⑥ OpenStack高可用集羣部署方案(train版)—Neutron

十五、Neutron控制節點集羣部署

https://docs.openstack.org/neutron/train/install/install-rdo.html
Neutron網絡的博客

Nova具體功能如下:

  • Neutron 爲整個 OpenStack 環境提供網絡支持,包括二層交換,三層路由,負載均衡,防火牆和 VPN 等。
  • Neutron 提供了一個靈活的框架,通過配置,無論是開源還是商業軟件都可以被用來實現這些功能。

1. 創建nova相關數據庫(控制節點)

在任意控制節點創建數據庫,數據庫自動同步,以controller01節點爲例;

mysql -u root -pZxzn@2020
CREATE DATABASE neutron;
GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'localhost' IDENTIFIED BY 'Zxzn@2020';
GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'%' IDENTIFIED BY 'Zxzn@2020';
flush privileges;

2. 創建neutron相關服務憑證(控制節點)

在任意控制節點操作,以controller01節點爲例;

2.1 創建neutron用戶

source admin-openrc
openstack user create --domain default --password Zxzn@2020 neutron

2.2 向neutron用戶賦予admin權限

openstack role add --project service --user neutron admin

2.3 創建neutron服務實體

openstack service create --name neutron --description "OpenStack Networking" network

2.4 創建neutron API服務端點

api地址統一採用vip,如果public/internal/admin分別設計使用不同的vip,請注意區分;

--region與初始化admin用戶時生成的region一致;neutron-api 服務類型爲network;

openstack endpoint create --region RegionOne network public http://10.15.253.88:9696
openstack endpoint create --region RegionOne network internal http://10.15.253.88:9696
openstack endpoint create --region RegionOne network admin http://10.15.253.88:9696

3. 安裝Neutron server(控制節點)

提供商網絡
租戶服務網絡

  • openstack-neutron:neutron-server的包
  • openstack-neutron-ml2:ML2 plugin的包
  • openstack-neutron-linuxbridge:linux bridge network provider相關的包
  • ebtables:防火牆相關的包
  • conntrack-tools: 該模塊可以對iptables進行狀態數據包檢查

這裏將neutron server與neutron agent分離,所以採取這樣的部署方式,常規的控制節點部署所有neutron的應用包括agent,計算節點部署只部署以下的neutron server、linuxbridge和nova配置即可;三臺計算節點現在相當於neutron節點

在全部控制節點安裝neutron相關服務,以controller01節點爲例;

#yum install openstack-neutron openstack-neutron-ml2 openstack-neutron-linuxbridge ebtables -y

yum install openstack-neutron openstack-neutron-ml2 ebtables -y
yum install conntrack-tools -y

4. 部署與配置(控制節點)

https://docs.openstack.org/neutron/train/install/controller-install-rdo.html

在全部控制節點配置neutron相關服務,以controller01節點爲例;

4. 1 配置nova.conf

注意my_ip參數,根據節點修改;注意neutron.conf文件的權限:root:neutron

注意bind_host參數,根據節點修改;

#備份配置文件/etc/nova/nova.conf
cp -a /etc/neutron/neutron.conf{,.bak}
grep -Ev '^$|#' /etc/neutron/neutron.conf.bak > /etc/neutron/neutron.conf
openstack-config --set  /etc/neutron/neutron.conf DEFAULT bind_host 10.15.253.163

openstack-config --set  /etc/neutron/neutron.conf DEFAULT core_plugin ml2
openstack-config --set  /etc/neutron/neutron.conf DEFAULT service_plugins router
openstack-config --set  /etc/neutron/neutron.conf DEFAULT allow_overlapping_ips true
#直接連接rabbitmq集羣
openstack-config --set /etc/neutron/neutron.conf DEFAULT transport_url rabbit://openstack:Zxzn@2020@controller01:5672,openstack:Zxzn@2020@controller02:5672,openstack:Zxzn@2020@controller03:5672

openstack-config --set  /etc/neutron/neutron.conf DEFAULT auth_strategy  keystone
openstack-config --set  /etc/neutron/neutron.conf DEFAULT notify_nova_on_port_status_changes  true
openstack-config --set  /etc/neutron/neutron.conf DEFAULT notify_nova_on_port_data_changes  true

