前往小程序,Get更优阅读体验!
立即前往
首页
学习
活动
专区
工具
TVP
发布
社区首页 >专栏 >OVN实践

OVN实践

作者头像
惠伟
发布2021-02-24 11:21:09
1.3K0
发布2021-02-24 11:21:09
举报
文章被收录于专栏:虚拟化笔记虚拟化笔记

OVN安装和配置

控制节点

代码语言:javascript
复制
yum install -y openvswitch-ovn-central.x86_64 openvswitch-ovn-common.x86_64 openvswitch-ovn-host.x86_64 openvswitch-ovn-vtep.x86_64
yum install -y python2-networking-ovn.noarch python2-networking-ovn-metadata-agent.noarch python2-networking-ovn-migration-tool.noarch
systemctl start openvswitch
/usr/share/openvswitch/scripts/ovs-ctl start --system-id="random"
ovn-nbctl set-connection ptcp:6641:192.168.56.101 -- set connection . inactivity_probe=60000
ovn-sbctl set-connection ptcp:6642:192.168.56.101 -- set connection . inactivity_probe=60000

#控制节点会运行三个ovs-dbserver,原先的ovs-db, ovn-south-db, ovn-north-db

代码语言:javascript
复制
systemctl start ovn-northd
vim /etc/neutron/neutron.conf
core_plugin = neutron.plugins.ml2.plugin.Ml2Plugin
service_plugins = networking_ovn.l3.l3_ovn.OVNL3RouterPlugin
router_distributed = False
vim /etc/neutron/plug.ini
mechanism_drivers = ovn
[ml2_type_geneve]
vni_ranges = 1:1000
[ovn]
ovn_nb_connection = tcp:192.168.56.101:6641
ovn_sb_connection = tcp:192.168.56.101:6642
ovn_l3_scheduler = leastloaded
代码语言:javascript
复制
neutron-db-manage --subproject networking-ovn upgrade head
systemctl restart neutron-server

计算节点

代码语言:javascript
复制
#计算节点
yum install -y openvswitch-ovn-central.x86_64 openvswitch-ovn-common.x86_64 openvswitch-ovn-host.x86_64 openvswitch-ovn-vtep.x86_64
yum install -y python2-networking-ovn.noarch python2-networking-ovn-metadata-agent.noarch python2-networking-ovn-migration-tool.noarch
/usr/share/openvswitch/scripts/ovs-ctl start --system-id="random"
ovs-vsctl set open . external-ids:ovn-bridge=br-int
ovs-vsctl set open . external-ids:ovn-remote=tcp:192.168.56.101:6642
ovs-vsctl set open . external-ids:ovn-encap-type=geneve,vxlan
ovs-vsctl set open . external-ids:ovn-encap-ip=192.168.2.2
ovs-vsctl set open . external-ids:ovn-cms-options="enable-chassis-as-gw"
ovs-vsctl --may-exist add-br br-provider -- set bridge br-provider protocols=OpenFlow13
ovs-vsctl set open . external-ids:ovn-bridge-mappings=provider:br-provider
ovs-vsctl --may-exist add-port br-provider enp0s9
systemctl start ovn-controller

