Attachment 834236 Details for Bug 1010170 – Neutron configs on Controller and Compute nodes, for reference.

Neutron configs on Controller and Compute nodes, for reference.

neutron-configs.txt (text/plain), 8.12 KB, created by Kashyap Chamarthy on 2013-12-09 09:14:27 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Kashyap Chamarthy

Created: 2013-12-09 09:14:27 UTC

Size: 8.12 KB

patch

obsolete

>== On Controller ==
>1/ neutron.conf 
>------------------
>[root@ostack-controller neutron(keystone_kashyap)]$ cat neutron.conf | grep -v ^$ | grep -v ^#
>[DEFAULT]
>core_plugin =neutron.plugins.openvswitch.ovs_neutron_plugin.OVSNeutronPluginV2
>rpc_backend = neutron.openstack.common.rpc.impl_qpid
>control_exchange = neutron
>qpid_hostname = 192.169.142.118
>auth_strategy = keystone
>ovs_use_veth = True
>allow_overlapping_ips = True
>dhcp_lease_duration = 120
>allow_bulk = True
>qpid_port = 5672
>qpid_heartbeat = 60
>qpid_protocol = tcp
>qpid_tcp_nodelay = True
>qpid_reconnect_limit=0
>qpid_reconnect_interval_max=0
>qpid_reconnect_timeout=0
>qpid_reconnect=True
>qpid_reconnect_interval_min=0
>qpid_reconnect_interval=0
>debug = False
>verbose = True
>[quotas]
>[agent]
>[keystone_authtoken]
>admin_tenant_name = services
>admin_user = neutron
>admin_password = fedora
>auth_host = 192.169.142.118
>auth_port = 35357
>auth_protocol = http
>auth_uri=http://192.169.142.118:5000/
>[database]
>[service_providers]
>[AGENT]
>root_helper = sudo neutron-rootwrap /etc/neutron/rootwrap.conf
>[root@ostack-controller neutron(keystone_kashyap)]$ 
>------------------
>
>2/ OVS plugin.ini
>------------------
>[root@ostack-controller neutron(keystone_kashyap)]$ cat plugin.ini | grep -v ^$ | grep -v ^#
>[ovs]
>tenant_network_type = gre
>tunnel_id_ranges = 1:1000
>enable_tunneling = True
>integration_bridge = br-int
>tunnel_bridge = br-tun
>local_ip = 192.169.142.118
>[agent]
>[securitygroup]
>[DATABASE]
>sql_connection = mysql://neutron:fedora@localhost/ovs_neutron
>sql_max_retries=10
>reconnect_interval=2
>sql_idle_timeout=3600
>[SECURITYGROUP]
>firewall_driver = neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver
>------------------
>
>3/ dhcp_agent.ini:
>------------------
>[root@ostack-controller neutron(keystone_kashyap)]$ cat dhcp_agent.ini | grep -v ^$ | grep -v ^#
>[DEFAULT]
>interface_driver = neutron.agent.linux.interface.OVSInterfaceDriver
>handle_internal_only_routers = TRUE
>external_network_bridge = br-ex
>use_namespaces = True
>dnsmasq_config_file = /etc/neutron/dnsmasq.conf
>------------------
>
>4/ l3_agent.ini:
>------------------
>[root@ostack-controller neutron(keystone_kashyap)]$ cat l3_agent.ini | grep -v ^$ | grep -v ^#
>[DEFAULT]
>interface_driver = neutron.agent.linux.interface.OVSInterfaceDriver
>handle_internal_only_routers = TRUE
>use_namespaces = True
>metadata_ip = 192.169.142.118
>metadata_port = 8700
>------------------
>
>5/ dnsmasq log (So dnsmasq output is logged to a file, instead of journalctl):
>------------------
>[root@ostack-controller neutron(keystone_kashyap)]$ cat dnsmasq.conf 
>log-facility = /var/log/neutron/dnsmasq.log
>log-dhcp
>[root@ostack-controller neutron(keystone_kashyap)]$ 
>------------------
>
>6/ api-paste.ini
>------------------
>[root@ostack-controller neutron(keystone_kashyap)]$ cat api-paste.ini | grep -v ^$ | grep -v ^#
>[composite:neutron]
>use = egg:Paste#urlmap
>/: neutronversions
>/v2.0: neutronapi_v2_0
>[composite:neutronapi_v2_0]
>use = call:neutron.auth:pipeline_factory
>noauth = extensions neutronapiapp_v2_0
>keystone = authtoken keystonecontext extensions neutronapiapp_v2_0
>[filter:keystonecontext]
>paste.filter_factory = neutron.auth:NeutronKeystoneContext.factory
>[filter:authtoken]
>paste.filter_factory = keystoneclient.middleware.auth_token:filter_factory
>admin_user=neutron
>auth_port=35357
>admin_password=fedora
>auth_protocol=http
>auth_uri=http://192.169.142.118:5000/
>admin_tenant_name=services
>auth_host = 192.169.142.118
>[filter:extensions]
>paste.filter_factory = neutron.api.extensions:plugin_aware_extension_middleware_factory
>[app:neutronversions]
>paste.app_factory = neutron.api.versions:Versions.factory
>[app:neutronapiapp_v2_0]
>paste.app_factory = neutron.api.v2.router:APIRouter.factory
>[root@ostack-controller neutron(keystone_kashyap)]$ 
>------------------
>
>7/ metadata_agent.ini
>------------------
>[root@ostack-controller neutron(keystone_kashyap)]$ cat metadata_agent.ini | grep -v ^$ | grep -v ^#
>[DEFAULT]
>auth_url = http://192.169.142.118:35357/v2.0/
