OpenStack的网络

网络类型有local,flat,vlan,vxlan。这些不同网络类型的实现借助于network driver,比如Linux Bridge和Open vSwitch。环境搭建需要多个网卡,控制节点或网络节点需要一个打通外网(集群外)的网卡。

local

local网络不支持跨节点,所有网络内的虚拟机通过bridge联通。bridge不会通过网卡对外通讯。

Linux Bridge – local

flat

flat网络和物理网卡一对一绑定。不存在一个物理网卡能支持多个flat网络的情况。flat可以跨节点。

每一个flat 网络都有一个dhcp服务,实际上是在网络控制节点上的一个独有的dnsmasq进程,每个进程独占一个网络namespace, 以便为某个flat网络单独服务。通过veth pair和flat bridge相连,打通两个namespace。

创建flat网络实例,openstack会根据该flat网络的设置分配一个port 包括ip和mac,并被dhcp获取,nova会给vm VIF虚拟网卡分配这个mac。获取ip的过程是这样的,dhcp进程通过虚拟网卡对监听到实例启动,vm会发广播到整个flat网络,dhcp的虚拟网卡会监听到,dhcp根据自己的host文件和mac查询到对应信息,然后分配ip子网掩码和地址租用期限。不同计算节点上的实例可以互相通信,每个节点上的bridge名称是一样的,每个flat网络绑定独占一个网卡。

Linux Bridge – flat

vlan

一个物理网卡可以支持多个vlan。vlan可以是夸节点的,每个节点的bridge名字相同。bridge通过vlan网口eth1.100与物理网卡联通。不同vlan可以通过路由router互通,可以是物理路由器,接到交换机之外,上面配置需要打通的所有vlan的网关。也可以是虚拟路由,首先建立一个虚拟网络,可以是flat类型的,通过物理网卡联通外网,存在于单独的network namespace,由veth pair打通和vlan bridge的通信。网关配置在路由到bridge的tap上。

和路由相连的所谓的外部网络,绑定一个控制节点的网卡,以后所有对外通信都通过这个网络,网络和网络之间用veth pair打通。

Linux Bridge – vlan

通过路由和相连接的外网可以设置某个vm的floating ip,floating IP 是配置在 router 提供网关的外网 interface 上的,而非 instance 中。所以路由保存有floating ip和网内ip的映射,是一种静态NAT。floating ip方便外网直接访问内网vm。

如果没有floating ip,向外的流量,路由会把内网ip转为自己的外网ip,当流量返回时,路由会找到相应的内网ip,这就是所谓的source NAT。

路由默认网关是外网网关,所有内网虚拟机访问除了内网的流量都会走向这个默认的网关。floating IP 配置到 router 的外网 interface qg-b8b32a88-03 上。

其他的比如dhcp和flat网络差不多。

Linux Bridge – vlan 路由 外网 两个内网的逻辑关系图

vxlan

由通道技术实现的虚拟网络。是基于三层网络协议实现的的二层协议。核心是vtep,一种虚拟网卡。基本思路,由vtep封装二层协议包打上vxlan标签,并用ip+udp封装,通过原始ip和终点ip打通通信。所以是一种基于网络之上的虚拟网络。

vxlan是一种虚拟二层网络,支持arp,不过在openstack中不需要广播,因为有代理会直接把ip mac的信息分享给虚拟机。

借助linux bridge 或 open vswitch可以实现vxlan。和vlan相比,vxlan适合更大规模的集群。其他的比如dhcp和router基本和vlan一样。

Linux Bridge vxlan

Security Group和FWaaS

这两种都是OpenStack的安全策略,都是通过iptables来实现的,前者是对特定虚拟机来设置的,后者是对整个定制网络的subnet指定的安全策略。可结合使用。

