Chapter 5. VLAN-aware instances

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Identify the network connected to the instances that you want to give access to the trunked VLANs:

   $ openstack network list -c Name -c Subnets --max-width=55

   Sample output

   +-------------+---------------------------------------+
   | Name        | Subnets                               |
   +-------------+---------------------------------------+
   | private     | 47d34cf0-0dd2-49bd-a985-67311d80c5c4, |
   |             | 82014d36-9e60-43eb-92fc-74674573f4e8, |
   |             | d7535565-113f-4192-baa6-da21f301f141  |
   | private2    | 7ee56cef-83c0-40d1-b4e7-5287dae1c23c  |
   | public      | 49dda67d-814e-457b-b14b-77ef32935c0f, |
   |             | 6745edd4-d15f-4971-89bf-70307b0ad2f1, |
   |             | cc3f81bb-4d55-4ead-aad4-5362a7ca5b04  |
   | lb-mgmt-net | 5ca08724-568c-4030-93eb-f2e286570a25  |
   +-------------+---------------------------------------+

3. Create the parent trunk port, and attach it to the network that the instances connect to.

   Example

   In this example, a port named parent-trunk-port is created on the public network. This port is the parent port, as you can use it to create subports:

   $ openstack port create --network public parent-trunk-port

   Sample output

1. Create a trunk using the parent port.

   Example

   In this example, the trunk is named trunk1, and its parent port is named parent-trunk-port:

   $ openstack network trunk create --parent-port parent-trunk-port trunk1

   Sample output

Verification

1. View the trunk connection:

   $ openstack network trunk list --max-width=72

   Sample output

1. View the details of the trunk connection:

   $ openstack network trunk show parent-trunk

   Sample output

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Obtain the MAC address of the parent port.

   Retain this name, because you will need it later:

   Example

   $ openstack port show parent-trunk-port --max-width=72

   Sample output

   +-------------------------+--------------------------------------------+
   | Field                   | Value                                      |
   +-------------------------+--------------------------------------------+
   | admin_state_up          | UP                                         |
   | allowed_address_pairs   |                                            |
   | binding_host_id         |                                            |
   | binding_profile         |                                            |
   | binding_vif_details     |                                            |
   | binding_vif_type        | unbound                                    |
   | binding_vnic_type       | normal                                     |
   | created_at              | 2024-09-25T20:18:40Z                       |
   | data_plane_status       | None                                       |
   | description             |                                            |
   | device_id               |                                            |
   | device_owner            |                                            |
   | device_profile          | None                                       |
   | dns_assignment          | fqdn='host-10-0-0-236.openstacklocal.',    |
   |                         | hostname='host-10-0-0-236',                |
   |                         | ip_address='10.0.0.236'                    |
   |                         | fqdn='host-2002-c000-200--                 |
   |                         | 64.openstacklocal.',                       |
   |                         | hostname='host-2002-c000-200--64',         |
   |                         | ip_address='2002:c000:200::64'             |
   | dns_domain              |                                            |
   | dns_name                |                                            |
   | extra_dhcp_opts         |                                            |
   | fixed_ips               | ip_address='10.0.0.236', subnet_id='6745ed |
   |                         | d4-d15f-4971-89bf-70307b0ad2f1'            |
   |                         | ip_address='2002:c000:200::64', subnet_id= |
   |                         | '49dda67d-814e-457b-b14b-77ef32935c0f'     |
   | id                      | 530ff46e-b285-4ad7-a77a-7dca1fb9174d       |
   | ip_allocation           | immediate                                  |
   | mac_address             | fa:16:3e:0f:b8:cb                          |
   | name                    | parent-trunk-port                          |
   | network_id              | bcdb3cc0-8c0b-4d2d-813c-e141bb97aa8f       |
   | numa_affinity_policy    | None                                       |
   | port_security_enabled   | True                                       |
   | project_id              | 24089d2fe1a94dd29ca2f665794fbe92           |
   | propagate_uplink_status | None                                       |
   | qos_network_policy_id   | None                                       |
   | qos_policy_id           | None                                       |
   | resource_request        | None                                       |
   | revision_number         | 1                                          |
   | security_group_ids      | 9bf70539-31b0-47e5-a0ea-3ee409de0499       |
   | status                  | DOWN                                       |
   | tags                    |                                            |
   | trunk_details           | {'trunk_id':                               |
   |                         | 'ef2aff85-9e51-43d4-ab28-2ab833f049b3',    |
   |                         | 'sub_ports': []}                           |
   | updated_at              | 2024-09-25T20:18:40Z                       |
   +-------------------------+--------------------------------------------+

3. Create a subport of the parent port for the trunk.

   Example

   In this example, a port is created, subport1. By specifying the MAC address assigned to the parent port, fa:16:3e:33:c4:75, the port created becomes a subport of the parent port:

