OpenStack的网络

网络类型有local,flat,vlan,vxlan。这些不同网络类型的实现借助于network driver,比如Linux Bridge和Open vSwitch。环境搭建需要多个网卡,控制节点或网络节点需要一个打通外网(集群外)的网卡。

local

local网络不支持跨节点,所有网络内的虚拟机通过bridge联通。bridge不会通过网卡对外通讯。

Linux Bridge – local

flat

flat网络和物理网卡一对一绑定。不存在一个物理网卡能支持多个flat网络的情况。flat可以跨节点。

每一个flat 网络都有一个dhcp服务,实际上是在网络控制节点上的一个独有的dnsmasq进程,每个进程独占一个网络namespace, 以便为某个flat网络单独服务。通过veth pair和flat bridge相连,打通两个namespace。

创建flat网络实例,openstack会根据该flat网络的设置分配一个port 包括ip和mac,并被dhcp获取,nova会给vm VIF虚拟网卡分配这个mac。获取ip的过程是这样的,dhcp进程通过虚拟网卡对监听到实例启动,vm会发广播到整个flat网络,dhcp的虚拟网卡会监听到,dhcp根据自己的host文件和mac查询到对应信息,然后分配ip子网掩码和地址租用期限。不同计算节点上的实例可以互相通信,每个节点上的bridge名称是一样的,每个flat网络绑定独占一个网卡。

Linux Bridge – flat

vlan

一个物理网卡可以支持多个vlan。vlan可以是夸节点的,每个节点的bridge名字相同。bridge通过vlan网口eth1.100与物理网卡联通。不同vlan可以通过路由router互通,可以是物理路由器,接到交换机之外,上面配置需要打通的所有vlan的网关。也可以是虚拟路由,首先建立一个虚拟网络,可以是flat类型的,通过物理网卡联通外网,存在于单独的network namespace,由veth pair打通和vlan bridge的通信。网关配置在路由到bridge的tap上。

和路由相连的所谓的外部网络,绑定一个控制节点的网卡,以后所有对外通信都通过这个网络,网络和网络之间用veth pair打通。

Linux Bridge – vlan

通过路由和相连接的外网可以设置某个vm的floating ip,floating IP 是配置在 router 提供网关的外网 interface 上的,而非 instance 中。所以路由保存有floating ip和网内ip的映射,是一种静态NAT。floating ip方便外网直接访问内网vm。

如果没有floating ip,向外的流量,路由会把内网ip转为自己的外网ip,当流量返回时,路由会找到相应的内网ip,这就是所谓的source NAT。

路由默认网关是外网网关,所有内网虚拟机访问除了内网的流量都会走向这个默认的网关。floating IP 配置到 router 的外网 interface qg-b8b32a88-03 上。

其他的比如dhcp和flat网络差不多。

Linux Bridge – vlan 路由 外网 两个内网的逻辑关系图

vxlan

由通道技术实现的虚拟网络。是基于三层网络协议实现的的二层协议。核心是vtep,一种虚拟网卡。基本思路,由vtep封装二层协议包打上vxlan标签,并用ip+udp封装,通过原始ip和终点ip打通通信。所以是一种基于网络之上的虚拟网络。

vxlan是一种虚拟二层网络,支持arp,不过在openstack中不需要广播,因为有代理会直接把ip mac的信息分享给虚拟机。

借助linux bridge 或 open vswitch可以实现vxlan。和vlan相比,vxlan适合更大规模的集群。其他的比如dhcp和router基本和vlan一样。

Linux Bridge vxlan

Security Group和FWaaS

这两种都是OpenStack的安全策略,都是通过iptables来实现的,前者是对特定虚拟机来设置的,后者是对整个定制网络的subnet指定的安全策略。可结合使用。

OpenStack LBaaS

OpenStack Loadbalance as a Service。方便搭建lb集群,默认HAProxy,可以选择其他。

需要一个lb server的虚拟机,这个lb server有一个VIP,是属于和集群(web server)相同网段的IP,在外围路由配置floating ip,这样集群外可通过floating ip访问lb。OpenStack界面支持lb的各种策略,第一次访问的策略,比如round robin,least connection,source ip。之后的session persistence策略比如source ip,http cookie,app cookie等。后两者是发送给客户端特定的cookie,比如srv,记录上次连接的server信息。

Open vSwitch

和Linux Bridge一样,Open vSwitch也可用来实现不同网络类型。不同的是,OVS有自己专有的网桥以及利用flow rule来隔离vlan,而不是Linux Bridge的veth1.100, eth1.101等vlan interface。
– br-int(integration),打通instance和其他虚拟网络设备
– br-ex(external),和网卡直连,打通和外网的通道
– br-tun(tunnel),只适用于基于tunnel技术的vxlan和GRE网络

