1、控制节点

1.1、数据库配置

  1. mysql -uroot -p123456
  2. CREATE DATABASE neutron;
  3. GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'localhost' IDENTIFIED BY 'neutron';
  4. GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'%' IDENTIFIED BY 'neutron';

1.2、创建项目

  1. openstack user create --domain default --password neutron neutron
  2.  openstack role add --project service --user neutron admin
  3.  openstack service create --name neutron --description "OpenStack Networking" network
  4.  openstack endpoint create --region RegionOne network public http://controller:9696
  5.  openstack endpoint create --region RegionOne network internal http://controller:9696
  6.  openstack endpoint create --region RegionOne network admin http://controller:9696

1.3、网络配置

1.3.1、网络选项1：提供商网络

1.3.1.1、安装组件

  1. yum install openstack-neutron openstack-neutron-ml2 openstack-neutron-linuxbridge ebtables -y
  2. cp /etc/neutron/neutron.conf /etc/neutron/neutron.conf.bak
  3. sed -ri '/^[ \t]*(#|$)/d' /etc/neutron/neutron.conf

vim /etc/neutron/neutron.conf

  1. [database]
  2. # ...
  3. connection = mysql+pymysql://neutron:neutron@controller/neutron
  4. [DEFAULT]
  5. # ...
  6. core_plugin = ml2
  7. service_plugins =
  8. transport_url = rabbit://openstack:openstack@controller
  9. auth_strategy = keystone
  10. notify_nova_on_port_status_changes = true
  11. notify_nova_on_port_data_changes = true
  13. [keystone_authtoken]
  14. # ...
  15. www_authenticate_uri = http://controller:5000
  16. auth_url = http://controller:5000
  17. memcached_servers = controller:11211
  18. auth_type = password
  19. project_domain_name = default
  20. user_domain_name = default
  21. project_name = service
  22. username = neutron
  23. password = neutron
  24. [nova]
  25. # ...
  26. auth_url = http://controller:5000
  27. auth_type = password
  28. project_domain_name = default
  29. user_domain_name = default
  30. region_name = RegionOne
  31. project_name = service
  32. username = nova
  33. password = nova
  34. [oslo_concurrency]
  35. # ...
  36. lock_path = /var/lib/neutron/tmp

1.3.1.2、配置模块化第 2 层 （ML2） 插件

  1. cp /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugins/ml2/ml2_conf.ini.bak
  2. sed -ri '/^[ \t]*(#|$)/d' /etc/neutron/plugins/ml2/ml2_conf.ini

vim /etc/neutron/plugins/ml2/ml2_conf.ini

  1. [ml2]
  2. # ...
  3. type_drivers = flat,vlan
  4. tenant_network_types =
  5. mechanism_drivers = linuxbridge
  6. extension_drivers = port_security
  7. [ml2_type_flat]
  8. # ...
  9. flat_networks = provider
  10. [securitygroup]
  11. # ...
  12. enable_ipset = true

1.3.1.3、配置 Linux 网桥代理

  1. cp /etc/neutron/plugins/ml2/linuxbridge_agent.ini /etc/neutron/plugins/ml2/linuxbridge_agent.ini.bak
  2. sed  -ri '/^[ \t]*(#|$)/d' /etc/neutron/plugins/ml2/linuxbridge_agent.ini

vim /etc/neutron/plugins/ml2/linuxbridge_agent.ini

  1. [linux_bridge]
  2. physical_interface_mappings = provider:ens192
  3. [vxlan]
  4. enable_vxlan = false
  5. [securitygroup]
  6. # ...
  7. enable_security_group = true
  8. firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver

1.3.1.4、确保 Linux 操作系统内核支持网桥筛选器

  1. #把值配置为1
  2. sysctl net.bridge.bridge-nf-call-iptables
  3. sysctl net.bridge.bridge-nf-call-ip6tables
  4. #如果没有这个文件，要启用网络网桥支持
  5. modprobe br_netfilter
  7. vim  /etc/sysctl.conf
  8. net.bridge.bridge-nf-call-iptables =1
  9. net.net.bridge.bridge-nf-call-ip6tables =1 
  10. sysctl -p