OVN实验

一个控制节点,两个计算节点,创建一个外网provider,两个内网net0和net1,一个路由器router

再创建两个VM分布在两个计算节点,分别连接到两个内网上,启用securitygroup

研究VM之间互通和VM流量出外网

openstack上信息如下

代码语言:javascript
复制
[root@controller ~]# openstack router list
+--------------------------------------+--------+--------+-------+----------------------------------+
| ID | Name | Status | State | Project |
+--------------------------------------+--------+--------+-------+----------------------------------+
| c9ea1061-4aa5-4a26-8025-ae463b4bd7e4 | router | ACTIVE | UP | 0b7065e7e73a4eb4971bf8a8f2816f2e |
+--------------------------------------+--------+--------+-------+----------------------------------+
[root@controller ~]# openstack network list
+--------------------------------------+----------+--------------------------------------+
| ID | Name | Subnets |
+--------------------------------------+----------+--------------------------------------+
| 4cb371b8-bcff-41cc-8802-40915492fc5f | net1 | cfde54a6-f72f-4dd8-85a6-1abb6af9b3da |
| 772cb643-fb89-4c5b-96db-b3764c791649 | net0 | d0fe607d-e434-43a8-980e-d4c70a8af907 |
| 976e06f0-3573-439d-ac9c-2b7968f145c8 | provider | b05f6bf7-2c1b-4e21-975c-329b73a3775d |
+--------------------------------------+----------+--------------------------------------+
[root@controller ~]# openstack server list
+--------------------------------------+--------------+--------+-------------------------------+--------+---------------+
| ID | Name | Status | Networks | Image | Flavor |
+--------------------------------------+--------------+--------+-------------------------------+--------+---------------+
| d24c09e0-a13a-4863-99fd-713353037dff | cirros-test1 | ACTIVE | net1=192.168.1.93, 10.0.3.201 | cirros | flavor-cirros |
| 3ccddf25-e419-45ce-afe6-873edb85eb05 | cirros-test0 | ACTIVE | net0=192.168.0.207 | cirros | flavor-cirros |
+--------------------------------------+--------------+--------+-------------------------------+--------+---------------+
[root@controller ~]# openstack floating ip list
+--------------------------------------+---------------------+------------------+--------------------------------------+--------------------------------------+----------------------------------+
| ID | Floating IP Address | Fixed IP Address | Port | Floating Network | Project |
+--------------------------------------+---------------------+------------------+--------------------------------------+--------------------------------------+----------------------------------+
| b57bd802-fa4c-48ba-a026-7a711d20dc5c | 10.0.3.201 | 192.168.1.93 | ddd6b73e-9d49-42e0-b09b-94480e8df6c7 | 976e06f0-3573-439d-ac9c-2b7968f145c8 | 0b7065e7e73a4eb4971bf8a8f2816f2e |
+--------------------------------------+---------------------+------------------+--------------------------------------+--------------------------------------+----------------------------------+

分别看NB,SB和ovs中的东西

OVN-NB DB上信息

代码语言:javascript
复制
[root@controller ~]# ovn-nbctl show
switch 3a0ea261-e893-456b-9d44-e16a33f6828d (neutron-4cb371b8-bcff-41cc-8802-40915492fc5f) (aka net1)
    port ae2df452-455d-448e-af5c-a48a92113458
        type: router
        router-port: lrp-ae2df452-455d-448e-af5c-a48a92113458
    port ddd6b73e-9d49-42e0-b09b-94480e8df6c7
        addresses: ["fa:16:3e:a8:5b:17 192.168.1.93", "unknown"]
switch db3de706-68f7-4d3f-980c-912f10396ace (neutron-772cb643-fb89-4c5b-96db-b3764c791649) (aka net0)
    port 6a3f0893-ab71-4ed9-a452-67a32e7ff9e1
        type: router
        router-port: lrp-6a3f0893-ab71-4ed9-a452-67a32e7ff9e1
    port 78f8c183-6654-4590-81ab-a7e35039aa23
        addresses: ["fa:16:3e:55:d6:07 192.168.0.207", "unknown"]
switch de10050a-898e-4cdc-9e36-98e637ef4280 (neutron-976e06f0-3573-439d-ac9c-2b7968f145c8) (aka provider)
    port 7c053b5d-f6f1-42a8-9543-b8dc007df437
        type: router
        addresses: ["router", "unknown"]
        router-port: lrp-7c053b5d-f6f1-42a8-9543-b8dc007df437
    port provnet-976e06f0-3573-439d-ac9c-2b7968f145c8
        type: localnet
        addresses: ["unknown"]
router bf0c7544-7341-414a-b1c5-2883351a8ec6 (neutron-c9ea1061-4aa5-4a26-8025-ae463b4bd7e4) (aka router)
    port lrp-7c053b5d-f6f1-42a8-9543-b8dc007df437
        mac: "fa:16:3e:00:ac:5c"
        networks: ["10.0.3.161/24"]
        gateway chassis: [b79410ba-eb77-48e8-bf0f-efcb08c32227]
    port lrp-6a3f0893-ab71-4ed9-a452-67a32e7ff9e1
        mac: "fa:16:3e:c6:3b:84"
        networks: ["192.168.0.1/24"]
    port lrp-ae2df452-455d-448e-af5c-a48a92113458
        mac: "fa:16:3e:22:79:f8"
        networks: ["192.168.1.1/24"]
    nat 2550fc99-cad7-4635-8436-c26f85cbccd5
        external ip: "10.0.3.201"
        logical ip: "192.168.1.93"
        type: "dnat_and_snat"
    nat 292c56af-a833-41d4-abad-ee6c9a6dd916
        external ip: "10.0.3.161"
        logical ip: "192.168.0.0/24"
        type: "snat"
    nat e85f7b26-7bcd-4b58-ad5e-ba6099aa7c3f
        external ip: "10.0.3.161"
        logical ip: "192.168.1.0/24"
        type: "snat"

