Chapter 8. Basic network isolation
Configure the overcloud to use isolated networks so that you can host specific types of network traffic in isolation. Red Hat OpenStack Platform (RHOSP) includes a set of environment files that you can use to configure this network isolation. You might also require additional environment files to further customize your networking parameters:
An environment file that you can use to enable network isolation (
/usr/share/openstack-tripleo-heat-templates/environments/network-isolation.yaml
).NoteBefore you deploy RHOSP with director, the files
network-isolation.yaml
andnetwork-environment.yaml
are only in Jinja2 format and have a.j2.yaml
extension. Director renders these files to.yaml
versions during deployment.-
An environment file that you can use to configure network defaults (
/usr/share/openstack-tripleo-heat-templates/environments/network-environment.yaml
). -
A
network_data
file that you can use to define network settings such as IP ranges, subnets, and virtual IPs. This example shows you how to create a copy of the default and edit it to suit your own network. - Templates that you can use to define your NIC layout for each node. The overcloud core template collection contains a set of defaults for different use cases.
-
An environment file that you can use to enable NICs. This example uses a default file located in the
environments
directory.
8.1. Network isolation
The overcloud assigns services to the provisioning network by default. However, director can divide overcloud network traffic into isolated networks. To use isolated networks, the overcloud contains an environment file that enables this feature. The environments/network-isolation.j2.yaml
file in the core heat templates is a Jinja2 file that defines all ports and VIPs for each network in your composable network file. When rendered, it results in a network-isolation.yaml
file in the same location with the full resource registry:
resource_registry: # networks as defined in network_data.yaml OS::TripleO::Network::Storage: ../network/storage.yaml OS::TripleO::Network::StorageMgmt: ../network/storage_mgmt.yaml OS::TripleO::Network::InternalApi: ../network/internal_api.yaml OS::TripleO::Network::Tenant: ../network/tenant.yaml OS::TripleO::Network::External: ../network/external.yaml # Port assignments for the VIPs OS::TripleO::Network::Ports::StorageVipPort: ../network/ports/storage.yaml OS::TripleO::Network::Ports::StorageMgmtVipPort: ../network/ports/storage_mgmt.yaml OS::TripleO::Network::Ports::InternalApiVipPort: ../network/ports/internal_api.yaml OS::TripleO::Network::Ports::ExternalVipPort: ../network/ports/external.yaml OS::TripleO::Network::Ports::RedisVipPort: ../network/ports/vip.yaml # Port assignments by role, edit role definition to assign networks to roles. # Port assignments for the Controller OS::TripleO::Controller::Ports::StoragePort: ../network/ports/storage.yaml OS::TripleO::Controller::Ports::StorageMgmtPort: ../network/ports/storage_mgmt.yaml OS::TripleO::Controller::Ports::InternalApiPort: ../network/ports/internal_api.yaml OS::TripleO::Controller::Ports::TenantPort: ../network/ports/tenant.yaml OS::TripleO::Controller::Ports::ExternalPort: ../network/ports/external.yaml # Port assignments for the Compute OS::TripleO::Compute::Ports::StoragePort: ../network/ports/storage.yaml OS::TripleO::Compute::Ports::InternalApiPort: ../network/ports/internal_api.yaml OS::TripleO::Compute::Ports::TenantPort: ../network/ports/tenant.yaml # Port assignments for the CephStorage OS::TripleO::CephStorage::Ports::StoragePort: ../network/ports/storage.yaml OS::TripleO::CephStorage::Ports::StorageMgmtPort: ../network/ports/storage_mgmt.yaml
The first section of this file has the resource registry declaration for the OS::TripleO::Network::*
resources. By default, these resources use the OS::Heat::None
resource type, which does not create any networks. By redirecting these resources to the YAML files for each network, you enable the creation of these networks.
The next several sections create the IP addresses for the nodes in each role. The controller nodes have IPs on each network. The compute and storage nodes each have IPs on a subset of the networks.
Other functions of overcloud networking, such as Chapter 9, Custom composable networks and Chapter 10, Custom network interface templates rely on the network-isolation.yaml
environment file. Therefore you must include the the rendered environment file in your deployment commands:
$ openstack overcloud deploy --templates \ ... -e /usr/share/openstack-tripleo-heat-templates/environments/network-isolation.yaml \ ...
8.2. Modifying isolated network configuration
Copy the default network_data.yaml
file and modify the copy to configure the default isolated networks.
Procedure
Copy the default
network_data.yaml
file:$ cp /usr/share/openstack-tripleo-heat-templates/network_data.yaml /home/stack/.
