私有云落地解决方案之openstack高可用（pike版本）-配置ovs的vxlan网络

admin

配置vxlan
+ V8 O) `1 x6 y; O- ^. F  P, L2 c1 U
6 e. q2 r0 O0 O/ |& ^% {2 d各个控制节点
% K5 A0 v; b  R4 [6 ~
修改配置文件/etc/neutron/plugins/ml2/ml2_conf.ini
9 R4 ~6 M+ X0 y6 @# E- S
& U8 T8 ?: U. s. c) D/ |openstack-config --set   /etc/neutron/plugins/ml2/ml2_conf.ini ml2 tenant_network_types  vxlan
openstack-config --set   /etc/neutron/plugins/ml2/ml2_conf.ini ml2_type_flat flat_networks  physnet1
openstack-config --set   /etc/neutron/plugins/ml2/ml2_conf.ini ml2_type_vxlan vni_ranges  1:1000

重启服务
# _" M3 a6 \2 y6 ~2 e
5 Y$ T7 l9 C" B# L7 N& q

0 b  E7 ~* R3 K5 \# systemctl restart neutron-server

创建网桥

) Z4 Q8 X8 b. T1 j) ~

7 Q, k1 a+ C% {1 \( Y5 e' x# ovs-vsctl add-br br-eth1

% F- r1 `' R. A4 G" ]1 K8 u# \  G将网卡加到网桥中


9 d; C. a5 e) _5 p
, y7 t. {+ F9 B- ?1 ?# ovs-vsctl add-port br-eth1 ens33

6 |9 r) u$ j* g  X$ _* v& L修改配置文件/etc/neutron/plugins/ml2/openvswitch_agent.ini
+ W6 f' w8 a% g' k/ W; I# c- {
: s! J+ g' _* j) k( ]/ v! n
: h/ x( `* Z5 b/ g. @9 s/ e3 {
[agent]
# L- o$ o5 S- k$ o; `7 q6 N6 Dtunnel_types = vxlan
+ t- C- |$ S6 E, L4 Hl2_population = True
prevent_arp_spoofing = True
$ H5 A- K; L$ c[ovs]
local_ip = 172.16.8.60 #各个节点的管理网IP
bridge_mappings = physnet1:br-eth1
# e" V7 t3 J2 A! o( ]. v
" |' J: J  @- {" A( k重启neutron服务



5 f' X3 v' J5 a$ P' ^# for service in dhcp-agent l3-agent metadata-agent openvswitch-agent; do
. w, {8 o1 Q, O# j. Z# T0 osystemctl restart neutron-$service
4 c5 f+ O, E+ X/ Edone

计算节点

修改配置文件/etc/neutron/plugins/ml2/ml2_conf.ini

" ?6 N& Q. `+ p. R, @openstack-config --set   /etc/neutron/plugins/ml2/ml2_conf.ini ml2 tenant_network_types  vxlan
openstack-config --set   /etc/neutron/plugins/ml2/ml2_conf.ini ml2_type_flat flat_networks  physnet1
; A/ |* B( K: _: Q' f7 n/ uopenstack-config --set   /etc/neutron/plugins/ml2/ml2_conf.ini ml2_type_vxlan vni_ranges  1:1000
  L% Z7 o! N( M% Q8 W
修改配置文件/etc/neutron/plugins/ml2/openvswitch_agent.ini

1 D) e: q* n4 `" x8 y- f2 h
2 j' {! t2 d3 @6 i' l
openstack-config --set  /etc/neutron/plugins/ml2/openvswitch_agent.ini  agent tunnel_types vxlan
openstack-config --set  /etc/neutron/plugins/ml2/openvswitch_agent.ini  agent l2_population  True
( V0 w5 C2 P3 m1 s: S0 Uopenstack-config --set  /etc/neutron/plugins/ml2/openvswitch_agent.ini  prevent_arp_spoofing  True
openstack-config --set  /etc/neutron/plugins/ml2/openvswitch_agent.ini  ovs local_ip  172.16.8.63
' }; ^9 f1 V8 r% h" Q+ b1 N
8 A9 h* |8 `$ T+ `重启服务
+ r1 i- x5 h* m# t


