1、網路服務介紹

　　OpenStack Networking（neutron），允許建立、插入介面裝置，這些裝置由其他的OpenStack服務管理。外掛式的實現可以容納不同的網路裝置和軟體，為OpenStack架構與部署提供了靈活性。
它包含下列元件：
neutron-server
　　接收和路由API請求到合適的OpenStack網路外掛，以達到預想的目的。
OpenStack網路外掛和代理
　　Plug and unplug ports, create networks or subnets, and provide IP addressing. These plug-ins and agents differ depending on the vendor and technologies used in the particular cloud. OpenStack Networking ships with plug-ins and agents for Cisco virtual and physical switches, NEC OpenFlow products, Open vSwitch, Linux bridging, and the VMware NSX product.
　　常見的代理L3(3層)，DHCP(動態主機IP地址)，以及外掛代理。
訊息佇列
　　大多數的OpenStack Networking安裝都會用到，用於在neutron-server和各種各樣的代理程序間路由資訊。也為某些特定的外掛扮演資料庫的角色，以儲存網路狀態
OpenStack網路主要和OpenStack計算互動，以提供網路連線到它的例項。

　　網路服務提供網路，子網以及路由這些物件的抽象概念。每個抽象概念都有自己的功能，可以模擬對應的物理裝置：網路包括子網，路由在不同的子網和網路間進行路由轉發。

　　對於任意一個給定的網路都必須包含至少一個外部網路。不想其他的網路那樣，外部網路不僅僅是一個定義的虛擬網路。相反，它代表了一種OpenStack安裝之外的能從物理的，外部的網路訪問的檢視。外部網路上的IP地址可供外部網路上的任意的物理裝置所訪問

　　外部網路之外，任何 Networking 設定擁有一個或多個內部網路。這些軟體定義的網路直接連線到虛擬機器。僅僅在給定網路上的虛擬機器，或那些在通過介面連線到相近路由的子網上的虛擬機器，能直接訪問連線到那個網路上的虛擬機器。

　　如果外部網路想要訪問例項或者相反例項想要訪問外部網路，那麼網路之間的路由就是必要的了。每一個路由都配有一個閘道器用於連線到外部網路，以及一個或多個連線到內部網路的介面。就像一個物理路由一樣，子網可以訪問同一個路由上其他子網中的機器，並且機器也可以訪問路由的閘道器訪問外部網路。

　　另外，你可以將外部網路的IP地址分配給內部網路的埠。不管什麼時候一旦有連線連線到子網，那個連線被稱作埠。你可以給例項的埠分配外部網路的IP地址。通過這種方式，外部網路上的實體可以訪問例項.

　　網路服務同樣支援安全組。安全組允許管理員在安全組中定義防火牆規則。一個例項可以屬於一個或多個安全組，網路為這個例項配置這些安全組中的規則，阻止或者開啟埠，埠範圍或者通訊型別。

　　每一個Networking使用的外掛都有其自有的概念。雖然對操作VNI和OpenStack環境不是至關重要的，但理解這些概念能幫助你設定Networking。所有的Networking安裝使用了一個核心外掛和一個安全組外掛(或僅是空操作安全組外掛)。另外，防火牆即服務(FWaaS)和負載均衡即服務(LBaaS)外掛是可用的。

2、環境準備

2.1 控制節點（node1）

1）建立資料庫(第一篇中已經完成)

2）安裝軟體及配置服務

yum install -y openstack-neutron openstack-neutron-ml2 openstack-neutron-linuxbridge ebtables

[[email protected] neutron]# grep -n '^[a-z]' neutron.conf
27:auth_strategy = keystone
30:core_plugin = ml2
33:service_plugins =
118:notify_nova_on_port_status_changes = true
122:notify_nova_on_port_data_changes = true
530:transport_url = rabbit://openstack:[email protected]
722:connection = mysql+pymysql://neutron:[email protected]/neutron
803:auth_uri = http://192.168.56.11:5000
804:auth_url = http://192.168.56.11:35357
805:memcached_servers = 192.168.56.11:11211
806:auth_type = password
807:project_domain_name = default
808:user_domain_name = default
809:project_name = service
810:username = neutron
811:password = neutron
1002:auth_url = http://192.168.56.11:35357
1003:auth_type = password
1004:project_domain_name = default
1005:user_domain_name = default
1006:region_name = RegionOne
1007:project_name = service
1008:username = nova
1009:password = nova
1122:lock_path = /var/lib/neutron/tmp


[[email protected]-node1 ml2]# grep -n '^[a-z]' ml2_conf.ini 
109:type_drivers = flat,vlan,gre,vxlan,geneve
114:tenant_network_types = flat,vlan,gre,vxlan,geneve
118:mechanism_drivers = linuxbridge
123:extension_drivers = port_security
159:flat_networks = public
236:enable_ipset = true

[[email protected]-node1 ml2]# grep -n '^[a-z]' linuxbridge_agent.ini
143:physical_interface_mappings = public:eth0
156:firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
161:enable_security_group = true
176:enable_vxlan = false

[[email protected]-node1 ml2]# grep -n '^[a-z]' /etc/neutron/dhcp_agent.ini
16:interface_driver = neutron.agent.linux.interface.BridgeInterfaceDriver
32:dhcp_driver = neutron.agent.linux.dhcp.Dnsmasq
41:enable_isolated_metadata = True

[[email protected]-node1 ml2]# grep -n '^[a-z]' /etc/neutron/metadata_agent.ini 
22:nova_metadata_ip = 192.168.56.11
34:metadata_proxy_shared_secret = oldboy

