介绍
OpenStack Networking（中子）允许您创建并附加由其他OpenStack服务管理的接口设备到网络。 可以实现插件以适应不同的网络设备和软件，为OpenStack架构和部署提供灵活性。
它包括以下组件：
neutron-server
接受并将API请求路由到相应的OpenStack Networking插件以进行操作。
OpenStack Networking plug-ins and agents
插拔端口，创建网络或子网，并提供IP寻址。
通用代理是L3，DHCP（动态主机IP寻址）和插件代理。
Messaging queue
大多数OpenStack网络设备用队列在neutron服务器和各种代理之间路由信息。 还充当数据库来存储特定插件的网络状态。
创建数据库
使用root用户登录数据库
sudo mysql
创建neutron数据库
CREATE DATABASE neutron;
创建neutron数据库并授权
GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'localhost' \
IDENTIFIED BY 'NEUTRON_DBPASS';
GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'%' \
IDENTIFIED BY 'NEUTRON_DBPASS';
将NEUTRON_DBPASS替换为自己的密码
创建服务凭证
输入管理员凭证
. admin-openrc
创建openstack的neutron用户
openstack user create --domain default --password-prompt neutron
User Password:
Repeat User Password:
+---------------------+----------------------------------+
| Field | Value |
+---------------------+----------------------------------+
| domain_id | default |
| enabled | True |
| id | fdb0f541e28141719b6a43c8944bf1fb |
| name | neutron |
| options | {} |
| password_expires_at | None |
+---------------------+----------------------------------+
将admin角色添加到service项目、neutron角色
openstack role add --project service --user neutron admin
创建neutron服务
openstack service create --name neutron \
--description "OpenStack Networking" network
+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | OpenStack Networking |
| enabled | True |
| id | f71529314dab4a4d8eca427e701d209e |
| name | neutron |
| type | network |
+-------------+----------------------------------+
创建neutron服务的API端口
openstack endpoint create --region RegionOne \
network public http://controller:9696
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | 85d80a6d02fc4b7683f611d7fc1493a3 |
| interface | public |
| region | RegionOne |
| region_id | RegionOne |
| service_id | f71529314dab4a4d8eca427e701d209e |
| service_name | neutron |
| service_type | network |
| url | http://controller:9696 |
+--------------+----------------------------------+
openstack endpoint create --region RegionOne \
network internal http://controller:9696
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | 09753b537ac74422a68d2d791cf3714f |
| interface | internal |
| region | RegionOne |
| region_id | RegionOne |
| service_id | f71529314dab4a4d8eca427e701d209e |
| service_name | neutron |
| service_type | network |
| url | http://controller:9696 |
+--------------+----------------------------------+
openstack endpoint create --region RegionOne \
network admin http://controller:9696
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | 1ee14289c9374dffb5db92a5c112fc4e |
| interface | admin |
| region | RegionOne |
| region_id | RegionOne |
| service_id | f71529314dab4a4d8eca427e701d209e |
| service_name | neutron |
| service_type | network |
| url | http://controller:9696 |
+--------------+----------------------------------+
配置网络
安装
sudo apt install neutron-server neutron-plugin-ml2 \
neutron-linuxbridge-agent neutron-l3-agent neutron-dhcp-agent \
neutron-metadata-agent
修改/etc/neutron/neutron.conf文件
修改数据库连接配置
[database]
connection = mysql+pymysql://neutron:NEUTRON_DBPASS@controller/neutron
替换NEUTRON_DBPASS为我们自己的密码，并且注释或者删除其他 [database]选项
启用ML2插件，路由器服务和重叠IP地址
[DEFAULT]
core_plugin = ml2
service_plugins = router
allow_overlapping_ips = true
修改连接rabbitmq配置
[DEFAULT]
transport_url = rabbit://openstack:RABBIT_PASS@controller
替换RABBIT_PASS为自己的密码
配置认证服务访问
[DEFAULT]
auth_strategy = keystone
[keystone_authtoken]
auth_uri = http://controller:5000
auth_url = http://controller:35357
memcached_servers = controller:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = neutron
password = NEUTRON_PASS
