OpenStack 私有云实战 3—— Neutron 网络服务与 Dashboard 控制台部署

1 Networking 服务配置

1.1 控制节点配置

1.1.1 创建数据库、服务凭证和API端点

创建neutron 数据库，授予合适的访问权限

bash 复制代码

[root@controller ~]# mysql -p123456
# 用数据库连接客户端以 root 用户连接到数据库服务器
MariaDB [(none)]> CREATE DATABASE neutron;
# 创建数据库
MariaDB [(none)]> GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'localhost' IDENTIFIED BY 'neutron';
# 对数据库授予访问权限，设置密码与用户名相同
MariaDB [(none)]> GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'%' IDENTIFIED BY 'neutron';
# 允许所有主机远程访问 neutron 库，设置密码与用户名相同
MariaDB [(none)]> quit

创建neutron用户

bash 复制代码

[root@controller ~]# openstack user create --domain default --password neutron neutron

添加admin 角色到neutron 用户

bash 复制代码

[root@controller ~]# openstack role add --project service --user neutron admin

创建neutron服务实体

bash 复制代码

[root@controller ~]# openstack service create --name neutron --description "OpenStack Networking" network

创建网络服务 API 端点

bash 复制代码

[root@controller ~]# openstack endpoint create --region RegionOne network public http://controller:9696

bash 复制代码

[root@controller ~]# openstack endpoint create --region RegionOne network internal http://controller:9696

bash 复制代码

[root@controller ~]# openstack endpoint create --region RegionOne network admin http://controller:9696

1.1.2 配置公共网络

安装网络组件

bash 复制代码

[root@controller ~]# yum install openstack-neutron openstack-neutron-ml2 openstack-neutron-linuxbridge ebtables

配置服务组件

bash 复制代码

[root@controller ~]# vim /etc/neutron/neutron.conf

复制代码

[database]
...
connection = mysql+pymysql://neutron:neutron@controller/neutron

[DEFAULT]
...
core_plugin = ml2
service_plugins =
rpc_backend = rabbit
auth_strategy = keystone
notify_nova_on_port_status_changes = True
notify_nova_on_port_data_changes = True

[oslo_messaging_rabbit]
...
rabbit_host = controller
rabbit_userid = openstack
rabbit_password = openstack

[keystone_authtoken]
...
auth_uri = http://controller:5000
auth_url = http://controller:35357
memcached_servers = controller:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = neutron
password = neutron

[nova]
...
auth_url = http://controller:35357
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = nova
password = nova

[oslo_concurrency]
...
lock_path = /var/lib/neutron/tmp

配置 Modular Layer 2 (ML2) 插件

bash 复制代码

[root@controller ~]# vim /etc/neutron/plugins/ml2/ml2_conf.ini

复制代码

[ml2]
...
type_drivers = flat,vlan
tenant_network_types =
mechanism_drivers = linuxbridge
extension_drivers = port_security

[ml2_type_flat]
...
flat_networks = provider

[securitygroup]
...
enable_ipset = True

配置 Linuxbridge 代理

bash 复制代码

[root@controller ~]# vim /etc/neutron/plugins/ml2/linuxbridge_agent.ini

复制代码

[linux_bridge]
physical_interface_mappings = provider:eth1

[vxlan]
enable_vxlan = False

[securitygroup]
...
enable_security_group = True
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver

配置 DHCP 代理

bash 复制代码

[root@controller ~]# vim /etc/neutron/dhcp_agent.ini

复制代码

[DEFAULT]
...
interface_driver = neutron.agent.linux.interface.BridgeInterfaceDriver
dhcp_driver = neutron.agent.linux.dhcp.Dnsmasq
enable_isolated_metadata = True

1.1.3 配置元数据代理

bash 复制代码

[root@controller ~]# vim /etc/neutron/metadata_agent.ini

复制代码

[DEFAULT]
...
nova_metadata_ip = controller
metadata_proxy_shared_secret = westos
# 此密码为自定义，稍后部署会用到

1.1.4 为计算节点配置网络服务

bash 复制代码

[root@controller ~]# vim /etc/nova/nova.conf

复制代码

[neutron]
...
url = http://controller:9696
auth_url = http://controller:35357
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = neutron
password = neutron

service_metadata_proxy = True
metadata_proxy_shared_secret = westos
# 此密码是在上一步中自定义的密码

网络服务初始化脚本需要一个超链接 /etc/neutron/plugin.ini指向ML2插件配置文件/etc/neutron/plugins/ml2/ml2_conf.ini

bash 复制代码

[root@controller ~]# ln -s /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugin.ini

同步数据库

bash 复制代码

[root@controller ~]# su -s /bin/sh -c "neutron-db-manage --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade head" neutron

重启服务

bash 复制代码

[root@controller ~]# systemctl restart openstack-nova-api.service
[root@controller ~]# systemctl enable neutron-server.service neutron-linuxbridge-agent.service neutron-dhcp-agent.service neutron-metadata-agent.service
[root@controller ~]# systemctl start neutron-server.service neutron-linuxbridge-agent.service neutron-dhcp-agent.service neutron-metadata-agent.service

验证

bash 复制代码

[root@controller ~]# neutron ext-list

bash 复制代码

[root@controller ~]# neutron agent-list

1.2 计算节点配置

1.2.1 安装并配置通用组件

bash 复制代码

[root@compute1 ~]# yum install openstack-neutron-linuxbridge ebtables ipset
[root@compute1 ~]# vim /etc/neutron/neutron.conf

复制代码

[DEFAULT]
...
rpc_backend = rabbit
auth_strategy = keystone

[oslo_messaging_rabbit]
...
rabbit_host = controller
rabbit_userid = openstack
rabbit_password = openstack

