私有云落地解决方案之openstack高可用（pike版本）-配置ovs的vxlan网络

admin

配置vxlan
+ U9 f. V4 e! s1 Z6 d+ z9 u" E
0 ?0 {* d0 J4 v' i3 B4 k各个控制节点

修改配置文件/etc/neutron/plugins/ml2/ml2_conf.ini
; J- h2 J: P9 j
" \0 _. P8 Z5 f9 m/ o7 ^" Jopenstack-config --set   /etc/neutron/plugins/ml2/ml2_conf.ini ml2 tenant_network_types  vxlan
- u4 U# a  n) A) c; Wopenstack-config --set   /etc/neutron/plugins/ml2/ml2_conf.ini ml2_type_flat flat_networks  physnet1
- X9 n7 a$ Q0 J6 Gopenstack-config --set   /etc/neutron/plugins/ml2/ml2_conf.ini ml2_type_vxlan vni_ranges  1:1000
" t" x$ O6 h! L/ j8 m% z& B
重启服务
' Y4 Q6 G7 I5 m3 d$ K
+ W5 A4 q+ [+ O3 [4 ?7 j
( W5 H2 ^# u8 V' ]2 r. N8 F5 Q+ U# G
# systemctl restart neutron-server

$ n& t5 o3 _- [) z% X& b4 O6 w  \创建网桥
% ^* ~: i: y4 C! [, K6 p( i

4 H7 D. }4 I5 X5 M7 O2 G( k- ?
" s- u% d% D2 ?$ q  V# ovs-vsctl add-br br-eth1
! T$ A4 G* T  k  ^  `; l. K$ }
5 |' o1 S& t4 _& w将网卡加到网桥中
) P8 B7 Z+ h/ |" o
1 a5 {1 T0 f/ W3 b7 a" J

# ovs-vsctl add-port br-eth1 ens33

6 C* F$ k. b  l/ t5 m' [$ O( c修改配置文件/etc/neutron/plugins/ml2/openvswitch_agent.ini
& Y: k& A. K0 C' {( l6 H


[agent]
6 M( \& _( b) ztunnel_types = vxlan
" n4 g: I: _, H7 F. m2 a* z) B$ Sl2_population = True
) ]0 s9 C& T( i4 ?9 w. xprevent_arp_spoofing = True
[ovs]
local_ip = 172.16.8.60 #各个节点的管理网IP
6 `- T! G7 i5 U* ~/ E! U' }$ |bridge_mappings = physnet1:br-eth1

0 p" Y. D) `* J# b2 C, l; D重启neutron服务



. N6 R2 J( S7 H+ n5 D+ @: S$ ?# for service in dhcp-agent l3-agent metadata-agent openvswitch-agent; do
) ]2 Z, u* k" R- \/ ~7 R; ~3 |5 usystemctl restart neutron-$service
; P2 g' T& J6 zdone
' O* D7 W1 s: E: ~
计算节点
& p/ ]" h9 E0 J) f
修改配置文件/etc/neutron/plugins/ml2/ml2_conf.ini
$ Q/ P7 I, L, r, Q9 @& S
6 ]+ F) A+ W( {openstack-config --set   /etc/neutron/plugins/ml2/ml2_conf.ini ml2 tenant_network_types  vxlan
openstack-config --set   /etc/neutron/plugins/ml2/ml2_conf.ini ml2_type_flat flat_networks  physnet1
openstack-config --set   /etc/neutron/plugins/ml2/ml2_conf.ini ml2_type_vxlan vni_ranges  1:1000
1 |% ^. N0 H8 }- \7 O& A
修改配置文件/etc/neutron/plugins/ml2/openvswitch_agent.ini

) W6 e' \- z+ S2 A$ R1 `- \

openstack-config --set  /etc/neutron/plugins/ml2/openvswitch_agent.ini  agent tunnel_types vxlan
openstack-config --set  /etc/neutron/plugins/ml2/openvswitch_agent.ini  agent l2_population  True
openstack-config --set  /etc/neutron/plugins/ml2/openvswitch_agent.ini  prevent_arp_spoofing  True
) P4 R& p. [  Z1 F& uopenstack-config --set  /etc/neutron/plugins/ml2/openvswitch_agent.ini  ovs local_ip  172.16.8.63
$ ~4 L8 \- c6 m$ M, T2 |: G
7 S3 O& {9 u! `1 U" [: Y9 x1 i重启服务
8 G8 I! K6 P$ @
/ `' x$ T' d: G% O3 n