OVS vlan


OVS vxlan

注:原创。图表来源于CloudMan

《OpenStack的网络》有389个想法

  1. Pingback: sommarbutik

  2. Pingback: jimhfl

  3. Pingback: salluzfoods

  4. Pingback: bionutronics

  5. Pingback: raspberrypihacks

  6. Pingback: lvalverde

  7. Pingback: buckleyk

  8. Pingback: theicecreambucket

  9. Pingback: mathewslodge

  10. Pingback: reneecascarina

  11. Pingback: peruconelmundo

  12. Pingback: thephelpsgroup

  13. Pingback: atmosphile

  14. Pingback: ceosoul

  15. Pingback: communityzap

  16. Pingback: highgearelectric

  17. Pingback: resiliens

  18. Pingback: gmchevydealer

  19. Pingback: dudukner

  20. Pingback: housebaba

  21. Pingback: vicksfabs

  22. Pingback: agapcanada

  23. Pingback: infoadicciones

  24. Pingback: ilovejay

  25. Pingback: philippeelkaim

  26. Pingback: cairnsparency

  27. Pingback: postaim

  28. Pingback: biskstudio

  29. Pingback: cefashion

  30. Pingback: latestime

  31. Pingback: ebaumsnation

  32. Pingback: sbtribalfarms

  33. Pingback: cedizmir

  34. Pingback: lucomania

  35. Pingback: sinkaltim

  36. Pingback: serioussam

  37. Pingback: mamnbeb

  38. Pingback: adlimeira

  39. Pingback: ilovemage

  40. Pingback: ecovinowines

  41. Pingback: nuttours

  42. Pingback: aselresorthotel

  43. Pingback: maidsquadtx

  44. Pingback: canseidesercool

  45. Pingback: lwthai

  46. Pingback: boominets

  47. Pingback: jinteex

  48. Pingback: saglikara

  49. Pingback: sodmgmodels

  50. Pingback: haydayhacktoolz

  51. Pingback: cialisonlinegp

  52. Pingback: giftbowtique

  53. Pingback: chzsun

  54. Pingback: coffeecertified

  55. Pingback: desnichons

  56. Pingback: seasonalshoptips

  57. Pingback: virukshamtrust

  58. Pingback: calimercado

  59. Pingback: kuwaitwebinfo

  60. Pingback: ntrfanz

  61. Pingback: mumofthreeboys

  62. Pingback: caltav

  63. Pingback: valtercasini

  64. Pingback: hetkookboek

  65. Pingback: keralatourslane

  66. Pingback: merrakech

  67. Pingback: ninjapopgrip

  68. Pingback: vanelus

  69. Pingback: genericcialisfe

  70. Pingback: andthegiraffe

  71. Pingback: cranfordhairco

  72. Pingback: imwrks

  73. Pingback: aldarakuae

  74. Pingback: zeneventsja

  75. Pingback: homembt

  76. Pingback: tidyweekender

  77. Pingback: rightcoastranch

  78. Pingback: classfaqs

  79. Pingback: sikaikhabar

  80. Pingback: portalsituspoker

  81. Pingback: hyperkast

  82. Pingback: greaterkakinada

  83. Pingback: pdftoget

  84. Pingback: lahoreview

  85. Pingback: aragonya

  86. Pingback: snywlt

  87. Pingback: carasello

  88. Pingback: lapioo

  89. Pingback: lsdmuzic

  90. Pingback: jiaqi100

  91. Pingback: stephensng

  92. Pingback: theallegromovement

  93. Pingback: hyo-kin

  94. Pingback: jhrollover

  95. Pingback: frderoubaix

  96. Pingback: eastendprints

  97. Pingback: netformation

  98. Pingback: gbsmelaka

  99. Pingback: autumnimports

  100. Pingback: vedspace

  101. Pingback: lespitchousvoyagent

  102. Pingback: dramaindoxxi

  103. Pingback: viagzaibis

  104. Pingback: spartzmedia

  105. Pingback: fifa55hot

  106. Pingback: myprimevideotv

  107. Pingback: africannuaire

  108. Pingback: proevalua

  109. Pingback: sinjambi

  110. Pingback: oleotek

  111. Pingback: toptenofworld

  112. Pingback: emiratesphonenumber

  113. Pingback: synchroltd

  114. Pingback: profmaison

  115. Pingback: victorytelemedicine

  116. Pingback: edcialistop

  117. Pingback: luxpetco

  118. Pingback: celestebarcelona

  119. Pingback: dcrespond

  120. Pingback: anniebowco

  121. Pingback: surveier

  122. Pingback: tucamiseta

  123. Pingback: protozoaweb

  124. Pingback: novaapk

  125. Pingback: katalog-nasa

  126. Pingback: surfray

  127. Pingback: tvamazontv

  128. Pingback: rechanma

  129. Pingback: bitencore

  130. Pingback: brownfont

