NSX-Policy: Support NSX policy in devstack
Code to support nsx policy in devstack Change-Id: I41a702c69d8869475e4f6dc9009fd63e88b62a9e Signed-off-by: Michal Kelner Mishali <mkelnermishal@vmware.com>
This commit is contained in:
Michal Kelner Mishali
Adit Sarfaty
parent
7270f8d9de
commit
0fd1424dda
@ -16,7 +16,7 @@
|
|||||||
# License for the specific language governing permissions and limitations
|
# License for the specific language governing permissions and limitations
|
||||||
# under the License.
|
# under the License.
|
||||||
|
|
||||||
# Common VMware NSXv and NSXv3 plugin
|
# Common VMware NSXv, NSXv3 and NSXp plugin
|
||||||
# -----------------------------------
|
# -----------------------------------
|
||||||
|
|
||||||
# ensure we don't re-source this in the same environment
|
# ensure we don't re-source this in the same environment
|
||||||
@ -118,6 +118,17 @@ function _nsxv3_ini_set {
|
|||||||
fi
|
fi
|
||||||
}
|
}
|
||||||
|
|
||||||
|
function _nsxp_ini_set {
|
||||||
|
if [[ -z $1 || -z $2 ]]; then
|
||||||
|
if [[ $3 != "" ]]; then
|
||||||
|
die $LINENO $3
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
if [[ $2 != "" ]]; then
|
||||||
|
iniset /$Q_PLUGIN_CONF_FILE nsx_p $1 $2
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
function nsxv3_configure_service {
|
function nsxv3_configure_service {
|
||||||
install_neutron_projects
|
install_neutron_projects
|
||||||
|
|
||||||
@ -167,100 +178,3 @@ function nsxv3_configure_service {
|
|||||||
_nsxv3_ini_set nsx_client_cert_pk_password "openstack"
|
_nsxv3_ini_set nsx_client_cert_pk_password "openstack"
|
||||||
fi
|
fi
|
||||||
}
|
}
|
||||||
|
|
||||||
function is_neutron_ovs_base_plugin {
|
|
||||||
if [ [ $1 == "nsx_v3" ] -o [ $1 == "nsx_p" ] ]; then
|
|
||||||
# This allows the deployer to decide whether devstack should install OVS.
|
|
||||||
# By default, we install OVS, to change this behavior add "OVS_BASE=1" to your localrc file.
|
|
||||||
# Note: Any KVM compute must have OVS installed on it.
|
|
||||||
return ${OVS_BASE:-0}
|
|
||||||
fi
|
|
||||||
}
|
|
||||||
|
|
||||||
function neutron_plugin_create_nova_conf {
|
|
||||||
if [ [ $1 == "nsx_v3" ] -o [ $1 == "nsx_p" ] ]; then
|
|
||||||
if [[ "$VIRT_DRIVER" != 'vsphere' ]]; then
|
|
||||||
# if n-cpu or octavia is enabled, then setup integration bridge
|
|
||||||
if is_service_enabled n-cpu || is_service_enabled octavia ; then
|
|
||||||
setup_integration_bridge
|
|
||||||
if is_service_enabled n-cpu ; then
|
|
||||||
iniset $NOVA_CONF neutron ovs_bridge $OVS_BRIDGE
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
# if n-api is enabled, then setup the metadata_proxy_shared_secret
|
|
||||||
if is_service_enabled n-api; then
|
|
||||||
iniset $NOVA_CONF neutron service_metadata_proxy True
|
|
||||||
if [[ "$NATIVE_DHCP_METADATA" == "True" ]]; then
|
|
||||||
iniset $NOVA_CONF neutron metadata_proxy_shared_secret $METADATA_PROXY_SHARED_SECRET
|
|
||||||
if [[ "$METADATA_PROXY_USE_HTTPS" == "True" ]]; then
|
|
||||||
iniset $NOVA_CONF DEFAULT enabled_ssl_apis metadata
|
|
||||||
if [[ "$METADATA_PROXY_CERT_FILE" != "" ]]; then
|
|
||||||
iniset $NOVA_CONF wsgi ssl_cert_file $METADATA_PROXY_CERT_FILE
|
|
||||||
fi
|
|
||||||
if [[ "$METADATA_PROXY_PRIV_KEY_FILE" != "" ]]; then
|
|
||||||
iniset $NOVA_CONF wsgi ssl_key_file $METADATA_PROXY_PRIV_KEY_FILE
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
# if n-api-meta is enabled, then setup https on n-api-meta
|
|
||||||
if is_service_enabled n-api-meta; then
|
|
||||||
if [[ "$NATIVE_DHCP_METADATA" == "True" && "$METADATA_PROXY_USE_HTTPS" == "True" ]]; then
|
|
||||||
inidelete $NOVA_METADATA_UWSGI_CONF uwsgi http
|
|
||||||
https=":8775,$METADATA_PROXY_CERT_FILE,$METADATA_PROXY_PRIV_KEY_FILE"
|
|
||||||
iniset $NOVA_METADATA_UWSGI_CONF uwsgi https $https
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
}
|
|
||||||
|
|
||||||
function neutron_plugin_configure_l3_agent {
|
|
||||||
if [ [ $1 == "nsx_v3" ] -o [ $1 == "nsx_p" ] ]; then
|
|
||||||
# VMware NSX plugin does not run L3 agent
|
|
||||||
die $LINENO "q-l3 should not be executed with VMware NSX plugin!"
