1. 2. 2015 CiscoLive! OpenStack Lab LABCLD2225 January 2630,2015 Milan,Italy Deploying a Private Cloud using OpenStack with Cisco Plugin LABCLD2225 Lab Manual http://openstack.ciscolive.com/printable.php?pod=3 1/180 1. 2. 2015 CiscoLive! OpenStack Lab LABCLD2225 What is OpenStack? OpenStack is an opensource cloud operating system designed to control large pools of compute, storage, and network resources. OpenStack began in 2010 as a joint project of Rackspace and NASA and is currently managed by the OpenStack Foundation. Hundreds of companies now participate in the project, developing drivers and components to interact with their products as well as contributing new features that benefit the entire OpenStack community. The community collaborates on 6month release cycles. The latest release that will be used for this lab is named the Juno release. OpenStack enables application developers to quickly provision the compute, storage, and network resources they need to develop and deploy their application without the need for intervention from the IT organization. In many ways, OpenStack was a direct response to the success of Amazon Web Services for customers who wanted the ability to create a similar development environment without having to use Amazon's services. OpenStack has a modular architecture for which each component has specific function. The following is a list of some of the core OpenStack components: Component Function Nova Compute Cinder Block storage Neutron Networking Keystone Identity Services Horizon Dashboard / Web GUI Glance Image Service The focus on this lab will be in familiarizing you with OpenStack with emphasis on the networking component (Neutron) and Cisco products. http://openstack.ciscolive.com/printable.php?pod=3 2/180 1. 2. 2015 CiscoLive! OpenStack Lab LABCLD2225 OpenStack Networking (Neutron) Pluggable, scalable, APIdriven network and IP management Today's datacenter networks contain more devices than ever before. Servers, network equipment, storage systems and security appliances — many of which are further divided into virtual machines and virtual networks. The number of IP addresses, routing configurations and security rules can quickly grow into the millions. Traditional network management techniques fall short of providing a truly scalable, automated approach to managing these nextgeneration networks. At the same time, users expect more control and flexibility with quicker provisioning. OpenStack Networking is a pluggable, scalable and APIdriven system for managing networks and IP addresses. Like other aspects of the cloud operating system, it can be used by administrators and users to increase the value of existing datacenter assets. OpenStack Networking ensures the network will not be the bottleneck or limiting factor in a cloud deployment and gives users real self service, even over their network configurations and topologies. Networking Capabilities OpenStack provides flexible networking models to suit the needs of different applications or user groups. Standard models include flat networks or VLANs for separation of servers and traffic or overlay technologies such as GRE tunnels or VXLAN encapsulation. OpenStack Networking manages IP addresses, allowing for dedicated static IPs or DHCP. Floating IPs provide a layer of abstraction between public IP addresses and private addresses. A Floating IP is essentially a static NAT translation. Because the application virtual machines (Instances) have private addresses, Floating IPs allow traffic to be dynamically rerouted to a different compute resource. This allows users to redirect traffic during maintenance or in the case of failure. Users can create their own networks, control traffic and connect servers and devices to one or more networks. The pluggable backend architecture lets users take advantage of commodity hardware or advanced networking services from supported vendors. Administrators can take advantage of softwaredefined networking (SDN) technology like OpenFlow to allow for high levels of multitenancy and massive scale. OpenStack Networking has an extension framework allowing additional network http://openstack.ciscolive.com/printable.php?pod=3 3/180 It is designed to manage and automate pools of compute resources and can work with widely available virtualization technologies. Flexible Architecture OpenStack is architected to provide flexibility as you design your cloud.1.ciscolive. Compute resources are accessible via APIs for developers building cloud applications and via web interfaces for administrators and users. enabling the cloud economics companies have come to expect. with no proprietary hardware or software requirements and the ability to integrate with legacy systems and third party technologies. as well as bare metal and highperformance computing (HPC) configurations. Popular Use Cases Service providers offering an IaaS or PaaS platform or delivering SaaS with OpenStack as the underlying infrastructure for the software IT departments acting as cloud service providers for business units and project teams Processing big data with tools like Hadoop Scaling compute up and down to meet demand for web resources and applications Highperformance computing (HPC) environments processing diverse and http://openstack. Administrators often deploy OpenStack Compute using one of multiple supported hypervisors in a virtualized environment. OpenStack Compute (Nova) Provision and manage large networks of virtual machines The OpenStack cloud operating system enables enterprises and service providers to offer ondemand computing resources. by provisioning and managing large networks of virtual machines. OpenStack supports ARM and alternative hardware architectures. KVM and XenServer are the most popular choices for hypervisor technology and recommended for most use cases. 2. 2015 CiscoLive! OpenStack Lab LABCLD2225 services.php?pod=3 4/180 . load balancing. The compute architecture is designed to scale horizontally on standard hardware.com/printable. firewalls and virtual private networks (VPN) to be deployed and managed as a service. In addition to different hypervisors. such as intrusion detection systems (IDS). 1.com/printable.openstack. 2.php?pod=3 5/180 .openstack. VLAN security features) DHCP.org/software/openstackshared services/) (to make it easy for you to spin up new standardized VMs) Live VM management Increase productivity with lifecycle management Run. (from a single user interface and using the APIs) resize.org/software/openstacknetworking/) .org/software/openstack dashboard/) . reboot. disk. import. 2015 CiscoLive! OpenStack Lab LABCLD2225 intensive workloads Learn more about OpenStack's storage (http://www.openstack. terminate instances Floating IP addresses Ability to assign (and reassign) IP addresses to VMs http://openstack. and network interfaces Manage Local Area Programmatically allocate IPs and VLANs Networks (LAN) (for rapid provisioning of network capabilities and Flat.org/software/openstack storage/) and networking (http://www. IPv6 Flexible networking models (http://www. Flat DHCP. memory. or take a tour of the dashboard (http://www.openstack. suspend. share. Feature Benefit Manage virtualized Racks of commodity servers as pools of computing commodity server Improved utilization and automation of resources for resources greater cost efficiencies CPU.openstack. Features & Benefits The features below are available in the current release.ciscolive.org/software/openstack networking/) to suit needs of each application and/or user group API with rate limiting Designed for automation and security and authentication (to make it easy for you to manage who has access to compute resources and prevent users from impacting each other with excessive API utilization) Distributed and Massively scalable and highly available system asynchronous (for increased assurance of system uptime) architecture Virtual Machine (VM) Easily store. and query images image management (http://www. APIaccessible storage platform that can be integrated directly into http://openstack. track and limit resource utilization VNC Proxy through Quick and easy CLI administration web browser Store and Manage files Automates resource management/provisioning programmatically via API VM Image Caching on Faster provisioning of VMs compute nodes Least privileged access Root access separation for management & services design Dashboard with fully Learn more about the OpenStack Dashboard integrated support for (http://www. Object Storage is ideal for cost effective.openstack.org/software/openstack selfservice dashboard/) provisioning OpenStack Storage (Cinder & Swift) Object and Block storage for use with servers and applications In addition to traditional enterpriseclass storage technology. 2015 CiscoLive! OpenStack Lab LABCLD2225 Security Groups Flexibility to assign and control access to VM instances by creating separation between resource pools Role Based Access Ensure security by user. many organizations now have a variety of storage needs with varying performance and price requirements. with many deployment options for each depending on the use case. role and project Control (RBAC) Projects & Quotas Ability to allocate. 2.com/printable.ciscolive.1.php?pod=3 6/180 . It provides a fully distributed. OpenStack has support for both Object Storage and Block Storage. scaleout storage. Block storage is appropriate for performance sensitive scenarios such as database storage. backups and archives. SolidFire. 2015 CiscoLive! OpenStack Lab LABCLD2225 applications or used for backup. Objects and files are written to multiple disk drives spread throughout servers in the data center. Block Storage Capabilities (Cinder) OpenStack provides persistent block level storage devices for use with OpenStack compute instances. email storage. Nexenta. Block storage volumes are fully integrated into OpenStack Compute and the Dashboard allowing for cloud users to manage their own storage needs. Because OpenStack uses software logic to ensure data replication and distribution across different devices. expandable file systems. or providing a server with access to raw block level storage. 2. inexpensive commodity hard drives and servers can be used in lieu of more expensive equipment. Storage clusters scale horizontally simply by adding new servers. better performance and integration with enterprise storage platforms.php?pod=3 7/180 . Nexenta and SolidFire. lower price/GB http://openstack. Having no central "brain" or master point of control provides greater scalability. redundancy and durability. such as NetApp. scalable object storage using clusters of standardized servers capable of storing petabytes of data Object Storage is not a traditional file system. Object Storage Capabilities (Swift) OpenStack provides redundant. Feature Benefit No lockin. The block storage system manages the creation. but rather a distributed storage system for static data such as virtual machine images. it has unified storage support for numerous storage platforms including Ceph.com/printable. attaching and detaching of the block devices to servers. In addition to using simple Linux server storage.1. OpenStack replicates its content from other active nodes to new locations in the cluster. Snapshots can be restored or used to create a new block storage volume. Should a server or hard drive fail. Block Storage allows block devices to be exposed and connected to compute instances for expanded storage. Features & Benefits The features below are available in the current release. Snapshot management provides powerful functionality for backing up data stored on block storage volumes. and Zadara. archiving and data retention. photo storage. NetApp.ciscolive. with the OpenStack software responsible for ensuring data replication and integrity across the cluster. verify Monitoring: Capacity. not a traditional file system Builtin replication Configurable number of accounts.com/printable. 2. 2015 CiscoLive! OpenStack Lab LABCLD2225 Leverages commodity hardware HDD/node failure agnostic Self healing Reliability. log trawling. highly scalable read/write access Ability to serve content directly from storage system Multidimensional scalability Backup and archive large amounts of data with (scale out architecture) linear performance Scale vertically and horizontally distributed storage Account/Container/Object Optimized for scale structure Scales to multiple petabytes. download. host.ciscolive. data redundancy protecting from failures Unlimited storage Huge & flat namespace.1. verify. delete users Container Management: Upload. no bottlenecks RAID not required Handle lots of small. cluster health Drive auditing Detect drive failures preempting data corruption Expiring objects Users can set an expiration time or a TTL on an object to control access http://openstack. add. random reads and writes efficiently Builtin management utilities Account Management: Create. container and 3x+ data redundancy compared object copies for high availability to 2x on RAID Easily add capacity unlike Elastic data scaling with ease RAID resize No central database Higher performance. network. billions of objects No nesting.php?pod=3 8/180 . Nexenta. It supports multiple forms of authentication including standard username and password credentials. 2. These services — including identity.php?pod=3 9/180 . Unified support for block volumes using a SolidFire variety of storage systems Snapshot and backup API for Data protection and recovery for VM data block volumes Standalone volume API Separate endpoint and API for integration with available other compute systems Integration with Compute Fully integrated to Compute for attaching block volumes and reporting on usage OpenStack Shared Services OpenStack has several shared services that span the three pillars of compute.1. the catalog provides a queryable list of all of the services deployed in an OpenStack cloud in a single registry. http://openstack.ciscolive. 2015 CiscoLive! OpenStack Lab LABCLD2225 Direct object access Enable direct browser access to content. It acts as a common authentication system across the cloud operating system and can integrate with existing backend directory services like LDAP. image management and a web interface — integrate the OpenStack components with each other as well as external systems to provide a unified experience for users as they interact with different cloud resources. Additionally. Identity Service (Keystone) OpenStack Identity provides a central directory of users mapped to the OpenStack services they can access. making it easier to implement and operate your cloud. storage and networking. Users and thirdparty tools can programmatically determine which resources they can access. such as for a control panel Realtime visibility into client Know what users are requesting requests Supports S3 API Utilize tools that were designed for the popular S3 API Restrict containers per Limit access to control usage by user account Support for NetApp. tokenbased systems and AWSstyle logins.com/printable. Stored images can be used as a template to get new servers up and running quickly and more consistently if you are provisioning multiple servers than installing a server operating system and individually configuring additional services.ciscolive. including OpenStack Object Storage.k. AMI) VHD (HyperV) VDI (VirtualBox) qcow2 (Qemu/KVM) VMDK (VMWare) OVF (VMWare. including: Raw Machine (kernel/ramdisk outside of image. 2. allowing for a single source of identity authentication across the enterprise As a user. It can also be used to store and catalog an unlimited number of backups. others) Telemetry Service (Ceilometer) http://openstack. the image service allows uploads of private and public images in a variety of formats. OpenStack Identity enables you to: Get a list of the services that you can access Make API requests or log into the web dashboard to create resources owned by your account Image Service (Glance) The OpenStack Image Service provides discovery. The Image Service can store disk and server images in a variety of backends. or create their own from existing servers Snapshots can also be stored in the Image Service so that virtual machines can be backed up quickly A multiformat image registry. a.php?pod=3 10/180 . 2015 CiscoLive! OpenStack Lab LABCLD2225 As an administrator. The Image Service API provides a standard REST interface for querying information about disk images and lets clients stream the images to new servers. Capabilities of the Image Service include: Administrators can create base templates from which their users can start new compute instances Users can choose from available images. OpenStack Identity enables you to: Configure centralized policies across users and systems Create users and tenants and define permissions for compute. registration and delivery services for disk and server images. storage and networking resources using rolebased access control (RBAC) features Integrate with an existing directory like LDAP.a. The ability to copy or snapshot a server image and immediately store it away is a powerful capability of the OpenStack cloud operating system.com/printable.1. Cloud users and database administrators can provision and manage multiple database instances as needed. configuration. backups. the service has the goal of allowing users to quickly and easily utilize the features of a relational database without the burden of handling complex administrative tasks. the service will focus on providing resource isolation at high performance while automating complex administrative tasks including deployment. http://openstack. restores. Initially.ciscolive.php?pod=3 11/180 . patching. storage and networking configurations as well as detailed postdeployment activity to automate the full provisioning of infrastructure as well as services and applications. Orchestration Service (Heat) OpenStack Orchestration is a templatedriven engine that allows application developers to describe and automate the deployment of infrastructure. The flexible template language can specify compute. Through integration with the Telemetry service. the Orchestration engine can also perform autoscaling of certain infrastructure elements. Database Service (Trove) Designed to run entirely on OpenStack. This powerful capability provides visibility and insight into the usage of the cloud across dozens of data points and allows cloud operators to view metrics globally or by individual deployed resources.com/printable. 2.1. 2015 CiscoLive! OpenStack Lab LABCLD2225 The OpenStack Telemetry service aggregates usage and performance data across the services deployed in an OpenStack cloud. and monitoring. cisco. there are some operating system parameters that need to be modified to facilitate the operation of your application. First. 2. Please refer to our documentation for instructions on integration with other Cisco plugins at http://www.ciscolive. you will have access to two Linux hosts to run OpenStack. perform OS modifications on your Controller Node by connecting to pod3controller in PuTTY Connection Manager. Step 1 Configure NTP for proper time synchronization In OpenStack it is critical to have proper time synchronization across each of the component hosts. That being said. For the purpose of this lab we will be using chrony and it has been preconfigured for you.com (http://www. 2015 CiscoLive! OpenStack Lab LABCLD2225 Configure base Operating System on Controller As with any Linux application installation.1. We have grouped the requirements ahead of each component installation of OpenStack. In CentOS the default time protocol is called Chrony. http://openstack. In this lab.com).php?pod=3 12/180 .com/printable. In your OpenStack environment you can run either Chrony or NTPd as needed. OpenStack can be installed on many different Linux distributions. Adjustments to the firewall and NTP are requirements for an operational OpenStack deployment. Use of CentOS for this lab We chose CentOS as the operating system for this laboratory due to the fact that RedHat Enterprise Linux (RHEL) is the preferred distribution of many Enterprise accounts. The first will serve the roll of the OpenStack controller which will run most of the OpenStack services. while the second will be a dedicated Compute Node. including Canonical's Ubuntu. For chrony you can use the command chronyc tracking to observe what clock source it's attached to. Chrony is a variation of the NTPd engine of linux that is designed for disassociation of NTP resources ( for example laptops that lose access to their network clocks ).cisco. you would have many compute nodes on which to run your virtual machines. In a production environment. localdomain localhost4 localhost4.31 pod3‐controller pod3‐ controller.ciscolive.1 localhost localhost.236.0.023922 seconds Update interval : 479.2 seconds Leap status : Normal Step 2 Configure HOSTS file for Name Resolution Setting proper hostname definition plays a key role in the setup of various components of OpenStack ( in particular RabbitMQ ).31 issue the command: [[IDSEQSTEP]] cat <<EOF > /etc/hostname pod3‐controller EOF Step 3 Install PLUGIN priorities and EPEL repository Install the yumpluginpriorities package to enable assignment of relative priorities within http://openstack.32 pod3‐compute2 pod3‐ compute2.0.236.236.000186148 seconds RMS offset : 3119.cisco.localdomain4 10. The first part is that the hostname is correct in the file /etc/hosts.cisco.671875000 seconds slow of NTP time Last offset : ‐0.ecatsrtpdmz.php?pod=3 13/180 . On the controller host 10.250 ppm Root delay : 0.com 10. There are three things that need to match for RabbitMQ to properly operate.com/printable.31 issue the command: [[IDSEQSTEP]] cat <<EOF > /etc/hosts 127. 2.ecatsrtpdmz.0.261 ppm fast Residual freq : ‐0.0.cisco.236.1.961914062 seconds Frequency : 48.com pod3‐compute1 pod3‐compute1.011 ppm Skew : 8.ecatsrtpdmz. 2015 CiscoLive! OpenStack Lab LABCLD2225 # chronyc tracking Reference ID : 10.0. We have already setup everything for you via kickstart on the systems you are using such that they have properly setup the hostname variable. The third is the hostname definition in /etc/hostname. The second is the environment variable HOSTNAME that is derived in the system.0.0.236.10 Stratum : 3 Ref time (UTC) : Tue Jan 6 14:42:10 2015 System time : 93476.020065 seconds Root dispersion : 0.com EOF On the controller host 10. org/pub/epel/7/x86_64/e/epel‐ release‐7‐5.com/printable.0.ciscolive.0.236. 2015 CiscoLive! OpenStack Lab LABCLD2225 repositories and install the epelrelease package to enable the EPEL repository (Extra Packages for Enterprise Linux).noarch.31 issue the command: [[IDSEQSTEP]] yum ‐y install yum‐plugin‐priorities On the controller host 10.236.236.rpm Step 5 Upgrade system packages On the controller host 10.0.31 issue the command: [[IDSEQSTEP]] yum ‐y install http://dl.fedorapeople. ALERT! It is fine if the yum commands return with an ERROR that say's nothing to do. The servers are built for you from scratch with the yum commands already applied to save time. 2.php?pod=3 14/180 . On the controller host 10.236.fedoraproject.rpm Step 4 Add the OpenStack JUNO release repository On the controller host 10.31 issue the command: [[IDSEQSTEP]] yum ‐y install http://rdo.236.0.31 issue the command: [[IDSEQSTEP]] yum ‐y upgrade Step 6 Install OpenStack On the controller host 10.31 issue the command: http://openstack.0.org/openstack‐juno/rdo‐ release‐juno.1. 1. 2. 2015 CiscoLive! OpenStack Lab LABCLD2225 [[IDSEQSTEP]] yum ‐y install openstack‐selinux openstack‐utils http://openstack.ciscolive.com/printable.php?pod=3 15/180 1. 2. 2015 CiscoLive! OpenStack Lab LABCLD2225 Configure base Operating System on Compute Node The following steps are similar to those you just performed on the Controller Node. You must do the same thing on your Compute node. Perform these OS modifications on your Compute Node by connecting to pod3compute2 in PuTTY Connection Manager. Step 7 Configure NTP for proper time synchronization on compute node In OpenStack it is critical proper time synchronization across each of the component hosts. In CentOS the default time protocol is called Chrony. Chrony is a variation of the NTPd engine of linux that is designed for disassociation of NTP resources ( for example laptops that loose access to their network clocks ). In your OpenStack environment you can run either Chrony or NTPd as needed. For the purpose of this lab we will be using chrony and it has been preconfigured for you. For chrony you can use the command chronyc tracking to observe what clock source it's attached to. # chronyc tracking Reference ID : 10.0.236.10 Stratum : 3 Ref time (UTC) : Tue Jan 6 14:42:10 2015 System time : 93476.671875000 seconds slow of NTP time Last offset : ‐0.000186148 seconds RMS offset : 3119.961914062 seconds Frequency : 48.261 ppm fast Residual freq : ‐0.011 ppm Skew : 8.250 ppm Root delay : 0.020065 seconds Root dispersion : 0.023922 seconds Update interval : 479.2 seconds Leap status : Normal Step 8 Configure HOSTS file for Name Resolution Setting proper hostname definition plays a key role in the setup of various components of OpenStack ( in particular RabbitMQ ). There are three things that need to match for RabbitMQ to properly operate. The first part is that the hostname is correct in the file /etc/hosts. The second is the environment variable HOSTNAME that is derived in the system. The third is the hostname definition in /etc/hostname. We have already setup everything for you via kickstart on the systems you are using such that they have properly setup the hostname variable. On the compute host 10.0.236.32 issue the command: http://openstack.ciscolive.com/printable.php?pod=3 16/180 1. 2. 2015 CiscoLive! OpenStack Lab LABCLD2225 [[IDSEQSTEP]] cat <<EOF > /etc/hosts 127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 10.0.236.31 pod3‐controller pod3‐ controller.ecatsrtpdmz.cisco.com pod3‐compute1 pod3‐compute1.ecatsrtpdmz.cisco.com 10.0.236.32 pod3‐compute2 pod3‐ compute2.ecatsrtpdmz.cisco.com EOF On the compute host 10.0.236.32 issue the command: [[IDSEQSTEP]] cat <<EOF > /etc/hostname pod3‐compute2 EOF Step 9 Install PLUGIN priorities and EPEL repository Install the yumpluginpriorities package to enable assignment of relative priorities within repositories and install the epelrelease package to enable the EPEL repository (Extra Packages for Enterprise Linux). On the compute host 10.0.236.32 issue the command: [[IDSEQSTEP]] yum ‐y install yum‐plugin‐priorities Now you must instal the EPEL repository to both hosts. On the compute host 10.0.236.32 issue the command: [[IDSEQSTEP]] yum ‐y install http://dl.fedoraproject.org/pub/epel/7/x86_64/e/epel‐ release‐7‐5.noarch.rpm Step 10 Add the OpenStack JUNO release repository On the compute host 10.0.236.32 issue the command: http://openstack.ciscolive.com/printable.php?pod=3 17/180 236.32 issue the command: [[IDSEQSTEP]] yum ‐y install openstack‐selinux openstack‐utils http://openstack.php?pod=3 18/180 .org/openstack‐juno/rdo‐ release‐juno.fedorapeople.236.ciscolive.0.rpm Step 11 Upgrade system packages On the compute host 10. 2. 2015 CiscoLive! OpenStack Lab LABCLD2225 [[IDSEQSTEP]] yum ‐y install http://rdo.1.0.32 issue the command: [[IDSEQSTEP]] yum ‐y upgrade Step 12 Install OpenStack On the compute host 10.com/printable. The following SED command line will insert the required configuration into the proper location of the my. 2015 CiscoLive! OpenStack Lab LABCLD2225 Database The database in the OpenStack cluster is utilized as a repository of information for various components in OpenStack.com/printable. [[IDSEQSTEP]] sed ‐i "4i\bind‐address = 10.cnf MariaDB configuration file. There are two commands. On the controller host 10.0. you can restart the service to read the new configuration file. Step 13 Install MariaDB from repository On the controller host 10.cnf Once this configuration is completed.31\nmax_connections = 500\ndefault‐ storage‐engine = innodb\ninnodb_file_per_table\ncollation‐server = utf8_general_ci\ninit‐connect = 'SET NAMES utf8'\ncharacter‐set‐server = utf8\n" /etc/my. configure MariaDB to accept connections from the network. the firewall in CentOS permits everything on localhost. so be sure to perform the following actions on your Controller Node. Because we will have components scattered across two different hosts for this lab. MariaDB uses port 3306. Different DB engines can be used in OpenStack. We will be using MariaDB (free version of MySQL) for this lab.236.31 issue the command: [[IDSEQSTEP]] firewall‐cmd ‐‐add‐port=3306/tcp ‐‐permanent firewall‐cmd ‐‐reload Step 15 Configure Network IP Bind Next.1. This configuration makes it possible for MariaDB to listen to network connections arriving at the IP address of the controller 10.php?pod=3 19/180 . One to enable the service and one to start the service.0.31.31 issue the command: [[IDSEQSTEP]] yum ‐y install mariadb mariadb‐server MySQL‐ python Step 14 Open Firewall Hole In a configuration for a single host OpenStack.236. we need to open the ports for the various services.0.ciscolive. The http://openstack. 