[root@controller ~]# ovn-nbctl ls-list
3a0ea261-e893-456b-9d44-e16a33f6828d (neutron-4cb371b8-bcff-41cc-8802-40915492fc5f)
db3de706-68f7-4d3f-980c-912f10396ace (neutron-772cb643-fb89-4c5b-96db-b3764c791649)
de10050a-898e-4cdc-9e36-98e637ef4280 (neutron-976e06f0-3573-439d-ac9c-2b7968f145c8)
[root@controller ~]# ovn-nbctl acl-list 3a0ea261-e893-456b-9d44-e16a33f6828d
[root@controller ~]# ovn-nbctl acl-list db3de706-68f7-4d3f-980c-912f10396ace
[root@controller ~]# ovn-nbctl acl-list de10050a-898e-4cdc-9e36-98e637ef4280
[root@controller ~]# ovn-nbctl qos-list de10050a-898e-4cdc-9e36-98e637ef4280
[root@controller ~]# ovn-nbctl lr-list
bf0c7544-7341-414a-b1c5-2883351a8ec6 (neutron-c9ea1061-4aa5-4a26-8025-ae463b4bd7e4)
[root@controller ~]# ovn-nbctl lr-route-list bf0c7544-7341-414a-b1c5-2883351a8ec6
IPv4 Routes
                0.0.0.0/0                  10.0.3.2 dst-ip
[root@controller ~]# ovn-nbctl lr-nat-list bf0c7544-7341-414a-b1c5-2883351a8ec6
TYPE             EXTERNAL_IP        LOGICAL_IP            EXTERNAL_MAC         LOGICAL_PORT
dnat_and_snat    10.0.3.201         192.168.1.93
snat             10.0.3.161         192.168.1.0/24
snat             10.0.3.161         192.168.0.0/24
[root@controller ~]# ovn-nbctl  dhcp-options-list
2f6405aa-59e3-4dcc-a1ad-e18a0494408a
85daf3cf-0703-4810-a5cc-374dd165c3cd
9a0a3bd6-3dcb-46c4-90a5-043abebb0eb4
[root@controller ~]#

OVN-SB DB

代码语言:javascript
复制
[root@controller ~]# ovn-sbctl show
Chassis "b79410ba-eb77-48e8-bf0f-efcb08c32228"
    hostname: "compute2"
    Encap vxlan
        ip: "192.168.2.3"
        options: {csum="true"}
    Encap geneve
        ip: "192.168.2.3"
        options: {csum="true"}
    Port_Binding "ddd6b73e-9d49-42e0-b09b-94480e8df6c7"
Chassis "b79410ba-eb77-48e8-bf0f-efcb08c32227"
    hostname: "compute1"
    Encap vxlan
        ip: "192.168.2.2"
        options: {csum="true"}
    Encap geneve
        ip: "192.168.2.2"
        options: {csum="true"}
    Port_Binding "78f8c183-6654-4590-81ab-a7e35039aa23"
    Port_Binding "cr-lrp-7c053b5d-f6f1-42a8-9543-b8dc007df437"
[root@controller ~]# ovn-sbctl dump-flows
Datapath: "neutron-4cb371b8-bcff-41cc-8802-40915492fc5f" aka "net1" (0c5826cf-1a88-4ca7-91e0-795a270578f1)  Pipeline: ingress
  table=0 (ls_in_port_sec_l2  ), priority=100  , match=(eth.src[40]), action=(drop;)
  table=0 (ls_in_port_sec_l2  ), priority=100  , match=(vlan.present), action=(drop;)
  table=0 (ls_in_port_sec_l2  ), priority=50   , match=(inport == "ae2df452-455d-448e-af5c-a48a92113458"), action=(next;)
  table=0 (ls_in_port_sec_l2  ), priority=50   , match=(inport == "ddd6b73e-9d49-42e0-b09b-94480e8df6c7"), action=(next;)
  table=1 (ls_in_port_sec_ip  ), priority=0    , match=(1), action=(next;)
  table=2 (ls_in_port_sec_nd  ), priority=0    , match=(1), action=(next;)
  table=3 (ls_in_pre_acl      ), priority=110  , match=(ip && inport == "ae2df452-455d-448e-af5c-a48a92113458"), action=(next;)
  table=3 (ls_in_pre_acl      ), priority=110  , match=(nd || nd_rs || nd_ra || icmp4.type == 3 || icmp6.type == 1 || (tcp && tcp.flags == 4)), action=(next;)
  table=3 (ls_in_pre_acl      ), priority=100  , match=(ip), action=(reg0[0] = 1; next;)

