網絡服務Neutron
本章節結束如何安裝並配置網絡服務（neutron）采用:ref:`provider networks <network1>`或:ref:`self-service networks <network2>`選項。
控制節點：controller：
IP：192.168.164.128
hostname&hosts：likeadmin
計算加點：Nova：
IP：192.168.164.129
hostname&hosts：likenode
塊存儲節點:cinder：
IP：192.168.164.136
hostname&hosts：likeblock
1.網絡服務概述
OpenStack Networking（neutron），允許創建、插入接口設備，這些設備由其他的OpenStack服務管理。插件式的實現可以容納不同的網絡設備和軟件，為OpenStack架構與部署提供了靈活性。
它包含下列組件：
neutron-server
接收和路由API請求到合適的OpenStack網絡插件，以達到預想的目的。
OpenStack的網絡插件和代理
插拔端口，創建網絡或子網，並提供IP尋址。 這些插件和代理程序因特定雲中使用的供應商和技術而異。 OpenStack Networking附帶了用於思科虛擬和物理交換機，NEC OpenFlow產品，Open vSwitch，Linux橋接和VMware NSX產品的插件和代理。
常見的代理L3（3層），DHCP（動態主機IP地址），以及插件代理。
消息隊列
大多數的OpenStack Networking安裝都會用到，用於在neutron-server和各種各樣的代理進程間路由信息。也為某些特定的插件扮演數據庫的角色，以存儲網絡狀態
OpenStack網絡主要和OpenStack計算交互，以提供網絡連接到它的實例。
2.網絡（neutron）概念
OpenStack Networking（neutron）管理OpenStack環境中虛擬網絡基礎架構（VNI）的所有網絡方面以及物理網絡基礎架構（PNI）的訪問層方面。
OpenStack Networking使項目能夠創建高級虛擬網絡拓撲，其中可能包括防火牆，負載均衡器和虛擬專用網絡（VPN）等服務。
網絡服務提供網絡，子網以及路由這些對象的抽象概念。每個抽象概念都有自己的功能，可以模擬對應的物理設備：網絡包括子網，路由在不同的子網和網絡間進行路由轉發。
對於任意一個給定的網絡都必須包含至少一個外部網絡。不想其他的網絡那樣，外部網絡不僅僅是一個定義的虛擬網絡。
相反，它代表了一種OpenStack安裝之外的能從物理的，外部的網絡訪問的視圖。外部網絡上的IP地址可供外部網絡上的任意的物理設備所訪問
外部網絡之外，任何 Networking 設置擁有一個或多個內部網絡。這些軟件定義的網絡直接連接到虛擬機。
僅僅在給定網絡上的虛擬機，或那些在通過接口連接到相近路由的子網上的虛擬機，能直接訪問連接到那個網絡上的虛擬機。
如果外部網絡想要訪問實例或者相反實例想要訪問外部網絡，那么網絡之間的路由就是必要的了。
每一個路由都配有一個網關用於連接到外部網絡，以及一個或多個連接到內部網絡的接口。
就像一個物理路由一樣，子網可以訪問同一個路由上其他子網中的機器，並且機器也可以訪問路由的網關訪問外部網絡。
另外，你可以將外部網絡的IP地址分配給內部網絡的端口。不管什么時候一旦有連接連接到子網，那個連接被稱作端口。
你可以給實例的端口分配外部網絡的IP地址。通過這種方式，外部網絡上的實體可以訪問實例.
