Micha's profile - activity

Unfortunatly I never digged deeper into that issue. I assume that the l3 agent is missing the functionality to load the user data from the config, but I'm not sure since I'm quite new to openstack.

1. No, you shouldn't. Do a manual setup with some kind of HAProxy in front. Administrating and updating OpenStack can be a fultime job, also it would be way to much hassle for a project that small. Maybe consider going to a public cloud provider like AWS or an OpenStack Provider like Open Telekom Cloud
   1. I would assume one Controller Node, atleast one Compute node and one Network node. Storage not taken into the consideration, for production probably something like Ceph, which would need about 5-10 Nodes.
   2. With three servers, probably Controller and Cinder, on one, Nova on another, and the third one for networking. On both sites obviously.
   3. In terms of storage? Usually with a distributed storage system like Ceph. I hope you have a 20-40Gbit link between your sites? Otherwise performance will be not prd. ready.
   4. Openstack does not care. Your ecommerce application needs to deal with that
   5. Yes. OpenStack is quite resiliant towards node outage, and Ceph also.

Seriously, DON'T use ptivate openstack in production for that. Please. And if you don't need to scale that much, even consider 'classic' VPS hosting at another provider.

Either Tenant Segregation or using the FWaaS module. Using security Groups woulkd be quite a hassler.

It's working now - awesome, thank to Bernd Bausch! I created a br-ex, added the needed cfg parameters to the openvswitch-agent.ini/ml2_conf.ini and created the patch ports towards the int interface. And now, everything works like a charm - wonderful :)

Ohhhhh, networking just got so much clearer to me. Awesome Bernd. I'ld like this to add a general Thank you for the amount of knowledge and tips you provide here. People like you are the reason I love working with OS projects rather than dark magic like Oracle or SAP <3

Thank you for your input. I added some output to the initial post due the character limitation in the comment section :)

Just fyi: In Mitaka the domain name for the metadata is always set via nova.conf. Ping an Instance via Hostname is not possible.

After upgrading to Newton, this now works :)

Hi,

on my Mitaka installation on Ubuntu I use Neutron for networking.

I have some issues with DNS Resolution at the moment. I set my own domain name by setting

/etc/neutron/neutron.conf

dns_domain = mydomain.

I also set

/etc/neutron/plugins/ml2/ml2_conf.ini

extension_drivers = port_security,dns

For test reasons.

This results in the following:

1. Hostname -A still shows something along host-192-168-10-3.openstacklocal
2. Hostname -f fails with hostname: Name or service not known
3. curl 169.254.169.254/latest/meta-data/hostname shows correct_hostname.novalocal

I then set the following

/etc/nova/nova.conf

dhcp_domain=mydomain

Now I get:

• the correct output when curling the metadata server
• the correct output when showing the port (talking about dns_assignment and dns_name)

But still:

• the wrong domain when asking for hostname -A - host-192-168-10-3.openstacklocal
• a failing hostname -f

Further confusion ensures when taking a look at the dnsmasq config files:

/var/lib/neutron/dhcp/207cc6aa-ede3-465f-bee3-2e85d864fc18/addn_hosts

192.168.10.2    host-192-168-10-2.mydomain. host-192-168-10-2
192.168.10.3    host-192-168-10-3.openstacklocal host-192-168-10-3
192.168.10.1    host-192-168-10-1.mydomain. host-192-168-10-1

but those are now missing from the leases file

/var/lib/neutron/dhcp/207cc6aa-ede3-465f-bee3-2e85d864fc18/leases

1498080444 fa:16:3e:e9:3c:43 192.168.10.3 host-192-168-10-3 *
1498080317 fa:16:3e:bc:6f:16 192.168.10.2 host-192-168-10-2 *

I have a hard time understanding what is happening here and how to fix. All I want is a working hostname -f (which will result in working sudo without touching any files on the instance) and my custom domain.

Also I read this spec: https://specs.openstack.org/openstack/neutron-specs/specs/liberty/internal-dns-resolution.html (https://specs.openstack.org/openstack...)

Does anybody know if this was already implemented in newton/ocata?

You were totally right. I was missing the exit point with the correct VLAN Tag. Turns out you need no promiscous mode when using OpenVSwitch.

After adding the VLAN tag everything works now as intended an I have a multi node OpenStack Lab Setup. On a single Hetzner node for about $60 per month :)

Execute the command with sudo or allow passwordless sudo for this account.

I do not want to sound rude, but you are not really familiar with linux, aren't you? Maybe you should try to get used to this environment before using OpenStack.

On the instance you want to access. Change PasswordAuthentication to yes and restart the ssh service via systemctl restart ssh or service ssh restart.

I added the VLANs via ovs-vsctl set port vnet8 trunks=2003,2004

This could be because of a missing connection to the openstack dns service. Installing and enabling dnsmasq could help, since the name resolution for your hostname will then happen locally. You may need to add the hostname to the /etc/hosts.

For the ssh password login you need to set PasswordAuthentication yes in /etc/ssh/sshd_config

Added info to the start post since there is no 'reply' function here.

Oh, just remembered I can't be sure the instance got the IP - I was just checking the metadata (which may be incorrect).

