[rdo-list] Adding a vlan to the external network in tripleo
Boris Derzhavets
bderzhavets at hotmail.com
Tue Oct 18 19:59:59 UTC 2016
________________________________
From: John Marks <jdmarks75080 at gmail.com>
Sent: Tuesday, October 18, 2016 7:57 PM
To: Brandon James
Cc: Boris Derzhavets; rdo-list at redhat.com
Subject: Re: [rdo-list] Adding a vlan to the external network in tripleo
There are some good docs on RH. The docs for RDHOSP 9 there is a networking guide with a lot of detail. However, the heat templates for tripleo are confusing. The thing is that with RHOSP, there is no "packstack" install so if your hope is to move from RDO to RHOSP, then tripleo is the way to go. But, as I said earlier, the north/south networking in Openstack remains a pain
Do you have in overcloud ( RHOSP 9 ) at least one external network ( for cloud VMs ) rout-able in both
ingress/egress directions to the Internet .
Thank you.
Boris
and the RedHat networking docs are very brief. If I knew that I could add north/south as easily as I can east west, I would be done.
On Tue, Oct 18, 2016 at 10:08 AM, Brandon James <brandon.james at sunayu.com<mailto:brandon.james at sunayu.com>> wrote:
All,
I truly feel that we should somehow improve the documentation to explain how to do this in detail(Vlans and external networks). I suspect that many people who want to tryout Tripleo/RDO Packstack are really struggling with the networking. I know for myself this alone is the main reason I have not deployed this into production because our external network is very complex and I need to be certain I can integrate this without serious pain. It would be great if users could easily change these settings on the fly because for most admins, networking is never static. Just my 2 cents.
Brandon
On Tue, Oct 18, 2016 at 10:59 AM, Boris Derzhavets <bderzhavets at hotmail.com<mailto:bderzhavets at hotmail.com>> wrote:
> It would seem that all I need to do is create a vlan27 port as shown below. The below was generated by the heat OOO heat templates.
Doesn't it mean one of original templates ( which were invoked by `openstack overcloud deploy .... ` )
should be updated to create vlan27 as separate network or you have some other way to add vlan27 ?
________________________________
From: John Marks <jdmarks75080 at gmail.com<mailto:jdmarks75080 at gmail.com>>
Sent: Tuesday, October 18, 2016 5:21 PM
To: Boris Derzhavets; rdo-list at redhat.com<mailto:rdo-list at redhat.com>
Subject: Re: [rdo-list] Adding a vlan to the external network in tripleo
I looked over you scenario in your blog and it is close. I have a single external port that shares the native VLAN and VLAN27. In my case, I configrued the external bridge (br-ex) with the native vlan and am now faced with adding vlan27 to the bridge. RHOSP has a vlan scenario which I used in creating the bridge and vlans under it that carry the storage, etc. It would seem that all I need to do is create a vlan27 port as shown below. The below was generated by the heat OOO heat templates.