OpenStack LBaaS

OpenStack Loadbalance as a Service。方便搭建lb集群,默认HAProxy,可以选择其他。

需要一个lb server的虚拟机,这个lb server有一个VIP,是属于和集群(web server)相同网段的IP,在外围路由配置floating ip,这样集群外可通过floating ip访问lb。OpenStack界面支持lb的各种策略,第一次访问的策略,比如round robin,least connection,source ip。之后的session persistence策略比如source ip,http cookie,app cookie等。后两者是发送给客户端特定的cookie,比如srv,记录上次连接的server信息。

Open vSwitch

和Linux Bridge一样,Open vSwitch也可用来实现不同网络类型。不同的是,OVS有自己专有的网桥以及利用flow rule来隔离vlan,而不是Linux Bridge的veth1.100, eth1.101等vlan interface。
– br-int(integration),打通instance和其他虚拟网络设备
– br-ex(external),和网卡直连,打通和外网的通道
– br-tun(tunnel),只适用于基于tunnel技术的vxlan和GRE网络

OVS vlan


OVS vxlan

注:原创。图表来源于CloudMan

《OpenStack的网络》有300个想法

  1. Pingback: jiaqi100

  2. Pingback: stephensng

  3. Pingback: theallegromovement

  4. Pingback: hyo-kin

  5. Pingback: jhrollover

  6. Pingback: frderoubaix

  7. Pingback: eastendprints

  8. Pingback: netformation

  9. Pingback: gbsmelaka

  10. Pingback: autumnimports

  11. Pingback: vedspace

  12. Pingback: lespitchousvoyagent

  13. Pingback: dramaindoxxi

  14. Pingback: viagzaibis

  15. Pingback: spartzmedia

  16. Pingback: fifa55hot

  17. Pingback: myprimevideotv

  18. Pingback: africannuaire

  19. Pingback: proevalua

  20. Pingback: sinjambi

  21. Pingback: oleotek

  22. Pingback: toptenofworld

  23. Pingback: emiratesphonenumber

  24. Pingback: synchroltd

  25. Pingback: profmaison

  26. Pingback: victorytelemedicine

  27. Pingback: edcialistop

  28. Pingback: luxpetco

  29. Pingback: celestebarcelona

  30. Pingback: dcrespond

  31. Pingback: anniebowco

  32. Pingback: surveier

  33. Pingback: tucamiseta

  34. Pingback: protozoaweb

  35. Pingback: novaapk

  36. Pingback: katalog-nasa

  37. Pingback: surfray

  38. Pingback: tvamazontv

  39. Pingback: rechanma

  40. Pingback: bitencore

  41. Pingback: brownfont

  42. Pingback: aegismultimedia

  43. Pingback: mt-amazon

  44. Pingback: dorichon

  45. Pingback: fildupuis

  46. Pingback: manbirsandhu

  47. Pingback: patelshopping

  48. Pingback: silifkeli

  49. Pingback: pagiaphat

  50. Pingback: holdingsahara

  51. Pingback: raulpastor

  52. Pingback: lakshmiprecastinn

  53. Pingback: vndsnkr

  54. Pingback: neilizur

  55. Pingback: mafhum-tech

  56. Pingback: dewapokerplay

  57. Pingback: stargiochi

  58. Pingback: srsearthing

  59. Pingback: chicagonano

  60. Pingback: chloroquinepack

  61. Pingback: dubai-developer

  62. Pingback: kucing-kelabu

  63. Pingback: photonaix

  64. Pingback: nosuvia

  65. Pingback: intellectivetech

  66. Pingback: celebritysweatnelly

  67. Pingback: lysj8

  68. Pingback: smefaculty

  69. Pingback: ainhoaart

  70. Pingback: tvmyprime

  71. Pingback: ahuela

  72. Pingback: agencemdc

  73. Pingback: obxpubcrawl

  74. Pingback: jetskilakehavasu

  75. Pingback: nguyenthinhaudio

  76. Pingback: homestorymarket

  77. Pingback: m-nortoncomsetup

  78. Pingback: paoaowjaisai

  79. Pingback: uppicfree

  80. Pingback: cassademaria

  81. Pingback: khangsneakers

  82. Pingback: kit963

  83. Pingback: sockeye-camp

  84. Pingback: viagrapoi

  85. Pingback: capilarspain