[keystone_authtoken]
...
auth_uri = http://controller:5000
auth_url = http://controller:35357
memcached_servers = controller:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = neutron
password = neutron

[oslo_concurrency]
...
lock_path = /var/lib/neutron/tmp

1.2.2 配置公共网络

配置 Linuxbridge 代理

bash 复制代码

[root@compute1 ~]# vim /etc/neutron/plugins/ml2/linuxbridge_agent.ini

复制代码

[linux_bridge]
physical_interface_mappings = provider:eth1

[vxlan]
enable_vxlan = False

[securitygroup]
...
enable_security_group = True
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver

1.2.3 为计算节点配置网络服务

bash 复制代码

[root@compute1 ~]# vim /etc/nova/nova.conf

复制代码

[neutron]
...
url = http://controller:9696
auth_url = http://controller:35357
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = neutron
password = neutron

重启计算服务，启动 Linuxbridge 代理并配置它开机自启动

bash 复制代码

[root@compute1 ~]# systemctl restart openstack-nova-compute.service
[root@compute1 ~]# systemctl enable neutron-linuxbridge-agent.service
[root@compute1 ~]# systemctl start neutron-linuxbridge-agent.service

2 启动一个实例

2.1 创建虚拟网络

创建提供者网络

bash 复制代码

[root@controller ~]# neutron net-create --shared --provider:physical_network provider --provider:network_type flat provider

在网络上创建一个子网

bash 复制代码

[root@controller ~]# neutron subnet-create --name provider \
--allocation-pool start=192.168.40.100,end=192.168.40.150 \
--dns-nameserver 114.114.114.114 --gateway 192.168.40.2 \
provider 192.168.40.0/24

2.2 创建 m1.nano 规格的主机

bash 复制代码

[root@controller ~]# openstack flavor list
[root@controller ~]# openstack flavor create --id 0 --vcpus 1 --ram 64 --disk 1 m1.nano

2.3 生成一个键值对

导入租户demo的凭证，生成和添加秘钥对

bash 复制代码

[root@controller ~]# . demo-openrc
[root@controller ~]# ssh-keygen -q -N ""
[root@controller ~]# openstack keypair create --public-key ~/.ssh/id_rsa.pub mykey

验证公钥的添加

bash 复制代码

[root@controller ~]# openstack keypair list

2.4 增加安全组规则

bash 复制代码

[root@controller ~]# openstack security group rule create --proto icmp default
[root@controller ~]# openstack security group rule create --proto tcp --dst-port 22 default

2.5 创建实例

确定实例选项

bash 复制代码

[root@controller ~]# . demo-openrc
[root@controller ~]# openstack flavor list
[root@controller ~]# openstack image list
[root@controller ~]# openstack network list
[root@controller ~]# openstack security group list

创建并启动实例

bash 复制代码

[root@controller ~]# openstack server create --flavor m1.nano --image cirros --nic net-id=3b8fe504-9c01-4f54-a60e-0fda4e80f7a8 --security-group default --key-name mykey provider-instance

查看实例状态

bash 复制代码

[root@controller ~]# openstack server list

获取实例的 Virtual Network Computing (VNC) 会话URL并从web浏览器访问它

bash 复制代码

[root@controller ~]# openstack console url show provider-instance

访问网址，http://controller:6080/vnc_auto.html?token=ea8b8a4f-066c-4f1c-a951-3af0243eb8a6，其中的 controller 替换为IP地址

用指定的用户名和密码登录即可

测试

远程登录

bash 复制代码

[root@controller ~]# ssh cirros@192.168.40.101

3 Dashboard

3.1 安装并配置组件

bash 复制代码

[root@controller ~]# yum install openstack-dashboard
[root@controller ~]# vim /etc/openstack-dashboard/local_settings

复制代码

OPENSTACK_HOST = "controller"

ALLOWED_HOSTS = ['*', ]

SESSION_ENGINE = 'django.contrib.sessions.backends.cache'
CACHES = {
    'default': {
         'BACKEND': 'django.core.cache.backends.memcached.MemcachedCache',
         'LOCATION': 'controller:11211',
    }
}

OPENSTACK_KEYSTONE_URL = "http://%s:5000/v3" % OPENSTACK_HOST

OPENSTACK_KEYSTONE_MULTIDOMAIN_SUPPORT = True

OPENSTACK_API_VERSIONS = {
    "identity": 3,
    "image": 2,
    "volume": 2,
}

OPENSTACK_KEYSTONE_DEFAULT_DOMAIN = "default"

OPENSTACK_KEYSTONE_DEFAULT_ROLE = "user"

OPENSTACK_NEUTRON_NETWORK = {
    ...
    'enable_router': False,
    'enable_quotas': False,
    'enable_distributed_router': False,
    'enable_ha_router': False,
    'enable_lb': False,
    'enable_firewall': False,
    'enable_vpn': False,
    'enable_fip_topology_check': False,
}

TIME_ZONE = "Asia/Shanghai"

重启 web 服务器以及会话存储服务

bash 复制代码

[root@controller ~]# systemctl restart httpd.service memcached.service

3.2 前端页面操作

访问http://192.168.40.161/dashboard

管理员身份登录，用户名和密码都是 admin

可以看到各类信息

登录普通用户 demo，用户名与密码相同

管理员创建的共享网络，普通用户云主机占用，必须要删除云主机，才能删除网络

删除云主机

记住供应商的信息

删除子网

删除网络

重新创建网络，信息与供应商信息保持一致

创建成功后点进 provider

创建子网

创建成功

除此之外，云主机类型和镜像等都可以自行创建

登录demo

批量创建云主机

启动实例

验证

远程连接也没问题