离线部署openstack 2024.1 neutron

控制节点网络服务

离线下载

apt install --download-only neutron-server neutron-plugin-ml2 neutron-openvswitch-agent neutron-dhcp-agent neutron-metadata-agent neutron-l3-agent python3-neutron

mkdir /controller/neutron
mv /var/cache/apt/archives/*.deb /controller/neutron/
dpkg -i /controller/neutron/*.deb

在一个控制节点操作

CREATE DATABASE neutron;
GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'localhost' IDENTIFIED BY 'NEUTRON_DBPASS';
GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'%' IDENTIFIED BY 'NEUTRON_DBPASS';
FLUSH PRIVILEGES;

openstack user create --domain default --password NEUTRON_PASS neutron
openstack role add --project service --user neutron admin
openstack service create --name neutron --description "OpenStack Networking" network

openstack endpoint create --region RegionOne network public http://<VIP>:9696
openstack endpoint create --region RegionOne network internal http://<VIP>:9696
openstack endpoint create --region RegionOne network admin http://<VIP>:9696

在三个控制节点操作

• 主要配置

vim /etc/neutron/neutron.conf

[DEFAULT]
core_plugin = ml2
service_plugins = router
transport_url = rabbit://neutron:NEUTRON_PASS@ip1,ip2,ip3
auth_strategy = keystone
notify_nova_on_port_status_changes = true
notify_nova_on_port_data_changes = true
dhcp_agent_notification = true
l3_ha = true
allow_overlapping_ips = true
state_path = /var/lib/neutron

[database]
connection = mysql+pymysql://neutron:NEUTRON_DBPASS@<VIP>/neutron

[keystone_authtoken]
www_authenticate_uri = http://<VIP>:5000/
auth_url = http://<VIP>:5000/
memcached_servers = ip1:11211,ip2:11211,ip3:11211
auth_type = password
project_domain_name = Default
user_domain_name = Default
project_name = service
username = neutron
password = NEUTRON_PASS
service_token_roles_required = true
service_token_roles = admin
region_name = RegionOne

[nova]
auth_url = http://<VIP>:5000
auth_type = password
project_domain_name = Default
user_domain_name = Default
region_name = RegionOne
project_name = service
username = nova
password = NOVA_PASS

[oslo_concurrency]
lock_path = /var/lib/neutron/tmp

vim /etc/neutron/plugins/ml2/ml2_conf.ini

[ml2]
type_drivers = flat,vlan,vxlan
tenant_network_types = vlan,vxlan
mechanism_drivers = openvswitch,l2population

[ml2_type_flat]
flat_networks = provider

[ml2_type_vlan]
# provider、external是ml2_conf.ini定义的物理网络名称
network_vlan_ranges = provider:10:4094,external:20:21

[ml2_type_vxlan]
vni_ranges = 1001:2000

[securitygroup]
enable_ipset = true

• 负责租户二层交换、东西流量

vim /etc/neutron/plugins/ml2/openvswitch_agent.ini

[ovs]
# 映射物理网络到物理接口
bridge_mappings = provider:bond0,external:bond1

[agent]
tunnel_types = vxlan
l2_population = true

[securitygroup]
enable_security_group = true
firewall_driver = neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver

[vxlan]
enable_vxlan = true
# 配置本机隧道端点IP，其余节点填对应IP。（管理网络）
local_ip = ip1
l2_population = true

• 负责租户三层路由、南北流量、NAT

vim /etc/neutron/l3_agent.ini

[DEFAULT]
interface_driver = openvswitch
ha_vrrp_advert_int = 1

• 为各租户网络分配ip

vim /etc/neutron/dhcp_agent.ini

[DEFAULT]
interface_driver = openvswitch
dhcp_driver = neutron.agent.linux.dhcp.Dnsmasq
enable_isolated_metadata = true

• 提供metadata服务

vim /etc/neutron/metadata_agent.ini

[DEFAULT]
nova_metadata_host = <VIP>
# 未设置或不一致时会报错，可以使用openssl rand -hex 16
metadata_proxy_shared_secret = Os#123