|
|
||||||
fi
|
|
||||||
}
|
|
||||||
|
|
||||||
function neutron_plugin_configure_plugin_agent {
|
|
||||||
if [ [ $1 == "nsx_v3" ] -o [ $1 == "nsx_p" ] ]; then
|
|
||||||
# VMware NSX plugin does not run L2 agent
|
|
||||||
die $LINENO "q-agt must not be executed with VMware NSX plugin!"
|
|
||||||
fi
|
|
||||||
}
|
|
||||||
|
|
||||||
function get_bridge_up {
|
|
||||||
# NOTE(armando-migliaccio): if running in a nested environment this will work
|
|
||||||
# only with mac learning enabled, portsecurity and security profiles disabled
|
|
||||||
# The public bridge might not exist for the NSX plugin if Q_USE_DEBUG_COMMAND is off
|
|
||||||
# Try to create it anyway
|
|
||||||
sudo ovs-vsctl --may-exist add-br $PUBLIC_BRIDGE
|
|
||||||
sudo ovs-vsctl --may-exist add-port $PUBLIC_BRIDGE $NSX_GATEWAY_NETWORK_INTERFACE
|
|
||||||
# Flush all existing addresses on public bridge
|
|
||||||
sudo ip addr flush dev $PUBLIC_BRIDGE
|
|
||||||
nsx_gw_net_if_mac=$(ip link show $NSX_GATEWAY_NETWORK_INTERFACE | awk '/ether/ {print $2}')
|
|
||||||
sudo ip link set address $nsx_gw_net_if_mac dev $PUBLIC_BRIDGE
|
|
||||||
for address in $addresses; do
|
|
||||||
sudo ip addr add dev $PUBLIC_BRIDGE $address
|
|
||||||
done
|
|
||||||
sudo ip addr add dev $PUBLIC_BRIDGE $NSX_GATEWAY_NETWORK_CIDR
|
|
||||||
sudo ip link set $PUBLIC_BRIDGE up
|
|
||||||
}
|
|
||||||
|
|
||||||
function set_nsx_gateway_network_cidr {
|
|
||||||
if ! is_set NSX_GATEWAY_NETWORK_CIDR; then
|
|
||||||
NSX_GATEWAY_NETWORK_CIDR=$PUBLIC_NETWORK_GATEWAY/${FLOATING_RANGE#*/}
|
|
||||||
echo "The IP address expected on $PUBLIC_BRIDGE was not specified. "
|
|
||||||
echo "Defaulting to "$NSX_GATEWAY_NETWORK_CIDR
|
|
||||||
fi
|
|
||||||
sudo ip addr del $NSX_GATEWAY_NETWORK_CIDR dev $PUBLIC_BRIDGE
|
|
||||||
# Save and then flush remaining addresses on the interface
|
|
||||||
addresses=$(ip addr show dev $PUBLIC_BRIDGE | grep inet | awk {'print $2'})
