OpenStack实战十六——Neutron实现阿里云VPC专有网络

1. 配置私有网络

  • 阿里云VPC网络

    OpenStack实战十六——Neutron实现阿里云VPC专有网络

  • 配置服务组件(在之前配置的基础上改)

    service_plugins = router

    allow_overlapping_ips = True

  • 配置 Modular Layer 2 (ML2) 插件

    ML2插件使用Linuxbridge机制来为实例创建layer-2虚拟网络基础设施

    编辑 /etc/neutron/plugins/ml2/ml2_conf.ini 文件并完成以下操作:

    1.在[ml2]部分,启用flat,VLAN以及VXLAN网络:

    [ml2]
    ...
    type_drivers = flat,vlan,vxlan

    2.在[ml2]部分,启用VXLAN私有网络:

    [ml2]
    ...
    tenant_network_types = vxlan

    3.在[ml2]部分,启用Linuxbridge和layer-2机制:

    [ml2]
    ...
    mechanism_drivers = linuxbridge,openvswitch,l2population

    4.在[ml2_type_vxlan]部分,为私有网络配置VXLAN网络识别的网络范围:

    [ml2_type_vxlan]
    ...
    vni_ranges = 1:1000
  • 配置Linuxbridge代理

    Linuxbridge代理为实例建立layer-2虚拟网络并且处理安全组规则。

    编辑 /etc/neutron/plugins/ml2/linuxbridge_agent.ini 文件并且完成以下操作:

    [vxlan]部分,启用VXLAN覆盖网络,配置覆盖网络的物理网络接口的IP地址,启用layer-2 population:

    [vxlan]
    enable_vxlan = True
    local_ip = 192.168.56.11
    l2_population = True
    
    physical_interface_mappings = public:eth0   #将之前测试配置的internet:eth1删掉
  • 配置layer-3代理

    Layer-3代理为私有虚拟网络提供路由和NAT服务。

    编辑 /etc/neutron/l3_agent.ini 文件并完成以下操作:

    [DEFAULT]部分,配置Linuxbridge接口驱动和外部网络网桥:

    [DEFAULT]
    ...
    interface_driver = neutron.agent.linux.interface.BridgeInterfaceDriver
    external_network_bridge =

    注解:

    external_network_bridge 选项特意设置成缺省值,这样就可以在一个代理上允许多种外部网络。

  • 启动服务

    [root@linux-node1 ~]# systemctl restart neutron-server
    [root@linux-node1 ~]# systemctl restart neutron-linuxbridge-agent
    [root@linux-node1 ~]# systemctl enable neutron-l3-agent
    [root@linux-node1 ~]# systemctl start neutron-l3-agent
    [root@linux-node1 ~]# ps aux|grep l3-agent
    neutron   16364  9.3  1.3 314924 53684 ?        Ss   23:07   0:04 /usr/bin/python2 /usr/bin/neutron-l3-agent --config-file /usr/share/neutron/neutron-dist.conf --config-dir /usr/share/neutron/l3_agent --config-file /etc/neutron/neutron.conf --config-dir /etc/neutron/conf.d/common --config-dir /etc/neutron/conf.d/neutron-l3-agent --log-file /var/log/neutron/l3-agent.log
  • 计算节点配置

    编辑 /etc/neutron/plugins/ml2/linuxbridge_agent.ini 文件并且完成以下操作:

    enable_vxlan = true
    local_ip = 192.168.56.12
    l2_population = true
    
    physical_interface_mappings = public:eth0   #将之前配置的internet:eth1删除掉
    [root@linux-node2 ~]# systemctl restart neutron-linuxbridge-agent.service   #重启linuxbridge

                                        

2. 创建自服务网络

2.1 查看neutron服务

[root@linux-node1 ~]# source admin-openstack.sh 
[root@linux-node1 ~]# neutron agent-list
+--------------------+--------------------+--------------------+-------------------+-------+----------------+-----------------------+
| id                 | agent_type         | host               | availability_zone | alive | admin_state_up | binary                |
+--------------------+--------------------+--------------------+-------------------+-------+----------------+-----------------------+
| 2d039f59-f185-4fea | L3 agent           | linux-             | nova              | 🙂   | True           | neutron-l3-agent      |
| -8175-4f99830621d6 |                    | node1.example.com  |                   |       |                |                       |
| 359b9e64-5cd1      | Metadata agent     | linux-             |                   | 🙂   | True           | neutron-metadata-     |
| -499d-             |                    | node1.example.com  |                   |       |                | agent                 |
| 8f94-5da454944257  |                    |                    |                   |       |                |                       |
| 935ffbe4-d5d1-4336 | Linux bridge agent | linux-             |                   | 🙂   | True           | neutron-linuxbridge-  |
| -a2ac-aabcbff3c154 |                    | node2.example.com  |                   |       |                | agent                 |
| bca4f7fc-9c45-4ba2 | DHCP agent         | linux-             | nova              | 🙂   | True           | neutron-dhcp-agent    |
| -83b6-5f5f9d1974e2 |                    | node1.example.com  |                   |       |                |                       |
| c549a7a4-2c0d-4842 | Linux bridge agent | linux-             |                   | 🙂   | True           | neutron-linuxbridge-  |
| -9620-9b1e19625947 |                    | node1.example.com  |                   |       |                | agent                 |
+--------------------+--------------------+--------------------+-------------------+-------+----------------+-----------------------+