Edit the local copy of the
network_data.yaml
file and modify the parameters to suit your networking requirements. For example, the Internal API network contains the following default network details:- name: InternalApi name_lower: internal_api vip: true vlan: 201 ip_subnet: '172.16.2.0/24' allocation_pools: [{'start': '172.16.2.4', 'end': '172.16.2.250'}]
Edit the following values for each network:
-
vlan
defines the VLAN ID that you want to use for this network. -
ip_subnet
andip_allocation_pools
set the default subnet and IP range for the network. -
gateway
sets the gateway for the network. Use this value to define the default route for the External network, or for other networks if necessary.
Include the custom network_data.yaml
file with your deployment using the -n
option. Without the -n
option, the deployment command uses the default network details.
8.3. Network interface templates
The overcloud network configuration requires a set of the network interface templates. These templates are standard heat templates in YAML format. Each role requires a NIC template so that director can configure each node within that role correctly.
All NIC templates contain the same sections as standard heat templates:
heat_template_version
- The syntax version to use.
description
- A string description of the template.
parameters
- Network parameters to include in the template.
resources
-
Takes parameters defined in
parameters
and applies them to a network configuration script. outputs
- Renders the final script used for configuration.
The default NIC templates in /usr/share/openstack-tripleo-heat-templates/network/config
use Jinja2 syntax to render the template. For example, the following snippet from the single-nic-vlans
configuration renders a set of VLANs for each network:
{%- for network in networks if network.enabled|default(true) and network.name in role.networks %} - type: vlan vlan_id: get_param: {{network.name}}NetworkVlanID addresses: - ip_netmask: get_param: {{network.name}}IpSubnet {%- if network.name in role.default_route_networks %}
For default Compute nodes, this renders only the network information for the Storage, Internal API, and Tenant networks:
- type: vlan vlan_id: get_param: StorageNetworkVlanID device: bridge_name addresses: - ip_netmask: get_param: StorageIpSubnet - type: vlan vlan_id: get_param: InternalApiNetworkVlanID device: bridge_name addresses: - ip_netmask: get_param: InternalApiIpSubnet - type: vlan vlan_id: get_param: TenantNetworkVlanID device: bridge_name addresses: - ip_netmask: get_param: TenantIpSubnet
Chapter 10, Custom network interface templates explores how to render the default Jinja2-based templates to standard YAML versions, which you can use as a basis for customization.
8.4. Default network interface templates
Director contains templates in /usr/share/openstack-tripleo-heat-templates/network/config/
to suit most common network scenarios. The following table outlines each NIC template set and the respective environment file that you must use to enable the templates.
Each environment file for enabling NIC templates uses the suffix .j2.yaml
. This is the unrendered Jinja2 version. Ensure that you include the rendered file name, which uses the .yaml
suffix, in your deployment.
NIC directory | Description | Environment file |
---|---|---|
|
Single NIC ( |
|
|
Single NIC ( |
|
|
Control plane attached to |
|
|
Control plane attached to |
|
Environment files exist for deploying the overcloud without an external network, for example, net-bond-with-vlans-no-external.yaml
, and for IPv6 deployments, for example, net-bond-with-vlans-v6.yaml
. These are provided for backwards compatibility and do not function with composable networks.
Each default NIC template set contains a role.role.j2.yaml
template. This file uses Jinja2 to render additional files for each composable role. For example, if your overcloud uses Compute, Controller, and Ceph Storage roles, the deployment renders new templates based on role.role.j2.yaml
, such as the following templates:
-
compute.yaml
-
controller.yaml
-
ceph-storage.yaml
.
8.5. Enabling basic network isolation
Director includes templates that you can use to enable basic network isolation. These files are located in the /usr/share/openstack-tripleo-heat-templates/environments
directory. For example, you can use the templates to deploy an overcloud on a single NIC with VLANs with basic network isolation. In this scenario, use the net-single-nic-with-vlans
template.
Procedure
When you run the
openstack overcloud deploy
command, ensure that you include the following rendered environment files:-
The custom
network_data.yaml
file. - The rendered file name of the default network isolation file.
- The rendered file name of the default network environment file.
- The rendered file name of the default network interface configuration file.
- Any additional environment files relevant to your configuration.
-
The custom
For example:
$ openstack overcloud deploy --templates \ ... -n /home/stack/network_data.yaml \ -e /usr/share/openstack-tripleo-heat-templates/environments/network-isolation.yaml \ -e /usr/share/openstack-tripleo-heat-templates/environments/network-environment.yaml \ -e /usr/share/openstack-tripleo-heat-templates/environments/net-single-nic-with-vlans.yaml \ ...