标签：openstack-ovs-新创建instance无法访问公网问题剖析
新 instance创建好后，登入到instance，ifconfig查看是否获取到ip。如果eth0没有ip，查询日志里fail部分，我遇到的获取 不到ip是metadata获取数据fail。查看network节点里的metadata的配置文件/etc/neutron /metadata_agent.ini，查看账户，密码，路径是否一致，查看controller里的nova配置文件是否启用使用metadata
1）network-node
[root@network ~]# grep "^[a-z]" /etc/neutron/metadata_agent.ini
verbose = True
auth_url = http://controller:5000/v2.0
auth_region =regionOne
admin_tenant_name = service
admin_user = neutron
admin_password = kyneutron
nova_metadata_ip= controller
metadata_proxy_shared_secret=METADATA_SECRET
重启 service neutron-metadata-agent restart
2）controller-node
[root@network ~]# grep "^[a-z]" /etc/nova/nova.conf
service_neutron_metadata_proxy = true
neutron_metadata_proxy_shared_secret = METADATA_SECRET
重启service openstack-nova-api restart
如果还是不能获取到ip。
查看网络的各个组件的服务是否正常启动
查看网络，是否有创建tenant子网络，子网的路由。ip地址范围是否有被使用。
1） instance之间能正常通信，但是无法访问外网。
查看是否有添加DNS的ip
pingDNS的ip，ping外部网络的网关
查看三层的服务L3（虚拟网络提供路由服务）的配置文件是否正确配置。
查看网卡配置
1）controller一个网卡
2）network三个或者两个网卡
第一块网卡是管理网络接口
第二块网卡是实例的隧道网络接口，用来和nova进行会话的。不需要网关
第三块网卡是外部网络接口，不需要ip添加，添加下面四行即可
DEVICE=INTERFACE_NAME
TYPE=Ethernet
ONBOOT="yes"
BOOTPROTO="none"
注意：如果网络节点如果只有两块网卡，将ifcfg-br-ex配置外网的ip，第二块网卡只配置上面四行即可。并将br-ex绑定在第二块网卡上
3）nova两个网卡
第一块网卡是管理网络接口
第二块网卡是实例的隧道网络接口，用来和network进行会话的。不需要网关
查看是否添加外部桥接，并给一个连接到物理外部网络接口的外部桥接添加端口，绑定在第三块网卡上。用ovs-vsctl show来查看是否正常绑定，下面的图是，左边的是没有绑定，右边的是绑定好了的。右边多了port
列出网络命名空间
[root@network ~]# ip netns
qrouter-51d9a3bf-0b80-422d-add8-7eab318f0c1f
qrouter-90277b0b-f8e1-4a73-b41a-d5f3e315cd5b
qdhcp-fcf4b790-74b3-4b4b-8af8-608937c1abbf
qdhcp-2041a3a3-7053-4254-9d68-bbf19642acea
利用网络命名空间进行操作1
[root@network ~]# ip netns exec qrouter-51d9a3bf-0b80-422d-add8-7eab318f0c1f bash
[root@network ~]# ifconfig
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:3 errors:0 dropped:0 overruns:0 frame:0
TX packets:3 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:311 (311.0 b) TX bytes:311 (311.0 b)
qg-7337dd4a-12 Link encap:Ethernet HWaddr FA:16:3E:1E:B0:36
inet addr:172.16.13.152 Bcast:172.16.13.255 Mask:255.255.255.0
inet6 addr: fe80::f816:3eff:fe1e:b036/64 Scope:Link
UP BROADCAST RUNNING MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:307 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 b) TX bytes:13158 (12.8 KiB)
qr-87aec2f2-1d Link encap:Ethernet HWaddr FA:16:3E:D5:75:54
inet addr:192.168.1.1 Bcast:192.168.1.255 Mask:255.255.255.0
inet6 addr: fe80::f816:3eff:fed5:7554/64 Scope:Link
UP BROADCAST RUNNING MTU:1500 Metric:1
RX packets:374 errors:0 dropped:0 overruns:0 frame:0
TX packets:315 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:35764 (34.9 KiB) TX bytes:36593 (35.7 KiB)
利用网络命名空间进行操作2
[root@network ~]# ip netns exec qrouter-51d9a3bf-0b80-422d-add8-7eab318f0c1f ip addr list
33: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
35: qg-7337dd4a-12: <BROADCAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN
link/ether fa:16:3e:1e:b0:36 brd ff:ff:ff:ff:ff:ff
inet 172.16.13.152/24 brd 172.16.13.255 scope global qg-7337dd4a-12
inet 172.16.13.153/32 brd 172.16.13.153 scope global qg-7337dd4a-12
inet 172.16.13.155/32 brd 172.16.13.155 scope global qg-7337dd4a-12
inet6 fe80::f816:3eff:fe1e:b036/64 scope link
valid_lft forever preferred_lft forever
36: qr-87aec2f2-1d: <BROADCAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN
link/ether fa:16:3e:d5:75:54 brd ff:ff:ff:ff:ff:ff
inet 192.168.1.1/24 brd 192.168.1.255 scope global qr-87aec2f2-1d
inet6 fe80::f816:3eff:fed5:7554/64 scope link
valid_lft forever preferred_lft forever
调试网络
[root@network ~]# ip netns exec qrouter-51d9a3bf-0b80-422d-add8-7eab318f0c1f ping 172.16.13.153
PING 172.16.13.153 (172.16.13.153) 56(84) bytes of data.
64 bytes from 172.16.13.153: icmp_seq=1 ttl=64 time=3.46 ms
64 bytes from 172.16.13.153: icmp_seq=2 ttl=64 time=0.901 ms
--- 172.16.13.153 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1840ms
rtt min/avg/max/mdev = 0.901/2.182/3.464/1.282 ms
[root@network ~]# ip netns exec qrouter-51d9a3bf-0b80-422d-add8-7eab318f0c1f ping 192.168.1.8
PING 192.168.1.8 (192.168.1.8) 56(84) bytes of data.
64 bytes from 192.168.1.8: icmp_seq=1 ttl=64 time=1.22 ms
64 bytes from 192.168.1.8: icmp_seq=2 ttl=64 time=0.437 ms
--- 192.168.1.8 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1514ms
rtt min/avg/max/mdev = 0.437/0.829/1.222/0.393 ms
排错1
[root@controller ~]# source demo-openrc.sh
[root@controller ~]# nova floating-ip-list
ERROR: Invalid OpenStack Nova credentials
demo的密码认证不正确
标签：openstack-ovs-新创建instance无法访问公网问题剖析
原文地址：http://zqingq.blog.51cto.com/6768398/1754044