網絡服務同樣支持安全組。安全組允許管理員在安全組中定義防火牆規則。一個實例可以屬於一個或多個安全組，網絡為這個實例配置這些安全組中的規則，阻止或者開啟端口，端口范圍或者通信類型。
每一個Networking使用的插件都有其自有的概念。雖然對操作VNI和OpenStack環境不是至關重要的，但理解這些概念能幫助你設置Networking。
所有的Networking安裝使用了一個核心插件和一個安全組插件(或僅是空操作安全組插件)。另外，防火牆即服務(FWaaS)和負載均衡即服務(LBaaS)插件是可用的。
3.安裝並配置控制節點
在你配置OpenStack網絡（neutron）服務之前，你必須為其創建一個數據庫，服務憑證和API端點。
1）完成下面的步驟以創建數據庫：
用數據庫連接客戶端以 root 用戶連接到數據庫服務器：
$ mysql -u root -p
創建``neutron`` 數據庫：
MariaDB [(none)] CREATE DATABASE neutron;
對``neutron`` 數據庫授予合適的訪問權限，使用合適的密碼替換``NEUTRON_DBPASS``：
MariaDB [(none)]> GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'localhost' \
IDENTIFIED BY 'djl18001';
MariaDB [(none)]> GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'%' \
IDENTIFIED BY 'djl18001';
2）獲得 admin 憑證來獲取只有管理員能執行的命令的訪問權限：
[root@likeadmin ~]# source /root/.admin-openrc
3）要創建服務證書，完成這些步驟：
創建``neutron``用戶：
[root@likeadmin ~]# openstack user create --domain default --password-prompt neutron
User Password: djl18001
Repeat User Password:
+---------------------+----------------------------------+
| Field | Value |
+---------------------+----------------------------------+
| domain_id | default |
| enabled | True |
| id | cda6dd27199642a3bfe3417e53803b8d |
| name | neutron |
| options | {} |
| password_expires_at | None |
+---------------------+----------------------------------+
[root@likeadmin ~]#
添加``admin`` 角色到``neutron`` 用戶：
[root@likeadmin ~]# openstack role add --project service --user neutron admin
創建``neutron``服務實體：
[root@likeadmin ~]# openstack service create --name neutron \
> --description "OpenStack Networking" network
+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | OpenStack Networking |
| enabled | True |
| id | b04fe56b6799405183418994a951df4a |
| name | neutron |
| type | network |
+-------------+----------------------------------+
[root@likeadmin ~]#
4.創建網絡服務API端點：
[root@likeadmin ~]# openstack endpoint create --region RegionOne \
> network public http://likeadmin:9696
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | b6b9526e4d514c0cb939f86021d23b89 |
| interface | public |
| region | RegionOne |
| region_id | RegionOne |
| service_id | b04fe56b6799405183418994a951df4a |
| service_name | neutron |
| service_type | network |
| url | http://likeadmin:9696 |
+--------------+----------------------------------+
[root@likeadmin ~]# openstack endpoint create --region RegionOne \
> network internal http://likeadmin:9696
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | cf9abd0f74684b969feaa224963adcc8 |
| interface | internal |
| region | RegionOne |
| region_id | RegionOne |
| service_id | b04fe56b6799405183418994a951df4a |
| service_name | neutron |
| service_type | network |
| url | http://likeadmin:9696 |
+--------------+----------------------------------+
[root@likeadmin ~]# openstack endpoint create --region RegionOne \
> network admin http://likeadmin:9696
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | 73fa01fab721467382d2d359afbc80f4 |
| interface | admin |
| region | RegionOne |
| region_id | RegionOne |
| service_id | b04fe56b6799405183418994a951df4a |
| service_name | neutron |
| service_type | network |
| url | http://likeadmin:9696 |
+--------------+----------------------------------+
[root@likeadmin ~]#
[root@likeadmin ~]# openstack endpoint list
+----------------------------------+-----------+--------------+--------------+---------+-----------+------------------------------------------+
| ID | Region | Service Name | Service Type | Enabled | Interface | URL |
+----------------------------------+-----------+--------------+--------------+---------+-----------+------------------------------------------+
| 0f5af5f9e444442eb07ad78fe1314705 | RegionOne | keystone | identity | True | internal | http://likeadmin:5000/v3/ |
| 2d3ee70a3c4c4cb399ba3a689a7fdf82 | RegionOne | nova | compute | True | admin | http://likeadmin:8774/v2.1/%(tenant_id)s |
| 36495ec2b54a4a07a8cd83745a3a19b8 | RegionOne | glance | image | True | public | http://likeadmin:9292 |
