<html> <head> <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body bgcolor="#FFFFFF" text="#000000"> Hi, Thanks for the inputs, please see below. I think that we are in two different time zones (we also have a holiday here this afternoon and tomorrow). Thanks Gary On 05/13/2013 11:08 PM, Minton, Rich wrote: <blockquote cite="mid:BCD47F9ED3ABA442A8713ECE06CB946821989149@HVXDSP43.us.lmco.com" type="cite"> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> <meta name="Generator" content="Microsoft Word 14 (filtered medium)"> <style></style> <div class="WordSection1"> Ok, success. </div> </blockquote> Cool <blockquote cite="mid:BCD47F9ED3ABA442A8713ECE06CB946821989149@HVXDSP43.us.lmco.com" type="cite"> <div class="WordSection1"> I was able to get the metadata service up and running. I’m using a Flat network, no GRE tunnels or VLANs, except for my host external interfaces.<o:p></o:p> <o:p> </o:p> 1. Installed L3-agent on my controller/compute node<o:p></o:p> 2. Nova-api is running on controller/compute node<o:p></o:p> 3. “quantum router-create router1”<o:p></o:p> 4. “quantum router-interface-add router1 <subnet-id>”<o:p></o:p> 5. Ensure port eth1 is attached to br-eth1 using “ovs-vsctl add-port br-eth1 eth1” (only if eth1 is your VM NIC). I loose eth1 off of br-eth1 after a service network restart or a host reboot. Any ideas on this one?<o:p></o:p> </div> </blockquote> I have a number of questions and comments regarding this one. i. If you have an interface /etc/sysconfig/network-scripts/ifcfg-br-int configured then each time that you run the network restart then the ovs bridges will be purged of all of their tap devices. ii. When the quantum agent restarts the interface is added to the bridge. It is not really clear why this is happening at reboot. I'll try and reproduce on my side. <blockquote cite="mid:BCD47F9ED3ABA442A8713ECE06CB946821989149@HVXDSP43.us.lmco.com" type="cite"> <div class="WordSection1"> 6. We also ran “ip addr add 169.254.169.254/32 dev eth0.500” to make route all requests to 169… to my external interface. I think this was the ticket for us.<o:p></o:p> <o:p> </o:p> Hope this helps somebody. </div> </blockquote> Yes, it sure does. Thank you Gary <blockquote cite="mid:BCD47F9ED3ABA442A8713ECE06CB946821989149@HVXDSP43.us.lmco.com" type="cite"> <div class="WordSection1"> <o:p></o:p> <o:p> </o:p> Rick<o:p></o:p> <o:p> </o:p> <div> <div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in"> From: Gary Kotton [<a class="moz-txt-link-freetext" href="mailto:gkotton@redhat.com">mailto:gkotton@redhat.com</a>] Sent: Monday, May 13, 2013 10:26 AM To: Minton, Rich Cc: <a class="moz-txt-link-abbreviated" href="mailto:rhos-list@redhat.com">rhos-list@redhat.com</a> Subject: Re: EXTERNAL: Re: [rhos-list] Metadata with Quantum.<o:p></o:p> </div> </div> <o:p> </o:p> On 05/13/2013 05:19 PM, Minton, Rich wrote: <o:p></o:p> Gary,<o:p></o:p> <o:p></o:p> Right now, I have my VMs on a flat network (10.0.56.0/21). Our external physical router acts as the gateway (10.0.56.1) for VMs to get to the external network. If I create an L3 router with the 10.0.56.1 IP as the gateway I get conflicts on my physical router. Is using the L3 agent and an L3 router the only way to access the metadata service on my external network?<o:p></o:p> In RHOS 2.0 this is the only way. In RHOS 3.0 you will be able to do this via the DHCP agent. <o:p></o:p> Is it possible to put a NAT on my physical router to accomplish the same thing or is it absolutely necessary to route through the L3 router?