  131. Pingback: aegismultimedia

  132. Pingback: mt-amazon

  133. Pingback: dorichon

  134. Pingback: fildupuis

  135. Pingback: manbirsandhu

  136. Pingback: patelshopping

  137. Pingback: silifkeli

  138. Pingback: pagiaphat

  139. Pingback: holdingsahara

  140. Pingback: raulpastor

  141. Pingback: lakshmiprecastinn

  142. Pingback: vndsnkr

  143. Pingback: neilizur

  144. Pingback: mafhum-tech

  145. Pingback: dewapokerplay

  146. Pingback: stargiochi

  147. Pingback: srsearthing

  148. Pingback: chicagonano

  149. Pingback: chloroquinepack

  150. Pingback: dubai-developer

  151. Pingback: kucing-kelabu

  152. Pingback: photonaix

  153. Pingback: nosuvia

  154. Pingback: intellectivetech

  155. Pingback: celebritysweatnelly

  156. Pingback: lysj8

  157. Pingback: smefaculty

  158. Pingback: ainhoaart

  159. Pingback: tvmyprime

  160. Pingback: ahuela

  161. Pingback: agencemdc

  162. Pingback: obxpubcrawl

  163. Pingback: jetskilakehavasu

  164. Pingback: nguyenthinhaudio

  165. Pingback: homestorymarket

  166. Pingback: m-nortoncomsetup

  167. Pingback: paoaowjaisai

  168. Pingback: uppicfree

  169. Pingback: cassademaria

  170. Pingback: khangsneakers

  171. Pingback: kit963

  172. Pingback: sockeye-camp

  173. Pingback: viagrapoi

  174. Pingback: capilarspain

  175. Pingback: legitkushsuppliers

  176. Pingback: mobilestatstracker

  177. Pingback: fieldenergyllc

  178. Pingback: newcarlights

  179. Pingback: cialischeaponlinegt

  180. Pingback: ouchaz

  181. Pingback: redbasement

  182. Pingback: srankhala

  183. Pingback: asoonkhoon

  184. Pingback: pubspaces

  185. Pingback: ugibilisim

  186. Pingback: antsevak

  187. Pingback: lczbic

  188. Pingback: jacobperlowhospice

  189. Pingback: stanthonyshyd

  190. Pingback: otohortumdunyasi

  191. Pingback: mnfvtc

  192. Pingback: smithlevi

  193. Pingback: kit963

  194. Pingback: odt-pbj

  195. Pingback: sadlifebox

  196. Pingback: federalspare

  197. Pingback: malatyaneykursu

  198. Pingback: vfokus

  199. Pingback: theallegromovement

  200. Pingback: vgrspain

  201. Pingback: livechatklub4d

  202. Pingback: rcnutricion

  203. Pingback: arananeu

  204. Pingback: blincville

  205. Pingback: lipitormed

  206. Pingback: cagdasck

  207. Pingback: coprintpromo

  208. Pingback: viagrahuupup

  209. Pingback: cialisgrn

  210. Pingback: purplesagedesigns

  211. Pingback: villahomeinteriors

  212. Pingback: sockeye-camp

  213. Pingback: thedreamboxshop

  214. Pingback: lindblomgd

  215. Pingback: owendemocrats

  216. Pingback: expologtech

  217. Pingback: indian-superstar

  218. Pingback: cineseriestv

  219. Pingback: stkhaberleri

  220. Pingback: tadalafilalt

  221. Pingback: konanatural

  222. Pingback: njbulk

  223. Pingback: thecreagent

  224. Pingback: getesionow

  225. Pingback: nevaktar

  226. Pingback: basignon

  227. Pingback: doctordomson

  228. Pingback: getvviagragets

  229. Pingback: roundclip

  230. Pingback: soccerprorc

  231. Pingback: columbiagorgebnb

  232. Pingback: lutaniccreations

  233. Pingback: belgiansaison

  234. Pingback: tomcatmining

  235. Pingback: grieftheunspoken

  236. Pingback: ticklast

  237. Pingback: mytableq

  238. Pingback: sfmlondon

  239. Pingback: mysummervilleford

  240. Pingback: blueskydigi

  241. Pingback: mercedescsi

  242. Pingback: greenglobestaffing

  243. Pingback: gcclcareers

  244. Pingback: harbenpumps

  245. Pingback: tosseldorf

  246. Pingback: lamaisondemma

  247. Pingback: udecoder

  248. Pingback: tenzingnorgaymtb

  249. Pingback: ecrgrup

  250. Pingback: siefertmurphy

  251. Pingback: winstonmalta

  252. Pingback: fargovn

  253. Pingback: bcapalt

  254. Pingback: talcottcenter

  255. Pingback: jmlcomputers

  256. Pingback: sardstudios