compute1桥和流表

代码语言:javascript
复制
[root@compute1 ~]# ovs-vsctl show
a08c6f9b-b2f9-4378-80d1-c8dbdd02a9e0
    Bridge br-provider
        Port br-provider
            Interface br-provider
                type: internal
        Port "enp0s8"
            Interface "enp0s8"
        Port "patch-provnet-976e06f0-3573-439d-ac9c-2b7968f145c8-to-br-int"
            Interface "patch-provnet-976e06f0-3573-439d-ac9c-2b7968f145c8-to-br-int"
                type: patch
                options: {peer="patch-br-int-to-provnet-976e06f0-3573-439d-ac9c-2b7968f145c8"}
    Bridge br-int
        fail_mode: secure
        Port "patch-br-int-to-provnet-976e06f0-3573-439d-ac9c-2b7968f145c8"
            Interface "patch-br-int-to-provnet-976e06f0-3573-439d-ac9c-2b7968f145c8"
                type: patch
                options: {peer="patch-provnet-976e06f0-3573-439d-ac9c-2b7968f145c8-to-br-int"}
        Port "ovn-b79410-0"
            Interface "ovn-b79410-0"
                type: geneve
                options: {csum="true", key=flow, remote_ip="192.168.2.3"}
        Port br-int
            Interface br-int
                type: internal
        Port "tap78f8c183-66"
            Interface "tap78f8c183-66"
    ovs_version: "2.11.0"
[root@compute1 ~]#
[root@compute1 ~]# ovs-ofctl dump-flows br-int
 cookie=0x0, duration=502952.443s, table=0, n_packets=82, n_bytes=6507, priority=100,in_port="ovn-b79410-0" actions=move:NXM_NX_TUN_ID[0..23]->OXM_OF_METADATA[0..23],move:NXM_NX_TUN_METADATA0[16..30]->NXM_NX_REG14[0..14],move:NXM_NX_TUN_METADATA0[0..15]->NXM_NX_REG15[0..15],resubmit(,33)
 cookie=0x0, duration=3244.330s, table=0, n_packets=53, n_bytes=4620, priority=100,in_port="tap78f8c183-66" actions=load:0xa->NXM_NX_REG13[],load:0x1->NXM_NX_REG11[],load:0x5->NXM_NX_REG12[],load:0x2->OXM_OF_METADATA[],load:0x2->NXM_NX_REG14[],resubmit(,8)
 cookie=0x0, duration=506852.785s, table=0, n_packets=14036, n_bytes=849448, priority=100,in_port="patch-br-int-to",vlan_tci=0x0000/0x1000 actions=load:0x8->NXM_NX_REG13[],load:0x3->NXM_NX_REG11[],load:0x7->NXM_NX_REG12[],load:0x1->OXM_OF_METADATA[],load:0x1->NXM_NX_REG14[],resubmit(,8)
 cookie=0x0, duration=506852.785s, table=0, n_packets=0, n_bytes=0, priority=100,in_port="patch-br-int-to",dl_vlan=0 actions=strip_vlan,load:0x8->NXM_NX_REG13[],load:0x3->NXM_NX_REG11[],load:0x7->NXM_NX_REG12[],load:0x1->OXM_OF_METADATA[],load:0x1->NXM_NX_REG14[],resubmit(,8)
 cookie=0xabb9facf, duration=506852.807s, table=8, n_packets=0, n_bytes=0, priority=100,metadata=0x3,vlan_tci=0x1000/0x1000 actions=drop
 cookie=0xcb7dd5cf, duration=506852.802s, table=8, n_packets=0, n_bytes=0, priority=100,metadata=0x1,vlan_tci=0x1000/0x1000 actions=drop
 cookie=0xd018baf0, duration=3566.794s, table=8, n_packets=0, n_bytes=0, priority=100,metadata=0x2,vlan_tci=0x1000/0x1000 actions=drop
 cookie=0x43bc5840, duration=3556.844s, table=8, n_packets=0, n_bytes=0, priority=100,metadata=0x4,vlan_tci=0x1000/0x1000 actions=drop
 cookie=0x5e54306c, duration=506852.805s, table=8, n_packets=0, n_bytes=0, priority=100,metadata=0x1,dl_src=01:00:00:00:00:00/01:00:00:00:00:00 actions=drop
 cookie=0xabb9facf, duration=506852.803s, table=8, n_packets=0, n_bytes=0, priority=100,metadata=0x3,dl_src=01:00:00:00:00:00/01:00:00:00:00:00 actions=drop
 cookie=0xcc73a6c9, duration=3566.794s, table=8, n_packets=0, n_bytes=0, priority=100,metadata=0x2,dl_src=01:00:00:00:00:00/01:00:00:00:00:00 actions=drop
 cookie=0x920ca92a, duration=3556.844s, table=8, n_packets=0, n_bytes=0, priority=100,metadata=0x4,dl_src=01:00:00:00:00:00/01:00:00:00:00:00 actions=drop
 cookie=0x9bb23761, duration=506852.804s, table=8, n_packets=316, n_bytes=24459, priority=50,reg14=0x2,metadata=0x1 actions=resubmit(,9)
 cookie=0xa869d55f, duration=506852.803s, table=8, n_packets=14036, n_bytes=849448, priority=50,reg14=0x1,metadata=0x1 actions=resubmit(,9)