|
|
||||||
sudo ip addr flush $PUBLIC_BRIDGE
|
|
||||||
# Try to detach physical interface from PUBLIC_BRIDGE
|
|
||||||
sudo ovs-vsctl del-port $NSX_GATEWAY_NETWORK_INTERFACE
|
|
||||||
# Restore addresses on NSX_GATEWAY_NETWORK_INTERFACE
|
|
||||||
for address in $addresses; do
|
|
||||||
sudo ip addr add dev $NSX_GATEWAY_NETWORK_INTERFACE $address
|
|
||||||
done
|
|
||||||
}
|
|
||||||
|
|||||||
109
devstack/lib/nsx_v3_p_common
Normal file
109
devstack/lib/nsx_v3_p_common
Normal file
@ -0,0 +1,109 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
# Copyright 2018 VMware, Inc.
|
||||||
|
#
|
||||||
|
# All Rights Reserved
|
||||||
|
#
|
||||||
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||||
|
# not use this file except in compliance with the License. You may obtain
|
||||||
|
# a copy of the License at
|
||||||
|
#
|
||||||
|
# http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
#
|
||||||
|
# Unless required by applicable law or agreed to in writing, software
|
||||||
|
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||||
|
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
||||||
|
# License for the specific language governing permissions and limitations
|
||||||
|
# under the License.
|
||||||
|
|
||||||
|
# Common code for VMware NSXv3 and NSXp plugins which share the same backend
|
||||||
|
# --------------------------------------------------------------------------
|
||||||
|
|
||||||
|
function is_neutron_ovs_base_plugin {
|
||||||
|
# This allows the deployer to decide whether devstack should install OVS.
|
||||||
|
# By default, we install OVS, to change this behavior add "OVS_BASE=1" to your localrc file.
|
||||||
|
# Note: Any KVM compute must have OVS installed on it.
|
||||||
|
return ${OVS_BASE:-0}
|
||||||
|
}
|
||||||
|
|
||||||
|
function neutron_plugin_create_nova_conf {
|
||||||
|
if [[ "$VIRT_DRIVER" != 'vsphere' ]]; then
|
||||||
|
# if n-cpu or octavia is enabled, then setup integration bridge
|
||||||
|
if is_service_enabled n-cpu || is_service_enabled octavia ; then
|
||||||
|
setup_integration_bridge
|
||||||
|
if is_service_enabled n-cpu ; then
|
||||||
|
iniset $NOVA_CONF neutron ovs_bridge $OVS_BRIDGE
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
# if n-api is enabled, then setup the metadata_proxy_shared_secret
|
||||||
|
if is_service_enabled n-api; then
|
||||||
|
iniset $NOVA_CONF neutron service_metadata_proxy True
|
||||||
|
if [[ "$NATIVE_DHCP_METADATA" == "True" ]]; then
|
||||||
|
iniset $NOVA_CONF neutron metadata_proxy_shared_secret $METADATA_PROXY_SHARED_SECRET
|
||||||
|
if [[ "$METADATA_PROXY_USE_HTTPS" == "True" ]]; then
|
||||||
|
iniset $NOVA_CONF DEFAULT enabled_ssl_apis metadata
|
||||||
|
if [[ "$METADATA_PROXY_CERT_FILE" != "" ]]; then
|
||||||
|
iniset $NOVA_CONF wsgi ssl_cert_file $METADATA_PROXY_CERT_FILE
|
||||||
|
fi
|
||||||
|
if [[ "$METADATA_PROXY_PRIV_KEY_FILE" != "" ]]; then
|
||||||
|
iniset $NOVA_CONF wsgi ssl_key_file $METADATA_PROXY_PRIV_KEY_FILE
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
# if n-api-meta is enabled, then setup https on n-api-meta
|
||||||
|
if is_service_enabled n-api-meta; then
|
||||||
|
if [[ "$NATIVE_DHCP_METADATA" == "True" && "$METADATA_PROXY_USE_HTTPS" == "True" ]]; then
|
||||||
|
inidelete $NOVA_METADATA_UWSGI_CONF uwsgi http
|
||||||
|
https=":8775,$METADATA_PROXY_CERT_FILE,$METADATA_PROXY_PRIV_KEY_FILE"
|
||||||
|
iniset $NOVA_METADATA_UWSGI_CONF uwsgi https $https
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
function neutron_plugin_configure_l3_agent {
|
||||||
|
# VMware NSX plugin does not run L3 agent
|
||||||
|
die $LINENO "q-l3 should not be executed with VMware NSX plugin!"
|
||||||
|
}
|
||||||
|
|
||||||
|
function neutron_plugin_configure_plugin_agent {
|
||||||
|
# VMware NSX plugin does not run L2 agent
|
||||||
|
die $LINENO "q-agt must not be executed with VMware NSX plugin!"
|
||||||
|
}
|
||||||
|
|
||||||
|
function get_bridge_up {
|
||||||
|
# NOTE(armando-migliaccio): if running in a nested environment this will work
|
||||||
|
# only with mac learning enabled, portsecurity and security profiles disabled
|
||||||
|
# The public bridge might not exist for the NSX plugin if Q_USE_DEBUG_COMMAND is off
|
||||||
|
# Try to create it anyway
|
||||||
|
sudo ovs-vsctl --may-exist add-br $PUBLIC_BRIDGE
|
||||||
|
sudo ovs-vsctl --may-exist add-port $PUBLIC_BRIDGE $NSX_GATEWAY_NETWORK_INTERFACE
|
||||||
|
# Flush all existing addresses on public bridge
|
||||||
|
sudo ip addr flush dev $PUBLIC_BRIDGE
|
||||||
|
nsx_gw_net_if_mac=$(ip link show $NSX_GATEWAY_NETWORK_INTERFACE | awk '/ether/ {print $2}')
|
||||||
|
sudo ip link set address $nsx_gw_net_if_mac dev $PUBLIC_BRIDGE
|
||||||
|
for address in $addresses; do
|
||||||
|
sudo ip addr add dev $PUBLIC_BRIDGE $address
|
||||||
|
done
|
||||||
|
sudo ip addr add dev $PUBLIC_BRIDGE $NSX_GATEWAY_NETWORK_CIDR
|
||||||
|
sudo ip link set $PUBLIC_BRIDGE up
|
||||||
|
}
|
||||||
|
|
||||||
|
function set_nsx_gateway_network_cidr {
|
||||||
|
if ! is_set NSX_GATEWAY_NETWORK_CIDR; then
|
||||||
|
NSX_GATEWAY_NETWORK_CIDR=$PUBLIC_NETWORK_GATEWAY/${FLOATING_RANGE#*/}
|
||||||
|
echo "The IP address expected on $PUBLIC_BRIDGE was not specified. "
|
||||||
|
echo "Defaulting to "$NSX_GATEWAY_NETWORK_CIDR
|
||||||
|
fi
|
||||||
|
sudo ip addr del $NSX_GATEWAY_NETWORK_CIDR dev $PUBLIC_BRIDGE
|
||||||
|
# Save and then flush remaining addresses on the interface
|
||||||
|
addresses=$(ip addr show dev $PUBLIC_BRIDGE | grep inet | awk {'print $2'})