openstack-config --set  /etc/neutron/neutron.conf database connection  mysql+pymysql://neutron:Zxzn@[email protected]/neutron

openstack-config --set  /etc/neutron/neutron.conf keystone_authtoken www_authenticate_uri  http://10.15.253.88:5000
openstack-config --set  /etc/neutron/neutron.conf keystone_authtoken auth_url  http://10.15.253.88:5000
openstack-config --set  /etc/neutron/neutron.conf keystone_authtoken memcached_servers  controller01:11211,controller02:11211,controller03:11211
openstack-config --set  /etc/neutron/neutron.conf keystone_authtoken auth_type  password
openstack-config --set  /etc/neutron/neutron.conf keystone_authtoken project_domain_name  default
openstack-config --set  /etc/neutron/neutron.conf keystone_authtoken user_domain_name  default
openstack-config --set  /etc/neutron/neutron.conf keystone_authtoken project_name  service
openstack-config --set  /etc/neutron/neutron.conf keystone_authtoken username  neutron
openstack-config --set  /etc/neutron/neutron.conf keystone_authtoken password  Zxzn@2020

openstack-config --set  /etc/neutron/neutron.conf nova  auth_url http://10.15.253.88:5000
openstack-config --set  /etc/neutron/neutron.conf nova  auth_type password
openstack-config --set  /etc/neutron/neutron.conf nova  project_domain_name default
openstack-config --set  /etc/neutron/neutron.conf nova  user_domain_name default
openstack-config --set  /etc/neutron/neutron.conf nova  region_name RegionOne
openstack-config --set  /etc/neutron/neutron.conf nova  project_name service
openstack-config --set  /etc/neutron/neutron.conf nova  username nova
openstack-config --set  /etc/neutron/neutron.conf nova  password Zxzn@2020

openstack-config --set  /etc/neutron/neutron.conf oslo_concurrency lock_path  /var/lib/neutron/tmp

將neutron.conf配置文件拷貝到另外的控制節點上:

scp -rp /etc/neutron/neutron.conf controller02:/etc/neutron/
scp -rp /etc/neutron/neutron.conf controller03:/etc/neutron/

##controller02上
sed -i "s#10.15.253.163#10.15.253.195#g" /etc/neutron/neutron.conf

##controller03上
sed -i "s#10.15.253.163#10.15.253.227#g" /etc/neutron/neutron.conf

4.2 配置 ml2_conf.ini

在全部控制節點操作,以controller01節點爲例;

#備份配置文件
cp -a /etc/neutron/plugins/ml2/ml2_conf.ini{,.bak}
grep -Ev '^$|#' /etc/neutron/plugins/ml2/ml2_conf.ini.bak > /etc/neutron/plugins/ml2/ml2_conf.ini
openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2 type_drivers  flat,vlan,vxlan
openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2 tenant_network_types vxlan
openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2 mechanism_drivers  linuxbridge,l2population
openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2 extension_drivers  port_security
openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2_type_flat flat_networks  provider
openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2_type_vxlan vni_ranges 1:1000
openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini securitygroup enable_ipset  true

ml2_conf.ini配置文件拷貝到另外的控制節點上:

scp -rp /etc/neutron/plugins/ml2/ml2_conf.ini controller02:/etc/neutron/plugins/ml2/ml2_conf.ini
scp -rp /etc/neutron/plugins/ml2/ml2_conf.ini controller03:/etc/neutron/plugins/ml2/ml2_conf.ini

4.3 配置nova服務與neutron服務進行交互

全部控制節點執行;

#修改配置文件/etc/nova/nova.conf
#在全部控制節點上配置nova服務與網絡節點服務進行交互
openstack-config --set  /etc/nova/nova.conf neutron url  http://10.15.253.88:9696
openstack-config --set  /etc/nova/nova.conf neutron auth_url  http://10.15.253.88:5000
openstack-config --set  /etc/nova/nova.conf neutron auth_type  password
openstack-config --set  /etc/nova/nova.conf neutron project_domain_name  default
openstack-config --set  /etc/nova/nova.conf neutron user_domain_name  default
openstack-config --set  /etc/nova/nova.conf neutron region_name  RegionOne
openstack-config --set  /etc/nova/nova.conf neutron project_name  service
openstack-config --set  /etc/nova/nova.conf neutron username  neutron
openstack-config --set  /etc/nova/nova.conf neutron password  Zxzn@2020
openstack-config --set  /etc/nova/nova.conf neutron service_metadata_proxy  true
openstack-config --set  /etc/nova/nova.conf neutron metadata_proxy_shared_secret  Zxzn@2020

