OpenStack-Ocata版+CentOS7.6 云平台环境搭建 —7.网络服务Neutron配置

网络服务Neutron
本章节结束如何安装并配置网络服务（neutron）采用:ref:`provider networks <network1>`或:ref:`self-service networks <network2>`选项。

控制节点：controller：
IP：192.168.164.128
hostname&hosts：likeadmin

计算加点：Nova：

IP：192.168.164.129
hostname&hosts：likenode

块存储节点:cinder：

IP：192.168.164.136
hostname&hosts：likeblock

1.网络服务概述
OpenStack Networking（neutron），允许创建、插入接口设备，这些设备由其他的OpenStack服务管理。插件式的实现可以容纳不同的网络设备和软件，为OpenStack架构与部署提供了灵活性。

它包含下列组件：
neutron-server
接收和路由API请求到合适的OpenStack网络插件，以达到预想的目的。
OpenStack的网络插件和代理
插拔端口，创建网络或子网，并提供IP寻址。 这些插件和代理程序因特定云中使用的供应商和技术而异。 OpenStack Networking附带了用于思科虚拟和物理交换机，NEC OpenFlow产品，Open vSwitch，Linux桥接和VMware NSX产品的插件和代理。
常见的代理L3（3层），DHCP（动态主机IP地址），以及插件代理。
消息队列
大多数的OpenStack Networking安装都会用到，用于在neutron-server和各种各样的代理进程间路由信息。也为某些特定的插件扮演数据库的角色，以存储网络状态
OpenStack网络主要和OpenStack计算交互，以提供网络连接到它的实例。

2.网络（neutron）概念
OpenStack Networking（neutron）管理OpenStack环境中虚拟网络基础架构（VNI）的所有网络方面以及物理网络基础架构（PNI）的访问层方面。
OpenStack Networking使项目能够创建高级虚拟网络拓扑，其中可能包括防火墙，负载均衡器和虚拟专用网络（VPN）等服务。

网络服务提供网络，子网以及路由这些对象的抽象概念。每个抽象概念都有自己的功能，可以模拟对应的物理设备：网络包括子网，路由在不同的子网和网络间进行路由转发。

对于任意一个给定的网络都必须包含至少一个外部网络。不想其他的网络那样，外部网络不仅仅是一个定义的虚拟网络。
相反，它代表了一种OpenStack安装之外的能从物理的，外部的网络访问的视图。外部网络上的IP地址可供外部网络上的任意的物理设备所访问

外部网络之外，任何 Networking 设置拥有一个或多个内部网络。这些软件定义的网络直接连接到虚拟机。
仅仅在给定网络上的虚拟机，或那些在通过接口连接到相近路由的子网上的虚拟机，能直接访问连接到那个网络上的虚拟机。

如果外部网络想要访问实例或者相反实例想要访问外部网络，那么网络之间的路由就是必要的了。
每一个路由都配有一个网关用于连接到外部网络，以及一个或多个连接到内部网络的接口。
就像一个物理路由一样，子网可以访问同一个路由上其他子网中的机器，并且机器也可以访问路由的网关访问外部网络。

另外，你可以将外部网络的IP地址分配给内部网络的端口。不管什么时候一旦有连接连接到子网，那个连接被称作端口。
你可以给实例的端口分配外部网络的IP地址。通过这种方式，外部网络上的实体可以访问实例.

网络服务同样支持安全组。安全组允许管理员在安全组中定义防火墙规则。一个实例可以属于一个或多个安全组，网络为这个实例配置这些安全组中的规则，阻止或者开启端口，端口范围或者通信类型。

每一个Networking使用的插件都有其自有的概念。虽然对操作VNI和OpenStack环境不是至关重要的，但理解这些概念能帮助你设置Networking。
所有的Networking安装使用了一个核心插件和一个安全组插件(或仅是空操作安全组插件)。另外，防火墙即服务(FWaaS)和负载均衡即服务(LBaaS)插件是可用的。

3.安装并配置控制节点
在你配置OpenStack网络（neutron）服务之前，你必须为其创建一个数据库，服务凭证和API端点。

1）完成下面的步骤以创建数据库：
用数据库连接客户端以 root 用户连接到数据库服务器：
$ mysql -u root -p

创建``neutron`` 数据库：
MariaDB [(none)] CREATE DATABASE neutron;

对``neutron`` 数据库授予合适的访问权限，使用合适的密码替换``NEUTRON_DBPASS``：

MariaDB [(none)]> GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'localhost' \
IDENTIFIED BY 'djl18001';
MariaDB [(none)]> GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'%' \
IDENTIFIED BY 'djl18001';