2.0. use the command % firewall‐cmd .236. It also specifies the default database engine and UTF types. To enable this port. By default MariaDB only accepts connections from internal Unix sockets. The database typically resides on the Controller Node.236. Dec 24 13:17:43 localhost.com/printable.31 issue the command: [[IDSEQSTEP]] systemctl status mariadb.0. There is a Active line and if the process shows active (running) then the process has started properly..ciscolive.service.. 2. On the controller host 10.service ‐ MariaDB database server Loaded: loaded (/usr/lib/systemd/system/mariadb.service mariadb.service . Dec 24 13:17:43 localhost. Step 16 Configure User Credentials http://openstack.. Info What you are looking for in the status command is the state of the process.service To validate that the MariaDB service is properly started you can issue the command % systemctl status mariadb.service systemctl start mariadb.localdomain systemd[1]: Starting MariaDB database serve r.localdomain mysqld_safe[54008]: 141224 13:17:43 mysqld_ safe Logging to '/var/log/mariadb/mariadb.localdomain mysqld_safe[54008]: 141224 13:17:43 mysqld_ safe Starting mysqld daemon with databases from /var/lib/mysql Dec 24 13:17:45 localhost.service systemctl stop mariadb.log ‐‐pid ‐file=/var/run/mariad.1. status=0/SUCCESS) Main PID: 54008 (mysqld_safe) CGroup: /system.service ├─54008 /bin/sh /usr/bin/mysqld_safe ‐‐basedir=/usr └─54261 /usr/libexec/mysqld ‐‐basedir=/usr ‐‐datadir=/var/lib/mysql ‐‐ plugin‐dir=/usr/lib64/mysql/plugin ‐‐log‐error=/var/log/mariadb/mariadb.service # systemctl status mariadb.31 issue the command: [[IDSEQSTEP]] systemctl enable mariadb.0.log'. Dec 24 13:17:43 localhost. 10s ago Process: 54009 ExecStartPost=/usr/libexec/mariadb‐wait‐ready $MAINPID (code=exi ted.localdomain systemd[1]: Started MariaDB database server . 2015 CiscoLive! OpenStack Lab LABCLD2225 enable command causes CentOS to activate this service in the system during startup. enabled) Active: active (running) since Wed 2014‐12‐24 13:17:45 EST.slice/mariadb.236.236. status=0/SUCCESS) Process: 53980 ExecStartPre=/usr/libexec/mariadb‐prepare‐db‐dir %n (code=exited . The output of the command is similar to the following: On the controller host 10..php?pod=3 20/180 . com/printable.0.* TO 'root'@'%' IDENTIFIED BY 'cisco. The second command we are issuing in MariaDB is to remove to 'blank' users that are tied to the localhost account.236. GRANT ALL PRIVILEGES ON *. the root password is not set so that administrators can access the database for initial configuration purposes. DELETE FROM `user` WHERE User=''. The first command we are going to issue is to update the root password.ciscolive. you are then inside the Maria database cli processor.123' WITH GRANT OPTION. flush privileges. On the controller host 10. For this lab we have specific requirements that we are building directly with these SQL commands. flush privileges. On the controller host 10.31 issue the command: [[IDSEQSTEP]] USE mysql. The first step is to configure the root password credential.123") where User='root'. you can configure the root credentials to access the database. update user set password=PASSWORD("cisco.31 issue the command: [[IDSEQSTEP]] use mysql.236.236.31 issue the command: [[IDSEQSTEP]] use mysql. the installation creates the default root credentials for you.0. From this point you can issue SQL commands against the database store. 2015 CiscoLive! OpenStack Lab LABCLD2225 With the MariaDB service now running and enabled for startup after reboot.0. By default.0. exit Once completed you should be able to access to database from the network and also use the set of credentials to add all the proper databases needed by the various components of http://openstack. In some Linux distributions.31 issue the command: [[IDSEQSTEP]] mysql ‐u root When you issue this command.123 throughout this lab for all access to simplify your experience. flush privileges. We will be using the password cisco.236.1. These two blank users need to be removed so that we can access the system properly from the network. On the controller host 10. MariaDB has a special command line tool available to users called mysql_secure_installation that you can use to secure the installation when doing so in a production network.php?pod=3 21/180 . 2. On the controller host 10. com/printable.123. 2.ciscolive. From this point forward to access the MariaDB using the root account you will have to specify the password cisco.1. 2015 CiscoLive! OpenStack Lab LABCLD2225 OpenStack. http://openstack.php?pod=3 22/180 . 236.31 issue the command: [[IDSEQSTEP]] yum ‐y install rabbitmq‐server Once installed.service You can now validate that the RabbitMQ process is properly running on the controller node. http://openstack.ciscolive.1. Step 17 Install RabbitMQ On the controller host 10. On the controller host 10.0. 2. As explained in the MariaDB section. The communication between the various components is simplified via the broker such that little to no knowledge of the separate components is needed. RabbitMQ takes care of getting the messages to the interested recipients.php?pod=3 23/180 . The AMQP broker sits in between various OpenStack components and makes communication possible through a message bus. And the start parameter starts the service right away.31 issue the command: [[IDSEQSTEP]] systemctl enable rabbitmq‐server.0. you have to enable the service and start the service. Components can subscribe to events they are interested in and other components can publish events to the bug. Nova or Quantum use to communicate with each other. you enable the service such that it starts automatically during bootup.service systemctl start rabbitmq‐server. 2015 CiscoLive! OpenStack Lab LABCLD2225 RabbitMQ AMQP (Advanced Message Queue Protocol) is what the various components of OpenStack like Cinder.236.com/printable. simplifying development and scalability of the OpenStack platform. localdomain rabbitmq‐server[54474]: ## ## Dec 24 13:33:22 localhost. Dec 24 13:33:22 localhost.done.236.localdomain systemd[1]: Started RabbitMQ broker.smp ‐W w ‐K true ‐A30 ‐ P 1048576 ‐‐ ‐root /usr/lib64/erlang ‐progname erl ‐‐ ‐home /var/lib/rabbitmq ‐‐ ‐pa /usr/lib/rabbitmq.service # systemctl status rabbitmq‐server.localdomain rabbitmq‐server[54474]: ## ## License d under the MPL.. 2. status=2) Main PID: 54474 (beam.log Dec 24 13:33:22 localhost. Dec 24 13:33:22 localhost.service ├─54474 /usr/lib64/erlang/erts‐5.rabbitmq..5.31 issue the command: [[IDSEQSTEP]] firewall‐cmd ‐‐add‐port=5672/tcp ‐‐permanent firewall‐cmd ‐‐reload More information on ports for RabbitMQ servers RabbitMQ Environment (https://www. 8s ago Process: 54475 ExecStartPost=/usr/lib/rabbitmq/bin/rabbitmqctl wait /var/run/ra bbitmq/pid (code=exited. completed with 0 plugins. Inc.localdomain rabbitmq‐server[54474]: ########## Logs: / var/log/rabbitmq/rabbit@localhost. status=0/SUCCESS) Process: 54443 ExecStartPre=/bin/sh ‐c /usr/lib/rabbitmq/bin/rabbitmqctl status > /dev/null 2>&1 (code=exited.. Step 18 Open Firewall Port Since all the different nodes in the OpenStack cluster will be using RabbitMQ for inter process calls.com/ Dec 24 13:33:22 localhost.localdomain rabbitmq‐server[54474]: Starting broker..1.1. we need to insure that the firewall permits connectivity on the proper ports.. See http://www.. 2015 CiscoLive! OpenStack Lab LABCLD2225 On the controller host 10. ├─54586 inet_gethost 4 └─54587 inet_gethost 4 Dec 24 13:33:21 localhost.0.service ‐ RabbitMQ broker Loaded: loaded (/usr/lib/systemd/system/rabbitmq‐server.service rabbitmq‐server. enabled) Active: active (running) since Wed 2014‐12‐24 13:33:22 EST.10..php?pod=3 24/180 .localdomain rabbitmqctl[54475]: .localdomain rabbitmq‐server[54474]: RabbitMQ 3. On the controller host 10.slice/rabbitmq‐server.smp) CGroup: /system.4/bin/beam. Dec 24 13:33:21 localhost.rabbitmq.236.service.log Dec 24 13:33:22 localhost. Cop yright (C) 2007‐2013 GoPivotal.ciscolive.localdomain rabbitmq‐server[54474]: ###### ## / var/log/rabbitmq/rabbit@localhost‐sasl.0.html#defineenvironmentvariables).localdomain rabbitmqctl[54475]: pid is 54474 .. http://openstack.com/configure.31 issue the command: [[IDSEQSTEP]] systemctl status rabbitmq‐server. Dec 24 13:33:22 localhost.localdomain rabbitmq‐server[54474]: ########## Dec 24 13:33:22 localhost.com/printable. This is one reason we have set up these hosts to have name resolution from /etc/hosts.ciscolive.1.0.236.php?pod=3 25/180 . make sure that name resolution of the RabbitMQ server is configured correctly.com/printable. 2015 CiscoLive! OpenStack Lab LABCLD2225 Step 19 Change the RabbitMQ password You have to set the password for the RabbitMQ messaging engine. http://openstack. On the controller host 10.31 issue the command: [[IDSEQSTEP]] rabbitmqctl change_password guest cisco. DNS and environment variables. 2. RabbitMQ is very strict with the hostname definitions as it structures the RabbitMQ message queues based on the hostname.123 ALERT! If you install OpenStack in a production environment. 1. 2. 2015 CiscoLive! OpenStack Lab LABCLD2225 Keystone Keystone is the identity service of OpenStack and ensures that users making API, CLI, or GUI calls to the various OpenStack components are authorized to do so. Keystone's responsibilities include: Tracking users and their permissions. Providing a catalog of available services with their API endpoints. Step 20 Configure Keystone users in database Keystone will need access to the MariaDB in OpenStack. For this lab, we only have two nodes and the primary node ( the controller in this case ) has both keystone and MariaDB running on one. We configure the credentials in the MariaDB such that Keystone will be able to access MariaDB during it's installation and configures the database. On the controller host 10.0.236.31 issue the command: [[IDSEQSTEP]] mysql ‐‐user=root ‐‐password=cisco.123 CREATE DATABASE keystone; GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' IDENTIFIED BY 'cisco.123'; GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' IDENTIFIED BY 'cisco.123'; exit; Step 21 Install Keystone As we start configuring OpenStack specific components in this lab, we will be using a command called % openstack‐config throughout this manual to simplify configuring the various OpenStack configuration files. OpenStack Config was installed previously. If you where to install a multinode OpenStack environment, you would have to install the OpenStack configuration utility via the package openstackutils. http://openstack.ciscolive.com/printable.php?pod=3 26/180 1. 2. 2015 CiscoLive! OpenStack Lab LABCLD2225 On the controller host 10.0.236.31 issue the command: [[IDSEQSTEP]] yum ‐y install openstack‐keystone python‐ keystoneclient Step 22 Configure Keystone Database Connection The openstack‐config command requires four parameters: The configuration file to modify The section of the document to update The variable to update The value of that variable The advantage of using this method instead of editing the file directly, is that the % openstack‐config locates the variable and modifies it. If the variable does not already exist, it will insert it. If you where to accomplish the same task by hand, you would have to first locate the section and carefully make the change. To start the Keystone configuration we begin by configuring the connection to the MariaDB so that keystone can configure the database directly. When a OpenStack process first starts and is initializing during installation it will directly modify the database to it's requirements. On the controller host 10.0.236.31 issue the command: [[IDSEQSTEP]] openstack‐config ‐‐set /etc/keystone/keystone.conf DEFAULT admin_token cisco.123 openstack‐config ‐‐set /etc/keystone/keystone.conf database connection mysql://keystone:
[email protected]/keystone openstack‐config ‐‐set /etc/keystone/keystone.conf token provider keystone.token.providers.uuid.Provider openstack‐config ‐‐set /etc/keystone/keystone.conf token driver keystone.token.persistence.backends.sql.Token Step 23 Configure max Keystone workers to control mysql connections This step is mostly for the purpose of this lab to control the amount of connections to the database from keystone. By default OpenStack bases the amount of workers that are forked on the amount of CPU resources available on the platform. These servers have 32 CPU cores and with two worker groups it would total over 64 active connections to MariaDB from keystone alone. In a production environment you might want to keep the worker values at a larger amount than what we have setup for this small lab. On the controller host 10.0.236.31 issue the command: http://openstack.ciscolive.com/printable.php?pod=3 27/180 1. 2. 2015 CiscoLive! OpenStack Lab LABCLD2225 [[IDSEQSTEP]] openstack‐config ‐‐set /etc/keystone/keystone.conf DEFAULT admin_workers 4 openstack‐config ‐‐set /etc/keystone/keystone.conf DEFAULT public_workers 4 Step 24 Configure PKI setup for certificates To ensure secure connectivity across the OpenStack cluster, keystone needs to prepare the PKI setup for proper certificate configuration. On the controller host 10.0.236.31 issue the command: [[IDSEQSTEP]] keystone‐manage pki_setup ‐‐keystone‐user keystone ‐‐keystone‐group keystone chown ‐R keystone:keystone /var/log/keystone chown ‐R keystone:keystone /etc/keystone/ssl chmod ‐R o‐rwx /etc/keystone/ssl /bin/sh ‐c "keystone‐manage db_sync" keystone If you wish, you can validate what keystone did to the database. If you goto the MariaDB database you can see the database that was created and populated by keystone to be ready for when the service is started. http://openstack.ciscolive.com/printable.php?pod=3 28/180 Type '\c' to clear the current input statement. Type 'help.com/printable.40‐MariaDB MariaDB Server Copyright (c) 2000. or \g.5. 2014. +‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ | Database | +‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ | information_schema | | keystone | | mysql | | performance_schema | | test | +‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ 5 rows in set (0. +‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ | Tables_in_keystone | +‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ | assignment | | credential | | domain | | endpoint | | group | | id_mapping | | migrate_version | | policy | | project | | region | | revocation_event | | role | | service | | token | | trust | | trust_role | | user | | user_group_membership | +‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ 18 rows in set (0.00 sec) MariaDB [(none)]> use keystone. MariaDB [(none)]> show databases. Commands end with . 2. Monty Program Ab and others. 2015 CiscoLive! OpenStack Lab LABCLD2225 # mysql ‐u root ‐p Enter password: Welcome to the MariaDB monitor.php?pod=3 29/180 .' or '\h' for help.ciscolive.1. Oracle. Your MariaDB connection id is 6 Server version: 5. Reading table information for completion of table and column names You can turn off this feature to get a quicker startup with ‐A Database changed MariaDB [keystone]> show tables.00 sec) MariaDB [keystone]> exit Bye Step 25 Open Firewall Holes for Keystone http://openstack. 0.236.service.ciscolive.service openstack‐keystone.0. particularly in environments with limited resources.slice/openstack‐keystone.service ├─56345 /usr/bin/python /usr/bin/keystone‐all ├─56352 /usr/bin/python /usr/bin/keystone‐all ├─56353 /usr/bin/python /usr/bin/keystone‐all ├─56354 /usr/bin/python /usr/bin/keystone‐all └─56355 /usr/bin/python /usr/bin/keystone‐all Dec 24 14:36:31 localhost. http://openstack.31 issue the command: [[IDSEQSTEP]] systemctl enable openstack‐keystone.0.236.236. Step 27 Create CRON job to purge tokens hourly By default. 2015 CiscoLive! OpenStack Lab LABCLD2225 Keystone is used by various processes across the OpenStack cluster.1.com/printable.php?pod=3 30/180 . 9s ago Main PID: 56345 (keystone‐all) CGroup: /system. The accumulation of expired tokens considerably increases the database size and might degrade service performance.service ‐ OpenStack Identity Service (code‐named Keystone) Loaded: loaded (/usr/lib/systemd/system/openstack‐keystone.31 issue the command: [[IDSEQSTEP]] systemctl status openstack‐keystone.service systemctl start openstack‐keystone.31 issue the command: [[IDSEQSTEP]] firewall‐cmd ‐‐add‐port=35357/tcp ‐‐permanent firewall‐cmd ‐‐add‐port=5000/tcp ‐‐permanent firewall‐cmd ‐‐reload Step 26 Enable the keystone service On the controller host 10. enabled) Active: active (running) since Wed 2014‐12‐24 14:36:31 EST.localdomain systemd[1]: Started OpenStack Identity Serv ice (code‐named Keystone).service # systemctl status openstack‐keystone.service You can validate the status of the service also. On the controller host 10. 2. On the controller host 10. the Identity service stores expired tokens in the database indefinitely. For this reason we need to open the firewall port such that different services from different nodes may connect. For this reason you will create a cronjob that runs and clears these tokens to keep the database trimmed. 236. These environment variables provide a pointer to the password for Keystone and the location that Keystone is running.236.31:35357/v2.0.236.php?pod=3 31/180 .0.123 export OS_SERVICE_ENDPOINT=http://10.log 2>&1 Step 28 Configure Keystone Admin User and Tenant Before configuring Keystone.31 issue the command: [[IDSEQSTEP]] crontab ‐l ‐u keystone # crontab ‐l ‐u keystone @hourly /usr/bin/keystone‐manage token_flush >/var/log/keystone/keystone‐tokenflu sh. On the controller host 10.31 issue the command: http://openstack.236.31 issue the command: [[IDSEQSTEP]] (crontab ‐l ‐u keystone 2>&1 | grep ‐q token_flush) || \ echo '@hourly /usr/bin/keystone‐manage token_flush >/var/log/keystone/keystone‐ tokenflush.31 issue the command: [[IDSEQSTEP]] export OS_SERVICE_TOKEN=cisco.0.0.log 2>&1' \ >> /var/spool/cron/keystone You can validate that the crontab was entered into the system via: On the controller host 10.1. 2015 CiscoLive! OpenStack Lab LABCLD2225 On the controller host 10. 2.0.com/printable.236. you must setup some environment variables first.ciscolive. On the controller host 10.0 Once completed you can add the Tenant configuration. 31 issue the command: http://openstack.123 ‐‐email root@localhost +‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ | Property | Value | +‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ | email | root@localhost | | enabled | True | | id | 3f03fe4e33e14e8a86b4438a973bfc59 | | name | admin | | username | admin | +‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ # keystone role‐create ‐‐name admin +‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ | Property | Value | +‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ | id | f784cdaeb9ea4787a0a6569fd85afa7c | | name | admin | +‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ # keystone user‐role‐add ‐‐tenant admin ‐‐user admin ‐‐role admin # keystone role‐create ‐‐name _member_ +‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ | Property | Value | +‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ | id | 4c768437c9ef4fb68d5423ca49ab1004 | | name | _member_ | +‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ # keystone user‐role‐add ‐‐tenant admin ‐‐user admin ‐‐role _member_ As you can observe each of these are tables with properties and values. 2. 2015 CiscoLive! OpenStack Lab LABCLD2225 [[IDSEQSTEP]] keystone tenant‐create ‐‐name admin ‐‐ description "Admin Tenant" keystone user‐create ‐‐name admin ‐‐pass cisco.1.0.123 ‐‐email root@localhost keystone role‐create ‐‐name admin keystone user‐role‐add ‐‐tenant admin ‐‐user admin ‐‐role admin keystone role‐create ‐‐name _member_ keystone user‐role‐add ‐‐tenant admin ‐‐user admin ‐‐role _member_ When you issue this command the output will look similar to the following. # keystone tenant‐create ‐‐name admin ‐‐description "Admin Tenant" +‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ | Property | Value | +‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ | description | Admin Tenant | | enabled | True | | id | 39926425f39640e89a3e27ed198ad138 | | name | admin | +‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ # keystone user‐create ‐‐name admin ‐‐pass cisco. Step 29 Configure POD user and Tenant On the controller host 10. One important value that we will be utilizing is the id .com/printable.ciscolive.236.php?pod=3 32/180 . 1. 2. 2015 CiscoLive! OpenStack Lab LABCLD2225 [[IDSEQSTEP]] keystone tenant‐create ‐‐name TenantPOD3 ‐‐ description "Tenant POD3" keystone user‐create ‐‐name userpod3 ‐‐pass cisco.123 keystone user‐role‐add ‐‐tenant TenantPOD3 ‐‐ user userpod3 ‐‐role _member_ The output should be similar to: # keystone tenant‐create ‐‐name TenantPOD3 ‐‐description "Tenant POD3" +‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ | Property | Value | +‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ | description | Tenant POD3 | | enabled | True | | id | ce2e989ba3f34d39a22888b46ebfa60a | | name | TenantPOD3 | +‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ # keystone user‐create ‐‐name UserPOD1 ‐‐pass cisco.123 +‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ | Property | Value | +‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ | email | | | enabled | True | | id | 44599cc7f9c6427fbf4e4724a59e2808 | | name | userpod3 | | username | userpod3 | +‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ # keystone user‐role‐add ‐‐tenant TenantPOD3 ‐‐user userpod3 ‐‐role _member_ Step 30 Configure Service Tenant On the controller host 10.0.236.31 issue the command: [[IDSEQSTEP]] keystone tenant‐create ‐‐name service ‐‐ description "Service Tenant" keystone service‐create ‐‐name keystone ‐‐type identity ‐‐description "OpenStack Identity" The output of the command should be similar to: http://openstack.ciscolive.com/printable.php?pod=3 33/180 1. 2. 2015 CiscoLive! OpenStack Lab LABCLD2225 ]# keystone tenant‐create ‐‐name service ‐‐description "Service Tenant" +‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ | Property | Value | +‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ | description | Service Tenant | | enabled | True | | id | 814d2fc46eda4d7d8fc174a198fd82ba | | name | service | +‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ # keystone service‐create ‐‐name keystone ‐‐type identity ‐‐description "OpenStac k Identity" +‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ | Property | Value | +‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ | description | OpenStack Identity | | enabled | True | | id | ec4effb75fa0435f96dd871098596d77 | | name | keystone | | type | identity | +‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ Once this has been created you can use the command # keystone service‐list to get the ID name that we need to create the endpoint. Luckily we have simplified this for you, but it is a good idea to see the command. On the controller host 10.0.236.31 issue the command: [[IDSEQSTEP]] keystone service‐list # keystone service‐list +‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ | id | name | type | description | +‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ | ec4effb75fa0435f96dd871098596d77 | keystone | identity | OpenStack Identity | +‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ What you are looking for is that id value hex string. You use that to create the keystone endpoint. We have provided for you a simple command that uses AWK to capture the output of that id for the next command that we need for Keystone. On the controller host 10.0.236.31 issue the command: [[IDSEQSTEP]] keystone endpoint‐create \ ‐‐service‐id $(keystone service‐list | awk '/ identity / {print $2}') \ ‐‐publicurl http://10.0.236.31:5000/v2.0 \ ‐‐internalurl http://10.0.236.31:5000/v2.0 \ ‐‐adminurl http://10.0.236.31:35357/v2.0 \ ‐‐region regionOne http://openstack.ciscolive.com/printable.php?pod=3 34/180 1. 2. 2015 CiscoLive! OpenStack Lab LABCLD2225 And the output for that command should be similar to: # keystone endpoint‐create \ > ‐‐service‐id $(keystone service‐list | awk '/ identity / {print $2}') \ > ‐‐publicurl http://10.0.236.31:5000/v2.0 \ > ‐‐internalurl http://10.0.236.31:5000/v2.0 \ > ‐‐adminurl http://10.0.236.31:35357/v2.0 \ > ‐‐region regionOne +‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ | Property | Value | +‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ | adminurl | http://10.0.236.31:35357/v2.0 | | id | 2518b1ff94f24400952dd9047662d67e | | internalurl | http://10.0.236.31:5000/v2.0 | | publicurl | http://10.0.236.31:5000/v2.0 | | region | regionOne | | service_id | ec4effb75fa0435f96dd871098596d77 | +‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ Step 31 Validate Keystone installation The first step is to remove the environment variables that we had setup previously. On the controller host 10.0.236.31 issue the command: [[IDSEQSTEP]] unset OS_SERVICE_TOKEN OS_SERVICE_ENDPOINT Then you have to set the values in Keystone. On the controller host 10.0.236.31 issue the command: [[IDSEQSTEP]] keystone ‐‐os‐tenant‐name admin ‐‐os‐username admin ‐‐os‐password cisco.123 ‐‐os‐auth‐url http://10.0.236.31:35357/v2.0 token‐get keystone ‐‐os‐tenant‐name admin ‐‐os‐username admin ‐‐os‐password cisco.123 ‐‐os‐auth‐url http://10.0.236.31:35357/v2.0 tenant‐list keystone ‐‐os‐tenant‐name admin ‐‐os‐username admin ‐‐os‐password cisco.123 ‐‐os‐auth‐url http://10.0.236.31:35357/v2.0 user‐list keystone ‐‐os‐tenant‐name admin ‐‐os‐username admin ‐‐os‐password cisco.123 ‐‐os‐auth‐url http://10.0.236.31:35357/v2.0 role‐list And complete the process for the user that was created On the controller host 10.0.236.31 issue the command: http://openstack.ciscolive.com/printable.php?pod=3 35/180 123 export OS_AUTH_URL=http://10.0.0/ export OS_REGION_NAME=regionOne export PS1='[\u@\h \W(keystone_admin)]# ' EOF chmod +x admin.236. Step 32 Create shell identity files You will now create two separate files that will be used to change your identity status when interacting with Keystone.php?pod=3 36/180 .1.31:5000/v2.0 token‐get keystone ‐‐os‐tenant‐name TenantPOD3 ‐‐os‐ username userpod3 ‐‐os‐password cisco.sh You will now create another file that takes the role of the user we have created. [[IDSEQSTEP]] cd ~ cat <<EOF > TenantPOD3.0 user‐list This last command will create a ERROR as you are not set as the administrator from the CLI.sh Step 33 Verify identity shell You can validate that each shell is working properly by executing the shell command via the #source command.0.123 ‐‐os‐ auth‐url http://10. 2015 CiscoLive! OpenStack Lab LABCLD2225 [[IDSEQSTEP]] keystone ‐‐os‐tenant‐name TenantPOD3 ‐‐os‐ username userpod3 ‐‐os‐password cisco.31:5000/v2.31 issue the command: [[IDSEQSTEP]] cd ~ cat <<EOF > admin.0/ export OS_REGION_NAME=regionOne export PS1='[\u@\h \W(keystone_TenantPOD3)]# ' EOF chmod +x TenantPOD3.0.sh export OS_USERNAME=userpod3 export OS_TENANT_NAME=TenantPOD3 export OS_PASSWORD=cisco.31:35357/v2.com/printable. On the controller host 10.sh export OS_USERNAME=admin export OS_TENANT_NAME=admin export OS_PASSWORD=cisco.236.123 ‐‐os‐ auth‐url http://10. 2.0.123 export OS_AUTH_URL=http://10.ciscolive. On the controller host 10.31 issue the command: http://openstack.0.31:35357/v2.236.236.236.236.0. php?pod=3 37/180 . On the controller host 10.123 PS1=[\u@\h \W(keystone_admin)]# SELINUX_LEVEL_REQUESTED= OS_AUTH_URL=http://10.236.31 issue the command: [[IDSEQSTEP]] cd ~ source TenantPOD3. yet the environment variables should be set.0/ OS_USERNAME=admin OS_TENANT_NAME=admin You can assume the identity of the POD Tenant you are using with the same command.0.ciscolive. [root@localhost ~(keystone_admin)]# env OS_REGION_NAME=regionOne OS_PASSWORD=cisco.sh The output should be minimal.sh http://openstack.com/printable. 2.31:5000/v2. 2015 CiscoLive! OpenStack Lab LABCLD2225 [[IDSEQSTEP]] cd ~ source admin.0.1.236. 31 issue the command: http://openstack. 2.236.0.com/printable. On the controller host 10. 2015 CiscoLive! OpenStack Lab LABCLD2225 Glance Glance provides an image store for users of OpenStack to create instances.31 issue the command: [[IDSEQSTEP]] firewall‐cmd ‐‐add‐port=9292/tcp ‐‐permanent firewall‐cmd ‐‐add‐port=9191/tcp ‐‐permanent firewall‐cmd ‐‐add‐port=873/tcp ‐‐permanent firewall‐cmd ‐‐add‐port=3260/tcp ‐‐permanent firewall‐cmd ‐‐reload Step 35 Configure Glance database and access to database Just as you completed previously.1. CentOS or Windows. you have to provide Glance with the privileges to access the database to configure it's tables.0.php?pod=3 38/180 . Step 34 Open Firewall Hole On the controller host 10. the administrator of the system can upload various disk images that have been prebuilt with an OS such as Ubuntu. The primary consumer of Glance services is the Nova service that manages the compute resources in OpenStack. Once glance is configured. The images may contain a plain OS image or may contain preinstalled applications.ciscolive.236. 236.0.123 CREATE DATABASE glance. On the controller host 10.ciscolive.123 keystone user‐role‐add ‐‐user glance ‐‐tenant service ‐‐role admin keystone service‐create ‐‐name glance ‐‐type image ‐‐description "OpenStack Image Service" keystone endpoint‐create \ ‐‐service‐id $(keystone service‐list | awk '/ image / {print $2}') \ ‐‐publicurl http://10.31 issue the command: [[IDSEQSTEP]] yum ‐y install openstack‐glance python‐ glanceclient http://openstack.236.236. exit Step 36 Add glance users to keystone Once the database access credentials is completed.236.com/printable.0.sh Now that you have assumed the identity of the admin user.123'.* to 'glance'@'%' identified by 'cisco. 2015 CiscoLive! OpenStack Lab LABCLD2225 [[IDSEQSTEP]] mysql ‐‐user=root ‐‐password=cisco.31 issue the commands: [[IDSEQSTEP]] keystone user‐create ‐‐name glance ‐‐pass cisco.236. you can issue the following commands to create the user and the service for Glance in Keystone.31:9292 \ ‐‐adminurl http://10.0.31:9292 \ ‐‐region regionOne Step 37 Install Glance On the controller host 10. On the controller host 10. 2. GRANT ALL PRIVILEGES ON glance.31 issue the command: [[IDSEQSTEP]] cd ~ source admin.123'.236. grant all privileges on glance.* TO 'glance'@'localhost' IDENTIFIED BY 'cisco.0.1. Previously you had created a script to assume the identity of the administrator. we add the service user into Keystone.0.31:9292 \ ‐‐internalurl http://10. You have to execute this command before you create the glance users such that it has proper permissions to add the users.php?pod=3 39/180 . you will add the glance user to keystone.0. For every OpenStack service we have to add. 123 http://openstack.conf glance_store filesystem_store_datadir /var/lib/glance/images/ Step 39 Configure Glance Registry On the controller host 10.123 openstack‐config ‐‐set /etc/glance/glance‐ api.conf glance_store default_store file openstack‐config ‐‐set /etc/glance/glance‐ api.31:5000/v2. 2.31:5000/v2.conf database connection mysql://glance:cisco.236.0.php?pod=3 40/180 .31 issue the command: [[IDSEQSTEP]] openstack‐config ‐‐set /etc/glance/glance‐ api.31/glance openstack‐config ‐‐set /etc/glance/glance‐ registry.conf keystone_authtoken identity_uri http://10.conf keystone_authtoken admin_password cisco.0.conf keystone_authtoken identity_uri http://