<o:p></o:p> Yes, that is certainly possible. I am actually happy that you mentioned this as it is something that I would have done. I think that you can do this pretty easily: 1. If your router will be the default gateway for the VMs (this can be ensured when you create your subnet) 2. If you create a NAT rule on the router - all traffic that is destined to the metadata service should be re routed to the the meta data service My understanding is that some hardware vendors are implementing l3 functionality in their routers (well it is something that they have had for decades and do it a lot better and more efficiently that the l3 agent - with the added bonus of HA) The problem with the above is that it is something that is done manually and is not automated via quantum at the moment. Thanks Gary <o:p></o:p> <o:p></o:p> Thanks,<o:p></o:p> Rick<o:p></o:p> <o:p></o:p> <div> <div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in"> From: <a moz-do-not-send="true" href="mailto:rhos-list-bounces@redhat.com">rhos-list-bounces@redhat.com</a> [<a moz-do-not-send="true" href="mailto:rhos-list-bounces@redhat.com">mailto:rhos-list-bounces@redhat.com</a>] On Behalf Of Gary Kotton Sent: Friday, May 10, 2013 9:45 AM To: <a moz-do-not-send="true" href="mailto:rhos-list@redhat.com">rhos-list@redhat.com</a> Subject: EXTERNAL: Re: [rhos-list] Metadata with Quantum.<o:p></o:p> </div> </div> <o:p></o:p> On 05/10/2013 04:18 PM, Minton, Rich wrote: <o:p></o:p> Guys and Gals,<o:p></o:p> <o:p></o:p> I’m looking for some direction with regards to implementing Metadata with Quantum. <o:p></o:p> <o:p></o:p> I’m using Openstack Networking with a Flat provider network, which is working great at the moment. I have a Controller/compute node running the quantum server, a Network node running openvswitch and dhcp agents, and three compute nodes running the openvswitch agent. I was going to install the L3 agent on the controller node since I read somewhere that for this implementation the L3 agent should not be run with the DHCP agent on the same host. From there I need some help with the configuration.<o:p></o:p> Yes, this is correct. At the moment RHEL does not support namespaces so in order to have network isolation is is recommended that the l3 agent and the dhcp agent do not run on the same host. If this is for a POC then you can certainly do this as there is no risk of a security hole. Hopefully in the coming versions we will have a better solution for this. Please note that in the RHOS 3 version will will be able to invoke the metadata service form the DHCP agent if you choose. <o:p></o:p> <o:p></o:p> I have these entries in my nova.conf file on the Controller host (L3 agent host)<o:p></o:p> enabled_apis=ec2,osapi_compute,metadata<o:p></o:p> metadata_host=172.17.0.68 # This is the external IP of my Controller host<o:p></o:p> metadata_port=8775<o:p></o:p> metadata_listen=172.17.0.68<o:p></o:p> service_quantum_metadata_proxy = true<o:p></o:p> Is this all I need in nova?<o:p></o:p> I think so. <o:p></o:p> <o:p></o:p> Do I need a port on br-ex that routes to my external network?<o:p></o:p> You only need the br-ex on the host that is running the l3-agent. <o:p></o:p> Do I need to create a router in quantum?<o:p></o:p> Yes, you need to do this and you need to assign the router to the subnet with the private ip. This will ensure that the traffic is sent to the l3 -agent which in turn will redirect it to the metadata service. <o:p></o:p> My External network is 172.17.0.0/24<o:p></o:p> My management network is 10.255.254.0/24 (this is used for the hosts to talk to each other, i.e., qpid and mysql)<o:p></o:p> My guest network is 10.0.56.0/21<o:p></o:p> <o:p></o:p> My l3-agent.conf file:<o:p></o:p> [DEFAULT]<o:p></o:p> #sql_connection = <a moz-do-not-send="true" href="mailto:mysql://quantum:XXXXXXXX@10.255.254.38/ovs_quantum">mysql://quantum:XXXXXXXX@10.255.254.38/ovs_quantum</a><o:p></o:p> # Show more verbose log output (sets INFO log level output).