# systemctl restart neutron-openvswitch-agent
) Z) n" ?, U9 M  V: _1 [
0 a- J3 r" Y  ^+ z* Z6 j' {配置drv
5 X6 Z0 A( x# s+ j) l6 v
6 ^: {* ?: j! \, Y8 W2 X控制节点：
& S' @' P# Y6 p) b
openstack-config --set /etc/neutron/neutron.conf DEFAULT router_distributed True
5 j2 C- j6 Q$ Y+ G( I  @. L

; S+ L4 i$ R1 A. [2 D. v6 R
+ _  m' g: \9 L: Uopenstack-config --set /etc/neutron/plugins/ml2/openvswitch_agent.ini DEFAULT enable_distributed_routing True
' h; V6 K6 {, d: ^1 l9 M/ ?: C  xopenstack-config --set /etc/neutron/l3_agent.ini DEFAULT agent_mode dvr_snat
9 `( J9 |! h! y! ^7 ?7 |计算节点：

- ^# S( O: E$ O: M修改配置文件/etc/neutron/l3_agent.ini
& F+ I; f, V# X/ i1 f0 P
# cp -a /etc/neutron/l3_agent.ini /etc/neutron/l3_agent.ini_bak
9 Z) {- x( O% U7 o3 N& x$ j
- m$ c$ m! ?5 C) {+ Y, n

, z) R; ^1 x3 J+ _, Q' T& k% o5 V  O[DEFAULT]
interface_driver = neutron.agent.linux.interface.OVSInterfaceDriver
7 c* I" W* C) O9 e( `" s) h

5 K, ?& n. |$ S
: Q$ u& d5 p* h' L- ?# e- |, Nopenstack-config --set /etc/neutron/l3_agent.ini DEFAULT agent_mode dvr
openstack-config --set /etc/neutron/plugins/ml2/openvswitch_agent.ini DEFAULT enable_distributed_routing True
openstack-config --set /etc/neutron/plugins/ml2/openvswitch_agent.ini ovs bridge_mappings physnet1:br-eth1

创建网桥

) L  {2 g5 Y" G% y# G, C; _
) p. a. [' m0 |+ n$ @
ovs-vsctl add-br br-eth1
ovs-vsctl add-port br-eth1 ens33(业务网)

计算节点上重启 neutron-l3-agent服务（默认没开启）



systemctl restart neutron-l3-agent.service
- I4 w% ^) D8 Lsystemctl enable neutron-l3-agent.service
2 a# V% n. t: Z8 F3 O9 P
验证

创建路由器

! \& u  j! w! b8 `, }3 |& \

1 @, E2 o, G) n4 |9 Y# openstack router create router01

- H: d  @. f6 W# w/ m, \1 c创建内部网络

4 \* H- p8 Z% W8 V) w

# openstack network create int_net --provider-network-type vxlan
% Z0 Y% i0 L5 @5 \
* @9 e$ j9 j1 V; o+ ^* o创建子网



# openstack subnet create subnet1 --network int_net \
--subnet-range 10.18.100.0/24 --gateway 10.18.100.1 \
0 o2 f4 o2 S5 b) `--dns-nameserver 114.114.114.114
* a/ b5 H# S2 o" T) d* {
将内部网络添加到路由器上
9 y) \! b7 q0 @& ]! C" b# Q) T

& V' S3 E* U: j0 \* S
2 b! ~$ X* v$ G$ A# openstack router add subnet router01 subnet1

创建外部网络
+ r) M$ P: I' ]! G


# openstack network create \
--provider-physical-network physnet1 \
* @. f5 u7 }' o) ~& C7 {# Q--provider-network-type flat --external ext_net

创建外部网络子网
7 S+ n+ c  R4 y5 M7 N# C& z
( d2 |. c0 }% K6 E$ o5 b
- @: K/ O& l+ q% |; X! \* p; }( w
( Z8 d$ q2 f8 A( w; j7 X  G# openstack subnet create subnet2 \
6 j0 }9 O( H5 {, p2 q--network ext_net --subnet-range 10.16.100.0/24 \
--allocation-pool start=10.16.100.200,end=10.16.100.254 \
! L1 W$ P5 g; ?--gateway 10.16.100.1 --dns-nameserver 114.114.114.114
+ u& Z$ b8 [7 I& B: P7 E* w9 v
将网络添加到路由器上