stack: ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8<http://127.0.0.1/8> scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eno1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
link/ether 14:58:d0:4c:2e:98 brd ff:ff:ff:ff:ff:ff
inet 192.0.2.17/24<http://192.0.2.17/24> brd 192.0.2.255 scope global eno1
valid_lft forever preferred_lft forever
inet 192.0.2.15/32<http://192.0.2.15/32> brd 192.0.2.255 scope global eno1
valid_lft forever preferred_lft forever
inet6 fe80::1658:d0ff:fe4c:2e98/64 scope link
valid_lft forever preferred_lft forever
3: ens1f0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN qlen 1000
link/ether 8c:dc:d4:b1:8e:b8 brd ff:ff:ff:ff:ff:ff
4: eno2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq master ovs-system state UP qlen 1000
link/ether 14:58:d0:4c:2e:9c brd ff:ff:ff:ff:ff:ff
inet6 fe80::1658:d0ff:fe4c:2e9c/64 scope link
valid_lft forever preferred_lft forever
5: ens1f1: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN qlen 1000
link/ether 8c:dc:d4:b1:8e:b9 brd ff:ff:ff:ff:ff:ff
6: eno3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq master ovs-system state UP qlen 1000
link/ether 14:58:d0:4c:2e:99 brd ff:ff:ff:ff:ff:ff
inet6 fe80::1658:d0ff:fe4c:2e99/64 scope link
valid_lft forever preferred_lft forever
7: eno4: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN qlen 1000
link/ether 14:58:d0:4c:2e:9d brd ff:ff:ff:ff:ff:ff
8: eno5: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN qlen 1000
link/ether 14:58:d0:4c:2e:9a brd ff:ff:ff:ff:ff:ff
9: eno6: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN qlen 1000
link/ether 14:58:d0:4c:2e:9e brd ff:ff:ff:ff:ff:ff
10: eno7: <BROADCAST,MULTICAST> mtu 1500 qdisc noop master ovs-system state DOWN qlen 1000
link/ether 14:58:d0:4c:2e:9b brd ff:ff:ff:ff:ff:ff
11: eno8: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN qlen 1000
link/ether 14:58:d0:4c:2e:9f brd ff:ff:ff:ff:ff:ff
12: ovs-system: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN
link/ether da:f8:b1:fd:2e:74 brd ff:ff:ff:ff:ff:ff
13: br-ex1: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN
link/ether 14:58:d0:4c:2e:9b brd ff:ff:ff:ff:ff:ff
14: br-tun: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN
link/ether 2a:98:45:ed:fb:4b brd ff:ff:ff:ff:ff:ff
15: vlan203: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN
link/ether 0a:5a:9c:28:45:f6 brd ff:ff:ff:ff:ff:ff
inet 172.19.0.11/24<http://172.19.0.11/24> brd 172.19.0.255 scope global vlan203
valid_lft forever preferred_lft forever
inet 172.19.0.10/32<http://172.19.0.10/32> brd 172.19.0.255 scope global vlan203
valid_lft forever preferred_lft forever
inet6 fe80::85a:9cff:fe28:45f6/64 scope link
valid_lft forever preferred_lft forever
16: vlan202: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN
link/ether 6e:3f:59:63:41:89 brd ff:ff:ff:ff:ff:ff
inet 172.18.0.12/24<http://172.18.0.12/24> brd 172.18.0.255 scope global vlan202
valid_lft forever preferred_lft forever
inet 172.18.0.10/32<http://172.18.0.10/32> brd 172.18.0.255 scope global vlan202
valid_lft forever preferred_lft forever
inet6 fe80::6c3f:59ff:fe63:4189/64 scope link
valid_lft forever preferred_lft forever
17: br-ex: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN
link/ether 14:58:d0:4c:2e:9c brd ff:ff:ff:ff:ff:ff
inet 10.1.62.169/24<http://10.1.62.169/24> brd 10.1.62.255 scope global br-ex
valid_lft forever preferred_lft forever
inet 10.1.62.168/32<http://10.1.62.168/32> brd 10.1.62.255 scope global br-ex
valid_lft forever preferred_lft forever
inet6 fcff:1:62:0:1658:d0ff:fe4c:2e9c/64 scope global mngtmpaddr dynamic
