OpenStack Epoxy : Neutron Network (Geneve) |
Configure virtual networking by OpenStack Network Service (Neutron). For example, configure Geneve type of networking on here. Furthermore, this example is based on the environment that Network Node and Compute Node have 2 network interfaces. ------------+--------------------------+--------------------------+------------
| | |
eth0|10.0.0.30 eth0|10.0.0.50 eth0|10.0.0.51
+-----------+-----------+ +-----------+-----------+ +-----------+-----------+
| [ dlp.srv.world ] | | [ network.srv.world ] | | [ node01.srv.world ] |
| (Control Node) | | (Network Node) | | (Compute Node) |
| | | | | |
| MariaDB RabbitMQ | | Open vSwitch | | Libvirt |
| Memcached Nginx | | Neutron Server | | Nova Compute |
| Keystone httpd | | OVN-Northd | | Open vSwitch |
| Glance Nova API | | Nginx | | OVN Metadata Agent |
| | | | | OVN-Controller |
+-----------------------+ +-----------+-----------+ +-----------+-----------+
eth1|(UP with no IP) eth1|(UP with no IP)
|
| [1] | Configure bridge mappings on both Network Node and Compute Node. |
# add bridge (any name you like for [br-eth1]) root@network:~# ovs-vsctl add-br br-eth1 # add a port to the bridge # replace [eth1] to your own environment root@network:~# ovs-vsctl add-port br-eth1 eth1 # map [physnet1] to the bridge (any name you like for [physnet1]) root@network:~# ovs-vsctl set open . external-ids:ovn-bridge-mappings=physnet1:br-eth1 |
| [2] | Create a Virtual router. It's OK to work on any node. (This example is on Control Node) |
| root@dlp ~(keystone)# openstack router create router01 +---------------------------+--------------------------------------+ | Field | Value | +---------------------------+--------------------------------------+ | admin_state_up | UP | | availability_zone_hints | | | availability_zones | | | created_at | 2025-08-29T04:03:33Z | | description | | | enable_default_route_bfd | False | | enable_default_route_ecmp | False | | enable_ndp_proxy | None | | external_gateway_info | null | | external_gateways | [] | | flavor_id | None | | ha | True | | id | a2f2c760-49e8-4a82-8ccb-d10c22b66d78 | | name | router01 | | project_id | d5ba291bfcdc4f8982cf5c28922f56be | | revision_number | 1 | | routes | | | status | ACTIVE | | tags | | | tenant_id | d5ba291bfcdc4f8982cf5c28922f56be | | updated_at | 2025-08-29T04:03:33Z | +---------------------------+--------------------------------------+ |
| [3] | Create internal network and associate with the router above. |
# create internal network root@dlp ~(keystone)# openstack network create private --provider-network-type geneve +---------------------------+--------------------------------------+ | Field | Value | +---------------------------+--------------------------------------+ | admin_state_up | UP | | availability_zone_hints | | | availability_zones | | | created_at | 2025-08-29T04:03:58Z | | description | | | dns_domain | None | | id | d442015a-b6f6-4349-890b-c08eb5366a4d | | ipv4_address_scope | None | | ipv6_address_scope | None | | is_default | None | | is_vlan_qinq | None | | is_vlan_transparent | None | | mtu | 1442 | | name | private | | port_security_enabled | True | | project_id | d5ba291bfcdc4f8982cf5c28922f56be | | provider:network_type | geneve | | provider:physical_network | None | | provider:segmentation_id | 52884 | | qos_policy_id | None | | revision_number | 1 | | router:external | Internal | | segments | None | | shared | False | | status | ACTIVE | | subnets | | | tags | | | updated_at | 2025-08-29T04:03:58Z | +---------------------------+--------------------------------------+ # create subnet in the internal network root@dlp ~(keystone)# openstack subnet create private-subnet --network private \ --subnet-range 192.168.100.0/24 --gateway 192.168.100.1 \ --dns-nameserver 10.0.0.10 +----------------------+--------------------------------------+ | Field | Value | +----------------------+--------------------------------------+ | allocation_pools | 192.168.100.2-192.168.100.254 | | cidr | 192.168.100.0/24 | | created_at | 2025-08-29T04:04:30Z | | description | | | dns_nameservers | 10.0.0.10 | | dns_publish_fixed_ip | None | | enable_dhcp | True | | gateway_ip | 192.168.100.1 | | host_routes | | | id | bb5efd0a-ea4d-42ee-99ca-97cee2f56ca2 | | ip_version | 4 | | ipv6_address_mode | None | | ipv6_ra_mode | None | | name | private-subnet | | network_id | d442015a-b6f6-4349-890b-c08eb5366a4d | | project_id | d5ba291bfcdc4f8982cf5c28922f56be | | revision_number | 0 | | router:external | False | | segment_id | None | | service_types | | | subnetpool_id | None | | tags | | | updated_at | 2025-08-29T04:04:30Z | +----------------------+--------------------------------------+ # set internal network to the router above root@dlp ~(keystone)# openstack router add subnet router01 private-subnet |
| [4] | Create external network and associate with the router above. |