# 網路服務初始化指令碼需要一個超連結 /etc/neutron/plugin.ini``指向ML2外掛配置檔案/etc/neutron/plugins/ml2/ml2_conf.ini``。如果超連結不存在，使用下面的命令建立
ln -s /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugin.ini


# 同步資料庫
su -s /bin/sh -c "neutron-db-manage --config-file /etc/neutron/neutron.conf \
--config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade head" neutron

# 驗證同步結果
mysql -h 192.168.56.11 -u neutron -pneutron -e "use neutron;show tables;"

# 啟動服務
systemctl enable neutron-server.service neutron-linuxbridge-agent.service neutron-dhcp-agent.service neutron-metadata-agent.service
systemctl start neutron-server.service neutron-linuxbridge-agent.service neutron-dhcp-agent.service neutron-metadata-agent.service

 3）建立使用者、API 端點等等

openstack service create --name neutron --description "OpenStack Networking" network

openstack endpoint create --region RegionOne network public http://192.168.56.11:9696
openstack endpoint create --region RegionOne network internal http://192.168.56.11:9696
openstack endpoint create --region RegionOne network admin http://192.168.56.11:9696

4）驗證服務

[[email protected] ~]# neutron agent-list          
+-----------------------------+--------------------+-------------------------+-------------------+-------+----------------+---------------------------+
| id                          | agent_type         | host                    | availability_zone | alive | admin_state_up | binary                    |
+-----------------------------+--------------------+-------------------------+-------------------+-------+----------------+---------------------------+
| 4a845146-20c8-4976-8440-8c5 | Metadata agent     | linux-node1.example.com |                   | :-)   | True           | neutron-metadata-agent    |
| 359e9f4b6                   |                    |                         |                   |       |                |                           |
| a0304ab9-4cf6-4dff-80ae-    | Linux bridge agent | linux-node1.example.com |                   | :-)   | True           | neutron-linuxbridge-agent |
| d517ec256f9b                |                    |                         |                   |       |                |                           |
| c753850b-aede-417e-         | DHCP agent         | linux-node1.example.com | nova              | :-)   | True           | neutron-dhcp-agent        |
| 8ea0-392a91248908           |                    |                         |                   |       |                |                           |
+-----------------------------+--------------------+-------------------------+-------------------+-------+----------------+---------------------------+

2.2 計算節點（node2）

1）軟體安裝及配置

yum install -y openstack-neutron-linuxbridge ebtables ipset

[[email protected] neutron]# grep -n '^[a-z]' /etc/neutron/neutron.conf 
27:auth_strategy = keystone
530:transport_url = rabbit://openstack:[email protected]
803:auth_uri = http://192.168.56.11:5000
804:auth_url = http://192.168.56.11:35357
805:memcached_servers = 192.168.56.11:11211
806:auth_type = password
807:project_domain_name = default
808:user_domain_name = default
809:project_name = service
810:username = neutron
811:password = neutron
1116:lock_path = /var/lib/neutron/tmp
[[email protected]-node2 neutron]# grep -n '^[a-z]' /etc/neutron/plugins/ml2/linuxbridge_agent.ini   
143:physical_interface_mappings = public:eth0
156:firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
161:enable_security_group = true
176:enable_vxlan = false

systemctl restart openstack-nova-compute.service
systemctl enable neutron-linuxbridge-agent.service
systemctl start neutron-linuxbridge-agent.service

2）驗證服務配置

[[email protected] ~]# neutron agent-list 
+-----------------------------+--------------------+-------------------------+-------------------+-------+----------------+---------------------------+
| id                          | agent_type         | host                    | availability_zone | alive | admin_state_up | binary                    |
+-----------------------------+--------------------+-------------------------+-------------------+-------+----------------+---------------------------+
| 4a845146-20c8-4976-8440-8c5 | Metadata agent     | linux-node1.example.com |                   | :-)   | True           | neutron-metadata-agent    |
| 359e9f4b6                   |                    |                         |                   |       |                |                           |
| 56378775-792f-483c-         | Linux bridge agent | linux-node2.example.com |                   | :-)   | True           | neutron-linuxbridge-agent |
| ad04-bd662200d1fc           |                    |                         |                   |       |                |                           |
| a0304ab9-4cf6-4dff-80ae-    | Linux bridge agent | linux-node1.example.com |                   | :-)   | True           | neutron-linuxbridge-agent |
| d517ec256f9b                |                    |                         |                   |       |                |                           |
| c753850b-aede-417e-         | DHCP agent         | linux-node1.example.com | nova              | :-)   | True           | neutron-dhcp-agent        |
| 8ea0-392a91248908           |                    |                         |                   |       |                |                           |
+-----------------------------+--------------------+-------------------------+-------------------+-------+----------------+---------------------------+
[[email protected]-node1 ~]# nova service-list
+----+------------------+-------------------------+----------+---------+-------+----------------------------+-----------------+
| Id | Binary           | Host                    | Zone     | Status  | State | Updated_at                 | Disabled Reason |
+----+------------------+-------------------------+----------+---------+-------+----------------------------+-----------------+
| 1  | nova-scheduler   | linux-node1.example.com | internal | enabled | up    | 2017-01-13T14:31:06.000000 | -               |
| 2  | nova-conductor   | linux-node1.example.com | internal | enabled | up    | 2017-01-13T14:31:09.000000 | -               |
| 3  | nova-consoleauth | linux-node1.example.com | internal | enabled | up    | 2017-01-13T14:31:12.000000 | -               |
| 6  | nova-compute     | linux-node2.example.com | nova     | enabled | up    | 2017-01-13T14:31:13.000000 | -               |
+----+------------------+-------------------------+----------+---------+-------+----------------------------+-----------------+