a48e5dc4bd
Neutron ML2 plugin introduces the first extension driver port_security, this patch add it to be a default extension driver as a example. And also, if not set it by default, networks like public/private which are created after the neutron-db-manage's update, will not include the port-sec value. Change-Id: I3035317c83d22804855517434bd8578719ce0436 Partially Implements: blueprint ml2-ovs-portsecurity
144 lines
5.8 KiB
Bash
144 lines
5.8 KiB
Bash
#!/bin/bash
|
|
#
|
|
# Neutron Modular Layer 2 plugin
|
|
# ------------------------------
|
|
|
|
# Save trace setting
|
|
ML2_XTRACE=$(set +o | grep xtrace)
|
|
set +o xtrace
|
|
|
|
# Enable this to simply and quickly enable tunneling with ML2.
|
|
# Select either 'gre', 'vxlan', or 'gre,vxlan'
|
|
Q_ML2_TENANT_NETWORK_TYPE=${Q_ML2_TENANT_NETWORK_TYPE:-"vxlan"}
|
|
# This has to be set here since the agent will set this in the config file
|
|
if [[ "$Q_ML2_TENANT_NETWORK_TYPE" == "gre" || "$Q_ML2_TENANT_NETWORK_TYPE" == "vxlan" ]]; then
|
|
Q_TUNNEL_TYPES=$Q_ML2_TENANT_NETWORK_TYPE
|
|
elif [[ "$ENABLE_TENANT_TUNNELS" == "True" ]]; then
|
|
Q_TUNNEL_TYPES=gre
|
|
fi
|
|
|
|
# Default openvswitch L2 agent
|
|
Q_AGENT=${Q_AGENT:-openvswitch}
|
|
source $TOP_DIR/lib/neutron_plugins/${Q_AGENT}_agent
|
|
|
|
# List of MechanismDrivers to load
|
|
Q_ML2_PLUGIN_MECHANISM_DRIVERS=${Q_ML2_PLUGIN_MECHANISM_DRIVERS:-openvswitch,linuxbridge}
|
|
# List of Type Drivers to load
|
|
Q_ML2_PLUGIN_TYPE_DRIVERS=${Q_ML2_PLUGIN_TYPE_DRIVERS:-local,flat,vlan,gre,vxlan}
|
|
# Default GRE TypeDriver options
|
|
Q_ML2_PLUGIN_GRE_TYPE_OPTIONS=${Q_ML2_PLUGIN_GRE_TYPE_OPTIONS:-tunnel_id_ranges=$TENANT_TUNNEL_RANGES}
|
|
# Default VXLAN TypeDriver options
|
|
Q_ML2_PLUGIN_VXLAN_TYPE_OPTIONS=${Q_ML2_PLUGIN_VXLAN_TYPE_OPTIONS:-vni_ranges=1001:2000}
|
|
# Default VLAN TypeDriver options
|
|
Q_ML2_PLUGIN_VLAN_TYPE_OPTIONS=${Q_ML2_PLUGIN_VLAN_TYPE_OPTIONS:-}
|
|
# List of extension drivers to load, use '-' instead of ':-' to allow people to
|
|
# explicitly override this to blank
|
|
Q_ML2_PLUGIN_EXT_DRIVERS=${Q_ML2_PLUGIN_EXT_DRIVERS-port_security}
|
|
|
|
# L3 Plugin to load for ML2
|
|
ML2_L3_PLUGIN=${ML2_L3_PLUGIN:-neutron.services.l3_router.l3_router_plugin.L3RouterPlugin}
|
|
|
|
function populate_ml2_config {
|
|
CONF=$1
|
|
SECTION=$2
|
|
OPTS=$3
|
|
|
|
if [ -z "$OPTS" ]; then
|
|
return
|
|
fi
|
|
for I in "${OPTS[@]}"; do
|
|
# Replace the first '=' with ' ' for iniset syntax
|
|
iniset $CONF $SECTION ${I/=/ }
|
|
done
|
|
}
|
|
|
|
function neutron_plugin_configure_common {
|
|
Q_PLUGIN_CONF_PATH=etc/neutron/plugins/ml2
|
|
Q_PLUGIN_CONF_FILENAME=ml2_conf.ini
|
|
Q_PLUGIN_CLASS="neutron.plugins.ml2.plugin.Ml2Plugin"
|
|
# The ML2 plugin delegates L3 routing/NAT functionality to
|
|
# the L3 service plugin which must therefore be specified.
|
|
_neutron_service_plugin_class_add $ML2_L3_PLUGIN
|
|
}
|
|
|
|
function neutron_plugin_configure_service {
|
|
if [[ "$Q_ML2_TENANT_NETWORK_TYPE" != "local" ]]; then
|
|
Q_SRV_EXTRA_OPTS+=(tenant_network_types=$Q_ML2_TENANT_NETWORK_TYPE)