|
||||||
|
sudo ip addr flush $PUBLIC_BRIDGE
|
||||||
|
# Try to detach physical interface from PUBLIC_BRIDGE
|
||||||
|
sudo ovs-vsctl del-port $NSX_GATEWAY_NETWORK_INTERFACE
|
||||||
|
# Restore addresses on NSX_GATEWAY_NETWORK_INTERFACE
|
||||||
|
for address in $addresses; do
|
||||||
|
sudo ip addr add dev $NSX_GATEWAY_NETWORK_INTERFACE $address
|
||||||
|
done
|
||||||
|
}
|
||||||
243
devstack/lib/vmware_nsx_p
Normal file
243
devstack/lib/vmware_nsx_p
Normal file
@ -0,0 +1,243 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
# Copyright 2018 VMware, Inc.
|
||||||
|
#
|
||||||
|
# All Rights Reserved
|
||||||
|
#
|
||||||
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||||
|
# not use this file except in compliance with the License. You may obtain
|
||||||
|
# a copy of the License at
|
||||||
|
#
|
||||||
|
# http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
#
|
||||||
|
# Unless required by applicable law or agreed to in writing, software
|
||||||
|
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||||
|
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
||||||
|
# License for the specific language governing permissions and limitations
|
||||||
|
# under the License.
|
||||||
|
|
||||||
|
|
||||||
|
# Neutron VMware NSX plugin
|
||||||
|
# -------------------------
|
||||||
|
|
||||||
|
# Settings previously defined in devstack:lib/neutron-legacy
|
||||||
|
NEUTRON_CONF_DIR=/etc/neutron
|
||||||
|
export NEUTRON_TEST_CONFIG_FILE=${NEUTRON_TEST_CONFIG_FILE:-"$NEUTRON_CONF_DIR/debug.ini"}
|
||||||
|
Q_DHCP_CONF_FILE=$NEUTRON_CONF_DIR/dhcp_agent.ini
|
||||||
|
|
||||||
|
# The interface which has connectivity to the NSX Gateway uplink
|
||||||
|
NSX_GATEWAY_NETWORK_INTERFACE=${NSX_GATEWAY_NETWORK_INTERFACE:-}
|
||||||
|
|
||||||
|
# Override default 'True' in devstack:lib/neutron_plugins/services/l3
|
||||||
|
Q_USE_PROVIDERNET_FOR_PUBLIC=False
|
||||||
|
|
||||||
|
# Native support from platform
|
||||||
|
NATIVE_DHCP_METADATA=${NATIVE_DHCP_METADATA:-True}
|
||||||
|
NATIVE_METADATA_ROUTE=${NATIVE_METADATA_ROUTE:-169.254.169.254/31}
|
||||||
|
METADATA_PROXY_SHARED_SECRET=${METADATA_PROXY_SHARED_SECRET:-}
|
||||||
|
|
||||||
|
# Save trace setting
|
||||||
|
NSX_XTRACE=$(set +o | grep xtrace)
|
||||||
|
set +o xtrace
|
||||||
|
|
||||||
|
# File to store client certificate and PK
|
||||||
|
CLIENT_CERT_FILE=${DEST}/data/neutron/client.pem
|
||||||
|
|
||||||
|
source $TOP_DIR/lib/neutron_plugins/ovs_base
|
||||||
|
dir=${GITDIR['vmware-nsx']}/devstack
|
||||||
|
source $dir/lib/nsx_common
|
||||||
|
source $dir/lib/nsx_v3_p_common
|
||||||
|
|
||||||
|
|
||||||
|
function _version { echo "$@" | awk -F. '{ printf("%d%03d%03d%03d\n", $1,$2,$3,$4); }'; }
|
||||||
|
|
||||||
|
function _ovsdb_connection {
|
||||||
|
managers=(${NSX_POLICY//,/ })
|
||||||
|
NSX_POLICY_IP=${managers[0]}
|
||||||
|
NSX_VER=$(curl -1 -s -k -u "$NSX_USER:$NSX_PASSWORD" -H 'Accept: application/json' https://$NSX_POLICY_IP/api/v1/node | python -c 'import sys, json; print json.load(sys.stdin)["node_version"][:5]')
|
||||||
|
if [ $(_version $NSX_VER) -ge $(_version 1.1.0) ]; then
|
||||||
|
echo "unix:/var/run/vmware/nsx-agent/nsxagent_ovsdb.sock"
|
||||||
|
else
|
||||||
|
echo "tcp:127.0.0.1:6632"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
function setup_integration_bridge {
|
||||||
|
die_if_not_set $LINENO NSX_POLICY "NSX_POLICY has not been set!"
|
||||||
|
die_if_not_set $LINENO NSX_USER "NSX_USER has not been set!"
|
||||||
|
die_if_not_set $LINENO NSX_PASSWORD "NSX_PASSWORD has not been set!"
|
||||||
|
# Ensure that the OVS params are set for the OVS utils
|
||||||
|
iniset $NEUTRON_CONF DEFAULT ovs_integration_bridge $OVS_BRIDGE
|
||||||
|
iniset $NEUTRON_CONF OVS ovsdb_connection $(_ovsdb_connection)
|
||||||
|
iniset $NEUTRON_CONF OVS ovsdb_interface vsctl
|
||||||
|
_neutron_ovs_base_setup_bridge $OVS_BRIDGE
|
||||||
|
sudo ovs-vsctl set bridge $OVS_BRIDGE external_ids:bridge-id=nsx-managed
|
||||||
|
sudo ovs-vsctl set-manager $(_ovsdb_connection)
