8.5. 使用 OpenStackNetConfig 创建 VLAN 网络进行网络隔离

流程

1. 为您的网络配置创建一个文件。包括 VLAN 网络的资源规格。例如，每个 worker 节点上管理 VLAN 标记的流量的 API、存储、存储 mgmt、租户和外部网络的规格通过 Linux 网桥 br-ex 和 br-osp 连接到 enp6s0 和 enp7s0 以太网设备：

   kind: OpenStackNetConfig
   metadata:
     name: openstacknetconfig
   spec:
     attachConfigurations:
       br-osp:
         nodeNetworkConfigurationPolicy:
           nodeSelector:
             node-role.kubernetes.io/worker: ""
           desiredState:
             interfaces:
             - bridge:
                 options:
                   stp:
                     enabled: false
                 port:
                 - name: enp7s0
               description: Linux bridge with enp7s0 as a port
               name: br-osp
               state: up
               type: linux-bridge
               mtu: 1500
       br-ex:
         nodeNetworkConfigurationPolicy:
           nodeSelector:
             node-role.kubernetes.io/worker: ""
           desiredState:
             interfaces:
             - bridge:
                 options:
                   stp:
                     enabled: false
                 port:
                 - name: enp6s0
               description: Linux bridge with enp6s0 as a port
               name: br-ex
               state: up
               type: linux-bridge
               mtu: 1500
     # optional DnsServers list
     dnsServers:
     - 172.22.0.1
     # optional DnsSearchDomains list
     dnsSearchDomains:
     - osptest.test.metalkube.org
     - some.other.domain
     # DomainName of the OSP environment
     domainName: osptest.test.metalkube.org
     networks:
     - name: Control
       nameLower: ctlplane
       subnets:
       - name: ctlplane
         ipv4:
           allocationEnd: 172.22.0.250
           allocationStart: 172.22.0.10
           cidr: 172.22.0.0/24
           gateway: 172.22.0.1
         attachConfiguration: br-osp
     - name: InternalApi
       nameLower: internal_api
       mtu: 1350
       subnets:
       - name: internal_api
         attachConfiguration: br-osp
         vlan: 20
         ipv4:
           allocationEnd: 172.17.0.250
           allocationStart: 172.17.0.10
           cidr: 172.17.0.0/24
     - name: External
       nameLower: external
       subnets:
       - name: external
         ipv4:
           allocationEnd: 10.0.0.250
           allocationStart: 10.0.0.10
           cidr: 10.0.0.0/24
           gateway: 10.0.0.1
         attachConfiguration: br-ex
     - name: Storage
       nameLower: storage
       mtu: 1500
       subnets:
       - name: storage
         ipv4:
           allocationEnd: 172.18.0.250
           allocationStart: 172.18.0.10
           cidr: 172.18.0.0/24
         vlan: 30
         attachConfiguration: br-osp
     - name: StorageMgmt
       nameLower: storage_mgmt
       mtu: 1500
       subnets:
       - name: storage_mgmt
         ipv4:
           allocationEnd: 172.19.0.250
           allocationStart: 172.19.0.10
           cidr: 172.19.0.0/24
         vlan: 40
         attachConfiguration: br-osp
     - name: Tenant
       nameLower: tenant
       vip: False
       mtu: 1500
       subnets:
       - name: tenant
         ipv4:
           allocationEnd: 172.20.0.250
           allocationStart: 172.20.0.10
           cidr: 172.20.0.0/24
         vlan: 50
         attachConfiguration: br-osp

   Copy to Clipboard Toggle word wrap

   当您将 VLAN 用于 linux-bridge 时，会出现以下情况：

   • director Operator 为资源中指定的网桥接口创建一个 Node Network Configuration 策略，它使用 nmstate 在 worker 节点上配置桥接。
   • director Operator 为每个网络创建一个 Network Attach Definition，用于定义 Multus CNI 插件配置。当您在 Network Attach Definition 中指定 VLAN ID 时，Multus CNI 插件会在网桥上启用 vlan-filtering。
   • director Operator 附加虚拟机上每个网络的专用接口。这意味着，OpenStackVMSet 的网络模板是一个多 NIC 网络模板。

   在资源规格中设置以下值：

   metadata.name

   将 设置为 OpenStackNetConfig 的名称。

   spec

   设置用于附加网络和网络特定网络配置。有关本节中可以使用的值的描述，请查看 openstacknetconfig CRD 的自定义资源定义中的规格模式：

   $ oc describe crd openstacknetconfig

   Copy to Clipboard Toggle word wrap

   配置完网络规格后保存文件。

2. 创建网络配置：

   $ oc apply -f openstacknetconfig.yaml -n openstack

   Copy to Clipboard Toggle word wrap

验证

1. 查看 OpenStackNetConfig API 并创建的子资源：

   $ oc get openstacknetconfig/openstacknetconfig -n openstack
   $ oc get openstacknetattachment -n openstack
   $ oc get openstacknet -n openstack

   Copy to Clipboard Toggle word wrap

   如果您看到错误，请检查底层 network-attach-definition 和 node 网络配置策略：

   $ oc get network-attachment-definitions -n openstack
   $ oc get nncp

   Copy to Clipboard Toggle word wrap