오픈스택 클라우드 서버 구축(Stein)(6)-네트워크 서비스(Neutron) 설치 및 설정

#Controller Node 설정

1) Neutron 서비스 사용자 및 역할 추가

[root@Controller ~(keystone)]# openstack user create --domain default --project service --password servicepassword neutron
+---------------------+----------------------------------+
| Field               | Value                            |
+---------------------+----------------------------------+
| default_project_id  | c5e87c9b460e4f16801b4102019c97e6 |
| domain_id           | default                          |
| enabled             | True                             |
| id                  | a551613a5e7c4108bda2e12668c99353 |
| name                | neutron                          |
| options             | {}                               |
| password_expires_at | None                             |
+---------------------+----------------------------------+

# add neutron user in admin role
[root@Controller ~(keystone)]# openstack role add --project service --user neutron admin
# add service entry for neutron
[root@Controller ~(keystone)]# openstack service create --name neutron --description "OpenStack Networking service" network
+-------------+----------------------------------+
| Field       | Value                            |
+-------------+----------------------------------+
| description | OpenStack Networking service     |
| enabled     | True                             |
| id          | 5ebe270343b54616a6f874070d61d53c |
| name        | neutron                          |
| type        | network                          |
+-------------+----------------------------------+

# define keystone host
[root@Controller ~(keystone)]# export controller=10.0.0.30
# add endpoint for neutron (public)
[root@Controller ~(keystone)]# openstack endpoint create --region RegionOne network public http://$controller:9696
+--------------+----------------------------------+
| Field        | Value                            |
+--------------+----------------------------------+
| enabled      | True                             |
| id           | 350abb038a884de2b6bd452e6470210b |
| interface    | public                           |
| region       | RegionOne                        |
| region_id    | RegionOne                        |
| service_id   | 5ebe270343b54616a6f874070d61d53c |
| service_name | neutron                          |
| service_type | network                          |
| url          | http://10.0.0.30:9696            |
+--------------+----------------------------------+

# add endpoint for neutron (internal)
[root@Controller ~(keystone)]# openstack endpoint create --region RegionOne network internal http://$controller:9696
+--------------+----------------------------------+
| Field        | Value                            |
+--------------+----------------------------------+
| enabled      | True                             |
| id           | 8702934448854a129474e56ab244c970 |
| interface    | internal                         |
| region       | RegionOne                        |
| region_id    | RegionOne                        |
| service_id   | 5ebe270343b54616a6f874070d61d53c |
| service_name | neutron                          |
| service_type | network                          |
| url          | http://10.0.0.30:9696            |
+--------------+----------------------------------+

# add endpoint for neutron (admin)
[root@Controller ~(keystone)]# openstack endpoint create --region RegionOne network admin http://$controller:9696
+--------------+----------------------------------+
| Field        | Value                            |
+--------------+----------------------------------+
| enabled      | True                             |
| id           | bc7b7fce2ca64de393aee3ad91bffe14 |
| interface    | admin                            |
| region       | RegionOne                        |
| region_id    | RegionOne                        |
| service_id   | 5ebe270343b54616a6f874070d61d53c |
| service_name | neutron                          |
| service_type | network                          |
| url          | http://10.0.0.30:9696            |
+--------------+----------------------------------+

2) Neutron DB 생성

[root@Controller ~(keystone)]# mysql -u root -p
Enter password:
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 56
Server version: 10.3.10-MariaDB MariaDB Server

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]> create database neutron_ml2;
Query OK, 1 row affected (0.00 sec)

MariaDB [(none)]> grant all privileges on neutron_ml2.* to neutron@'localhost' identified by 'password';
Query OK, 0 rows affected (0.00 sec)

MariaDB [(none)]> grant all privileges on neutron_ml2.* to neutron@'%' identified by 'password';
Query OK, 0 rows affected (0.00 sec)

MariaDB [(none)]> flush privileges;
Query OK, 0 rows affected (0.00 sec)

MariaDB [(none)]> exit
Bye

3) Neutron 서버 설치 

[root@Controller ~(keystone)]# yum --enablerepo=centos-openstack-stein,epel -y install openstack-neutron openstack-neutron-ml2

4) Neutron 서버 설정

[root@Controller ~(keystone)]# mv /etc/neutron/neutron.conf /etc/neutron/neutron.conf.org
[root@Controller ~(keystone)]# vi /etc/neutron/neutron.conf
[DEFAULT]
core_plugin = ml2
service_plugins = router
auth_strategy = keystone
state_path = /var/lib/neutron
dhcp_agent_notification = True
allow_overlapping_ips = True
notify_nova_on_port_status_changes = True
notify_nova_on_port_data_changes = True
# RabbitMQ connection info
transport_url = rabbit://openstack:password@10.0.0.30

# Keystone auth info
[keystone_authtoken]
www_authenticate_uri = http://10.0.0.30:5000
auth_url = http://10.0.0.30:5000
memcached_servers = 10.0.0.30:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = neutron
password = servicepassword