2.2 创建私有网络

  • 获取admin凭证

    [root@linux-node1 ~]# source demo-openstack.sh
  • 创建网络

    [root@linux-node1 ~]# neutron net-create selfservice
    Created a new network:
    +-------------------------+--------------------------------------+
    | Field                   | Value                                |
    +-------------------------+--------------------------------------+
    | admin_state_up          | True                                 |
    | availability_zone_hints |                                      |
    | availability_zones      |                                      |
    | created_at              | 2017-04-30T04:02:44                  |
    | description             |                                      |
    | id                      | 71d9ac17-1c9e-4b6e-9afa-870184930fd3 |
    | ipv4_address_scope      |                                      |
    | ipv6_address_scope      |                                      |
    | mtu                     | 1450                                 |
    | name                    | selfservice                          |
    | port_security_enabled   | True                                 |
    | router:external         | False                                |
    | shared                  | False                                |
    | status                  | ACTIVE                               |
    | subnets                 |                                      |
    | tags                    |                                      |
    | tenant_id               | ab47f14a4ccf4f748f84d5100eb30300     |
    | updated_at              | 2017-04-30T04:02:44                  |
    +-------------------------+--------------------------------------+
  • 在网络上创建一个子网

    自服务网络使用172.16.1.0/24 网关172.16.1.1。DHCP服务负责为每个实例从172.16.1.2 到172.16.1.254中分配IP地址。所有实例使用223.5.5.5作为DNS。

    [root@linux-node1 ~]# neutron subnet-create --name selfservice   --dns-nameserver 223.5.5.5 --gateway 172.16.1.1   selfservice 172.16.1.0/24
    Created a new subnet:
    +-------------------+------------------------------------------------+
    | Field             | Value                                          |
    +-------------------+------------------------------------------------+
    | allocation_pools  | {"start": "172.16.1.2", "end": "172.16.1.254"} |
    | cidr              | 172.16.1.0/24                                  |
    | created_at        | 2017-04-30T04:03:10                            |
    | description       |                                                |
    | dns_nameservers   | 223.5.5.5                                      |
    | enable_dhcp       | True                                           |
    | gateway_ip        | 172.16.1.1                                     |
    | host_routes       |                                                |
    | id                | f2e976d6-25f3-4150-a9d0-bb109a5c56b0           |
    | ip_version        | 4                                              |
    | ipv6_address_mode |                                                |
    | ipv6_ra_mode      |                                                |
    | name              | selfservice                                    |
    | network_id        | 71d9ac17-1c9e-4b6e-9afa-870184930fd3           |
    | subnetpool_id     |                                                |
    | tenant_id         | ab47f14a4ccf4f748f84d5100eb30300               |
    | updated_at        | 2017-04-30T04:03:10                            |
    +-------------------+------------------------------------------------+
  • 创建路由

    私有网络通过虚拟路由来连接到公有网络,以双向NAT最为典型。每个路由包含至少一个连接到私有网络的接口以及一个连接到公有网络的网关的接口

    公有提供网络必须包括 router: external 选项,用来使路由连接到外部网络,比如互联网。 admin 或者其他权限用户在网络创建时必须包括这个选项,也可以之后在添加。在这个环境里,我们把 public 公有网络设置成 router: external 。

    1.添加router:external 到 provider 网络

    [root@linux-node1 ~]# source admin-openstack.sh 
    [root@linux-node1 ~]# neutron net-update public-net --router:external
    Updated network: public-net

    2.创建路由

    [root@linux-node1 ~]# source demo-openstack.sh 
    [root@linux-node1 ~]# neutron router-create router
    Created a new router:
    Created a new router:
    +-------------------------+--------------------------------------+
    | Field                   | Value                                |
    +-------------------------+--------------------------------------+
    | admin_state_up          | True                                 |
    | availability_zone_hints |                                      |
    | availability_zones      |                                      |
    | description             |                                      |
    | external_gateway_info   |                                      |
    | id                      | eaa2877f-663b-4ca4-9afa-1a303471f6cf |
    | name                    | router                               |
    | routes                  |                                      |
    | status                  | ACTIVE                               |
    | tenant_id               | ab47f14a4ccf4f748f84d5100eb30300     |
    +-------------------------+--------------------------------------+

    3.给路由器添加一个私网子网的接口

    [root@linux-node1 ~]# neutron router-interface-add eaa2877f-663b-4ca4-9afa-1a303471f6cf selfservice
    Added interface 1dadef85-4b1c-499f-bf16-91d2989138b1 to router eaa2877f-663b-4ca4-9afa-1a303471f6cf.

