培訓教程easystack-深入理解neutron v1

1、深入理解Neutron巨楓 大綱部署環(huán)境中的網絡Neutron框架介紹Neutron概念介紹Neutron中數據流分析Neutron與OpenvSwitchNeutron中的DVRNeutron代碼簡介Neutron運維部署環(huán)境中的網絡OpenStack架構圖neutron架構圖OpenStack里的網絡neutron-server提供neutron API，使用plugin的方式處理API并讀寫數據庫，icehouse版的默認plugin是ml2 plugin。使用消息隊列與其他agent交互。L3-agent負責浮動IP的和router的具體實現。實現浮動IP到虛機私有IP的映射。負責ro

2、uter的具體實現，創(chuàng)建router對應的私有網絡的網關，創(chuàng)建router對應的公網的網絡設備。neutron-metadata-agent負責虛機里訪問metadata數據。dhcp-agent負責私有網絡中虛機的IP分配為不同的子網創(chuàng)建不同的dnsmasq實例，負責給虛機分配IP。創(chuàng)建虛機時，IP和mac地址會在dnsmasq里設置好，虛機啟動時獲取指定的IP。plugin-agent: neutron-openvswitch-agent負責不同類型網絡的具體實現根據網絡的類型和屬性建立規(guī)則連通網絡。neutron-openvswitch-agent使用openvswtich網絡虛擬化技術

3、，實現neutron里定義的網絡。Neutron概念介紹net 網絡subnet 子網router 路由floating-ip 浮動IPport 網絡portsecurity-group 防火墻組Neutron數據庫模型網絡拓撲網絡neutron help net-create外部網絡neutron net-create public_network -router:external True共享網絡neutron net-create share_network -shared私有網絡neutron net-create private_network子網neutron help subne

4、t-createneutron subnet-create -h -f html,json,shell,table,yaml -c COLUMN -variable VARIABLE -prefix PREFIX -request-format json,xml -tenant-id TENANT_ID -name NAME -ip-version 4,6 -gateway GATEWAY_IP -no-gateway -allocation-pool start=IP_ADDR,end=IP_ADDR -host-route destination=CIDR,nexthop=IP_ADDR

5、-dns-nameserver DNS_NAMESERVER -disable-dhcp NETWORK CIDRneutron subnet-create private_network /24路由連接不同的網絡創(chuàng)建routerneutron router-create test_router連接外部網路neutron router-gateway-set router-id external-network-id連接內部網絡neutron router-interface-add router-id INTERFACE浮動IP創(chuàng)建浮動IPneutron floatin

6、gip-create FLOATING_NETWORK關聯浮動IP到主機neutron floatingip-associate FLOATINGIP_ID PORT網絡Port網絡設備比如虛機的網卡、路由連接兩端網絡的網卡neutron port-list虛機防火墻使用iptables實現到虛機的防火墻管理openstack安裝好后，默認有一個default防火墻。查看防火墻組neutron security-group-list查看防火墻規(guī)則neutron security-group-rule-list部署虛機時neutron數據流Neutron中虛機數據流典型分析1. 虛機如何獲取IP

7、2. 虛機ping外部網絡時數據包的流向控制節(jié)點網絡設備計算節(jié)點網絡設備OpenvSwitch介紹openvswitch概念Neutron中如何使用openvswichOpenvSwitch主要組件OpenvSwitch命令ovs-vsctl ovsdb-server ovs-ofctl - ovs-vswitchdovs-dpctl kernel datapathovs-appctl OVS daemonsNeutron中如何使用openvswichneutron-openvswtich-agent負責與openvswtich交互根據不同的網絡類型和設置創(chuàng)建不同的ovs port和openf

8、low流規(guī)則local網絡br-inttapXXX(vm)tapXXX(dhcp)eth0dnsmasqVM0flat網絡br-inttapXXX(vm)tapXXX(dhcp)eth0dnsmasqVM0br-eth1phy-br-eth1phy-br-intTag is converted with flow tablestrip_vlan = mod_vlan_vid:1Tag is converted with flow tabledl_vlan=1 = strip_vlaneth1patch pairvlan網絡br-inttapXXX(vm)tapXXX(dhcp)eth0dnsm

9、asqVM0br-eth1phy-br-eth1phy-br-intVLAN ID is converted with flow tabledl_vlan=101 = mod_vlan_vid:1dl_vlan=102 = mod_vlan_vid:2VLAN ID is converted with flow tabledl_vlan=1 = mod_vlan_vid:101dl_vlan=2 = mod_vlan_vid:102eth1patch pairgre網絡br-inttapXXX(vm)tapXXX(dhcp)eth0dnsmasqVM0br-tunpatch-intpatch-

10、tuntunnel_id is set by flow tabledl_vlan=3 actions=strip_vlan,set_tunnel:0 x1eth1gre-tunnel_id is removed by flow tabletun_id=0 x1 actions=mod_vlan_vid:3patch pairvxlan網絡br-inttapXXX(vm)tapXXX(dhcp)eth0dnsmasqVM0br-tunpatch-intpatch-tuntunnel_id is set by flow tabledl_vlan=3 actions=strip

11、_vlan,set_tunnel:0 x1eth1vxlan-tunnel_id is removed by flow tabletun_id=0 x1 actions=mod_vlan_vid:3patch pairNeutron DVR沒有DVR時，所有路由，Floatingip都在網絡節(jié)點。容易造成網絡節(jié)點單點問題，負載問題，性能問題。DVR可以適度的解決這些問題，將路由，Floatingip放到對應的計算節(jié)點。DVR不能解決集中SNAT，分布式DHCP。DVR對FWaas，LBaas，VPNaas支持程度在不同OpenStack版本里不同。Neutron DVRN

