培訓(xùn)教程easystack-深入理解neutron v1

1、深入理解Neutron巨楓 大綱部署環(huán)境中的網(wǎng)絡(luò)Neutron框架介紹Neutron概念介紹Neutron中數(shù)據(jù)流分析Neutron與OpenvSwitchNeutron中的DVRNeutron代碼簡介Neutron運(yùn)維部署環(huán)境中的網(wǎng)絡(luò)OpenStack架構(gòu)圖neutron架構(gòu)圖OpenStack里的網(wǎng)絡(luò)neutron-server提供neutron API，使用plugin的方式處理API并讀寫數(shù)據(jù)庫，icehouse版的默認(rèn)plugin是ml2 plugin。使用消息隊列與其他agent交互。L3-agent負(fù)責(zé)浮動IP的和router的具體實現(xiàn)。實現(xiàn)浮動IP到虛機(jī)私有IP的映射。負(fù)責(zé)ro

2、uter的具體實現(xiàn)，創(chuàng)建router對應(yīng)的私有網(wǎng)絡(luò)的網(wǎng)關(guān)，創(chuàng)建router對應(yīng)的公網(wǎng)的網(wǎng)絡(luò)設(shè)備。neutron-metadata-agent負(fù)責(zé)虛機(jī)里訪問metadata數(shù)據(jù)。dhcp-agent負(fù)責(zé)私有網(wǎng)絡(luò)中虛機(jī)的IP分配為不同的子網(wǎng)創(chuàng)建不同的dnsmasq實例，負(fù)責(zé)給虛機(jī)分配IP。創(chuàng)建虛機(jī)時，IP和mac地址會在dnsmasq里設(shè)置好，虛機(jī)啟動時獲取指定的IP。plugin-agent: neutron-openvswitch-agent負(fù)責(zé)不同類型網(wǎng)絡(luò)的具體實現(xiàn)根據(jù)網(wǎng)絡(luò)的類型和屬性建立規(guī)則連通網(wǎng)絡(luò)。neutron-openvswitch-agent使用openvswtich網(wǎng)絡(luò)虛擬化技術(shù)

3、，實現(xiàn)neutron里定義的網(wǎng)絡(luò)。Neutron概念介紹net 網(wǎng)絡(luò)subnet 子網(wǎng)router 路由floating-ip 浮動IPport 網(wǎng)絡(luò)portsecurity-group 防火墻組Neutron數(shù)據(jù)庫模型網(wǎng)絡(luò)拓?fù)渚W(wǎng)絡(luò)neutron help net-create外部網(wǎng)絡(luò)neutron net-create public_network -router:external True共享網(wǎng)絡(luò)neutron net-create share_network -shared私有網(wǎng)絡(luò)neutron net-create private_network子網(wǎng)neutron help subne

4、t-createneutron subnet-create -h -f html,json,shell,table,yaml -c COLUMN -variable VARIABLE -prefix PREFIX -request-format json,xml -tenant-id TENANT_ID -name NAME -ip-version 4,6 -gateway GATEWAY_IP -no-gateway -allocation-pool start=IP_ADDR,end=IP_ADDR -host-route destination=CIDR,nexthop=IP_ADDR

5、-dns-nameserver DNS_NAMESERVER -disable-dhcp NETWORK CIDRneutron subnet-create private_network /24路由連接不同的網(wǎng)絡(luò)創(chuàng)建routerneutron router-create test_router連接外部網(wǎng)路neutron router-gateway-set router-id external-network-id連接內(nèi)部網(wǎng)絡(luò)neutron router-interface-add router-id INTERFACE浮動IP創(chuàng)建浮動IPneutron floatin

6、gip-create FLOATING_NETWORK關(guān)聯(lián)浮動IP到主機(jī)neutron floatingip-associate FLOATINGIP_ID PORT網(wǎng)絡(luò)Port網(wǎng)絡(luò)設(shè)備比如虛機(jī)的網(wǎng)卡、路由連接兩端網(wǎng)絡(luò)的網(wǎng)卡neutron port-list虛機(jī)防火墻使用iptables實現(xiàn)到虛機(jī)的防火墻管理openstack安裝好后，默認(rèn)有一個default防火墻。查看防火墻組neutron security-group-list查看防火墻規(guī)則neutron security-group-rule-list部署虛機(jī)時neutron數(shù)據(jù)流Neutron中虛機(jī)數(shù)據(jù)流典型分析1. 虛機(jī)如何獲取IP

