neutron gateway #10

Supports: trusty


Neutron is a virtual network service for Openstack, and a part of Netstack. Just like OpenStack Nova provides an API to dynamically request and configure virtual servers, Neutron provides an API to dynamically request and configure virtual networks. These networks connect "interfaces" from other OpenStack services (e.g., virtual NICs from Nova VMs). The Neutron API supports extensions to provide advanced network capabilities (e.g., QoS, ACLs, network monitoring, etc.) . This charm provides central Neutron networking services as part of a Neutron based OpenStack deployment


Neutron provides flexible software defined networking (SDN) for OpenStack.

This charm is designed to be used in conjunction with the rest of the OpenStack related charms in the charm store to virtualize the network that Nova Compute instances plug into.

It's designed as a replacement for nova-network; however it does not yet support all of the features of nova-network (such as multihost) so may not be suitable for all.

Neutron supports a rich plugin/extension framework for propriety networking solutions and supports (in core) Nicira NVP, NEC, Cisco and others...

See the upstream Neutron documentation for more details.


In order to use Neutron with OpenStack, you will need to deploy the nova-compute and nova-cloud-controller charms with the network-manager configuration set to 'Neutron':

    network-manager: Neutron

This decision must be made prior to deploying OpenStack with Juju as Neutron is deployed baked into these charms from install onwards:

juju deploy nova-compute
juju deploy --config config.yaml nova-cloud-controller
juju add-relation nova-compute nova-cloud-controller

The Neutron Gateway can then be added to the deploying:

juju deploy neutron-gateway
juju add-relation neutron-gateway mysql
juju add-relation neutron-gateway rabbitmq-server
juju add-relation neutron-gateway nova-cloud-controller

The gateway provides two key services; L3 network routing and DHCP services.

These are both required in a fully functional Neutron OpenStack deployment.

See upstream Neutron multi extnet

Configuration Options

External Port Configuration

If the port to be used for external traffic is consistent across all physical servers then is can be specified by simply setting ext-port to the nic id:

    ext-port: eth2

However, if it varies between hosts then the mac addresses of the external nics for each host can be passed as a space separated list:

    ext-port: <MAC ext port host 1> <MAC ext port host 2> <MAC ext port host 3>

Multiple Floating Pools

If multiple floating pools are needed then an L3 agent (which corresponds to a neutron-gateway for the sake of this charm) is needed for each one. Each gateway needs to be deployed as a separate service so that the external network id can be set differently for each gateway e.g.

juju deploy neutron-gateway neutron-gateway-extnet1
juju add-relation neutron-gateway-extnet1 mysql
juju add-relation neutron-gateway-extnet1 rabbitmq-server
juju add-relation neutron-gateway-extnet1 nova-cloud-controller
juju deploy neutron-gateway neutron-gateway-extnet2
juju add-relation neutron-gateway-extnet2 mysql
juju add-relation neutron-gateway-extnet2 rabbitmq-server
juju add-relation neutron-gateway-extnet2 nova-cloud-controller

Create extnet1 and extnet2 via neutron client and take a note of their ids

juju set neutron-gateway-extnet1 "run-internal-router=leader"
juju set neutron-gateway-extnet2 "run-internal-router=none"
juju set neutron-gateway-extnet1 "external-network-id=<extnet1 id>"
juju set neutron-gateway-extnet2 "external-network-id=<extnet2 id>"

Instance MTU

When using Open vSwitch plugin with GRE tunnels default MTU of 1500 can cause packet fragmentation due to GRE overhead. One solution is to increase the MTU on physical hosts and network equipment. When this is not possible or practical the charm's instance-mtu option can be used to reduce instance MTU via DHCP.

juju set neutron-gateway instance-mtu=1400

OpenStack upstream documentation recommends a MTU value of 1400: OpenStack documentation

Note that this option was added in Havana and will be ignored in older releases.

Deploying from source

The minimum openstack-origin-git config required to deploy from source is:

openstack-origin-git: include-file://neutron-juno.yaml

- {name: requirements,
   repository: 'git://',
   branch: stable/juno}
- {name: neutron,
   repository: 'git://',
   branch: stable/juno}

Note that there are only two 'name' values the charm knows about: 'requirements' and 'neutron'. These repositories must correspond to these 'name' values. Additionally, the requirements repository must be specified first and the neutron repository must be specified last. All other repositories are installed in the order in which they are specified.

The following is a full list of current tip repos (may not be up-to-date):

openstack-origin-git: include-file://neutron-master.yaml

- {name: requirements,
   repository: 'git://',
   branch: master}
- {name: oslo-concurrency,
   repository: 'git://',
   branch: master}
- {name: oslo-config,
   repository: 'git://',
   branch: master}
- {name: oslo-context,
   repository: 'git://',
   branch: master}
- {name: oslo-db,
   repository: 'git://',
   branch: master}
- {name: oslo-i18n,
   repository: 'git://',
   branch: master}
- {name: oslo-messaging,
   repository: 'git://',
   branch: master}
- {name: oslo-middleware,
   repository': 'git://',
   branch: master}
- {name: oslo-rootwrap',
   repository: 'git://',
   branch: master}
- {name: oslo-serialization,
   repository: 'git://',
   branch: master}
- {name: oslo-utils,
   repository: 'git://',
   branch: master}
- {name: pbr,
   repository: 'git://',
   branch: master}
- {name: stevedore,
   repository: 'git://',
   branch: 'master'}
- {name: python-keystoneclient,
   repository: 'git://',
   branch: master}
- {name: python-neutronclient,
   repository: 'git://',
   branch: master}
- {name: python-novaclient,
   repository': 'git://',
   branch: master}
- {name: keystonemiddleware,
   repository: 'git://',
   branch: master}
- {name: neutron-fwaas,
   repository': 'git://',
   branch: master}
- {name: neutron-lbaas,
   repository: 'git://',
   branch: master}
- {name: neutron-vpnaas,
   repository: 'git://',
   branch: master}
- {name: neutron,
   repository: 'git://',
   branch: master}