The network is not configured in virsh (yet - should I do that?), I attached the instances by editing their config file and adding another interface like this:

<interface type='bridge'>   
  <mac address='52:54:00:43:68:01'/>  
  <source bridge='ostun0'/>  
  <virtualport type='openvswitch'>
    <parameters interfaceid='85dc9976-0f7b-4995-891d-c1ce2f5902a6'/>
  </virtualport>
  <model type='virtio'/>
  <address type='pci' domain='0x0000' bus='0x00' slot='0x08' function='0x0'/> 
</interface>

However, I also found out that virsh apparently does some security implementation:

virsh # nwfilter-list 
 UUID                                  Name                 
------------------------------------------------------------------
 33bbc764-11b7-4ca4-aa1a-18824e34c4e6  allow-arp           
 04184b11-1b34-4b6d-b165-ca4b4e5ba95d  allow-dhcp          
 b1852242-1ad1-4532-a93a-877eaa50c4c6  allow-dhcp-server   
 2cf82839-eba7-42e9-a185-d8769ffa1426  allow-incoming-ipv4 
 21b246cc-af53-4534-bdc9-1ca7d02cba45  allow-ipv4          
 7415b3e5-56d2-4307-87db-05192550a250  clean-traffic       
 0ae14293-0feb-43b4-bfad-02becb9ed97f  no-arp-ip-spoofing  
 29b87460-fdb9-4ad6-877f-6845fa39d036  no-arp-mac-spoofing 
 42c7f827-fa04-4950-a47c-85f87093db54  no-arp-spoofing     
 3a490558-4afb-4905-be38-cd89ea3446a3  no-ip-multicast     
 8036475f-6f81-4fb7-85b7-19672c6fb4bb  no-ip-spoofing      
 1e0f16dd-7f07-4cd8-b6db-2d5d7b43d7de  no-mac-broadcast    
 4842ab50-6826-400c-9d4b-5e26a1fe0a93  no-mac-spoofing     
 9e694f78-e0d6-4d35-84eb-5bda16f471d0  no-other-l2-traffic 
 ce03eadf-4cc5-4f26-8b31-28f2d76fd879  no-other-rarp-traffic
 865e29f9-7088-4519-9dc4-57499ecb92be  qemu-announce-self  
 96416978-64bf-4a63-88e0-7e514f04d1c5  qemu-announce-self-rarp

ovs-vsctl show on the host:

user@host:~$ sudo ovs-vsctl show
73bade2a-a301-49d6-9bdc-306c92a490de
    Bridge "ostun0"
        Port "ostun0"
            Interface "ostun0"
                type: internal
        Port "vnet12"
            Interface "vnet12"
        Port "vnet10"
            Interface "vnet10"
        Port "vnet7"
            Interface "vnet7"
    Bridge "intbr0"
        Port "vnet14"
            Interface "vnet14"
        Port "vnet6"
            Interface "vnet6"
        Port "vnet5"
            Interface "vnet5"
        Port "vnet3"
            Interface "vnet3"
        Port "vnet1"
            Interface "vnet1"
        Port "vnet9"
            Interface "vnet9"
        Port "vnet11"
            Interface "vnet11"
        Port "vnet4"
            Interface "vnet4"
        Port "intbr0"
            Interface "intbr0"
                type: internal
    Bridge "databr0"
        Port "vnet8"
            trunks: [2003, 2004]
            Interface "vnet8"
        Port "vnet0"
            Interface "vnet0"
        Port "databr0"
            Interface "databr0"
                type: internal
        Port "dev1"
            Interface "dev1"
                type: internal
    ovs_version: "2.5.2"

vnet6, vnet7 and vnet8 are the ports of the network instance. vnet10 and vnet12 are the compute nodes.

and on the network node:

user@host:~$ sudo ovs-vsctl show
05cd067e-3831-4721-bd1b-c61561c5388b
    Bridge br-int
        fail_mode: secure
        Port br-int
            Interface br-int
                type: internal
        Port "tape567d86e-f1"
            tag: 1
            Interface "tape567d86e-f1"
                type: internal
        Port "qr-1bd55b0a-f1"
            tag: 1
            Interface "qr-1bd55b0a-f1"
                type: internal
        Port "qg-3e0b069a-a3"
            tag: 2
            Interface "qg-3e0b069a-a3"
                type: internal
        Port patch-tun
            Interface patch-tun
                type: patch
                options: {peer=patch-int}
        Port int-br-ex
            Interface int-br-ex
                type: patch
                options: {peer=phy-br-ex}
    Bridge br-ex
        fail_mode: secure
        Port "ens9"
            trunks: [2003, 2004]
            Interface "ens9"
        Port phy-br-ex
            Interface phy-br-ex
                type: patch
                options: {peer=int-br-ex}
        Port br-ex
            Interface br-ex
                type: internal
    Bridge br-tun
        fail_mode: secure
        Port patch-int
            Interface patch-int
                type: patch
                options: {peer=patch-tun}
        Port br-tun
            Interface br-tun
                type: internal
        Port "vxlan-c0a8022b"
            Interface "vxlan-c0a8022b"
                type: vxlan
                options: {df_default="true", in_key=flow, local_ip="192.168.2.41", out_key=flow, remote_ip="192.168.2.43"}
        Port "vxlan-c0a8022a"
            Interface "vxlan-c0a8022a"
                type: vxlan
                options: {df_default="true", in_key=flow, local_ip="192.168.2.41", out_key=flow, remote_ip="192.168.2.42"}
    ovs_version: "2.5.2"

Since the router resides (afaik) in the same security group as the node, it should be pingable by the default mitaka rules.

This would also not explain why I can't ping the external public IPs.

Can somebody tell me if the IP after boot is assigned via DHCP or if there is some voodoo happening?

Hi,

please try to use the os_auth token first for debug reasons. This way you can ensure it's not a problem with your credentials. Please also try to create the instance with the python-openstackclient.

I suspect that a part of your API is not reachable from the remote host.

Hi,

please try to use the os_auth token first for debug reasons. This way you can ensure it's not a problem with your credentials. Please also try to create the instance with the python-openstackclient.

I suspect that a part of your API is not reachable from the remote host.

Greetings from Germany Micha