1.3.1.5、配置 DHCP 代理

  1. cp /etc/neutron/dhcp_agent.ini /etc/neutron/dhcp_agent.ini.bak
  2. sed  -ri '/^[ \t]*(#|$)/d' /etc/neutron/dhcp_agent.ini
  3. vim /etc/neutron/dhcp_agent.ini
  4. [DEFAULT]
  5. # ...
  6. interface_driver = linuxbridge
  7. dhcp_driver = neutron.agent.linux.dhcp.Dnsmasq
  8. enable_isolated_metadata = True

1.3.2、网络选项2：自助网络

1.3.2.1、安装组件

  1. yum install openstack-neutron openstack-neutron-ml2 openstack-neutron-linuxbridge ebtables -y
  2. cp /etc/neutron/neutron.conf /etc/neutron/neutron.conf.bak
  3. sed -ri '/^[ \t]*(#|$)/d' /etc/neutron/neutron.conf

vim /etc/neutron/neutron.conf

  1. [database]
  2. # ...
  3. connection = mysql+pymysql://neutron:neutron@controller/neutron
  5. [DEFAULT]
  6. # ...
  7. core_plugin = ml2
  8. service_plugins = router
  9. allow_overlapping_ips = true
  10. transport_url = rabbit://openstack:openstack@controller
  11. auth_strategy = keystone
  12. notify_nova_on_port_status_changes = true
  13. notify_nova_on_port_data_changes = true
  14. [keystone_authtoken]
  15. # ...
  16. www_authenticate_uri = http://controller:5000
  17. auth_url = http://controller:5000
  18. memcached_servers = controller:11211
  19. auth_type = password
  20. project_domain_name = default
  21. user_domain_name = default
  22. project_name = service
  23. username = neutron
  24. password = neutron
  25. [nova]
  26. # ...
  27. auth_url = http://controller:5000
  28. auth_type = password
  29. project_domain_name = default
  30. user_domain_name = default
  31. region_name = RegionOne
  32. project_name = service
  33. username = nova
  34. password = nova
  35. [oslo_concurrency]
  36. # ...
  37. lock_path = /var/lib/neutron/tmp

1.3.2.2、配置模块化第 2 层 （ML2） 插件

  1. cp /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugins/ml2/ml2_conf.ini.bak
  2. sed -ri '/^[ \t]*(#|$)/d' /etc/neutron/plugins/ml2/ml2_conf.ini

vim /etc/neutron/plugins/ml2/ml2_conf.ini

  1. [ml2]
  2. # ...
  3. type_drivers = flat,vlan,vxlan
  4. tenant_network_types = vxlan
  5. mechanism_drivers = linuxbridge,l2population
  6. extension_drivers = port_security
  7. [ml2_type_flat]
  8. # ...
  9. flat_networks = provider
  10. [ml2_type_vxlan]
  11. # ...
  12. vni_ranges = 1:1000
  13. [securitygroup]
  14. # ...
  15. enable_ipset = true

1.3.2.3、配置 Linux 网桥代理

  1. cp /etc/neutron/plugins/ml2/linuxbridge_agent.ini /etc/neutron/plugins/ml2/linuxbridge_agent.ini.bak
  2. sed  -ri '/^[ \t]*(#|$)/d' /etc/neutron/plugins/ml2/linuxbridge_agent.ini

vim /etc/neutron/plugins/ml2/linuxbridge_agent.ini

  1. [linux_bridge]
  2. physical_interface_mappings = provider:PROVIDER_INTERFACE_NAME
  3. [vxlan]
  4. enable_vxlan = true
  5. local_ip = OVERLAY_INTERFACE_IP_ADDRESS
  6. l2_population = true
  7. [securitygroup]
  8. # ...
  9. enable_security_group = true
  10. firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver

1.3.2.4、确保 Linux 操作系统内核支持网桥筛选器

  1. #把值配置为1
  2. sysctl net.bridge.bridge-nf-call-iptables
  3. sysctl net.bridge.bridge-nf-call-ip6tables
  4. #如果没有这个文件，要启用网络网桥支持
  5. modprobe br_netfilter
  7. vim  /etc/sysctl.conf
  8. net.bridge.bridge-nf-call-iptables =1
  9. net.net.bridge.bridge-nf-call-ip6tables =1 
  10. sysctl -p

1.3.2.5、配置第三层代理

  1. [DEFAULT]
  2. # ...
  3. interface_driver = linuxbridge

1.3.2.6、配置 DHCP 代理

  1. cp /etc/neutron/dhcp_agent.ini /etc/neutron/dhcp_agent.ini.bak
  2. sed  -ri '/^[ \t]*(#|$)/d' /etc/neutron/dhcp_agent.ini
  3. vim /etc/neutron/dhcp_agent.ini
  4. [DEFAULT]
  5. # ...
  6. interface_driver = linuxbridge
  7. dhcp_driver = neutron.agent.linux.dhcp.Dnsmasq
  8. enable_isolated_metadata = True

1.4、配置元数据代理

  1. cp /etc/neutron/metadata_agent.ini /etc/neutron/metadata_agent.ini.bak
  2.  sed  -ri '/^[ \t]*(#|$)/d'  /etc/neutron/metadata_agent.ini
  3. vim /etc/neutron/metadata_agent.ini
  4. [DEFAULT]
  5. # ...
  6. nova_metadata_host = controller
  7. metadata_proxy_shared_secret = METADATA_SECRET

1.5、将计算服务配置为使用网络服务

  1. vim /etc/nova/nova.conf
  2. [neutron]
  3. auth_url = http://controller:5000
  4. auth_type = password
  5. project_domain_name = default
  6. user_domain_name = default
  7. region_name = RegionOne
  8. project_name = service
  9. username = neutron
  10. password = neutron
  11. service_metadata_proxy = true
  12. metadata_proxy_shared_secret = METADATA_SECRET

1.6、完成安装

1.6.1、服务初始化脚本需要一个指向 ML2 插件配置文件的符号链接

  1. ln -s /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugin.ini

1.6.2、同步数据库

  1. su -s /bin/sh -c "neutron-db-manage --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade head" neutron

1.6.3、启动

1.6.3.1、网络选项1：提供商网络

  1. systemctl restart openstack-nova-api.service && systemctl status openstack-nova-api.service
  2. systemctl enable neutron-server.service neutron-linuxbridge-agent.service neutron-dhcp-agent.service neutron-metadata-agent.service
  3. systemctl restart neutron-server.service neutron-linuxbridge-agent.service neutron-dhcp-agent.service neutron-metadata-agent.service  
  4. systemctl status neutron-server.service neutron-linuxbridge-agent.service neutron-dhcp-agent.service neutron-metadata-agent.service

1.6.3.1、网络选项2：自助网络

  1. systemctl restart openstack-nova-api.service && systemctl status openstack-nova-api.service
  2. systemctl enable neutron-server.service neutron-linuxbridge-agent.service neutron-dhcp-agent.service neutron-metadata-agent.service
  3. systemctl restart neutron-server.service neutron-linuxbridge-agent.service neutron-dhcp-agent.service neutron-metadata-agent.service  
  4. systemctl status neutron-server.service neutron-linuxbridge-agent.service neutron-dhcp-agent.service neutron-metadata-agent.service
  5. #网络选项 2，还启用和启动第 3 层服务
  6. systemctl enable neutron-l3-agent.service
  7. systemctl restart neutron-l3-agent.service
  8. systemctl status neutron-l3-agent.service