# create external network root@dlp ~(keystone)# openstack network create \ --provider-physical-network physnet1 \ --provider-network-type flat --external public +---------------------------+--------------------------------------+ | Field | Value | +---------------------------+--------------------------------------+ | admin_state_up | UP | | availability_zone_hints | | | availability_zones | | | created_at | 2025-08-29T04:04:56Z | | description | | | dns_domain | None | | id | 7de3878f-814f-4909-b4e6-d4dc1c740577 | | ipv4_address_scope | None | | ipv6_address_scope | None | | is_default | False | | is_vlan_qinq | None | | is_vlan_transparent | None | | mtu | 1500 | | name | public | | port_security_enabled | True | | project_id | d5ba291bfcdc4f8982cf5c28922f56be | | provider:network_type | flat | | provider:physical_network | physnet1 | | provider:segmentation_id | None | | qos_policy_id | None | | revision_number | 1 | | router:external | External | | segments | None | | shared | False | | status | ACTIVE | | subnets | | | tags | | | updated_at | 2025-08-29T04:04:56Z | +---------------------------+--------------------------------------+ # create subnet in the external network root@dlp ~(keystone)# openstack subnet create public-subnet \ --network public --subnet-range 10.0.0.0/24 \ --allocation-pool start=10.0.0.200,end=10.0.0.254 \ --gateway 10.0.0.1 --dns-nameserver 10.0.0.10 --no-dhcp +----------------------+--------------------------------------+ | Field | Value | +----------------------+--------------------------------------+ | allocation_pools | 10.0.0.200-10.0.0.254 | | cidr | 10.0.0.0/24 | | created_at | 2025-08-29T04:05:27Z | | description | | | dns_nameservers | 10.0.0.10 | | dns_publish_fixed_ip | None | | enable_dhcp | False | | gateway_ip | 10.0.0.1 | | host_routes | | | id | 319013fd-5412-4cce-bb87-49f5a0c91b0e | | ip_version | 4 | | ipv6_address_mode | None | | ipv6_ra_mode | None | | name | public-subnet | | network_id | 7de3878f-814f-4909-b4e6-d4dc1c740577 | | project_id | d5ba291bfcdc4f8982cf5c28922f56be | | revision_number | 0 | | router:external | True | | segment_id | None | | service_types | | | subnetpool_id | None | | tags | | | updated_at | 2025-08-29T04:05:27Z | +----------------------+--------------------------------------+ # set gateway to the router above root@dlp ~(keystone)# openstack router set router01 --external-gateway public |
| [5] | By default, it's possible to access for all projects to external network only, but for internal network, only [admin] projects can access to it, so grant access permission of internal network to a project you'd like to let users in the project use. |
# show network RBAC list root@dlp ~(keystone)# openstack network rbac list +--------------------------------------+-------------+--------------------------------------+ | ID | Object Type | Object ID | +--------------------------------------+-------------+--------------------------------------+ | d715df6f-1875-464a-9436-b26a1ca673b3 | network | 7de3878f-814f-4909-b4e6-d4dc1c740577 | +--------------------------------------+-------------+--------------------------------------+ # RBAC details # all projects can access only to [access_as_external] root@dlp ~(keystone)# openstack network rbac show d715df6f-1875-464a-9436-b26a1ca673b3 +-------------------+--------------------------------------+ | Field | Value | +-------------------+--------------------------------------+ | action | access_as_external | | id | d715df6f-1875-464a-9436-b26a1ca673b3 | | object_id | 7de3878f-814f-4909-b4e6-d4dc1c740577 | | object_type | network | | project_id | d5ba291bfcdc4f8982cf5c28922f56be | | target_project_id | * | +-------------------+--------------------------------------+ # show network list root@dlp ~(keystone)# openstack network list +--------------------------------------+---------+--------------------------------------+ | ID | Name | Subnets | +--------------------------------------+---------+--------------------------------------+ | 7de3878f-814f-4909-b4e6-d4dc1c740577 | public | 319013fd-5412-4cce-bb87-49f5a0c91b0e | | d442015a-b6f6-4349-890b-c08eb5366a4d | private | bb5efd0a-ea4d-42ee-99ca-97cee2f56ca2 | +--------------------------------------+---------+--------------------------------------+ # show project list root@dlp ~(keystone)# openstack project list +----------------------------------+-----------+ | ID | Name | +----------------------------------+-----------+ | a60814a6c56241edbbdfae6c290f8abc | service | | d5ba291bfcdc4f8982cf5c28922f56be | admin | | ecfa98ba82de421e8f16c3d862b5ab04 | hiroshima | +----------------------------------+-----------+ # grant [access_as_shared] permission for [private] to [hiroshima] project root@dlp ~(keystone)# netID=$(openstack network list | grep private | awk '{ print $2 }') root@dlp ~(keystone)# prjID=$(openstack project list | grep hiroshima | awk '{ print $2 }') root@dlp ~(keystone)# openstack network rbac create --target-project $prjID --type network --action access_as_shared $netID +-------------------+--------------------------------------+ | Field | Value | +-------------------+--------------------------------------+ | action | access_as_shared | | id | ee0bec57-7cd4-4d9d-b509-2e05fd3165c1 | | object_id | d442015a-b6f6-4349-890b-c08eb5366a4d | | object_type | network | | project_id | d5ba291bfcdc4f8982cf5c28922f56be | | target_project_id | ecfa98ba82de421e8f16c3d862b5ab04 | +-------------------+--------------------------------------+ |
| [6] | Login with a user who is in the project you granted access permission to internal network and Create and boot an instance. |
# confirm available [flavor] list debian@dlp ~(keystone)$ openstack flavor list +----+-----------+-------+------+-----------+-------+-----------+ | ID | Name | RAM | Disk | Ephemeral | VCPUs | Is Public | +----+-----------+-------+------+-----------+-------+-----------+ | 1 | m1.tiny | 2048 | 10 | 0 | 1 | True | | 2 | m1.small | 4096 | 10 | 0 | 2 | True | | 3 | m1.medium | 8192 | 10 | 0 | 4 | True | | 4 | m1.large | 16384 | 10 | 0 | 8 | True | | 5 | m2.medium | 8192 | 10 | 10 | 4 | True | +----+-----------+-------+------+-----------+-------+-----------+ # confirm available image list debian@dlp ~(keystone)$ openstack image list +--------------------------------------+----------+--------+ | ID | Name | Status | +--------------------------------------+----------+--------+ | 33def798-3361-483b-9de1-8c2c6e1c840c | Debian13 | active | +--------------------------------------+----------+--------+ # confirm available network list debian@dlp ~(keystone)$ openstack network list +--------------------------------------+---------+--------------------------------------+ | ID | Name | Subnets | +--------------------------------------+---------+--------------------------------------+ | 7de3878f-814f-4909-b4e6-d4dc1c740577 | public | 319013fd-5412-4cce-bb87-49f5a0c91b0e | | d442015a-b6f6-4349-890b-c08eb5366a4d | private | bb5efd0a-ea4d-42ee-99ca-97cee2f56ca2 | +--------------------------------------+---------+--------------------------------------+ # create a security group for instances debian@dlp ~(keystone)$ openstack security group create secgroup01 +-----------------+----------------------------------------------------------------------------+ | Field | Value | +-----------------+----------------------------------------------------------------------------+ | created_at | 2025-08-29T04:08:38Z | | description | secgroup01 | | id | 8af05d75-dc3a-4e53-a3ab-dd5dfeb3981b | | name | secgroup01 | | project_id | ecfa98ba82de421e8f16c3d862b5ab04 | | revision_number | 1 | | rules | created_at='2025-08-29T04:08:38Z', direction='egress', ethertype='IPv6', | | | id='661fd48f-5a44-4d78-abb8-4226634fe91d', standard_attr_id='28', updat... | | | created_at='2025-08-29T04:08:38Z', direction='egress', ethertype='IPv4', | | | id='66214b0b-6eb5-4c24-a6d0-7779afcd222d', standard_attr_id='29', updat... | | shared | False | | stateful | True | | tags | [] | | updated_at | 