|
||||||
|
}
|
||||||
|
|
||||||
|
function is_neutron_ovs_base_plugin {
|
||||||
|
# This allows the deployer to decide whether devstack should install OVS.
|
||||||
|
# By default, we install OVS, to change this behavior add "OVS_BASE=1" to your localrc file.
|
||||||
|
# Note: Any KVM compute must have OVS installed on it.
|
||||||
|
return ${OVS_BASE:-0}
|
||||||
|
}
|
||||||
|
|
||||||
|
function neutron_plugin_create_nova_conf {
|
||||||
|
if [[ "$VIRT_DRIVER" != 'vsphere' ]]; then
|
||||||
|
# if n-cpu or octavia is enabled, then setup integration bridge
|
||||||
|
if is_service_enabled n-cpu || is_service_enabled octavia ; then
|
||||||
|
setup_integration_bridge
|
||||||
|
if is_service_enabled n-cpu ; then
|
||||||
|
iniset $NOVA_CONF neutron ovs_bridge $OVS_BRIDGE
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
# if n-api is enabled, then setup the metadata_proxy_shared_secret
|
||||||
|
if is_service_enabled n-api; then
|
||||||
|
iniset $NOVA_CONF neutron service_metadata_proxy True
|
||||||
|
if [[ "$NATIVE_DHCP_METADATA" == "True" ]]; then
|
||||||
|
iniset $NOVA_CONF neutron metadata_proxy_shared_secret $METADATA_PROXY_SHARED_SECRET
|
||||||
|
if [[ "$METADATA_PROXY_USE_HTTPS" == "True" ]]; then
|
||||||
|
iniset $NOVA_CONF DEFAULT enabled_ssl_apis metadata
|
||||||
|
if [[ "$METADATA_PROXY_CERT_FILE" != "" ]]; then
|
||||||
|
iniset $NOVA_CONF wsgi ssl_cert_file $METADATA_PROXY_CERT_FILE
|
||||||
|
fi
|
||||||
|
if [[ "$METADATA_PROXY_PRIV_KEY_FILE" != "" ]]; then
|
||||||
|
iniset $NOVA_CONF wsgi ssl_key_file $METADATA_PROXY_PRIV_KEY_FILE
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
# if n-api-meta is enabled, then setup https on n-api-meta
|
||||||
|
if is_service_enabled n-api-meta; then
|
||||||
|
if [[ "$NATIVE_DHCP_METADATA" == "True" && "$METADATA_PROXY_USE_HTTPS" == "True" ]]; then
|
||||||
|
inidelete $NOVA_METADATA_UWSGI_CONF uwsgi http
|
||||||
|
https=":8775,$METADATA_PROXY_CERT_FILE,$METADATA_PROXY_PRIV_KEY_FILE"
|
||||||
|
iniset $NOVA_METADATA_UWSGI_CONF uwsgi https $https
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
function neutron_plugin_install_agent_packages {
|
||||||
|
# VMware NSX Plugin does not run q-agt, but it currently needs dhcp and metadata agents
|
||||||
|
_neutron_ovs_base_install_agent_packages
|
||||||
|
}
|
||||||
|
|
||||||
|
function neutron_plugin_configure_common {
|
||||||
|
Q_PLUGIN_CONF_PATH=etc/neutron/plugins/vmware
|
||||||
|
Q_PLUGIN_CONF_FILENAME=nsx.ini
|
||||||
|
Q_PLUGIN_SRC_CONF_PATH=vmware-nsx/etc
|
||||||
|
VMWARE_NSX_DIR=vmware-nsx
|
||||||
|
# Uses oslo config generator to generate sample configuration file
|
||||||
|
(cd $DEST/$VMWARE_NSX_DIR && exec ./tools/generate_config_file_samples.sh)
|
||||||
|
mkdir -p /$Q_PLUGIN_CONF_PATH
|
||||||
|
cp $DEST/$Q_PLUGIN_SRC_CONF_PATH/nsx.ini.sample /$Q_PLUGIN_CONF_PATH/$Q_PLUGIN_CONF_FILENAME
|
||||||
|
sudo install -d -o $STACK_USER $NEUTRON_CONF_DIR/policy.d
|
||||||
|
cp -vr $DEST/$Q_PLUGIN_SRC_CONF_PATH/policy.d/* $NEUTRON_CONF_DIR/policy.d/
|
||||||
|
Q_PLUGIN_CLASS="vmware_nsxp"
|
||||||
|
}
|
||||||
|
|
||||||
|
function neutron_plugin_configure_debug_command {
|
||||||
|
sudo ovs-vsctl --no-wait -- --may-exist add-br $PUBLIC_BRIDGE
|
||||||
|
iniset $NEUTRON_TEST_CONFIG_FILE DEFAULT external_network_bridge "$PUBLIC_BRIDGE"
|
||||||
|
}
|
||||||
|
|
||||||
|
function neutron_plugin_configure_dhcp_agent {
|
||||||
|
setup_integration_bridge
|
||||||
|
iniset $Q_DHCP_CONF_FILE DEFAULT enable_isolated_metadata True
|
||||||
|
iniset $Q_DHCP_CONF_FILE DEFAULT enable_metadata_network True
|
||||||
|
iniset $Q_DHCP_CONF_FILE DEFAULT ovs_use_veth True
|
||||||
|
iniset $Q_DHCP_CONF_FILE DEFAULT ovs_integration_bridge $OVS_BRIDGE
|
||||||
|
iniset $Q_DHCP_CONF_FILE OVS ovsdb_connection $(_ovsdb_connection)
|
||||||
|
iniset $Q_DHCP_CONF_FILE OVS ovsdb_interface vsctl
|
||||||
|
}
|
||||||
|
|
||||||
|
function neutron_plugin_configure_l3_agent {
|
||||||
|
# VMware NSX plugin does not run L3 agent
|
||||||
|
die $LINENO "q-l3 should not be executed with VMware NSX plugin!"