| 59ee7ce4b50d4142b5a66c8ab3c8e01a | RegionOne | glance | image | True | admin | http://likeadmin:9292 |
| 5e5a460effe3446bbad3d434a0c128c4 | RegionOne | placement | placement | True | public | http://likeadmin:8778 |
| 73fa01fab721467382d2d359afbc80f4 | RegionOne | neutron | network | True | admin | http://likeadmin:9696 |
| 829019c5bfe94637af4876725213690e | RegionOne | nova | compute | True | internal | http://likeadmin:8774/v2.1/%(tenant_id)s |
| 8a1893ba8035440f8e4a7bdc440ffef8 | RegionOne | glance | image | True | internal | http://likeadmin:9292 |
| 94c895aac78141f8a397a1c0f80f8ea1 | RegionOne | placement | placement | True | internal | http://likeadmin:8778 |
| b572d79c6f5c47a789b258ec7474599c | RegionOne | keystone | identity | True | public | http://likeadmin:5000/v3/ |
| b6b9526e4d514c0cb939f86021d23b89 | RegionOne | neutron | network | True | public | http://likeadmin:9696 |
| cf9abd0f74684b969feaa224963adcc8 | RegionOne | neutron | network | True | internal | http://likeadmin:9696 |
| e54a008fe46741588458cf66fd67c31f | RegionOne | placement | placement | True | admin | http://likeadmin:8778 |
| ea27f64912a3468f9c77df9298ae6fd7 | RegionOne | nova | compute | True | public | http://likeadmin:8774/v2.1/%(tenant_id)s |
| ed967ed76c6141cba66f6f20b9b9c5f2 | RegionOne | keystone | identity | True | admin | http://likeadmin:35357/v3/ |
+----------------------------------+-----------+--------------+--------------+---------+-----------+------------------------------------------+
[root@likeadmin ~]#
5.配置網絡選項
您可以部署網絡服務使用選項1和選項2兩種架構中的一種來部署網絡服務。
選項1采用盡可能簡單的架構進行部署，只支持實例連接到公有網絡（外部網絡）。
沒有私有網絡（個人網絡），路由器以及浮動IP地址。只有``admin``或者其他特權用戶才可以管理公有網絡
選項2在選項1的基礎上多了layer－3服務，支持實例連接到私有網絡。
``demo``或者其他沒有特權的用戶可以管理自己的私有網絡，包含連接公網和私網的路由器。
另外，浮動IP地址可以讓實例使用私有網絡連接到外部網絡，例如互聯網
典型的私有網絡一般使用覆蓋網絡。覆蓋網絡，例如VXLAN包含了額外的數據頭，這些數據頭增加了開銷，減少了有效內容和用戶數據的可用空間。
在不了解虛擬網絡架構的情況下，實例嘗試用以太網 最大傳輸單元 (MTU) 1500字節發送數據包。網絡服務會自動給實例提供正確的MTU的值通過DHCP的方式。
但是，一些雲鏡像並沒有使用DHCP或者忽視了DHCP MTU選項，要求使用元數據或者腳本來進行配置
1.這里我們選擇網絡選項2：自服務網絡
1）在 controller 節點安裝和配置網絡組件。
安裝組件
# yum install openstack-neutron openstack-neutron-ml2 \
openstack-neutron-linuxbridge ebtables
2)配置服務組件
編輯``/etc/neutron/neutron.conf`` 文件並完成如下操作：
在 [database] 部分，配置數據庫訪問：
[database]
# ...
connection = mysql+pymysql://neutron:djl18001@likeadmin/neutron
使用你設置的數據庫密碼替換 NEUTRON_DBPASS 。
注解：注釋或刪除``[database]``部分除``connection`以外的所有內容
在``[DEFAULT]``部分，啟用Modular Layer 2 (ML2)插件，路由服務和重疊的IP地址：
[DEFAULT]
# ...
core_plugin = ml2
service_plugins = router
allow_overlapping_ips = true
在``[DEFAULT]``部分，配置``RabbitMQ``消息隊列訪問權限：
[DEFAULT]
# ...
transport_url = rabbit://openstack:djl18001@likeadmin
用你在RabbitMQ中為``openstack``選擇的密碼替換 “RABBIT_PASS”。
在 “[DEFAULT]” 和 “[keystone_authtoken]” 部分，配置認證服務訪問：
[DEFAULT]
# ...
auth_strategy = keystone
[keystone_authtoken]
# ...
auth_uri = http://likeadmin:5000
auth_url = http://likeadmin:35357
memcached_servers = likeadmin:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = neutron
password = djl18001
將 NEUTRON_PASS 替換為你在認證服務中為 neutron 用戶選擇的密碼。
注解：在 [keystone_authtoken] 中注釋或者刪除其他選項。
在``[DEFAULT]``和``[nova]``部分，配置網絡服務來通知計算節點的網絡拓撲變化：
[DEFAULT]
# ...
notify_nova_on_port_status_changes = true
notify_nova_on_port_data_changes = true
[nova]
# ...
auth_url = http://likeadmin:35357
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = nova
password = djl18001
使用你在身份認證服務中設置的``nova`` 用戶的密碼替換``NOVA_PASS``。
在 [oslo_concurrency] 部分，配置鎖路徑：
[oslo_concurrency]
# ...
lock_path = /var/lib/neutron/tmp
3）配置 Modular Layer 2 (ML2) 插件
ML2插件使用Linuxbridge機制來為實例創建layer－2虛擬網絡基礎設施
編輯``/etc/neutron/plugins/ml2/ml2_conf.ini``文件並完成以下操作：
在``[ml2]``部分，啟用flat，VLAN以及VXLAN網絡：
[ml2]
# ...
type_drivers = flat,vlan,vxlan
在``[ml2]``部分，啟用VXLAN私有網絡：
[ml2]
# ...
tenant_network_types = vxlan
在``[ml2]``部分，啟用Linuxbridge和l2機制：
[ml2]
# ...
mechanism_drivers = linuxbridge,l2population
注解：Linuxbridge代理只支持VXLAN覆蓋網絡。
在``[ml2]`` 部分，啟用端口安全擴展驅動：
[ml2]
# ...
extension_drivers = port_security
在``[ml2_type_flat]``部分，配置公共虛擬網絡為flat網絡：
[ml2_type_flat]
# ...
flat_networks = provider
在``[ml2_type_vxlan]``部分，為私有網絡配置VXLAN網絡識別的網絡范圍：
[ml2_type_vxlan]
