Add support for VMware NSXP

NSXP is the OpenStack support for the NSX Policy platform.
This is supported from neutron in the Stein version. This patch
adds Kolla support

This adds a new neutron_plugin_agent type 'vmware_nsxp'. The plugin
does not run any neutron agents.

Change-Id: I9e9d8f07e586bdc143d293e572031368af7f3fca

1 files changed, 183 insertions, 10 deletions

diff --git a/doc/source/reference/compute/vmware-guide.rst b/doc/source/reference/compute/vmware-guide.rst
index a205593b1..b03fd8f28 100644
--- a/doc/source/reference/compute/vmware-guide.rst
+++ b/doc/source/reference/compute/vmware-guide.rst
@@ -8,8 +8,13 @@ Overview
 ~~~~~~~~
 
 Kolla can deploy the Nova and Neutron Service(s) for VMware vSphere.
-Depending on the network architecture (NsxV or DVS) you choose, Kolla deploys
-the following OpenStack services for VMware vSphere:
+Depending on the network architecture (NsxT, NsxV or DVS) you choose,
+Kolla deploys the following OpenStack services for VMware vSphere:
+
+For VMware NsxT:
+
+* nova-compute
+* neutron-server
 
 For VMware NsxV:
 
@@ -35,6 +40,12 @@ into what vSphere/NSX Manager API can understand. Neutron does
 not directly takes control of the Open vSwitch inside the VMware
 environment but through the API exposed by vSphere/NSX Manager.
 
+.. note::
+
+   VMware NSX plugin is not in the kolla image by default.
+   VMware NSX plugin has to be added in the neutron image and
+   if you are using vmware_dvs also in neutron-dhcp-agent image.
+
 For VMware DVS, the Neutron DHCP agent does not attaches to Open vSwitch inside
 VMware environment, but attach to the Open vSwitch bridge called ``br-dvs`` on
 the OpenStack side and replies to/receives DHCP packets through VLAN. Similar
@@ -46,6 +57,165 @@ bridge and works through VLAN.
    VMware NSX-DVS plugin does not support tenant networks, so all VMs should
    attach to Provider VLAN/Flat networks.
 
+VMware NSX-T
+~~~~~~~~~~~~
+
+Preparation
+-----------
+
+You should have a working NSX-T environment, this part is out of scope
+of Kolla. For more information, please see
+`VMware NSX-T documentation <https://docs.vmware.com/en/VMware-NSX-T-Data-Center/index.html/>`__.
+The NSX Manager provides a web-based user interface where you can manage
+your NSX-T environment.
+It also hosts the API server that processes API calls.
+The NSX Manager interface provides two modes for configuring resources:
+
+- Policy mode
+- Manager mode
+
+In Kolla you will have the choice between both with neutron plugin
+vmware_nsxv3 for Manager mode and vmware_nsxp for Policy Mode.
+For more information, please see
+`documentation <https://docs.vmware.com/en/VMware-NSX-T-Data-Center/3.1/installation/GUID-BB26CDC8-2A90-4C7E-9331-643D13FEEC4A.html/>`__.
+
+------------------------------------------------------------------------------
+
+In addition, it is important to modify the firewall rule of vSphere to make
+sure that VNC is accessible from outside VMware environment.
+
+On every VMware host, edit ``/etc/vmware/firewall/vnc.xml`` as below:
+
+.. code-block:: xml
+
+   <!-- FirewallRule for VNC Console -->
+   <ConfigRoot>
+   <service>
+   <id>VNC</id>
+   <rule id = '0000'>
+   <direction>inbound</direction>
+   <protocol>tcp</protocol>
+   <porttype>dst</porttype>
+   <port>
+   <begin>5900</begin>
+   <end>5999</end>
+   </port>
+   </rule>
+   <rule id = '0001'>
+   <direction>outbound</direction>
+   <protocol>tcp</protocol>
+   <porttype>dst</porttype>
+   <port>
+   <begin>0</begin>
+   <end>65535</end>
+   </port>
+   </rule>
+   <enabled>true</enabled>
+   <required>false</required>
+   </service>
+   </ConfigRoot>
+
+Then refresh the firewall config by:
+
+.. code-block:: console
+
+   # esxcli network firewall refresh
+
+Verify that the firewall config is applied:
+
+.. code-block:: console
+
+   # esxcli network firewall ruleset list
+
+------------------------------------------------------------------------------
+
+Deployment
+----------
+
+The deployment below covers the Policy mode (vmware_nsxp)
+
+Enable VMware nova-compute plugin and NSX-T neutron-server plugin in
+``/etc/kolla/globals.yml``:
+
+.. code-block:: yaml
+
+   enable_openvswitch: no
+   nova_compute_virt_type: "vmware"
+   neutron_plugin_agent: "vmware_nsxp"
+
+If you want to set VMware datastore as cinder backend, enable it in
+``/etc/kolla/globals.yml``:
+
+.. code-block:: yaml
+
+   enable_cinder: "yes"
+   cinder_backend_vmwarevc_vmdk: "yes"
+   vmware_datastore_name: "TestDatastore"
+
+If you want to set VMware datastore as glance backend, enable it in
+``/etc/kolla/globals.yml``:
+
+.. code-block:: yaml
+
+   glance_backend_vmware: "yes"
+   vmware_vcenter_name: "TestDatacenter"
+   vmware_datastore_name: "TestDatastore"
+
+VMware options are required in ``/etc/kolla/globals.yml``, these options should
+be configured correctly according to your NSX-T environment.
+
+Options for ``nova-compute`` and ``ceilometer``:
+
+.. code-block:: yaml
+
+   vmware_vcenter_host_ip: "127.0.0.1"
+   vmware_vcenter_host_username: "admin"
+   vmware_vcenter_cluster_name: "cluster-1"
+   vmware_vcenter_insecure: "True"
+   vmware_vcenter_datastore_regex: ".*"
+
+.. note::
+
+   The VMware vCenter password has to be set in ``/etc/kolla/passwords.yml``.
+
+   .. code-block:: yaml
+
+      vmware_vcenter_host_password: "admin"
+
+Options for Neutron NSX-T support:
+
+.. code-block:: yaml
+
+   vmware_nsxp_api_user: "admin"
+   vmware_nsxp_insecure: true
+   vmware_nsxp_default_tier0_router: "T0-Example"
+   vmware_nsxp_dhcp_profile: "dhcp-profile-example"
+   vmware_nsxp_metadata_proxy: "metadata_proxy-example"
+   vmware_nsxp_api_managers: "nsx-manager.local"
+   vmware_nsxp_default_vlan_tz: "vlan-tz-example"
+   vmware_nsxp_default_overlay_tz: "overlay-tz-example"
+
+.. yaml
+
+.. note::
+
+   If you want to set secure connections to VMware, set ``vmware_vcenter_insecure``
+   to false.
+   Secure connections to vCenter requires a CA file, copy the vCenter CA file to
+   ``/etc/kolla/config/vmware_ca``.
+
+.. note::
+
+   The VMware NSX-T password has to be set in ``/etc/kolla/passwords.yml``.
+
+   .. code-block:: yaml
+
+      vmware_nsxp_api_password: "xxxxx"
+      vmware_nsxp_metadata_proxy_shared_secret: "xxxxx"
+
+Then you should start :command:`kolla-ansible` deployment normally as
+KVM/QEMU deployment.
+
 VMware NSX-V
 ~~~~~~~~~~~~
 