<o:p></o:p> verbose = True<o:p></o:p> <o:p></o:p> # Show debugging output in log (sets DEBUG log level output).<o:p></o:p> debug = True<o:p></o:p> <o:p></o:p> # L3 agent requires that an interface driver be set. Choose the one<o:p></o:p> # that best matches your plugin. There is no default.<o:p></o:p> # interface_driver =<o:p></o:p> #<o:p></o:p> # OVS<o:p></o:p> interface_driver = quantum.agent.linux.interface.OVSInterfaceDriver<o:p></o:p> # LinuxBridge<o:p></o:p> # interface_driver = quantum.agent.linux.interface.BridgeInterfaceDriver<o:p></o:p> <o:p></o:p> # The Quantum user information for accessing the Quantum API.<o:p></o:p> auth_strategy = keystone<o:p></o:p> auth_url = <a moz-do-not-send="true" href="http://10.255.254.38:35357/v2.0/"> http://10.255.254.38:35357/v2.0/</a><o:p></o:p> auth_region = lmicc<o:p></o:p> admin_tenant_name = services<o:p></o:p> admin_user = quantum<o:p></o:p> admin_password = XXXXXXXXXX<o:p></o:p> <o:p></o:p> # Use "sudo quantum-rootwrap /etc/quantum/rootwrap.conf" to use the real<o:p></o:p> # root filter facility.<o:p></o:p> # Change to "sudo" to skip the filtering and just run the comand directly<o:p></o:p> # root_helper = sudo quantum-rootwrap /etc/quantum/rootwrap.conf<o:p></o:p> <o:p></o:p> # Without network namespaces, each L3 agent can only configure one<o:p></o:p> # router. This is done by setting the specific router_id.<o:p></o:p> # router_id = <o:p></o:p> Due to the fact that namespaces is not supported you need to create a router and then update this with the router id and restart the service (sorry it is a real pain). Hopefully in the near future we will have packstack support for Quantum that will do all of the above automatically. <o:p></o:p> <o:p></o:p> # Each L3 agent can be associated with at most one external network. This<o:p></o:p> # value should be set to the UUID of that external network. If empty,<o:p></o:p> # the agent will enforce that only a single external networks exists and<o:p></o:p> # use that external network id.<o:p></o:p> # gateway_external_network_id =<o:p></o:p> <o:p></o:p> # Indicates that this L3 agent should also handle routers that do not have<o:p></o:p> # an external network gateway configured. This option should be True only<o:p></o:p> # for a single agent in a Quantum deployment, and may be False for all agents<o:p></o:p> # if all routers must have an external network gateway.<o:p></o:p> # handle_internal_only_routers = True<o:p></o:p> <o:p></o:p> # Name of bridge used for external network traffic. This should be set to<o:p></o:p> # empty value for the linuxbridge plugin.<o:p></o:p> # external_network_bridge = br-ex<o:p></o:p> <o:p></o:p> # IP address used by Nova metadata server.<o:p></o:p> metadata_ip = 172.17.0.68<o:p></o:p> <o:p></o:p> # TCP Port used by Nova metadata server.<o:p></o:p> metadata_port = 8775<o:p></o:p> <o:p></o:p> use_namespaces = False<o:p></o:p> <o:p></o:p> # The time in seconds between state poll requests.<o:p></o:p> # polling_interval = 3<o:p></o:p> <o:p></o:p> Thank you for your help and patience.<o:p></o:p> Rick<o:p></o:p> <o:p></o:p> Richard Minton<o:p></o:p> LMICC Systems Administrator<o:p></o:p> 4000 Geerdes Blvd, 13D31<o:p></o:p> King of Prussia, PA 19406<o:p></o:p> Phone: 610-354-5482<o:p></o:p> <o:p></o:p> <o:p></o:p> <pre>_______________________________________________<o:p></o:p></pre> <pre>rhos-list mailing list<o:p></o:p></pre> <pre><a moz-do-not-send="true" href="mailto:rhos-list@redhat.com">rhos-list@redhat.com</a><o:p></o:p></pre> <pre><a moz-do-not-send="true" href="https://www.redhat.com/mailman/listinfo/rhos-list">https://www.redhat.com/mailman/listinfo/rhos-list</a><o:p></o:p></pre> <o:p></o:p> <o:p> </o:p> </div> </blockquote> </body> </html>