[email protected]:35357 openstack‐config ‐‐set /etc/glance/glance‐ api.236.conf keystone_authtoken auth_uri http://10.0.236.conf keystone_authtoken admin_user glance openstack‐config ‐‐set /etc/glance/glance‐ api.0 openstack‐config ‐‐set /etc/glance/glance‐ api.236.ciscolive.1.conf paste_deploy flavor keystone openstack‐config ‐‐set /etc/glance/glance‐ api.0 openstack‐config ‐‐set /etc/glance/glance‐ registry.conf keystone_authtoken admin_tenant_name service openstack‐config ‐‐set /etc/glance/glance‐ registry.conf keystone_authtoken auth_uri http://10. 2015 CiscoLive! OpenStack Lab LABCLD2225 Step 38 Configure Glance API On the controller host 10.236.0.conf keystone_authtoken admin_tenant_name service openstack‐config ‐‐set /etc/glance/glance‐ api.conf keystone_authtoken admin_user glance openstack‐config ‐‐set /etc/glance/glance‐ registry.conf DEFAULT workers 4 openstack‐config ‐‐set /etc/glance/glance‐
[email protected]:35357 openstack‐config ‐‐set /etc/glance/glance‐ registry.conf database connection mysql://glance:cisco.conf DEFAULT workers 4 openstack‐config ‐‐set /etc/glance/glance‐ api.236.conf keystone_authtoken admin_password cisco.com/printable.0.31 issue the command: [[IDSEQSTEP]] openstack‐config ‐‐set /etc/glance/glance‐ registry.31/glance openstack‐config ‐‐set /etc/glance/glance‐ api.236.0. service openstack‐glance‐registry.236.service systemctl start openstack‐glance‐api.1.service You can validate that Glance was correctly installed and configured.localdomain systemd[1]: Started OpenStack Image Service (code‐named Glance) API server.0.31 issue the command: [[IDSEQSTEP]] su ‐s /bin/sh ‐c "glance‐manage db_sync" glance Step 41 Enable Glance service and startup On the controller host 10.0.service # systemctl status openstack‐glance‐api.236. 2.php?pod=3 41/180 .31 issue the command: [[IDSEQSTEP]] systemctl enable openstack‐glance‐api.service. enabled) Active: active (running) since Fri 2014‐12‐26 21:49:50 EST.service ├─33550 /usr/bin/python /usr/bin/glance‐api ├─33566 /usr/bin/python /usr/bin/glance‐api └─33567 /usr/bin/python /usr/bin/glance‐api Dec 26 21:49:50 localhost.236.31 issue the command: http://openstack. On the controller host 10.slice/openstack‐glance‐api.0.31 issue the command: [[IDSEQSTEP]] systemctl status systemctl status openstack‐ glance‐api.service openstack‐glance‐api.com/printable.service ‐ OpenStack Image Service (code‐named Glance) API se rver Loaded: loaded (/usr/lib/systemd/system/openstack‐glance‐api.123 openstack‐config ‐‐set /etc/glance/glance‐ registry. On the controller host 10.236. 2015 CiscoLive! OpenStack Lab LABCLD2225 admin_password cisco.0. On the controller host 10. 11s ago Main PID: 33550 (glance‐api) CGroup: /system.service openstack‐glance‐registry.conf paste_deploy flavor keystone Step 40 Synchronize Glance database The following command will connect glance to the MariaDB on the controller host and insert the proper table SQL structure that glance needs.ciscolive. 2015 CiscoLive! OpenStack Lab LABCLD2225 [[IDSEQSTEP]] systemctl status openstack‐glance‐ registry. you could download various different operating system flavors and insert them into glance for use by the Tenants of OpenStack.31 issue the command: [[IDSEQSTEP]] mkdir /tmp/images cd /tmp/images wget http://cdn. On the controller host 10. Once glance has the image in the repository we can create instances in OpenStack of the Cirros image.slice/openstack‐glance‐registry.service # systemctl status openstack‐glance‐registry.service openstack‐glance‐registry. we will download a small linux image called Cirros. Step 42 Download ISO image for Glance Image Repository Since Glance is operational.236.localdomain systemd[1]: Started OpenStack Image Service (code‐named Glance) Registry server.0.0.ciscolive.localdomain systemd[1]: Starting OpenStack Image Servic e (code‐named Glance) Registry server.3/cirros‐0.1.service ├─33551 /usr/bin/python /usr/bin/glance‐registry ├─33564 /usr/bin/python /usr/bin/glance‐registry └─33565 /usr/bin/python /usr/bin/glance‐registry Dec 26 21:49:49 localhost..236. Hint: Some lines were ellipsized.service. Dec 26 21:49:50 localhost.cirros‐ cloud.3‐x86_64‐disk. we will take the Cirros image and add it to the glance repository.31 issue the command: http://openstack.download. 2.3.img Step 43 Add ISO image to Glance Image Repository Using glance.service ‐ OpenStack Image Service (code‐named Glance) R egistry server Loaded: loaded (/usr/lib/systemd/system/openstack‐glance‐registry.. 20s ago Main PID: 33551 (glance‐registry) CGroup: /system. use ‐l to show in full.3. If you had this in a production environment. On the controller host 10.net/0. ena bled) Active: active (running) since Fri 2014‐12‐26 21:49:50 EST.php?pod=3 42/180 .com/printable. 0.1.com/printable.php?pod=3 43/180 .3.3.3‐x86_64‐disk.31 issue the command: [[IDSEQSTEP]] glance image‐list Now that the image has been added to glance.236. On the controller host 10.3‐x86_64 | qcow2 | bare | 13200896 | active | +‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐+ http://openstack.3. 2015 CiscoLive! OpenStack Lab LABCLD2225 [[IDSEQSTEP]] glance image‐create ‐‐name "cirros‐0.3‐x86_64" ‐‐file cirros‐0. 2.img ‐‐disk‐ format qcow2 ‐‐container‐format bare ‐‐is‐public True ‐‐progress cd rm ‐rf /tmp/images Step 44 List image repository in glance The command glance image‐list will provide you the list of all images that are available for users in this OpenStack system. you can look at the list of images in glance with the command glance image‐list # glance image‐list +‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐+ | ID | Name | Disk Format | Cont ainer Format | Size | Status | +‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐+ | 3ca7952a‐4d5f‐4e15‐85dd‐7a5cd7223dd3 | cirros‐0.ciscolive. Step 45 Open Firewall Holes On the controller host 10.com/printable. Nova provides an API abstract the hypervisor from the applications and then leverages underlying hypervisors like KVM.236.php?pod=3 44/180 . 2015 CiscoLive! OpenStack Lab LABCLD2225 Configure Nova on Controller Host As you read earlier. For this lab you will be configuring two separate nodes as compute. It manages scheduling and placement of instances in the OpenStack system. 2.31 issue the command: [[IDSEQSTEP]] firewall‐cmd ‐‐add‐port=8774/tcp ‐‐permanent firewall‐cmd ‐‐add‐port=8773/tcp ‐‐permanent firewall‐cmd ‐‐add‐port=8775/tcp ‐‐permanent firewall‐cmd ‐‐add‐port=6080/tcp ‐‐permanent firewall‐cmd ‐‐add‐port=6081/tcp ‐‐permanent firewall‐cmd ‐‐add‐port=6082/tcp ‐‐permanent firewall‐cmd ‐‐add‐port=5900‐5999/tcp ‐‐ permanent firewall‐cmd ‐‐reload Step 46 Configure Nova database and access to database http://openstack. Nova is the compute provisioning service of OpenStack.0. Note that the Nova service itself is not a hypervisor.ciscolive.1. The controller is performing a dual role as both a controller and a compute node while the second compute node that is only a compute node. ciscolive.123 CREATE DATABASE nova.0.236.0.php?pod=3 45/180 .com/printable.236. On the controller host 10.sh Now that you have assumed the identity of the admin user. 2.236.31:8774/v2/%\ (tenant_id\)s \ ‐‐adminurl http://10.236.31:8774/v2/%\ (tenant_id\)s \ ‐‐internalurl http://10.1.31:8774/v2/%\ (tenant_id\)s \ ‐‐region regionOne Step 48 Install Nova On the controller host 10.31 issue the command: [[IDSEQSTEP]] mysql ‐‐user=root ‐‐password=cisco.0.31 issue the command: http://openstack. you can add the Nova users to keystone.0.123'.236. GRANT ALL PRIVILEGES ON nova.236.0.* TO 'nova'@'localhost' IDENTIFIED BY 'cisco.236.123 keystone user‐role‐add ‐‐user nova ‐‐tenant service ‐‐role admin keystone service‐create ‐‐name nova ‐‐type compute ‐‐description "OpenStack Compute" keystone endpoint‐create \ ‐‐service‐id $(keystone service‐list | awk '/ compute / {print $2}') \ ‐‐publicurl http://10.* TO 'nova'@'%' IDENTIFIED BY 'cisco. 2015 CiscoLive! OpenStack Lab LABCLD2225 On the controller host 10.0.31 issue the commands: [[IDSEQSTEP]] keystone user‐create ‐‐name nova ‐‐pass cisco. exit Step 47 Add Nova users to keystone Once the database is ready.0.31 issue the command: [[IDSEQSTEP]] cd ~ source admin. On the controller host 10. you can issue the following commands to create the user and the service for Nova in Keystone. GRANT ALL PRIVILEGES ON nova.123'. com/printable.236. you might want to reduce the worker size. In production environments with servers that have large amount of CPU cores. In large datacenter environments the amount of workers keeping established sessions against the database can cause scaling issues.conf conductor workers 4 You will now configure the keystone authentication and RabbitMQ backend. OpenStack instantiates a thread that connects to MySQL. 2015 CiscoLive! OpenStack Lab LABCLD2225 [[IDSEQSTEP]] yum ‐y install openstack‐nova‐api openstack‐ nova‐cert openstack‐nova‐conductor \ openstack‐nova‐console openstack‐nova‐ novncproxy openstack‐nova‐scheduler \ python‐novaclient openstack‐nova‐compute sysfsutils Step 49 Configure Nova INI file On the controller host
[email protected] database connection mysql://nova:cisco.ciscolive.31 issue the command: The first command is to establish the SQL connection base parameters. [[IDSEQSTEP]] openstack‐config ‐‐set /etc/nova/nova. [[IDSEQSTEP]] openstack‐config ‐‐set /etc/nova/nova.236. This provides Nova with the credentials needed to reach the database and it's default database (nova).1.php?pod=3 46/180 .conf DEFAULT metadata_workers 4 openstack‐config ‐‐set /etc/nova/nova.conf DEFAULT ec2_workers 4 openstack‐config ‐‐set /etc/nova/nova.31/nova Limit the workers for Nova in this system.conf DEFAULT osapi_compute_workers 4 openstack‐config ‐‐set /etc/nova/nova. The reason is that for each CPU core. For this lab we are limiting them to 4 as the server has many CPU cores.0. 2. http://openstack. 0.236.31:35357 openstack‐config ‐‐set /etc/nova/nova.API openstack‐config ‐‐set /etc/nova/nova.virt.236.conf DEFAULT vncserver_proxyclient_address 10.api.236.conf keystone_authtoken admin_password cisco.0.31 openstack‐config ‐‐set /etc/nova/nova.NoopFirewallDriver openstack‐config ‐‐set /etc/nova/nova.conf DEFAULT vnc_enabled True openstack‐config ‐‐set /etc/nova/nova.network.conf DEFAULT rpc_backend rabbit openstack‐config ‐‐set /etc/nova/nova.conf glance host 10.0.conf keystone_authtoken admin_user nova openstack‐config ‐‐set /etc/nova/nova.conf DEFAULT rabbit_host 10.0.ciscolive.0. 2015 CiscoLive! OpenStack Lab LABCLD2225 [[IDSEQSTEP]] openstack‐config ‐‐set /etc/nova/nova.conf DEFAULT firewall_driver nova.firewall.conf DEFAULT novncproxy_base_url http://10.31:5000/v2. 2.0 openstack‐config ‐‐set /etc/nova/nova.linux_net.31:6080/vnc_auto.31 openstack‐config ‐‐set /etc/nova/nova.31 http://openstack.LinuxOVSInterfaceDriver openstack‐config ‐‐set /etc/nova/nova.neutronv2.236.conf DEFAULT vnc_keymap en‐us openstack‐config ‐‐set /etc/nova/nova.0.conf DEFAULT rabbit_password cisco.conf DEFAULT network_api_class nova.0.1.123 Define the VNC parameters to reach the instances created by Nova.conf keystone_authtoken auth_uri http://10.conf keystone_authtoken identity_uri http://10.236.conf DEFAULT verbose True openstack‐config ‐‐set /etc/nova/nova.conf DEFAULT auth_strategy keystone openstack‐config ‐‐set /etc/nova/nova.conf DEFAULT vncserver_listen 0.31 openstack‐config ‐‐set /etc/nova/nova.conf keystone_authtoken admin_tenant_name service openstack‐config ‐‐set /etc/nova/nova.network.com/printable.236.123 openstack‐config ‐‐set /etc/nova/nova.236.php?pod=3 47/180 . [[IDSEQSTEP]] openstack‐config ‐‐set /etc/nova/nova.conf DEFAULT security_group_api neutron openstack‐config ‐‐set /etc/nova/nova.conf DEFAULT linuxnet_interface_driver nova.0.html Define the glance host so that Nova can reach ISO images for instance creation.0. [[IDSEQSTEP]] openstack‐config ‐‐set /etc/nova/nova.0 openstack‐config ‐‐set /etc/nova/nova.conf DEFAULT my_ip 10. com/printable.php?pod=3 48/180 . This makes it possible for Nova to learn how to configure the network components of instances that it creates.31 issue the command: [[IDSEQSTEP]] systemctl enable openstack‐nova‐api.236.service openstack‐ nova‐novncproxy.service http://openstack.conf neutron admin_auth_url http://10.236.0.service openstack‐ nova‐scheduler.service openstack‐ nova‐novncproxy. 2.service openstack‐nova‐cert.conf neutron admin_password cisco.service openstack‐ nova‐scheduler.service \ openstack‐nova‐consoleauth.123 Step 50 Initialize the Database for Nova On the controller host 10.31:9696 openstack‐config ‐‐set /etc/nova/nova.0.0.conf neutron service_metadata_proxy True openstack‐config ‐‐set /etc/nova/nova.0 openstack‐config ‐‐set /etc/nova/nova.31 issue the command: [[IDSEQSTEP]] su ‐s /bin/sh ‐c "nova‐manage db sync" nova Step 51 Configure system to start Nova On the controller host 10.conf neutron auth_strategy keystone openstack‐config ‐‐set /etc/nova/nova.conf neutron admin_username neutron openstack‐config ‐‐set /etc/nova/nova. [[IDSEQSTEP]] openstack‐config ‐‐set /etc/nova/nova.236. [[IDSEQSTEP]] openstack‐config ‐‐set /etc/nova/nova.0.31:35357/v2.service systemctl start openstack‐nova‐api.ciscolive.conf neutron admin_tenant_name service openstack‐config ‐‐set /etc/nova/nova.service \ openstack‐nova‐conductor.1.conf neutron url http://10.236.service \ openstack‐nova‐conductor.conf libvirt virt_type kvm Configure neutron access and metadata.123 openstack‐config ‐‐set /etc/nova/nova. 2015 CiscoLive! OpenStack Lab LABCLD2225 Specify the virtualization driver (hypervisor) to use for creating instances.service \ openstack‐nova‐consoleauth.conf neutron metadata_proxy_shared_secret cisco.service openstack‐nova‐cert. service ‐ OpenStack Nova VNC console auth Server Loaded: loaded (/usr/lib/systemd/system/openstack‐nova‐consoleauth. COMMAND=/bin/nova‐rootwrap /etc/nova/rootwrap...1.service openstack‐nova‐cert. PWD=/ . COMMAND=/bin/nova‐rootwrap /etc/nova/rootwrap.service \ openstack‐nova‐conductor. 23h ago Main PID: 13448 (nova‐api) CGroup: /system. enabled) Active: active (running) since Thu 2015‐01‐15 11:31:34 EST. .service openstack‐nova‐novncproxy.service openstack‐ nova‐scheduler. 23h ago Main PID: 12629 (nova‐cert) CGroup: /system. en abled) Active: active (running) since Thu 2015‐01‐15 11:29:46 EST. Jan 15 11:29:46 pod4‐controller systemd[1]: Started OpenStack Nova Cert Server. 2015 CiscoLive! OpenStack Lab LABCLD2225 Step 52 Validate Nova system status On the controller host 10.slice/openstack‐nova‐cert. 23h ago Main PID: 12630 (nova‐consoleaut) http://openstack.service \ > openstack‐nova‐conductor..slice/openstack‐nova‐api.service openstack‐nova‐api.conf iptables‐save ‐c Jan 15 11:31:34 pod4‐controller sudo[13466]: nova : TTY=unknown .service.service \ > openstack‐nova‐consoleauth.conf iptables‐restore ‐c Jan 15 11:31:34 pod4‐controller systemd[1]: Started OpenStack Nova API Server. 2. Jan 15 11:31:34 pod4‐controller sudo[13463]: nova : TTY=unknown . enabled) Active: active (running) since Thu 2015‐01‐15 11:29:46 EST. openstack‐nova‐consoleauth.service openstack‐nova‐scheduler.com/printable. USER=ro ot .service # systemctl status openstack‐nova‐api.service openstack‐ nova‐novncproxy.php?pod=3 49/180 . openstack‐nova‐cert.service ‚î‚îÄ13448 /usr/bin/python /usr/bin/nova‐api ‚î‚îÄ13455 /usr/bin/python /usr/bin/nova‐api ‚î‚îÄ13456 /usr/bin/python /usr/bin/nova‐api ‚î‚îÄ13457 /usr/bin/python /usr/bin/nova‐api ‚î‚îÄ13458 /usr/bin/python /usr/bin/nova‐api ‚î‚îÄ13459 /usr/bin/python /usr/bin/nova‐api ‚î‚îÄ13460 /usr/bin/python /usr/bin/nova‐api ‚î‚îÄ13461 /usr/bin/python /usr/bin/nova‐api ‚î‚îÄ13462 /usr/bin/python /usr/bin/nova‐api ‚î‚îÄ13469 /usr/bin/python /usr/bin/nova‐api ‚î‚îÄ13470 /usr/bin/python /usr/bin/nova‐api ‚î‚îÄ13471 /usr/bin/python /usr/bin/nova‐api ‚îî‚îÄ13472 /usr/bin/python /usr/bin/nova‐api Jan 15 11:31:33 pod4‐controller systemd[1]: Starting OpenStack Nova API Server.0.service ‐ OpenStack Nova API Server Loaded: loaded (/usr/lib/systemd/system/openstack‐nova‐api.service ‚îî‚îÄ12629 /usr/bin/python /usr/bin/nova‐cert Jan 15 11:29:45 pod4‐controller systemd[1]: Starting OpenStack Nova Cert Server. PWD=/ .service. USER=ro ot .service ‐ OpenStack Nova Cert Server Loaded: loaded (/usr/lib/systemd/system/openstack‐nova‐cert.236.ciscolive.service \ openstack‐nova‐consoleauth.service openstack‐nova‐cert.service.31 issue the command: [[IDSEQSTEP]] systemctl status openstack‐nova‐api. service ‐ OpenStack Nova Conductor Server Loaded: loaded (/usr/lib/systemd/system/openstack‐nova‐conductor.service ‐ OpenStack Nova NoVNC Proxy Server Loaded: loaded (/usr/lib/systemd/system/openstack‐nova‐novncproxy..0.1.service ‚îî‚îÄ13338 /usr/bin/python /usr/bin/nova‐scheduler Jan 15 11:31:18 pod4‐controller systemd[1]: Started OpenStack Nova Scheduler Serv er. openstack‐nova‐scheduler.service ‚îî‚îÄ12633 /usr/bin/python /usr/bin/nova‐novncproxy ‐‐web /usr/share/ novnc/ [CUT] Hint: Some lines were ellipsized. use ‐l to show in full. On the controller host 10. 23h ago Main PID: 13338 (nova‐scheduler) CGroup: /system. openstack‐nova‐conductor. enab led) Active: active (running) since Thu 2015‐01‐15 11:31:18 EST.service ‚î‚îÄ13336 /usr/bin/python /usr/bin/nova‐conductor ‚î‚îÄ13359 /usr/bin/python /usr/bin/nova‐conductor ‚î‚îÄ13360 /usr/bin/python /usr/bin/nova‐conductor ‚î‚îÄ13361 /usr/bin/python /usr/bin/nova‐conductor ‚îî‚îÄ13362 /usr/bin/python /usr/bin/nova‐conductor [CUT] openstack‐nova‐novncproxy. 23h ago Main PID: 13336 (nova‐conductor) CGroup: /system.service.236..slice/openstack‐nova‐scheduler. 23h ago Main PID: 12633 (nova‐novncproxy) CGroup: /system.service. 2. Jan 15 11:29:46 pod4‐controller systemd[1]: Started OpenStack Nova VNC console au th Server.slice/openstack‐nova‐conductor. If you are running OpenStack on a virtual machine.ciscolive.slice/openstack‐nova‐consoleauth. 2015 CiscoLive! OpenStack Lab LABCLD2225 CGroup: /system. Step 53 Determine system hardware CPU type For virtualization we have to determine the hardware type of the CPU.com/printable.31 issue the command: [[IDSEQSTEP]] egrep ‐c '(vmx|svm)' /proc/cpuinfo http://openstack. it might not be possible to run KVM in itself as it requires hardware acceleration features from the CPU. You can determine the hardware type by issuing the command. enab led) Active: active (running) since Thu 2015‐01‐15 11:31:18 EST.php?pod=3 50/180 .service ‚îî‚îÄ12630 /usr/bin/python /usr/bin/nova‐consoleauth Jan 15 11:29:45 pod4‐controller systemd[1]: Starting OpenStack Nova VNC console a uth Server.service. ena bled) Active: active (running) since Thu 2015‐01‐15 11:29:45 EST.slice/openstack‐nova‐novncproxy.service ‐ OpenStack Nova Scheduler Server Loaded: loaded (/usr/lib/systemd/system/openstack‐nova‐scheduler. By default KVM is the default hypervisor used in OpenStack. you can start that functionality.31 issue the command: [[IDSEQSTEP]] lsmod | grep kvm # lsmod | grep kvm kvm_intel 138567 0 kvm 441119 1 kvm_intel Step 54 Configure system to start virtualization engine Now that you have validated the virtualization requirements.236. 2. On the controller host 10.31 issue the command: [[IDSEQSTEP]] nova service‐list http://openstack. On the controller host 10.com/printable.0.0.0.236.236. 2015 CiscoLive! OpenStack Lab LABCLD2225 # egrep ‐c '(vmx|svm)' /proc/cpuinfo 2 # Based on the result from the command you can derive the following from the table: Result Required Hypervisor 0 Qemu >1 KVM You can now then validate that the KVM module is loaded.service systemctl start libvirtd.1.php?pod=3 51/180 .service systemctl start openstack‐nova‐compute.31 issue the command: [[IDSEQSTEP]] systemctl enable libvirtd.service Step 55 Validate Nova instance On the controller host 10.service openstack‐ nova‐compute.ciscolive. 000000 | ‐ | +‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ Nova should at this point also see the image resources provided by glance. 2.php?pod=3 52/180 .1.ciscolive.000000 | ‐ | | 3 | nova‐conductor | pod3‐controller | internal | enabled | up | 2015‐01‐ 11T02:48:08.000000 | ‐ | | 5 | nova‐compute | pod3‐controller | nova | enabled | up | 2015‐01‐ 11T02:48:08. Yet this is Nova interacting with glance retrieving that information.com/printable. [[IDSEQSTEP]] nova image‐list # nova image‐list +‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐+ | ID | Name | Status | Server | +‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐+ | 3ca7952a‐4d5f‐4e15‐85dd‐7a5cd7223dd3 | cirros‐0.3.000000 | ‐ | | 4 | nova‐scheduler | pod3‐controller | internal | enabled | up | 2015‐01‐ 11T02:48:08.3‐x86_64 | ACTIVE | | +‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐+ http://openstack. The command nova image‐list should present you with the same information we got from glance.000000 | ‐ | | 2 | nova‐consoleauth | pod3‐controller | internal | enabled | up | 2015‐01‐ 11T02:48:13. 2015 CiscoLive! OpenStack Lab LABCLD2225 # nova service‐list +‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ | Id | Binary | Host | Zone | Status | State | Updated_ at | Disabled Reason | +‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ | 1 | nova‐cert | pod3‐controller | internal | enabled | up | 2015‐01‐ 11T02:48:12. Separate hosts would be required for scalability.32 issue the command: [[IDSEQSTEP]] yum ‐y install openstack‐nova‐compute sysfsutils Step 58 Configure Nova on compute On the compute host 10.0. NOTE: This commands for this section should be entered on the second host the compute node.32 issue the command: http://openstack. In a large scale OpenStack environment that wouldn't be the case.32 issue the command: [[IDSEQSTEP]] firewall‐cmd ‐‐add‐port=8774/tcp ‐‐permanent firewall‐cmd ‐‐add‐port=8773/tcp ‐‐permanent firewall‐cmd ‐‐add‐port=8775/tcp ‐‐permanent firewall‐cmd ‐‐add‐port=6080/tcp ‐‐permanent firewall‐cmd ‐‐add‐port=6081/tcp ‐‐permanent firewall‐cmd ‐‐add‐port=6082/tcp ‐‐permanent firewall‐cmd ‐‐add‐port=5900‐5999/tcp ‐‐ permanent firewall‐cmd ‐‐reload Step 57 Install Nova on compute node On the compute host 10.236. not the controller node. Ensure you connect to the correct PuTTY session before entering these commands. The first compute host contains the control processes for the compute host.1. 2. Each additional compute host has a smaller configuration footprint than the controller. The controller host contains the first compute host.0.ciscolive.0.236.com/printable. 2015 CiscoLive! OpenStack Lab LABCLD2225 Configure Nova on Compute Host Next you must configure the second host in the cluster as a compute host. Step 56 Open Firewall Holes As a first step in the compute host you need to open the firewall ports for Nova.236.php?pod=3 53/180 . On the compute host 10. conf DEFAULT auth_strategy keystone openstack‐config ‐‐set /etc/nova/nova.conf keystone_authtoken identity_uri http://10.conf keystone_authtoken admin_user nova openstack‐config ‐‐set /etc/nova/nova.conf DEFAULT vnc_enabled True openstack‐config ‐‐set /etc/nova/nova. it might not be possible to run KVM in itself as it requires hardware acceleration features from the CPU.php?pod=3 54/180 .32 openstack‐config ‐‐set /etc/nova/nova.32 issue the command: [[IDSEQSTEP]] egrep ‐c '(vmx|svm)' /proc/cpuinfo # egrep ‐c '(vmx|svm)' /proc/cpuinfo 2 # Based on the result from the command you can derive the following from the table: http://openstack.0.conf DEFAULT rabbit_host 10.236.236.0.conf keystone_authtoken admin_password cisco. 2015 CiscoLive! OpenStack Lab LABCLD2225 [[IDSEQSTEP]] openstack‐config ‐‐set /etc/nova/nova.236.32 openstack‐config ‐‐set /etc/nova/nova.conf libvirt virt_type kvm Step 59 Determine system hardware CPU type For virtualization we have to determine the hardware type of the CPU.31 openstack‐config ‐‐set /etc/nova/nova.31 openstack‐config ‐‐set /etc/nova/nova.0 openstack‐config ‐‐set /etc/nova/nova.conf DEFAULT vncserver_proxyclient_address 10.0 openstack‐config ‐‐set /etc/nova/nova.0.conf glance host 10.0.0.236.conf DEFAULT my_ip 10.236.0.0.conf DEFAULT rabbit_password cisco.conf keystone_authtoken auth_uri http://10. 2.123 openstack‐config ‐‐set /etc/nova/nova.conf DEFAULT vncserver_listen 0.31:5000/v2.0.0.html openstack‐config ‐‐set /etc/nova/nova.1. On the compute host 10. If you are running OpenStack on a virtual machine.com/printable.conf keystone_authtoken admin_tenant_name service openstack‐config ‐‐set /etc/nova/nova. You can determine the hardware type by issuing the command.236.31:6080/vnc_auto.31:35357 openstack‐config ‐‐set /etc/nova/nova.236.conf DEFAULT rpc_backend rabbit openstack‐config ‐‐set /etc/nova/nova.ciscolive.123 openstack‐config ‐‐set /etc/nova/nova.conf DEFAULT novncproxy_base_url http://10.236.0. 