# ...
vni_ranges = 1:1000
在 ``[securitygroup]``部分，啟用 ipset 增加安全組的方便性：
[securitygroup]
# ...
enable_ipset = true
4）配置Linuxbridge代理
Linuxbridge代理為實例建立layer－2虛擬網絡並且處理安全組規則。
編輯``/etc/neutron/plugins/ml2/linuxbridge_agent.ini``文件並且完成以下操作：
在``[linux_bridge]``部分，將公共虛擬網絡和公共物理網絡接口對應起來：
[linux_bridge]
physical_interface_mappings = provider:virbr0
可使用ifconfig -a來查看PUBLIC_INTERFACE_NAME信息，將``PUBLIC_INTERFACE_NAME`` 替換為底層的物理公共網絡接口。請查看：ref:environment-networking for more information。
在``[vxlan]``部分，啟用VXLAN覆蓋網絡，配置覆蓋網絡的物理網絡接口的IP地址，啟用layer－2 population：
[vxlan]
enable_vxlan = true
local_ip = 192.168.164.128
l2_population = true
將``OVERLAY_INTERFACE_IP_ADDRESS`` 替換為處理覆蓋網絡的底層物理網絡接口的IP地址。這個示例架構中使用管理網絡接口與其他節點建立流量隧道。因此，將``OVERLAY_INTERFACE_IP_ADDRESS``替換為計算節點的管理網絡的IP地址。請查看：ref:environment-networking for more information。
在 ``[securitygroup]``部分，啟用安全組並配置 Linux 橋接 iptables 防火牆驅動：
[securitygroup]
# ...
enable_security_group = true
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
5）配置layer-3代理
The Layer-3 (L3) agent provides routing and NAT services for self-service virtual networks.
編輯``/etc/neutron/l3_agent.ini``文件並完成以下操作：
在``[DEFAULT]``部分，配置Linuxbridge接口驅動和外部網絡網橋：
[DEFAULT]
# ...
interface_driver = linuxbridge
6）配置DHCP代理¶
The DHCP agent provides DHCP services for virtual networks.
編輯``/etc/neutron/dhcp_agent.ini``文件並完成下面的操作：
在``[DEFAULT]``部分，配置Linuxbridge驅動接口，DHCP驅動並啟用隔離元數據，這樣在公共網絡上的實例就可以通過網絡來訪問元數據
[DEFAULT]
# ...
interface_driver = linuxbridge
dhcp_driver = neutron.agent.linux.dhcp.Dnsmasq
enable_isolated_metadata = true
6.配置元數據代理
元數據代理提供配置信息，例如實例的憑證。
編輯``/etc/neutron/metadata_agent.ini``文件並完成以下操作：
在``[DEFAULT]`` 部分，配置元數據主機以及共享密碼：
[DEFAULT]
# ...
nova_metadata_ip = likeadmin
metadata_proxy_shared_secret = djl18001
用你為元數據代理設置的密碼替換 METADATA_SECRET。
7.配置計算服務來使用網絡服務
編輯``/etc/nova/nova.conf``文件並完成以下操作：
在``[neutron]``部分，配置訪問參數，啟用元數據代理並設置密碼：
[neutron]
# ...
url = http://likeadmin:9696
auth_url = http://likeadmin:35357
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = neutron
password = djl18001
service_metadata_proxy = true
metadata_proxy_shared_secret = djl18001
將 NEUTRON_PASS 替換為你在認證服務中為 neutron 用戶選擇的密碼。
使用你為元數據代理設置的密碼替換``METADATA_SECRET``
8.完成安裝
網絡服務初始化腳本需要一個超鏈接 /etc/neutron/plugin.ini``指向ML2插件配置文件/etc/neutron/plugins/ml2/ml2_conf.ini``。如果超鏈接不存在，使用下面的命令創建它：
# ln -s /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugin.ini
同步數據庫：
[root@likeadmin ~]# su -s /bin/sh -c "neutron-db-manage --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade head" neutron
INFO [alembic.runtime.migration] Context impl MySQLImpl.
INFO [alembic.runtime.migration] Will assume non-transactional DDL.
Running upgrade for neutron ...
INFO [alembic.runtime.migration] Context impl MySQLImpl.
INFO [alembic.runtime.migration] Will assume non-transactional DDL.