12、etwork Node 2 (KVM)Ext BrARPNAT1FW1ARPNAT2FW2FlowIntegration BridgeFlowTunnel BrCase 1 Same network, Same Compute Node Neutron DVRNetwork Node 1 (KVM)Ext BrARPNAT1FW1ARPNAT2FW2FlowIntegration BridgeFlowTunnel BrCompute Node 1 (KVM)T1VM1T1VM2T1VM3T2VM1ARPInt R1FW1ARPInt R2FW2FlowIntegration BridgeFlo

13、wTunnel BrFloat IPExt BrCompute Node 2 (KVM)T1VM4T1VM5T1VM6T2VM2ARPInt R1FW1ARPInt R2FW2FlowIntegration BridgeFlowTunnel BrFloat IPExt BrInternetVNET 1VNET 2VNET 3External NetworkNetwork Node 2 (KVM)Ext BrARPNAT1FW1ARPNAT2FW2FlowIntegration BridgeFlowTunnel BrCase 2 Same Network, Different Compute N

14、odeNeutron DVRNetwork Node 1 (KVM)Ext BrARPNAT1FW1ARPNAT2FW2FlowIntegration BridgeFlowTunnel BrCompute Node 1 (KVM)T1VM1T1VM2T1VM3T2VM1ARPInt R1FW1ARPInt R2FW2FlowIntegration BridgeFlowTunnel BrFloat IPExt BrCompute Node 2 (KVM)T1VM4T1VM5T1VM6T2VM2ARPInt R1FW1ARPInt R2FW2FlowIntegration BridgeFlowTu

15、nnel BrFloat IPExt BrInternetVNET 1VNET 2VNET 3External NetworkNetwork Node 2 (KVM)Ext BrARPNAT1FW1ARPNAT2FW2FlowIntegration BridgeFlowTunnel BrCase 3 Same Tenant, different Networks, same Compute nodeBefore DVR Enhancement (East/West)Network Node 1 (KVM)Ext BrARPNAT1FW1ARPNAT2FW2FlowIntegration Bri

16、dgeFlowTunnel BrCompute Node 1 (KVM)T1VM1T1VM2T1VM3T2VM1ARPInt R1FW1ARPInt R2FW2FlowIntegration BridgeFlowTunnel BrFloat IPExt BrCompute Node 2 (KVM)T1VM4T1VM5T1VM6T2VM2ARPInt R1FW1ARPInt R2FW2FlowIntegration BridgeFlowTunnel BrFloat IPExt BrInternetVNET 1VNET 2VNET 3External NetworkBefore DVR, this

17、 traffic would need to go to the Network Node to be routed.L3NamespaceNetwork Node 2 (KVM)Ext BrARPNAT1FW1ARPNAT2FW2FlowIntegration BridgeFlowTunnel BrCase 3 Same Tenant, different Networks, same Compute nodeDVR Enhancement (East/West)Network Node 1 (KVM)Ext BrARPNAT1FW1ARPNAT2FW2FlowIntegration Bri

18、dgeFlowTunnel BrCompute Node 1 (KVM)T1VM1T1VM2T1VM3T2VM1ARPInt R1FW1ARPInt R2FW2FlowIntegration BridgeFlowTunnel BrFloat IPExt BrCompute Node 2 (KVM)T1VM4T1VM5T1VM6T2VM2ARPInt R1FW1ARPInt R2FW2FlowIntegration BridgeFlowTunnel BrFloat IPExt BrInternetVNET 1VNET 2VNET 3External NetworkBefore DVR, this

19、 traffic would need to go to the Network Node to be routed.Network Node 2 (KVM)Ext BrARPNAT1FW1ARPNAT2FW2FlowIntegration BridgeFlowTunnel BrCase 4 Same Tenant, different Networks, different Compute nodeDVR Enhancement (East/West)Network Node 1 (KVM)Ext BrARPNAT1FW1ARPNAT2FW2FlowIntegration BridgeFlo

20、wTunnel BrCompute Node 1 (KVM)T1VM1T1VM2T1VM3T2VM1ARPInt R1FW1ARPInt R2FW2FlowIntegration BridgeFlowTunnel BrFloat IPExt BrCompute Node 2 (KVM)T1VM4T1VM5T1VM6T2VM2ARPInt R1FW1ARPInt R2FW2FlowIntegration BridgeFlowTunnel BrFloat IPExt BrInternetVNET 1VNET 2VNET 3External NetworkBefore DVR, this traff

21、ic would need to go to the Network Node to be routed.Network Node 2 (KVM)Ext BrARPNAT1FW1ARPNAT2FW2FlowIntegration BridgeFlowTunnel BrCase 5 Floating IPDVR Enhancement (North/South)Network Node 1 (KVM)Ext BrARPNAT1FW1ARPNAT2FW2FlowIntegration BridgeFlowTunnel BrCompute Node 1 (KVM)T1VM1T1VM2T1VM3T2V

22、M1ARPInt R1FW1ARPInt R2FW2FlowIntegration BridgeFlowTunnel BrFloat IPExt BrCompute Node 2 (KVM)T1VM4T1VM5T1VM6T2VM2ARPInt R1FW1ARPInt R2FW2FlowIntegration BridgeFlowTunnel BrFloat IPExt BrInternetVNET 1VNET 2VNET 3External NetworkNetwork Node 2 (KVM)Ext BrARPNAT1FW1ARPNAT2FW2FlowIntegration BridgeFlowTunnel BrCase 6 Default SNATDVR Enhancement (North/South)Network Node 1 (KVM)Ext BrARPNAT1FW1ARPNAT2FW2FlowIntegration BridgeFlowTunnel BrCompute Node 1 (KVM)T1VM1T1VM2T1VM3T2VM1ARPInt R1FW1ARPInt R2FW2FlowInteg