2015 CiscoLive! OpenStack Lab LABCLD2225 Result Required Hypervisor 0 Qemu >1 KVM You can now then validate that the KVM module is loaded.service systemctl start libvirtd.service systemctl status openstack‐nova‐compute. On the compute host 10.0.32 issue the command: [[IDSEQSTEP]] systemctl status libvirtd.32 issue the command: [[IDSEQSTEP]] systemctl enable libvirtd.236.service systemctl start openstack‐nova‐compute.32 issue the command: [[IDSEQSTEP]] lsmod | grep kvm # lsmod | grep kvm kvm_intel 138567 0 kvm 441119 1 kvm_intel Step 60 Configure system to start virtualization engine Now that you have validated the virtualization requirements. Don't worry about the errors that show up in red. you can start that functionality. This is because we have not loaded drivers for Linux Containers as we are not using them in this lab.0.1. On the compute host 10.236.ciscolive. By default KVM is the default hypervisor used in OpenStack.service Step 61 Validate Nova system status Run the following commands to check the status of the virtualization driver.service http://openstack. On the compute host 10.service openstack‐ nova‐compute.0. 2.php?pod=3 55/180 .com/printable.236. PWD=/ .service ‚îî‚îÄ17151 /usr/bin/python /usr/bin/nova‐compute Jan 16 06:02:47 pod4‐compute2 sudo[15029]: nova : TTY=unknown .cisco.el7_0. USER=root ..cisco.ecatsrtpdmz..cisco.service.ciscolive. Hint: Some lines were ellipsized.com libvirtd[3879]: Module /usr/l ib64/libvirt/connection‐driver/libvirt_drive. enabled) Active: active (running) since Thu 2015‐01‐15 10:30:32 EST. COMMAND=/bin/nova‐rootwrap /etc/nova/roo..ible Jan 15 10:30:32 pod4‐compute2.com/printable.0.service ‐ Virtualization daemon Loaded: loaded (/usr/lib/systemd/system/libvirtd. Hint: Some lines were ellipsized. USER=root .. PWD=/ .. USER=root .236. PWD=/ ...service ‚îî‚îÄ3879 /usr/sbin/libvirtd Jan 15 10:30:32 pod4‐compute2. PWD=/ .service.4 (CentOS Build. use ‐l to show in full. Step 62 Create shell identity files You will now create to separate files that will be used to change your identity status when interacting with Keystone..ecatsrtpdmz. PWD=/ .. USER=root . COMMAND=/bin/nova‐rootwrap /etc/nova/roo.. USER=root . COMMAND=/bin/nova‐rootwrap /etc/nova/ro.. USER=root ..221da6 Jan 16 06:42:48 pod4‐compute2 sudo[19882]: nova : TTY=unknown . enable d) Active: active (running) since Thu 2015‐01‐15 11:35:29 EST.32 issue the command: http://openstack.. COMMAND=/bin/nova‐rootwrap /etc/nova/ro.221da6 Jan 16 10:58:45 pod4‐compute2 systemd[1]: Started OpenStack Nova Compute Server. USER=root .org) Jan 15 10:30:32 pod4‐compute2.. PWD=/ .. PWD=/ .1. COMMAND=/bin/nova‐rootwrap /etc/nova/ro. [root@pod4‐compute2 ~]# systemctl status openstack‐nova‐compute. 2015 CiscoLive! OpenStack Lab LABCLD2225 # systemctl status libvirtd.221da6 Jan 16 07:23:59 pod4‐compute2 sudo[24839]: nova : TTY=unknown . Jan 16 10:59:26 pod4‐compute2 systemd[1]: Started OpenStack Nova Compute Server.com libvirtd[3879]: libvirt versi on: 1. use ‐l to show in full.. package: 29. Jan 15 11:35:28 pod4‐compute2 libvirtd[3879]: End of file while reading data: Inp ut/output error Jan 16 10:58:45 pod4‐compute2 systemd[1]: Started Virtualization daemon.service openstack‐nova‐compute. 23h ago Main PID: 17151 (nova‐compute) CGroup: /system. USER=root .221da6 Jan 16 10:47:57 pod4‐compute2 sudo[17156]: nova : TTY=unknown .1.1.service libvirtd. COMMAND=/bin/nova‐rootwrap /etc/nova/ro.. On the compute host 10.221da6 Jan 16 08:04:14 pod4‐compute2 sudo[29699]: nova : TTY=unknown . Jan 15 11:30:04 pod4‐compute2 systemd[1]: Started Virtualization daemon. PWD=/ .ecatsrtpdmz. 24h ago Main PID: 3879 (libvirtd) CGroup: /system.service ‐ OpenStack Nova Compute Server Loaded: loaded (/usr/lib/systemd/system/openstack‐nova‐compute.221da6 Jan 16 08:46:07 pod4‐compute2 sudo[2315]: nova : TTY=unknown .221da6 Jan 16 09:26:30 pod4‐compute2 sudo[7266]: nova : TTY=unknown ...php?pod=3 56/180 .slice/openstack‐nova‐compute. COMMAND=/bin/nova‐rootwrap /etc/nova/ro.com systemd[1]: Started Virtualiz ation daemon. COMMAND=/bin/nova‐rootwrap /etc/nova/ro..221da6 Jan 16 10:06:41 pod4‐compute2 sudo[12099]: nova : TTY=unknown . 2.slice/libvirtd. 32 issue the command: [[IDSEQSTEP]] cd ~ source admin.31 issue the command: [[IDSEQSTEP]] nova service‐list http://openstack.31:5000/v2.ciscolive.236. you can add the Nova users to keystone.123 export OS_AUTH_URL=http://10. On the controller host 10.0/ export OS_REGION_NAME=regionOne export PS1='[\u@\h \W(keystone_admin)]# ' EOF chmod +x admin. 2. 2015 CiscoLive! OpenStack Lab LABCLD2225 [[IDSEQSTEP]] cd ~ cat <<EOF > admin.236. verify that the dedicated compute node (pod3 compute2) is online and enabled.sh export OS_USERNAME=admin export OS_TENANT_NAME=admin export OS_PASSWORD=cisco.1.com/printable.0.sh Step 63 Assume admin identity for CLI Once the database is ready.0/ export OS_REGION_NAME=regionOne export PS1='[\u@\h \W(keystone_TenantPOD3)]# ' EOF chmod +x TenantPOD3.0. On the compute host 10.0.php?pod=3 57/180 .123 export OS_AUTH_URL=http://10.236.0.236.sh You will now create another file that takes the role of the user we have created.sh Step 64 Validate Nova instance In the output of the following command. [[IDSEQSTEP]] cd ~ cat <<EOF > TenantPOD3.31:5000/v2.sh export OS_USERNAME=userpod3 export OS_TENANT_NAME=TenantPOD3 export OS_PASSWORD=cisco. 000000 | ‐ | +‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ http://openstack.000000 | ‐ | | 3 | nova‐conductor | pod3‐controller | internal | enabled | up | 2015‐01‐ 11T02:50:08.1.000000 | ‐ | | 5 | nova‐compute | pod3‐controller | nova | enabled | up | 2015‐01‐ 11T02:50:08.ciscolive.com/printable.000000 | ‐ | | 4 | nova‐scheduler | pod3‐controller | internal | enabled | up | 2015‐01‐ 11T02:50:10. 2.000000 | ‐ | | 2 | nova‐consoleauth | pod3‐controller | internal | enabled | up | 2015‐01‐ 11T02:50:13.php?pod=3 58/180 . 2015 CiscoLive! OpenStack Lab LABCLD2225 # nova service‐list +‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ | Id | Binary | Host | Zone | Status | State | Updated_ at | Disabled Reason | +‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ | 1 | nova‐cert | pod3‐controller | internal | enabled | up | 2015‐01‐ 11T02:50:13.000000 | ‐ | | 6 | nova‐compute | pod3‐compute2 | nova | enabled | up | 2015‐01‐ 11T02:50:12. or those on subnets connected through interfaces to a similar router. and vice versa. 2. Any given Neutron set up has at least one external network.1. subnets. DHCP is disabled on this network. Whenever a virtual device (a virtual NIC on an instance) is connected to a subnet. Each abstraction has functionality that mimics its physical counterpart: networks contain subnets. Neutron provides the networks. Each router has one gateway that connects to a network. Additionally.com/printable. it represents a view into a slice of the physical. load balancers.php?pod=3 59/180 .ciscolive. subnets can access machines on other subnets that are connected to the same router. Each router has one gateway that is connected to a network and many interfaces that are connected to subnets. These softwaredefined networks connect directly to the VMs. can access VMs connected to that network directly. You can associate external network IP addresses with ports http://openstack. For the outside network to access VMs. and routers object abstractions. Only the VMs on a given internal network. OpenStack Networking enables tenants to create advanced virtual network topologies including services such as firewalls. that connection is called a port. and machines can access the outside network through the gateway for the router. IP addresses on the external network are accessible by anybody physically on the outside network. Unlike the other networks. the external network is not merely a virtually defined network. any Neutron set up has one or more internal networks called Tenant networks. In addition to external networks. routers between the networks are needed. 2015 CiscoLive! OpenStack Lab LABCLD2225 Configure Neutron Controller Host OpenStack Networking (neutron) manages all networking functions for the Virtual Networking Infrastructure (VNI) and the access layer aspects of the Physical Networking Infrastructure (PNI) in your OpenStack environment. you can allocate IP addresses on external networks to ports on the internal network. and virtual private networks (VPNs). Subnets can access machines on other subnets connected to the same router. Like a physical router. Instead. Because the external network merely represents a view into the outside network. external network accessible outside the OpenStack installation. and routers route traffic between different subnet and networks. and many interfaces connected to subnets. 0.31 issue the command: [[IDSEQSTEP]] firewall‐cmd ‐‐add‐port=9696/tcp ‐‐permanent firewall‐cmd ‐‐reload Step 66 Configure Neutron database and access to database On the controller host 10.123 CREATE DATABASE neutron. NOTE: Remember to switch back to your Controller node in PuTTY for this section.0.com/printable. Networking also supports security groups.* TO 'neutron'@'%' IDENTIFIED BY 'cisco. entities on the outside network can access VMs. port ranges.123'. While not vital to operating the VNI and OpenStack environment. All Neutron installations use a core plugin and a security group plugin (or just the NoOp security group plugin). or traffic types for that VM.123'. This functionality is called a Floating IP in OpenStack and basically provides a static NAT translation between an external network and a port on a Tenant network.1. GRANT ALL PRIVILEGES ON neutron. you can add the Neutron users to keystone. 2015 CiscoLive! OpenStack Lab LABCLD2225 to VMs. Step 65 Open Firewall Holes On the controller host 10. Security groups enable administrators to define basic firewall rules in groups.0. FirewallasaService (FWaaS) and LoadBalancerasa Service (LBaaS) plugins are available. understanding these concepts can help you set up Neutron. exit Step 67 Add Neutron users to keystone Once the database is ready. and Neutron applies the rules in those security groups to block or unblock ports. GRANT ALL PRIVILEGES ON neutron. Additionally.236.php?pod=3 60/180 .sh http://openstack.ciscolive.31 issue the command: [[IDSEQSTEP]] cd ~ source admin. 2.* TO 'neutron'@'localhost' IDENTIFIED BY 'cisco.236.236.31 issue the command: [[IDSEQSTEP]] mysql ‐‐user=root ‐‐password=cisco. A VM can belong to one or more security groups. This way. Each plugin that Neutron uses has its own concepts. On the controller host 10. conf DEFAULT workers 4 openstack‐config ‐‐set /etc/neutron/neutron.31:9696 \ ‐‐adminurl http://10.0.0.conf DEFAULT ec2_workers 4 openstack‐config ‐‐set /etc/neutron/neutron.123 keystone user‐role‐add ‐‐user neutron ‐‐tenant service ‐‐role admin keystone service‐create ‐‐name neutron ‐‐type network ‐‐description "OpenStack Networking" keystone endpoint‐create \ ‐‐service‐id $(keystone service‐list | awk '/ network / {print $2}') \ ‐‐publicurl http://10.0.31:9696 \ ‐‐region regionOne Step 68 Install Neutron On the controller host 10. you can issue the following commands to create the user and the service for Neutron in Keystone.236.0.236. 2.ciscolive.31 issue the command: [[IDSEQSTEP]] yum ‐y install openstack‐neutron openstack‐ neutron‐ml2 python‐neutronclient openstack‐ neutron‐openvswitch which Step 69 Configure Neutron INI On the controller host 10.conf DEFAULT osapi_compute_workers 4 openstack‐config ‐‐set /etc/neutron/neutron. http://openstack.31 issue the command: Configure the database connection and limit Neutron workers to
[email protected] issue the commands: [[IDSEQSTEP]] keystone user‐create ‐‐name neutron ‐‐pass cisco.conf DEFAULT metadata_workers 4 Configure the connection to the RabbitMQ server. 2015 CiscoLive! OpenStack Lab LABCLD2225 Now that you have assumed the identity of the admin user. [[IDSEQSTEP]] openstack‐config ‐‐set /etc/neutron/neutron.com/printable.31:9696 \ ‐‐internalurl http://10. On the controller host 10.236.1.0.31/neutron openstack‐config ‐‐set /etc/neutron/neutron.0.0.conf database connection mysql://neutron:cisco.php?pod=3 61/180 .236.236. 2.conf DEFAULT auth_strategy keystone openstack‐config ‐‐set /etc/neutron/neutron.236.31 openstack‐config ‐‐set /etc/neutron/neutron.1.236.conf DEFAULT nova_region_name regionOne openstack‐config ‐‐set /etc/neutron/neutron.conf DEFAULT notify_nova_on_port_status_changes True openstack‐config ‐‐set /etc/neutron/neutron. [[IDSEQSTEP]] openstack‐config ‐‐set /etc/neutron/neutron.com/printable.conf DEFAULT nova_admin_auth_url http://10.0.31:35357 openstack‐config ‐‐set /etc/neutron/neutron.31:35357/v2.conf keystone_authtoken auth_uri http://10. 2015 CiscoLive! OpenStack Lab LABCLD2225 [[IDSEQSTEP]] openstack‐config ‐‐set /etc/neutron/neutron.123 Configure Neutron to Nova parameters.conf DEFAULT nova_admin_password cisco.conf keystone_authtoken admin_password cisco.php?pod=3 62/180 .conf DEFAULT core_plugin ml2 openstack‐config ‐‐set /etc/neutron/neutron.conf keystone_authtoken identity_uri http://10.conf DEFAULT nova_admin_tenant_id $(keystone tenant‐ get service | awk '/ id / {print $4}') openstack‐config ‐‐set /etc/neutron/neutron.conf DEFAULT notify_nova_on_port_data_changes True openstack‐config ‐‐set /etc/neutron/neutron.conf DEFAULT nova_admin_username nova openstack‐config ‐‐set /etc/neutron/neutron.0.123 Define the ML2 Plugin.0.conf DEFAULT rabbit_host 10.0 openstack‐config ‐‐set /etc/neutron/neutron.0.ciscolive.236.0.236.31:8774/v2 openstack‐config ‐‐set /etc/neutron/neutron. [[IDSEQSTEP]] openstack‐config ‐‐set /etc/neutron/neutron.conf DEFAULT nova_url http://10.conf keystone_authtoken admin_tenant_name service openstack‐config ‐‐set /etc/neutron/neutron.conf DEFAULT service_plugins router openstack‐config ‐‐set /etc/neutron/neutron.236.conf DEFAULT rpc_backend rabbit openstack‐config ‐‐set /etc/neutron/neutron.conf DEFAULT allow_overlapping_ips True http://openstack.31:5000/v2.0 openstack‐config ‐‐set /etc/neutron/neutron.123 Configure the keystone server auth URI parameters.conf keystone_authtoken admin_user neutron openstack‐config ‐‐set /etc/neutron/neutron. [[IDSEQSTEP]] openstack‐config ‐‐set /etc/neutron/neutron.conf DEFAULT rabbit_password cisco. agent.ciscolive. flat. It currently includes drivers for the local.236.ini ml2 type_drivers local.com/printable. allowing multiple mechanisms to be used simultaneously.0. Linux Bridge .linux. GRE and VXLAN network types and works with the existing Open vSwitch.php?pod=3 63/180 .gre.ini ml2 mechanism_drivers openvswitch openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf. 2015 CiscoLive! OpenStack Lab LABCLD2225 The Modular Layer 2 plugin allows OpenStack Networking to simultaneously utilize the variety of layer 2 networking technologies found in complex realworld data centers.ini securitygroup enable_security_group True openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf. The ML2 plugin can be extended through mechanism drivers.vxlan openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf.ini securitygroup firewall_driver neutron.1.vlan.flat. and HyperV L2 agents.31 issue the command: http://openstack.OVSHybridIptablesFirewallDriver Step 71 Configure Nova Neutron integration On the controller host 10.0. Step 70 Configure ML2 Plugin On the controller host 10.236. VLAN.ini securitygroup enable_ipset True openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf. 2.31 issue the command: [[IDSEQSTEP]] openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf.ini ml2 tenant_network_types vlan openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf.iptables_firewall. ini /etc/neutron/plugin.31:35357/v2.31 issue the command: [[IDSEQSTEP]] su ‐s /bin/sh ‐c "neutron‐db‐manage ‐‐config‐ file /etc/neutron/neutron.1.0.0.31 issue the command: [[IDSEQSTEP]] ln ‐s /etc/neutron/plugins/ml2/ml2_conf.236.conf DEFAULT linuxnet_interface_driver nova.firewall.0 openstack‐config ‐‐set /etc/nova/nova.neutronv2.0.network.ini upgrade juno" neutron Step 74 Restart Nova to reread configuration file On the controller host 10.api.conf ‐‐config‐file /etc/neutron/plugins/ml2/ml2_conf.0. 2.123 Step 72 Link ML2 plugin to neutron On the controller host 10.linux_net.conf DEFAULT security_group_api neutron openstack‐config ‐‐set /etc/nova/nova.0.conf DEFAULT firewall_driver nova.ciscolive.conf neutron auth_strategy keystone openstack‐config ‐‐set /etc/nova/nova.network.API openstack‐config ‐‐set /etc/nova/nova.conf neutron url http://10.conf DEFAULT network_api_class nova.conf neutron admin_auth_url http://10. 2015 CiscoLive! OpenStack Lab LABCLD2225 [[IDSEQSTEP]] openstack‐config ‐‐set /etc/nova/nova.LinuxOVSInterfaceDriver openstack‐config ‐‐set /etc/nova/nova.236.236.31 issue the command: http://openstack.conf neutron admin_password cisco.NoopFirewallDriver openstack‐config ‐‐set /etc/nova/nova.conf neutron admin_tenant_name service openstack‐config ‐‐set /etc/nova/nova.236.com/printable.31:9696 openstack‐config ‐‐set /etc/nova/nova.ini Step 73 Database build for Neutron On the controller host 10.236.virt.conf neutron admin_username neutron openstack‐config ‐‐set /etc/nova/nova.php?pod=3 64/180 . 31 issue the command: [[IDSEQSTEP]] systemctl enable neutron‐server.0. Filter selects the default RPF filtering setting for IPV4 networking with three possible options.service Step 75 Enable and start Neutron service On the controller host 10.service systemctl start neutron‐server. Jan 09 13:21:57 pod4‐controller systemd[1]: Started OpenStack Neutron Server.236. 17s ago Main PID: 23998 (neutron‐server) CGroup: /system. 2.service openstack‐nova‐ conductor. enabled) Active: active (running) since Fri 2015‐01‐09 13:21:57 EST..service.31 issue the command: [[IDSEQSTEP]] systemctl status neutron‐server. 2 = Loose mode as defined in RFC3704 Loose Reverse Path Each incoming packet's source address is also tested against the FIB and if the source address is not reachable http://openstack.1. 0 = No source validation 1 = Strict mode as defined in RFC3704 Strict Reverse Path Each incoming packet is tested against the FIB and if the interface is not the best reverse path the packet check will fail.236.slice/neutron‐server.0.service # systemctl status neutron‐server..service ‚îî‚îÄ23998 /usr/bin/python /usr/bin/neutron‐server ‐‐config‐file /usr /share/neutron/neutron‐dist.php?pod=3 65/180 .service ‐ OpenStack Neutron Server Loaded: loaded (/usr/lib/systemd/system/neutron‐server.service openstack‐nova‐scheduler. Step 77 Configure IP forwarding on linux system control Ip Forwarding allows the network packets on one network interface (eth0) to be forwarded to another network interface (eth1).conf ‐‐config‐file /etc/.com/printable. 2015 CiscoLive! OpenStack Lab LABCLD2225 [[IDSEQSTEP]] systemctl restart openstack‐nova‐api.ciscolive.service Step 76 Validate Neutron service status On the controller host 10. By default failed packets are discarded. This will allow the Linux computer to connect (“ethernet bridge”) or route network traffic.service neutron‐server. 31 issue the command: [[IDSEQSTEP]] sysctl ‐p Understanding OpenStack Networking There are four distinct type of virtual networking devices: TAP devices.ip_forward=1 net.all.0. Linux bridges. The Linux bridge uses a MAC caching table to record which interface on the bridge is used to communicate with a host on the link.ipv4.ipv4. If not. Open vSwitch bridge brint. An Ethernet frame sent to one end of a veth pair is received by the other end of a veth pair.conf. the frame is flooded to all network ports in http://openstack.conf.236. 2. and Open vSwitch bridges. Networking uses veth pairs as virtual patch cables to make connections between virtual bridges. such as vnet0 is how hypervisors such as KVM implement a virtual network interface card (typically called a VIF or vNIC).rp_filter=0 EOF Validate changes to sysctl file. veth pair (intbrex. veth pair (qvbNNN. and. A veth pair is a pair of directly connected virtual network interfaces.0. On the controller host 10. phybreth1). When the bridge needs to forward a frame.rp_filter=0 net.1. 2015 CiscoLive! OpenStack Lab LABCLD2225 via any interface the packet check will fail. An Ethernet frame sent to a TAP device is received by the guest operating system. A Linux bridge behaves like a simple MAC learning switch: you can connect multiple (physical or virtual) network interfaces devices to a Linux bridge. the Linux bridge forwards the frame through only that port. For any Ethernet frames that come in from one interface attached to the bridge.236. finally. If so. it must pass through nine virtual devices inside of the host: TAP vnet0. the host MAC address and port on which the frame was received is recorded in the MAC caching table for a limited time. it will check to see if the frame's destination MAC address is recorded in the table. For an Ethernet frame to travel from eth0 of a virtual machine to the physical network.com/printable. On the controller host 10.conf net.31 issue the command: [[IDSEQSTEP]] cat <<EOF >> /etc/sysctl. qvoNNN). Linux bridge qbrNNN.default. the physical network interface card enp8s0.ipv4. A TAP device. veth pairs.ciscolive.php?pod=3 66/180 . switches.ciscolive. on the other hand. The Open vSwitch plugin is one of the most popular core plugins. Neutron uses a Linux feature called network namespaces that enable Linux to group adapters into unique namespaces that are not visible to other namespaces (the equivalent of a VRF in the routing world). you can use two different technologies to create the virtual networks: GRE or VLANs. It uses a combination for IPTables and OpenFlow rules. and the underlying packet is routed. a brtun bridge is used instead. Open vSwitch uses OpenFlow. connects to the virtual machines (Instances) and associated services via the Linux Bridges that are used for security group functionality. use a special modification to the Ethernet header. with the exception of the port where the frame was received. These tunnels are ports on a bridge and enable bridges on different systems to act as though they were one bridge. even through all devices are on the same physical network. The external bridge.0. made of all ones. Packets tagged for one VLAN are only shared with other devices configured to be on that VLAN.php?pod=3 67/180 . 2015 CiscoLive! OpenStack Lab LABCLD2225 the bridge. The most common security group driver used with Open vSwitch is the Hybrid IPTables/Open vSwitch plugin. which enables you to define networking flow rules. They add a 4byte VLAN tag that ranges from 1 to 4094 (the 0 tag is special. connects to the external network when using flat or VLAN networking. and routers know how to interpret the VLAN tags. It encapsulates IP packets inside another IP packet to create entirely new packets with different routing information. is equivalent to an untagged packet). Finally. This allows the same network node to manage multiple Neutron routers with each namespace representing a virtual router function. Special NICs. The sole purpose of the Linux bridge here is to user the Linux iptables functionality to enforce OpenStack security groups. Packets from any given port on a bridge are shared with all other ports on that bridge. Neutron creates GRE tunnels. Use the IPTables tool to create firewalls and set up NATs on Linux. bridges appear as network interfaces to Linux. the integration bridge. In Neutron. Open vSwitch configurations consist of bridges and ports. Note that this Linux bridge is actually managed by the Nova service. To use GRE with Open vSwitch. If an overlay such as GRE networking is defined for Tenant networks. Generic Routing Encapsulation (GRE) is an overlay tunneling technology. the VLAN configuration of the Open vSwitch plugin uses bridges associated with each physical network. such as physical interfaces and patch cables. In addition to defining bridges.31 issue the command: http://openstack. as does Open vSwitch. This allows for the extension of a layer 2 broadcast domain (subnet) across various nodes and thereby allows the compute and network nodes to act as one for the purposes of routing. Step 78 Install Open vSwitch On the controller host 10. so you can assign IP addresses to them. it is unwrapped. called brex. This tool uses a complex rule system and chains of rules to accommodate the complex rules required by Neutron security groups. and the 4095 tag. Additionally. not by Neutron.com/printable. 2.1. Virtual LANs (VLANs).236. When the new packet reaches its destination. Bridges can be connected through Open vSwitch virtual patch cables or through Linux virtual Ethernet cables (veth). With Open vSwitch. Ports represent connections to other things. Certain configurations use these rules to transfer packets between VLANs. called brint. On the controller host 10.ciscolive. This name is an arbitrary name representing a physical network connection (via an Open vSwitch bridge).com/printable. While you haven't yet been to the OpenStack dashboard. this is a quick peek to understand the relationships.aci:br‐ aci The relationship will map as follows.236. This is the list of mappings you will configure: Open vSwitch Physical Network Bridge Value brex pub brnexus nexus braci aci This relationship allows you to have separate physical networks abstracted to a name that Tenants can use to chose the appropriate network without needing to know about the underlying infrastructure.php?pod=3 68/180 . 2. 2015 CiscoLive! OpenStack Lab LABCLD2225 [[IDSEQSTEP]] yum install openstack‐neutron openstack‐neutron‐ ml2 openstack‐neutron‐openvswitch Step 79 Configure ML2 for Open vSwitch In this step you will create a mapped relationship between the Open vSwitch bridges and the Physical Networks names that you will then use in the Neutron API or OpenStack GUI.nexus:br‐nexus.ini ovs bridge_mappings pub:br‐ex.31 issue the command: [[IDSEQSTEP]] openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf. you will have to also do that map of the VLANS that you will be using.1. Step 80 Configure VLAN Maps to each TAG After you have defined the relationships of the Physical Networks to each Open vSwitch.0. http://openstack. 31 issue the command: [[IDSEQSTEP]] openstack‐config ‐‐set /etc/neutron/l3_agent.31 issue the command: [[IDSEQSTEP]] openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf.31 issue the command: http://openstack.linux.ini DEFAULT external_network_bridge Step 82 Configure DHCP Agent for Neutron On the controller host 10.OVSInterfaceDriver openstack‐config ‐‐set /etc/neutron/l3_agent.1.ini ml2_type_vlan network_vlan_ranges pub:300:305. 2015 CiscoLive! OpenStack Lab LABCLD2225 On the controller host 10.ini DEFAULT use_namespaces True openstack‐config ‐‐set /etc/neutron/l3_agent.com/printable.interface.236.ini DEFAULT interface_driver neutron.nexus:370:375.0.nexus:330:335.agent.0.ciscolive.nexus:310:315.aci:390:395 Physical Network VLAN Range pub 300 <> 305 nexus 310 <> 315 330 <> 335 370 <> 375 aci 390 <> 395 Step 81 Configure L3 Agent for Neutron On the controller host 10.236.236.php?pod=3 69/180 .0. 2. 123 Step 84 Restart Nova On the controller host 10.1.agent.ini DEFAULT metadata_proxy_shared_secret cisco.236.31 openstack‐config ‐‐set /etc/neutron/metadata_agent.ini DEFAULT nova_metadata_ip 10.0.31 issue the command: [[IDSEQSTEP]] systemctl restart openstack‐nova‐api.agent.236.ini DEFAULT auth_url http://10.ini DEFAULT dhcp_driver neutron.conf neutron metadata_proxy_shared_secret cisco.ini DEFAULT admin_password cisco.linux.com/printable.ini DEFAULT use_namespaces True Step 83 Configure metadata for Neutron On the controller host 10. 2. 2015 CiscoLive! OpenStack Lab LABCLD2225 [[IDSEQSTEP]] openstack‐config ‐‐set /etc/neutron/dhcp_agent.ini DEFAULT interface_driver neutron.0.123 openstack‐config ‐‐set /etc/neutron/metadata_agent.Dnsmasq openstack‐config ‐‐set /etc/neutron/dhcp_agent.interface.31 issue the command: [[IDSEQSTEP]] openstack‐config ‐‐set /etc/neutron/metadata_agent.ciscolive.0 openstack‐config ‐‐set /etc/neutron/metadata_agent.conf neutron service_metadata_proxy True openstack‐config ‐‐set /etc/nova/nova.0.service http://openstack.31:5000/v2.236.123 openstack‐config ‐‐set /etc/nova/nova.OVSInterfaceDriver openstack‐config ‐‐set /etc/neutron/dhcp_agent.php?pod=3 70/180 .linux.ini DEFAULT admin_user neutron openstack‐config ‐‐set /etc/neutron/metadata_agent.ini DEFAULT admin_tenant_name service openstack‐config ‐‐set /etc/neutron/metadata_agent.236.dhcp.0.ini DEFAULT auth_region regionOne openstack‐config ‐‐set /etc/neutron/metadata_agent. 