1 == OpFlex agent-ovs Install Guide
3 You'll need to install the following packages and their dependencies:
13 Packages are available for Red Hat Enterprise Linux 7 and Ubuntu 14.04
14 LTS. Some of the examples below are specific to RHEL7 but you can run
15 the equivalent commands for upstart instead of systemd.
17 Note that many of these steps may be performed automatically if you're
18 deploying this along with a larger orchestration system.
20 === Host Networking Configuration
22 You'll need to set up your VM host uplink interface. You should
23 ensure that the MTU of the underlying network is sufficient to handle
24 tunneled traffic. We will use an example of setting up *eth0* as your
25 uplink interface with a vlan of 4093 used for the networking control
26 infrastructure and tunnel data plane.
28 We just need to set the MTU and disable IPv4 and IPv6
29 autoconfiguration. The MTU needs to be large enough to allow both the
30 VXLAN header and VLAN tags to pass through without fragmenting for
31 best performance. We'll use 1600 bytes which should be sufficient
32 assuming you are using a default 1500 byte MTU on your virtual machine
33 traffic. If you already have any NetworkManager connections configured
34 for your uplink interface find the connection name and proceed to the
35 next step. Otherwise, create a connection with (be sure to update the
36 variable UPLINK_IFACE as needed):
40 nmcli c add type ethernet ifname $UPLINK_IFACE
43 Now, configure your interface as follows:
46 CONNECTION_NAME="ethernet-$UPLINK_IFACE"
47 nmcli connection mod "$CONNECTION_NAME" connection.autoconnect yes \
48 ipv4.method link-local \
50 802-3-ethernet.mtu 9000 \
51 ipv4.routes '224.0.0.0/4 0.0.0.0 2000'
53 Then bring up the interface with
56 nmcli connection up "$CONNECTION_NAME"
59 Next, create the infrastructure interface using the infrastructure
60 VLAN (4093 by default). We'll need to create a vlan subinterface of
61 your uplink interface, the configure DHCP on that interface. Run the
62 following commands. Be sure to replace the variable values if needed. If
63 you're not using NIC teaming, replace the variable team0 below
68 nmcli connection add type vlan ifname $UPLINK_IFACE.$INFRA_VLAN dev $UPLINK_IFACE id $INFRA_VLAN
69 nmcli connection mod vlan-$UPLINK_IFACE.$INFRA_VLAN \
70 ethernet.mtu 1600 ipv4.routes '224.0.0.0/4 0.0.0.0 1000'
71 sed "s/CLIENT_ID/01:$(ip link show $UPLINK_IFACE | awk '/ether/ {print $2}')/" \
72 > /etc/dhcp/dhclient-$UPLINK_IFACE.$INFRA_VLAN.conf <<EOF
73 send dhcp-client-identifier CLIENT_ID;
74 request subnet-mask, domain-name, domain-name-servers, host-name;
77 Now bring up the new interface with:
80 nmcli connection up vlan-$UPLINK_IFACE.$INFRA_VLAN
82 If you were successful, you should be able to see an IP address when you run:
85 ip addr show dev $UPLINK_IFACE.$INFRA_VLAN
88 === OVS Bridge Configuration
89 We'll need to configure an OVS bridge which will handle the traffic
90 for any virtual machines or containers that are hosted on the VM
91 host. First, enable the openvswitch service and start it:
94 # systemctl enable openvswitch
95 ln -s '/usr/lib/systemd/system/openvswitch.service' '/etc/systemd/system/multi-user.target.wants/openvswitch.service'
96 # systemctl start openvswitch
97 # systemctl status openvswitch
98 openvswitch.service - Open vSwitch
99 Loaded: loaded (/usr/lib/systemd/system/openvswitch.service; enabled)
100 Active: active (exited) since Fri 2014-12-12 17:20:13 PST; 3s ago
101 Process: 3053 ExecStart=/bin/true (code=exited, status=0/SUCCESS)
102 Main PID: 3053 (code=exited, status=0/SUCCESS)
103 Dec 12 17:20:13 ovs-server.cisco.com systemd[1]: Started Open vSwitch.
106 Next, we can create an OVS bridge (you may wish to use a different
110 # ovs-vsctl add-br br0
112 34aa83d7-b918-4e49-bcec-1b521acd1962
117 ovs_version: "2.3.90"
120 Next, we configure a tunnel interface on our new bridge as follows:
123 # ovs-vsctl add-port br0 br0_vxlan0 -- \
124 set Interface br0_vxlan0 type=vxlan \
125 options:remote_ip=flow options:key=flow options:dst_port=8472
127 34aa83d7-b918-4e49-bcec-1b521acd1962
130 Interface "br0_vxlan0"
132 options: {dst_port="8472", key=flow, remote_ip=flow}
136 ovs_version: "2.3.90"
139 Open vSwitch is now configured and ready.
141 === Agent Configuration
142 Before enabling the agent, we'll need to edit its configuration file,
143 which is located at "/etc/opflex-agent-ovs/opflex-agent-ovs.conf".