INFO [alembic.runtime.migration] Running upgrade -> kilo, kilo_initial
INFO [alembic.runtime.migration] Running upgrade kilo -> 354db87e3225, nsxv_vdr_metadata.py
INFO [alembic.runtime.migration] Running upgrade 354db87e3225 -> 599c6a226151, neutrodb_ipam
INFO [alembic.runtime.migration] Running upgrade 599c6a226151 -> 52c5312f6baf, Initial operations in support of address scopes
INFO [alembic.runtime.migration] Running upgrade 52c5312f6baf -> 313373c0ffee, Flavor framework
INFO [alembic.runtime.migration] Running upgrade 313373c0ffee -> 8675309a5c4f, network_rbac
INFO [alembic.runtime.migration] Running upgrade 8675309a5c4f -> 45f955889773, quota_usage
INFO [alembic.runtime.migration] Running upgrade 45f955889773 -> 26c371498592, subnetpool hash
INFO [alembic.runtime.migration] Running upgrade 26c371498592 -> 1c844d1677f7, add order to dnsnameservers
INFO [alembic.runtime.migration] Running upgrade 1c844d1677f7 -> 1b4c6e320f79, address scope support in subnetpool
INFO [alembic.runtime.migration] Running upgrade 1b4c6e320f79 -> 48153cb5f051, qos db changes
INFO [alembic.runtime.migration] Running upgrade 48153cb5f051 -> 9859ac9c136, quota_reservations
INFO [alembic.runtime.migration] Running upgrade 9859ac9c136 -> 34af2b5c5a59, Add dns_name to Port
INFO [alembic.runtime.migration] Running upgrade 34af2b5c5a59 -> 59cb5b6cf4d, Add availability zone
INFO [alembic.runtime.migration] Running upgrade 59cb5b6cf4d -> 13cfb89f881a, add is_default to subnetpool
INFO [alembic.runtime.migration] Running upgrade 13cfb89f881a -> 32e5974ada25, Add standard attribute table
INFO [alembic.runtime.migration] Running upgrade 32e5974ada25 -> ec7fcfbf72ee, Add network availability zone
INFO [alembic.runtime.migration] Running upgrade ec7fcfbf72ee -> dce3ec7a25c9, Add router availability zone
INFO [alembic.runtime.migration] Running upgrade dce3ec7a25c9 -> c3a73f615e4, Add ip_version to AddressScope
INFO [alembic.runtime.migration] Running upgrade c3a73f615e4 -> 659bf3d90664, Add tables and attributes to support external DNS integration
INFO [alembic.runtime.migration] Running upgrade 659bf3d90664 -> 1df244e556f5, add_unique_ha_router_agent_port_bindings
INFO [alembic.runtime.migration] Running upgrade 1df244e556f5 -> 19f26505c74f, Auto Allocated Topology - aka Get-Me-A-Network
INFO [alembic.runtime.migration] Running upgrade 19f26505c74f -> 15be73214821, add dynamic routing model data
INFO [alembic.runtime.migration] Running upgrade 15be73214821 -> b4caf27aae4, add_bgp_dragent_model_data
INFO [alembic.runtime.migration] Running upgrade b4caf27aae4 -> 15e43b934f81, rbac_qos_policy
INFO [alembic.runtime.migration] Running upgrade 15e43b934f81 -> 31ed664953e6, Add resource_versions row to agent table
INFO [alembic.runtime.migration] Running upgrade 31ed664953e6 -> 2f9e956e7532, tag support
INFO [alembic.runtime.migration] Running upgrade 2f9e956e7532 -> 3894bccad37f, add_timestamp_to_base_resources
INFO [alembic.runtime.migration] Running upgrade 3894bccad37f -> 0e66c5227a8a, Add desc to standard attr table
INFO [alembic.runtime.migration] Running upgrade 0e66c5227a8a -> 45f8dd33480b, qos dscp db addition
INFO [alembic.runtime.migration] Running upgrade 45f8dd33480b -> 5abc0278ca73, Add support for VLAN trunking
INFO [alembic.runtime.migration] Running upgrade 5abc0278ca73 -> d3435b514502, Add device_id index to Port
INFO [alembic.runtime.migration] Running upgrade d3435b514502 -> 30107ab6a3ee, provisioning_blocks.py
INFO [alembic.runtime.migration] Running upgrade 30107ab6a3ee -> c415aab1c048, add revisions table
INFO [alembic.runtime.migration] Running upgrade c415aab1c048 -> a963b38d82f4, add dns name to portdnses
INFO [alembic.runtime.migration] Running upgrade a963b38d82f4 -> 3d0e74aa7d37, Add flavor_id to Router
INFO [alembic.runtime.migration] Running upgrade 3d0e74aa7d37 -> 030a959ceafa, uniq_routerports0port_id
INFO [alembic.runtime.migration] Running upgrade 030a959ceafa -> a5648cfeeadf, Add support for Subnet Service Types
INFO [alembic.runtime.migration] Running upgrade a5648cfeeadf -> 0f5bef0f87d4, add_qos_minimum_bandwidth_rules
INFO [alembic.runtime.migration] Running upgrade 0f5bef0f87d4 -> 67daae611b6e, add standardattr to qos policies
INFO [alembic.runtime.migration] Running upgrade kilo -> 30018084ec99, Initial no-op Liberty contract rule.