31 issue the command: [[IDSEQSTEP]] cat <<EOF > /etc/sysconfig/network‐ scripts/ifcfg‐br‐int DEVICE=br‐int ONBOOT=yes DEVICETYPE=ovs TYPE=OVSBridge BOOTPROTO=static EOF [[IDSEQSTEP]] cat <<EOF > /etc/sysconfig/network‐ scripts/ifcfg‐br‐ex DEVICE=br‐ex ONBOOT=yes DEVICETYPE=ovs TYPE=OVSBridge BOOTPROTO=static EOF http://openstack.0.31 issue the command: [[IDSEQSTEP]] systemctl enable openvswitch. Networking implements isolation across these guests by configuring the brint ports. including VLAN configurations.ciscolive.236. and the ports can be configured much like a physical switch's ports.1. On the controller host 10. The brint Open vSwitch bridge is the integration bridge: all guests running on the compute host connect to this bridge.236.php?pod=3 71/180 .service Step 86 Configure Open vSwitch bridges An Open vSwitch bridge behaves like a virtual switch: network interface devices connect to Open vSwitch bridge's ports.com/printable.service systemctl start openvswitch. 2. 2015 CiscoLive! OpenStack Lab LABCLD2225 Step 85 Enable and activate Open vSwitch On the controller host 10.0. php?pod=3 72/180 .0.31 issue the command: [[IDSEQSTEP]] cat <<EOF > /etc/sysconfig/network‐ scripts/ifcfg‐enp8s0 DEVICE="enp8s0" ONBOOT=yes DEVICETYPE=ovs TYPE=OVSPort OVS_BRIDGE=br‐ex EOF http://openstack. On the controller host 10.ciscolive.236. 2. 2015 CiscoLive! OpenStack Lab LABCLD2225 [[IDSEQSTEP]] cat <<EOF > /etc/sysconfig/network‐ scripts/ifcfg‐br‐nexus DEVICE=br‐nexus ONBOOT=yes DEVICETYPE=ovs TYPE=OVSBridge BOOTPROTO=static EOF [[IDSEQSTEP]] cat <<EOF > /etc/sysconfig/network‐ scripts/ifcfg‐br‐aci DEVICE=br‐aci ONBOOT=yes DEVICETYPE=ovs TYPE=OVSBridge BOOTPROTO=static EOF Step 87 Configure Open vSwitch physical NIC ports These last 3 ports are to configure the actual physical interfaces of the server that is running this OpenStack instance.1.com/printable. php?pod=3 73/180 . The command ovs‐vsctl show shows you the status of all configured Open vSwitch bridges and their ports.com/printable. 2015 CiscoLive! OpenStack Lab LABCLD2225 [[IDSEQSTEP]] cat <<EOF > /etc/sysconfig/network‐ scripts/ifcfg‐enp10s0 DEVICE="enp10s0" ONBOOT=yes DEVICETYPE=ovs TYPE=OVSPort OVS_BRIDGE=br‐nexus EOF [[IDSEQSTEP]] cat <<EOF > /etc/sysconfig/network‐ scripts/ifcfg‐enp11s0 DEVICE="enp11s0" ONBOOT=yes DEVICETYPE=ovs TYPE=OVSPort OVS_BRIDGE=br‐aci EOF Step 88 Restart Operating System Network Service You have to restart the network stack on this server to reread the configuration and add all the interfaces.236.0.236.service You can validate that the Open vSwitch controller has all the bridge defined. On the controller host 10.1. On the controller host 10.31 issue the command: [[IDSEQSTEP]] ovs‐vsctl show http://openstack.31 issue the command: [[IDSEQSTEP]] systemctl restart network.ciscolive.0. 2. ini pointing to the ML2 plugin configuration file.236.31 issue the command: http://openstack.0.1. 2.31 issue the command: [[IDSEQSTEP]] cp /usr/lib/systemd/system/neutron‐openvswitch‐ agent.1.service.service On the controller host 10. 2015 CiscoLive! OpenStack Lab LABCLD2225 # ovs‐vsctl show bf4bccee‐b0ba‐41e7‐b53a‐bb108b78ca70 Bridge br‐int Port br‐int Interface br‐int type: internal Bridge "br‐nexus" Port "br‐nexus" Interface "br‐nexus" type: internal Port "enp10s0" Interface "enp10s0" Bridge br‐aci Port br‐aci Interface br‐aci type: internal Port "enp11s0" Interface "enp11s0" Bridge br‐ex Port "enp8s0" Interface "enp8s0" Port br‐ex Interface br‐ex type: internal ovs_version: "2.plugins/openvswitch/ovs_neutron_plugin.ini. the Open vSwitch agent initialization script explicitly looks for the Open vSwitch plugin configuration file rather than a symbolic link /etc/neutron/plugin.3" Step 89 Restart Neutron ALERT! Due to a packaging bug.ini.plugin.php?pod=3 74/180 .236.service /usr/lib/systemd/system/neutron‐openvswitch‐ agent.ciscolive.com/printable.orig sed ‐i 's.0.g' /usr/lib/systemd/system/neutron‐openvswitch‐agent. Run the following commands to resolve this issue: On the controller host 10. ciscolive.php?pod=3 75/180 .31 issue the command: [[IDSEQSTEP]] ovs‐vsctl show http://openstack.service neutron‐ dhcp‐agent.service systemctl start neutron‐openvswitch‐ agent. 2015 CiscoLive! OpenStack Lab LABCLD2225 [[IDSEQSTEP]] systemctl enable neutron‐openvswitch‐ agent...com/printable.service neutron‐metadata‐ agent.service └─46682 /usr/bin/python /usr/bin/neutron‐server ‐‐config‐file /usr/sha re/neutron/neutron‐dist.236.service neutron‐ dhcp‐agent.service neutron‐metadata‐ agent.0.31 issue the command: [[IDSEQSTEP]] systemctl status neutron‐server. 2.service neutron‐server. you will get more information as the paths should now be built between the different bridges.236.1.0. On the controller host 10.service.service # systemctl status neutron‐server. On the controller host 10.0. 9s ago Main PID: 46682 (neutron‐server) CGroup: /system.. And finally if you look at the same command issued earlier to see the bridge definitions active.service neutron‐l3‐agent.conf ‐‐.service ‐ OpenStack Neutron Server Loaded: loaded (/usr/lib/systemd/system/neutron‐server.slice/neutron‐server..service You can look at systemctl to validate that neutron server is operational. Jan 04 23:56:23 controller systemd[1]: Starting OpenStack Neutron Server. Jan 04 23:56:24 controller systemd[1]: Started OpenStack Neutron Server.service On the controller host 10.236.service neutron‐l3‐agent.31 issue the command: [[IDSEQSTEP]] systemctl restart neutron‐server.service neutron‐ovs‐cleanup. enabled) Active: active (running) since Sun 2015‐01‐04 23:56:24 EST. 2.1.1.3" When you observe this command you will see that each bridge now has a port definition that ties it to specific interfaces and other bridges. Step 90 Validate Neutron operation [[IDSEQSTEP]] neutron agent‐list http://openstack.ciscolive.com/printable.php?pod=3 76/180 . 2015 CiscoLive! OpenStack Lab LABCLD2225 # ovs‐vsctl show bf4bccee‐b0ba‐41e7‐b53a‐bb108b78ca70 Bridge br‐int fail_mode: secure Port "int‐br‐n7k" Interface "int‐br‐n7k" type: patch options: {peer="phy‐br‐nexus"} Port br‐int Interface br‐int type: internal Port int‐br‐ex Interface int‐br‐ex type: patch options: {peer=phy‐br‐ex} Port int‐br‐aci Interface int‐br‐aci type: patch options: {peer=phy‐br‐aci} Bridge "br‐nexus" Port "phy‐br‐nexus" Interface "phy‐br‐nexus" type: patch options: {peer="int‐br‐nexus"} Port "br‐n7k" Interface "br‐nexus" type: internal Port "enp10s0" Interface "enp10s0" Bridge br‐aci Port br‐aci Interface br‐aci type: internal Port "enp11s0" Interface "enp11s0" Port phy‐br‐aci Interface phy‐br‐aci type: patch options: {peer=int‐br‐aci} Bridge br‐ex Port phy‐br‐ex Interface phy‐br‐ex type: patch options: {peer=int‐br‐ex} Port "enp8s0" Interface "enp8s0" Port br‐ex Interface br‐ex type: internal ovs_version: "2. 1.php?pod=3 77/180 .cisco_nexus openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf_cisco.31 issue the command: The following section adds 'cisco_nexus' plugin to the ml2 mechanism driver.com/printable.py install Step 92 Enable Cisco Nexus Plugin On the controller host 10.git cd ncclient/ python . 2015 CiscoLive! OpenStack Lab LABCLD2225 # neutron agent‐list +‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐ +‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ | id | agent_type | host | alive | admin_state_up | binary | +‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐ +‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ | 150493eb‐854a‐4c44‐9f48‐c0d7a16b2f37 | L3 agent | controller | :‐) | True | neutron‐l3‐agent | | 3ce895ee‐3980‐492b‐9dea‐9ee0bcc0a9d5 | DHCP agent | controller | :‐) | True | neutron‐dhcp‐agent | | 9923a961‐5f31‐4a54‐a3e2‐cdab1b78ca27 | Open vSwitch agent | controller | :‐) | True | neutron‐openvswitch‐agent | | e7802d24‐8347‐4c01‐b8f4‐99eecf77c299 | Metadata agent | controller | :‐) | True | neutron‐metadata‐agent | +‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐ +‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ Step 91 Enable Cisco Nexus Plugin On the controller host 10.236.0./setup.ini ml2 mechanism_drivers openvswitch.236.ini DEFAULT http://openstack.0.com/CiscoSystems/ncclient. [[IDSEQSTEP]] openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf. configured the vlan prefix to be use and the provider network that the plugin will manage.ini ml2_cisco managed_physical_network nexus openstack‐config ‐‐set /etc/neutron/dhcp_agent. 2.ciscolive.31 issue the command: Install git and enable Python library for NETCONF clients [[IDSEQSTEP]] yum install ‐y git git clone https://github.ini ml2_cisco vlan_name_prefix POD3‐neutron‐ openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf_cisco. 1.ini ml2_mech_cisco_nexus:n7k‐os‐pod3 username admin openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf_cisco.ini ml2_mech_cisco_nexus:n3k‐os‐pod3 password cisco.123 openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf_cisco. 2.com/printable.31 issue the command: [[IDSEQSTEP]] openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf_cisco.ini ml2_mech_cisco_nexus:n7k‐os‐pod3 password cisco.ciscolive.31 issue the command: [[IDSEQSTEP]] openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf_cisco.123 openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf_cisco.ini DEFAULT enable_isolated_metadata True Step 93 Add Cisco Nexus 3000 Switch and associate it with Compute1 (Controller) On the controller host 10.236.0.ini ml2_mech_cisco_nexus:n3k‐os‐pod3 username admin openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf_cisco.0.236. 2015 CiscoLive! OpenStack Lab LABCLD2225 /etc/neutron/dhcp_agent.ini ml2_mech_cisco_nexus:n7k‐os‐pod3 pod3‐compute2 3/5 Step 95 Add Cisco ML2 ConfigFile To Neutron Server On the controller host 10.ini ml2_mech_cisco_nexus:n3k‐os‐pod3 pod3‐controller 1/1 Step 94 Add Cisco Nexus 7000 Switch and associate it with Compute2 On the controller host 10.ini ml2_mech_cisco_nexus:n3k‐os‐pod3 ssh_port 22 openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf_cisco.31 issue the command: http://openstack.236.ini ml2_mech_cisco_nexus:n7k‐os‐pod3 ssh_port 22 openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf_cisco.0.php?pod=3 78/180 . ssh/known_hosts sudo ‐u neutron ssh‐keyscan n3k‐os‐pod3 >> /var/lib/neutron/.ini/' /usr/lib/systemd/system/neutron‐server.service systemctl daemon‐reload Step 96 Add RSA key fingerprint of Nexus3k to neutron. 2015 CiscoLive! OpenStack Lab LABCLD2225 [[IDSEQSTEP]] sed ‐i 's/plugin.ini/plugin.123 ssh admin@n3k‐os‐pod3 Step 98 Nexus 3000 Interface Configuration On the n3kospod3 issue the command: http://openstack.103 > /var/lib/neutron/.com/printable.0. 2.226.ini ‐‐config‐file \/etc\/neutron\/plugins\/ml2\/ml2_conf_cisco.226.1.ssh/known_hosts Step 97 SSH into Nexus 3000 for configuration Configuration On the controller host 10.ssh/known_hosts sudo ‐u neutron ssh‐keyscan 10. In this step we need to get the RSA key for the Nexus3000 stored under the neutron user account.236.0.0.ssh sudo ‐u neutron ssh‐keyscan 10.0.ssh/known_hosts sudo ‐u neutron ssh‐keyscan n7k‐os‐pod3 >> /var/lib/neutron/. This On the controller host 10.php?pod=3 79/180 .119 >> /var/lib/neutron/.ciscolive.31 issue the command: [[IDSEQSTEP]] sudo ‐u neutron mkdir /var/lib/neutron/.31 issue the command: [[IDSEQSTEP]] sudo ‐u neutron sshpass ‐p cisco.236. 1.3.90.com/printable.90.2 end copy running‐config startup‐config exit Step 99 Nexus 7000 Interface Configuration On the controller host 10.123 ssh admin@n7k‐os‐pod3 Step 100 Nexus 7000 Configuration On the n7kospod3 issue the command: http://openstack.1 ! interface Vlan370 no shutdown ip address 10.70.3/24 hsrp version 2 hsrp 330 ip 10.92.90.php?pod=3 80/180 .1 ! interface ethernet 1/48 no switchport no shutdown ip address 10.ciscolive. 2015 CiscoLive! OpenStack Lab LABCLD2225 [[IDSEQSTEP]] config t feature hsrp feature interface‐vlan feature ospf ! interface Ethernet1/1 switchport description UCS switchport mode trunk switchport trunk allowed vlan none ! interface Vlan330 no shutdown ip address 10.3.3.70.3.2 ip route 10.236.3/24 hsrp version 2 hsrp 370 ip 10.1/24 ! ip route 10.31 issue the command: [[IDSEQSTEP]] sudo ‐u neutron sshpass ‐p cisco.0/24 10.30.0/24 10.3.0.3.3.3.91. 2.30.3. 7/24 hsrp version 2 hsrp 370 ip 10.3.3.0.ciscolive.236.70.1 ! interface Vlan370 no shutdown ip address 10.3. 2.30.1.1 ! end copy running‐config startup‐config exit Step 101 Restart Neutron Server On the controller host 10. 2015 CiscoLive! OpenStack Lab LABCLD2225 [[IDSEQSTEP]] config t feature hsrp feature interface‐vlan feature ospf ! interface Ethernet3/5 switchport description UCS switchport mode trunk switchport trunk allowed vlan none ! interface Vlan330 no shutdown ip address 10.0.30.70.31 issue the command: [[IDSEQSTEP]] openstack‐service restart neutron On the controller host 10.31 issue the command: [[IDSEQSTEP]] openstack‐service status neutron [root@pod12‐controller ~(keystone_admin)]# openstack‐service status neutron neutron‐dhcp‐agent (pid 29951) is active neutron‐l3‐agent (pid 29953) is active neutron‐metadata‐agent (pid 29959) is active neutron‐openvswitch‐agent (pid 29983) is active neutron‐server (pid 29949) is active http://openstack.7/24 hsrp version 2 hsrp 330 ip 10.3.com/printable.php?pod=3 81/180 .236. 32 issue the command: [[IDSEQSTEP]] sysctl ‐p Step 104 Install Neutron on Compute host http://openstack.236.236.com/printable. NOTE: This commands for this section should be entered on the second host the compute node.default. not the controller node.0.php?pod=3 82/180 .rp_filter=0 EOF Validate changes to sysctl file. On the compute host 10.0.236.conf. 2015 CiscoLive! OpenStack Lab LABCLD2225 Configure Neutron Compute Host You have to configure the compute host network component.0.ipv4.all.conf.ipv4. Ensure you connect to the correct PuTTY session before entering these commands.32 issue the command: [[IDSEQSTEP]] firewall‐cmd ‐‐add‐port=9696/tcp ‐‐permanent firewall‐cmd ‐‐reload Step 103 Configure IP forwarding on linux system control On the compute host 10.ipv4.conf net. Step 102 Open Firewall Holes On the compute host 10.32 issue the command: [[IDSEQSTEP]] cat <<EOF >> /etc/sysctl.rp_filter=0 net.ciscolive.ip_forward=1 net. 2.1. ciscolive.conf keystone_authtoken auth_uri http://10.31:5000/v2.conf keystone_authtoken admin_user neutron openstack‐config ‐‐set /etc/neutron/neutron.conf DEFAULT auth_strategy keystone openstack‐config ‐‐set /etc/neutron/neutron.0.31:35357 openstack‐config ‐‐set /etc/neutron/neutron.236.1.123 openstack‐config ‐‐set /etc/neutron/neutron.236.0.123 openstack‐config ‐‐set /etc/neutron/neutron.conf keystone_authtoken identity_uri http://10.conf DEFAULT core_plugin ml2 openstack‐config ‐‐set /etc/neutron/neutron. 2015 CiscoLive! OpenStack Lab LABCLD2225 On the compute host 10.236.32 issue the command: [[IDSEQSTEP]] yum ‐y install openstack‐neutron openstack‐ neutron‐ml2 python‐neutronclient openstack‐ neutron‐openvswitch which Step 105 Configure Neutron for compute node On the compute host 10.236.0.32 issue the command: [[IDSEQSTEP]] openstack‐config ‐‐set /etc/neutron/neutron.conf DEFAULT rabbit_password cisco.conf DEFAULT rabbit_host 10. 2.0 openstack‐config ‐‐set /etc/neutron/neutron.0.conf keystone_authtoken admin_password cisco.0.0.com/printable.conf DEFAULT service_plugins router openstack‐config ‐‐set /etc/neutron/neutron.236.conf DEFAULT allow_overlapping_ips True Step 106 Configure Neutron ML2 for compute node On the compute host 10.32 issue the command: http://openstack.31 openstack‐config ‐‐set /etc/neutron/neutron.conf keystone_authtoken admin_tenant_name service openstack‐config ‐‐set /etc/neutron/neutron.conf DEFAULT rpc_backend rabbit openstack‐config ‐‐set /etc/neutron/neutron.236.php?pod=3 83/180 . php?pod=3 84/180 .linux.flat.agent.ini securitygroup enable_ipset True openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf.aci:390:395 Step 108 Configure Neutron NOVA components On the compute host 10.ini ml2 type_drivers local.236.0.gre.ini ml2 tenant_network_types vlan openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf.ini securitygroup firewall_driver neutron.aci:br‐aci openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf.32 issue the command: [[IDSEQSTEP]] openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf.vxlan openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf.ini ml2_type_vlan network_vlan_ranges nexus:310:315.OVSHybridIptablesFirewallDriver Step 107 Configure ML2 and L3 Agent for OVS On the compute host 10.vlan. 2015 CiscoLive! OpenStack Lab LABCLD2225 [[IDSEQSTEP]] openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf.ini securitygroup enable_security_group True openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf.com/printable.nexus:330:335.236.nexus:370:375.0. 2.iptables_firewall.ciscolive.ini ovs bridge_mappings nexus:br‐nexus.ini ml2 mechanism_drivers openvswitch openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf.1.32 issue the command: http://openstack. 0.236.ini.ini /etc/neutron/plugin.236.31:9696 openstack‐config ‐‐set /etc/nova/nova.ini Step 110 Copy OpenVSwitch service configuration files On the compute host 10.api.236.neutronv2.32 issue the command: [[IDSEQSTEP]] ln ‐s /etc/neutron/plugins/ml2/ml2_conf.service \ /usr/lib/systemd/system/neutron‐openvswitch‐ agent.0.conf neutron admin_tenant_name service openstack‐config ‐‐set /etc/nova/nova.conf DEFAULT security_group_api neutron openstack‐config ‐‐set /etc/nova/nova.API openstack‐config ‐‐set /etc/nova/nova.31:35357/v2.ciscolive.conf DEFAULT firewall_driver nova.0.firewall. 2015 CiscoLive! OpenStack Lab LABCLD2225 [[IDSEQSTEP]] openstack‐config ‐‐set /etc/nova/nova.linux_net.orig sed ‐i 's.com/printable.conf neutron auth_strategy keystone openstack‐config ‐‐set /etc/nova/nova.plugins/openvswitch/ovs_neutron_plugin. 2.236.conf neutron url http://10.service.LinuxOVSInterfaceDriver openstack‐config ‐‐set /etc/nova/nova.32 issue the command: [[IDSEQSTEP]] cp /usr/lib/systemd/system/neutron‐openvswitch‐ agent.1.conf neutron admin_username neutron openstack‐config ‐‐set /etc/nova/nova.service Step 111 Enable OpenVSwitch service and start http://openstack.123 Step 109 Link ML2 to Neutron On the compute host 10.0.plugin.0 openstack‐config ‐‐set /etc/nova/nova.ini.network.conf neutron admin_password cisco.network.php?pod=3 85/180 .conf DEFAULT network_api_class nova.virt.g' \ /usr/lib/systemd/system/neutron‐openvswitch‐agent.conf neutron admin_auth_url http://10.conf DEFAULT linuxnet_interface_driver nova.NoopFirewallDriver openstack‐config ‐‐set /etc/nova/nova. 0.0. 2015 CiscoLive! OpenStack Lab LABCLD2225 On the compute host 10.32 issue the command: http://openstack.236.236.com/printable.ciscolive.236. 2.1.php?pod=3 86/180 .service systemctl start openvswitch.service Step 112 Configure OpenVSwitch bridges On the compute host 10.32 issue the command: [[IDSEQSTEP]] systemctl enable openvswitch.0.32 issue the command: [[IDSEQSTEP]] cat <<EOF > /etc/sysconfig/network‐ scripts/ifcfg‐br‐int DEVICE=br‐int ONBOOT=yes DEVICETYPE=ovs TYPE=OVSBridge BOOTPROTO=static EOF [[IDSEQSTEP]] cat <<EOF > /etc/sysconfig/network‐ scripts/ifcfg‐br‐nexus DEVICE=br‐nexus ONBOOT=yes DEVICETYPE=ovs TYPE=OVSBridge BOOTPROTO=static EOF [[IDSEQSTEP]] cat <<EOF > /etc/sysconfig/network‐ scripts/ifcfg‐br‐aci DEVICE=br‐aci ONBOOT=yes DEVICETYPE=ovs TYPE=OVSBridge BOOTPROTO=static EOF Step 113 Configure OpenVSwitch physical NIC ports On the compute host 10. ciscolive.service http://openstack. 2015 CiscoLive! OpenStack Lab LABCLD2225 [[IDSEQSTEP]] cat <<EOF > /etc/sysconfig/network‐ scripts/ifcfg‐enp10s0 DEVICE="enp10s0" ONBOOT=yes DEVICETYPE=ovs TYPE=OVSPort OVS_BRIDGE=br‐nexus EOF [[IDSEQSTEP]] cat <<EOF > /etc/sysconfig/network‐ scripts/ifcfg‐enp11s0 DEVICE="enp11s0" ONBOOT=yes DEVICETYPE=ovs TYPE=OVSPort OVS_BRIDGE=br‐aci EOF Step 114 Restart network services On the compute host 10.236.service Validate that network service is operational.236.32 issue the command: [[IDSEQSTEP]] systemctl restart network. On the compute host 10.1. 2.0.32 issue the command: [[IDSEQSTEP]] systemctl status network.php?pod=3 87/180 .0.com/printable. 236.d/init.service network. On the compute host 10.ion/6) Jan 09 13:32:25 pod4‐compute2 network[21023]: [ OK ] Jan 09 13:32:26 pod4‐compute2 ovs‐vsctl[21876]: ovs|00001|vsctl|INFO|Called as ov s‐vsctl ‐t 10 ‐‐ ‐‐may‐exist add‐port br‐t. 1min 18s ago Jan 09 13:32:25 pod4‐compute2 network[21023]: Bringing up interface enp6s0: Conn ection successfully activated (D‐Bus activ.0.service ‐ LSB: Bring up/down networking Loaded: loaded (/etc/rc.236.np11s0 Jan 09 13:32:28 pod4‐compute2 network[21023]: Bringing up interface enp11s0: [ OK ] Jan 09 13:32:28 pod4‐compute2 systemd[1]: Started LSB: Bring up/down networking. Step 115 Restart NOVA Compute services On the compute host 10. 2....enp7s0 Jan 09 13:32:26 pod4‐compute2 network[21023]: Bringing up interface enp7s0: [ O K ] Jan 09 13:32:27 pod4‐compute2 ovs‐vsctl[22012]: ovs|00001|vsctl|INFO|Called as ov s‐vsctl ‐t 10 ‐‐ ‐‐may‐exist add‐port br‐n3k enp9s0 Jan 09 13:32:27 pod4‐compute2 network[21023]: Bringing up interface enp9s0: [ O K ] Jan 09 13:32:27 pod4‐compute2 ovs‐vsctl[22147]: ovs|00001|vsctl|INFO|Called as ov s‐vsctl ‐t 10 ‐‐ ‐‐may‐exist add‐port br‐n. 2015 CiscoLive! OpenStack Lab LABCLD2225 # systemctl status network.service http://openstack.0.php?pod=3 88/180 .service Validate that NOVA service is operational. Hint: Some lines were ellipsized.d/network) Active: active (exited) since Fri 2015‐01‐09 13:32:28 EST.np10s0 Jan 09 13:32:28 pod4‐compute2 network[21023]: Bringing up interface enp10s0: [ OK ] Jan 09 13:32:28 pod4‐compute2 ovs‐vsctl[22290]: ovs|00001|vsctl|INFO|Called as ov s‐vsctl ‐t 10 ‐‐ ‐‐may‐exist add‐port br‐a..ciscolive.1..32 issue the command: [[IDSEQSTEP]] systemctl restart openstack‐nova‐compute..com/printable. use ‐l to show in full.32 issue the command: [[IDSEQSTEP]] systemctl status openstack‐nova‐compute... service Validate that OpenVSwitch service is operational.service. enable d) Active: active (running) since Fri 2015‐01‐09 13:36:00 EST. 7s ago Main PID: 22916 (nova‐compute) CGroup: /system.service ‐ OpenStack Nova Compute Server Loaded: loaded (/usr/lib/systemd/system/openstack‐nova‐compute.service openstack‐nova‐compute.php?pod=3 89/180 .1.236.ciscolive.slice/openstack‐nova‐compute.0.service ‚îî‚îÄ22916 /usr/bin/python /usr/bin/nova‐compute Jan 09 13:36:00 pod4‐compute2 systemd[1]: Started OpenStack Nova Compute Server.service systemctl start neutron‐openvswitch‐ agent. On the compute host 10.service http://openstack.0. Step 116 Enable and start OpenVSwitch on compute node On the compute host 10.32 issue the command: [[IDSEQSTEP]] systemctl status neutron‐openvswitch‐ agent.32 issue the command: [[IDSEQSTEP]] systemctl enable neutron‐openvswitch‐ agent. 2. 2015 CiscoLive! OpenStack Lab LABCLD2225 # systemctl status openstack‐nova‐compute.com/printable.236. service neutron‐openvswitch‐agent.service. USER=r oot . PWD=/ .ble=23 Jan 09 13:36:51 pod4‐compute2 sudo[23031]: neutron : TTY=unknown .slice/neutron‐openvswitch‐agent.ble=23 Jan 09 13:36:55 pod4‐compute2 sudo[23037]: neutron : TTY=unknown .. USER=r oot .. COMMAND=/bin/neutron‐rootwrap /etc/n. PWD=/ . 2.conf ‐‐config.ofport ‐‐format=j son Jan 09 13:36:39 pod4‐compute2 sudo[23013]: neutron : TTY=unknown .... COMMAND=/bin/neutron‐rootwrap /etc/n. USER=r oot ..ble=23 Jan 09 13:36:43 pod4‐compute2 sudo[23019]: neutron : TTY=unknown .ble=23 Jan 09 13:36:45 pod4‐compute2 sudo[23022]: neutron : TTY=unknown . COMMAND=/bin/neutron‐rootwrap /etc/n. PWD=/ . USER=r oot .ofport ‐‐format=json ‚î‚îÄ22560 /usr/bin/python /usr/bin/neutron‐rootwrap /etc/neutron/root wrap.ble=23 Jan 09 13:36:41 pod4‐compute2 sudo[23016]: neutron : TTY=unknown . PWD=/ . USER=r oot .1. COMMAND=/bin/neutron‐rootwrap /etc/n. PWD=/ .ble=23 Jan 09 13:36:49 pod4‐compute2 sudo[23028]: neutron : TTY=unknown .ble=23 Jan 09 13:36:53 pod4‐compute2 sudo[23034]: neutron : TTY=unknown ... COMMAND=/bin/neutron‐rootwrap /etc/n. USER=r oot . ‚î‚îÄ22558 sudo neutron‐rootwrap /etc/neutron/rootwrap. 2015 CiscoLive! OpenStack Lab LABCLD2225 # systemctl status neutron‐openvswitch‐agent..service ‐ OpenStack Neutron Open vSwitch Agent Loaded: loaded (/usr/lib/systemd/system/neutron‐openvswitch‐agent. COMMAND=/bin/neutron‐rootwrap /etc/n.ciscolive.conf ovsdb‐clie nt monitor Interface name. 4min 21s ago Main PID: 22381 (neutron‐openvsw) CGroup: /system.ble=23 Jan 09 13:36:57 pod4‐compute2 sudo[23040]: neutron : TTY=unknown . ena bled) Active: active (running) since Fri 2015‐01‐09 13:32:36 EST. http://openstack...service ‚î‚îÄ22381 /usr/bin/python /usr/bin/neutron‐openvswitch‐agent ‐‐config ‐file /usr/share/neutron/neutron‐dist. COMMAND=/bin/neutron‐rootwrap /etc/n.....ble=23 Hint: Some lines were ellipsized. PWD=/ . use ‐l to show in full.. PWD=/ ....php?pod=3 90/180 .. USER=r oot . PWD=/ . PWD=/ .. COMMAND=/bin/neutron‐rootwrap /etc/n.conf ovsdb‐client monitor Interface name.ble=23 Jan 09 13:36:47 pod4‐compute2 sudo[23025]: neutron : TTY=unknown . COMMAND=/bin/neutron‐rootwrap /etc/n.com/printable. USER=r oot ..ofpor. USER=r oot . USER=r oot . COMMAND=/bin/neutron‐rootwrap /etc/n. ‚îî‚îÄ22563 /bin/ovsdb‐client monitor Interface name. PWD=/ ... 2015 CiscoLive! OpenStack Lab LABCLD2225 Cinder Step 117 Open Firewall Holes On the controller host 10. exit Step 119 Add Cinder users to keystone Once the database is ready. http://openstack.31 issue the command: [[IDSEQSTEP]] mysql ‐‐user=root ‐‐password=cisco.sh Now that you have assumed the identity of the admin user. On the controller host 10.php?pod=3 91/180 . you can issue the following commands to create the user and the service for Cinder in Keystone.* TO 'cinder'@'%' IDENTIFIED BY 'cisco.31 issue the command: [[IDSEQSTEP]] firewall‐cmd ‐‐add‐port=8776/tcp ‐‐permanent firewall‐cmd ‐‐reload Step 118 Configure Cinder database and access to database On the controller host 10.ciscolive.236.* TO 'cinder'@'localhost' IDENTIFIED BY 'cisco. you can add the Cinder users to keystone.236.236.123 CREATE DATABASE cinder.0. 2. GRANT ALL PRIVILEGES ON cinder.0.0.1.123'.123'.31 issue the command: [[IDSEQSTEP]] cd ~ source admin.com/printable. GRANT ALL PRIVILEGES ON cinder. 31:8776/v2/%\ (tenant_id\)s \ ‐‐region regionOne Step 121 Install OpenStack Cinder On the controller host 10.0.0.31 issue the commands: [[IDSEQSTEP]] keystone user‐create ‐‐name cinder ‐‐pass cisco.0.ciscolive.0.31:8776/v1/%\ (tenant_id\)s \ ‐‐adminurl http://10.236.31 issue the commands: http://openstack.123 keystone user‐role‐add ‐‐user cinder ‐‐tenant service ‐‐role admin Step 120 Add Cinder services to Keystone On the controller host 10.236.31:8776/v2/%\ (tenant_id\)s \ ‐‐internalurl http://10.236.0.236.236.236.0.236.0.1.236.0.236.php?pod=3 92/180 .31:8776/v1/%\ (tenant_id\)s \ ‐‐region regionOne keystone endpoint‐create \ ‐‐service‐id $(keystone service‐list | awk '/ volumev2 / {print $2}') \ ‐‐publicurl http://10.31 issue the commands: [[IDSEQSTEP]] yum ‐y install openstack‐cinder python‐ cinderclient python‐oslo‐db Step 122 Configure Cinder On the controller host 10.31:8776/v1/%\ (tenant_id\)s \ ‐‐internalurl http://10. 2.31 issue the commands: [[IDSEQSTEP]] keystone service‐create ‐‐name cinder ‐‐type volume ‐‐description "OpenStack Block Storage" keystone service‐create ‐‐name cinderv2 ‐‐type volumev2 ‐‐description "OpenStack Block Storage" keystone endpoint‐create \ ‐‐service‐id $(keystone service‐list | awk '/ volume / {print $2}') \ ‐‐publicurl http://10.236.31:8776/v2/%\ (tenant_id\)s \ ‐‐adminurl http://10.0. 2015 CiscoLive! OpenStack Lab LABCLD2225 On the controller host 10.0.com/printable. 0.0.0.0.0.service systemctl start openstack‐cinder‐api.31 issue the commands: [[IDSEQSTEP]] systemctl enable openstack‐cinder‐api.0.0 openstack‐config ‐‐set /etc/cinder/cinder.conf keystone_authtoken auth_uri http://10.31 openstack‐config ‐‐set /etc/cinder/cinder.conf DEFAULT rabbit_host 10.0.conf DEFAULT auth_strategy keystone openstack‐config ‐‐set /etc/cinder/cinder.31 openstack‐config ‐‐set /etc/cinder/cinder.conf DEFAULT osapi_volume_workers 4 openstack‐config ‐‐set /etc/cinder/cinder.conf keystone_authtoken identity_uri http://10.conf DEFAULT rabbit_password cisco.conf DEFAULT iscsi_helper lioadm Step 123 Synchronize Cinder database schema On the controller host 10.conf DEFAULT glance_host 10.ciscolive.service openstack‐cinder‐