4.4 同步nova相關數據庫並驗證

任意控制節點操作;填充neutron數據庫

[root@controller01 ~]# su -s /bin/sh -c "neutron-db-manage --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade head" neutron
...
  OK

驗證neutron數據庫是否正常寫入

mysql -h controller03 -u neutron -pZxzn@2020 -e "use neutron;show tables;"

4.5 創建ml2的軟連接 文件指向ML2插件配置的軟鏈接

全部控制節點執行;

ln -s /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugin.ini

4.6 重啓nova-api和neutron-server服務

在全部控制節點操作;

systemctl restart openstack-nova-api.service
systemctl status openstack-nova-api.service

systemctl enable neutron-server.service
systemctl restart neutron-server.service
systemctl status neutron-server.service

十六、Neutron計算節點集羣部署

1. 安裝Neutron agent(計算節點=網絡節點)

  • 由於這裏部署爲neutron serverneutron agent分離,所以採取這樣的部署方式,常規的控制節點部署所有neutron的應用包括server和agent

  • 計算節點部署neutron agentlinuxbridgenova配置即可;也可以單獨準備網絡節點進行neutron agent的部署;

在全部計算節點安裝,以compute01節點爲例;

yum install openstack-neutron openstack-neutron-ml2 openstack-neutron-linuxbridge ebtables -y
#備份配置文件/etc/nova/nova.conf
cp -a /etc/neutron/neutron.conf{,.bak}
grep -Ev '^$|#' /etc/neutron/neutron.conf.bak > /etc/neutron/neutron.conf
openstack-config --set  /etc/neutron/neutron.conf DEFAULT bind_host 10.15.253.162
openstack-config --set /etc/neutron/neutron.conf DEFAULT transport_url rabbit://openstack:Zxzn@2020@controller01:5672,openstack:Zxzn@2020@controller02:5672,openstack:Zxzn@2020@controller03:5672
openstack-config --set  /etc/neutron/neutron.conf DEFAULT auth_strategy keystone 

openstack-config --set  /etc/neutron/neutron.conf keystone_authtoken www_authenticate_uri http://10.15.253.88:5000
openstack-config --set  /etc/neutron/neutron.conf keystone_authtoken auth_url http://10.15.253.88:5000
openstack-config --set  /etc/neutron/neutron.conf keystone_authtoken memcached_servers controller01:11211,controller02:11211,controller03:11211
openstack-config --set  /etc/neutron/neutron.conf keystone_authtoken auth_type password
openstack-config --set  /etc/neutron/neutron.conf keystone_authtoken project_domain_name default
openstack-config --set  /etc/neutron/neutron.conf keystone_authtoken user_domain_name default
openstack-config --set  /etc/neutron/neutron.conf keystone_authtoken project_name service
openstack-config --set  /etc/neutron/neutron.conf keystone_authtoken username neutron
openstack-config --set  /etc/neutron/neutron.conf keystone_authtoken password Zxzn@2020

openstack-config --set  /etc/neutron/neutron.conf oslo_concurrency lock_path /var/lib/neutron/tmp

將neutron.conf配置文件拷貝到另外的計算節點上:

scp -rp /etc/neutron/neutron.conf controller02:/etc/neutron/
scp -rp /etc/neutron/neutron.conf controller03:/etc/neutron/

##compute02上
sed -i "s#10.15.253.162#10.15.253.194#g" /etc/neutron/neutron.conf

##compute03上
sed -i "s#10.15.253.162#10.15.253.226#g" /etc/neutron/neutron.conf

2. 部署與配置(計算節點)