INFO [alembic.runtime.migration] Running upgrade 30018084ec99 -> 4ffceebfada, network_rbac
INFO [alembic.runtime.migration] Running upgrade 4ffceebfada -> 5498d17be016, Drop legacy OVS and LB plugin tables
INFO [alembic.runtime.migration] Running upgrade 5498d17be016 -> 2a16083502f3, Metaplugin removal
INFO [alembic.runtime.migration] Running upgrade 2a16083502f3 -> 2e5352a0ad4d, Add missing foreign keys
INFO [alembic.runtime.migration] Running upgrade 2e5352a0ad4d -> 11926bcfe72d, add geneve ml2 type driver
INFO [alembic.runtime.migration] Running upgrade 11926bcfe72d -> 4af11ca47297, Drop cisco monolithic tables
INFO [alembic.runtime.migration] Running upgrade 4af11ca47297 -> 1b294093239c, Drop embrane plugin table
INFO [alembic.runtime.migration] Running upgrade 1b294093239c -> 8a6d8bdae39, standardattributes migration
INFO [alembic.runtime.migration] Running upgrade 8a6d8bdae39 -> 2b4c2465d44b, DVR sheduling refactoring
INFO [alembic.runtime.migration] Running upgrade 2b4c2465d44b -> e3278ee65050, Drop NEC plugin tables
INFO [alembic.runtime.migration] Running upgrade e3278ee65050 -> c6c112992c9, rbac_qos_policy
INFO [alembic.runtime.migration] Running upgrade c6c112992c9 -> 5ffceebfada, network_rbac_external
INFO [alembic.runtime.migration] Running upgrade 5ffceebfada -> 4ffceebfcdc, standard_desc
INFO [alembic.runtime.migration] Running upgrade 4ffceebfcdc -> 7bbb25278f53, device_owner_ha_replicate_int
INFO [alembic.runtime.migration] Running upgrade 7bbb25278f53 -> 89ab9a816d70, Rename ml2_network_segments table
INFO [alembic.runtime.migration] Running upgrade 67daae611b6e -> 6b461a21bcfc, uniq_floatingips0floating_network_id0fixed_port_id0fixed_ip_addr
INFO [alembic.runtime.migration] Running upgrade 6b461a21bcfc -> 5cd92597d11d, Add ip_allocation to port
INFO [alembic.runtime.migration] Running upgrade 5cd92597d11d -> 929c968efe70, add_pk_version_table
INFO [alembic.runtime.migration] Running upgrade 929c968efe70 -> a9c43481023c, extend_pk_with_host_and_add_status_to_ml2_port_binding
INFO [alembic.runtime.migration] Running upgrade 89ab9a816d70 -> c879c5e1ee90, Add segment_id to subnet
INFO [alembic.runtime.migration] Running upgrade c879c5e1ee90 -> 8fd3918ef6f4, Add segment_host_mapping table.
INFO [alembic.runtime.migration] Running upgrade 8fd3918ef6f4 -> 4bcd4df1f426, Rename ml2_dvr_port_bindings
INFO [alembic.runtime.migration] Running upgrade 4bcd4df1f426 -> b67e765a3524, Remove mtu column from networks.
INFO [alembic.runtime.migration] Running upgrade b67e765a3524 -> a84ccf28f06a, migrate dns name from port
INFO [alembic.runtime.migration] Running upgrade a84ccf28f06a -> 7d9d8eeec6ad, rename tenant to project
INFO [alembic.runtime.migration] Running upgrade 7d9d8eeec6ad -> a8b517cff8ab, Add routerport bindings for L3 HA
INFO [alembic.runtime.migration] Running upgrade a8b517cff8ab -> 3b935b28e7a0, migrate to pluggable ipam
INFO [alembic.runtime.migration] Running upgrade 3b935b28e7a0 -> b12a3ef66e62, add standardattr to qos policies
INFO [alembic.runtime.migration] Running upgrade b12a3ef66e62 -> 97c25b0d2353, Add Name and Description to the networksegments table
INFO [alembic.runtime.migration] Running upgrade 97c25b0d2353 -> 2e0d7a8a1586, Add binding index to RouterL3AgentBinding
INFO [alembic.runtime.migration] Running upgrade 2e0d7a8a1586 -> 5c85685d616d, Remove availability ranges.