145 First, we'll configure the Opflex protocol parameters. If you're using
146 an ACI fabric, you'll need the OpFlex domain from the ACI
147 configuration, which is the name of the VMM domain you mapped to the
148 interface for this hypervisor. Set the "domain" field to this
149 value. Next, set the "name" field to a hostname or other unique
150 identifier for the VM host. Finally, set the "peers" list to contain
151 the fixed static anycast peer address of 10.0.0.30 and port 8009. Here
152 is an example of a completed section (bold text shows areas you'll
157 // The globally unique policy domain for this agent.
158 "domain": "[CHANGE ME]",
160 // The unique name in the policy domain for this agent.
161 "name": "[CHANGE ME]",
163 // a list of peers to connect to, by hostname and port. One
164 // peer, or an anycast pseudo-peer, is sufficient to bootstrap
165 // the connection without needing an exhaustive list of all
168 {"hostname": "10.0.0.30", "port": 8009}
172 // SSL mode. Possible values:
173 // disabled: communicate without encryption
174 // encrypted: encrypt but do not verify peers
175 // secure: encrypt and verify peer certificates
178 // The path to a directory containing trusted certificate
179 // authority public certificates, or a file containing a
180 // specific CA certificate.
181 "ca-store": "/etc/ssl/certs/"
186 Next, configure the appropriate policy renderer for the ACI
187 fabric. You'll want to use a stitched-mode renderer. You'll need to
188 configure the bridge name and the uplink interface name. The remote
189 anycast IP address will need to be obtained from the ACI configuration
190 console, but unless the configuration is unusual, it will be
194 // Renderers enforce policy obtained via OpFlex.
196 // Stitched-mode renderer for interoperating with a
197 // hardware fabric such as ACI
199 "ovs-bridge-name": "br0",
201 // Set encapsulation type. Must set either vxlan or vlan.
203 // Encapsulate traffic with VXLAN.
205 // The name of the tunnel interface in OVS
206 "encap-iface": "br0_vxlan0",
208 // The name of the interface whose IP should be used
209 // as the source IP in encapsulated traffic.
210 "uplink-iface": "eth0.4093",
212 // The vlan tag, if any, used on the uplink interface.
213 // Set to zero or omit if the uplink is untagged.
216 // The IP address used for the destination IP in
217 // the encapsulated traffic. This should be an
218 // anycast IP address understood by the upstream
219 // stitched-mode fabric.
220 "remote-ip": "10.0.0.32"
223 // Configure forwarding policy
225 // Configure the virtual distributed router
227 // Enable virtual distributed router. Set to true
228 // to enable or false to disable. Default true.
231 // Override MAC address for virtual router.
232 // Default is "00:22:bd:f8:19:ff"
233 "mac": "00:22:bd:f8:19:ff",
235 // Configure IPv6-related settings for the virtual
238 // Send router advertisement messages in
239 // response to router solicitation requests as
240 // well as unsolicited advertisements.
241 "router-advertisement": true
245 // Configure virtual distributed DHCP server
247 // Enable virtual distributed DHCP server. Set to
248 // true to enable or false to disable. Default
252 // Override MAC address for virtual dhcp server.
253 // Default is "00:22:bd:f8:19:ff"
254 "mac": "00:22:bd:f8:19:ff"
258 // Location to store cached IDs for managing flow state
259 "flowid-cache-dir": "DEFAULT_FLOWID_CACHE_DIR"
264 Finally, enable the agent service:
267 # systemctl enable agent-ovs
268 ln -s '/usr/lib/systemd/system/agent-ovs.service' '/etc/systemd/system/multi-user.target.wants/agent-ovs.service'
269 # systemctl start agent-ovs
270 # systemctl status agent-ovs
271 agent-ovs.service - Opflex OVS Agent
272 Loaded: loaded (/usr/lib/systemd/system/agent-ovs.service; enabled)
273 Active: active (running) since Mon 2014-12-15 10:03:42 PST; 5min ago
274 Main PID: 6062 (agent_ovs)
275 CGroup: /system.slice/agent-ovs.service
276 └─6062 /usr/bin/agent_ovs
279 The agent is now running and ready to enforce policy. You can add
280 endpoints to the local VM hosts using the OpFlex Group-based policy
281 plugin from OpenStack, or manually.