2）获得 admin 凭证来获取只有管理员能执行的命令的访问权限：
[root@likeadmin ~]# source /root/.admin-openrc

3）要创建服务证书，完成这些步骤：
创建``neutron``用户：
[root@likeadmin ~]# openstack user create --domain default --password-prompt neutron
User Password: djl18001
Repeat User Password:
+---------------------+----------------------------------+
| Field | Value |
+---------------------+----------------------------------+
| domain_id | default |
| enabled | True |
| id | cda6dd27199642a3bfe3417e53803b8d |
| name | neutron |
| options | {} |
| password_expires_at | None |
+---------------------+----------------------------------+
[root@likeadmin ~]#

添加``admin`` 角色到``neutron`` 用户：
[root@likeadmin ~]# openstack role add --project service --user neutron admin

创建``neutron``服务实体：
[root@likeadmin ~]# openstack service create --name neutron \
> --description "OpenStack Networking" network
+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | OpenStack Networking |
| enabled | True |
| id | b04fe56b6799405183418994a951df4a |
| name | neutron |
| type | network |
+-------------+----------------------------------+
[root@likeadmin ~]#

4.创建网络服务API端点：
[root@likeadmin ~]# openstack endpoint create --region RegionOne \
> network public http://likeadmin:9696
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | b6b9526e4d514c0cb939f86021d23b89 |
| interface | public |
| region | RegionOne |
| region_id | RegionOne |
| service_id | b04fe56b6799405183418994a951df4a |
| service_name | neutron |
| service_type | network |
| url | http://likeadmin:9696 |
+--------------+----------------------------------+
[root@likeadmin ~]# openstack endpoint create --region RegionOne \
> network internal http://likeadmin:9696
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | cf9abd0f74684b969feaa224963adcc8 |
| interface | internal |
| region | RegionOne |
| region_id | RegionOne |
| service_id | b04fe56b6799405183418994a951df4a |
| service_name | neutron |
| service_type | network |
| url | http://likeadmin:9696 |
+--------------+----------------------------------+
[root@likeadmin ~]# openstack endpoint create --region RegionOne \
> network admin http://likeadmin:9696
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | 73fa01fab721467382d2d359afbc80f4 |
| interface | admin |
| region | RegionOne |
| region_id | RegionOne |
| service_id | b04fe56b6799405183418994a951df4a |
| service_name | neutron |
| service_type | network |
| url | http://likeadmin:9696 |
+--------------+----------------------------------+
[root@likeadmin ~]#
[root@likeadmin ~]# openstack endpoint list
+----------------------------------+-----------+--------------+--------------+---------+-----------+------------------------------------------+
| ID | Region | Service Name | Service Type | Enabled | Interface | URL |
+----------------------------------+-----------+--------------+--------------+---------+-----------+------------------------------------------+
| 0f5af5f9e444442eb07ad78fe1314705 | RegionOne | keystone | identity | True | internal | http://likeadmin:5000/v3/ |
| 2d3ee70a3c4c4cb399ba3a689a7fdf82 | RegionOne | nova | compute | True | admin | http://likeadmin:8774/v2.1/%(tenant_id)s |
| 36495ec2b54a4a07a8cd83745a3a19b8 | RegionOne | glance | image | True | public | http://likeadmin:9292 |
| 59ee7ce4b50d4142b5a66c8ab3c8e01a | RegionOne | glance | image | True | admin | http://likeadmin:9292 |
| 5e5a460effe3446bbad3d434a0c128c4 | RegionOne | placement | placement | True | public | http://likeadmin:8778 |
| 73fa01fab721467382d2d359afbc80f4 | RegionOne | neutron | network | True | admin | http://likeadmin:9696 |
| 829019c5bfe94637af4876725213690e | RegionOne | nova | compute | True | internal | http://likeadmin:8774/v2.1/%(tenant_id)s |
| 8a1893ba8035440f8e4a7bdc440ffef8 | RegionOne | glance | image | True | internal | http://likeadmin:9292 |
| 94c895aac78141f8a397a1c0f80f8ea1 | RegionOne | placement | placement | True | internal | http://likeadmin:8778 |
| b572d79c6f5c47a789b258ec7474599c | RegionOne | keystone | identity | True | public | http://likeadmin:5000/v3/ |
| b6b9526e4d514c0cb939f86021d23b89 | RegionOne | neutron | network | True | public | http://likeadmin:9696 |
| cf9abd0f74684b969feaa224963adcc8 | RegionOne | neutron | network | True | internal | http://likeadmin:9696 |
| e54a008fe46741588458cf66fd67c31f | RegionOne | placement | placement | True | admin | http://likeadmin:8778 |
| ea27f64912a3468f9c77df9298ae6fd7 | RegionOne | nova | compute | True | public | http://likeadmin:8774/v2.1/%(tenant_id)s |
| ed967ed76c6141cba66f6f20b9b9c5f2 | RegionOne | keystone | identity | True | admin | http://likeadmin:35357/v3/ |
+----------------------------------+-----------+--------------+--------------+---------+-----------+------------------------------------------+
[root@likeadmin ~]#