OK
[root@likeadmin ~]#
注解:數據庫的同步發生在 Networking 之后，因為腳本需要完成服務器和插件的配置文件。
如果您收到以下Python異常，無法從字符串解析rfc1738 URL，請將連接選項從[default]部分移動到[database]部分。 然后，從neutron.conf文件中的值中刪除單引號。
9.重啟計算API 服務：
# systemctl restart openstack-nova-api.service
當系統啟動時，啟動 Networking 服務並配置它啟動。
對於兩種網絡選項：
# systemctl enable neutron-server.service \
neutron-linuxbridge-agent.service neutron-dhcp-agent.service \
neutron-metadata-agent.service
# systemctl start neutron-server.service \
neutron-linuxbridge-agent.service neutron-dhcp-agent.service \
neutron-metadata-agent.service
對於網絡選項2，同樣啟用layer－3服務並設置其隨系統自啟動
# systemctl enable neutron-l3-agent.service
# systemctl start neutron-l3-agent.service
10.安裝和配置計算節點
以下配置在計算節點上進行
計算節點處理實例的連接和 security groups 。
1.安裝組件
# yum install openstack-neutron-linuxbridge ebtables ipset
2.配置通用組件
Networking 通用組件的配置包括認證機制、消息隊列和插件。
注解：默認配置文件在各發行版本中可能不同。你可能需要添加這些部分，選項而不是修改已經存在的部分和選項。另外，在配置片段中的省略號(...)表示默認的配置選項你應該保留。
編輯``/etc/neutron/neutron.conf`` 文件並完成如下操作：
在``[database]`` 部分，注釋所有``connection`` 項，因為計算節點不直接訪問數據庫。
在``[DEFAULT]``部分，配置``RabbitMQ``消息隊列訪問權限：
[DEFAULT]
# ...
transport_url = rabbit://openstack:djl18001@likeadmin
用你在RabbitMQ中為``openstack``選擇的密碼替換 “RABBIT_PASS”。
在 “[DEFAULT]” 和 “[keystone_authtoken]” 部分，配置認證服務訪問：
[DEFAULT]
# ...
auth_strategy = keystone
[keystone_authtoken]
# ...
auth_uri = http://likeadmin:5000
auth_url = http://likeadmin:35357
memcached_servers = likeadmin:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = neutron
password = djl18001
將 NEUTRON_PASS 替換為你在認證服務中為 neutron 用戶選擇的密碼。
注解：在 [keystone_authtoken] 中注釋或者刪除其他選項。
在 [oslo_concurrency] 部分，配置鎖路徑：
[oslo_concurrency]
# ...
lock_path = /var/lib/neutron/tmp
3.配置網絡選項
選擇與您之前在控制節點上選擇的相同的網絡選項。之后，回到這里並進行下一步：配置計算服務來使用網絡服務。
在 compute 節點上配置網絡組件。
配置Linuxbridge代理
Linuxbridge代理為實例建立layer－2虛擬網絡並且處理安全組規則。
編輯``/etc/neutron/plugins/ml2/linuxbridge_agent.ini``文件並且完成以下操作：
在``[linux_bridge]``部分，將公共虛擬網絡和公共物理網絡接口對應起來：
[linux_bridge]
physical_interface_mappings = provider:virbr0
將``PUBLIC_INTERFACE_NAME`` 替換為底層的物理公共網絡接口。請查看：ref:environment-networking for more information。
在``[vxlan]``部分，啟用VXLAN覆蓋網絡，配置覆蓋網絡的物理網絡接口的IP地址，啟用layer－2 population：
[vxlan]
enable_vxlan = true
local_ip = 192.168.164.129
l2_population = true
將``OVERLAY_INTERFACE_IP_ADDRESS`` 替換為處理覆蓋網絡的底層物理網絡接口的IP地址。這個示例架構中使用管理網絡接口與其他節點建立流量隧道。因此，將``OVERLAY_INTERFACE_IP_ADDRESS``替換為計算節點的管理網絡的IP地址。請查看：ref:environment-networking for more information。
在 ``[securitygroup]``部分，啟用安全組並配置 Linux 橋接 iptables 防火牆驅動：
[securitygroup]
# ...
enable_security_group = true
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
4.配置計算服務來使用網絡服務¶
編輯``/etc/nova/nova.conf``文件並完成下面的操作：
在``[neutron]`` 部分，配置訪問參數：
[neutron]