|
||||||
|
}
|
||||||
|
|
||||||
|
function neutron_plugin_configure_plugin_agent {
|
||||||
|
# VMware NSX plugin does not run L2 agent
|
||||||
|
die $LINENO "q-agt must not be executed with VMware NSX plugin!"
|
||||||
|
}
|
||||||
|
|
||||||
|
function neutron_plugin_configure_service {
|
||||||
|
nsxp_configure_service nsx_p
|
||||||
|
iniset /$Q_PLUGIN_CONF_FILE DEFAULT nsx_extension_drivers vmware_nsxp_dns
|
||||||
|
}
|
||||||
|
|
||||||
|
function neutron_plugin_setup_interface_driver {
|
||||||
|
local conf_file=$1
|
||||||
|
iniset $conf_file DEFAULT interface_driver neutron.agent.linux.interface.OVSInterfaceDriver
|
||||||
|
}
|
||||||
|
|
||||||
|
function neutron_plugin_check_adv_test_requirements {
|
||||||
|
is_service_enabled q-dhcp && return 0
|
||||||
|
}
|
||||||
|
|
||||||
|
function nsxp_configure_service {
|
||||||
|
install_neutron_projects
|
||||||
|
if [[ "$DEFAULT_TIER0_ROUTER_UUID" != "" ]]; then
|
||||||
|
_nsxp_ini_set default_tier0_router $DEFAULT_TIER0_ROUTER_UUID
|
||||||
|
Q_L3_ENABLED=True
|
||||||
|
Q_L3_ROUTER_PER_TENANT=True
|
||||||
|
fi
|
||||||
|
# NSX_POLICY must be a comma separated string
|
||||||
|
if [[ "$NSX_POLICIES" != "" ]]; then
|
||||||
|
_nsxp_ini_set nsx_api_managers $NSX_POLICIES
|
||||||
|
elif [[ "$NSX_POLICY" != "" ]]; then
|
||||||
|
_nsxp_ini_set nsx_api_managers $NSX_POLICY
|
||||||
|
else
|
||||||
|
if [[ $1 == "nsx_p" ]]; then
|
||||||
|
die $LINENO "The VMware nsx-p plugin needs at least one NSX policy manager."
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
if [[ "$NSX_L2GW_DRIVER" != "" ]]; then
|
||||||
|
iniset /$Q_PLUGIN_CONF_FILE DEFAULT nsx_l2gw_driver $NSX_L2GW_DRIVER
|
||||||
|
fi
|
||||||
|
_nsxp_ini_set nsx_api_user $NSX_USER
|
||||||
|
_nsxp_ini_set nsx_api_password $NSX_PASSWORD
|
||||||
|
_nsxp_ini_set retries $NSX_RETRIES
|
||||||
|
_nsxp_ini_set insecure $NSX_INSECURE
|
||||||
|
_nsxp_ini_set ca_file $NSX_CA_FILE
|
||||||
|
}
|
||||||
|
|
||||||
|
function init_vmware_nsx_p {
|
||||||
|
# Generate client certificate
|
||||||
|
if [[ "$NSX_USE_CLIENT_CERT_AUTH" == "True" ]]; then
|
||||||
|
nsxadmin -o generate -r certificate
|
||||||
|
fi
|
||||||
|
if ! is_set NSX_GATEWAY_NETWORK_INTERFACE; then
|
||||||
|
echo "NSX_GATEWAY_NETWORK_INTERFACE not set not configuring routes"
|
||||||
|
return
|
||||||
|
fi
|
||||||
|
|
||||||
|
if ! is_set NSX_GATEWAY_NETWORK_CIDR; then
|
||||||
|
NSX_GATEWAY_NETWORK_CIDR=$PUBLIC_NETWORK_GATEWAY/${FLOATING_RANGE#*/}
|
||||||
|
echo "The IP address to set on $PUBLIC_BRIDGE was not specified. "
|
||||||
|
echo "Defaulting to $NSX_GATEWAY_NETWORK_CIDR"
|
||||||
|
fi
|
||||||
|
# Make sure the interface is up, but not configured
|
||||||
|
sudo ip link set $NSX_GATEWAY_NETWORK_INTERFACE up
|
||||||
|
# Save and then flush the IP addresses on the interface
|
||||||
|
addresses=$(ip addr show dev $NSX_GATEWAY_NETWORK_INTERFACE | grep inet | awk {'print $2'})
|
||||||
|
sudo ip addr flush $NSX_GATEWAY_NETWORK_INTERFACE
|
||||||
|
# Use the PUBLIC Bridge to route traffic to the NSX gateway
|
||||||
|
get_bridge_up
|
||||||
|
}
|
||||||
|
|
||||||
|
function stop_vmware_nsx_p {
|
||||||
|
# Clean client certificate if exists
|
||||||
|
nsxadmin -o clean -r certificate
|
||||||
|
|
||||||
|
if ! is_set NSX_GATEWAY_NETWORK_INTERFACE; then
|
||||||
|
echo "NSX_GATEWAY_NETWORK_INTERFACE was not configured."