# systemctl restart neutron-openvswitch-agent
7 g* l, O; i* p' C8 R
配置drv

控制节点：
) o0 S8 F. q+ P' V: {  C) N
openstack-config --set /etc/neutron/neutron.conf DEFAULT router_distributed True

4 Z' [5 n7 \3 h+ [4 i

openstack-config --set /etc/neutron/plugins/ml2/openvswitch_agent.ini DEFAULT enable_distributed_routing True
openstack-config --set /etc/neutron/l3_agent.ini DEFAULT agent_mode dvr_snat
计算节点：

修改配置文件/etc/neutron/l3_agent.ini

# cp -a /etc/neutron/l3_agent.ini /etc/neutron/l3_agent.ini_bak


( {5 B+ U. Y1 f1 _' c
[DEFAULT]
. F9 a3 c" v. C3 k4 w& k& Rinterface_driver = neutron.agent.linux.interface.OVSInterfaceDriver
4 I. W" E( L5 x: \

$ m/ h5 H7 k. s$ T% D2 L
openstack-config --set /etc/neutron/l3_agent.ini DEFAULT agent_mode dvr
openstack-config --set /etc/neutron/plugins/ml2/openvswitch_agent.ini DEFAULT enable_distributed_routing True
" K$ \& Q5 M; m1 q. g" copenstack-config --set /etc/neutron/plugins/ml2/openvswitch_agent.ini ovs bridge_mappings physnet1:br-eth1
: o4 Q; W: |# M7 l6 O8 ^9 Q; ]
' ~3 q! R% H3 {( j. S: y9 |5 C创建网桥
, [5 W, f  V5 P" m3 U


ovs-vsctl add-br br-eth1
  e% r$ V: i/ z4 |ovs-vsctl add-port br-eth1 ens33(业务网)
* r1 J) s" G9 H4 L' Q. x
- i  d7 _" o- k; l0 T计算节点上重启 neutron-l3-agent服务（默认没开启）
1 P" r6 K# ?; l  L+ |" u) D
$ M- ^3 \5 x# B; Z% c
9 u! H5 a, f! J7 g/ v
systemctl restart neutron-l3-agent.service
$ y6 u7 X: k9 b$ [4 a5 p3 [systemctl enable neutron-l3-agent.service

验证

& l: k( o% f% b创建路由器


! Y, f; d8 n( {3 W/ y6 L) g: Q. [
# openstack router create router01
3 r5 K/ y* R4 @6 l& M
" l1 U8 X5 j8 z. R( r创建内部网络
$ S* h- ]$ H8 J1 t: K


# openstack network create int_net --provider-network-type vxlan
1 i" Q0 d1 L9 M% k6 q; H
+ o$ [5 q) d  J$ [: i- t  ^创建子网


6 k4 i2 d- x. l
5 l0 w3 O9 b/ h: x# openstack subnet create subnet1 --network int_net \
0 N" o: z# i2 O! K2 t; g--subnet-range 10.18.100.0/24 --gateway 10.18.100.1 \
3 R. [: O, x/ |( R" |0 H+ z--dns-nameserver 114.114.114.114

将内部网络添加到路由器上
; `3 f) V- a) `% B  L) @


# openstack router add subnet router01 subnet1

创建外部网络


; C9 b; U9 F* K0 I$ X
2 {0 V* _& M/ b" B0 C, x2 T3 G# openstack network create \
--provider-physical-network physnet1 \
' f0 s3 D/ q% Y) Z4 [7 ]! `% U--provider-network-type flat --external ext_net

/ q9 W: J% L0 R. i7 j6 T创建外部网络子网



# openstack subnet create subnet2 \
' K( f( I1 g6 K1 w2 y--network ext_net --subnet-range 10.16.100.0/24 \
- Q' |& P" `0 {& R: w--allocation-pool start=10.16.100.200,end=10.16.100.254 \
--gateway 10.16.100.1 --dns-nameserver 114.114.114.114