  86. Pingback: legitkushsuppliers

  87. Pingback: mobilestatstracker

  88. Pingback: fieldenergyllc

  89. Pingback: newcarlights

  90. Pingback: cialischeaponlinegt

  91. Pingback: ouchaz

  92. Pingback: redbasement

  93. Pingback: srankhala

  94. Pingback: asoonkhoon

  95. Pingback: pubspaces

  96. Pingback: ugibilisim

  97. Pingback: antsevak

  98. Pingback: lczbic

  99. Pingback: jacobperlowhospice

  100. Pingback: stanthonyshyd

  101. Pingback: otohortumdunyasi

  102. Pingback: mnfvtc

  103. Pingback: smithlevi

  104. Pingback: kit963

  105. Pingback: odt-pbj

  106. Pingback: sadlifebox

  107. Pingback: federalspare

  108. Pingback: malatyaneykursu

  109. Pingback: vfokus

  110. Pingback: theallegromovement

  111. Pingback: vgrspain

  112. Pingback: livechatklub4d

  113. Pingback: rcnutricion

  114. Pingback: arananeu

  115. Pingback: blincville

  116. Pingback: lipitormed

  117. Pingback: cagdasck

  118. Pingback: coprintpromo

  119. Pingback: viagrahuupup

  120. Pingback: cialisgrn

  121. Pingback: purplesagedesigns

  122. Pingback: villahomeinteriors

  123. Pingback: sockeye-camp

  124. Pingback: thedreamboxshop

  125. Pingback: lindblomgd

  126. Pingback: owendemocrats

  127. Pingback: expologtech

  128. Pingback: indian-superstar

  129. Pingback: cineseriestv

  130. Pingback: stkhaberleri

  131. Pingback: tadalafilalt

  132. Pingback: konanatural

  133. Pingback: njbulk

  134. Pingback: thecreagent

  135. Pingback: getesionow

  136. Pingback: nevaktar

  137. Pingback: basignon

  138. Pingback: doctordomson

  139. Pingback: getvviagragets

  140. Pingback: roundclip

  141. Pingback: soccerprorc

  142. Pingback: columbiagorgebnb

  143. Pingback: lutaniccreations

  144. Pingback: belgiansaison

  145. Pingback: tomcatmining

  146. Pingback: grieftheunspoken

  147. Pingback: ticklast

  148. Pingback: mytableq

  149. Pingback: sfmlondon

  150. Pingback: mysummervilleford

  151. Pingback: blueskydigi

  152. Pingback: mercedescsi

  153. Pingback: greenglobestaffing

  154. Pingback: gcclcareers

  155. Pingback: harbenpumps

  156. Pingback: tosseldorf

  157. Pingback: lamaisondemma

  158. Pingback: udecoder

  159. Pingback: tenzingnorgaymtb

  160. Pingback: ecrgrup

  161. Pingback: siefertmurphy

  162. Pingback: winstonmalta

  163. Pingback: fargovn

  164. Pingback: bcapalt

  165. Pingback: talcottcenter

  166. Pingback: jmlcomputers

  167. Pingback: sardstudios

  168. Pingback: sedfab

  169. Pingback: freedomqdro

  170. Pingback: guiacinefila

  171. Pingback: hiteauto

  172. Pingback: fermomia

  173. Pingback: fredmarvin

  174. Pingback: triplenickles

  175. Pingback: tildesheim

  176. Pingback: ctfohempcbd

  177. Pingback: sinspi

  178. Pingback: motobc

  179. Pingback: estatesdelray

  180. Pingback: bucumarket

  181. Pingback: cambridgeauto

  182. Pingback: fibuilders

  183. Pingback: visionitgroup

  184. Pingback: drivingmama

  185. Pingback: transcapins

  186. Pingback: caldreamapp

  187. Pingback: calmission

  188. Pingback: tuinvlangdh

  189. Pingback: debagliano

  190. Pingback: designinator