[email protected]:5000/v2.236.service openstack‐cinder‐scheduler.conf DEFAULT my_ip 10.php?pod=3 93/180 .236.conf database connection mysql://cinder:cisco. 2015 CiscoLive! OpenStack Lab LABCLD2225 [[IDSEQSTEP]] openstack‐config ‐‐set /etc/cinder/cinder.236.123 openstack‐config ‐‐set /etc/cinder/cinder.com/printable.236.236.31 openstack‐config ‐‐set /etc/cinder/cinder.1. 2.0.service Step 125 Install targetcli http://openstack.conf keystone_authtoken admin_tenant_name service openstack‐config ‐‐set /etc/cinder/cinder.conf keystone_authtoken admin_user cinder openstack‐config ‐‐set /etc/cinder/cinder.31/cinder openstack‐config ‐‐set /etc/cinder/cinder.conf DEFAULT rpc_backend rabbit openstack‐config ‐‐set /etc/cinder/cinder.31:35357 openstack‐config ‐‐set /etc/cinder/cinder.conf keystone_authtoken admin_password cisco.236.123 openstack‐config ‐‐set /etc/cinder/cinder.236.31 issue the commands: [[IDSEQSTEP]] su ‐s /bin/sh ‐c "cinder‐manage db sync" cinder Step 124 Enable and start Cinder service On the controller host 10. 31 issue the command: [[IDSEQSTEP]] systemctl status openstack‐cinder‐volume.service target. 2.com/printable.31 issue the commands: [[IDSEQSTEP]] yum ‐y install targetcli Step 126 Enable and start Cinder volume service On the controller host 10.service http://openstack.ciscolive.236.236.0. starting with the Grizzly release. and supports its comprehensive SPC3/SPC4 feature set in a fabricagnostic way.0. 2015 CiscoLive! OpenStack Lab LABCLD2225 targetcli is the general management platform for the LinuxIO Target. It comprises a shell that uses the LIO library through a welldefined API.236.service Validate that OpenVSwitch service is operational.service target.0.php?pod=3 94/180 . Native support in OpenStack (setup. code). makes LIO also an attractive storage option for cloud deployments. LinuxIO Target is based on a SCSI engine that implements the semantics of a SCSI target as described in the SCSI Architecture Model (SAM).31 issue the commands: [[IDSEQSTEP]] systemctl enable openstack‐cinder‐volume.service systemctl start openstack‐cinder‐volume. On the controller host 10. On the controller host 10.1. .manager Stderr: u' .messaging. 2.json.py:616: VDeprecationWarn. ‚îî‚îÄ28797 /usr/bin/python2 /usr/bin/cinder‐volume ‐‐config‐file /usr /share/cinder/cinder‐dist..service Jan 09 13:39:15 pod4‐controller systemd[1]: Starting Restore LIO kernel target co nfiguration. Jan 09 13:39:16 pod4‐controller cinder‐volume[28775]: warn(VDeprecationWarning(EX CHANGE_AUTODELETE_DEPRECATED)) target. use ‐l to show in full.457 287 97 TRACE cinder.7/site‐pac kages/amqp/channel..manager Command: sud...manager Jan 09 13:39:16 pod4‐controller cinder‐volume[28775]: 2015‐01‐09 13:39:16.lumes Jan 09 13:39:16 pod4‐controller cinder‐volume[28775]: 2015‐01‐09 13:39:16.volume._drivers..service ‚î‚îÄ28775 /usr/bin/python2 /usr/bin/cinder‐volume ‐‐config‐file /usr/ share/cinder/cinder‐dist..ciscolive. enabl ed) Active: active (running) since Fri 2015‐01‐09 13:39:15 EST. http://openstack.5._drivers.. 1min 43s ago Process: 28776 ExecStart=/usr/bin/targetctl restore (code=exited.:5672 Jan 09 13:39:16 pod4‐controller cinder‐volume[28775]: /usr/lib/python2..es\n' Jan 09 13:39:16 pod4‐controller cinder‐volume[28775]: 2015‐01‐09 13:39:16.moved Jan 09 13:39:16 pod4‐controller cinder‐volume[28775]: from py‐amqp v1.impl_rabbit.457 287 97 TRACE cinder.service.volume.slice/target.service ‐ Restore LIO kernel target configuration Loaded: loaded (/usr/lib/systemd/system/target. status=0/SUCC ESS) Main PID: 28776 (code=exited. enabled) Active: active (exited) since Fri 2015‐01‐09 13:39:16 EST.com/printable.service ‐ OpenStack Cinder Volume Server Loaded: loaded (/usr/lib/systemd/system/openstack‐cinder‐volume. 2015 CiscoLive! OpenStack Lab LABCLD2225 # systemctl status openstack‐cinder‐volume.conf ‐‐config‐file /etc/ci.:5672 Jan 09 13:39:16 pod4‐controller cinder‐volume[28775]: 2015‐01‐09 13:39:16. Hint: Some lines were ellipsized..service target.457 287 97 TRACE cinder..volume.457 287 97 TRACE cinder. status=0/SUCCESS) CGroup: /system.manager Stdout: u'' Jan 09 13:39:16 pod4‐controller cinder‐volume[28775]: 2015‐01‐09 13:39:16..manager Exit code: 5 Jan 09 13:39:16 pod4‐controller cinder‐volume[28775]: 2015‐01‐09 13:39:16.php?pod=3 95/180 .1. exiting Jan 09 13:39:16 pod4‐controller systemd[1]: Started Restore LIO kernel target con figuration.impl_rabbit.. ok.457 287 97 TRACE cinder.748 287 97 INFO oslo. Jan 09 13:39:16 pod4‐controller target[28776]: No saved config file at /etc/targe t/saveconfig.0.volume.. 1min 43s ago Main PID: 28775 (cinder‐volume) CGroup: /system.service.conf ‐‐config‐file /etc/ci.service openstack‐cinder‐volume.slice/openstack‐cinder‐volume.messaging..764 287 97 INFO oslo. Jan 09 13:39:16 pod4‐controller cinder‐volume[28775]: 2015‐01‐09 13:39:16.volume.. 31"/g' /etc/openstack‐dashboard/local_settings What this command did was go into the file.0.236. On the controller host 10.31 issue the command: [[IDSEQSTEP]] yum ‐y install openstack‐dashboard httpd mod_wsgi memcached python‐memcached yum ‐y install python‐pbr Step 129 Configure Horizon local settings The following commands will make changes to the file /etc/openstackdashboard/local settings. find the specific line that is configured as OPENSTACK_HOST = "127.31 issue the command: [[IDSEQSTEP]] sed ‐i 's/OPENSTACK_HOST = "127. http://openstack.236.236.0.236.0. The same command will be used to modify the ALLOWED_HOSTS definition. They are designed specifically around line numbers and will only work with a un modified file.0. 2015 CiscoLive! OpenStack Lab LABCLD2225 Horizon Step 127 Open Firewall Holes On the controller host 10.ciscolive.0.1.com/printable.1" and swap it to OPENSTACK_HOST = "10.0.0.php?pod=3 96/180 .236.0.1"/OPENSTACK_HOST = "10.31 issue the command: [[IDSEQSTEP]] firewall‐cmd ‐‐add‐port=80/tcp ‐‐permanent firewall‐cmd ‐‐add‐port=8080/tcp ‐‐permanent firewall‐cmd ‐‐add‐port=443/tcp ‐‐permanent firewall‐cmd ‐‐reload Step 128 Install Horizon On the controller host 10. 2.31".0. com/printable.com'.0.0.php?pod=3 97/180 .31 issue the command: [[IDSEQSTEP]] setsebool ‐P httpd_can_network_connect on chown ‐R apache:apache /usr/share/openstack‐ dashboard/static Step 131 Enable and start HTTP service On the controller host 10.0.service Step 132 Validate HTTP service is enabled On the controller host 10.236. 2. 2015 CiscoLive! OpenStack Lab LABCLD2225 [[IDSEQSTEP]] sed ‐i "s/ALLOWED_HOSTS = \ ['horizon.service memcached. 'localhost'\]/ALLOWED_HOSTS = '*'/g" /etc/openstack‐dashboard/local_settings The last configuration change for the Horizon dashboard settings is to uncomment a section and recomment another.ciscolive.236.236.1.109 s/#//g' /etc/openstack‐ dashboard/local_settings sed ‐i '104.0. On the controller host 10.236.service systemctl start httpd.31 issue the command: [[IDSEQSTEP]] systemctl status httpd.109 s/^\s//g' /etc/openstack‐ dashboard/local_settings sed ‐i '111.115 s/^/#/g' /etc/openstack‐ dashboard/local_settings Step 130 Set HTTP On the controller host 10.31 issue the command: [[IDSEQSTEP]] systemctl enable httpd.service http://openstack.service memcached.example.31 issue the command: [[IDSEQSTEP]] sed ‐i '104. 2.slice/httpd.31/dashboard (http://10.31/dashboard) This should open a page that looks like the following. 14s ago Main PID: 83322 (httpd) Status: "Total requests: 0.236.0.0.1.php?pod=3 98/180 . Current traffic: 0 B/se c" CGroup: /system. enabled) Active: active (running) since Mon 2015‐01‐05 04:29:45 EST.service ├─83322 /usr/sbin/httpd ‐DFOREGROUND ├─83329 /usr/sbin/httpd ‐DFOREGROUND ├─83330 /usr/sbin/httpd ‐DFOREGROUND ├─83331 /usr/sbin/httpd ‐DFOREGROUND ├─83332 /usr/sbin/httpd ‐DFOREGROUND ├─83333 /usr/sbin/httpd ‐DFOREGROUND └─83334 /usr/sbin/httpd ‐DFOREGROUND Step 133 Validate Horizon is operational From your desktop you should be able to point your browser to the controller host with the url: http://10.236.service ‐ The Apache HTTP Server Loaded: loaded (/usr/lib/systemd/system/httpd. 2015 CiscoLive! OpenStack Lab LABCLD2225 # systemctl status httpd.service httpd.service. Current requests/sec: 0.com/printable. You can login into the interface with the credentials Username: admin http://openstack.ciscolive. 2.com/printable. 2015 CiscoLive! OpenStack Lab LABCLD2225 Password: cisco.php?pod=3 99/180 .123 http://openstack.ciscolive.1. 31: After you login into to the Horizon dashboard with the admin account. memory and other factors. It does an analysis of CPU. For the purpose of this lab. By default. we want to force the virtual machine instances created by you to reside in specific hosts of the topology so you can test the network connectivity between the hosts.ciscolive. you should see a screen similar to the following: The first step that you will perform is to set up host aggregates so that you can specify which host you want to place your virtual machine instances.236. 2.com/printable. OpenStack has a series of algorithms to select the most appropriate host to place created instances.1.php?pod=3 100/180 . Step 135 Go to Host Aggregates http://openstack. 2015 CiscoLive! OpenStack Lab LABCLD2225 OpenStack Host Aggregates Step 134 Login into dashboard with admin account Under the administrator account you will goto On the horizon web interface on 10.0. 31: Step 136 Create compute1 Aggregate On the Create Host Aggregate configuration page. select Host Aggregates on the left menu.0.ciscolive.com/printable.0. 2015 CiscoLive! OpenStack Lab LABCLD2225 To access the Host Aggregates configuration section. On the horizon web interface on 10. This will match the OpenStack naming convention for our hosts. then click the +Create Host Aggregate button on the upper right corner. On the horizon web interface on 10. enter the name compute1 for both Name and Availability Zone as shown below. http://openstack. In this case we want to include the controller host into this aggregate. 2.1.236.31: Now you have to select the host that will be part of this aggregate.php?pod=3 101/180 .236. ciscolive.1.31: Once the popup is up enter the following information: http://openstack. You have created the first aggregate. the aggregate should look similar to the following.236.0. You will repeat the process to create another aggregate but for the second host in your cluster. 2015 CiscoLive! OpenStack Lab LABCLD2225 Once created. 2.php?pod=3 102/180 . Step 137 Create compute2 Aggregate On the horizon web interface on 10.com/printable. ciscolive.1.com/printable.php?pod=3 103/180 . http://openstack. 2. 2015 CiscoLive! OpenStack Lab LABCLD2225 You should now have two separate aggregates called compute1 and compute2 matching the appropriate host of this OpenStack cluster. 31/dashboard) and log in with the following credentials: On the horizon web interface on 10.0.com/printable.31/dashboard (http://10.0. 2015 CiscoLive! OpenStack Lab LABCLD2225 OpenStack base network Step 138 Log in to dashboard with admin account If you are not already logged into the OpenStack dashboard. 2.236.236. connect to http://10.236.0.1.31: http://openstack.236.31: Step 140 Tenant Public Network Parameters Fill out the form as follows: On the horizon web interface on 10.236.31: Step 139 Create Tenant Public Network Locate the Networks tab under Admin > System and click on +Create Network On the horizon web interface on 10.0.php?pod=3 104/180 .0.ciscolive. Click on the Network Name.ciscolive. 2. 2015 CiscoLive! OpenStack Lab LABCLD2225 When finished you should see a screen similar to the following. and the following screen will appear.php?pod=3 105/180 . http://openstack. On this screen click on the +Create Subnet Step 141 Create Subnet for Public Network In this step you will be creating the subnet for the public admin network.1. When creating a subnet it involves two parts.com/printable. Now you need to click on the Network Name to add the subnet for this network. Step 142 Create Tenant Private Network Click on the OpenStack Horizon Dashboard Networks Tab to return to the Network List. 2015 CiscoLive! OpenStack Lab LABCLD2225 ALERT! Make sure to disable DHCP for this subnet.ciscolive. It should look similar to this: http://openstack.php?pod=3 106/180 .1.com/printable. 2. 31: Step 143 Signout and Signin as Tenant User Logout from the admin account as the next steps will be conducted as you assume the role of the Tenant of this OpenStack network.236. 2.0. Step 144 Login to dashboard with poduser account On the horizon web interface on 10. On the horizon web interface on 10.31: Step 145 Add subnet to Tenant VLAN http://openstack.236. 2015 CiscoLive! OpenStack Lab LABCLD2225 Click the +Create Network button again.php?pod=3 107/180 .com/printable.ciscolive.0.1. For this network we will be creating a DHCP server on the subnet such that the instances that we create will receive IP addresses.10. 2. On the horizon web interface on 10.3. Now that you have assumed the entity of the Tenant User.com/printable.10.3. 2015 CiscoLive! OpenStack Lab LABCLD2225 The administrator created the two networks.1. Enable DHCP and enter the scope in the range that list listed as 10. you will configure the subnet for the Tenant VLAN.31: Step 146 Create Subnet for Tenant Private Network Once you click add Subnets a popup will appear as the following. The reason for this is that that network belongs to the admin side while the network Vlan310 belongs to the Tenant Project.199.0. You are going to use the Tenant account to create the subnet under the tenant network Vlan310.236. You will notice that you can't make changes to the network Vlan300.ciscolive.php?pod=3 108/180 . you should be able to add a Subnet under actions for Vlan310. http://openstack.10. Under the Network>Networks tab in Horizon Dashboard.101. Fill in with the following values. com/printable. When the popup appears please enter the name TenantRouterPOD3 as the router name. please proceed to the following screen and click on the +Create Router . http://openstack.ciscolive.1. 2. Click on the Set Gateway as you would see below. 1 Router Name: TenantRouterPOD3 Once created you will select the gateway for this router. 2015 CiscoLive! OpenStack Lab LABCLD2225 Once completed we can proceed to create the router for the Tenant Network Step 147 Configure Tenant Router To configure the Router.php?pod=3 109/180 . 3.0/24 and click the + Add interface button.10. And a screen similar to the following will be presented. 1 Subnet: Vlan310:10.10. For this you need to click on the router network name. The following screen will be presented.ciscolive.0/24 http://openstack. Select Vlan300 for the External Network then click Set Gateway 1 External Network: Vlan300 Now you need to configure the port of the router that is attached to the internal private network.com/printable. 2015 CiscoLive! OpenStack Lab LABCLD2225 The following screen should appear.php?pod=3 110/180 . Select the option that says Vlan310:10.3. 2.1. Click on the + Add interface button. X. The following screen will popup and you will need to fill out the form as shown below making sure not to click the submit button until after you have selected the network adapter: 1 Availability Zone: compute1 2 Instance Name: POD3VM1 3 Instance Boot Source: Boot from image 4 Image Name: cirros0. Step 148 Create Instance on compute1 You will be creating two separate instances and each instance will be created in a separate compute node of your cluster. 2.ciscolive. The Instances tab is under the Compute section on the left of the screen.X x86_64 (XX. You will start with creating the instance on compute1.X MB) http://openstack. First make sure you are logged into the Horizon Dashboard as userpod3 and go to the Instances tab as shown below.com/printable. Once there click on the Launch Instance button. Now you will create two separate instances that will be placed in the private Tenant network and will be capable of reaching the external network.php?pod=3 111/180 .1. 2015 CiscoLive! OpenStack Lab LABCLD2225 With that you have concluded creating the network for this Tenant. X. 2.php?pod=3 112/180 .X MB) When you click on the network tab the following will be presented. This selects the VLAN as the NIC interface for this instance. http://openstack. Step 149 Create Instance on compute2 You will now create the second instance (VM) on compute2. 2015 CiscoLive! OpenStack Lab LABCLD2225 When you click on the network tab the following will be presented. 1 Click on the + button for the option presented as Vlan310.X x86_64 (XX. Click on the Launch Instance button.ciscolive. The following screen will popup and you will need to fill out as follows making sure not to click the submit button until after you have selected the network adapter: 1 Availability Zone: compute2 2 Instance Name: POD3VM2 3 Instance Boot Source: Boot from image 4 Image Name: cirros0. 2 Click on the Launch button At this point OpenStack will start the process of creating your instance attached to the network Vlan310.com/printable.1. This selects the VLAN as the NIC interface for this instance. 2015 CiscoLive! OpenStack Lab LABCLD2225 1 Click on the + button for the option presented as Vlan310. 2 Click on the Launch button At this point you should have two instances running in OpenStack! Congrats! After a few seconds. you should see the following: Your network should now look something like this: ALERT! This might be a good time to take a small break! The system is creating the http://openstack.com/printable. 2.php?pod=3 113/180 .1.ciscolive. php?pod=3 114/180 . Once there you can see the topology you have created up to this point. This command will list the interface eth0 ip address. And from them issue the command ip a . A popup window will appear similar to the following. Step 150 Connect to instance consoles and validate network The best way to connect to the consoles of the instances is via the Network Topology TAB in the Horizon Dashboard.1. http://openstack. 2015 CiscoLive! OpenStack Lab LABCLD2225 instances and takes a couple of minutes until the instances are ready for use. If you hover over one of the computer icons you will see the following: From there you can now click on Open Console to open the console of the specific instance. 2.com/printable. Head over to your Tenant Network tab and select Network Topology. Log into the two separate instances.ciscolive. 3.3.10. On one of the instances issue the command: ping 10.10.1 (10.1: icmp_seq=1 ttl=255 time=0.3.1: icmp_seq=2 ttl=255 time=0.3.1.10.207 ms 64 bytes from 10.1 (10.3.1 # ping 10.1: icmp_seq=3 ttl=255 time=0.1: icmp_seq=1 ttl=255 time=0. On one of the instances issue the command: ALERT! You will not be able to copy into this VNC window.php?pod=3 115/180 .10.10.3.0.236.0.257 ms 64 bytes from 10. 64 bytes from 10.1 # ping 10.0.290 ms 64 bytes from 10.XX/24 brd 10.0.1/8 scope host lo inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: eth0: mtu 1500 qdisc mq state UP qlen 1000 link/ether 00:25:b5:bc:00:14 brd ff:ff:ff:ff:ff:ff inet 10.10.207 ms 64 bytes from 10.com/printable.1 PING 10.0.3.3. 64 bytes from 10. ping 10.3.257 ms 64 bytes from 10.1) 56(84) bytes of data.3.3.10.1 PING 10.0.3.XX.290 ms 64 bytes from 10.1: icmp_seq=2 ttl=255 time=0.3.10.207 ms http://openstack. 2015 CiscoLive! OpenStack Lab LABCLD2225 # ip a 1: lo: mtu 65536 qdisc noqueue state UNKNOWN link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.1) 56(84) bytes of data.207 ms You should also be capable of pinging the northbound ASR1K that is depicted in the topology diagram above.1: icmp_seq=4 ttl=255 time=0.0.3.0.3.1: icmp_seq=4 ttl=255 time=0.1: icmp_seq=3 ttl=255 time=0.ciscolive.0.3. 2.255 scope global eth0 inet6 fe80::225:b5ff:febc:14/64 scope link valid_lft forever preferred_lft forever You should be able to ping from instance to instance and also the default gateways.XX.0.0. ciscolive.31/dashboard (http://10.236. In OpenStack you create flavors to define what resources an instance will consume.31/dashboard) and log in with the following credentials: On the horizon web interface on 10.236.31: Step 152 Create Flavor Go to Admin > Flavors and click on the +Create Flavor button as shown below. 2. Step 151 Log in to the OpenStack dashboard with admin account If you are not already logged into the OpenStack dashboard.0. CPU requirements and memory requirements.com/printable.php?pod=3 116/180 . When you complete this procedure.0.1. For example. You will need to fill out the following form with this information: 1 Name: CSR1K 2VCPU http://openstack. you will provide your Tenant with the ability to create a instance based on the Cisco CSR (Cloud Services Router) in their networks.0. 2015 CiscoLive! OpenStack Lab LABCLD2225 Create CSR1K Flavor in OpenStack This procedure explains the process to create the CSR1K flavor.236. the instance image. connect to http://10. 0.13.S. 2015 CiscoLive! OpenStack Lab LABCLD2225 2 ID: auto 3 VPCU: 2 4 RAM: 4096 5 Root Disk: 0 6 Ephermeral Disk: 0 7 Swap Disk: 0 Step 153 Create Image Next.1.03.13.qcow2 4 Format: QCOW2 QEMU Emulator 5 Public: (CHECKED) ALERT! http://openstack.226.com/printable.1S 2 Image Source: image location 3 Image Location: http://10.01.ciscolive.7/tftpboot/iso/csr1000v universalk9. 2. navigate to Admin > System > Images and click on the +Create Image button as shown below: Fill out the Create An Image form with the following information: 1 Name: CSR1KV3.php?pod=3 117/180 .S1 ext.1543. http://openstack. You will be doing this as part of your Nexus integration later in this lab.1.php?pod=3 118/180 . 2015 CiscoLive! OpenStack Lab LABCLD2225 This process will take a few minutes to complete as the image needs to be downloaded from our internal server into your OpenStack topology.com/printable.ciscolive. 2. you should now have the ability to create CSR1KV instances. Once completed. 236. you should see a screen similar to the following: Step 155 Create Nexus Public Network Navigate to Admin > System > Networks and click on +Create Network http://openstack.1.31/dashboard) and log in with the following credentials: On the horizon web interface on 10.236. connect to http://10. 2. 2015 CiscoLive! OpenStack Lab LABCLD2225 OpenStack Nexus3k/7k network configuration Step 154 Login into dashboard with admin account If you are not already logged into the OpenStack dashboard.php?pod=3 119/180 .236.com/printable.ciscolive.0.31: After you login into to the Horizon dashboard with the admin account.0.31/dashboard (http://10.0. Now you need to click on the Network Name to add the subnet for this network.0.ciscolive. On this screen click on the +Create Subnet Step 157 Create Subnet for Public Network http://openstack. 2015 CiscoLive! OpenStack Lab LABCLD2225 On the horizon web interface on 10.31: When finished you should see a screen similar to the following.php?pod=3 120/180 .0.com/printable. Click on the Network Name. 2.236.236.31: Step 156 Nexus Public Network Parameters Enter the information as shown below to create the network: On the horizon web interface on 10.1. and the following screen will appear. 1. 2015 CiscoLive! OpenStack Lab LABCLD2225 In this step you will be creating the subnet for the public admin network. When creating a subnet it involves two parts. 2. ALERT! Make sure to disable DHCP for this subnet.com/printable. Step 158 Create Network for Nexus Private Network Navigate to Admin > System > Networks to return to the network list and click on the +Create Network button.ciscolive. http://openstack.php?pod=3 121/180 . On this screen click on the +Create Subnet You will now create the private network for the Nexus component.1. 2.ciscolive.php?pod=3 122/180 . 2015 CiscoLive! OpenStack Lab LABCLD2225 Enter the information as follows: When finished you should see a screen similar to the following. Now you need to click on the Network Name to add the subnet for this network. http://openstack. You should be back to the Network pane.com/printable. 2. 2015 CiscoLive! OpenStack Lab LABCLD2225 Step 159 Signout and Signin as Tenant User Log out from the admin account as the next steps will be conducted as you assume the role of a Tenant of the OpenStack network.ciscolive.236. Step 160 Login to dashboard with poduser account On the horizon web interface on 10.31: http://openstack.php?pod=3 123/180 .0.1.com/printable. Type exactly or next steps will fail.1. CSR1KvR1 3 Flavor: CSR1K2VCPU 4 Instance Boot Source: Boot from image 5 Image Name: CSR1KV 3. enter the following information: 1 Availability Zone: compute1 2 Instance Name: CSR1KvR1 ALERT! This is case sensitive.com/printable. Click on the Launch Instance button.13. 2015 CiscoLive! OpenStack Lab LABCLD2225 Step 161 Create a CSR1Kv instance After you log in to the Horizon dashboard with the tenant account.php?pod=3 124/180 . 2.ciscolive. In the Instance Create form. Copy provided to help.1S 6 Click on Networking tab Once you click on the Networking tab you should see a screen similar to the following: 1 Select Vlan330 http://openstack. navigate to Compute > Instances on the Horizon Dashboard. http://openstack.31 issue the command: [[IDSEQSTEP]] sshpass ‐p cisco.1. You can take a look at this now via the CLI as follows.php?pod=3 125/180 . the Nexus plugin has done some work on the Nexus switches to allow the required VLANs to reach the hosts.0. Step 162 Access Nexus 3k to validate interface/VLAN creation. On the controller host 10.123 ssh ‐o StrictHostKeyChecking=no admin@n3k‐os‐pod3 You should be able to see the creation of both the VLAN and the interface.ciscolive.com/printable. 2. 2015 CiscoLive! OpenStack Lab LABCLD2225 2 Click Launch In the background.236. Eth1/5 Eth1/6. Eth1/23. Eth1/12 Eth1/13. Eth1/18 Eth1/19. On the controller host 10. Eth1/48 Eth1/49/1. Eth1/27 Eth1/28.70. Eth1/8. you must assume the identity of the Tenant to issue these commands. Eth1/15 Eth1/16. Eth1/47.3 protocol‐up/link‐up/admin‐up Vlan370 10. Eth1/51/4 Eth1/52/1.0. Eth1/50/2 Eth1/50/3. Eth1/20. Eth1/52/3 Eth1/52/4 310 POD3‐neutron‐310 active Eth1/1 330 POD3‐neutron‐330 active Eth1/1 VLAN Type Vlan‐mode ‐‐‐‐ ‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐ 1 enet CE 310 enet CE 330 enet CE Primary Secondary Type Ports ‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐ N3K‐OS‐POD3# show ip int brief IP Interface Status for VRF "default"(1) Interface IP Address Interface Status Vlan330 10. Eth1/52/2. Eth1/38. Eth1/7. Eth1/41. Eth1/11. 2. Next. Eth1/36 Eth1/37.236. Eth1/39 Eth1/40. Eth1/49/3 Eth1/49/4.com/printable. Eth1/44. Eth1/42 Eth1/43. Eth1/9 Eth1/10. Eth1/51/3. Eth1/50/4. Eth1/45 Eth1/46. exit the SSH session to return to the terminal prompt on your controller node. 2015 CiscoLive! OpenStack Lab LABCLD2225 N3K‐OS‐POD4# show vlan VLAN Name Status Ports ‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐ 1 default active Eth1/2.31 issue the command: http://openstack. Eth1/14.3. Eth1/17. Eth1/32. Eth1/24 Eth1/25. Eth1/35. Eth1/3. Eth1/30 Eth1/31. Eth1/29.1.3 protocol‐down/link‐down/admin‐up Step 163 Attach port to CSR1Kv If you are still logged in to the Nexus switch. Eth1/21 Eth1/22. Eth1/4.php?pod=3 126/180 . Eth1/49/2. Eth1/26.30.3. Eth1/50/1. Eth1/33 Eth1/34. Eth1/51/1 Eth1/51/2.ciscolive. 10.1 Vlan331 | awk '/ id / {print $4}') CSR1Kv‐R1 You should be able to now look at the CSR1Kv from the CLI and see both connected ports to OpenStack.sh You can list all the instances that are active in this OpenStack network with the command: On the controller host 10. TenantPOD3.3.2 | | 75734a5e‐77bf‐4e43‐9611‐e485eee76972 | POD3VM1 | ACTIVE | ‐ | Runnin g | Vlan310=10. 2.0.10.31 issue the command: [[IDSEQSTEP]] nova interface‐attach ‐‐port‐id $(neutron port‐ create ‐‐fixed‐ip ip_address=10.236.3.3.0.30. On the controller host 10.103 | +‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐ ‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ You can see the instance for the CSR1Kv.0.3.1.31.31 issue the command: nova show CSR1Kv‐R1 http://openstack.236. From here we can derive the command to create the port in OpenStack.php?pod=3 127/180 .236. On the controller host 10.com/printable.ciscolive.31 issue the command: [[IDSEQSTEP]] nova list That should provide output similar to the following: # nova list +‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐ ‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ | ID | Name | Status | Task State | Power State | Networks | +‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐ ‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ | 8b2d7d9f‐692e‐4c70‐b2b9‐0717bffa987a | CSR1Kv‐R1 | ACTIVE | ‐ | Runnin g | Vlan330=10.101 | | b59e7146‐a429‐490f‐b7da‐9c983c05e1e6 | POD3VM2 | ACTIVE | ‐ | Runnin g | Vlan310=10. 