>auth_region = regionOne
>admin_tenant_name = services
>admin_user = neutron
>admin_password = fedora
>nova_metadata_ip = 192.168.142.118
>nova_metadata_port = 8700
>metadata_proxy_shared_secret = fedora
>[root@ostack-controller neutron(keystone_kashyap)]$ 
>------------------
>
>
>== On Compute ==
>
>NOTE: Only neutron.conf, plugin.ini, metadata_agent.ini
>
>1/ neutron.conf
>------------------
>[root@ostack-compute neutron(keystone_kashyap)]$ cat neutron.conf | grep -v ^$ | grep -v ^#
>[DEFAULT]
>core_plugin =neutron.plugins.openvswitch.ovs_neutron_plugin.OVSNeutronPluginV2
>rpc_backend = neutron.openstack.common.rpc.impl_qpid
>qpid_hostname = 192.169.142.118
>auth_strategy = keystone
>ovs_use_veth = True
>allow_overlapping_ips = True
>qpid_port = 5672
>debug = True
>verbose = True
>[quotas]
>[agent]
>[keystone_authtoken]
>admin_tenant_name = services
>admin_user = neutron
>admin_password = fedora
>auth_host = 192.169.142.118
>[database]
>[service_providers]
>[AGENT]
>root_helper = sudo neutron-rootwrap /etc/neutron/rootwrap.conf
>------------------
>
>2/ OVS plugin.ini
>------------------
>[root@ostack-compute neutron(keystone_kashyap)]$ cat plugin.ini | grep -v ^$ | grep -v ^#
>[ovs]
>tenant_network_type = gre
>tunnel_id_ranges = 1:1000
>enable_tunneling = True
>integration_bridge = br-int
>tunnel_bridge = br-tun
>local_ip = 192.169.142.209
>[agent]
>[securitygroup]
>[DATABASE]
>sql_connection = mysql://neutron:fedora@192.169.142.118/ovs_neutron
>[SECURITYGROUP]
>firewall_driver = neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver
>[root@ostack-compute neutron(keystone_kashyap)]$ 
>------------------
>
>3/ metadata_agent.ini
>------------------
>[root@ostack-compute neutron(keystone_kashyap)]$ cat metadata_agent.ini | grep -v ^$ | grep -v ^#
>[DEFAULT]
>auth_url = http://localhost:5000/v2.0
>auth_region = RegionOne
>admin_tenant_name = %SERVICE_TENANT_NAME%
>admin_user = %SERVICE_USER%
>admin_password = %SERVICE_PASSWORD%
>[root@ostack-compute neutron(keystone_kashyap)]$ 
>------------------
>
>
>== iptables on Controller & Compute ==
>
>1/ iptables on Controller
>------------------
>[root@ostack-controller ~]# cat /etc/sysconfig/iptables
>*filter
>:INPUT ACCEPT [0:0]
>:FORWARD ACCEPT [0:0]
>:OUTPUT ACCEPT [0:0]
>-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
>-A INPUT -p icmp -j ACCEPT
>-A INPUT -i lo -j ACCEPT
>-A INPUT -p tcp -m multiport --dports 3260 -m comment --comment "001 cinder incoming" -j ACCEPT 
>-A INPUT -p tcp -m multiport --dports 80 -m comment --comment "001 horizon incoming" -j ACCEPT 
>-A INPUT -p tcp -m multiport --dports 9292 -m comment --comment "001 glance incoming" -j ACCEPT 
>-A INPUT -p tcp -m multiport --dports 5000,35357 -m comment --comment "001 keystone incoming" -j ACCEPT 
>-A INPUT -p tcp -m multiport --dports 3306 -m comment --comment "001 mariadb incoming" -j ACCEPT 
>-A INPUT -p tcp -m multiport --dports 6080 -m comment --comment "001 novncproxy incoming" -j ACCEPT 
>-A INPUT -p tcp -m multiport --dports 8770:8780 -m comment --comment "001 novaapi incoming" -j ACCEPT 
>-A INPUT -p tcp -m multiport --dports 9696 -m comment --comment "001 neutron incoming" -j ACCEPT 
>-A INPUT -p tcp -m multiport --dports 5672 -m comment --comment "001 qpid incoming" -j ACCEPT 
>-A INPUT -p tcp -m multiport --dports 8700 -m comment --comment "001 metadata incoming" -j ACCEPT 
>-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
>-A INPUT -m state --state NEW -m tcp -p tcp --dport 5900:5999 -j ACCEPT
>-A INPUT -j REJECT --reject-with icmp-host-prohibited
>-A INPUT -p gre -j ACCEPT 
>-A OUTPUT -p gre -j ACCEPT
>-A FORWARD -j REJECT --reject-with icmp-host-prohibited
>COMMIT
>------------------
>
>2/ iptables on Compute
>------------------
>[root@ostack-compute ~(keystone_kashyap)]$ cat /etc/sysconfig/iptables
># Firewall configuration written by system-config-firewall
># Manual customization of this file is not recommended.
>*filter
>:INPUT ACCEPT [0:0]
>:FORWARD ACCEPT [0:0]
>:OUTPUT ACCEPT [0:0]
>-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
>-A INPUT -p icmp -j ACCEPT
>-A INPUT -i lo -j ACCEPT
>-A INPUT -m state --state NEW -m tcp -p tcp --dport 5900:5999 -j ACCEPT
>-A INPUT -p tcp --dport 22 -j ACCEPT
>-A INPUT -p gre -j ACCEPT 
>-A INPUT -j REJECT --reject-with icmp-host-prohibited
>-A OUTPUT -p gre -j ACCEPT
>-A FORWARD -j REJECT --reject-with icmp-host-prohibited
>COMMIT
>------------------

Actions: View

Attachments on bug 1010170: 834236