前言
通过查询资料，我们应该大体都了解nova创建虚机的一般流程：首先是通过horizon下发指令到nova-API，然后是keystone认证，接着nova-conductor查询数据库，nova-scheduler进行物理主机选举，从glance下载镜像，通过neutron创建网络资源，最后nova-compute创建虚机。本文旨在记录一下，在代码层面，nova与neutron的交互过程中比较重要的细节。
nova处理流程
nova-conductor通过rpc的方式通知nova-compute创建虚机。nova-compute创建虚机的入口是build_and_run_instance，在文件/nova/compute/manager.py中：
def build_and_run_instance(self, context, instance, image, request_spec,
filter_properties, admin_password=None, injected_files=None, requested_networks=None,
security_groups=None, block_device_mapping=None, node=None, limits=None):
@utils.synchronized(instance.uuid)
def _locked_do_build_and_run_instance(*args, **kwargs):
......
with self._build_semaphore:
try:
result = self._do_build_and_run_instance(*args, **kwargs)
except Exception:
在这里，具体执行创建虚机流程的方法是_do_build_and_run_instance。进入这个方法，再进一步分析：
def _do_build_and_run_instance(self, context, instance, image,
request_spec, filter_properties, admin_password, injected_files,
requested_networks, security_groups, block_device_mapping, node=None, limits=None):
......
try:
with timeutils.StopWatch() as timer:
self._build_and_run_instance(context, instance, image,
decoded_files, admin_password, requested_networks,
security_groups, block_device_mapping, node, limits, filter_properties)
......
在这个方法里，主要关注_build_and_run_instance的调用，进入该方法的主体：
def _build_and_run_instance(self, context, instance, image, injected_files,
admin_password, requested_networks, security_groups,
block_device_mapping, node, limits, filter_properties):
......
try:
......
with self._build_resources(context, instance,requested_networks, security_groups, image_meta,
block_device_mapping) as resources:
......
instance.save(expected_task_state=task_states.BLOCK_DEVICE_MAPPING)
block_device_info = resources['block_device_info']
network_info = resources['network_info']
LOG.debug('Start spawning the instance on the hypervisor.',
instance=instance)
with timeutils.StopWatch() as timer:
self.driver.spawn(context, instance, image_meta, injected_files, admin_password,
network_info=network_info, block_device_info=block_device_info)
......
实现的时候，_build_resources主要是创建各种资源，其中就包括虚机的网络资源。self.driver.spawn就是调用具体的hypervisor的driver进行虚机创建的操作，比如libvirt，它的实现就是根据资源信息生成虚机的xml文件，然后通过xml配置启动虚机。
nova与neutron的交互
nova与neutron的交互主要就是nova通知neutron服务器创建网络资源，并获取成功创建的资源信息。
首先进入_build_resources方法里：
def _build_resources(self, context, instance, requested_networks,
security_groups, image_meta, block_device_mapping):
resources = {}
network_info = None
try:
LOG.debug('Start building networks asynchronously for instance.',instance=instance)
network_info = self._build_networks_for_instance(context, instance,
requested_networks, security_groups)
resources['network_info'] = network_info
更深入查看方法的调用，_build_networks_for_instance方法：
def _build_networks_for_instance(self, context, instance,requested_networks, security_groups):
......
network_info = self._allocate_network(context, instance,
requested_networks, macs, security_groups, dhcp_options)
_allocate_network方法：
def _allocate_network(self, context, instance, requested_networks, macs, security_groups, dhcp_options):
return network_model.NetworkInfoAsyncWrapper(
self._allocate_network_async, context, instance,
requested_networks, macs, security_groups, is_vpn, dhcp_options)
_allocate_network_async方法：
def _allocate_network_async(self, context, instance, requested_networks,
macs, security_groups, is_vpn, dhcp_options):
......
bind_host_id = self.driver.network_binding_host_id(context, instance)
for attempt in range(1, attempts + 1):
try:
nwinfo = self.network_api.allocate_for_instance(
context, instance, vpn=is_vpn, requested_networks=requested_networks,
macs=macs, security_groups=security_groups,
dhcp_options=dhcp_options, bind_host_id=bind_host_id)
在这个方法里，首先会通过self.driver.network_binding_host_id获取到虚机所在主机的host_id。然后进行虚机的网络资源的创建。也就是方法allocate_for_instance：
def allocate_for_instance(self, context, instance, vpn,requested_networks, macs=None,
security_groups=None,dhcp_options=None, bind_host_id=None):
......
# We do not want to create a new neutron session for each call
neutron = get_client(context)
.....