valid_lft 2591980sec preferred_lft 604780sec
inet6 fe80::1658:d0ff:fe4c:2e9c/64 scope link
valid_lft forever preferred_lft forever
18: vlan204: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN
link/ether ba:76:32:20:c8:1e brd ff:ff:ff:ff:ff:ff
inet 172.17.0.11/24<http://172.17.0.11/24> brd 172.17.0.255 scope global vlan204
valid_lft forever preferred_lft forever
inet6 fe80::b876:32ff:fe20:c81e/64 scope link
valid_lft forever preferred_lft forever
19: vlan201: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN
link/ether 96:0b:f7:a1:89:dc brd ff:ff:ff:ff:ff:ff
inet 172.16.0.13/24<http://172.16.0.13/24> brd 172.16.0.255 scope global vlan201
valid_lft forever preferred_lft forever
inet 172.16.0.10/32<http://172.16.0.10/32> brd 172.16.0.255 scope global vlan201
valid_lft forever preferred_lft forever
inet 172.16.0.11/32<http://172.16.0.11/32> brd 172.16.0.255 scope global vlan201
valid_lft forever preferred_lft forever
inet6 fe80::940b:f7ff:fea1:89dc/64 scope link
valid_lft forever preferred_lft forever
23: br-int: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN
link/ether 12:ec:43:c0:1d:43 brd ff:ff:ff:ff:ff:ff
stack: ovs-ctl show
75acb2b-1107-419f-9fed-1b80741aa78a
Bridge br-ex
Port "vlan202"
tag: 202
Interface "vlan202"
type: internal
Port br-ex
Interface br-ex
type: internal
Port "vlan201"
tag: 201
Interface "vlan201"
type: internal
Port "bond1"
Interface "eno2"
Interface "eno3"
Port phy-br-ex
Interface phy-br-ex
type: patch
options: {peer=int-br-ex}
Port "vlan204"
tag: 204
Interface "vlan204"
type: internal
Port "vlan203"
tag: 203
Interface "vlan203"
type: internal
Bridge br-int
fail_mode: secure
Port "tap485f8aa8-86"
tag: 2
Interface "tap485f8aa8-86"
type: internal
Port patch-tun
Interface patch-tun
type: patch
options: {peer=patch-int}
Port "tap62b75cc5-ef"
tag: 3
Interface "tap62b75cc5-ef"
type: internal
Port br-int
Interface br-int
type: internal
Port "tap123c52e6-5d"
tag: 1
Interface "tap123c52e6-5d"
type: internal
Port int-br-ex
Interface int-br-ex
type: patch
options: {peer=phy-br-ex}
Bridge br-tun
fail_mode: secure
Port br-tun
Interface br-tun
type: internal
Port "vxlan-ac11000c"
Interface "vxlan-ac11000c"
type: vxlan
options: {df_default="true", in_key=flow, local_ip="172.17.0.11", out_key=flow, remote_ip="172.17.0.12"}
Port "vxlan-ac11000a"
Interface "vxlan-ac11000a"
type: vxlan
options: {df_default="true", in_key=flow, local_ip="172.17.0.11", out_key=flow, remote_ip="172.17.0.10"}
Port patch-int
Interface patch-int
type: patch
options: {peer=patch-tun}
Port "vxlan-ac11000d"
Interface "vxlan-ac11000d"
type: vxlan
options: {df_default="true", in_key=flow, local_ip="172.17.0.11", out_key=flow, remote_ip="172.17.0.13"}
Port "vxlan-ac11000e"
Interface "vxlan-ac11000e"
type: vxlan
options: {df_default="true", in_key=flow, local_ip="172.17.0.11", out_key=flow, remote_ip="172.17.0.14"}
On Tue, Oct 18, 2016 at 8:50 AM, John Marks <jdmarks75080 at gmail.com<mailto:jdmarks75080 at gmail.com>> wrote:
Doesn't that make the stack very inflexible? And yes, we have faced this issue before and talked to RH about it and they said exactly the same thing. However, if I redeploy, I have found that modifying the network config does not take affect and I have to delete and redeploy the overcloud. That would really reak havoc if I had to do that in production.
Thanks for the reply.
On Tue, Oct 18, 2016 at 8:43 AM, Boris Derzhavets <bderzhavets at hotmail.com<mailto:bderzhavets at hotmail.com>> wrote:
Sorry for typo
If I am not correct stating the above, RH's technical stuff will point to my mistake for sure
I skipped "if" on first place.