compute2桥和流表

代码语言:javascript
复制
[root@compute2 ~]# ovs-vsctl show
18c8dc91-b0a8-434f-a46a-4fd3ab59e986
    Bridge br-provider
        Port br-provider
            Interface br-provider
                type: internal
        Port "patch-provnet-976e06f0-3573-439d-ac9c-2b7968f145c8-to-br-int"
            Interface "patch-provnet-976e06f0-3573-439d-ac9c-2b7968f145c8-to-br-int"
                type: patch
                options: {peer="patch-br-int-to-provnet-976e06f0-3573-439d-ac9c-2b7968f145c8"}
        Port "enp0s9"
            Interface "enp0s9"
    Bridge br-int
        fail_mode: secure
        Port "ovn-b79410-0"
            Interface "ovn-b79410-0"
                type: geneve
                options: {csum="true", key=flow, remote_ip="192.168.2.2"}
        Port "tapddd6b73e-9d"
            Interface "tapddd6b73e-9d"
        Port "patch-br-int-to-provnet-976e06f0-3573-439d-ac9c-2b7968f145c8"
            Interface "patch-br-int-to-provnet-976e06f0-3573-439d-ac9c-2b7968f145c8"
                type: patch
                options: {peer="patch-provnet-976e06f0-3573-439d-ac9c-2b7968f145c8-to-br-int"}
        Port br-int
            Interface br-int
                type: internal
    ovs_version: "2.11.0"
[root@compute2 ~]#
[root@compute2 ~]# ovs-ofctl dump-flows -O OpenFlow13 br-provider
 cookie=0x0, duration=503290.470s, table=0, n_packets=152, n_bytes=9196, priority=0 actions=NORMAL
[root@compute2 ~]# ovs-ofctl dump-flows -O OpenFlow13 br-int
 cookie=0x0, duration=503307.117s, table=0, n_packets=72, n_bytes=6030, priority=100,in_port="ovn-b79410-0" actions=move:NXM_NX_TUN_ID[0..23]->OXM_OF_METADATA[0..23],move:NXM_NX_TUN_METADATA0[16..30]->NXM_NX_REG14[0..14],move:NXM_NX_TUN_METADATA0[0..15]->NXM_NX_REG15[0..15],resubmit(,33)
 cookie=0x0, duration=3530.312s, table=0, n_packets=51, n_bytes=4424, priority=100,in_port="tapddd6b73e-9d" actions=set_field:0x1->reg13,set_field:0x4->reg11,set_field:0x3->reg12,set_field:0x4->metadata,set_field:0x2->reg14,resubmit(,8)
 cookie=0x0, duration=3530.313s, table=0, n_packets=152, n_bytes=9196, priority=100,in_port="patch-br-int-to",vlan_tci=0x0000/0x1000 actions=set_field:0x8->reg13,set_field:0x6->reg11,set_field:0xa->reg12,set_field:0x1->metadata,set_field:0x1->reg14,resubmit(,8)