@@ -54,14 +224,15 @@ Preparation
 
 You should have a working NSX-V environment, this part is out of scope
 of Kolla.
-For more information, please see `VMware NSX-V documentation <https://docs.vmware.com/en/VMware-NSX-for-vSphere/>`__.
+For more information, please see
+`VMware NSX-V documentation <https://docs.vmware.com/en/VMware-NSX-for-vSphere/>`__.
 
-.. note::
+------------------------------------------------------------------------------
 
-   In addition, it is important to modify the firewall rule of vSphere to make
-   sure that VNC is accessible from outside VMware environment.
+In addition, it is important to modify the firewall rule of vSphere to make
+sure that VNC is accessible from outside VMware environment.
 
-   On every VMware host, edit ``/etc/vmware/firewall/vnc.xml`` as below:
+On every VMware host, edit ``/etc/vmware/firewall/vnc.xml`` as below:
 
 .. code-block:: xml
 
@@ -87,8 +258,7 @@ For more information, please see `VMware NSX-V documentation <https://docs.vmwar
    <end>65535</end>
    </port>
    </rule>
-   <enabled>true</enabled>
-   <required>false</required>
+   <enabled>true</enabled>   <required>false</required>
    </service>
    </ConfigRoot>
 
@@ -104,6 +274,8 @@ Verify that the firewall config is applied:
 
    # esxcli network firewall ruleset list
 
+------------------------------------------------------------------------------
+
 Deployment
 ----------
 
@@ -211,7 +383,8 @@ Before deployment, you should have a working VMware vSphere environment.
 Create a cluster and a vSphere Distributed Switch with all the host in the
 cluster attached to it.
 
-For more information, please see `Setting Up Networking with vSphere Distributed Switches <http://pubs.vmware.com/vsphere-51/index.jsp#com.vmware.vsphere.networking.doc/GUID-375B45C7-684C-4C51-BA3C-70E48DFABF04.html>`__.
+For more information, please see
+`Setting Up Networking with vSphere Distributed Switches <http://pubs.vmware.com/vsphere-51/index.jsp#com.vmware.vsphere.networking.doc/GUID-375B45C7-684C-4C51-BA3C-70E48DFABF04.html>`__.
 
 Deployment
 ----------