2025-08-29T04:08:38Z | +-----------------+----------------------------------------------------------------------------+ # create an SSH keypair for connecting to instances debian@dlp ~(keystone)$ ssh-keygen -q -N "" Enter file in which to save the key (/home/debian/.ssh/id_ed25519): # add public-key debian@dlp ~(keystone)$ openstack keypair create --public-key ~/.ssh/id_ed25519.pub mykey +-------------+-------------------------------------------------+ | Field | Value | +-------------+-------------------------------------------------+ | created_at | None | | fingerprint | d1:8a:af:7b:8f:fb:ff:2e:b7:82:df:c6:e7:be:e6:b1 | | id | mykey | | is_deleted | None | | name | mykey | | type | ssh | | user_id | da64c3c335434563b66eb2e8af260392 | +-------------+-------------------------------------------------+debian@dlp ~(keystone)$ netID=$(openstack network list | grep private | awk '{ print $2 }') debian@dlp ~(keystone)$ debian@dlp ~(keystone)$ openstack server create --flavor m1.small --image Debian13 --security-group secgroup01 --nic net-id=$netID --key-name mykey Debian-13 openstack server list +--------------------------------------+-----------+--------+------------------------+----------+----------+ | ID | Name | Status | Networks | Image | Flavor | +--------------------------------------+-----------+--------+------------------------+----------+----------+ | 2deabceb-e220-4e5c-b8dd-320683d0bf0b | Debian-13 | ACTIVE | private=192.168.100.39 | Debian13 | m1.small | +--------------------------------------+-----------+--------+------------------------+----------+----------+ |
| [7] | Assign floating IP address to the Instance above. |
| debian@dlp ~(keystone)$ openstack floating ip create public +---------------------+--------------------------------------+ | Field | Value | +---------------------+--------------------------------------+ | created_at | 2025-08-29T04:27:17Z | | description | | | dns_domain | | | dns_name | | | fixed_ip_address | None | | floating_ip_address | 10.0.0.249 | | floating_network_id | 7de3878f-814f-4909-b4e6-d4dc1c740577 | | id | 96b3461a-872e-4440-9b91-842b2205f342 | | name | 10.0.0.249 | | port_details | None | | port_id | None | | project_id | ecfa98ba82de421e8f16c3d862b5ab04 | | qos_policy_id | None | | revision_number | 0 | | router_id | None | | status | DOWN | | subnet_id | None | | tags | [] | | updated_at | 2025-08-29T04:27:17Z | +---------------------+--------------------------------------+ debian@dlp ~(keystone)$ openstack server add floating ip Debian-13 10.0.0.249 # confirm settings debian@dlp ~(keystone)$ openstack floating ip show 10.0.0.249 +---------------------+---------------------------------------------------------------------------+ | Field | Value | +---------------------+---------------------------------------------------------------------------+ | created_at | 2025-08-29T04:27:17Z | | description | | | dns_domain | | | dns_name | | | fixed_ip_address | 192.168.100.39 | | floating_ip_address | 10.0.0.249 | | floating_network_id | 7de3878f-814f-4909-b4e6-d4dc1c740577 | | id | 96b3461a-872e-4440-9b91-842b2205f342 | | name | 10.0.0.249 | | port_details | admin_state_up='True', device_id='2deabceb-e220-4e5c-b8dd-320683d0bf0b... | | | mac_address='fa:16:3e:1b:10:e8', name='', network_id='d442015a-b6f6-43... | | | status='ACTIVE' | | port_id | 425dc12b-6712-47eb-a850-61efb89956fb | | project_id | ecfa98ba82de421e8f16c3d862b5ab04 | | qos_policy_id | None | | revision_number | 2 | | router_id | a2f2c760-49e8-4a82-8ccb-d10c22b66d78 | | status | ACTIVE | | subnet_id | None | | tags | [] | | updated_at | 2025-08-29T04:27:44Z | +---------------------+---------------------------------------------------------------------------+debian@dlp ~(keystone)$ openstack server list +--------------------------------------+-----------+--------+------------------------------------+----------+----------+ | ID | Name | Status | Networks | Image | Flavor | +--------------------------------------+-----------+--------+------------------------------------+----------+----------+ | 2deabceb-e220-4e5c-b8dd-320683d0bf0b | Debian-13 | ACTIVE | private=10.0.0.249, 192.168.100.39 | Debian13 | m1.small | +--------------------------------------+-----------+--------+------------------------------------+----------+----------+ |