# MariaDB connection info
[database]
connection = mysql+pymysql://neutron:password@10.0.0.30/neutron_ml2

# Nova connection info
[nova]
auth_url = http://10.0.0.30:5000
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = nova
password = servicepassword

[oslo_concurrency]
lock_path = $state_path/tmp

[root@Controller ~(keystone)]# chmod 640 /etc/neutron/neutron.conf
[root@Controller ~(keystone)]# chgrp neutron /etc/neutron/neutron.conf
[root@Controller ~(keystone)]# vi /etc/neutron/metadata_agent.ini
[DEFAULT]
# 2번째 줄 추가
nova_metadata_host = 10.0.0.30
metadata_proxy_shared_secret = metadata_secret

 

# 214번째 줄 수정
memcache_servers = 10.0.0.30:11211

[root@Controller ~(keystone)]# vi /etc/neutron/plugins/ml2/ml2_conf.ini
#마지막 줄에 추가
[ml2]
type_drivers = flat,vlan,gre,vxlan
tenant_network_types =
mechanism_drivers = openvswitch
extension_drivers = port_security

[root@Controller ~(keystone)]# vi /etc/nova/nova.conf
#2번째 줄에 추가
use_neutron = True
linuxnet_interface_driver = nova.network.linux_net.LinuxOVSInterfaceDriver
firewall_driver = nova.virt.firewall.NoopFirewallDriver

#마지막 줄에 추가
[neutron]
auth_url = http://10.0.0.30:5000
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = neutron
password = servicepassword
service_metadata_proxy = True
metadata_proxy_shared_secret = metadata_secret

5) Selinux 추가 및 방화벽 설정

[root@Controller ~(keystone)]# yum --enablerepo=centos-openstack-stein -y install openstack-selinux
[root@Controller ~(keystone)]# setsebool -P neutron_can_network on
[root@Controller ~(keystone)]# setsebool -P daemons_enable_cluster_mode on

[root@Controller ~(keystone)]# firewall-cmd --add-port=9696/tcp --permanent
success
[root@Controller ~(keystone)]# firewall-cmd --reload
success

6) Neutron server 실행

[root@Controller ~(keystone)]# ln -s /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugin.ini
[root@Controller ~(keystone)]# su -s /bin/bash neutron -c "neutron-db-manage --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugin.ini upgrade head"

[root@Controller ~(keystone)]# systemctl start neutron-server neutron-metadata-agent
[root@Controller ~(keystone)]# systemctl enable neutron-server neutron-metadata-agent
[root@Controller ~(keystone)]# systemctl restart openstack-nova-api

 

 

 

#Network Node 설정

1) Install Neutron services.

[root@network ~]# yum --enablerepo=centos-openstack-stein,epel -y install openstack-neutron openstack-neutron-ml2 openstack-neutron-openvswitch libibverbs

2) Neutron 설정

root@network ~]# mv /etc/neutron/neutron.conf /etc/neutron/neutron.conf.org
[root@network ~]# vi /etc/neutron/neutron.conf
[DEFAULT]
core_plugin = ml2
service_plugins = router
auth_strategy = keystone
state_path = /var/lib/neutron
allow_overlapping_ips = True
# RabbitMQ connection info
transport_url = rabbit://openstack:password@10.0.0.30

# Keystone auth info
[keystone_authtoken]
www_authenticate_uri = http://10.0.0.30:5000
auth_url = http://10.0.0.30:5000
memcached_servers = 10.0.0.30:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = neutron
password = servicepassword

[oslo_concurrency]
lock_path = $state_path/lock

[root@network ~]# chmod 640 /etc/neutron/neutron.conf
[root@network ~]# chgrp neutron /etc/neutron/neutron.conf

[root@network ~]# vi /etc/neutron/l3_agent.ini
[DEFAULT]
# 2번째 줄 추가
interface_driver = openvswitch

 

[root@network ~]# vi /etc/neutron/dhcp_agent.ini
[DEFAULT]
# 2번째 줄 추가
interface_driver = openvswitch
dhcp_driver = neutron.agent.linux.dhcp.Dnsmasq
enable_isolated_metadata = true

[root@network ~]# vi /etc/neutron/metadata_agent.ini
[DEFAULT]
#2번째 줄 추가
nova_metadata_host = 10.0.0.30
metadata_proxy_shared_secret = metadata_secret

# 213번째 줄 수정
memcache_servers = 10.0.0.30:11211

[root@network ~]# vi /etc/neutron/plugins/ml2/ml2_conf.ini
# 마지막 줄 추가
[ml2]
type_drivers = flat,vlan,gre,vxlan
tenant_network_types =
mechanism_drivers = openvswitch
extension_drivers = port_security

[root@network ~]# vi /etc/neutron/plugins/ml2/openvswitch_agent.ini
# 마지막 줄 추가
[securitygroup]
firewall_driver = openvswitch
enable_security_group = true
enable_ipset = true

