保存时,备用节点又在实时同步那 ...
- openstack私有云布署实践【9.2 Glance镜像管理（办公网环境）】
首先登录controller1创建glance数据库,并赋于远程和本地访问的权限. mysql -u root -p CREATE DATABASE glance; GRANT ALL ...
- openstack私有云布署实践【14.2 登录页dashboard-controller（办公网环境）】
这一小节基本配置相同,但留意以下紫色部份的配置,当初为了管理方便,我们让办公网openstack的dashboard的登录桥接了科兴的dashboard,由此统一dashboard界面的登录地址 ...
- openstack私有云布署实践【2 安装前的服务器基本环境准备】
服务器物理机都安装centos7.2 1511版本 , 此次采用的分区方式全是自动XFS格式LVM,在装系统时就将所有本地raid5硬盘都加入LVM全用了.默认/home目录有着最大的硬盘空间 并且我 ...
- openstack私有云布署实践【12.2 网络Neutron-controller节点配置（办公网环境）】
网络这一块推荐使用的是 Neutron--LinuxBirdge的Ha高可用,此高可用方案对Public作用不是很大,Public只用到DHCP,而Private则会用到L3 Agent,则此方案是有 ...
- openstack私有云布署实践【0 前言】
管理控制层面示图: 其实在修改这个布署文档是,我发现当时生产中的布署已经严重偏离了openstack高可用的指导思想.我们自己实践的高可用其实是适应自己的架构而做的调整,因为我们现实手头上中没有比较符 ...
随机推荐
- 微信--高效解决token及授权用户openid的持久化处理办法
摘要 关于微信开发的话题,例子确实已经有不少,但大部分都是人云亦云,很多小细节或者需要注意的地方却大多没有讲清楚,这令很多刚开始开发的人感觉大很迷茫.而我今天要说的话题,主要着眼于两个方面. 一:如 ...
- 安装oracle11数据库时,先决条件都失败怎么处理?
安装oracle11数据库时,先决条件都失败怎么处理?
- HMM 前向后向算法（转）
最近研究NLP颇感兴趣,但由于比较懒,所以只好找来网上别人的比较好的博客,备份一下,也方便自己以后方便查找(其实,一般是不会再回过头来看的,嘿嘿 -_-!!) 代码自己重新写了一遍,所以就不把原文代码 ...
- jmeter（八）-JDBC请求（sqlserver）
做JDBC请求,首先要了解这个JDBC对象是什么,然后寻找响应的数据库连接URL和数据库驱动. 数据库URL:jdbc:sqlserver://200.99.197.190:1433;database ...
- JSTL标签库--核心标签库
->JSTL的使用和EL表达式是分不开的 ->JSTL标签库分为5类 1.核心标签库(这里只介绍该标签库) 2.I18N格式化标签库 3.SQL标签库 4.XML标签库 5.函数标签库 - ...
- 一步步优化JVM五：优化延迟或者响应时间
本节的目标是做一些优化以满足对应用对延迟的需求.这次需要几个步骤,包括完善Java堆大小的配置,评估垃圾回收占用的时间和频率,也许还要尝试切换到不同的垃圾回收器,以及由于使用了不同的垃圾回收器,需要重 ...
- CoreJavaE10V1P3.2 第3章 Java的基本编程结构－3.2 注释
3.2 注释 1. //形式注释 System.out.println("We will not use 'Hello, World!'"); // is this too cut ...
- ios用storyboard快速创建静态cell
在实际开发中经常会遇到下面这样的页面,通常我们用静态cell来做可以快速创建,提高效率 下面讲一下用storyboard创建方法,将一个tableViewController控制器拖入storyboa ...
- js 中的 exec（ ）方法
JavaScript exec() 方法 JavaScript RegExp 对象 定义和用法 exec() 方法用于检索字符串中的正则表达式的匹配. 语法:RegExpObject.exec(str ...
- memcahced缓存特点
1.key-value数据结构 2.所有数据保存在内存中 3.可以分布式集群 4.处理并发的机制是libevent事件机制 5.当内容容量达到指定值后,就基于LRU(Least Recently Us ...