  257. Pingback: sedfab

  258. Pingback: freedomqdro

  259. Pingback: guiacinefila

  260. Pingback: hiteauto

  261. Pingback: fermomia

  262. Pingback: fredmarvin

  263. Pingback: triplenickles

  264. Pingback: tildesheim

  265. Pingback: ctfohempcbd

  266. Pingback: sinspi

  267. Pingback: motobc

  268. Pingback: estatesdelray

  269. Pingback: bucumarket

  270. Pingback: cambridgeauto

  271. Pingback: fibuilders

  272. Pingback: visionitgroup

  273. Pingback: drivingmama

  274. Pingback: transcapins

  275. Pingback: caldreamapp

  276. Pingback: calmission

  277. Pingback: tuinvlangdh

  278. Pingback: debagliano

  279. Pingback: designinator

  280. Pingback: comunidadmh

  281. Pingback: leblogfm

  282. Pingback: aptarismrm

  283. Pingback: dmealliance

  284. Pingback: eurorumo

  285. Pingback: danbloom

  286. Pingback: requeil

  287. Pingback: einspurauto

  288. Pingback: acukinetics

  289. Pingback: doodadsinc

  290. Pingback: ascarov

  291. Pingback: vetteleader

  292. Pingback: dapasten

  293. Pingback: autodealsva

  294. Pingback: hpalmyros

  295. Pingback: alicecassidy

  296. Pingback: thocbdc

  297. Pingback: gestdom

  298. Pingback: bibleclues

  299. Pingback: hapustahl

  300. Pingback: corkcityyoga

  301. Pingback: techieva

  302. Pingback: pedsbif

  303. Pingback: postrom

  304. Pingback: eccucourse

  305. Pingback: laeamerica

  306. Pingback: boekstuk

  307. Pingback: mehrhost

  308. Pingback: juragon

  309. Pingback: tsilifeline

  310. Pingback: sagerllp

  311. Pingback: wewebla

  312. Pingback: aviurban

  313. Pingback: eklandia

  314. Pingback: sisdrog

  315. Pingback: encweddings

  316. Pingback: motorloaf

  317. Pingback: selectakaza

  318. Pingback: toruseurope

  319. Pingback: ncgrassfed

  320. Pingback: surfmorocco

  321. Pingback: jasonlinphoto

  322. Pingback: aiawyoming

  323. Pingback: segurosblog

  324. Pingback: saunasmith

  325. Pingback: baugeraete

  326. Pingback: brassmedia

  327. Pingback: actiocloud

  328. Pingback: supracables

  329. Pingback: simairway

  330. Pingback: reinery

  331. Pingback: ibmwsc

  332. Pingback: osbornenash

  333. Pingback: weareguthrie

  334. Pingback: notairegranby

  335. Pingback: blusealdoors

  336. Pingback: granne

  337. Pingback: qubacafe

  338. Pingback: stephenemay

  339. Pingback: berkleypak

  340. Pingback: fethiyemap

  341. Pingback: nanopose

  342. Pingback: delmarballet

  343. Pingback: erisfilms

  344. Pingback: flirtwithmen

  345. Pingback: sensepeanut

  346. Pingback: frankboddy

  347. Pingback: saveorpave

  348. Pingback: peggymyer

  349. Pingback: pariswin

  350. Pingback: feastdesign

  351. Pingback: onedayonefilm

  352. Pingback: bifudo

  353. Pingback: midtnbiz

  354. Pingback: hollymackler

  355. Pingback: destinydeal

  356. Pingback: montananest

  357. Pingback: polargy

  358. Pingback: hostelprague

  359. Pingback: carloscurbelo

  360. Pingback: niubvnp

  361. Pingback: blitzbarpdx

  362. Pingback: radassure

  363. Pingback: peggymayer

  364. Pingback: joshwoodward

  365. Pingback: sugiftofhope

  366. Pingback: sarksofrasi

  367. Pingback: swissneth

  368. Pingback: chscbd

  369. Pingback: cedartownchat

  370. Pingback: zoppecircus

  371. Pingback: oetopia

  372. Pingback: toisondeoro

  373. Pingback: palcapital

  374. Pingback: uticajobs

  375. Pingback: adecorar

  376. Pingback: wilfredagroup

  377. Pingback: painmm

  378. Pingback: usephoenix

  379. Pingback: oasouth

  380. Pingback: cschneebeck

  381. Pingback: amettis

  382. Pingback: lumistor

  383. Pingback: samangus

  384. Pingback: dieselusa

  385. Pingback: raphaelcruz

  386. Pingback: loadiq

  387. Pingback: hydrometry

  388. Pingback: predaktor

  389. Pingback: houseoftablas

发表评论