2、计算节点

2.1、安装

  1. yum install openstack-neutron-linuxbridge ebtables ipset -y
  2. cp /etc/neutron/neutron.conf /etc/neutron/neutron.conf.bak
  3.  sed  -ri '/^[ \t]*(#|$)/d' /etc/neutron/neutron.conf
  5. vim /etc/neutron/neutron.conf
  6. [DEFAULT]
  7. # ...
  8. transport_url = rabbit://openstack:openstack@controller
  9. auth_strategy = keystone
  11. [keystone_authtoken]
  12. # ...
  13. www_authenticate_uri = http://controller:5000
  14. auth_url = http://controller:5000
  15. memcached_servers = controller:11211
  16. auth_type = password
  17. project_domain_name = default
  18. user_domain_name = default
  19. project_name = service
  20. username = neutron
  21. password = neutron
  22. [oslo_concurrency]
  23. # ...
  24. lock_path = /var/lib/neutron/tmp

2.2、网络配置

2.2.1、网络选项1：提供商网络

2.2.1.1、安装组件、配置网桥代理

  1. cp /etc/neutron/plugins/ml2/linuxbridge_agent.ini /etc/neutron/plugins/ml2/linuxbridge_agent.ini.bak
  2. sed  -ri '/^[ \t]*(#|$)/d' /etc/neutron/plugins/ml2/linuxbridge_agent.ini
  4. vim /etc/neutron/plugins/ml2/linuxbridge_agent.ini
  5. [linux_bridge]
  6. physical_interface_mappings = provider:PROVIDER_INTERFACE_NAME
  7. [vxlan]
  8. enable_vxlan = false
  9. [securitygroup]
  10. # ...
  11. enable_security_group = true
  12. firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver

2.2.1.2、确保 Linux 操作系统内核支持网桥筛选器：

  1. #把值配置为1
  2. sysctl net.bridge.bridge-nf-call-iptables
  3. sysctl net.bridge.bridge-nf-call-ip6tables
  4. #如果没有这个文件，要启用网络网桥支持
  5. modprobe br_netfilter
  7. vim  /etc/sysctl.conf
  8. net.bridge.bridge-nf-call-iptables =1
  9. net.net.bridge.bridge-nf-call-ip6tables =1 
  10. sysctl -p

2.2.2、网络选项2：自助网络

2.2.2.1、安装组件、配置网桥代理

  1. cp /etc/neutron/plugins/ml2/linuxbridge_agent.ini /etc/neutron/plugins/ml2/linuxbridge_agent.ini.bak
  2. sed  -ri '/^[ \t]*(#|$)/d' /etc/neutron/plugins/ml2/linuxbridge_agent.ini
  4. vim /etc/neutron/plugins/ml2/linuxbridge_agent.ini
  5. [linux_bridge]
  6. physical_interface_mappings = provider:PROVIDER_INTERFACE_NAME
  7. [vxlan]
  8. enable_vxlan = true
  9. local_ip = OVERLAY_INTERFACE_IP_ADDRESS
  10. l2_population = true
  11. [securitygroup]
  12. # ...
  13. enable_security_group = true
  14. firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver

2.2.2.2、确保 Linux 操作系统内核支持网桥筛选器：

  1. #把值配置为1
  2. sysctl net.bridge.bridge-nf-call-iptables
  3. sysctl net.bridge.bridge-nf-call-ip6tables
  4. #如果没有这个文件，要启用网络网桥支持
  5. modprobe br_netfilter
  7. vim  /etc/sysctl.conf
  8. net.bridge.bridge-nf-call-iptables =1
  9. net.net.bridge.bridge-nf-call-ip6tables =1 
  10. sysctl -p

2.3、将计算服务配置为使用网络服务

  1. vim /etc/nova/nova.conf
  2. [neutron]
  3. # ...
  4. auth_url = http://controller:5000
  5. auth_type = password
  6. project_domain_name = default
  7. user_domain_name = default
  8. region_name = RegionOne
  9. project_name = service
  10. username = neutron
  11. password = neutron

2.4、启动

  1. systemctl restart openstack-nova-compute.service 
  2. systemctl status openstack-nova-compute.service
  3. systemctl enable neutron-linuxbridge-agent.service 
  4. systemctl restart neutron-linuxbridge-agent.service 
  5. systemctl status neutron-linuxbridge-agent.service

3、验证

  1. openstack extension list --network
  2. openstack network agent list