2.1 配置nova.conf

在全部計算節點操作;配置只涉及nova.conf的[neutron]字段

openstack-config --set  /etc/nova/nova.conf neutron url  http://10.15.253.88:9696
openstack-config --set  /etc/nova/nova.conf neutron auth_url http://10.15.253.88:5000
openstack-config --set  /etc/nova/nova.conf neutron auth_type password
openstack-config --set  /etc/nova/nova.conf neutron project_domain_name default
openstack-config --set  /etc/nova/nova.conf neutron user_domain_name default
openstack-config --set  /etc/nova/nova.conf neutron region_name RegionOne
openstack-config --set  /etc/nova/nova.conf neutron project_name service
openstack-config --set  /etc/nova/nova.conf neutron username neutron
openstack-config --set  /etc/nova/nova.conf neutron password Zxzn@2020

2.2 配置ml2_conf.ini

在全部計算節點操作,以compute01節點爲例;

#備份配置文件
cp -a /etc/neutron/plugins/ml2/ml2_conf.ini{,.bak}
grep -Ev '^$|#' /etc/neutron/plugins/ml2/ml2_conf.ini.bak > /etc/neutron/plugins/ml2/ml2_conf.ini
openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2 type_drivers  flat,vlan,vxlan
openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2 tenant_network_types vxlan
openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2 mechanism_drivers  linuxbridge,l2population
openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2 extension_drivers  port_security
openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2_type_flat flat_networks  provider
openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2_type_vxlan vni_ranges 1:1000
openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini securitygroup enable_ipset  true

ml2_conf.ini配置文件拷貝到另外的計算節點上:

scp -rp /etc/neutron/plugins/ml2/ml2_conf.ini compute02:/etc/neutron/plugins/ml2/ml2_conf.ini
scp -rp /etc/neutron/plugins/ml2/ml2_conf.ini compute03:/etc/neutron/plugins/ml2/ml2_conf.ini

2.3 配置linuxbridge_agent.ini

  • Linux網橋代理
  • Linux網橋代理爲實例構建第2層(橋接和交換)虛擬網絡基礎結構並處理安全組
  • 網絡類型名稱與物理網卡對應,這裏提供商網絡provider對應規劃的ens192網卡,vlan租戶網絡對應規劃的ens224網卡,在創建相應網絡時採用的是網絡名稱而非網卡名稱;
  • 需要明確的是物理網卡是本地有效,根據主機實際使用的網卡名確定;

在全部計算節點操作,以compute01節點爲例;

#備份配置文件
cp -a /etc/neutron/plugins/ml2/linuxbridge_agent.ini{,.bak}
grep -Ev '^$|#' /etc/neutron/plugins/ml2/linuxbridge_agent.ini.bak >/etc/neutron/plugins/ml2/linuxbridge_agent.ini
#環境無法提供四張網卡;建議生產環境上將每種網絡分開配置
#provider網絡對應規劃的ens192,vlan租戶網絡對應也暫時使用ens192;
openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini linux_bridge physical_interface_mappings  provider:ens192,vlan:ens192

openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini vxlan enable_vxlan  true

#tunnel租戶網絡(vxlan)vtep端點,這裏對應規劃的ens224地址,根據節點做相應修改
openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini vxlan local_ip 10.15.253.162

openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini vxlan l2_population true
openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini securitygroup enable_security_group  true
openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini securitygroup firewall_driver  neutron.agent.linux.iptables_firewall.IptablesFirewallDriver

將 linuxbridge_agent.ini 配置文件拷貝到另外的計算節點上:

scp -rp /etc/neutron/plugins/ml2/linuxbridge_agent.ini  controller02:/etc/neutron/plugins/ml2/
scp -rp /etc/neutron/plugins/ml2/linuxbridge_agent.ini  controller03:/etc/neutron/plugins/ml2/

##compute02上
sed -i "s#10.15.253.162#10.15.253.194#g" /etc/neutron/plugins/ml2/linuxbridge_agent.ini 

##compute03上
sed -i "s#10.15.253.162#10.15.253.226#g" /etc/neutron/plugins/ml2/linuxbridge_agent.ini

2.4 配置 l3_agent.ini

  • l3代理爲租戶虛擬網絡提供路由和NAT服務

在全部計算節點操作,以compute01節點爲例;

#備份配置文件
cp -a /etc/neutron/l3_agent.ini{,.bak}
grep -Ev '^$|#' /etc/neutron/l3_agent.ini.bak > /etc/neutron/l3_agent.ini
openstack-config --set /etc/neutron/l3_agent.ini DEFAULT interface_driver linuxbridge