在一个控制节点操作

su -s /bin/sh -c "neutron-db-manage upgrade head" neutron

在三个节点操作

systemctl start neutron-server neutron-linuxbridge-agent neutron-dhcp-agent neutron-metadata-agent neutron-l3-agent
systemctl enable neutron-server neutron-linuxbridge-agent neutron-dhcp-agent neutron-metadata-agent neutron-l3-agent

source ~/admin-openrc
openstack network agent list

计算节点网络服务

离线下载

apt install --download-only neutron-openvswitch-agent openvswitch-switch neutron-metadata-agent

mkdir /compute/neutron
mv /var/cache/apt/archives/*.deb /compute/neutron/
dpkg -i /compute/neutron/*.deb

在计算节点操作

# 启动OVS
systemctl start openvswitch-switch && systemctl enable openvswitch-switch

# 创建网桥，将物理网络provider绑定到bond0
ovs-vsctl add-br br-provider
ovs-vsctl add-port br-provider bond0

# 创建网桥，物理网络external绑定到bond1
ovs-vsctl add-br br-external
ovs-vsctl add-port br-external bond1

• 主要配置

vim /etc/neutron/neutron.conf

[DEFAULT]
core_plugin = ml2
service_plugins = router
transport_url = rabbit://neutron:NEUTRON_PASS@ip1,ip2,ip3
auth_strategy = keystone
notify_nova_on_port_status_changes = true
notify_nova_on_port_data_changes = true
dhcp_agent_notification = true
l3_ha = true
allow_overlapping_ips = true
state_path = /var/lib/neutron

[keystone_authtoken]
www_authenticate_uri = http://<VIP>:5000/
auth_url = http://<VIP>:5000/
memcached_servers = ip1:11211,ip2:11211,ip3:11211
auth_type = password
project_domain_name = Default
user_domain_name = Default
project_name = service
username = neutron
password = NEUTRON_PASS
service_token_roles_required = true
service_token_roles = admin
region_name = RegionOne

[nova]
auth_url = http://<VIP>:5000
auth_type = password
project_domain_name = Default
user_domain_name = Default
region_name = RegionOne
project_name = service
username = nova
password = NOVA_PASS

[oslo_concurrency]
lock_path = /var/lib/neutron/tmp

vim /etc/neutron/plugins/ml2/ml2_conf.ini

[ml2]
type_drivers = flat,vlan,vxlan
tenant_network_types = vlan,vxlan
# provider、external是ml2_conf.ini定义的物理网络名称
mechanism_drivers = openvswitch,l2population

[ml2_type_flat]
flat_networks = provider

[ml2_type_vlan]
network_vlan_ranges = provider:10:4094,external:20:21

[ml2_type_vxlan]
vni_ranges = 1001:2000

[securitygroup]
enable_ipset = true

• 负责租户二层交换、东西流量

vim /etc/neutron/plugins/ml2/openvswitch_agent.ini

[ovs]
# 映射物理网络到物理接口
bridge_mappings = provider:bond0,external:bond1

[agent]
tunnel_types = vxlan
l2_population = true

[securitygroup]
enable_security_group = true
firewall_driver = neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver

[vxlan]
enable_vxlan = true
# 配置本机隧道端点IP，其余节点填对应IP。（管理网络）
local_ip = ip1

• 提供metadata服务

vim /etc/neutron/metadata_agent.ini

[DEFAULT]
nova_metadata_host = <VIP>
# 未设置或不一致时会报错，可以使用openssl rand -hex 16
metadata_proxy_shared_secret = Os#123

systemctl start neutron-openvswitch-agent && systemctl enable neutron-openvswitch-agent
systemctl start neutron-metadata-agent && systemctl enable neutron-metadata-agent

在控制节点执行

openstack network agent list

在计算节点执行

ovs-vsctl show
# 日志
cat /var/log/neutron/openvswitch-agent.log
cat /var/log/neutron/metadata-agent.log