5.配置网络选项
您可以部署网络服务使用选项1和选项2两种架构中的一种来部署网络服务。

选项1采用尽可能简单的架构进行部署，只支持实例连接到公有网络（外部网络）。
没有私有网络（个人网络），路由器以及浮动IP地址。只有``admin``或者其他特权用户才可以管理公有网络

选项2在选项1的基础上多了layer－3服务，支持实例连接到私有网络。
``demo``或者其他没有特权的用户可以管理自己的私有网络，包含连接公网和私网的路由器。
另外，浮动IP地址可以让实例使用私有网络连接到外部网络，例如互联网

典型的私有网络一般使用覆盖网络。覆盖网络，例如VXLAN包含了额外的数据头，这些数据头增加了开销，减少了有效内容和用户数据的可用空间。
在不了解虚拟网络架构的情况下，实例尝试用以太网 最大传输单元 (MTU) 1500字节发送数据包。网络服务会自动给实例提供正确的MTU的值通过DHCP的方式。
但是，一些云镜像并没有使用DHCP或者忽视了DHCP MTU选项，要求使用元数据或者脚本来进行配置

1.这里我们选择网络选项2：自服务网络
1）在 controller 节点安装和配置网络组件。
安装组件
# yum install openstack-neutron openstack-neutron-ml2 \
openstack-neutron-linuxbridge ebtables

2)配置服务组件
编辑``/etc/neutron/neutron.conf`` 文件并完成如下操作：

在 [database] 部分，配置数据库访问：
[database]
# ...
connection = mysql+pymysql://neutron:djl18001@likeadmin/neutron
使用你设置的数据库密码替换 NEUTRON_DBPASS 。

注解：注释或删除``[database]``部分除``connection`以外的所有内容

在``[DEFAULT]``部分，启用Modular Layer 2 (ML2)插件，路由服务和重叠的IP地址：
[DEFAULT]
# ...
core_plugin = ml2
service_plugins = router
allow_overlapping_ips = true

在``[DEFAULT]``部分，配置``RabbitMQ``消息队列访问权限：
[DEFAULT]
# ...
transport_url = rabbit://openstack:djl18001@likeadmin
用你在RabbitMQ中为``openstack``选择的密码替换 “RABBIT_PASS”。

在 “[DEFAULT]” 和 “[keystone_authtoken]” 部分，配置认证服务访问：
[DEFAULT]
# ...
auth_strategy = keystone

[keystone_authtoken]
# ...
auth_uri = http://likeadmin:5000
auth_url = http://likeadmin:35357
memcached_servers = likeadmin:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = neutron
password = djl18001
将 NEUTRON_PASS 替换为你在认证服务中为 neutron 用户选择的密码。
注解：在 [keystone_authtoken] 中注释或者删除其他选项。

在``[DEFAULT]``和``[nova]``部分，配置网络服务来通知计算节点的网络拓扑变化：
[DEFAULT]
# ...
notify_nova_on_port_status_changes = true
notify_nova_on_port_data_changes = true

[nova]
# ...
auth_url = http://likeadmin:35357
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = nova
password = djl18001
使用你在身份认证服务中设置的``nova`` 用户的密码替换``NOVA_PASS``。

在 [oslo_concurrency] 部分，配置锁路径：
[oslo_concurrency]
# ...
lock_path = /var/lib/neutron/tmp

3）配置 Modular Layer 2 (ML2) 插件
ML2插件使用Linuxbridge机制来为实例创建layer－2虚拟网络基础设施

编辑``/etc/neutron/plugins/ml2/ml2_conf.ini``文件并完成以下操作：
在``[ml2]``部分，启用flat，VLAN以及VXLAN网络：
[ml2]
# ...
type_drivers = flat,vlan,vxlan
在``[ml2]``部分，启用VXLAN私有网络：
[ml2]
# ...
tenant_network_types = vxlan

在``[ml2]``部分，启用Linuxbridge和l2机制：
[ml2]
# ...
mechanism_drivers = linuxbridge,l2population

注解：Linuxbridge代理只支持VXLAN覆盖网络。

在``[ml2]`` 部分，启用端口安全扩展驱动：
[ml2]
# ...
extension_drivers = port_security
在``[ml2_type_flat]``部分，配置公共虚拟网络为flat网络：

[ml2_type_flat]
# ...
flat_networks = provider
在``[ml2_type_vxlan]``部分，为私有网络配置VXLAN网络识别的网络范围：

[ml2_type_vxlan]
# ...
vni_ranges = 1:1000
在 ``[securitygroup]``部分，启用 ipset 增加安全组的方便性：

