Manage VLANs in instances with VLAN transparency

Enable VLAN transparency to send VLAN-tagged traffic between instances.

Before you begin

  • You have the oc command line tool installed on your workstation.
  • You are logged on to a workstation that has access to the RHOSO control plane as a user with cluster-admin privileges.
  • Provider network of type Local, VLAN, or GENEVE. Do not use VLAN transparency in deployments with flat type provider networks.
  • Ensure that the external switch supports 802.1q VLAN stacking using EtherType 0x8100 on both VLANs. OVN VLAN transparency does not support 802.1ad QinQ with outer provider VLAN EtherType set to 0x88A8 or 0x9100.

About this task

In a VLAN transparent network, you can configure the VLANS directly in the VMs without configuring them in the Networking service (neutron).

Procedure

  1. Create a YAML file and add the following content: 
    apiVersion: core.openstack.org/v1beta1
kind: OpenStackControlPlane
metadata:
  name: openstack-control-plane
spec:
  neutron:
    template:
      customServiceConfig: |
        [DEFAULT]
        vlan_transparent = true
  2. Apply the updated OpenStackControlPlane CR configuration: 
    $ oc apply -f <control_plane_update.yaml>
    • Replace <control_plane_update.yaml> with the name of the YAML file that contains your update.
  3. Wait until Red Hat OpenShift Container Platform (RHOCP) creates the resources related to the OpenStackControlPlane CR. Check the status of the control plane deployment: 
    $ oc get openstackcontrolplane -n OPENSTACK
    Sample output
    NAME                      STATUS    MESSAGE
openstack-control-plane   Unknown   Setup started

    The OpenStackControlPlane resources are created when the status is "Setup complete".

    Tip

    Append the -w option to the get command to track deployment progress.
  4. Access the remote shell for the OpenStackClient pod from your workstation: 
    $ oc rsh -n openstack openstackclient
  5. Confirm that the Networking service has successfully loaded the vlan_transparent extension: 
    $ openstack extension list --network  --max-width=72 \
| grep vlan-transparent
    Sample output

    If the Networking service has successfully loaded the loaded the vlan_transparent extension, you should see output similar to the following:

    | Vlantransparent      | vlan-transparent     | Provides Vlan          |
|                      |                      | Transparent Networks   |
  6. Create the network using the --transparent-vlan argument.
    Example
    $ openstack network create <network-name> --transparent-vlan
    • Replace <network-name> with the name of the network that you are creating.
  7. Exit the openstackclient pod: 
    $ exit
  8. Set up a VLAN interface on each participating VM.

    Set the interface MTU to 4 bytes less than the MTU of the underlay network to accommodate the extra tagging required by VLAN transparency. For example, if the underlay network MTU is 1500, set the interface MTU to 1496.

    The following example command adds a VLAN interface on eth0 with an MTU of 1496. The VLAN is 50 and the interface name is vlan50:

    Example
    $ ip link add link eth0 name vlan50 type vlan id 50 mtu 1496
$ ip link set vlan50 up
$ ip addr add 192.128.111.3/24 dev vlan50
  9. Access the remote shell for the OpenStackClient pod from your workstation: 
    $ oc rsh -n openstack openstackclient
  10. Set --allowed-address on the VM port.

    Set the allowed address to the IP address you created on the VLAN interface inside the VM. Optionally, you can also set the VLAN interface MAC address.

    Note

    An alternative to setting an allowed address pair, is to disable port security on the port by using the port set --disable-port-security command.
    Example

    The following example sets the IP address to 192.128.111.3 with the optional MAC address 00:40:96:a8:45:c4 on port fv82gwk3-qq2e-yu93-go31-56w7sf476mm0:

    $ openstack port set --allowed-address ip-address=192.128.111.3,\
mac-address=00:40:96:a8:45:c4 fv82gwk3-qq2e-yu93-go31-56w7sf476mm0
  11. Exit the openstackclient pod: 
    $ exit

Results

  1. Ping between two VMs on the VLAN using the VLAN interface name IP address that you set in an earlier step, for example, vlan50.
  2. Use tcpdump on eth0 to see if the packets arrive with the VLAN tag intact.