7.2. Configure OpenStack Networking

Procedure 7.4. Creating the OpenStack Networking Database

1. Connect to the database service:

   # mysql -u root -p

2. Create the database with one of the following names:

   • If you are using the ML2 plug-in, the recommended database name is neutron_ml2
   • If you are using the Open vSwitch plug-in, the recommended database name is ovs_neutron.
   • If you are using the Linux Bridge plug-in, the recommended database name is neutron_linux_bridge.

   This example creates the ML2 neutron_ml2 database:

   mysql> CREATE DATABASE neutron_ml2 character set utf8;

3. Create a neutron database user and grant the user access to the neutron_ml2 database:

   mysql> GRANT ALL ON neutron_ml2.* TO 'neutron'@'%' IDENTIFIED BY 'PASSWORD';
   mysql> GRANT ALL ON neutron_ml2.* TO 'neutron'@'localhost' IDENTIFIED BY 'PASSWORD';

   Replace PASSWORD with a secure password that will be used to authenticate with the database server as this user.
4. Flush the database privileges to ensure that they take effect immediately:

   mysql> FLUSH PRIVILEGES;

5. Exit the mysql client:

   mysql> quit

Procedure 7.5. Configuring the OpenStack Networking SQL Database Connection

1. Set the value of the connection configuration key.

   # openstack-config --set /etc/neutron/plugin.ini \
      DATABASE sql_connection mysql://USER:PASS@IP/DB

   Replace the following values:

   • Replace USER with the OpenStack Networking database user name, usually neutron.
   • Replace PASS with the password of the database user.
   • Replace IP with the IP address or host name of the database server.
   • Replace DB with the name of the OpenStack Networking database.

   Important

   The IP address or host name specified in the connection configuration key must match the IP address or host name to which the OpenStack Networking database user was granted access when creating the OpenStack Networking database. Moreover, if the database is hosted locally and you granted permissions to 'localhost' when creating the database, you must enter 'localhost'.
2. Upgrade the OpenStack Networking database schema:

   # neutron-db-manage --config-file /usr/share/neutron/neutron-dist.conf \
      --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugin.ini upgrade head

Procedure 7.6. Creating Identity Records for OpenStack Networking

1. Set up the shell to access Keystone as the administrative user:

   # source ~/keystonerc_admin

2. Create the neutron user:

   [(keystone_admin)]# keystone user-create --name neutron --pass PASSWORD
   +----------+----------------------------------+
   | Property |              Value               |
   +----------+----------------------------------+
   |  email   |                                  |
   | enabled  |               True               |
   |    id    | 1df18bcd14404fa9ad954f9d5eb163bc |
   |   name   |              neutron             |
   | username |              neutron             |
   +----------+----------------------------------+
   

   Replace PASSWORD with a secure password that will be used by OpenStack Networking when authenticating with the Identity service.
3. Link the neutron user and the admin role together within the context of the services tenant:

   [(keystone_admin)]# keystone user-role-add --user neutron --role admin --tenant services

4. Create the neutron OpenStack Networking service entry:

   [(keystone_admin)]# keystone service-create --name neutron \
      --type network \
      --description "OpenStack Networking"
   +-------------+----------------------------------+
   |   Property  |              Value               |
   +-------------+----------------------------------+
   | description |        OpenStack Networking      |
   |   enabled   |               True               |
   |      id     | 134e815915f442f89c39d2769e278f9b |
   |     name    |              neutron             |
   |     type    |              network             |
   +-------------+----------------------------------+

5. Create the neutron endpoint entry:

   [(keystone_admin)]# keystone endpoint-create
      --service neutron \
      --publicurl 'http://IP:9696' \
      --adminurl 'http://IP:9696' \
      --internalurl 'http://IP:9696' \
      --region 'RegionOne'

   Replace IP with the IP address or host name of the server that will act as the OpenStack Networking node.

Procedure 7.7. Configuring the OpenStack Networking Service to Authenticate through the Identity Service

1. Set the authentication strategy to keystone:

   # openstack-config --set /etc/neutron/neutron.conf \
      DEFAULT auth_strategy keystone

2. Set the Identity service host that OpenStack Networking must use:

   # openstack-config --set /etc/neutron/neutron.conf \
      keystone_authtoken auth_host IP

   Replace IP with the IP address or host name of the server hosting the Identity service.
3. Set OpenStack Networking to authenticate as the correct tenant:

   # openstack-config --set /etc/neutron/neutron.conf \
      keystone_authtoken admin_tenant_name services

   Replace services with the name of the tenant created for the use of OpenStack Networking. Examples in this guide use services.
4. Set OpenStack Networking to authenticate using the neutron administrative user account:

   # openstack-config --set /etc/neutron/neutron.conf \
      keystone_authtoken admin_user neutron

5. Set OpenStack Networking to use the correct neutron administrative user account password:

   # openstack-config --set /etc/neutron/neutron.conf \
      keystone_authtoken admin_password PASSWORD

   Replace PASSWORD with the password set when the neutron user was created.