将网络添加到路由器上



! ~1 Z1 ~5 v$ G  D# openstack router set router01 --external-gateway ext_net
& T) e+ M! q- i" ^/ M
创建flavor
  a) }- K) }; x) X

, P+ O; {3 p% P  c. @: V
" b: e7 {' n. |" {# openstack flavor create  --vcpus 1 --ram 512 --disk 1 test

$ C  M. K0 A5 p8 A5 q: z1 ?7 z% b" K查看网络


( L: ?* _6 E' z& b" X% `' S$ K
2 M* l3 b; C* D  @0 M0 O# Int_Net_ID=`openstack network list | grep int_net | awk '{ print $2 }'`
4 {7 v5 R- ~  @3 o5 q" i# openstack image list
: A2 h0 Y0 ]2 Y9 F
5 j; ~' [( A+ ~, V9 l- q) C' L1 S创建keypair
) n  h1 e: A- V8 q
' ]. C+ b# d% l

# ssh-keygen -q -N ""
. g. p# k$ m# p  k6 ^Enter file in which to save the key (/root/.ssh/id_rsa):
, P/ C0 w$ c9 Y
$ ~" Z$ U* ~6 L9 }5 m" K添加公钥

0 m  W- d3 w7 z: o/ m2 ?+ h

# openstack keypair create --public-key ~/.ssh/id_rsa.pub mykey

4 T: n/ @" `- [* P- O创建虚拟机
; H4 @" o3 K$ E, H' D) Y: B* L/ R6 P* ]


' z) o5 e( W' K# openstack server create --flavor m1.small --image cirros--security-group default --nic net-id=$Int_Net_ID --key-name mykey cirros

6 V; m% P( p4 M& Z6 K. A$ R

# openstack server list

分配浮动IP


8 e5 ]# k3 F3 f, X
# openstack floating ip create ext_net
- ~& v1 F& D4 g# p8 w$ g& F
分配浮动IP给虚拟机

* B4 M4 v* J0 L' ]: `5 \3 ]
% Z; m! Y0 z4 E& w% d" X2 ^1 o$ [# ]
# openstack server add floating ip cirros 172.16.100.201

7 o7 l3 O! o, m6 O) r8 U确认配置
8 ?, |$ G1 i& O' m4 I$ ^+ s
# y8 k3 _8 I& w
  k) }+ ]* m: K- A5 I7 C
& V2 T& Q% T% v5 Y# openstack floating ip show 10.16.100.201

& j9 ]/ o/ D6 r: p# |) J查看虚拟机
& k9 a* s/ ^/ J$ Z; s3 {# S

5 Y% Y- W& D5 ]+ N
# openstack server list

配置安全组icmp
8 @3 m* E9 c  d0 [5 V  m, O

, j* ?! w9 f1 Y
# openstack security group rule create --protocol icmp --ingress default

" y! N9 J6 J; X3 D8 {8 A1 g配置安全组SSH
) N1 f9 k) b& k. T, c
0 {  g- H# r; Q5 U! [

# openstack security group rule create --protocol tcp --dst-port 22:22 default

查看安全组

/ K& f: }0 ^) R' F$ h
/ X$ z2 C4 j3 d0 ~: t: H5 D5 C
6 k2 Q' R, _' G& a! ]3 A- r# openstack security group rule list
6 y9 n: x9 }& F; E
查看虚拟机


. A2 P; [0 P0 y: U0 K! g0 {
# openstack server list
0 z' e# j1 }5 B: x
5 v. @# b2 C" V登录虚拟机
% G8 M7 Z) H$ h" U0 P1 F+ A
7 R4 s$ n) ?- I# a% W' [+ K

# ssh cirros@172.16.100.201
The authenticity of host '172.16.100.201 (172.16.100.201)' can't be established.
ECDSA key fingerprint is 94:11:48:02:fa:62:ff:9c:c4:75:8f:eb:16:62:a9:ff.
% [( R( Z! D4 p  a5 d( EAre you sure you want to continue connecting (yes/no)? yes
$ f% O* @  I+ @, H8 s: u+ CWarning: Permanently added '172.16.100.201' (ECDSA) to the list of known hosts.     
                                               
9 Z( ^, e: n  @# ?7 y, h
) p1 w! c5 ]4 ~* `1 c