|
|
elif [[ "$ENABLE_TENANT_TUNNELS" == "True" ]]; then
|
|
# This assumes you want a simple configuration, and will overwrite
|
|
# Q_SRV_EXTRA_OPTS if set in addition to ENABLE_TENANT_TUNNELS.
|
|
Q_SRV_EXTRA_OPTS+=(tenant_network_types=gre)
|
|
Q_ML2_PLUGIN_GRE_TYPE_OPTIONS=(tunnel_id_ranges=$TENANT_TUNNEL_RANGES)
|
|
elif [[ "$ENABLE_TENANT_VLANS" == "True" ]]; then
|
|
Q_SRV_EXTRA_OPTS+=(tenant_network_types=vlan)
|
|
else
|
|
echo "WARNING - The ml2 plugin is using local tenant networks, with no connectivity between hosts."
|
|
fi
|
|
|
|
# Allow for overrding VLAN configuration (for example, to configure provider
|
|
# VLANs) by first checking if Q_ML2_PLUGIN_VLAN_TYPE_OPTIONS is set.
|
|
if [ "$Q_ML2_PLUGIN_VLAN_TYPE_OPTIONS" == "" ]; then
|
|
if [[ "$ML2_VLAN_RANGES" == "" ]] && [[ "$PHYSICAL_NETWORK" != "" ]]; then
|
|
ML2_VLAN_RANGES=$PHYSICAL_NETWORK
|
|
if [[ "$TENANT_VLAN_RANGE" != "" ]]; then
|
|
ML2_VLAN_RANGES=$ML2_VLAN_RANGES:$TENANT_VLAN_RANGE
|
|
fi
|
|
fi
|
|
if [[ "$ML2_VLAN_RANGES" != "" ]]; then
|
|
Q_ML2_PLUGIN_VLAN_TYPE_OPTIONS=(network_vlan_ranges=$ML2_VLAN_RANGES)
|
|
fi
|
|
fi
|
|
|
|
|
|
# Allow for setup the flat type network
|
|
if [[ -z "$Q_ML2_PLUGIN_FLAT_TYPE_OPTIONS" && -n "$PHYSICAL_NETWORK" ]]; then
|
|
Q_ML2_PLUGIN_FLAT_TYPE_OPTIONS="flat_networks=$PHYSICAL_NETWORK"
|
|
fi
|
|
# REVISIT(rkukura): Setting firewall_driver here for
|
|
# neutron.agent.securitygroups_rpc.is_firewall_enabled() which is
|
|
# used in the server, in case no L2 agent is configured on the
|
|
# server's node. If an L2 agent is configured, this will get
|
|
# overridden with the correct driver. The ml2 plugin should
|
|
# instead use its own config variable to indicate whether security
|
|
# groups is enabled, and that will need to be set here instead.
|
|
if [[ "$Q_USE_SECGROUP" == "True" ]]; then
|
|
iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver neutron.agent.not.a.real.FirewallDriver
|
|
else
|
|
iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver neutron.agent.firewall.NoopFirewallDriver
|
|
fi
|
|
|
|
if [[ "$ENABLE_TENANT_TUNNELS" == "True" ]]; then
|
|
# Set local_ip if TENANT_TUNNELS are enabled.
|
|
iniset /$Q_PLUGIN_CONF_FILE ovs local_ip $TUNNEL_ENDPOINT_IP
|
|
fi
|
|
|
|
populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2 mechanism_drivers=$Q_ML2_PLUGIN_MECHANISM_DRIVERS
|
|
|
|
populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2 type_drivers=$Q_ML2_PLUGIN_TYPE_DRIVERS
|
|
|
|
populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2 extension_drivers=$Q_ML2_PLUGIN_EXT_DRIVERS
|
|
|
|
populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2 $Q_SRV_EXTRA_OPTS
|
|
|
|
populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2_type_gre $Q_ML2_PLUGIN_GRE_TYPE_OPTIONS
|
|
|
|
populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2_type_vxlan $Q_ML2_PLUGIN_VXLAN_TYPE_OPTIONS
|
|
|
|
populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2_type_flat $Q_ML2_PLUGIN_FLAT_TYPE_OPTIONS
|
|
|
|
populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2_type_vlan $Q_ML2_PLUGIN_VLAN_TYPE_OPTIONS
|
|
|
|
if [[ "$Q_DVR_MODE" != "legacy" ]]; then
|
|
populate_ml2_config /$Q_PLUGIN_CONF_FILE agent l2_population=True
|
|
populate_ml2_config /$Q_PLUGIN_CONF_FILE agent tunnel_types=vxlan
|
|
populate_ml2_config /$Q_PLUGIN_CONF_FILE agent enable_distributed_routing=True
|
|
fi
|
|
}
|
|
|
|
function has_neutron_plugin_security_group {
|
|
return 0
|
|
}
|
|
|
|
# Restore xtrace
|
|
$ML2_XTRACE
|