2015 CiscoLive! OpenStack Lab LABCLD2225 [[IDSEQSTEP]] cd ~ . 1S (ac958f45‐85e0‐4984‐864b‐ f7970a303210) | | key_name | ‐ | | metadata | {} | | name | CSR1Kv‐R1 | | os‐extended‐volumes:volumes_attached | [] | | progress | 0 | | security_groups | default | | status | ACTIVE | | tenant_id | f3b50c1031b64ab38488d8aa5b3497fc | | updated | 2015‐01‐15T19:31:41Z | | user_id | bcdb00a1ace34bf9adc567d0c6dca133 | http://openstack.1 | | accessIPv4 | | | accessIPv6 | | | config_drive | | | created | 2015‐01‐15T19:31:28Z | | flavor | CSR1K‐2VCPU (ef11df23‐a196‐4786‐a841‐5b9 b42105ebe) | | hostId | 4b8af0b563c2933d9991ffe261f6b594b7c45307 c07c430eed4eb04d | | id | 8b2d7d9f‐692e‐4c70‐b2b9‐0717bffa987a | | image | CSR1KV‐3.3.2 | | Vlan331 network | 10. 2.php?pod=3 128/180 . 2015 CiscoLive! OpenStack Lab LABCLD2225 # nova show CSR1Kv‐R1 +‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ | Property | Value | +‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ | OS‐DCF:diskConfig | AUTO | | OS‐EXT‐AZ:availability_zone | compute1 | | OS‐EXT‐STS:power_state | 1 | | OS‐EXT‐STS:task_state | ‐ | | OS‐EXT‐STS:vm_state | active | | OS‐SRV‐USG:launched_at | 2015‐01‐15T19:31:41.ciscolive.com/printable.3.13.30.1.000000 | | OS‐SRV‐USG:terminated_at | ‐ | | Vlan330 network | 10.31. you can configure the CSR directly via CLI. Navigate to Network > Network Topology as the Tenant user.1. To do this you will need to connect to the console of the CSR1Kv directly. You will now configure the CSR router functionality via the CLI. You should see a diagram like this: Step 165 Configure IOS interfaces for CSR1Kv Now that both interfaces of the CSR1Kv are attached to the proper networks. The best way to attach to the console of the CSR is via the Network > Network Topology OpenStack Dashboard tab.ciscolive. hover over the CSR1Kv instance and click on the Open Console link.com/printable.php?pod=3 129/180 . This will open a screen similar to the following: Because of the nature of the VNC console you will not be able to COPY/PASTE into it. On the CSR1Kv instance issue the command: http://openstack. 2015 CiscoLive! OpenStack Lab LABCLD2225 +‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ Step 164 Validate CSR instance and network. Once there. 2. On the controller host 10.php?pod=3 130/180 .31 issue the command: nova show CSR1Kv‐R1 # nova show CSR1Kv‐R1 +‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐ http://openstack.236.ciscolive. 2. The first interface we will configure will be for GigabitEthernet2 that is attached to Vlan331.31.3. you can locate the IP Address that was assigned to it via the CLI command nova show CSR1Kv‐R1 .0.1 YES DHCP up up For the interface that is attached to Vlan330. On the CSR1Kv instance issue the command: [[IDSEQSTEP]] config t int GigabitEthernet2 ip address dhcp no shutdown end The interface of the router should become operational and you should see a message that it has acquired a IP address.com/printable.1. 2015 CiscoLive! OpenStack Lab LABCLD2225 enable show ip interface brief # show ip interface brief Interface IP‐Address OK? Method Status Protocol GigabitEthernet1 unassigned YES unset administratively down down GigabitEthernet2 unassigned YES unset administratively down down Your next step is to configure the IP Addresses of both interfaces. If you issue the command show ip interface brief it will look similar to: # show ip interface brief Interface IP‐Address OK? Method Status Protocol GigabitEthernet1 unassigned YES unset administratively down down GigabitEthernet2 10. 13.1 | | accessIPv4 | | | accessIPv6 | | | config_drive | | | created | 2015‐01‐15T19:31:28Z | | flavor | CSR1K‐2VCPU (ef11df23‐a196‐4786‐a841‐5b9 b42105ebe) | | hostId | 4b8af0b563c2933d9991ffe261f6b594b7c45307 c07c430eed4eb04d | | id | 8b2d7d9f‐692e‐4c70‐b2b9‐0717bffa987a | | image | CSR1KV‐3.1S (ac958f45‐85e0‐4984‐864b‐ f7970a303210) | | key_name | ‐ | | metadata | {} | | name | CSR1Kv‐R1 | | os‐extended‐volumes:volumes_attached | [] | | progress | 0 | | security_groups | default | | status | ACTIVE | | tenant_id | f3b50c1031b64ab38488d8aa5b3497fc | | updated | 2015‐01‐15T19:31:41Z | | user_id | bcdb00a1ace34bf9adc567d0c6dca133 | +‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ http://openstack.2 | | Vlan431 network | 10.com/printable.3. 2015 CiscoLive! OpenStack Lab LABCLD2225 ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ | Property | Value | +‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐+ | OS‐DCF:diskConfig | AUTO | | OS‐EXT‐AZ:availability_zone | compute1 | | OS‐EXT‐STS:power_state | 1 | | OS‐EXT‐STS:task_state | ‐ | | OS‐EXT‐STS:vm_state | active | | OS‐SRV‐USG:launched_at | 2015‐01‐15T19:31:41.php?pod=3 131/180 .30.31.1. 2.000000 | | OS‐SRV‐USG:terminated_at | ‐ | | Vlan430 network | 10.ciscolive.3. 3.1 # ping 10. use the value that is specified by NOVA in the previous command.php?pod=3 132/180 .0 no shutdown end With this both interfaces should be operational.2. If it doesn't.3.3.255.30. On the CSR1Kv instance issue the command: ping 10.30. timeout is 2 seconds: .1.255.com/printable.3.2 255. Sending 5.30.!!!! Success rate is 100 percent (5/5).255.0 area 0 network 10.30. On the CSR1Kv instance issue the command: [[IDSEQSTEP]] config t int GigabitEthernet1 ip address 10.ciscolive.3.0 255. round‐trip min/avg/max = 1/1/1 ms Step 166 Configure OSPF on CSR1Kv Your first task is to configure OSPF process on the CSR1Kv On the CSR1Kv instance issue the command: [[IDSEQSTEP]] conf t router ospf 1 router‐id 10.255.3.3.1 Type escape sequence to abort.0 255.30.1. 2015 CiscoLive! OpenStack Lab LABCLD2225 Validate from the output of the command that Vlan330 has an assigned IP address of 10.0 area 0 exit interface gigabitethernet1 ip ospf network broadcast exit interface gigabitethernet2 ip ospf network broadcast Step 167 Configure OSPF on Nexus3k You will need to connect to the Nexus3k. http://openstack.2 network 10. 2. 100‐byte ICMP Echos to 10.255.3.31.30.255. You can then ping the northbound SVI interface on the Nexus3k.30. 3.3. On the nexus3k issue the command: [[IDSEQSTEP]] conf t router ospf 1 router‐id 10. On the nexus3k issue the command: show ip ospf neighbors N3K‐OS‐PODPOD3# show ip ospf neighbors OSPF Process ID 1 VRF default Total number of neighbors: 1 Neighbor ID Pri State Up Time Address Interface 10.1.30.3. 2015 CiscoLive! OpenStack Lab LABCLD2225 On the controller host 10. you will have to configure OSPF.255.30.236.123 ssh ‐o StrictHostKeyChecking=no admin@n3k‐os‐pod3 Once in the Nexus3k.3.2 1 FULL/DR 00:02:21 10.0 255.255.ciscolive.2 Vlan330 You can also validate that the Nexus3k has learned the routes after the CSR1Kv show ip route http://openstack. 2. You should be able to already establish a neighbor relationship with the CSR1Kv.31 issue the command: [[IDSEQSTEP]] sshpass ‐p cisco.com/printable.1 network 10.0.30.php?pod=3 133/180 .30.0 area 0 interface Vlan330 ip ospf network broadcast end copy running‐config startup‐config With this configuration the Nexus3k is configured for OSPF. 2015 CiscoLive! OpenStack Lab LABCLD2225 N3K‐OS‐POD3# show ip route IP Route Table for VRF "default" '*' denotes best ucast next‐hop '**' denotes best mcast next‐hop '[x/y]' denotes [preference/metric] '%' in via output denotes VRF [CUT] 10. This http://openstack.ciscolive. Once there click on the Launch Instance button. [110/41]. 2.2. ubest/mbest: 1/0 *via 10. 00:04:20. 1 Click on the + button for the option presented as Vlan331.0/24.3.1.31.X x86_64 (XX. Vlan330.X. ospf‐1. intra Step 168 Create Instance on compute1 You will be creating two separate instances and each instance will be created in a separate compute node of your cluster.30. The following screen will popup and you will need to fill out as follows making sure not to click the submit button until after you have selected the network adapter: 1 Availability Zone: compute1 2 Instance Name: POD3VM3 3 Instance Boot Source: Boot from image 4 Image Name: cirros0.3.X MB) When you click on the network tab the following will be presented.php?pod=3 134/180 . First make sure you are logged into the Horizon Dashboard as userpod3 and goto the following tab. You will start with creating the instance on compute1.com/printable. Please click on Launch Instance Step 169 Create second Instance on compute2 You will now create the second instance (VM) on compute2.X MB) When you click on the network tab the following will be presented. 2. This http://openstack.ciscolive. 2 Click on the Launch button At this point OpenStack will start the process of creating your instance attached to the network Vlan331. Click on the Launch Instance button.php?pod=3 135/180 . 1 Click on the + button for the option presented as Vlan331.1.X. The following screen will popup and you will need to fill out as follows making sure not to click the submit button until after you have selected the network adapter: 1 Availability Zone: compute2 2 Instance Name: POD3VM4 3 Instance Boot Source: Boot from image 4 Image Name: cirros0.X x86_64 (XX. 2015 CiscoLive! OpenStack Lab LABCLD2225 selects the VLAN as the NIC interface for this instance.com/printable. ciscolive. 2 Click on the Launch button At this point you should have two instances running in OpenStack! Congrats!.php?pod=3 136/180 . 2015 CiscoLive! OpenStack Lab LABCLD2225 selects the VLAN as the NIC interface for this instance. 2. Your network should now look something like this: ALERT! This might be a good time to take a small break! The system is creating the instances and takes a couple of minutes until the instances are ready for use. The following screen you should be seeing at this point is as follows. http://openstack.1.com/printable. 1. 2. 2015 CiscoLive! OpenStack Lab LABCLD2225 Step 170 Connect to instance consoles and validate network The best way to connect to the consoles of the instances is via the Network Topology tab in the Horizon Dashboard. Head over to your Tenant Network tab and an option is Network Topology. Select that option. Once there you can see the topology you have created up to this point. If you hover over that computer icon you can then see the following: From there you can now click on Open Console to open the console of the specific instance. A popup window will appear similar to the following. Log into the two separate instances. And from them issue the command ip a . This command will list the interface eth0 ip address. http://openstack.ciscolive.com/printable.php?pod=3 137/180 1. 2. 2015 CiscoLive! OpenStack Lab LABCLD2225 # ip a 1: lo: mtu 65536 qdisc noqueue state UNKNOWN link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: eth0: mtu 1500 qdisc mq state UP qlen 1000 link/ether 00:25:b5:bc:00:14 brd ff:ff:ff:ff:ff:ff inet 10.XX.XX.XX/24 brd 10.0.236.255 scope global eth0 inet6 fe80::225:b5ff:febc:14/64 scope link valid_lft forever preferred_lft forever You should be able to ping from instance to instance and also the default gateways. On one of the instances issue the command: ALERT! You will not be able to copy into this VNC window. ping 10.3.31.1 # ping 10.3.31.1 PING 10.3.31.1 (10.3.10.1) 56(84) bytes of data. 64 bytes from 10.3.31.1: icmp_seq=1 ttl=255 time=0.290 ms 64 bytes from 10.3.31.1: icmp_seq=2 ttl=255 time=0.207 ms 64 bytes from 10.3.31.1: icmp_seq=3 ttl=255 time=0.257 ms 64 bytes from 10.3.31.1: icmp_seq=4 ttl=255 time=0.207 ms You should also be capable of pinging the northbound ASR1K that is depicted in the topology diagram above. On one of the instances issue the command: ping 10.3.30.1 # ping 10.3.30.1 PING 10.3.30.1 (10.3.30.1) 56(84) bytes of data. 64 bytes from 10.3.30.1: icmp_seq=1 ttl=255 time=0.290 ms 64 bytes from 10.3.30.1: icmp_seq=2 ttl=255 time=0.207 ms 64 bytes from 10.3.30.1: icmp_seq=3 ttl=255 time=0.257 ms 64 bytes from 10.3.30.1: icmp_seq=4 ttl=255 time=0.207 ms http://openstack.ciscolive.com/printable.php?pod=3 138/180 1. 2. 2015 CiscoLive! OpenStack Lab LABCLD2225 Congrats! You Finished! If you wish to continue the lab with the Cisco Nexus ACI integration, on the next step a special script will be used to remove the Tenant instances and network definitions. This will not remove the underlying Neutron configuration. You will be replacing some values for ACI in that step. If you just wish to continue playing with the lab without ACI stop here. http://openstack.ciscolive.com/printable.php?pod=3 139/180 2015 CiscoLive! OpenStack Lab LABCLD2225 Wipe Tenant OpenStack configuration This script is available on the internet and available via GitHub. Step 171 Login into dashboard with admin account Under the administrator account you will goto On the horizon web interface on 10. admin. 2. The purpose of this script is to remove all resources related to the Tenant before it get's cleared.31: Step 172 Run dry run of purge all elements under TenantPOD3 On the controller host 10.0.31 issue the command: [[IDSEQSTEP]] cd ~ .236.php?pod=3 140/180 .sh ospurge ‐‐dry‐run ‐‐cleanup‐project TenantPOD3 http://openstack. For this lab we plan to run the command with the options to keep the Tenant but remove all it's underlying resources so that you can proceed to the ACI integration with a clear OpenStack setup.1.com/printable.236.0. It goes through an OpenStack Tenant and removes all the configuration.ciscolive. 2015 CiscoLive! OpenStack Lab LABCLD2225 # ospurge ‐‐dry‐run ‐‐cleanup‐project TenantPOD3 * Resources type: CinderSnapshots * Resources type: CinderBackups * Resources type: NovaServers server POD3VM4 (id 7e3198a3‐438e‐46f4‐adf0‐7da270f2b299) server POD3VM3 (id 1de71e78‐fdda‐4024‐a5d4‐240d303dbfd5) server CSR1Kv‐R1 (id 2aecc3de‐799f‐464d‐963b‐19d62d4b1d1a) server POD3VM2 (id 4af9c718‐6e6d‐42c9‐a3b7‐41fb4a6e3f37) server POD3VM1 (id 18b87292‐0cd0‐4c27‐95aa‐187a1d41b9a4) * Resources type: NeutronFloatingIps * Resources type: NeutronInterfaces interface (id 31745c03‐391d‐4feb‐9631‐6c9e3c15c22f) * Resources type: NeutronRouters router TenantRouterPOD4 (id 35f2e546‐df5e‐4d39‐a0d2‐ce852b540e9f) * Resources type: NeutronPorts port (id 2ca7a0b6‐c1c8‐4334‐ba54‐d64e129765f1) port (id 5f11d032‐d011‐4776‐b6d6‐16507cc1407a) port (id 5f3693bd‐2640‐4930‐b40b‐c3c8486aaf86) port (id 746e2593‐d469‐490a‐b631‐ca7d9e2cc13c) port (id a8df498d‐8c8a‐4959‐8eec‐0837f5793ca5) port (id dd12b4d4‐2ce4‐4e89‐8b0e‐e1befc315678) * Resources type: NeutronNetworks network Vlan431 (id 610813a8‐bed7‐4249‐85b0‐0dff0eaf57a4) network Vlan430 (id 698416c8‐d2d7‐4765‐a823‐3a0b2b6d0c1b) network Vlan410 (id 875e731d‐3c08‐4928‐aa9f‐2d2ed3c66a40) * Resources type: NeutronSecgroups * Resources type: GlanceImages * Resources type: CinderVolumes Step 173 Purge all elements under TenantPOD3 ALERT! This is the last change to STOP.0.php?pod=3 141/180 .31 issue the command: http://openstack.ciscolive. 2. On the controller host 10.1.com/printable. Once you enter the following command if you wish to spend more time with just the Nexus3k integration you will have to redo all the GUI based steps.236. admin. http://openstack.sh ospurge ‐‐verbose ‐‐dont‐delete‐project ‐‐ cleanup‐project TenantPOD3 Step 174 Login into dashboard with tenant account Under the tenant account you will goto On the horizon web interface on 10.ciscolive.1.0. 2. 2015 CiscoLive! OpenStack Lab LABCLD2225 [[IDSEQSTEP]] cd ~ .com/printable.236.31: You should be able to browse through the Tenant and see that everything has been removed.php?pod=3 142/180 . ini ml2_mech_cisco_nexus:n3k‐os‐pod3 pod3‐controller openstack‐config ‐‐del /etc/neutron/plugins/ml2/ml2_conf_cisco.php?pod=3 143/180 .ini enable_isolated_metadata True openstack‐config ‐‐del /etc/neutron/plugins/ml2/ml2_conf_cisco.ini ml2_mech_cisco_nexus:n3k‐os‐pod3 ssh_port openstack‐config ‐‐del /etc/neutron/plugins/ml2/ml2_conf_cisco.ini ml2 mechanism_drivers openstack‐config ‐‐del /etc/neutron/plugins/ml2/ml2_conf_cisco.ini ml2_cisco vlan_name_prefix openstack‐config ‐‐del /etc/neutron/plugins/ml2/ml2_conf_cisco.ini ml2_mech_cisco_nexus:n7k‐os‐pod3 password openstack‐config ‐‐del /etc/neutron/plugins/ml2/ml2_conf_cisco.ini ml2_mech_cisco_nexus:n3k‐os‐pod3 password openstack‐config ‐‐del /etc/neutron/plugins/ml2/ml2_conf_cisco.ini ml2_mech_cisco_nexus:n7k‐os‐pod3 pod3‐compute2 Step 176 Create a service file for systemd Cisco APIC host agent On the controller host 10.com/printable.31 issue the command: [[IDSEQSTEP]] openstack‐config ‐‐del /etc/neutron/plugins/ml2/ml2_conf.236.ini ml2_mech_cisco_nexus:n3k‐os‐pod3 username openstack‐config ‐‐del /etc/neutron/plugins/ml2/ml2_conf_cisco.0. 2.236. 2015 CiscoLive! OpenStack Lab LABCLD2225 ACI Integration Step 175 Configure a service for the Cisco APIC host agent On the controller host 10.0.1.ciscolive.ini ml2_mech_cisco_nexus:n7k‐os‐pod3 username openstack‐config ‐‐del /etc/neutron/plugins/ml2/ml2_conf_cisco.ini ml2_cisco managed_physical_network openstack‐config ‐‐del /etc/neutron/dhcp_agent.ini ml2_mech_cisco_nexus:n7k‐os‐pod3 ssh_port openstack‐config ‐‐del /etc/neutron/plugins/ml2/ml2_conf_cisco.31 issue the command: http://openstack. service [Unit] Description=OpenStack APIC Host Agent After=syslog.target [Service] Type=simple User=neutron ExecStart=/usr/bin/neutron‐cisco‐apic‐service‐ agent ‐‐config‐file=/etc/neutron/neutron.wants/neutron‐cisco‐apic‐service‐ agent.target network.service [Unit] Description=OpenStack APIC Service Agent After=syslog.log PrivateTmp=false KillMode=process [Install] Wanted=multi‐user. 2.php?pod=3 144/180 .com/printable.target.target EOF Step 177 Create a service file for systemd Cisco APIC service agent On the controller host 10.ciscolive.target network.target.wants/neutron‐cisco‐apic‐host‐ agent.log PrivateTmp=false KillMode=process [Install] WantedBy=multi‐user.1.236.0.conf ‐‐ config‐ file=/etc/neutron/plugins/ml2/ml2_conf_cisco.31 issue the command: [[IDSEQSTEP]] cat <<EOF > /etc/systemd/system/multi‐ user.target EOF Step 178 Create a service file for systemd for neutron service http://openstack.ini ‐‐log‐file=/var/log/neutron/cisco‐apic‐host‐ agent.target [Service] Type=simple User=neutron ExecStart=/usr/bin/neutron‐cisco‐apic‐host‐agent ‐‐config‐file=/etc/neutron/neutron.conf ‐‐ config‐ file=/etc/neutron/plugins/ml2/ml2_conf_cisco.ini ‐‐log‐file=/var/log/neutron/cisco‐apic‐service‐ agent. 2015 CiscoLive! OpenStack Lab LABCLD2225 [[IDSEQSTEP]] cat <<EOF > /etc/systemd/system/multi‐ user. conf ‐‐config‐file /etc/neutron/neutron. 2.236.target [Service] Type=simple User=neutron ExecStart=/usr/bin/neutron‐openvswitch‐agent ‐‐ config‐file /usr/share/neutron/neutron‐dist.1.log PrivateTmp=true KillMode=process [Install] WantedBy=multi‐user.ini ‐‐log‐file /var/log/neutron/openvswitch‐agent.service [Unit] Description=OpenStack Neutron Open vSwitch Agent After=syslog.31 issue the command: [[IDSEQSTEP]] cat <<EOF > /etc/systemd/system/multi‐ user.ini ‐‐log‐file /var/log/neutron/server.236.target.target.ciscolive.0. 2015 CiscoLive! OpenStack Lab LABCLD2225 On the controller host 10.conf ‐‐ config‐file /etc/neutron/plugins/ml2/ml2_conf.service [Service] Type=notify User=neutron ExecStart=/usr/bin/neutron‐server ‐‐config‐file /usr/share/neutron/neutron‐dist.conf ‐‐config‐file /etc/neutron/plugin.log ‐‐config‐file /etc/neutron/plugins/ml2/ml2_conf.0.wants/neutron‐openvswitch‐ agent.php?pod=3 145/180 .target network.31 issue the command: [[IDSEQSTEP]] cat <<EOF > /etc/systemd/system/multi‐ user.conf ‐‐config‐ file /etc/neutron/neutron.target EOF Step 180 Configure Cisco ML2 INI for ACI integration http://openstack.com/printable.ini PrivateTmp=true NotifyAccess=all KillMode=process [Install] WantedBy=multi‐user.wants/neutron‐server.ini ‐‐config‐ file /etc/neutron/plugins/ml2/ml2_conf_cisco.target EOF Step 179 Create a service file for systemd for OpenVSwitch agent On the controller host 10. ini ml2_cisco_apic apic_name_mapping use_name openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf_cisco.0.31 issue the command: [[IDSEQSTEP]] openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf_cisco. Step 181 Configure Cisco ML2 INI Attached devices On the controller host 10.0.1.php?pod=3 146/180 .10.31 issue the command: http://openstack.61:80 openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf_cisco.31 issue the command: [[IDSEQSTEP]] openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf_cisco.ini DEFAULT apic_system_id POD3 Now you have to define the connectivity parameters for OpenStack to connect to the APIC Controller.ini ml2_cisco_apic root_helper 'sudo' The following command will add to the SUDOERS file the ability for neutron to be a sudoer. On the controller host 10.59:80. 2.ini ml2_cisco_apic apic_hosts 10.ini ml2_cisco_apic apic_password cisco. On the controller host 10.0.10.ini ml2_cisco_apic apic_use_ssl False Define the use of SUDO for neutron ML2 Cisco APIC driver.236.236.ini ml2_cisco_apic apic_username admin openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf_cisco.123 openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf_cisco.60:80.31 issue the command: [[IDSEQSTEP]] openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf_cisco.ciscolive.226.0. On the controller host 10.226.0.236.0.236.com/printable. 2015 CiscoLive! OpenStack Lab LABCLD2225 Configure the systemID that will be used to prefix all configuration towards the ACI fabric.0.226. \.236.31 issue the command: [[IDSEQSTEP]] openstack‐config ‐‐set /etc/neutron/neutron.\./comands\.236.31 openstack‐config ‐‐set /etc/neutron/neutron.236.3.ciscolive.0.ini apic_external_network:POD3‐ext switch 201 openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf_cisco.ini apic_external_network:POD3‐ext gateway_ip 10.31 issue the command: [[IDSEQSTEP]] openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf_cisco.90.236.conf keystone_authtoken auth_port 35357 Step 183 Change service plugin On the controller host 10.ini apic_external_network:POD3‐ext cidr_exposed 10.conf keystone_authtoken auth_host 10.90.0.31 issue the command: http://openstack.ini apic_external_network:POD3‐ext port 1/19 openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf_cisco.3. \n## Neutron sudoers as needed for APIC following installation instructions\nneutron ALL=(ALL) NOPASSWD: ALL/g' /etc/sudoers Finally define the APIC network definitions for this OpenStack POD towards APIC.com/printable.ini apic_switch:201 pod3‐controller.\.1.2/24 openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf_cisco.php?pod=3 147/180 .0.0. 2015 CiscoLive! OpenStack Lab LABCLD2225 [[IDSEQSTEP]] sed ‐i 's/commands\.conf keystone_authtoken auth_protocol http openstack‐config ‐‐set /etc/neutron/neutron. On the controller host 10.\.pod3‐compute2 1/5 Step 182 Configure Neutron keystone auth On the controller host 10.1 openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf_cisco. 2. l3_router.31 issue the command: [[IDSEQSTEP]] openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf.conf DEFAULT service_plugins neutron.31 issue the command: [[IDSEQSTEP]] openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf.l3_apic.ini ml2 tenant_network_types vlan http://openstack.ini agent arp_responder False Step 186 Configure the ML2 driver type and network type On the controller host 10.ApicL3ServicePlugin openstack‐config ‐‐set /etc/neutron/neutron.31 issue the command: [[IDSEQSTEP]] openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf.services.ciscolive.vlan.OVSHybridIptablesFirewallDriver Step 185 Configure the ML2 agent On the controller host 10.ini ml2 type_drivers local.vxlan openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf.com/printable.conf DEFAULT core_plugin ml2 Step 184 Configure the ML2 Security Groups On the controller host 10.ini securitygroup firewall_driver neutron.ini securitygroup enable_ipset True openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf. 2015 CiscoLive! OpenStack Lab LABCLD2225 [[IDSEQSTEP]] openstack‐config ‐‐set /etc/neutron/neutron.php?pod=3 148/180 .0.linux.ini securitygroup enable_security_group True openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf.236.0.ini agent polling_interval 2 openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf. 2.1.236.flat.gre.iptables_firewall.agent.ini agent l2_population False openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf.236.0. http://openstack.php?pod=3 149/180 .cisco_apic Step 188 Configure Cisco ML2 OVS Vlan Ranges aci 390 <> 395 On the controller host 10.ini ml2_type_vlan network_vlan_ranges aci:390:395 Step 189 Configure Cisco ML2 OVS Bridge Mapping The relationship will map as follows. 2015 CiscoLive! OpenStack Lab LABCLD2225 Step 187 Configure the Cisco APIC Mechanism driver On the controller host 10.236.31 issue the command: [[IDSEQSTEP]] openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf.0.236.0. While you haven't yet been to the OpenStack dashboard. 2.ciscolive.com/printable.ini ml2 mechanism_drivers openvswitch. this is a quick peek to understand the relationships.1.31 issue the command: [[IDSEQSTEP]] openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf. 2.ini ovs integration_bridge br‐int Step 190 Restart Neutron Services On the controller host 10. 2015 CiscoLive! OpenStack Lab LABCLD2225 On the controller host 10.236.service http://openstack.236.php?pod=3 150/180 .0.31 issue the command: [[IDSEQSTEP]] systemctl daemon‐reload systemctl restart neutron‐server.com/printable.31 issue the command: [[IDSEQSTEP]] openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf.ini ovs enable_tunneling False openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf.ini ovs bridge_mappings aci:br‐aci openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf.1.service systemctl status neutron‐server.ciscolive.0. 0.target network.wants/neutron‐cisco‐apic‐host‐ agent. 2.0.236.target.32 issue the command: [[IDSEQSTEP]] openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf.ini ‐‐log‐file=/var/log/neutron/cisco‐apic‐host‐ agent.236.php?pod=3 151/180 .32 issue the command: http://openstack.32 issue the command: [[IDSEQSTEP]] cat <<EOF > /etc/systemd/system/multi‐ user.target EOF Step 192 Configure Cisco ML2 OVS Vlan Ranges On the compute host 10. 2015 CiscoLive! OpenStack Lab LABCLD2225 ACI Integration Step 191 Create a service file for systemd Cisco APIC host agent On the compute host 10.236.target [Service] Type=simple User=neutron ExecStart=/usr/bin/neutron‐cisco‐apic‐host‐agent ‐‐config‐file=/etc/neutron/neutron.0.log PrivateTmp=false KillMode=process [Install] Wanted=multi‐user.conf ‐‐ config‐ file=/etc/neutron/plugins/ml2/ml2_conf_cisco.service [Unit] Description=OpenStack APIC Host Agent After=syslog.ini ml2_type_vlan network_vlan_ranges aci:390:395 Step 193 Configure Cisco ML2 OVS Bridge Mapping On the compute host 10.1.ciscolive.com/printable. service Validate that OpenVSwitch service is operational.ini ovs integration_bridge br‐int Step 194 Enable and start OpenVSwitch on compute node On the compute host 10. 2. 2015 CiscoLive! OpenStack Lab LABCLD2225 [[IDSEQSTEP]] openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf.1.32 issue the command: [[IDSEQSTEP]] systemctl enable neutron‐openvswitch‐ agent.ini ovs bridge_mappings aci:br‐aci openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf.32 issue the command: [[IDSEQSTEP]] systemctl status neutron‐openvswitch‐ agent.236. On the compute host 10.com/printable.0.service http://openstack.0.ciscolive.php?pod=3 152/180 .ini ovs enable_tunneling False openstack‐config ‐‐set /etc/neutron/plugins/ml2/ml2_conf.service systemctl start neutron‐openvswitch‐ agent.236. PWD=/ .ble=23 Jan 09 13:36:55 pod4‐compute2 sudo[23037]: neutron : TTY=unknown ..slice/neutron‐openvswitch‐agent. USER=r oot . ena bled) Active: active (running) since Fri 2015‐01‐09 13:32:36 EST.ofpor.php?pod=3 153/180 . ‚î‚îÄ22558 sudo neutron‐rootwrap /etc/neutron/rootwrap.ofport ‐‐format=j son Jan 09 13:36:39 pod4‐compute2 sudo[23013]: neutron : TTY=unknown .. USER=r oot .ble=23 Jan 09 13:36:47 pod4‐compute2 sudo[23025]: neutron : TTY=unknown .service. PWD=/ .ble=23 Jan 09 13:36:43 pod4‐compute2 sudo[23019]: neutron : TTY=unknown ..conf ovsdb‐client monitor Interface name. COMMAND=/bin/neutron‐rootwrap /etc/n.ofport ‐‐format=json ‚î‚îÄ22560 /usr/bin/python /usr/bin/neutron‐rootwrap /etc/neutron/root wrap.ble=23 Jan 09 13:36:51 pod4‐compute2 sudo[23031]: neutron : TTY=unknown .. USER=r oot . PWD=/ ......ble=23 Jan 09 13:36:41 pod4‐compute2 sudo[23016]: neutron : TTY=unknown . COMMAND=/bin/neutron‐rootwrap /etc/n..ble=23 Jan 09 13:36:45 pod4‐compute2 sudo[23022]: neutron : TTY=unknown . PWD=/ . USER=r oot .service ‐ OpenStack Neutron Open vSwitch Agent Loaded: loaded (/usr/lib/systemd/system/neutron‐openvswitch‐agent. PWD=/ . USER=r oot . 