Procedure 7.8. Configuring the Firewall to Allow OpenStack Networking Traffic

1. Open the /etc/sysconfig/iptables file in a text editor.
2. Add an INPUT rule allowing TCP traffic on port 9696. The new rule must appear before any INPUT rules that REJECT traffic:

   -A INPUT -p tcp -m multiport --dports 9696 -j ACCEPT

3. Save the changes to the /etc/sysconfig/iptables file.
4. Restart the iptables service to ensure that the change takes effect:

   # systemctl restart iptables.service

Procedure 7.9. Configuring the OpenStack Networking Service to use the RabbitMQ Message Broker

1. Set RabbitMQ as the RPC back end:

   # openstack-config --set /etc/neutron/neutron.conf \
      DEFAULT rpc_backend neutron.openstack.common.rpc.impl_kombu

2. Set OpenStack Networking to connect to the RabbitMQ host:

   # openstack-config --set /etc/neutron/neutron.conf \
      DEFAULT rabbit_host RABBITMQ_HOST

   Replace RABBITMQ_HOST with the IP address or host name of the message broker.
3. Set the message broker port to 5672:

   # openstack-config --set /etc/neutron/neutron.conf \
      DEFAULT rabbit_port 5672

4. Set the RabbitMQ user name and password created for OpenStack Networking when RabbitMQ was configured:

   # openstack-config --set /etc/neutron/neutron.conf \
      DEFAULT rabbit_userid neutron
   # openstack-config --set /etc/neutron/neutron.conf \
      DEFAULT rabbit_password NEUTRON_PASS

   Replace neutron and NEUTRON_PASS with the RabbitMQ user name and password created for OpenStack Networking.
5. When RabbitMQ was launched, the neutron user was granted read and write permissions to all resources: specifically, through the virtual host /. Configure the Networking service to connect to this virtual host:

   # openstack-config --set /etc/neutron/neutron.conf \
      DEFAULT rabbit_virtual_host /

Procedure 7.10. Enabling SSL Communication Between OpenStack Networking and the RabbitMQ Message Broker

1. Enable SSL communication with the message broker:

   # openstack-config --set /etc/neutron/neutron.conf \
      DEFAULT rabbit_use_ssl True
   # openstack-config --set /etc/neutron/neutron.conf \
      DEFAULT kombu_ssl_certfile /path/to/client.crt
   # openstack-config --set /etc/neutron/neutron.conf \
      DEFAULT kombu_ssl_keyfile /path/to/clientkeyfile.key

   Replace the following values:
   • Replace /path/to/client.crt with the absolute path to the exported client certificate.
   • Replace /path/to/clientkeyfile.key with the absolute path to the exported client key file.
2. If your certificates were signed by a third-party Certificate Authority (CA), you must also run the following command:

   # openstack-config --set /etc/neutron/neutron.conf \
    DEFAULT kombu_ssl_ca_certs /path/to/ca.crt

   Replace /path/to/ca.crt with the absolute path to the CA file provided by the third-party CA (see Section 2.3.4, “Enable SSL on the RabbitMQ Message Broker” for more information).

Procedure 7.11. Configuring OpenStack Networking to Communicate with the Compute Service

1. Set OpenStack Networking to connect to the Compute controller node:

   # openstack-config --set /etc/neutron/neutron.conf \
      DEFAULT nova_url http://CONTROLLER_IP:8774/v2

   Replace CONTROLLER_IP with the IP address or host name of the Compute controller node.
2. Set the user name, password, and tenant for the nova user:

   # openstack-config --set /etc/neutron/neutron.conf \
      DEFAULT nova_admin_username nova
   # openstack-config --set /etc/neutron/neutron.conf \
      DEFAULT nova_admin_tenant_id TENANT_ID
   # openstack-config --set /etc/neutron/neutron.conf \
      DEFAULT nova_admin_password PASSWORD

   Replace TENANT_ID with the unique identifier of the tenant created for the use of the Compute service. Replace PASSWORD with the password set when the nova user was created.
3. Set OpenStack Networking to connect to the Compute controller node in an administrative context:

   # openstack-config --set /etc/neutron/neutron.conf \
      DEFAULT nova_admin_auth_url http://CONTROLLER_IP:35357/v2.0

   Replace CONTROLLER_IP with the IP address or host name of the Compute controller node.
4. Set OpenStack Networking to use the correct region for the Compute controller node:

   # openstack-config --set /etc/neutron/neutron.conf \
      DEFAULT nova_region_name RegionOne