[securitygroup]
# ...
enable_ipset = true

4）配置Linuxbridge代理
Linuxbridge代理为实例建立layer－2虚拟网络并且处理安全组规则。

编辑``/etc/neutron/plugins/ml2/linuxbridge_agent.ini``文件并且完成以下操作：

在``[linux_bridge]``部分，将公共虚拟网络和公共物理网络接口对应起来：
[linux_bridge]
physical_interface_mappings = provider:virbr0
可使用ifconfig -a来查看PUBLIC_INTERFACE_NAME信息，将``PUBLIC_INTERFACE_NAME`` 替换为底层的物理公共网络接口。请查看：ref:environment-networking for more information。

在``[vxlan]``部分，启用VXLAN覆盖网络，配置覆盖网络的物理网络接口的IP地址，启用layer－2 population：
[vxlan]
enable_vxlan = true
local_ip = 192.168.164.128
l2_population = true
将``OVERLAY_INTERFACE_IP_ADDRESS`` 替换为处理覆盖网络的底层物理网络接口的IP地址。这个示例架构中使用管理网络接口与其他节点建立流量隧道。因此，将``OVERLAY_INTERFACE_IP_ADDRESS``替换为计算节点的管理网络的IP地址。请查看：ref:environment-networking for more information。

在 ``[securitygroup]``部分，启用安全组并配置 Linux 桥接 iptables 防火墙驱动：
[securitygroup]
# ...
enable_security_group = true
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver

5）配置layer-3代理
The Layer-3 (L3) agent provides routing and NAT services for self-service virtual networks.

编辑``/etc/neutron/l3_agent.ini``文件并完成以下操作：

在``[DEFAULT]``部分，配置Linuxbridge接口驱动和外部网络网桥：

[DEFAULT]
# ...
interface_driver = linuxbridge

6）配置DHCP代理¶
The DHCP agent provides DHCP services for virtual networks.

编辑``/etc/neutron/dhcp_agent.ini``文件并完成下面的操作：

在``[DEFAULT]``部分，配置Linuxbridge驱动接口，DHCP驱动并启用隔离元数据，这样在公共网络上的实例就可以通过网络来访问元数据
[DEFAULT]
# ...
interface_driver = linuxbridge
dhcp_driver = neutron.agent.linux.dhcp.Dnsmasq
enable_isolated_metadata = true

6.配置元数据代理
元数据代理提供配置信息，例如实例的凭证。
编辑``/etc/neutron/metadata_agent.ini``文件并完成以下操作：

在``[DEFAULT]`` 部分，配置元数据主机以及共享密码：
[DEFAULT]
# ...
nova_metadata_ip = likeadmin
metadata_proxy_shared_secret = djl18001
用你为元数据代理设置的密码替换 METADATA_SECRET。

7.配置计算服务来使用网络服务
编辑``/etc/nova/nova.conf``文件并完成以下操作：

在``[neutron]``部分，配置访问参数，启用元数据代理并设置密码：
[neutron]
# ...
url = http://likeadmin:9696
auth_url = http://likeadmin:35357
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = neutron
password = djl18001
service_metadata_proxy = true
metadata_proxy_shared_secret = djl18001
将 NEUTRON_PASS 替换为你在认证服务中为 neutron 用户选择的密码。
使用你为元数据代理设置的密码替换``METADATA_SECRET``

8.完成安装
网络服务初始化脚本需要一个超链接 /etc/neutron/plugin.ini``指向ML2插件配置文件/etc/neutron/plugins/ml2/ml2_conf.ini``。如果超链接不存在，使用下面的命令创建它：