2.5 配置dhcp_agent.ini

  • DHCP代理,DHCP代理爲虛擬網絡提供DHCP服務;
  • 使用dnsmasp提供dhcp服務;

在全部計算節點操作,以compute01節點爲例;

#備份配置文件
cp -a /etc/neutron/dhcp_agent.ini{,.bak}
grep -Ev '^$|#' /etc/neutron/dhcp_agent.ini.bak > /etc/neutron/dhcp_agent.ini
openstack-config --set  /etc/neutron/dhcp_agent.ini DEFAULT interface_driver linuxbridge
openstack-config --set  /etc/neutron/dhcp_agent.ini DEFAULT dhcp_driver neutron.agent.linux.dhcp.Dnsmasq
openstack-config --set  /etc/neutron/dhcp_agent.ini DEFAULT enable_isolated_metadata true

2.6 配置metadata_agent.ini

  • 元數據代理提供配置信息,例如實例的憑據
  • metadata_proxy_shared_secret 的密碼與控制節點上/etc/nova/nova.conf文件中密碼一致;

在全部計算節點操作,以compute01節點爲例;

#備份配置文件
cp -a /etc/neutron/metadata_agent.ini{,.bak}
grep -Ev '^$|#' /etc/neutron/metadata_agent.ini.bak > /etc/neutron/metadata_agent.ini
openstack-config --set /etc/neutron/metadata_agent.ini DEFAULT nova_metadata_host 10.15.253.88
openstack-config --set /etc/neutron/metadata_agent.ini DEFAULT metadata_proxy_shared_secret Zxzn@2020
openstack-config --set /etc/neutron/metadata_agent.ini cache memcache_servers controller01:11211,controller02:11211,controller03:11211

2.7 添加linux內核參數設置

  • 確保Linux操作系統內核支持網橋過濾器,通過驗證所有下列sysctl值設置爲1;

全部控制節點和計算節點配置;

echo 'net.bridge.bridge-nf-call-iptables=1' >>/etc/sysctl.conf
echo 'net.bridge.bridge-nf-call-ip6tables=1'  >>/etc/sysctl.conf

#啓用網絡橋接器支持,需要加載 br_netfilter 內核模塊;否則會提示沒有目錄
modprobe br_netfilter
sysctl -p

2.8 重啓nova-api和neutron-gaent服務

全部控制節點;重新啓動nova API和neutron-server服務

systemctl restart openstack-nova-api.service
systemctl status openstack-nova-api.service

systemctl enable neutron-server.service
systemctl restart neutron-server.service
systemctl status neutron-server.service

全部計算節點;重啓nova-compute服務

systemctl restart openstack-nova-compute.service

全部計算節點;啓動neutron-agent服務和l3網絡服務

systemctl enable neutron-linuxbridge-agent neutron-dhcp-agent neutron-metadata-agent neutron-l3-agent
systemctl restart neutron-linuxbridge-agent neutron-dhcp-agent neutron-metadata-agent neutron-l3-agent
systemctl status neutron-linuxbridge-agent neutron-dhcp-agent neutron-metadata-agent neutron-l3-agent

3. neutron服務驗證(控制節點)

#列出已加載的擴展,以驗證該neutron-server過程是否成功啓動
[root@controller01 ~]# openstack extension list --network

#列出代理商以驗證成功
[root@controller01 ~]# openstack network agent list

4. 添加pcs資源

  • 只需要添加neutron-server,其他的neutron-agent服務:neutron-linuxbridge-agentneutron-l3-agentneutron-dhcp-agentneutron-metadata-agent 不需要添加了;因爲部署在了計算節點上

在任意控制節點操作;添加資源neutron-server

#pcs resource create neutron-linuxbridge-agent systemd:neutron-linuxbridge-agent clone interleave=true
#pcs resource create neutron-l3-agent systemd:neutron-l3-agent clone interleave=true
#pcs resource create neutron-dhcp-agent systemd:neutron-dhcp-agent clone interleave=true
#pcs resource create neutron-metadata-agent systemd:neutron-metadata-agent clone interleave=true

pcs resource create neutron-server systemd:neutron-server clone interleave=true

查看資源

[root@controller01 ~]# pcs resource 
發表評論
所有評論
還沒有人評論,想成為第一個評論的人麼? 請在上方評論欄輸入並且點擊發布.
相關文章