<html> <head> <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body bgcolor="#FFFFFF" text="#000000"> On 05/13/2013 05:19 PM, Minton, Rich wrote: <blockquote cite="mid:BCD47F9ED3ABA442A8713ECE06CB94682198903D@HVXDSP43.us.lmco.com" type="cite"> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> <meta name="Generator" content="Microsoft Word 14 (filtered medium)"> <style></style> <div class="WordSection1"> Gary,<o:p></o:p> <o:p> </o:p> Right now, I have my VMs on a flat network (10.0.56.0/21). Our external physical router acts as the gateway (10.0.56.1) for VMs to get to the external network. If I create an L3 router with the 10.0.56.1 IP as the gateway I get conflicts on my physical router. Is using the L3 agent and an L3 router the only way to access the metadata service on my external network? </div> </blockquote> In RHOS 2.0 this is the only way. In RHOS 3.0 you will be able to do this via the DHCP agent. <blockquote cite="mid:BCD47F9ED3ABA442A8713ECE06CB94682198903D@HVXDSP43.us.lmco.com" type="cite"> <div class="WordSection1"> Is it possible to put a NAT on my physical router to accomplish the same thing or is it absolutely necessary to route through the L3 router? </div> </blockquote> Yes, that is certainly possible. I am actually happy that you mentioned this as it is something that I would have done. I think that you can do this pretty easily: 1. If your router will be the default gateway for the VMs (this can be ensured when you create your subnet) 2. If you create a NAT rule on the router - all traffic that is destined to the metadata service should be re routed to the the meta data service My understanding is that some hardware vendors are implementing l3 functionality in their routers (well it is something that they have had for decades and do it a lot better and more efficiently that the l3 agent - with the added bonus of HA) The problem with the above is that it is something that is done manually and is not automated via quantum at the moment. Thanks Gary <blockquote cite="mid:BCD47F9ED3ABA442A8713ECE06CB94682198903D@HVXDSP43.us.lmco.com" type="cite"> <div class="WordSection1"> <o:p></o:p> <o:p> </o:p> Thanks,<o:p></o:p> Rick<o:p></o:p> <o:p> </o:p> <div> <div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in"> From: <a class="moz-txt-link-abbreviated" href="mailto:rhos-list-bounces@redhat.com">rhos-list-bounces@redhat.com</a> [<a class="moz-txt-link-freetext" href="mailto:rhos-list-bounces@redhat.com">mailto:rhos-list-bounces@redhat.com</a>] On Behalf Of Gary Kotton Sent: Friday, May 10, 2013 9:45 AM To: <a class="moz-txt-link-abbreviated" href="mailto:rhos-list@redhat.com">rhos-list@redhat.com</a> Subject: EXTERNAL: Re: [rhos-list] Metadata with Quantum.<o:p></o:p> </div> </div> <o:p> </o:p> On 05/10/2013 04:18 PM, Minton, Rich wrote: <o:p></o:p> Guys and Gals,<o:p></o:p> <o:p></o:p> I’m looking for some direction with regards to implementing Metadata with Quantum. <o:p></o:p> <o:p></o:p> I’m using Openstack Networking with a Flat provider network, which is working great at the moment. I have a Controller/compute node running the quantum server, a Network node running openvswitch and dhcp agents, and three compute nodes running the openvswitch agent. I was going to install the L3 agent on the controller node since I read somewhere that for this implementation the L3 agent should not be run with the DHCP agent on the same host. From there I need some help with the configuration.<o:p></o:p> Yes, this is correct. At the moment RHEL does not support namespaces so in order to have network isolation is is recommended that the l3 agent and the dhcp agent do not run on the same host. If this is for a POC then you can certainly do this as there is no risk of a security hole. Hopefully in the coming versions we will have a better solution for this. Please note that in the RHOS 3 version will will be able to invoke the metadata service form the DHCP agent if you choose. <o:p></o:p> <o:p></o:p> I have these entries in my nova.conf file on the Controller host (L3 agent host)<o:p></o:p> enabled_apis=ec2,osapi_compute,metadata<o:p></o:p> metadata_host=172.17.0.68 # This is the external IP of my Controller host<o:p></o:p> metadata_port=8775<o:p></o:p> metadata_listen=172.17.0.68<o:p></o:p> service_quantum_metadata_proxy = true<o:p></o:p> Is this all I need in nova?<o:p></o:p> I think so. <o:p></o:p> <o:p></o:p> Do I need a port on br-ex that routes to my external network?<o:p></o:p> You only need the br-ex on the host that is running the l3-agent. <o:p></o:p> Do I need to create a router in quantum?