3) SELinux 설정 및 Pollcy 추가

[root@network ~]# yum --enablerepo=centos-openstack-stein -y install openstack-selinux
[root@network ~]# setsebool -P neutron_can_network on
[root@network ~]# setsebool -P haproxy_connect_any on
[root@network ~]# setsebool -P daemons_enable_cluster_mode on
[root@network ~]# vi my-ovsofctl.te
module my-ovsofctl 1.0;

require {
        type neutron_t;
        class capability sys_rawio;
}

#============= neutron_t ==============
allow neutron_t self:capability sys_rawio;

[root@network ~]# checkmodule -m -M -o my-ovsofctl.mod my-ovsofctl.te
checkmodule: loading policy configuration from my-ovsofctl.te
checkmodule: policy configuration loaded
checkmodule: writing binary representation (version 17) to my-ovsofctl.mod
[root@network ~]# semodule_package --outfile my-ovsofctl.pp --module my-ovsofctl.mod
[root@network ~]# semodule -i my-ovsofctl.pp

4) Neutron 서비스 시작

[root@network ~]# ln -s /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugin.ini
[root@network ~]# systemctl start openvswitch
[root@network ~]# systemctl enable openvswitch
[root@network ~]# ovs-vsctl add-br br-int
[root@network ~]# for service in dhcp-agent l3-agent metadata-agent openvswitch-agent; do
systemctl start neutron-$service
systemctl enable neutron-$service
done

 

 

 

#Compute Node 설정

1) Install Neutron services on Compute Node.

[root@computer ~]# yum --enablerepo=centos-openstack-stein,epel -y install openstack-neutron openstack-neutron-ml2 openstack-neutron-openvswitch

2) Configure as a Compute node.

[root@computer ~]# mv /etc/neutron/neutron.conf /etc/neutron/neutron.conf.org
[root@computer ~]# vi /etc/neutron/neutron.conf
# create new
[DEFAULT]
core_plugin = ml2
service_plugins = router
auth_strategy = keystone
state_path = /var/lib/neutron
allow_overlapping_ips = True
# RabbitMQ connection info
transport_url = rabbit://openstack:password@10.0.0.30

# Keystone auth info
[keystone_authtoken]
www_authenticate_uri = http://10.0.0.30:5000
auth_url = http://10.0.0.30:5000
memcached_servers = 10.0.0.30:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = neutron
password = servicepassword

[oslo_concurrency]
lock_path = $state_path/lock

[root@computer ~]# chmod 640 /etc/neutron/neutron.conf
[root@computer ~]# chgrp neutron /etc/neutron/neutron.conf
[root@computer ~]# vi /etc/neutron/plugins/ml2/ml2_conf.ini
# 마지막 줄에 추가
[ml2]
type_drivers = flat,vlan,gre,vxlan
tenant_network_types =
mechanism_drivers = openvswitch
extension_drivers = port_security

[root@computer ~]# vi /etc/neutron/plugins/ml2/openvswitch_agent.ini
# 마지막 줄에 추가
[securitygroup]
firewall_driver = openvswitch
enable_security_group = true
enable_ipset = true

[root@computer ~]# vi /etc/nova/nova.conf
# 2번째 줄에 추가
use_neutron = True
linuxnet_interface_driver = nova.network.linux_net.LinuxOVSInterfaceDriver
firewall_driver = nova.virt.firewall.NoopFirewallDriver
vif_plugging_is_fatal = True
vif_plugging_timeout = 300

# 마지막 줄에 추가
[neutron]
auth_url = http://10.0.0.30:5000
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = neutron
password = servicepassword
service_metadata_proxy = True
metadata_proxy_shared_secret = metadata_secret

3) SELinux 등록 및 pollcy 생성

root@computer ~]# yum --enablerepo=centos-openstack-stein -y install openstack-selinux
[root@computer ~]# setsebool -P neutron_can_network on
[root@computer ~]# setsebool -P daemons_enable_cluster_mode on
[root@computer ~]# vi my-ovsofctl.te
module my-ovsofctl 1.0;

require {
        type neutron_t;
        class capability sys_rawio;
}

#============= neutron_t ==============
allow neutron_t self:capability sys_rawio;

[root@computer ~]# checkmodule -m -M -o my-ovsofctl.mod my-ovsofctl.te
checkmodule: loading policy configuration from my-ovsofctl.te
checkmodule: policy configuration loaded
checkmodule: writing binary representation (version 17) to my-ovsofctl.mod
[root@computer ~]# semodule_package --outfile my-ovsofctl.pp --module my-ovsofctl.mod
[root@computer ~]# semodule -i my-ovsofctl.pp

4) Neutron 서비스 시작

[root@computer ~]# ln -s /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugin.ini
[root@computer ~]# systemctl start openvswitch
[root@computer ~]# systemctl enable openvswitch
[root@computer ~]# ovs-vsctl add-br br-int
[root@computer ~]# systemctl restart openstack-nova-compute
[root@computer ~]# systemctl start neutron-openvswitch-agent
[root@computer ~]# systemctl enable neutron-openvswitch-agent