# ...
url = http://likeadmin:9696
auth_url = http://likeadmin:35357
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = neutron
password = djl18001
將 NEUTRON_PASS 替換為你在認證服務中為 neutron 用戶選擇的密碼。
5.完成安裝
重啟計算服務：
# systemctl restart openstack-nova-compute.service
啟動Linuxbridge代理並配置它開機自啟動：
# systemctl enable neutron-linuxbridge-agent.service
# systemctl start neutron-linuxbridge-agent.service
6.驗證操作
在控制節點上執行這些命令。
獲得 admin 憑證來獲取只有管理員能執行的命令的訪問權限：
[root@likeadmin network-scripts]# source /root/.admin-openrc
列出加載的擴展來驗證``neutron-server``進程是否正常啟動：
[root@likeadmin network-scripts]# openstack extension list --network
+-------------------------------------------------------------+---------------------------+---------------------------------------------------------------+
| Name | Alias | Description |
+-------------------------------------------------------------+---------------------------+---------------------------------------------------------------+
| Default Subnetpools | default-subnetpools | Provides ability to mark and use a subnetpool as the default |
| Network IP Availability | network-ip-availability | Provides IP availability data for each network and subnet. |
| Network Availability Zone | network_availability_zone | Availability zone support for network. |
| Auto Allocated Topology Services | auto-allocated-topology | Auto Allocated Topology Services. |
| Neutron L3 Configurable external gateway mode | ext-gw-mode | Extension of the router abstraction for specifying whether |
| | | SNAT should occur on the external gateway |
| Port Binding | binding | Expose port bindings of a virtual port to external |
| | | application |
| agent | agent | The agent management extension. |
| Subnet Allocation | subnet_allocation | Enables allocation of subnets from a subnet pool |
| L3 Agent Scheduler | l3_agent_scheduler | Schedule routers among l3 agents |
| Tag support | tag | Enables to set tag on resources. |
| Neutron external network | external-net | Adds external network attribute to network resource. |
| Neutron Service Flavors | flavors | Flavor specification for Neutron advanced services |
| Network MTU | net-mtu | Provides MTU attribute for a network resource. |
| Availability Zone | availability_zone | The availability zone extension. |
| Quota management support | quotas | Expose functions for quotas management per tenant |
| HA Router extension | l3-ha | Add HA capability to routers. |
| Provider Network | provider | Expose mapping of virtual networks to physical networks |
| Multi Provider Network | multi-provider | Expose mapping of virtual networks to multiple physical |
| | | networks |
| Address scope | address-scope | Address scopes extension. |
| Neutron Extra Route | extraroute | Extra routes configuration for L3 router |
| Subnet service types | subnet-service-types | Provides ability to set the subnet service_types field |
| Resource timestamps | standard-attr-timestamp | Adds created_at and updated_at fields to all Neutron |
| | | resources that have Neutron standard attributes. |
| Neutron Service Type Management | service-type | API for retrieving service providers for Neutron advanced |
| | | services |
| Router Flavor Extension | l3-flavors | Flavor support for routers. |
| Port Security | port-security | Provides port security |
| Neutron Extra DHCP opts | extra_dhcp_opt | Extra options configuration for DHCP. For example PXE boot |
| | | options to DHCP clients can be specified (e.g. tftp-server, |
| | | server-ip-address, bootfile-name) |
| Resource revision numbers | standard-attr-revisions | This extension will display the revision number of neutron |
| | | resources. |
| Pagination support | pagination | Extension that indicates that pagination is enabled. |
| Sorting support | sorting | Extension that indicates that sorting is enabled. |
| security-group | security-group | The security groups extension. |
| DHCP Agent Scheduler | dhcp_agent_scheduler | Schedule networks among dhcp agents |
| Router Availability Zone | router_availability_zone | Availability zone support for router. |
| RBAC Policies | rbac-policies | Allows creation and modification of policies that control |
| | | tenant access to resources. |
| Tag support for resources: subnet, subnetpool, port, router | tag-ext | Extends tag support to more L2 and L3 resources. |
| standard-attr-description | standard-attr-description | Extension to add descriptions to standard attributes |
| Neutron L3 Router | router | Router abstraction for basic L3 forwarding between L2 Neutron |
| | | networks and access to external networks via a NAT gateway. |
| Allowed Address Pairs | allowed-address-pairs | Provides allowed address pairs |
| project_id field enabled | project-id | Extension that indicates that project_id field is enabled. |
| Distributed Virtual Router | dvr | Enables configuration of Distributed Virtual Routers. |
+-------------------------------------------------------------+---------------------------+---------------------------------------------------------------+
[root@likeadmin network-scripts]#
網絡選項2：自服務網絡
列出代理以驗證啟動 neutron 代理是否成功：
[root@likeadmin network-scripts]# openstack network agent list
+--------------------------------------+--------------------+-----------+-------------------+-------+-------+---------------------------+
| ID | Agent Type | Host | Availability Zone | Alive | State | Binary |
+--------------------------------------+--------------------+-----------+-------------------+-------+-------+---------------------------+
| 1c78a82e-155b-4aa0-b3ad-b6a753afc452 | DHCP agent | likeadmin | nova | True | UP | neutron-dhcp-agent |
| 47f93a7f-4db8-4a9d-a8a5-d9f3e6a5b5df | Linux bridge agent | likeadmin | None | True | UP | neutron-linuxbridge-agent |
| c3efa976-6d23-4198-8387-f8303cbd4b93 | Linux bridge agent | likenode | None | True | UP | neutron-linuxbridge-agent |
| e324fef9-0386-4b2f-ad9f-b02b2dfae712 | L3 agent | likeadmin | nova | True | UP | neutron-l3-agent |
| fdb14d79-2bb1-4e43-a95b-82569de6a5f8 | Metadata agent | likeadmin | None | True | UP | neutron-metadata-agent |
+--------------------------------------+--------------------+-----------+-------------------+-------+-------+---------------------------+
[root@likeadmin network-scripts]#
注：至此網絡服務已基本配置完成，此環境選用的是自網絡服務。