# ln -s /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugin.ini
同步数据库：
[root@likeadmin ~]# su -s /bin/sh -c "neutron-db-manage --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade head" neutron
INFO [alembic.runtime.migration] Context impl MySQLImpl.
INFO [alembic.runtime.migration] Will assume non-transactional DDL.
Running upgrade for neutron ...
INFO [alembic.runtime.migration] Context impl MySQLImpl.
INFO [alembic.runtime.migration] Will assume non-transactional DDL.
INFO [alembic.runtime.migration] Running upgrade -> kilo, kilo_initial
INFO [alembic.runtime.migration] Running upgrade kilo -> 354db87e3225, nsxv_vdr_metadata.py
INFO [alembic.runtime.migration] Running upgrade 354db87e3225 -> 599c6a226151, neutrodb_ipam
INFO [alembic.runtime.migration] Running upgrade 599c6a226151 -> 52c5312f6baf, Initial operations in support of address scopes
INFO [alembic.runtime.migration] Running upgrade 52c5312f6baf -> 313373c0ffee, Flavor framework
INFO [alembic.runtime.migration] Running upgrade 313373c0ffee -> 8675309a5c4f, network_rbac
INFO [alembic.runtime.migration] Running upgrade 8675309a5c4f -> 45f955889773, quota_usage
INFO [alembic.runtime.migration] Running upgrade 45f955889773 -> 26c371498592, subnetpool hash
INFO [alembic.runtime.migration] Running upgrade 26c371498592 -> 1c844d1677f7, add order to dnsnameservers
INFO [alembic.runtime.migration] Running upgrade 1c844d1677f7 -> 1b4c6e320f79, address scope support in subnetpool
INFO [alembic.runtime.migration] Running upgrade 1b4c6e320f79 -> 48153cb5f051, qos db changes
INFO [alembic.runtime.migration] Running upgrade 48153cb5f051 -> 9859ac9c136, quota_reservations
INFO [alembic.runtime.migration] Running upgrade 9859ac9c136 -> 34af2b5c5a59, Add dns_name to Port
INFO [alembic.runtime.migration] Running upgrade 34af2b5c5a59 -> 59cb5b6cf4d, Add availability zone
INFO [alembic.runtime.migration] Running upgrade 59cb5b6cf4d -> 13cfb89f881a, add is_default to subnetpool
INFO [alembic.runtime.migration] Running upgrade 13cfb89f881a -> 32e5974ada25, Add standard attribute table
INFO [alembic.runtime.migration] Running upgrade 32e5974ada25 -> ec7fcfbf72ee, Add network availability zone
INFO [alembic.runtime.migration] Running upgrade ec7fcfbf72ee -> dce3ec7a25c9, Add router availability zone
INFO [alembic.runtime.migration] Running upgrade dce3ec7a25c9 -> c3a73f615e4, Add ip_version to AddressScope
INFO [alembic.runtime.migration] Running upgrade c3a73f615e4 -> 659bf3d90664, Add tables and attributes to support external DNS integration
INFO [alembic.runtime.migration] Running upgrade 659bf3d90664 -> 1df244e556f5, add_unique_ha_router_agent_port_bindings
INFO [alembic.runtime.migration] Running upgrade 1df244e556f5 -> 19f26505c74f, Auto Allocated Topology - aka Get-Me-A-Network
INFO [alembic.runtime.migration] Running upgrade 19f26505c74f -> 15be73214821, add dynamic routing model data
INFO [alembic.runtime.migration] Running upgrade 15be73214821 -> b4caf27aae4, add_bgp_dragent_model_data
INFO [alembic.runtime.migration] Running upgrade b4caf27aae4 -> 15e43b934f81, rbac_qos_policy
INFO [alembic.runtime.migration] Running upgrade 15e43b934f81 -> 31ed664953e6, Add resource_versions row to agent table
INFO [alembic.runtime.migration] Running upgrade 31ed664953e6 -> 2f9e956e7532, tag support
INFO [alembic.runtime.migration] Running upgrade 2f9e956e7532 -> 3894bccad37f, add_timestamp_to_base_resources
INFO [alembic.runtime.migration] Running upgrade 3894bccad37f -> 0e66c5227a8a, Add desc to standard attr table
INFO [alembic.runtime.migration] Running upgrade 0e66c5227a8a -> 45f8dd33480b, qos dscp db addition
INFO [alembic.runtime.migration] Running upgrade 45f8dd33480b -> 5abc0278ca73, Add support for VLAN trunking
INFO [alembic.runtime.migration] Running upgrade 5abc0278ca73 -> d3435b514502, Add device_id index to Port
INFO [alembic.runtime.migration] Running upgrade d3435b514502 -> 30107ab6a3ee, provisioning_blocks.py
INFO [alembic.runtime.migration] Running upgrade 30107ab6a3ee -> c415aab1c048, add revisions table
INFO [alembic.runtime.migration] Running upgrade c415aab1c048 -> a963b38d82f4, add dns name to portdnses