  191. Pingback: comunidadmh

  192. Pingback: leblogfm

  193. Pingback: aptarismrm

  194. Pingback: dmealliance

  195. Pingback: eurorumo

  196. Pingback: danbloom

  197. Pingback: requeil

  198. Pingback: einspurauto

  199. Pingback: acukinetics

  200. Pingback: doodadsinc

  201. Pingback: ascarov

  202. Pingback: vetteleader

  203. Pingback: dapasten

  204. Pingback: autodealsva

  205. Pingback: hpalmyros

  206. Pingback: alicecassidy

  207. Pingback: thocbdc

  208. Pingback: gestdom

  209. Pingback: bibleclues

  210. Pingback: hapustahl

  211. Pingback: corkcityyoga

  212. Pingback: techieva

  213. Pingback: pedsbif

  214. Pingback: postrom

  215. Pingback: eccucourse

  216. Pingback: laeamerica

  217. Pingback: boekstuk

  218. Pingback: mehrhost

  219. Pingback: juragon

  220. Pingback: tsilifeline

  221. Pingback: sagerllp

  222. Pingback: wewebla

  223. Pingback: aviurban

  224. Pingback: eklandia

  225. Pingback: sisdrog

  226. Pingback: encweddings

  227. Pingback: motorloaf

  228. Pingback: selectakaza

  229. Pingback: toruseurope

  230. Pingback: ncgrassfed

  231. Pingback: surfmorocco

  232. Pingback: jasonlinphoto

  233. Pingback: aiawyoming

  234. Pingback: segurosblog

  235. Pingback: saunasmith

  236. Pingback: baugeraete

  237. Pingback: brassmedia

  238. Pingback: actiocloud

  239. Pingback: supracables

  240. Pingback: simairway

  241. Pingback: reinery

  242. Pingback: ibmwsc

  243. Pingback: osbornenash

  244. Pingback: weareguthrie

  245. Pingback: notairegranby

  246. Pingback: blusealdoors

  247. Pingback: granne

  248. Pingback: qubacafe

  249. Pingback: stephenemay

  250. Pingback: berkleypak

  251. Pingback: fethiyemap

  252. Pingback: nanopose

  253. Pingback: delmarballet

  254. Pingback: erisfilms

  255. Pingback: flirtwithmen

  256. Pingback: sensepeanut

  257. Pingback: frankboddy

  258. Pingback: saveorpave

  259. Pingback: peggymyer

  260. Pingback: pariswin

  261. Pingback: feastdesign

  262. Pingback: onedayonefilm

  263. Pingback: bifudo

  264. Pingback: midtnbiz

  265. Pingback: hollymackler

  266. Pingback: destinydeal

  267. Pingback: montananest

  268. Pingback: polargy

  269. Pingback: hostelprague

  270. Pingback: carloscurbelo

  271. Pingback: niubvnp

  272. Pingback: blitzbarpdx

  273. Pingback: radassure

  274. Pingback: peggymayer

  275. Pingback: joshwoodward

  276. Pingback: sugiftofhope

  277. Pingback: sarksofrasi

  278. Pingback: swissneth

  279. Pingback: chscbd

  280. Pingback: cedartownchat

  281. Pingback: zoppecircus

  282. Pingback: oetopia

  283. Pingback: toisondeoro

  284. Pingback: palcapital

  285. Pingback: uticajobs

  286. Pingback: adecorar

  287. Pingback: wilfredagroup

  288. Pingback: painmm

  289. Pingback: usephoenix

  290. Pingback: oasouth

  291. Pingback: cschneebeck

  292. Pingback: amettis

  293. Pingback: lumistor

  294. Pingback: samangus

  295. Pingback: dieselusa

  296. Pingback: raphaelcruz

  297. Pingback: loadiq

  298. Pingback: hydrometry

  299. Pingback: predaktor

  300. Pingback: houseoftablas

发表评论