<o:p></o:p> Yes, you need to do this and you need to assign the router to the subnet with the private ip. This will ensure that the traffic is sent to the l3 -agent which in turn will redirect it to the metadata service. <o:p></o:p> My External network is 172.17.0.0/24<o:p></o:p> My management network is 10.255.254.0/24 (this is used for the hosts to talk to each other, i.e., qpid and mysql)<o:p></o:p> My guest network is 10.0.56.0/21<o:p></o:p> <o:p></o:p> My l3-agent.conf file:<o:p></o:p> [DEFAULT]<o:p></o:p> #sql_connection = <a moz-do-not-send="true" href="mailto:mysql://quantum:XXXXXXXX@10.255.254.38/ovs_quantum"> mysql://quantum:XXXXXXXX@10.255.254.38/ovs_quantum</a><o:p></o:p> # Show more verbose log output (sets INFO log level output).<o:p></o:p> verbose = True<o:p></o:p> <o:p></o:p> # Show debugging output in log (sets DEBUG log level output).<o:p></o:p> debug = True<o:p></o:p> <o:p></o:p> # L3 agent requires that an interface driver be set. Choose the one<o:p></o:p> # that best matches your plugin. There is no default.<o:p></o:p> # interface_driver =<o:p></o:p> #<o:p></o:p> # OVS<o:p></o:p> interface_driver = quantum.agent.linux.interface.OVSInterfaceDriver<o:p></o:p> # LinuxBridge<o:p></o:p> # interface_driver = quantum.agent.linux.interface.BridgeInterfaceDriver<o:p></o:p> <o:p></o:p> # The Quantum user information for accessing the Quantum API.<o:p></o:p> auth_strategy = keystone<o:p></o:p> auth_url = <a moz-do-not-send="true" href="http://10.255.254.38:35357/v2.0/"> http://10.255.254.38:35357/v2.0/</a><o:p></o:p> auth_region = lmicc<o:p></o:p> admin_tenant_name = services<o:p></o:p> admin_user = quantum<o:p></o:p> admin_password = XXXXXXXXXX<o:p></o:p> <o:p></o:p> # Use "sudo quantum-rootwrap /etc/quantum/rootwrap.conf" to use the real<o:p></o:p> # root filter facility.<o:p></o:p> # Change to "sudo" to skip the filtering and just run the comand directly<o:p></o:p> # root_helper = sudo quantum-rootwrap /etc/quantum/rootwrap.conf<o:p></o:p> <o:p></o:p> # Without network namespaces, each L3 agent can only configure one<o:p></o:p> # router. This is done by setting the specific router_id.<o:p></o:p> # router_id = <o:p></o:p> Due to the fact that namespaces is not supported you need to create a router and then update this with the router id and restart the service (sorry it is a real pain). Hopefully in the near future we will have packstack support for Quantum that will do all of the above automatically. <o:p></o:p> <o:p></o:p> # Each L3 agent can be associated with at most one external network. This<o:p></o:p> # value should be set to the UUID of that external network. If empty,<o:p></o:p> # the agent will enforce that only a single external networks exists and<o:p></o:p> # use that external network id.<o:p></o:p> # gateway_external_network_id =<o:p></o:p> <o:p></o:p> # Indicates that this L3 agent should also handle routers that do not have<o:p></o:p> # an external network gateway configured. This option should be True only<o:p></o:p> # for a single agent in a Quantum deployment, and may be False for all agents<o:p></o:p> # if all routers must have an external network gateway.<o:p></o:p> # handle_internal_only_routers = True<o:p></o:p> <o:p></o:p> # Name of bridge used for external network traffic. This should be set to<o:p></o:p> # empty value for the linuxbridge plugin.<o:p></o:p> # external_network_bridge = br-ex<o:p></o:p> <o:p></o:p> # IP address used by Nova metadata server.<o:p></o:p> metadata_ip = 172.17.0.68<o:p></o:p> <o:p></o:p> # TCP Port used by Nova metadata server.<o:p></o:p> metadata_port = 8775<o:p></o:p> <o:p></o:p> use_namespaces = False<o:p></o:p> <o:p></o:p> # The time in seconds between state poll requests.<o:p></o:p> # polling_interval = 3<o:p></o:p> <o:p></o:p> Thank you for your help and patience.<o:p></o:p> Rick<o:p></o:p> <o:p></o:p> Richard Minton<o:p></o:p> LMICC Systems Administrator<o:p></o:p> 4000 Geerdes Blvd, 13D31<o:p></o:p> King of Prussia, PA 19406<o:p></o:p> Phone: 610-354-5482<o:p></o:p> <o:p></o:p> <o:p></o:p> <pre>_______________________________________________<o:p></o:p></pre> <pre>rhos-list mailing list<o:p></o:p></pre> <pre><a moz-do-not-send="true" href="mailto:rhos-list@redhat.com">rhos-list@redhat.com</a><o:p></o:p></pre> <pre><a moz-do-not-send="true" href="https://www.redhat.com/mailman/listinfo/rhos-list">https://www.redhat.com/mailman/listinfo/rhos-list</a><o:p></o:p></pre> <o:p> </o:p> </div> </blockquote> </body> </html>