INFO [alembic.runtime.migration] Running upgrade a963b38d82f4 -> 3d0e74aa7d37, Add flavor_id to Router
INFO [alembic.runtime.migration] Running upgrade 3d0e74aa7d37 -> 030a959ceafa, uniq_routerports0port_id
INFO [alembic.runtime.migration] Running upgrade 030a959ceafa -> a5648cfeeadf, Add support for Subnet Service Types
INFO [alembic.runtime.migration] Running upgrade a5648cfeeadf -> 0f5bef0f87d4, add_qos_minimum_bandwidth_rules
INFO [alembic.runtime.migration] Running upgrade 0f5bef0f87d4 -> 67daae611b6e, add standardattr to qos policies
INFO [alembic.runtime.migration] Running upgrade kilo -> 30018084ec99, Initial no-op Liberty contract rule.
INFO [alembic.runtime.migration] Running upgrade 30018084ec99 -> 4ffceebfada, network_rbac
INFO [alembic.runtime.migration] Running upgrade 4ffceebfada -> 5498d17be016, Drop legacy OVS and LB plugin tables
INFO [alembic.runtime.migration] Running upgrade 5498d17be016 -> 2a16083502f3, Metaplugin removal
INFO [alembic.runtime.migration] Running upgrade 2a16083502f3 -> 2e5352a0ad4d, Add missing foreign keys
INFO [alembic.runtime.migration] Running upgrade 2e5352a0ad4d -> 11926bcfe72d, add geneve ml2 type driver
INFO [alembic.runtime.migration] Running upgrade 11926bcfe72d -> 4af11ca47297, Drop cisco monolithic tables
INFO [alembic.runtime.migration] Running upgrade 4af11ca47297 -> 1b294093239c, Drop embrane plugin table
INFO [alembic.runtime.migration] Running upgrade 1b294093239c -> 8a6d8bdae39, standardattributes migration
INFO [alembic.runtime.migration] Running upgrade 8a6d8bdae39 -> 2b4c2465d44b, DVR sheduling refactoring
INFO [alembic.runtime.migration] Running upgrade 2b4c2465d44b -> e3278ee65050, Drop NEC plugin tables
INFO [alembic.runtime.migration] Running upgrade e3278ee65050 -> c6c112992c9, rbac_qos_policy
INFO [alembic.runtime.migration] Running upgrade c6c112992c9 -> 5ffceebfada, network_rbac_external
INFO [alembic.runtime.migration] Running upgrade 5ffceebfada -> 4ffceebfcdc, standard_desc
INFO [alembic.runtime.migration] Running upgrade 4ffceebfcdc -> 7bbb25278f53, device_owner_ha_replicate_int
INFO [alembic.runtime.migration] Running upgrade 7bbb25278f53 -> 89ab9a816d70, Rename ml2_network_segments table
INFO [alembic.runtime.migration] Running upgrade 67daae611b6e -> 6b461a21bcfc, uniq_floatingips0floating_network_id0fixed_port_id0fixed_ip_addr
INFO [alembic.runtime.migration] Running upgrade 6b461a21bcfc -> 5cd92597d11d, Add ip_allocation to port
INFO [alembic.runtime.migration] Running upgrade 5cd92597d11d -> 929c968efe70, add_pk_version_table
INFO [alembic.runtime.migration] Running upgrade 929c968efe70 -> a9c43481023c, extend_pk_with_host_and_add_status_to_ml2_port_binding
INFO [alembic.runtime.migration] Running upgrade 89ab9a816d70 -> c879c5e1ee90, Add segment_id to subnet
INFO [alembic.runtime.migration] Running upgrade c879c5e1ee90 -> 8fd3918ef6f4, Add segment_host_mapping table.
INFO [alembic.runtime.migration] Running upgrade 8fd3918ef6f4 -> 4bcd4df1f426, Rename ml2_dvr_port_bindings
INFO [alembic.runtime.migration] Running upgrade 4bcd4df1f426 -> b67e765a3524, Remove mtu column from networks.
INFO [alembic.runtime.migration] Running upgrade b67e765a3524 -> a84ccf28f06a, migrate dns name from port
INFO [alembic.runtime.migration] Running upgrade a84ccf28f06a -> 7d9d8eeec6ad, rename tenant to project
INFO [alembic.runtime.migration] Running upgrade 7d9d8eeec6ad -> a8b517cff8ab, Add routerport bindings for L3 HA
INFO [alembic.runtime.migration] Running upgrade a8b517cff8ab -> 3b935b28e7a0, migrate to pluggable ipam
INFO [alembic.runtime.migration] Running upgrade 3b935b28e7a0 -> b12a3ef66e62, add standardattr to qos policies
INFO [alembic.runtime.migration] Running upgrade b12a3ef66e62 -> 97c25b0d2353, Add Name and Description to the networksegments table
INFO [alembic.runtime.migration] Running upgrade 97c25b0d2353 -> 2e0d7a8a1586, Add binding index to RouterL3AgentBinding
INFO [alembic.runtime.migration] Running upgrade 2e0d7a8a1586 -> 5c85685d616d, Remove availability ranges.
OK
[root@likeadmin ~]#
注解:数据库的同步发生在 Networking 之后，因为脚本需要完成服务器和插件的配置文件。
如果您收到以下Python异常，无法从字符串解析rfc1738 URL，请将连接选项从[default]部分移动到[database]部分。 然后，从neutron.conf文件中的值中删除单引号。