________________________________
From: rdo-list-bounces at redhat.com<mailto:rdo-list-bounces at redhat.com> <rdo-list-bounces at redhat.com<mailto:rdo-list-bounces at redhat.com>> on behalf of Boris Derzhavets <bderzhavets at hotmail.com<mailto:bderzhavets at hotmail.com>>
Sent: Tuesday, October 18, 2016 4:37 PM
To: John Marks; rdo-list at redhat.com<mailto:rdo-list at redhat.com>
Subject: Re: [rdo-list] Adding a vlan to the external network in tripleo
I have a lab situation where there are 2 networks. One is in one DMZ and the other is a lab isolated network. I need access to both via the external port. I believe what I need to do is add another port to the bridge on a vlan to the lab network. I created a new external network in Director and assigned the vlan to it. However, I am not sure that will add it to the existing bridge.
A bigger question around this is why does Openstack not support modifications after installation to the north/south network?
Openstack has no problem with adding one more external network (or even 2) of VLAN type .
See for instance https://www.linux.com/blog/rdo-mitaka-several-external-networks-vlan-provider-setup
The problem here is the way which was used for deployment, it is TripleO.
To have the job done you need to update heat stack "overcloud" which had been built
on undercloud Node. So you should be able redeploy overcloud with specific tripleo-heat-template
addressing you needs. I would expect your br-ex bridges to have IPs on ctlplane obtained via DHCP.
Any manual intervention to overcloud is impossible. You have presumably only one
option , which is to ask vendor for support.
I am not correct stating the above, RH's technical stuff will point to my mistake for sure.
That is why I am so sorry about regression taken place in packstack functionality
Boris.
East/west is easy but North/South has to have a lot of modifications made to static files (it seems) like plugin.ini and openvswitch.ini.
________________________________
From: rdo-list-bounces at redhat.com<mailto:rdo-list-bounces at redhat.com> <rdo-list-bounces at redhat.com<mailto:rdo-list-bounces at redhat.com>> on behalf of John Marks <jdmarks75080 at gmail.com<mailto:jdmarks75080 at gmail.com>>
Sent: Tuesday, October 18, 2016 7:32:53 AM
To: rdo-list at redhat.com<mailto:rdo-list at redhat.com>
Subject: [rdo-list] Adding a vlan to the external network in tripleo
I have a lab situation where there are 2 networks. One is in one DMZ and the other is a lab isolated network. I need access to both via the external port. I believe what I need to do is add another port to the bridge on a vlan to the lab network. I created a new external network in Director and assigned the vlan to it. However, I am not sure that will add it to the existing bridge.
A bigger question around this is why does Openstack not support modifications after installation to the north/south network? East/west is easy but North/South has to have a lot of modifications made to static files (it seems) like plugin.ini and openvswitch.ini.
Any help would be appreciated.
_______________________________________________
rdo-list mailing list
rdo-list at redhat.com<mailto:rdo-list at redhat.com>
https://www.redhat.com/mailman/listinfo/rdo-list
To unsubscribe: rdo-list-unsubscribe at redhat.com<mailto:rdo-list-unsubscribe at redhat.com>
--
[https://0cac57e6-a-62cb3a1a-s-sites.googlegroups.com/site/brandonajames/hot/SUNAYU_LOGO_SIDE%28NO%20TAGLINE%29.jpg?attachauth=ANoY7craA8YrLTT8x3WhaypAtiXvQ0K-_OS2jZLqGIxlVfggNoilgZ0EphWMvnkHuk2FGCoOAjLIdLUOfDaai4Hb33i4FsnL9TXCfSS4WDRCVQVeKFk3qZU226q_8ZQhEYrPX9OR_Bx3eeOB42Qb9fr6qDvqzgSLcbGWpvI_vaAU8ldioT8VmZIwTFZJ84g6PcdXTG-aKTBGCN0xDfScEkqhERAh8lqvHsOua9a6jYjhY49IRhsfGj-_2V5FUz_p4oBpI1B3qjvK&attredirects=0]
Brandon James
CEO & Founding Member
Mobile: 240.476-3922<tel:240.476-3922>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rdoproject.org/pipermail/dev/attachments/20161018/82f62cd6/attachment.html>
More information about the dev
mailing list