   $ openstack port create --network private --mac-address fa:16:3e:33:c4:75 subport1

   Sample output

   +-------------------------+--------------------------------------------+
   | Field                   | Value                                      |
   +-------------------------+--------------------------------------------+
   | admin_state_up          | UP                                         |
   | allowed_address_pairs   |                                            |
   | binding_host_id         |                                            |
   | binding_profile         |                                            |
   | binding_vif_details     |                                            |
   | binding_vif_type        | unbound                                    |
   | binding_vnic_type       | normal                                     |
   | created_at              | 2024-09-25T20:19:28Z                       |
   | data_plane_status       | None                                       |
   | description             |                                            |
   | device_id               |                                            |
   | device_owner            |                                            |
   | device_profile          | None                                       |
   | dns_assignment          | fqdn='host-10-0-24-31.openstacklocal.',    |
   |                         | hostname='host-10-0-24-31',                |
   |                         | ip_address='10.0.24.31'                    |
   | dns_domain              |                                            |
   | dns_name                |                                            |
   | extra_dhcp_opts         |                                            |
   | fixed_ips               | ip_address='10.0.24.31', subnet_id='47d34c |
   |                         | f0-0dd2-49bd-a985-67311d80c5c4'            |
   | id                      | 4ce8382f-5efc-4794-83f8-1f89ef7efe68       |
   | ip_allocation           | immediate                                  |
   | mac_address             | fa:16:3e:0f:b8:cb                          |
   | name                    | subport1                                   |
   | network_id              | 317be3d3-5265-43f7-b52b-930e3fd19b8b       |
   | numa_affinity_policy    | None                                       |
   | port_security_enabled   | True                                       |
   | project_id              | 24089d2fe1a94dd29ca2f665794fbe92           |
   | propagate_uplink_status | None                                       |
   | qos_network_policy_id   | None                                       |
   | qos_policy_id           | None                                       |
   | resource_request        | None                                       |
   | revision_number         | 1                                          |
   | security_group_ids      | 9bf70539-31b0-47e5-a0ea-3ee409de0499       |
   | status                  | DOWN                                       |
   | tags                    |                                            |
   | trunk_details           | None                                       |
   | updated_at              | 2024-09-25T20:19:28Z                       |
   +-------------------------+--------------------------------------------+

   Note

   If you receive the error HttpException: Conflict, confirm that you are creating the subport on a different network to the one that has the parent trunk port. This example uses the public network for the parent trunk port, and private for the subport.

4. Associate the port with the trunk.

   Example

   In this example, subport1 is associated with trunk1. The segmentation type is vlan and the segmentation ID, the VLAN ID, is 55. The type and ID are attributes from the network (private) that was used to create subport1 in an earlier command:

   $ openstack network trunk set --subport port=subport1,\
   segmentation-type=vlan,segmentation-id=55 trunk1

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Obtain the trunk name and the parent port ID that you want to connect your instance to.

   Retain this information, because you will need it later:

   Example

   $ openstack network trunk list -c Name -c "Parent Port"

   Sample output

   +--------+--------------------------------------+
   | Name   | Parent Port                          |
   +--------+--------------------------------------+
   | trunk1 | 530ff46e-b285-4ad7-a77a-7dca1fb9174d |
   +--------+--------------------------------------+

3. Create an instance that uses the parent port-id as its vNIC.

   Example

   In this example, an instance, testInstance, is created and connected to the parent port by specifying the port ID, 530ff46e-b285-4ad7-a77a-7dca1fb9174d:

   $ openstack server create --image cirros --flavor m1.tiny \
   --security-group default --key-name sshaccess \
   --nic port-id=530ff46e-b285-4ad7-a77a-7dca1fb9174d testInstance