9.重启计算API 服务：
# systemctl restart openstack-nova-api.service
当系统启动时，启动 Networking 服务并配置它启动。

对于两种网络选项：
# systemctl enable neutron-server.service \
neutron-linuxbridge-agent.service neutron-dhcp-agent.service \
neutron-metadata-agent.service
# systemctl start neutron-server.service \
neutron-linuxbridge-agent.service neutron-dhcp-agent.service \
neutron-metadata-agent.service

对于网络选项2，同样启用layer－3服务并设置其随系统自启动
# systemctl enable neutron-l3-agent.service
# systemctl start neutron-l3-agent.service

10.安装和配置计算节点
以下配置在计算节点上进行
计算节点处理实例的连接和 security groups 。

1.安装组件
# yum install openstack-neutron-linuxbridge ebtables ipset

2.配置通用组件
Networking 通用组件的配置包括认证机制、消息队列和插件。
注解：默认配置文件在各发行版本中可能不同。你可能需要添加这些部分，选项而不是修改已经存在的部分和选项。另外，在配置片段中的省略号(...)表示默认的配置选项你应该保留。

编辑``/etc/neutron/neutron.conf`` 文件并完成如下操作：
在``[database]`` 部分，注释所有``connection`` 项，因为计算节点不直接访问数据库。
在``[DEFAULT]``部分，配置``RabbitMQ``消息队列访问权限：
[DEFAULT]
# ...
transport_url = rabbit://openstack:djl18001@likeadmin
用你在RabbitMQ中为``openstack``选择的密码替换 “RABBIT_PASS”。

在 “[DEFAULT]” 和 “[keystone_authtoken]” 部分，配置认证服务访问：
[DEFAULT]
# ...
auth_strategy = keystone

[keystone_authtoken]
# ...
auth_uri = http://likeadmin:5000
auth_url = http://likeadmin:35357
memcached_servers = likeadmin:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = neutron
password = djl18001
将 NEUTRON_PASS 替换为你在认证服务中为 neutron 用户选择的密码。
注解：在 [keystone_authtoken] 中注释或者删除其他选项。

在 [oslo_concurrency] 部分，配置锁路径：
[oslo_concurrency]
# ...
lock_path = /var/lib/neutron/tmp

3.配置网络选项
选择与您之前在控制节点上选择的相同的网络选项。之后，回到这里并进行下一步：配置计算服务来使用网络服务。
在 compute 节点上配置网络组件。

配置Linuxbridge代理
Linuxbridge代理为实例建立layer－2虚拟网络并且处理安全组规则。

编辑``/etc/neutron/plugins/ml2/linuxbridge_agent.ini``文件并且完成以下操作：
在``[linux_bridge]``部分，将公共虚拟网络和公共物理网络接口对应起来：
[linux_bridge]
physical_interface_mappings = provider:virbr0
将``PUBLIC_INTERFACE_NAME`` 替换为底层的物理公共网络接口。请查看：ref:environment-networking for more information。

在``[vxlan]``部分，启用VXLAN覆盖网络，配置覆盖网络的物理网络接口的IP地址，启用layer－2 population：
[vxlan]
enable_vxlan = true
local_ip = 192.168.164.129
l2_population = true
将``OVERLAY_INTERFACE_IP_ADDRESS`` 替换为处理覆盖网络的底层物理网络接口的IP地址。这个示例架构中使用管理网络接口与其他节点建立流量隧道。因此，将``OVERLAY_INTERFACE_IP_ADDRESS``替换为计算节点的管理网络的IP地址。请查看：ref:environment-networking for more information。

在 ``[securitygroup]``部分，启用安全组并配置 Linux 桥接 iptables 防火墙驱动：
[securitygroup]
# ...
enable_security_group = true
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver

4.配置计算服务来使用网络服务¶
编辑``/etc/nova/nova.conf``文件并完成下面的操作：

在``[neutron]`` 部分，配置访问参数：
[neutron]
# ...
url = http://likeadmin:9696
auth_url = http://likeadmin:35357
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = neutron
password = djl18001

将 NEUTRON_PASS 替换为你在认证服务中为 neutron 用户选择的密码。

5.完成安装
重启计算服务：
# systemctl restart openstack-nova-compute.service

启动Linuxbridge代理并配置它开机自启动：
# systemctl enable neutron-linuxbridge-agent.service
# systemctl start neutron-linuxbridge-agent.service

6.验证操作
在控制节点上执行这些命令。
获得 admin 凭证来获取只有管理员能执行的命令的访问权限：
[root@likeadmin network-scripts]# source /root/.admin-openrc

