RDO部署openstack（3）

目前OpenStackNeutron框架支持的网络服务有：LoadBalancing as a Service，VPNas a Service，Firewallas a Service。

1. 安装和配置网络服务（在网络节点上）

(1) 安装软件包

yum install openstack-neutron-vpn-agent openstack-neutron openswan haproxy

/etc/sysctl.conf:
net.ipv4.conf.default.accept_redirects=0
net.ipv4.conf.default.send_redirects=0

(2) VPNaaS的特别要求

检查Ipsec服务状态，VPNaaS需要。
chkconfig ipsec on
service ipsec start
ipsec verify

ln -s /dev/urandom /dev/random

(3) 配置服务（我这边把三类服务一起配了，其实一看就该明白，配置项都类似）

/usr/share/neutron/neutron-dist.conf
service_provider = LOADBALANCER:Haproxy:neutron.services.loadbalancer.drivers.haproxy.plugin_driver.HaproxyOnHostPluginDriver:default
service_provider = VPN:openswan:neutron.services.vpn.service_drivers.ipsec.IPsecVPNDriver:default
service_provider = FIREWALL:Iptables:neutron.services.firewall.drivers.linux.iptables_fwaas.IptablesFwaasDriver

/etc/neutron/neutron.conf
service_plugins = neutron.services.l3_router.l3_router_plugin.L3RouterPlugin,neutron.services.loadbalancer.plugin.LoadBalancerPlugin, neutron.services.firewall.fwaas_plugin.FirewallPlugin,neutron.services.vpn.plugin.VPNDriverPlugin

/etc/neutron/fwaas_driver.ini
[fwaas]
#driver =neutron.services.firewall.drivers.linux.iptables_fwaas.IptablesFwaasDriver
enabled = True

/etc/neutron/vpn_agent.ini
[DEFAULT]
# VPN-Agent configuration file
# Note vpn-agent inherits l3-agent, so you can use configs on l3-agent also

[vpnagent]
#vpn device drivers which vpn agent will use
#If we want to use multiple drivers, we need to define this option multipletimes.
vpn_device_driver=neutron.services.vpn.device_drivers.ipsec.OpenSwanDriver
#vpn_device_driver=another_driver

[ipsec]
#Status check interval
#ipsec_status_check_interval=60

/etc/neutron/lbaas_agent.ini
[DEFAULT]
# Show debugging output in log (sets DEBUG log level output).
# debug = False
debug = False

# The LBaaS agent will resync its state with Neutron to recoverfrom any
# transient notification or rpc errors. The interval is number of
# seconds between attempts.
# periodic_interval = 10

# LBaas requires an interface driver be set. Choose the one thatbest
# matches your plugin.
# interface_driver =
interface_driver =neutron.agent.linux.interface.OVSInterfaceDriver

# Example of interface_driver option for OVS based plugins (OVS, Ryu, NEC, NVP,
# BigSwitch/Floodlight)
# interface_driver = neutron.agent.linux.interface.OVSInterfaceDriver

# Use veth for an OVS interface or not.
# Support kernels with limited namespace support
# (e.g. RHEL 6.5) so long as ovs_use_veth is set to True.
# ovs_use_veth = False

# Example of interface_driver option for LinuxBridge
#interface_driver = neutron.agent.linux.interface.BridgeInterfaceDriver

# The agent requires a driver to manage the loadbalancer. HAProxy is the
# opensource version.
# device_driver = neutron.services.loadbalancer.drivers.haproxy.namespace_driver.HaproxyNSDriver
device_driver = neutron.services.loadbalancer.drivers.haproxy.namespace_driver.HaproxyNSDriver

# The user group
# user_group = nogroup
user_group = haproxy
use_namespaces=True

 

 

Neutron安全组的配置需要仔细。

需要在所有计算节点上配置：

/etc/nova/nova.conf:

# 该配置项有时候会遗漏，导致iptables策略无法生效
libvirt_vif_driver = nova.virt.libvirt.vif.LibvirtHybridOVSBridgeDriver

linuxnet_interface_driver =nova.network.linux_net.LinuxOVSInterfaceDriver

# 让Nova在调用安全组API时，直接通知neutron处理

security_group_api = neutron

# 配置Nova禁用firewalldriver
firewall_driver = nova.virt.firewall.NoopFirewallDriver

/etc/neutron/ovs_neutron_plugin.ini:
firewall_driver = neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver

 

/etc/init.d/neutron-vpn-agent start

/etc/init.d/neutron-lbaas-agent start

/etc/init.d/neutron-l3-agent restart

/etc/init.d/neutron-server restart