| [8] | Configure security settings for the security group you created above to access with SSH and ICMP. |
# permit ICMP debian@dlp ~(keystone)$ openstack security group rule create --protocol icmp --ingress secgroup01 +-------------------------+--------------------------------------+ | Field | Value | +-------------------------+--------------------------------------+ | belongs_to_default_sg | False | | created_at | 2025-08-29T04:12:50Z | | description | | | direction | ingress | | ether_type | IPv4 | | id | bf1018b5-e1b4-47bb-9954-ffb9efb2cef9 | | name | None | | normalized_cidr | 0.0.0.0/0 | | port_range_max | None | | port_range_min | None | | project_id | ecfa98ba82de421e8f16c3d862b5ab04 | | protocol | icmp | | remote_address_group_id | None | | remote_group_id | None | | remote_ip_prefix | 0.0.0.0/0 | | revision_number | 0 | | security_group_id | 8af05d75-dc3a-4e53-a3ab-dd5dfeb3981b | | tags | [] | | updated_at | 2025-08-29T04:12:50Z | +-------------------------+--------------------------------------+ # permit SSH debian@dlp ~(keystone)$ openstack security group rule create --protocol tcp --dst-port 22:22 secgroup01 +-------------------------+--------------------------------------+ | Field | Value | +-------------------------+--------------------------------------+ | belongs_to_default_sg | False | | created_at | 2025-08-29T04:13:05Z | | description | | | direction | ingress | | ether_type | IPv4 | | id | 82db8c6f-57eb-4450-8c39-c4327c35721d | | name | None | | normalized_cidr | 0.0.0.0/0 | | port_range_max | 22 | | port_range_min | 22 | | project_id | ecfa98ba82de421e8f16c3d862b5ab04 | | protocol | tcp | | remote_address_group_id | None | | remote_group_id | None | | remote_ip_prefix | 0.0.0.0/0 | | revision_number | 0 | | security_group_id | 8af05d75-dc3a-4e53-a3ab-dd5dfeb3981b | | tags | [] | | updated_at | 2025-08-29T04:13:05Z | +-------------------------+--------------------------------------+debian@dlp ~(keystone)$ openstack security group rule list secgroup01 +--------------------+-------------+-----------+-----------+------------+-----------+-----------------------+----------------------+ | ID | IP Protocol | Ethertype | IP Range | Port Range | Direction | Remote Security Group | Remote Address Group | +--------------------+-------------+-----------+-----------+------------+-----------+-----------------------+----------------------+ | 661fd48f-5a44- | None | IPv6 | ::/0 | | egress | None | None | | 4d78-abb8- | | | | | | | | | 4226634fe91d | | | | | | | | | 66214b0b-6eb5- | None | IPv4 | 0.0.0.0/0 | | egress | None | None | | 4c24-a6d0- | | | | | | | | | 7779afcd222d | | | | | | | | | 82db8c6f-57eb- | tcp | IPv4 | 0.0.0.0/0 | 22:22 | ingress | None | None | | 4450-8c39- | | | | | | | | | c4327c35721d | | | | | | | | | bf1018b5-e1b4- | icmp | IPv4 | 0.0.0.0/0 | | ingress | None | None | | 47bb-9954- | | | | | | | | | ffb9efb2cef9 | | | | | | | | +--------------------+-------------+-----------+-----------+------------+-----------+-----------------------+----------------------+ |
| [9] | It's possible to login to the Instance to connect to the floating IP address with SSH like follows. |
| debian@dlp ~(keystone)$ openstack server list +--------------------------------------+-----------+--------+------------------------------------+----------+----------+ | ID | Name | Status | Networks | Image | Flavor | +--------------------------------------+-----------+--------+------------------------------------+----------+----------+ | 2deabceb-e220-4e5c-b8dd-320683d0bf0b | Debian-13 | ACTIVE | private=10.0.0.249, 192.168.100.39 | Debian13 | m1.small | +--------------------------------------+-----------+--------+------------------------------------+----------+----------+debian@dlp ~(keystone)$ ssh debian@10.0.0.249 The authenticity of host '10.0.0.249 (10.0.0.249)' can't be established. ED25519 key fingerprint is SHA256:k+MDvtDQeK2XnNIpRuKKYwAceFneDG+unTAEEiB78Us. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '10.0.0.249' (ED25519) to the list of known hosts. Linux debian-13 6.12.41+deb13-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.12.41-1 (2025-08-12) x86_64 The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. debian@debian-13:~$ # logined |
Matched Content
No comments:
Post a Comment