|
||||||
|
return
|
||||||
|
fi
|
||||||
|
|
||||||
|
set_nsx_gateway_network_cidr
|
||||||
|
}
|
||||||
|
|
||||||
|
# Restore xtrace
|
||||||
|
$NSX_XTRACE
|
||||||
@ -46,6 +46,7 @@ CLIENT_CERT_FILE=${DEST}/data/neutron/client.pem
|
|||||||
source $TOP_DIR/lib/neutron_plugins/ovs_base
|
source $TOP_DIR/lib/neutron_plugins/ovs_base
|
||||||
dir=${GITDIR['vmware-nsx']}/devstack
|
dir=${GITDIR['vmware-nsx']}/devstack
|
||||||
source $dir/lib/nsx_common
|
source $dir/lib/nsx_common
|
||||||
|
source $dir/lib/nsx_v3_p_common
|
||||||
|
|
||||||
|
|
||||||
function _version { echo "$@" | awk -F. '{ printf("%d%03d%03d%03d\n", $1,$2,$3,$4); }'; }
|
function _version { echo "$@" | awk -F. '{ printf("%d%03d%03d%03d\n", $1,$2,$3,$4); }'; }
|
||||||
|
|||||||
16
devstack/localrc_nsx_p
Normal file
16
devstack/localrc_nsx_p
Normal file
@ -0,0 +1,16 @@
|
|||||||
|
enable_plugin vmware-nsx https://git.openstack.org/openstack/vmware-nsx
|
||||||
|
ENABLED_SERVICES=g-api,g-reg,key,n-api,n-crt,n-obj,n-cpu,n-sch,n-cond,n-cauth,horizon,mysql,rabbit,sysstat,quantum,q-svc,q-dhcp,n-novnc,n-xvnc
