Book Image

Production Ready OpenStack - Recipes for Successful Environments

By : Arthur Berezin
Book Image

Production Ready OpenStack - Recipes for Successful Environments

By: Arthur Berezin

Overview of this book

OpenStack is the most popular open source cloud platform used by organizations building internal private clouds and by public cloud providers. OpenStack is designed in a fully distributed architecture to provide Infrastructure as a Service, allowing us to maintain a massively scalable cloud infrastructure. OpenStack is developed by a vibrant community of open source developers who come from the largest software companies in the world. The book provides a comprehensive and practical guide to the multiple uses cases and configurations that OpenStack supports. This book simplifies the learning process by guiding you through how to install OpenStack in a single controller configuration. The book goes deeper into deploying OpenStack in a highly available configuration. You'll then configure Keystone Identity Services using LDAP, Active Directory, or the MySQL identity provider and configure a caching layer and SSL. After that, you will configure storage back-end providers for Glance and Cinder, which will include Ceph, NFS, Swift, and local storage. Then you will configure the Neutron networking service with provider network VLANs, and tenant network VXLAN and GRE. Also, you will configure Nova's Hypervisor with KVM, and QEMU emulation, and you will configure Nova's scheduler filters and weights. Finally, you will configure Horizon to use Apache HTTPD and SSL, and you will customize the dashboard's appearance.
Table of Contents (16 chapters)
Production Ready OpenStack - Recipes for Successful Environments
About the Author
About the Reviewers

Configuring compute node for Neutron

After we have configured the Neutron network node, we can go ahead and configure our compute nodes to use Neutron networking service.

How to do it...

When the controller and Neutron network node are ready, we can configure Nova-Compute node to use Neutron for networking. We will configure Neutron access to the message broker. Then, we will configure Neutron to use ML2 plugin with GRE tunneling segmentation.

Run the following commands on compute1!

  1. Disable reverse path filtering, Edit /etc/sysctl.conf to contain the following:

    and apply the new configuration:
    [root@compute1 ~]# sysctl -p
  2. Install the Neutron ML2 and Open vSwitch packages:

    [root@compute1 ~]# yum install -y openstack-neutron-ml2 openstack-neutron-openvswitch

Configure message broker

Configure Neutron to use RabbitMQ message broker of the controller:


Remember to change to your controller management IP.

[root@compute1 ~]# openstack-config --set /etc/neutron/neutron.conf DEFAULT rpc_backend rabbit
[root@compute1 ~]# openstack-config --set /etc/neutron/neutron.conf DEFAULT rabbit_host

Configure Neutron service

  1. Configure Neutron to use Keystone as an authentication strategy:

    [root@compute1 ~]# openstack-config --set /etc/neutron/neutron.conf DEFAULTauth_strategy keystone
    [root@compute1 ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken \auth_uri http://controller:5000
    [root@compute1 ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken \auth_host controller
    [root@compute1 ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken \auth_protocol http
    [root@compute1 ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken \auth_port 35357
    [root@compute1 ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken \admin_tenant_name services
    [root@compute1 ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken \admin_user neutron
    [root@compute1 ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken \admin_password password
  2. Now configure Neutron to use ML2 Neutron plugin:

    [root@compute1 ~]# openstack-config --set /etc/neutron/neutron.conf DEFAULT core_plugin ml2
    [root@compute1 ~]# openstack-config --set /etc/neutron/neutron.conf DEFAULT service_plugins router
  3. Configure the ML2 Plugin to use GRE tunneling segregation:

    [root@compute1 ~]# openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2 \type_drivers gre
    [root@compute1 ~]# openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2 \tenant_network_types gre
    [root@compute1 ~]# openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2 \mechanism_drivers openvswitch
    [root@compute1 ~]# openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2_type_gre \tunnel_id_ranges 1:1000
    [root@compute1 ~]# openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ovs \local_ip
    [root@compute1 ~]# openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ovs \tunnel_type gre
    [root@compute1 ~]# openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ovs \enable_tunneling True
    [root@compute1 ~]# openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini securitygroup \firewall_driver neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver
    [root@compute1 ~]# openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini securitygroup \enable_security_group True
  4. Create bridges for Neutron layer 2 and Neutron layer 3 agents. First, start the enable vSwitch service:

    [root@compute1 ~]# systemctl start openvswitch
    [root@compute1 ~]# systemctl enable openvswitch
  5. After starting Open vSwitch service, we can create the needed bridge:

    [root@compute1 ~]# ovs-vsctl add-br br-int
  6. Configure Nova to use Neutron Networking:

    [root@compute1 ~]# openstack-config --set /etc/nova/nova.conf DEFAULT network_api_class
    [root@compute1 ~]# openstack-config --set /etc/nova/nova.conf DEFAULT neutron_url http://controller:9696
    [root@compute1 ~]# openstack-config --set /etc/nova/nova.conf DEFAULT neutron_auth_strategy keystone
    [root@compute1 ~]# openstack-config --set /etc/nova/nova.conf DEFAULT neutron_admin_tenant_name service
    [root@compute1 ~]# openstack-config --set /etc/nova/nova.conf DEFAULT neutron_admin_username neutron
    [root@compute1 ~]# openstack-config --set /etc/nova/nova.conf DEFAULT neutron_admin_password NEUTRON_PASS
    [root@compute1 ~]# openstack-config --set /etc/nova/nova.conf DEFAULT neutron_admin_auth_url http://controller:35357/v2.0
    [root@compute1 ~]# openstack-config --set /etc/nova/nova.conf DEFAULT linuxnet_interface_driver
    [root@compute1 ~]# openstack-config --set /etc/nova/nova.conf DEFAULT firewall_driver nova.virt.firewall.NoopFirewallDriver
    [root@compute1 ~]# openstack-config --set /etc/nova/nova.conf DEFAULT security_group_api neutron
  7. Create a symbolic link for ML2 Neutron plugin:

    [root@compute1 ~]# ln -s plugins/ml2/ml2_conf.ini /etc/neutron/plugin.ini
  8. Restart the Nova-Compute service:

    [root@compute1 ~]# systemctl restart openstack-nova-compute
  9. Start and enable Neutron Open vSwitch agent service:

    [root@compute1 ~]# systemctl start neutron-openvswitch-agent
    [root@compute1 ~]# systemctl enable neutron-openvswitch-agent

Creating Neutron networks

At this point, we should have the controller, Neutron network node, and compute1 configured for using Neutron networking. We can go ahead and create Neutron virtual networks needed for instances to be able to communicate with external public networks. We are going to create two layer 2 networks, one for the instances, and another to connect external networks.

Run the following commands on the controller node!

By default, networks are own and managed by the Admin user, under Admin tenant and shared for other tenants' use.

  1. Source Admin tenant credentials:

    [root@controller ~]# source keystonerc_admin
  2. Create an external shared network:

    [root@controller ~(keystone_admin)]# neutron net-create external-net --shared --router:external=True

    In this example, we allocate a range of IPs from our existing external physical network, for instances to use when communicating with the Internet or with external hosts in the IT environment.

  3. Create a subnet in the newly created network:

    [root@controller ~(keystone_admin)]# neutron subnet-create external-net --name ext-subnet --allocation-pool start=,end= --disable-dhcp --gateway

    The IP range is ought to be routable by the external public network and not overlap with the existing configured networks. Chapter 7, Neutron Networking Service, will further discuss Neutron networks planning.

  4. Create a tenant network, which is an isolated network for instances to inner-communicate:

    [root@controller ~(keystone_admin)]# neutron net-create tenant_net
    [root@controller ~(keystone_admin)]# neutron subnet-create tenant_net --name tenant_net_subnet --gateway
    [root@controller ~(keystone_admin)]# neutron router-create ext-router
    [root@controller ~(keystone_admin)]# neutron router-interface-add ext-router tenant-subnet
    [root@controller ~(keystone_admin)]# neutron router-gateway-set ext-router external-net