8 N* t7 D' ]) P0 A+ n

# openstack router set router01 --external-gateway ext_net
: C7 S! P  |$ c# }$ F
创建flavor
7 ]: V, ^4 x# A3 b. b0 W


# openstack flavor create  --vcpus 1 --ram 512 --disk 1 test
1 p4 k6 w( z  t  [' B) I
* D" c& s) ?/ e1 X2 G% t+ I* S* A* R查看网络



4 ?/ h: X% B, M+ [# Int_Net_ID=`openstack network list | grep int_net | awk '{ print $2 }'`
# openstack image list
( \0 q' X* m  f" R, @( T5 ?
7 B* R2 P# a  I0 S3 o创建keypair

9 \( I" I$ g  h' j

$ H( c+ z! S3 |: [1 N# ssh-keygen -q -N ""
Enter file in which to save the key (/root/.ssh/id_rsa):
- W% B$ k2 c1 q6 D8 M, [7 i
' i  K6 B& u: e7 L添加公钥

7 S( t/ N, ~6 G4 T

4 J0 A# ~; W' q7 r( j  M8 p, H9 z# openstack keypair create --public-key ~/.ssh/id_rsa.pub mykey
6 m3 }/ n' x# ~
创建虚拟机
) q1 w2 p& W! Z: j5 R


* v1 N+ A4 h- W: q5 ?7 x6 |# openstack server create --flavor m1.small --image cirros--security-group default --nic net-id=$Int_Net_ID --key-name mykey cirros
' G4 ~) Z( ]* R( G# f7 o  O: h: J
6 O* F( t3 k0 v$ R3 N
3 m: v7 j0 s7 I& f' q& ^
2 i" N1 N- }9 z, F* ]$ b8 w# openstack server list

7 F7 x! H* M/ _2 s" h分配浮动IP
0 v6 p6 W, i: r" Y1 v
$ J8 e8 M8 R$ E
3 t7 e5 s& ?, A% t
# openstack floating ip create ext_net

" m/ j5 n* }$ t) T  M2 w4 j' Z( H% Y  x分配浮动IP给虚拟机



! y& I: ^; I) L# openstack server add floating ip cirros 172.16.100.201

确认配置

+ q# L; b, C7 a8 g& h2 ]

- b$ Q. I7 H7 i5 k7 S0 l# openstack floating ip show 10.16.100.201

查看虚拟机
: o2 i7 K/ h8 c; W

* x' \5 ^' W( f0 I5 @, V2 z
  Z+ C$ d: K: g9 b' u# openstack server list
" O9 g  |# `9 i% m+ ]! B% K
8 a3 l) Z8 Q: ~( c8 i配置安全组icmp
+ `7 Q4 o: J  Z, t# q6 |
9 r/ s" t( \, R( Q5 S' \

# openstack security group rule create --protocol icmp --ingress default

6 i; L3 v/ R; n) [( f配置安全组SSH
2 Z2 W& u, L6 t0 e$ W" P  J& S; t
" e) U1 ?6 A$ v* h; J: @: k

( y1 `1 @, I6 J+ f9 i% Y# openstack security group rule create --protocol tcp --dst-port 22:22 default
; Z- T* G! Q  Y2 J& Y- T
查看安全组



+ X+ Z# d7 E$ i, {4 U$ T7 k# openstack security group rule list

) j4 A, S. A% v% [5 C查看虚拟机
1 }# s/ i, F' T' w: e) V+ ~1 o

% e9 |1 g* D: A. L5 }4 H
# openstack server list

登录虚拟机

4 g* P+ B2 c" C! W( ?, p

3 W- _* \$ o1 f* B1 B0 R7 c# ssh cirros@172.16.100.201
The authenticity of host '172.16.100.201 (172.16.100.201)' can't be established.
ECDSA key fingerprint is 94:11:48:02:fa:62:ff:9c:c4:75:8f:eb:16:62:a9:ff.
Are you sure you want to continue connecting (yes/no)? yes
( M' N! C0 a' x$ f1 A$ v6 S, RWarning: Permanently added '172.16.100.201' (ECDSA) to the list of known hosts.     
2 k5 n( o: b3 D- Z- u                                               

4 v. M/ h  E2 n" x1 P