7、2. 虛機(jī)ping外部網(wǎng)絡(luò)時數(shù)據(jù)包的流向控制節(jié)點(diǎn)網(wǎng)絡(luò)設(shè)備計算節(jié)點(diǎn)網(wǎng)絡(luò)設(shè)備OpenvSwitch介紹openvswitch概念Neutron中如何使用openvswichOpenvSwitch主要組件OpenvSwitch命令ovs-vsctl ovsdb-server ovs-ofctl - ovs-vswitchdovs-dpctl kernel datapathovs-appctl OVS daemonsNeutron中如何使用openvswichneutron-openvswtich-agent負(fù)責(zé)與openvswtich交互根據(jù)不同的網(wǎng)絡(luò)類型和設(shè)置創(chuàng)建不同的ovs port和openf

8、low流規(guī)則local網(wǎng)絡(luò)br-inttapXXX(vm)tapXXX(dhcp)eth0dnsmasqVM0flat網(wǎng)絡(luò)br-inttapXXX(vm)tapXXX(dhcp)eth0dnsmasqVM0br-eth1phy-br-eth1phy-br-intTag is converted with flow tablestrip_vlan = mod_vlan_vid:1Tag is converted with flow tabledl_vlan=1 = strip_vlaneth1patch pairvlan網(wǎng)絡(luò)br-inttapXXX(vm)tapXXX(dhcp)eth0dnsm

9、asqVM0br-eth1phy-br-eth1phy-br-intVLAN ID is converted with flow tabledl_vlan=101 = mod_vlan_vid:1dl_vlan=102 = mod_vlan_vid:2VLAN ID is converted with flow tabledl_vlan=1 = mod_vlan_vid:101dl_vlan=2 = mod_vlan_vid:102eth1patch pairgre網(wǎng)絡(luò)br-inttapXXX(vm)tapXXX(dhcp)eth0dnsmasqVM0br-tunpatch-intpatch-

10、tuntunnel_id is set by flow tabledl_vlan=3 actions=strip_vlan,set_tunnel:0 x1eth1gre-tunnel_id is removed by flow tabletun_id=0 x1 actions=mod_vlan_vid:3patch pairvxlan網(wǎng)絡(luò)br-inttapXXX(vm)tapXXX(dhcp)eth0dnsmasqVM0br-tunpatch-intpatch-tuntunnel_id is set by flow tabledl_vlan=3 actions=strip

11、_vlan,set_tunnel:0 x1eth1vxlan-tunnel_id is removed by flow tabletun_id=0 x1 actions=mod_vlan_vid:3patch pairNeutron DVR沒有DVR時，所有路由，F(xiàn)loatingip都在網(wǎng)絡(luò)節(jié)點(diǎn)。容易造成網(wǎng)絡(luò)節(jié)點(diǎn)單點(diǎn)問題，負(fù)載問題，性能問題。DVR可以適度的解決這些問題，將路由，F(xiàn)loatingip放到對應(yīng)的計算節(jié)點(diǎn)。DVR不能解決集中SNAT，分布式DHCP。DVR對FWaas，LBaas，VPNaas支持程度在不同OpenStack版本里不同。Neutron DVRN

12、etwork Node 2 (KVM)Ext BrARPNAT1FW1ARPNAT2FW2FlowIntegration BridgeFlowTunnel BrCase 1 Same network, Same Compute Node Neutron DVRNetwork Node 1 (KVM)Ext BrARPNAT1FW1ARPNAT2FW2FlowIntegration BridgeFlowTunnel BrCompute Node 1 (KVM)T1VM1T1VM2T1VM3T2VM1ARPInt R1FW1ARPInt R2FW2FlowIntegration BridgeFlo

13、wTunnel BrFloat IPExt BrCompute Node 2 (KVM)T1VM4T1VM5T1VM6T2VM2ARPInt R1FW1ARPInt R2FW2FlowIntegration BridgeFlowTunnel BrFloat IPExt BrInternetVNET 1VNET 2VNET 3External NetworkNetwork Node 2 (KVM)Ext BrARPNAT1FW1ARPNAT2FW2FlowIntegration BridgeFlowTunnel BrCase 2 Same Network, Different Compute N

14、odeNeutron DVRNetwork Node 1 (KVM)Ext BrARPNAT1FW1ARPNAT2FW2FlowIntegration BridgeFlowTunnel BrCompute Node 1 (KVM)T1VM1T1VM2T1VM3T2VM1ARPInt R1FW1ARPInt R2FW2FlowIntegration BridgeFlowTunnel BrFloat IPExt BrCompute Node 2 (KVM)T1VM4T1VM5T1VM6T2VM2ARPInt R1FW1ARPInt R2FW2FlowIntegration BridgeFlowTu