替换NEUTRON_PASS为自己的密码,并且注释或者删除其他 [keystone_authtoken]部分
配置Networking通知Compute网络拓扑变化
[DEFAULT]
notify_nova_on_port_status_changes = true
notify_nova_on_port_data_changes = true
[nova]
auth_url = http://controller:35357
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = nova
password = NOVA_PASS
替换NOVA_PASS为自己的密码
配置ML2插件
修改/etc/neutron/plugins/ml2/ml2_conf.ini文件
启动flat、VLAN和VXLAN网络
[ml2]
type_drivers = flat,vlan,vxlan
启用VXLAN自服务网络
[ml2]
tenant_network_types = vxlan
启动Linux bridge和L2 population机制
[ml2]
mechanism_drivers = linuxbridge,l2population
启动端口安全扩展驱动程序
[ml2]
extension_drivers = port_security
将提供商虚拟网络配置为flat网络
[ml2_type_flat]
flat_networks = provider
配置自服务网络的VXLAN网络标识符范围
[ml2_type_vxlan]
vni_ranges = 1:1000
启用ipset来提高安全组规则的效率
[securitygroup]
enable_ipset = true
配置Linux bridge代理
修改/etc/neutron/plugins/ml2/linuxbridge_agent.ini文件
将提供商虚拟网络映射到提供商物理网络接口
[linux_bridge]
physical_interface_mappings = provider:PROVIDER_INTERFACE_NAME
PROVIDER_INTERFACE_NAME替换为控制节点外网网卡，例如enp9s0
启用VXLAN覆盖网络，配置处理覆盖网络的物理网络接口的IP地址，并启动L2 population
[vxlan]
enable_vxlan = true
local_ip = OVERLAY_INTERFACE_IP_ADDRESS
l2_population = true
用控制节点管理网络IP地址替换OVERLAY_INTERFACE_IP_ADDRESS，例如10.0.0.11
启动安全组并配置Linux bridge iptables防火墙驱动
[securitygroup]
enable_security_group = true
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
配置L3代理
修改/etc/neutron/l3_agent.ini文件
配置Linux bridge接口驱动和外网网桥
[DEFAULT]
interface_driver = linuxbridge
配置DHCP代理
修改/etc/neutron/dhcp_agent.ini文件
配置Linux bridge接口驱动,Dnsmasq DHCP驱动,并启动启用隔离的元数据，从而提供商网络上的实例可以通过网络访问元数据
[DEFAULT]
interface_driver = linuxbridge
dhcp_driver = neutron.agent.linux.dhcp.Dnsmasq
enable_isolated_metadata = true
配置metadata代理
修改/etc/nova/nova.conf文件
配置元数据主机和共享密匙
[DEFAULT]
nova_metadata_host = controller
metadata_proxy_shared_secret = METADATA_SECRET
为元数据代理选择合适的密匙替代METADATA_SECRET。
配置compute服务以使用networking服务
修改/etc/nova/nova.conf文件
配置访问参数，启动元数据代理
[neutron]
url = http://controller:9696
auth_url = http://controller:35357
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = neutron
password = NEUTRON_PASS
service_metadata_proxy = true
metadata_proxy_shared_secret = METADATA_SECRET
用neutron用户密码替换NEUTRON_PASS。用元数据代理密匙替换METADATA_SECRET。
完成安装
填充计算服务数据库
sudo -s /bin/sh -c "neutron-db-manage --config-file /etc/neutron/neutron.conf \
--config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade head" neutron
重启计算api服务
sudo service nova-api restart
重启网络服务
sudo service neutron-server restart
sudo service neutron-linuxbridge-agent restart
sudo service neutron-dhcp-agent restart
sudo service neutron-metadata-agent restart
sudo service neutron-l3-agent restart
验证
openstack network agent list
+--------------------------------------+--------------------+------------+-------------------+-------+-------+---------------------------+
| ID | Agent Type | Host | Availability Zone | Alive | State | Binary |
+--------------------------------------+--------------------+------------+-------------------+-------+-------+---------------------------+
| f49a4b81-afd6-4b3d-b923-66c8f0517099 | Metadata agent | controller | None | True | UP | neutron-metadata-agent |
| 27eee952-a748-467b-bf71-941e89846a92 | Linux bridge agent | controller | None | True | UP | neutron-linuxbridge-agent |
| 08905043-5010-4b87-bba5-aedb1956e27a | Linux bridge agent | compute1 | None | True | UP | neutron-linuxbridge-agent |
| 830344ff-dc36-4956-84f4-067af667a0dc | L3 agent | controller | nova | True | UP | neutron-l3-agent |
| dd3644c9-1a3a-435a-9282-eb306b4b0391 | DHCP agent | controller | nova | True | UP | neutron-dhcp-agent |
+--------------------------------------+--------------------+------------+-------------------+-------+-------+---------------------------+