(boolean) If True enables openstack upgrades for this charm via juju actions. You will still need to set openstack-origin to the new repository but instead of an upgrade running automatically across all units, it will wait for you to execute the openstack-upgrade action for this charm on each unit. If False it will revert to existing behavior of upgrading all units on config change.
(string) Space-separated list of ML2 data bridge mappings with format <provider>:<bridge>.
(string) Space-delimited list of bridge:port mappings. Ports will be added to their corresponding bridge. The bridges will allow usage of flat or VLAN network types with Neutron and should match this defined in bridge-mappings. . Ports provided can be the name or MAC address of the interface to be added to the bridge. If MAC addresses are used, you may provide multiple bridge:mac for the same bridge so as to be able to configure multiple units. In this case the charm will run through the provided MAC addresses for each bridge until it finds one it can resolve to an interface name.
(string) Database name
(string) Username for database access
(boolean) Enable debug logging.
(string) Comma-separated list of key=value config flags with the additional dhcp options for neutron dnsmasq.
(boolean) Optional configuration to support use of linux router Note that this is used only for Cisco n1kv plugin.
(string) Space-delimited list of external ports to use for routing of instance traffic to the external public network. Valid values are either MAC addresses (in which case only MAC addresses for interfaces without an IP address already assigned will be used), or interfaces (eth0)
(string) Optional configuration to set the external-network-id. Only needed when configuring multiple external networks and should be used in conjunction with run-internal-router.
(string) Space-delimited list of Neutron flat network providers.
(string) Default network interface on which HA cluster will bind to communicate with the other members of the HA Cluster.
(boolean) If True will enable Pacemaker to monitor the neutron-ha-monitor daemon on every neutron-gateway unit, which detects neutron agents status and reschedule resources hosting on failed agents, detects local errors and release resources when network is unreachable or do necessary recover tasks. This feature targets to < Juno which doesn't natively support HA in Neutron itself.
(int) Default multicast port number that will be used to communicate between HA Cluster nodes.
(int) Configure DHCP services to provide MTU configuration to instances within the cloud. This is useful in deployments where its not possible to increase MTU on switches and physical servers to accommodate the packet overhead of using GRE tunnels.
(string) Used by the nrpe-external-master subordinate charm. A string that will be prepended to instance name to set the host name in Nagios. So for instance the hostname would be something like: juju-myservice-0 If you're running multiple environments with the same services in them this allows you to differentiate between them.
(string) A comma-separated list of Nagios servicegroups. If left empty, the nagios_context will be used as the servicegroup
(string) RabbitMQ Nova user
(string) RabbitMQ Nova Virtual Host
(string) Repository from which to install. May be one of the following: distro (default), ppa:somecustom/ppa, a deb url sources entry, or a supported Cloud Archive release pocket. Supported Cloud Archive sources include: cloud:<series>-<openstack-release> cloud:<series>-<openstack-release>/updates cloud:<series>-<openstack-release>/staging cloud:<series>-<openstack-release>/proposed For series=Precise we support cloud archives for openstack-release: * icehouse For series=Trusty we support cloud archives for openstack-release: * juno * kilo * ... NOTE: updating this setting to a source that is known to provide a later version of OpenStack will trigger a software upgrade. NOTE: when openstack-origin-git is specified, OpenStack specific packages will be installed from source rather than from the openstack-origin repository.
(string) Specifies a YAML-formatted dictionary listing the git repositories and branches from which to install OpenStack and its dependencies. Note that the installed config files will be determined based on the OpenStack release of the openstack-origin option. For more details see
(string) The IP address and netmask of the OpenStack Data network (e.g., This network will be used for tenant network traffic in overlay networks.
(string) Network configuration plugin to use for quantum. Supported values include: ovs - Open vSwitch nvp|nsx - Nicira NVP/VMware NSX n1kv - Cisco N1kv ovs-odl - Open vSwitch with OpenDayLight Controller
(string) RabbitMQ user
(string) RabbitMQ Virtual Host
(string) Optional configuration to support how the L3 agent option handle_internal_only_routers is configured. all => Set to be true everywhere none => Set to be false everywhere leader => Set to be true on one node (the leader) and false everywhere else. Use leader and none when configuring multiple floating pools
(string) YAML-formatted associative array of sysctl key/value pairs to be set persistently e.g. '{ kernel.pid_max : 4194303 }'.
(boolean) Setting this to True will allow supporting services to log to syslog.
(boolean) Enable verbose logging.
(string) Space-delimited list of <physical_network>:<vlan_min>:<vlan_max> or <physical_network> specifying physical_network names usable for VLAN provider and tenant networks, as well as ranges of VLAN tags on each available for allocation to tenant networks.