15、nnel BrFloat IPExt BrInternetVNET 1VNET 2VNET 3External NetworkNetwork Node 2 (KVM)Ext BrARPNAT1FW1ARPNAT2FW2FlowIntegration BridgeFlowTunnel BrCase 3 Same Tenant, different Networks, same Compute nodeBefore DVR Enhancement (East/West)Network Node 1 (KVM)Ext BrARPNAT1FW1ARPNAT2FW2FlowIntegration Bri

16、dgeFlowTunnel BrCompute Node 1 (KVM)T1VM1T1VM2T1VM3T2VM1ARPInt R1FW1ARPInt R2FW2FlowIntegration BridgeFlowTunnel BrFloat IPExt BrCompute Node 2 (KVM)T1VM4T1VM5T1VM6T2VM2ARPInt R1FW1ARPInt R2FW2FlowIntegration BridgeFlowTunnel BrFloat IPExt BrInternetVNET 1VNET 2VNET 3External NetworkBefore DVR, this

17、 traffic would need to go to the Network Node to be routed.L3NamespaceNetwork Node 2 (KVM)Ext BrARPNAT1FW1ARPNAT2FW2FlowIntegration BridgeFlowTunnel BrCase 3 Same Tenant, different Networks, same Compute nodeDVR Enhancement (East/West)Network Node 1 (KVM)Ext BrARPNAT1FW1ARPNAT2FW2FlowIntegration Bri

18、dgeFlowTunnel BrCompute Node 1 (KVM)T1VM1T1VM2T1VM3T2VM1ARPInt R1FW1ARPInt R2FW2FlowIntegration BridgeFlowTunnel BrFloat IPExt BrCompute Node 2 (KVM)T1VM4T1VM5T1VM6T2VM2ARPInt R1FW1ARPInt R2FW2FlowIntegration BridgeFlowTunnel BrFloat IPExt BrInternetVNET 1VNET 2VNET 3External NetworkBefore DVR, this

19、 traffic would need to go to the Network Node to be routed.Network Node 2 (KVM)Ext BrARPNAT1FW1ARPNAT2FW2FlowIntegration BridgeFlowTunnel BrCase 4 Same Tenant, different Networks, different Compute nodeDVR Enhancement (East/West)Network Node 1 (KVM)Ext BrARPNAT1FW1ARPNAT2FW2FlowIntegration BridgeFlo

20、wTunnel BrCompute Node 1 (KVM)T1VM1T1VM2T1VM3T2VM1ARPInt R1FW1ARPInt R2FW2FlowIntegration BridgeFlowTunnel BrFloat IPExt BrCompute Node 2 (KVM)T1VM4T1VM5T1VM6T2VM2ARPInt R1FW1ARPInt R2FW2FlowIntegration BridgeFlowTunnel BrFloat IPExt BrInternetVNET 1VNET 2VNET 3External NetworkBefore DVR, this traff

21、ic would need to go to the Network Node to be routed.Network Node 2 (KVM)Ext BrARPNAT1FW1ARPNAT2FW2FlowIntegration BridgeFlowTunnel BrCase 5 Floating IPDVR Enhancement (North/South)Network Node 1 (KVM)Ext BrARPNAT1FW1ARPNAT2FW2FlowIntegration BridgeFlowTunnel BrCompute Node 1 (KVM)T1VM1T1VM2T1VM3T2V

22、M1ARPInt R1FW1ARPInt R2FW2FlowIntegration BridgeFlowTunnel BrFloat IPExt BrCompute Node 2 (KVM)T1VM4T1VM5T1VM6T2VM2ARPInt R1FW1ARPInt R2FW2FlowIntegration BridgeFlowTunnel BrFloat IPExt BrInternetVNET 1VNET 2VNET 3External NetworkNetwork Node 2 (KVM)Ext BrARPNAT1FW1ARPNAT2FW2FlowIntegration BridgeFlowTunnel BrCase 6 Default SNATDVR Enhancement (North/South)Network Node 1 (KVM)Ext BrARPNAT1FW1ARPNAT2FW2FlowIntegration BridgeFlowTunnel BrCompute Node 1 (KVM)T1VM1T1VM2T1VM3T2VM1ARPInt R1FW1ARPInt R2FW2FlowInteg