    4.给路由器设置公有网络的网关

    [root@linux-node1 ~]# neutron router-gateway-set eaa2877f-663b-4ca4-9afa-1a303471f6cf public-net
    Set gateway for router eaa2877f-663b-4ca4-9afa-1a303471f6cf

                                           

3. 验证操作

  • 获取admin凭据

    [root@linux-node1 ~]# source admin-openstack.sh
  • 列出网络命名空间。你应该可以看到一个 qrouter 命名空间和两个 qdhcp 命名空间

    [root@linux-node1 ~]# ip netns
    qrouter-eaa2877f-663b-4ca4-9afa-1a303471f6cf (id: 2)
    qdhcp-71d9ac17-1c9e-4b6e-9afa-870184930fd3 (id: 0)
    qdhcp-f3006de4-de03-4bec-af7f-40d3791b645e (id: 1)
  • 列出路由器上的端口来确定公网网关的IP 地址

    [root@linux-node1 ~]#  neutron router-port-list eaa2877f-663b-4ca4-9afa-1a303471f6cf
    +--------------------------------------+------+-------------------+----------------------------------------------------+
    | id                                   | name | mac_address       | fixed_ips                                          |
    +--------------------------------------+------+-------------------+----------------------------------------------------+
    | 1dadef85-4b1c-499f-bf16-91d2989138b1 |      | fa:16:3e:e1:f5:d8 | {"subnet_id":                                      |
    |                                      |      |                   | "f2e976d6-25f3-4150-a9d0-bb109a5c56b0",            |
    |                                      |      |                   | "ip_address": "172.16.1.1"}                        |
    | a4560466-cf00-4199-8a2a-b71a2878c99e |      | fa:16:3e:65:cc:cb | {"subnet_id": "0cf4b0dd-79de-44c4-be7c-            |
    |                                      |      |                   | ca6d8ee88f09", "ip_address": "192.168.56.103"}     |
    +--------------------------------------+------+-------------------+----------------------------------------------------+
  • 修改horizon配置

    [root@linux-node1 ~]# vi /etc/openstack-dashboard/local_settings
    OPENSTACK_NEUTRON_NETWORK = {
        'enable_router': True,
        'enable_quotas': True,
        'enable_ipv6': False,
        'enable_distributed_router': True,
        'enable_ha_router': True,
        'enable_lb': True,
        'enable_firewall': True,
        'enable_vpn': False,
        'enable_fip_topology_check': True,
    
    [root@linux-node1 ~]# systemctl restart httpd

                                        

4. 创建VPC网络

  • 创建两台使用VPC网络的云主机

 OpenStack实战十六——Neutron实现阿里云VPC专有网络

OpenStack实战十六——Neutron实现阿里云VPC专有网络

OpenStack实战十六——Neutron实现阿里云VPC专有网络

OpenStack实战十六——Neutron实现阿里云VPC专有网络

 可以发现,内网能互通,但访问不了公网,我们可以绑定一个浮动IP,通过NAT转换上网

  • 绑定浮动IP

OpenStack实战十六——Neutron实现阿里云VPC专有网络

OpenStack实战十六——Neutron实现阿里云VPC专有网络

OpenStack实战十六——Neutron实现阿里云VPC专有网络

OpenStack实战十六——Neutron实现阿里云VPC专有网络

  • 通过浮动IP对外提供访问

OpenStack实战十六——Neutron实现阿里云VPC专有网络

OpenStack实战十六——Neutron实现阿里云VPC专有网络

  • 查看网络拓扑

OpenStack实战十六——Neutron实现阿里云VPC专有网络

注意:生产中vxlan要慎用,测试环境没什么关系。

参考:

https://docs.openstack.org/mitaka/zh_CN/install-guide-rdo/neutron-controller-install-option2.html

https://docs.openstack.org/mitaka/zh_CN/install-guide-rdo/launch-instance-networks-selfservice.html

anzhihe安志合个人博客,版权所有丨 如未注明,均为原创 丨转载请注明转自:https://chegva.com/2128.html | ☆★★每天进步一点点,加油!★★☆

您可能还感兴趣的文章!

发表评论

电子邮件地址不会被公开。 必填项已用*标注