 cookie=0x0, duration=3530.313s, table=0, n_packets=0, n_bytes=0, priority=100,in_port="patch-br-int-to",dl_vlan=0 actions=pop_vlan,set_field:0x8->reg13,set_field:0x6->reg11,set_field:0xa->reg12,set_field:0x1->metadata,set_field:0x1->reg14,resubmit(,8)
 cookie=0xabb9facf, duration=3530.268s, table=8, n_packets=0, n_bytes=0, priority=100,metadata=0x3,vlan_tci=0x1000/0x1000 actions=drop
 cookie=0xd018baf0, duration=3530.265s, table=8, n_packets=0, n_bytes=0, priority=100,metadata=0x2,vlan_tci=0x1000/0x1000 actions=drop
 cookie=0xcb7dd5cf, duration=3530.261s, table=8, n_packets=0, n_bytes=0, priority=100,metadata=0x1,vlan_tci=0x1000/0x1000 actions=drop
 cookie=0x43bc5840, duration=3530.261s, table=8, n_packets=0, n_bytes=0, priority=100,metadata=0x4,vlan_tci=0x1000/0x1000 actions=drop
 cookie=0x5e54306c, duration=3530.264s, table=8, n_packets=0, n_bytes=0, priority=100,metadata=0x1,dl_src=01:00:00:00:00:00/01:00:00:00:00:00 actions=drop
 cookie=0xabb9facf, duration=3530.263s, table=8, n_packets=0, n_bytes=0, priority=100,metadata=0x3,dl_src=01:00:00:00:00:00/01:00:00:00:00:00 actions=drop
 cookie=0xcc73a6c9, duration=3530.263s, table=8, n_packets=0, n_bytes=0, priority=100,metadata=0x2,dl_src=01:00:00:00:00:00/01:00:00:00:00:00 actions=drop
 cookie=0x920ca92a, duration=3530.261s, table=8, n_packets=0, n_bytes=0, priority=100,metadata=0x4,dl_src=01:00:00:00:00:00/01:00:00:00:00:00 actions=drop
 cookie=0xd70a9258, duration=3530.269s, table=8, n_packets=2, n_bytes=196, priority=50,reg14=0x1,metadata=0x2 actions=resubmit(,9)
 cookie=0x9bb23761, duration=3530.264s, table=8, n_packets=0, n_bytes=0, priority=50,reg14=0x2,metadata=0x1 actions=resubmit(,9)

由于ovn logical flow和ovs flow太多了,只粘贴了部分,大家感受一下,ovn和openstack原来的agent相比流表爆发性增长,因为所有的功能都用流表实现了。

本文参与 腾讯云自媒体同步曝光计划,分享自作者个人站点/博客。
如有侵权请联系 cloudcommunity@tencent.com 删除

本文分享自 作者个人站点/博客 前往查看

如有侵权,请联系 cloudcommunity@tencent.com 删除。

本文参与 腾讯云自媒体同步曝光计划  ,欢迎热爱写作的你一起参与!

评论
登录后参与评论
0 条评论
热度
最新
推荐阅读
目录
  • OVN安装和配置
  • 控制节点
  • 计算节点
  • OVN实验
领券
问题归档专栏文章快讯文章归档关键词归档开发者手册归档开发者手册 Section 归档