2.1.service neutron‐openvswitch‐agent.com/printable.ciscolive. PWD=/ . 2015 CiscoLive! OpenStack Lab LABCLD2225 # systemctl status neutron‐openvswitch‐agent... ‚îî‚îÄ22563 /bin/ovsdb‐client monitor Interface name.... COMMAND=/bin/neutron‐rootwrap /etc/n. COMMAND=/bin/neutron‐rootwrap /etc/n. COMMAND=/bin/neutron‐rootwrap /etc/n. COMMAND=/bin/neutron‐rootwrap /etc/n.ble=23 Jan 09 13:36:49 pod4‐compute2 sudo[23028]: neutron : TTY=unknown .conf ovsdb‐clie nt monitor Interface name. USER=r oot .. PWD=/ . USER=r oot .. PWD=/ .. COMMAND=/bin/neutron‐rootwrap /etc/n.. USER=r oot . PWD=/ .service ‚î‚îÄ22381 /usr/bin/python /usr/bin/neutron‐openvswitch‐agent ‐‐config ‐file /usr/share/neutron/neutron‐dist. 4min 21s ago Main PID: 22381 (neutron‐openvsw) CGroup: /system.conf ‐‐config. COMMAND=/bin/neutron‐rootwrap /etc/n.. PWD=/ .. USER=r oot .. COMMAND=/bin/neutron‐rootwrap /etc/n. use ‐l to show in full.. COMMAND=/bin/neutron‐rootwrap /etc/n.ble=23 Hint: Some lines were ellipsized. USER=r oot ..ble=23 Jan 09 13:36:57 pod4‐compute2 sudo[23040]: neutron : TTY=unknown . http://openstack.ble=23 Jan 09 13:36:53 pod4‐compute2 sudo[23034]: neutron : TTY=unknown . 0.com/printable.31: After you login into to the Horizon dashboard with the admin account. 2015 CiscoLive! OpenStack Lab LABCLD2225 OpenStack base network Step 195 Login into dashboard with admin account Under the administrator account you will goto On the horizon web interface on 10. you should see a screen similar to the following: Step 196 Create ACI Network POD3ext Locate the network tab under admin and click on +Create Network On the horizon web interface on 10.1.php?pod=3 154/180 .31: http://openstack.ciscolive. 2.236.236.0. 2. On this screen click on the +Create Subnet In this step you will be creating the subnet for the public admin network. When creating a subnet it involves two parts. and the following screen will appear.php?pod=3 155/180 .1. http://openstack. Now you need to click on the Network Name to add the subnet for this network.ciscolive.com/printable. Click on the Network Name. 2015 CiscoLive! OpenStack Lab LABCLD2225 When finished you should see a screen similar to the following. Step 197 Create ACI Network Vlan391 Locate the network tab under admin and click on +Create Network On the horizon web interface on 10.php?pod=3 156/180 .0.com/printable. 2.236.31: http://openstack. 2015 CiscoLive! OpenStack Lab LABCLD2225 ALERT! Make sure to disable DHCP for this subnet.ciscolive.1. On this screen click on the +Create Subnet Step 198 Create Subnet for ACI Network Vlan391 In this step you will be creating the subnet for the public admin network. http://openstack. 2015 CiscoLive! OpenStack Lab LABCLD2225 When finished you should see a screen similar to the following.ciscolive. Now you need to click on the Network Name to add the subnet for this network.php?pod=3 157/180 . and the following screen will appear. When creating a subnet it involves two parts. Click on the Network Name.com/printable. 2.1. com/printable. 2.php?pod=3 158/180 .ciscolive. http://openstack. 2015 CiscoLive! OpenStack Lab LABCLD2225 Step 199 Create Network for ACI network Vlan392 Click on the Network Tab to return to the network list and click on +Create Network button.1. http://openstack. 2. 2015 CiscoLive! OpenStack Lab LABCLD2225 When finished you should see a screen similar to the following.ciscolive. Now you need to click on the Network Name to add the subnet for this network. You should be back to the Network pane. On this screen click on the +Create Subnet You will now create the private network for the Nexus component.php?pod=3 159/180 .com/printable.1. com/printable.59) On the ACI web interface on 10. 2015 CiscoLive! OpenStack Lab LABCLD2225 Step 200 Login into ACI Open a new TAB in your browser and point your browser to: http://10. http://openstack.0.0.226.ciscolive.226.0. click on the Tenants TAB at the top of the page.php?pod=3 160/180 .59 (http://10.226. 2.59: Once you have logged into the ACI admin. Once in the Tenants TAB you need to click on All tenants.1. ciscolive. depends on the list of Tenants. If you expand on the Application Profile. 2.1.php?pod=3 161/180 . Depending on where other members of the lab are in completion. In the following screen you can observe that OpenStack has created for this Tenant the two Bridge Domains in ACI for both networks Vlan391 and Vlan392. you will see that OpenStack has also created two separate End Point Groups (EPGs) correlated to each of the networks that you built. The OpenStack ACI plugin will always create a Bridge Domain and an End Point Group for every Network that is built in OpenStack. You will need to locate and click on the tenant name _POD3_TenantPOD3 . 2015 CiscoLive! OpenStack Lab LABCLD2225 You will be presented with a list of Tenants that are part of the system. The following screen will be presented. Here you can click on the Networking PLUS sign on the left of the screen to expand Networking. http://openstack. At this point any instance that is built in these networks would exist inside these EPGs in ACI.com/printable. a named logical entity that contains a collection of end points. For a group of developers a Tenant might mean single developer. For example for a service provider. interEPG communication is disabled by default. End Point Group An EPG is a managed object. HTTPS messages (the what). the ports allowed. Subjects determine if filters are uni or bidirectional.1. A Tenant is a logical construct that isolates a series of networks from other tenants in the fabric.ciscolive.com/printable. Application Network Profiles Application network profiles provide a convenient way to model application requirements. If there is no contract. Each Tenant is compromised of different elements ( or objects ) that are part of the Managed Information Tree. Filters Filters are TCP/IP header fields such as L3 protocol type. For a single company a Tenant might mean different parts of the organization ( engineering. Subjects specify what information can be communicated and how; for example. etc. A Tenant can mean different things to different organizations. Subject Contracts contain one or more subjects. A unidirectional filter is used in one http://openstack. marketing ). 2. Each tenant is an overlay in the network. End points are devices connected to the network directly or indirectly. and the direction (the how). 2015 CiscoLive! OpenStack Lab LABCLD2225 Tenant is probably the most important construct of the ACI Fabric. a tenant might mean different customers. L4 ports. The application profile contains as many (or as few) EPGs as necessary that are logically related to providing the capabilities of an application.php?pod=3 162/180 . Contracts Contracts are the rules that specify what and how communication between EPGs takes place. It let's you organize the network in such a way that each Tenant perceives itself as part of a unique network. com/printable. Step 201 Signout and Signin as Tenant User Logout from the admin account as the next steps will be conducted as you assume the role of the Tenant of this OpenStack network. A tenant may contain multiple contexts. According to its related contract. Contracts contain all of the filters (and their directions) that will be applied between EPGs that produce and consume the contract.1.31: Step 203 Configure Tenant Router To configure the Router. a consumer EPG specifies the protocols and ports for use in the inbound direction (from the provider).php?pod=3 163/180 . Those subnets are defined in one or more bridge domains that reference the corresponding context.ciscolive. 2. an EPG provider dictates the protocols and ports in both the in and out directions. please proceed to the following screen and click on the +Create Router . Step 202 Login to dashboard with poduser account On the horizon web interface on 10. Unidirectional filters define in or out communications but not the same for both. for ACI the Router is going to establish a contract between the two EPGs that have been created. While traditionally a router would create a entity that does routing inbetween segments. It is equivalent to a VRF in the networking world. http://openstack. The next step will be to create a Router in OpenStack. Bridge Domain While a context defines a unique IP address space. All of the endpoints within the layer 3 domain must have unique IP addresses because it is possible to directly forward packets between these devices should the policy allow it. Contexts A context defines a layer 3 address domain. According to its related contract.0. 2015 CiscoLive! OpenStack Lab LABCLD2225 direction. Bidirectional filters are the same for both directions; they define both in and out. Each bridge domain must be linked to a context and have at least one subnet. that address space can consist of multiple subnets.236. 1.com/printable. Click on the Router Name ACIRouterPOD3. 2. Click on the Set Gateway as you would see below.ciscolive. 2015 CiscoLive! OpenStack Lab LABCLD2225 When the popup appears please enter the name ACIRouterPOD3 as the router name. http://openstack. The following screen should have popped up to you.php?pod=3 164/180 . 1 Router Name: ACIRouterPOD3 Once created you will select the gateway for this router. 1 External Network: POD3ext This will setup the external connectivity for the ACI network. 91.0/24 Now that you have completed this step.3.3. 2015 CiscoLive! OpenStack Lab LABCLD2225 Click on the + Add interface button.0/24 and click the + Add interface button.92. The following screen will be presented. Step 204 Login into ACI http://openstack.0/24 and click the + Add interface button.3. Select the option that says Vlan392:10.0/24 You will have to repeat these steps to create another interface on this router for the second network.com/printable. Click on the + Add interface button.ciscolive. 1 Subnet: Vlan391:10.3.1.php?pod=3 165/180 . 1 Subnet: Vlan392:10. you will go back to ACI to see that OpenStack has now created a contract between the two End Point Groups (EPGs). 2. Select the option that says Vlan391:10.91.92. The following screen will be presented. the EPGs are connected to each other via a Contract.php?pod=3 166/180 . The following image provides a visual representation of the completed Application Profile that OpenStack built in the fabric.59) On the ACI web interface on 10.226.226. 2.1.59: In ACI you have to look under the Application Profile.ciscolive.0. 2015 CiscoLive! OpenStack Lab LABCLD2225 Open the previous TAB in your browser to reach the ACI interface at: http://10. Expand the POD3_app that will list you the EPGs that we had seen before. http://openstack.226. Now though.0. You will now return to OpenStack and you will create some instances in OpenStack that will utilize the ACI fabric.59 (http://10.com/printable.0. You will start with creating the instance on compute1.0. Once there click on the Launch Instance button. 2015 CiscoLive! OpenStack Lab LABCLD2225 Step 205 Login to dashboard with poduser account On the horizon web interface on 10. 2.ciscolive.X MB) http://openstack.31: Step 206 Create Instance on compute1 You will be creating two separate instances and each instance will be created in a separate compute node of your cluster.php?pod=3 167/180 .com/printable.X x86_64 (XX.X.236.1. First make sure you are logged into the Horizon Dashboard as userpod3 and goto the following TAB. The following screen will popup and you will need to fill out as follows making sure not to click the submit button until after you have selected the network adapter: 1 Availability Zone: compute1 2 Instance Name: POD3ACI VM1 3 Instance Boot Source: Boot from image 4 Image Name: cirros0. X MB) When you click on the network tab the following will be presented. 1 Click on the + button for the option presented as Vlan391.com/printable. This selects the VLAN as the NIC interface for this instance. The following screen will popup and you will need to fill out as follows making sure not to click the submit button until after you have selected the network adapter: 1 Availability Zone: compute2 2 Instance Name: POD3ACI VM2 3 Instance Boot Source: Boot from image 4 Image Name: cirros0. 2015 CiscoLive! OpenStack Lab LABCLD2225 When you click on the network tab the following will be presented. http://openstack. Please click on Launch Instance Step 207 Create second Instance on compute2 You will now create the second instance (VM) on compute2. 2.php?pod=3 168/180 .X.1. Click on the Launch Instance button. 2 Click on the Launch button At this point OpenStack will start the process of creating your instance attached to the network Vlan391.ciscolive.X x86_64 (XX. 1.ciscolive.php?pod=3 169/180 . http://openstack. This selects the VLAN as the NIC interface for this instance. 2. 2015 CiscoLive! OpenStack Lab LABCLD2225 1 Click on the + button for the option presented as Vlan392.com/printable. Your network should now look like this: ALERT! This might be a good time to take a small break! The system is creating the instances and takes a couple of minutes until the instances are ready for use. 2 Click on the Launch button At this point you should have two instances running in OpenStack! Congrats!. The following screen you should be seeing at this point is as follows. If you hover over that computer icon you can then see the following: From there you can now click on Open Console to open the console of the specific instance.ciscolive. A popup window will appear similar to the following. 2015 CiscoLive! OpenStack Lab LABCLD2225 Step 208 Connect to instance consoles and validate network The best way to connect to the consoles of the instances is via the Network Topology TAB in the Horizon Dashboard.php?pod=3 170/180 . Select that option. This command will list the interface eth0 ip address. Once there you can see the topology you have created up to this point. Log into the two separate instances. http://openstack.com/printable. And from them issue the command ip a .1. Head over to your Tenant Network tab and an option is Network Topology. 2. 3.1: icmp_seq=1 ttl=255 time=0.92.1.3.1 (10.1: icmp_seq=1 ttl=255 time=0.91.1: icmp_seq=3 ttl=255 time=0.92.1: icmp_seq=4 ttl=255 time=0.91.3.207 ms You should also be capable of pinging the northbound ASR1K.257 ms 64 bytes from 10. On one of the instances issue the command: ping 10. On one of the instances issue the command: ALERT! You will not be able to copy into this VNC window.207 ms 64 bytes from 10.1 # ping 10. 2.com/printable.92.3.3.3.3.3.1: icmp_seq=4 ttl=255 time=0. http://openstack.3.XX/24 brd 10.290 ms 64 bytes from 10.3.1 (10.91.3.1) 56(84) bytes of data.91.92. 64 bytes from 10.1/8 scope host lo inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: eth0: mtu 1500 qdisc mq state UP qlen 1000 link/ether 00:25:b5:bc:00:14 brd ff:ff:ff:ff:ff:ff inet 10.1: icmp_seq=3 ttl=255 time=0.236.3.php?pod=3 171/180 .0.1 # ping 10.3.ciscolive.XX.207 ms You should also be capable of pinging the northbound external network.3.207 ms 64 bytes from 10.290 ms 64 bytes from 10.91.0.3.92.XX.257 ms 64 bytes from 10.92.92.1 PING 10.1) 56(84) bytes of data.3.1 PING 10.1: icmp_seq=2 ttl=255 time=0.91.10. ping 10.1: icmp_seq=2 ttl=255 time=0.91.92.0. 2015 CiscoLive! OpenStack Lab LABCLD2225 # ip a 1: lo: mtu 65536 qdisc noqueue state UNKNOWN link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.255 scope global eth0 inet6 fe80::225:b5ff:febc:14/64 scope link valid_lft forever preferred_lft forever You should be able to ping from instance to instance and also the default gateways. 64 bytes from 10. 1: icmp_seq=1 ttl=255 time=0.1: icmp_seq=4 ttl=255 time=0.90. 64 bytes from 10.1 (10. 2015 CiscoLive! OpenStack Lab LABCLD2225 On one of the instances issue the command: ping 10.90.3.90.3.90.3. 2.3.com/printable.90.ciscolive.1) 56(84) bytes of data.3.90.207 ms Congrats you Finished! http://openstack.1: icmp_seq=2 ttl=255 time=0.1 # ping 10.1.3.php?pod=3 172/180 .90.207 ms 64 bytes from 10.3.290 ms 64 bytes from 10.1 PING 10.1: icmp_seq=3 ttl=255 time=0.90.3.257 ms 64 bytes from 10. sh On the controller host 10.31 issue the command: http://openstack.123 CREATE DATABASE heat.31 issue the command: [[IDSEQSTEP]] mysql ‐‐user=root ‐‐password=cisco.236.* TO 'heat'@'%' IDENTIFIED BY 'cisco.com/printable.ciscolive.123'. 2.236.0.236.31 issue the command: [[IDSEQSTEP]] cd ~ source admin. exit Step 211 Add Heat users to keystone On the controller host 10.0.123'. Step 209 Open Firewall Holes On the controller host 10.0.236.1. GRANT ALL PRIVILEGES ON heat. 2015 CiscoLive! OpenStack Lab LABCLD2225 Configure Heat Controller Host NOTE: Remember to switch back to your Controller node in PuTTY for this section.php?pod=3 173/180 .* TO 'heat'@'localhost' IDENTIFIED BY 'cisco.31 issue the command: [[IDSEQSTEP]] firewall‐cmd ‐‐add‐port=8000/tcp ‐‐permanent firewall‐cmd ‐‐add‐port=8004/tcp ‐‐permanent firewall‐cmd ‐‐reload Step 210 Configure Heat database and access to database On the controller host 10.0. GRANT ALL PRIVILEGES ON heat.
[email protected]:8000/v1 \ ‐‐region regionOne Step 212 Install Heat On the controller host 10.0.31:8000/v1 \ ‐‐adminurl http://10.31/heat On the controller host 10.236.31 issue the command: http://openstack.0.236.0.0.31:8004/v1/%\ (tenant_id\)s \ ‐‐internalurl http://10.0.236.1.31 issue the command: [[IDSEQSTEP]] yum ‐y install openstack‐heat‐api openstack‐ heat‐api‐cfn openstack‐heat‐engine python‐ heatclient Step 213 Heat INI File On the controller host 10.31:8000/v1 \ ‐‐internalurl http://10.236.31:8004/v1/%\ (tenant_id\)s \ ‐‐adminurl http://10.236.236.236.0.0.php?pod=3 174/180 .31:8004/v1/%\ (tenant_id\)s \ ‐‐region regionOne keystone endpoint‐create \ ‐‐service‐id $(keystone service‐list | awk '/ cloudformation / {print $2}') \ ‐‐publicurl http://10.31 issue the command: [[IDSEQSTEP]] openstack‐config ‐‐set /etc/heat/heat.0.0.conf database connection mysql://heat:cisco.ciscolive. 2015 CiscoLive! OpenStack Lab LABCLD2225 [[IDSEQSTEP]] keystone user‐create ‐‐name heat ‐‐pass cisco.com/printable.236.123 keystone user‐role‐add ‐‐user heat ‐‐tenant service ‐‐role admin keystone role‐create ‐‐name heat_stack_owner keystone user‐role‐add ‐‐user demo ‐‐tenant demo ‐‐role heat_stack_owner keystone role‐create ‐‐name heat_stack_user keystone service‐create ‐‐name heat ‐‐type orchestration ‐‐description "Orchestration" keystone service‐create ‐‐name heat‐cfn ‐‐type cloudformation ‐‐description "Orchestration" keystone endpoint‐create \ ‐‐service‐id $(keystone service‐list | awk '/ orchestration / {print $2}') \ ‐‐publicurl http://10.0. 2.236. service systemctl start openstack‐heat‐api.conf keystone_authtoken auth_uri http://10.123 openstack‐config ‐‐set /etc/heat/heat.31 openstack‐config ‐‐set /etc/heat/heat.service openstack‐heat‐ engine.php?pod=3 175/180 .0.236.service openstack‐heat‐ engine.conf keystone_authtoken admin_password cisco.0.31:5000/v2.service systemctl status openstack‐heat‐api.0.0.236.ciscolive.31:8000/v1/waitcondition On the controller host 10.31 issue the command: [[IDSEQSTEP]] su ‐s /bin/sh ‐c "heat‐manage db_sync" heat On the controller host 10.236. 2.com/printable.31:35357 openstack‐config ‐‐set /etc/heat/heat.conf ec2authtoken auth_uri http://10.conf keystone_authtoken identity_uri http://10.236.31:5000/v2.236.conf DEFAULT heat_metadata_server_url http://10.31 issue the command: [[IDSEQSTEP]] systemctl enable openstack‐heat‐api.conf keystone_authtoken admin_user heat openstack‐config ‐‐set /etc/heat/heat.236.conf DEFAULT rabbit_password cisco.0 On the controller host 10.0.236.123 openstack‐config ‐‐set /etc/heat/heat.236.conf DEFAULT rpc_backend rabbit openstack‐config ‐‐set /etc/heat/heat.conf keystone_authtoken admin_tenant_name service openstack‐config ‐‐set /etc/heat/heat.conf DEFAULT rabbit_host 10. 2015 CiscoLive! OpenStack Lab LABCLD2225 [[IDSEQSTEP]] openstack‐config ‐‐set /etc/heat/heat.31 issue the command: [[IDSEQSTEP]] openstack‐config ‐‐set /etc/heat/heat.service openstack‐heat‐api‐cfn.31:8000 openstack‐config ‐‐set /etc/heat/heat.0.0.1.service openstack‐heat‐ engine.236.service openstack‐heat‐api‐cfn.service openstack‐heat‐api‐cfn.service http://openstack.0.conf DEFAULT heat_waitcondition_server_url http://10.0.0 openstack‐config ‐‐set /etc/heat/heat. NetID=$NET_ID" testStack heat stack‐list http://openstack.sh test‐stack.236. 2015 CiscoLive! OpenStack Lab LABCLD2225 Step 214 Add Heat Template On the controller host 10.0. first_address ] } EOF Step 215 Create Heat Stack On the controller host 10.31 issue the command: [[IDSEQSTEP]] cd ~ .tiny" networks: ‐ network: { get_param: NetID } outputs: server1_private_ip: description: IP address of the server in the private network value: { get_attr: [ server1.1.yml << EOF > description: Test Template parameters: ImageID: type: string description: Image use to boot a server NetID: type: string description: Network ID for the server resources: server1: type: OS::Nova::Server properties: name: "Test server" image: { get_param: ImageID } flavor: "m1.php?pod=3 176/180 .yml ‐P "ImageID=cirros‐0.ciscolive.3‐x86_64.31 issue the command: [[IDSEQSTEP]] NET_ID=$(nova net‐list | awk '/ demo‐net / { print $2 }') heat stack‐create ‐f test‐stack.com/printable. TenantPOD15.0.3.236. 2. com/printable.1. 2.ciscolive.php?pod=3 177/180 . 2015 CiscoLive! OpenStack Lab LABCLD2225 http://openstack. They are orginized in directories by component. When troubleshooting.rabbitmq}/*.123@controller/glance [keystone_authtoken] auth_uri = http://controller:5000/v2.conf | grep ‐v "^\s*$" [DEFAULT] [database] connection = mysql://glance:cisco.glance.openvswitch}/*.log /var/log/messages http://openstack.neutron.openvswitch. we need to look at differet logs file.neutron.cinder.123 [paste_deploy] flavor = keystone [store_type_location_strategy] [profiler] [task] [glance_store] default_store = file filesystem_store_datadir = /var/lib/glance/images/ Looking at log files All the logs that we are interested on are on /var/log.nova.conf> | grep ‐v "^\s*$" # grep ‐v "^#" /etc/glance/glance‐api. grep ‐v "^#" <filename. 2.0 identity_uri = http://controller:35357 admin_tenant_name = service admin_user = glance admin_password = cisco.log'. For example for neutron server the corresponding log file is '/var/log/neutorn/server.mysql. 2015 CiscoLive! OpenStack Lab LABCLD2225 Troubleshooting Commands Locating only changed variables in OpenStack configuration files One valuable command line grep to identify only the configuration lines in a OpenStack INI file that are not set ( meaning they don't start with a # or are a blank line ).log /var/log/messages Compute logs: tail ‐f /var/log/{ceilometer.ciscolive.php?pod=3 178/180 .1. Here is a way to do this: Controller logs: tail ‐f /var/log/{ceilometer. It is helpfull to look at them at the same time.nova.keystone.com/printable. org/developer/nova/devref/rpc.redhat. 2015 CiscoLive! OpenStack Lab LABCLD2225 Reference Material Important Web References Synopsis URL Detailed document on the https://openstack.openstack.1.org/juno/config and configuration reference/content/section_computescheduler.html (http://docs.com/Networking_in_too_much_detail) OpenStack from the RedHat team NOVA Scheduler options http://docs.html) RabbitMQ and Nova http://docs.openstack.html) Openstack TCP Ports Default ports that OpenStack components use OpenStack service Default ports Port type Block Storage ( cinder ) 8776 publicurl and adminurl Compute ( nova ) endpoints 8774 publicurl and adminurl Compute API ( nova‐api ) 8773.php?pod=3 179/180 .html (http://docs.com/printable.redhat.org/juno/config reference/content/section_computescheduler.org/developer/nova/devref/rpc.ciscolive.openstack.openstack. 2.com/Networking_in_too_much_detail networking components of (https://openstack. 8775 Compute ports for access to virtual machine 59005999 consoles Compute VNC proxy for browsers ( 6080 openstack‐nova‐novncproxy ) Compute VNC proxy for traditional VNC 6081 clients ( openstack‐nova‐xvpvncproxy ) Proxy port for HTML5 console used by 6082 Compute service Identity service ( keystone ) administrative 35357 adminurl endpoint Identity service public endpoint 5000 publicurl http://openstack. especially secureaccess dashboard. MySQL database 3306 Most OpenStack components.php?pod=3 180/180 . http://openstack. service Message Broker 5672 OpenStack Block Storage.ciscolive. HTTP alternate 8080 OpenStack Object Storage ( swift ) service. 2015 CiscoLive! OpenStack Lab LABCLD2225 Image Service ( glance ) API 9292 publicurl and adminurl Image Service registry 9191 Networking ( neutron ) 9696 publicurl and adminurl Object Storage ( swift ) 6000. 6002 Orchestration ( heat ) endpoint 8004 publicurl and adminurl Orchestration AWS CloudFormation 8000 compatible API ( openstack‐heat‐api‐cfn ) Orchestration AWS CloudWatchcompatible 8003 API ( openstack‐heat‐api‐cloudwatch ) Telemetry ( ceilometer ) 8777 publicurl and adminurl Default ports that secondary services related to OpenStack components use Service Default port Used by HTTP 80 OpenStack dashboard ( Horizon ) when it is not configured to use secure access. Required. 2. and Compute. rsync 873 OpenStack Object Storage. (AMQP traffic) Orchestration. HTTPS 443 Any OpenStack service that is enabled for SSL. Required. Networking. 6001.1. iSCSI target 3260 OpenStack Block Storage.com/printable. Documents Similar To CiscoLive! OpenStack Lab LABCLD-2225Skip carouselcarousel previouscarousel nextDistributed storage performance for OpenStack cloudsRed Hat Enterprise Linux 6 Security Guide en USImage Guide OpenstackIJSER paperOpen Stack Welcome GuideData Replication in Cost Optimized Geo-Distributed Clouds for OSNCisco Regional WAN SolutionUse of Cloud Computing in Educator SectorCloud Computing solaris-11Using Oracle Enterprise Manager Cloud Control 12c_D73244GC10_1080544_USSplunk 6.5.2 CapacityP4_Dell2014.pdfSoftwareDefinedNetwork_20131024_v04TeamF1 to Demonstrate Advanced Internet Gateway and Cloud Device Management Solutions at Computex 2013Final Year Project 2014-2015 e-Bliss BookletVMware Adeo serviceSecurity CloudWPC eBook - How to Get the Most Out of WPCEnglish LabBatch 7QuizCloud computingmAutomate– Cloud enabled Mobile Automation Testing Solution- Impetus White PaperNetwork as a Service White PaperSeminar Presentation 2Meraki Datasheet Cloud Controller EnterpriseThe Biggest Impediment to Cloud Adoption is Cultural_ CapioIT CEO _ Forbes IndiaPaulo Chainho Maxim is Ing CSPs Network With Cloud and SaaSAssignments& Lab PracticalsMore From jakub_zenSkip carouselcarousel previouscarousel nextData Center Overlay Technologies_white-paper-c11-730116 (1).pdfPlatform Guide 4000 Seriesvpc_best_practices_design_guide.pdfIPv6IPv6 EssentialsDCAC9K_2.0_Čekání na revoluciVaclav Belohradsky - Czech Soft PowerData Center Overlay TechnologiesAnatomy of Security DisasterMichal Pullmann - Bourání stereotypu bude boletFooter MenuBack To TopAboutAbout ScribdPressOur blogJoin our team!Contact UsJoin todayInvite FriendsGiftsLegalTermsPrivacyCopyrightSupportHelp / FAQAccessibilityPurchase helpAdChoicesPublishersSocial MediaCopyright © 2018 Scribd Inc. .Browse Books.Site Directory.Site Language: English中文EspañolالعربيةPortuguês日本語DeutschFrançaisTurkceРусский языкTiếng việtJęzyk polskiBahasa indonesiaMaster your semester with Scribd & The New York TimesSpecial offer for students: Only $4.99/month.Master your semester with Scribd & The New York TimesRead Free for 30 DaysCancel anytime.Read Free for 30 DaysYou're Reading a Free PreviewDownloadClose DialogAre you sure?This action might not be possible to undo. Are you sure you want to continue?CANCELOK