列出加载的扩展来验证``neutron-server``进程是否正常启动：
[root@likeadmin network-scripts]# openstack extension list --network
+-------------------------------------------------------------+---------------------------+---------------------------------------------------------------+
| Name | Alias | Description |
+-------------------------------------------------------------+---------------------------+---------------------------------------------------------------+
| Default Subnetpools | default-subnetpools | Provides ability to mark and use a subnetpool as the default |
| Network IP Availability | network-ip-availability | Provides IP availability data for each network and subnet. |
| Network Availability Zone | network_availability_zone | Availability zone support for network. |
| Auto Allocated Topology Services | auto-allocated-topology | Auto Allocated Topology Services. |
| Neutron L3 Configurable external gateway mode | ext-gw-mode | Extension of the router abstraction for specifying whether |
| | | SNAT should occur on the external gateway |
| Port Binding | binding | Expose port bindings of a virtual port to external |
| | | application |
| agent | agent | The agent management extension. |
| Subnet Allocation | subnet_allocation | Enables allocation of subnets from a subnet pool |
| L3 Agent Scheduler | l3_agent_scheduler | Schedule routers among l3 agents |
| Tag support | tag | Enables to set tag on resources. |
| Neutron external network | external-net | Adds external network attribute to network resource. |
| Neutron Service Flavors | flavors | Flavor specification for Neutron advanced services |
| Network MTU | net-mtu | Provides MTU attribute for a network resource. |
| Availability Zone | availability_zone | The availability zone extension. |
| Quota management support | quotas | Expose functions for quotas management per tenant |
| HA Router extension | l3-ha | Add HA capability to routers. |
| Provider Network | provider | Expose mapping of virtual networks to physical networks |
| Multi Provider Network | multi-provider | Expose mapping of virtual networks to multiple physical |
| | | networks |
| Address scope | address-scope | Address scopes extension. |
| Neutron Extra Route | extraroute | Extra routes configuration for L3 router |
| Subnet service types | subnet-service-types | Provides ability to set the subnet service_types field |
| Resource timestamps | standard-attr-timestamp | Adds created_at and updated_at fields to all Neutron |
| | | resources that have Neutron standard attributes. |
| Neutron Service Type Management | service-type | API for retrieving service providers for Neutron advanced |
| | | services |
| Router Flavor Extension | l3-flavors | Flavor support for routers. |
| Port Security | port-security | Provides port security |
| Neutron Extra DHCP opts | extra_dhcp_opt | Extra options configuration for DHCP. For example PXE boot |
| | | options to DHCP clients can be specified (e.g. tftp-server, |
| | | server-ip-address, bootfile-name) |
| Resource revision numbers | standard-attr-revisions | This extension will display the revision number of neutron |
| | | resources. |
| Pagination support | pagination | Extension that indicates that pagination is enabled. |
| Sorting support | sorting | Extension that indicates that sorting is enabled. |
| security-group | security-group | The security groups extension. |
| DHCP Agent Scheduler | dhcp_agent_scheduler | Schedule networks among dhcp agents |
| Router Availability Zone | router_availability_zone | Availability zone support for router. |
| RBAC Policies | rbac-policies | Allows creation and modification of policies that control |
| | | tenant access to resources. |
| Tag support for resources: subnet, subnetpool, port, router | tag-ext | Extends tag support to more L2 and L3 resources. |
| standard-attr-description | standard-attr-description | Extension to add descriptions to standard attributes |
| Neutron L3 Router | router | Router abstraction for basic L3 forwarding between L2 Neutron |
| | | networks and access to external networks via a NAT gateway. |
| Allowed Address Pairs | allowed-address-pairs | Provides allowed address pairs |
| project_id field enabled | project-id | Extension that indicates that project_id field is enabled. |
| Distributed Virtual Router | dvr | Enables configuration of Distributed Virtual Routers. |
+-------------------------------------------------------------+---------------------------+---------------------------------------------------------------+
[root@likeadmin network-scripts]#

网络选项2：自服务网络

列出代理以验证启动 neutron 代理是否成功：

[root@likeadmin network-scripts]# openstack network agent list
+--------------------------------------+--------------------+-----------+-------------------+-------+-------+---------------------------+
| ID | Agent Type | Host | Availability Zone | Alive | State | Binary |
+--------------------------------------+--------------------+-----------+-------------------+-------+-------+---------------------------+
| 1c78a82e-155b-4aa0-b3ad-b6a753afc452 | DHCP agent | likeadmin | nova | True | UP | neutron-dhcp-agent |
| 47f93a7f-4db8-4a9d-a8a5-d9f3e6a5b5df | Linux bridge agent | likeadmin | None | True | UP | neutron-linuxbridge-agent |
| c3efa976-6d23-4198-8387-f8303cbd4b93 | Linux bridge agent | likenode | None | True | UP | neutron-linuxbridge-agent |
| e324fef9-0386-4b2f-ad9f-b02b2dfae712 | L3 agent | likeadmin | nova | True | UP | neutron-l3-agent |
| fdb14d79-2bb1-4e43-a95b-82569de6a5f8 | Metadata agent | likeadmin | None | True | UP | neutron-metadata-agent |
+--------------------------------------+--------------------+-----------+-------------------+-------+-------+---------------------------+
[root@likeadmin network-scripts]#

注：至此网络服务已基本配置完成，此环境选用的是自网络服务。