   Sample output

   +--------------------------------------+---------------------------------+
   | Property                             | Value                           |
   +--------------------------------------+---------------------------------+
   | OS-DCF:diskConfig                    | MANUAL                          |
   | OS-EXT-AZ:availability_zone          |                                 |
   | OS-EXT-SRV-ATTR:host                 | -                               |
   | OS-EXT-SRV-ATTR:hostname             | testinstance                    |
   | OS-EXT-SRV-ATTR:hypervisor_hostname  | -                               |
   | OS-EXT-SRV-ATTR:instance_name        |                                 |
   | OS-EXT-SRV-ATTR:kernel_id            |                                 |
   | OS-EXT-SRV-ATTR:launch_index         | 0                               |
   | OS-EXT-SRV-ATTR:ramdisk_id           |                                 |
   | OS-EXT-SRV-ATTR:reservation_id       | r-juqco0el                      |
   | OS-EXT-SRV-ATTR:root_device_name     | -                               |
   | OS-EXT-SRV-ATTR:user_data            | -                               |
   | OS-EXT-STS:power_state               | 0                               |
   | OS-EXT-STS:task_state                | scheduling                      |
   | OS-EXT-STS:vm_state                  | building                        |
   | OS-SRV-USG:launched_at               | -                               |
   | OS-SRV-USG:terminated_at             | -                               |
   | accessIPv4                           |                                 |
   | accessIPv6                           |                                 |
   | adminPass                            | uMyL8PnZRBwQ                    |
   | config_drive                         |                                 |
   | created                              | 2024-09-25T20:22:19Z            |
   | description                          | -                               |
   | flavor                               | m1.tiny (1)                     |
   | hostId                               |                                 |
   | host_status                          |                                 |
   | id                                   | 88b7aede-1305-4d91-a180-67e7eac |
   |                                      | 8b70d                           |
   | image                                | cirros (568372f7-15df-4e61-a05f |
   |                                      | -10954f79a3c4)                  |
   | key_name                             | sshaccess                       |
   | locked                               | False                           |
   | metadata                             | {}                              |
   | name                                 | testInstance                    |
   | os-extended-volumes:volumes_attached | []                              |
   | progress                             | 0                               |
   | security_groups                      | default                         |
   | status                               | BUILD                           |
   | tags                                 | []                              |
   | tenant_id                            | 745d33000ac74d30a77539f8920555e |
   |                                      | 7                               |
   | updated                              | 2024-09-25T20:22:19Z            |
   | user_id                              | 8c4aea738d774967b4ef388eb41fef5 |
   |                                      | e                               |
   +--------------------------------------+---------------------------------+

Procedure

1. Create a YAML file and add the following content:

   apiVersion: core.openstack.org/v1beta1
   kind: OpenStackControlPlane
   metadata:
     name: openstack-control-plane
   spec:
     neutron:
       template:
         customServiceConfig: |
           [DEFAULT]
           vlan_transparent = true

2. Apply the updated OpenStackControlPlane CR configuration:

   $ oc apply -f <control_plane_update.yaml>

   • Replace <control_plane_update.yaml> with the name of the YAML file that contains your update.

3. Wait until Red Hat OpenShift Container Platform (RHOCP) creates the resources related to the OpenStackControlPlane CR. Check the status of the control plane deployment:

   $ oc get openstackcontrolplane -n OPENSTACK

   Sample output

   NAME                      STATUS    MESSAGE
   openstack-control-plane   Unknown   Setup started

   The OpenStackControlPlane resources are created when the status is "Setup complete".

   Tip

   Append the -w option to the get command to track deployment progress.

4. Access the remote shell for the OpenStackClient pod from your workstation:

   $ oc rsh -n openstack openstackclient

5. Confirm that the Networking service has successfully loaded the vlan_transparent extension:

   $ openstack extension list --network  --max-width=72 \
   | grep vlan-transparent

   Sample output

   If the Networking service has successfully loaded the loaded the vlan_transparent extension, you should see output similar to the following:

   | Vlantransparent      | vlan-transparent     | Provides Vlan          |
   |                      |                      | Transparent Networks   |

6. Create the network using the --transparent-vlan argument.

   Example

   $ openstack network create <network-name> --transparent-vlan

   • Replace <network-name> with the name of the network that you are creating.

7. Exit the openstackclient pod:

   $ exit

8. Set up a VLAN interface on each participating VM.

   Set the interface MTU to 4 bytes less than the MTU of the underlay network to accommodate the extra tagging required by VLAN transparency. For example, if the underlay network MTU is 1500, set the interface MTU to 1496.

   The following example command adds a VLAN interface on eth0 with an MTU of 1496. The VLAN is 50 and the interface name is vlan50:

   Example

   $ ip link add link eth0 name vlan50 type vlan id 50 mtu 1496
   $ ip link set vlan50 up
   $ ip addr add 192.128.111.3/24 dev vlan50

9. Access the remote shell for the OpenStackClient pod from your workstation:

   $ oc rsh -n openstack openstackclient

10. Set --allowed-address on the VM port.

    Set the allowed address to the IP address you created on the VLAN interface inside the VM. Optionally, you can also set the VLAN interface MAC address.

    Note

    An alternative to setting an allowed address pair, is to disable port security on the port by using the port set --disable-port-security command.

    Example

    The following example sets the IP address to 192.128.111.3 with the optional MAC address 00:40:96:a8:45:c4 on port fv82gwk3-qq2e-yu93-go31-56w7sf476mm0:

    $ openstack port set --allowed-address ip-address=192.128.111.3,\
    mac-address=00:40:96:a8:45:c4 fv82gwk3-qq2e-yu93-go31-56w7sf476mm0

11. Exit the openstackclient pod:

    $ exit

Verification

1. Ping between two VMs on the VLAN using the VLAN interface name IP address that you set in an earlier step, for example, vlan50.
2. Use tcpdump on eth0 to see if the packets arrive with the VLAN tag intact.