|
||||||
|
DATABASE_PASSWORD=password
|
||||||
|
RABBIT_PASSWORD=password
|
||||||
|
SERVICE_TOKEN=password
|
||||||
|
SERVICE_PASSWORD=password
|
||||||
|
ADMIN_PASSWORD=password
|
||||||
|
Q_PLUGIN=vmware_nsx_p
|
||||||
|
NSX_PASSWORD=Admin!23Admin
|
||||||
|
DEFAULT_OVERLAY_TZ_UUID=<FILL_IN>
|
||||||
|
EDGE_CLUSTER_UUID=<FILL_IN>
|
||||||
|
NSX_MANAGER=<FILL_IN>
|
||||||
|
NSX_CONTROLLERS=<FILL_IN>
|
||||||
|
DHCP_PROFILE_UUID=<FILL_IN>
|
||||||
|
METADATA_PROXY_UUID=<FILL_IN>
|
||||||
|
DHCP_RELAY_SERVICE=<FILL_IN>
|
||||||
24
devstack/nsx_p/devstackgaterc
Normal file
24
devstack/nsx_p/devstackgaterc
Normal file
@ -0,0 +1,24 @@
|
|||||||
|
# Copyright 2018 VMware, Inc.
|
||||||
|
#
|
||||||
|
# All Rights Reserved
|
||||||
|
#
|
||||||
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||||
|
# not use this file except in compliance with the License. You may obtain
|
||||||
|
# a copy of the License at
|
||||||
|
#
|
||||||
|
# http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
#
|
||||||
|
# Unless required by applicable law or agreed to in writing, software
|
||||||
|
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||||
|
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
||||||
|
# License for the specific language governing permissions and limitations
|
||||||
|
# under the License.
|
||||||
|
|
||||||
|
|
||||||
|
# This file is sourced by the NSX-p CI to run selective set of tests
|
||||||
|
# based on the features that are ready to be tested.
|
||||||
|
|
||||||
|
# Begin list of exclusions.
|
||||||
|
r="^(?!.*)"
|
||||||
|
|
||||||
|
export DEVSTACK_GATE_TEMPEST_REGEX="$r"
|
||||||
@ -108,4 +108,24 @@ elif [[ $Q_PLUGIN == 'vmware_nsx_tvd' ]]; then
|
|||||||
fi
|
fi
|
||||||
elif [[ $Q_PLUGIN == 'vmware_dvs' ]]; then
|
elif [[ $Q_PLUGIN == 'vmware_dvs' ]]; then
|
||||||
source $dir/lib/vmware_dvs
|
source $dir/lib/vmware_dvs
|
||||||
|
elif [[ $Q_PLUGIN == 'vmware_nsx_p' ]]; then
|
||||||
|
source $dir/lib/vmware_nsx_p
|
||||||
|
if [[ "$1" == "stack" && "$2" == "post-config" ]]; then
|
||||||
|
init_vmware_nsx_p
|
||||||
|
elif [[ "$1" == "unstack" ]]; then
|
||||||
|
db_connection=$(iniget $NEUTRON_CONF database connection)
|
||||||
|
stop_vmware_nsx_p
|
||||||
|
# only clean up when q-svc (legacy support) or neutron-api is enabled
|
||||||
|
if is_service_enabled q-svc || is_service_enabled neutron-api; then
|
||||||
|
NSX_POLICY=${NSX_POLICIES:-$NSX_POLICY}
|
||||||
|
IFS=','
|
||||||
|
NSX_POLICY=($NSX_POLICY)
|
||||||
|
unset IFS
|
||||||
|
$PYTHON $dir/tools/nsxp_cleanup.py --mgr-ip $NSX_POLICY --user $NSX_USER --password $NSX_PASSWORD --db-connection $db_connection
|
||||||
|
fi
|
||||||
|
elif [[ "$1" == 'clean' ]]; then
|
||||||
|
if is_service_enabled q-svc || is_service_enabled neutron-api; then
|
||||||
|
$PYTHON $dir/tools/nsxp_cleanup.py --mgr-ip $NSX_POLICY --user $NSX_USER --password $NSX_PASSWORD
|
||||||
|
fi
|
||||||
|
fi
|
||||||
fi
|
fi
|
||||||
|
|||||||
90
devstack/tools/nsxp_cleanup.py
Executable file
90
devstack/tools/nsxp_cleanup.py
Executable file
@ -0,0 +1,90 @@
|
|||||||
|
# Copyright 2018 VMware Inc
|
||||||
|
# All Rights Reserved
|
||||||
|
#
|
||||||
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||||
|
# not use this file except in compliance with the License. You may obtain
|
||||||
|
# a copy of the License at
|
||||||
|
#
|
||||||
|
# http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
#
|
||||||
|
# Unless required by applicable law or agreed to in writing, software
|
||||||
|
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||||
|
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
||||||
|
# License for the specific language governing permissions and limitations
|
||||||
|
# under the License.
|
||||||
|
|
||||||
|
import optparse
|
||||||
|
|
||||||
|
import sqlalchemy as sa
|
||||||
|
|
||||||
|
from vmware_nsxlib import v3
|
||||||
|
from vmware_nsxlib.v3 import config
|
||||||
|
|
||||||
|
|
||||||
|
class NeutronNsxDB(object):
|
||||||
|
def __init__(self, db_connection):
|
||||||
|
super(NeutronNsxDB, self).__init__()
|
||||||
|
engine = sa.create_engine(db_connection)
|
||||||
|
self.session = sa.orm.session.sessionmaker()(bind=engine)
|
||||||
|
|
||||||
|
def query_all(self, column, model):
|
||||||
|
return list(set([r[column] for r in self.session.query(model).all()]))
|
||||||
|
|
||||||
|
|
||||||
|
class NSXClient(object):
|
||||||
|
"""Base NSX REST client"""
|
||||||
|
API_VERSION = "v1"
|
||||||
|
NULL_CURSOR_PREFIX = '0000'
|
||||||
|
|
||||||
|
def __init__(self, host, username, password, db_connection):
|
||||||
|
self.host = host
|
||||||
|
self.username = username
|
||||||
|
self.password = password
|
||||||
|
self.neutron_db = (NeutronNsxDB(db_connection)
|
||||||
|
if db_connection else None)
|
||||||
|
|
||||||
|
nsxlib_config = config.NsxLibConfig(
|
||||||
|
username=self.username,
|
||||||
|
password=self.password,
|
||||||
|
nsx_api_managers=[self.host],
|
||||||
|
# allow admin user to delete entities created
|
||||||
|
# under openstack principal identity
|
||||||
|
allow_overwrite_header=True)
|
||||||
|
self.nsxlib = v3.NsxPolicyLib(nsxlib_config)
|
||||||
|
|
||||||
|
def cleanup_all(self):
|
||||||
|
"""
|
||||||
|
Cleanup steps:
|
||||||
|
- Firewall sections
|
||||||
|
- NSGroups
|
||||||
|
- VPN objects
|
||||||
|
- Loadbalancer objects
|
||||||
|
- Logical router and their ports
|
||||||
|
- Logical Tier 0 routers ports
|
||||||
|
- Logical switch ports
|
||||||
|
- Logical switches
|
||||||
|
- DHCP servers
|
||||||
|
- Switching profiles
|
||||||
|
"""
|
||||||
|
return
|
||||||
|
|
||||||
|
|
||||||
|
if __name__ == "__main__":
|
||||||
|
|
||||||
|
parser = optparse.OptionParser()
|
||||||
|
parser.add_option("--policy-ip", dest="policy_ip", help="NSX Policy IP "
|
||||||
|
"address")
|
||||||
|
parser.add_option("-u", "--username", default="admin", dest="username",
|
||||||
|
help="NSX Policy username")
|
||||||
|
parser.add_option("-p", "--password", default="default", dest="password",
|
||||||
|
help="NSX Policy password")
|
||||||
|
parser.add_option("--db-connection", default="", dest="db_connection",
|
||||||
|
help=("When set, cleaning only backend resources that "
|
||||||
|
"have db record."))
|
||||||
|
(options, args) = parser.parse_args()
|
||||||
|
|
||||||
|
# Get NSX REST client
|
||||||
|
nsx_client = NSXClient(options.policy_ip, options.username,
|
||||||
|
options.password, options.db_connection)
|
||||||
|
# Clean all objects created by OpenStack
|
||||||
|
nsx_client.cleanup_all()
|
||||||
Loading…
x
Reference in New Issue
Block a user