I'm trying to get a multinode setup of Openstack Kolla to work over AWS.

In particular, I'm having trouble understanding Neutron networking and getting it to work properly in my AWS setup. E.g. even after using the tools/initi-runonce script provided by kolla I can't ping a VM instance.

I'll start by describing the immediate problem, providing more details below. In general, I'd appreciate if you could follow what I'm doing and tell me what I'm doing wrong, what could be wrong, etc.

Thanks in advance!

DISCLAIMER: this question may contain "noob" talk & mistakes.

Main problem: Can't ping VMs using floating IP

After running kolla-ansible deploy and init-runonce' successfuly, I create one new m1.tiny instance and giving it a floating IP:

$ openstack server create --image cirros --flavor m1.tiny --nic net-id=$(neutron net-list | awk '/demo-net/ {print $2}') demo-instance

$ openstack server list
INFO: urllib3.connectionpool Starting new HTTP connection (1): 192.168.8.99
INFO: urllib3.connectionpool Starting new HTTP connection (1): 192.168.8.99
+--------------------------------------+---------------+--------+-------------------+
| ID                                   | Name          | Status | Networks          |
+--------------------------------------+---------------+--------+-------------------+
| 4a76515c-3b47-44d2-b5c7-3ff25f25ac5a | demo-instance | ACTIVE | demo-net=10.0.0.3 |
+--------------------------------------+---------------+--------+-------------------+

$ nova floating-ip-create public1
+---------------+-----------+----------+---------+
| Ip            | Server Id | Fixed Ip | Pool    |
+---------------+-----------+----------+---------+
| 192.168.8.201 |           | -        | public1 |
+---------------+-----------+----------+---------+

$ nova add-floating-ip 4a76515c-3b47-44d2-b5c7-3ff25f25ac5a 192.168.8.201
$ nova list
+--------------------------------------+---------------+--------+------------+-------------+----------------------------------+
| ID                                   | Name          | Status | Task State | Power State | Networks                         |
+--------------------------------------+---------------+--------+------------+-------------+----------------------------------+
| 4a76515c-3b47-44d2-b5c7-3ff25f25ac5a | demo-instance | ACTIVE | -          | Running     | demo-net=10.0.0.3, 192.168.8.201 |
+--------------------------------------+---------------+--------+------------+-------------+----------------------------------+

When I try to ping the instance (from the deployment node), I get no response:

$ ping 192.168.8.201
PING 192.168.8.201 (192.168.8.201) 56(84) bytes of data.
From 192.168.8.20 icmp_seq=1 Destination Host Unreachable
(...)

In the end, this could all be a problem of a very strict default firewall policy in AWS. If there's someone out there who can give me some advice to handle these issues in an AWS context, it would be awesome.

Setup

I have the following setup:

                                             (...........)
                                            (   Internet  )
                                             (...........)
                                                   |
                                              -----o-----
                                              |   VPC   |
                                              -----------
                       +-------------------(192.168.8.0/24)--------------------+
                       |                           |                           |
                       |                           |                           |
Nova + Neutron node    |    Controller node        |    Deployment node        |
+----------------+     |    +----------------+     |    +----------------+     |
|                |     |    |                |     |    |                |     |
|           eth0 o-----+    |           eth0 o-----+    |           eth0 o-----+
| (192.168.8.18) |     |    | (192.168.8.19) |          | (192.168.8.20) |
|                |     |    |                |          |                |
|           eth1 o-----+    +----------------+          +----------------+
| (neutron ext.) |     
|                |     
+----------------+

Comments:

• The deployment node is where I run kolla-ansible, the openstack clients and a Docker registry for the kolla Docker images.

• I realize this not recommended for a multinode setup. E.g. the controller, compute and network nodes should be separated. In fact, if I had to join 2 of them, it would probably make more sense to join the network and controller nodes.

• Also, I've read that a "by-the-book" Openstack deployment should use 3 types of networks: management (for communication between OS services), external (access OS services/VMs from the outside) and VM data (for communication between VMs). Here I merge all of these in the same network.

Relevant kolla config files

Here I include the relevant definitions in the kolla config files. When appropriate, I also post some characteristics of the deployment which follow from these configurations ... (more)