# Create any ports that might be required,
# after validating requested security groups
security_groups = self._clean_security_groups(security_groups)
security_group_ids = self._process_security_groups(instance, neutron, security_groups)
requests_and_created_ports = self._create_ports_for_instance(
context, instance, ordered_networks, nets, neutron, security_group_ids)
# Update existing and newly created ports
available_macs = _filter_hypervisor_macs(instance, ports, macs)
admin_client = get_client(context, admin=True)
ordered_nets, ordered_ports, preexisting_port_ids, \
created_port_ids = self._update_ports_for_instance(
context, instance, neutron, admin_client, requests_and_created_ports, nets,
bind_host_id, dhcp_options, available_macs)
nw_info = self.get_instance_nw_info(context, instance, networks=ordered_nets, port_ids=ordered_ports,
admin_client=admin_client,preexisting_port_ids=preexisting_port_ids, update_cells=True)
return network_model.NetworkInfo([vif for vif in nw_info
if vif['id'] in created_port_ids + preexisting_port_ids])
从方法的实现上可以看到，首先会创建虚机的安全组和端口，注意这时候的端口，是最小配置的端口，还没有进行bind和qos策略这些extensions配置的，端口的bind状态是UNBOUND状态。创建成功后会调用_update_ports_for_instance方法将端口的bind_host_id传入进行端口bind_port操作。以上的操作都会调用neutron的api。重点关注以下几个方法的实现：
- _process_security_groups
- _create_ports_for_instance 调用neutron的create_port
- _update_ports_for_instance 调用neutron的update_port
这里neutron创建端口的操作主要包括IP地址分配以及安全组的配置；接下来将单独分析一下neutron的端口绑定bind_port。
上面两部分的调用栈可以简单总结如下：
build_and_run_instance
--->_locked_do_build_and_run_instance
| --->_do_build_and_run_instance
| | --->_build_and_run_instance
| | | --->_build_resources
| | | | --->_build_networks_for_instance
| | | | | --->_allocate_network
| | | | | | --->_allocate_network_async
| | | | | | | --->allocate_for_instance
| | | | | | | | --->_process_security_groups
| | | | | | | | --->_create_ports_for_instance
| | | | | | | | | --->_create_port_minimal
| | | | | | | | --->_update_ports_for_instance
| | | | | | | | | --->_populate_neutron_extension_values
| | | | | | | | | | --->QOS_QUEUE,BINDING_HOST_ID,DNS_INTEGRATION
| | | | | | | | | | --->_populate_pci_mac_address
| | | | | | | | | | --->_populate_mac_address
| | | | | | | | | | --->extra_dhcp_opts
| | | | | | | | |
| | | | | | | | |
| | | --->self.driver.spawn
neutron端口绑定
neutron的端口绑定bind_port的代码，关注一下neutron的bind_port方法，在文件neutron/plugins/ml2/manager.py中：
def bind_port(self, context):
binding = context._binding
LOG.debug("Attempting to bind port %(port)s on host %(host)s "
"for vnic_type %(vnic_type)s with profile %(profile)s",
{'port': context.current['id'],'host': context.host,
'vnic_type': binding.vnic_type,'profile': binding.profile})
context._clear_binding_levels()
if not self._bind_port_level(context, 0,context.network.network_segments):
binding.vif_type = portbindings.VIF_TYPE_BINDING_FAILED
方法首先会获取端口即将binding的信息，清空端口的层次化绑定信息，然后调用_bind_port_level方法进行分层绑定。这里有个关注的点就是，目前的_bind_port_level方法是兼容了单层绑定和多层次化绑定的。目前对于层次化绑定可以参考这个BP
接下来分析_bind_port_level：
def _bind_port_level(self, context, level, segments_to_bind):
......
for driver in self.ordered_mech_drivers:
if not self._check_driver_to_bind(driver, segments_to_bind,
context._binding_levels):
continue
try:
context._prepare_to_bind(segments_to_bind)
driver.obj.bind_port(context)
segment = context._new_bound_segment
if segment:
context._push_binding_level(
models.PortBindingLevel(port_id=port_id,host=context.host,
level=level,driver=driver.name,segment_id=segment))
next_segments = context._next_segments_to_bind
if next_segments:
# Continue binding another level.
if self._bind_port_level(context, level + 1,next_segments):
return True
else:
LOG.warning(_LW("Failed to bind port %(port)s on "
"host %(host)s at level %(lvl)s"),
{'port': context.current['id'],'host': context.host,'lvl': level + 1})
context._pop_binding_level()
else:
# Binding complete.
......
return True
首先会遍历每个ml2 driver（例如openvswitch，networking-huawei等），调用_check_driver_to_bind，遍历每个context._binding_levels中的level，如果该level.segment_id在segments_to_bind里面以及level.driver与当前driver匹配的话，将会退出该driver的绑定流程，进行下一个driver的绑定。简单总结一下：就是在同一个driver上不能绑定相同的segment_id。
当然，如果是层次化绑定的话，需要higher level的driver将分配的segment_id通过continue_binding()传递给bottom level的driver。各种driver进行端口绑定的过程就不详细分析了，主要就是获取host中运行的alive状态的agent，如果agent的信息符合绑定的需求（如检验network_type），就会将该agent信息写入端口绑定信息里（vif_type：ovs，vif_details）。nova创建虚机，需要获取vif_type：ovs，vif_detail信息。
个人分析，欢迎指正，若转载请注明出处！
欢迎访问我的主页
网友评论