Adds Neutron Networking Support

Implements: blueprint kube-neutron-container

Previously, only the neutron-server service was functional. This
patch adds support the the rest of the neutron services need by
Nova instances to function. The linux-bridge agent is used instead
of the OVS agent to realize network abstractions. This is because
the ovs-agent package will install the kernel module version of OVS
instead of the userspace version. Additionally, the OVS
userspace code is still very experimental and reduces performance.

Requires:

https://github.com/larsks/heat-kubernetes/pull/8

Change-Id: I5ef34ddeb48d4954934571a928cc82ae7f3a0f20

31 files changed, 490 insertions, 55 deletions

diff --git a/docker/neutron/agents/dhcp/Dockerfile b/docker/neutron/agents/dhcp/Dockerfile
new file mode 100644
index 000000000..021940c9c
--- /dev/null
+++ b/docker/neutron/agents/dhcp/Dockerfile
@@ -0,0 +1,14 @@
+FROM kollaglue/fedora-rdo-neutron-base:l3_ovs_wip
+MAINTAINER Kolla Project (https://launchpad.net/kolla)
+
+# Install required packages
+RUN yum install -y openstack-neutron \
+        yum clean all;
+
+# Add required scripts
+ADD ./start.sh /start.sh
+ADD ./check.sh /check.sh
+ADD ./sudoers.sh /sudoers.sh
+
+# Configure and run the service
+CMD ["/start.sh"]
diff --git a/docker/neutron/agents/dhcp/build b/docker/neutron/agents/dhcp/build
new file mode 120000
index 000000000..8d652f7ee
--- /dev/null
+++ b/docker/neutron/agents/dhcp/build
@@ -0,0 +1 @@
+../../../../tools/build-docker-image
\ No newline at end of file
diff --git a/docker/neutron/agents/dhcp/check.sh b/docker/neutron/agents/dhcp/check.sh
new file mode 100755
index 000000000..9c36f1996
--- /dev/null
+++ b/docker/neutron/agents/dhcp/check.sh
@@ -0,0 +1,13 @@
+#!/bin/sh
+
+RES=0
+
+check=$(/usr/bin/neutron agent-list | awk '/ DHCP / {print $9}')
+error="ERROR: Neutron DHCP Agent is not alive."
+
+if [[ $check != ":-)" ]]; then
+    echo $error >&2
+    RES=1
+fi
+
+exit $RES
diff --git a/docker/neutron/agents/dhcp/start.sh b/docker/neutron/agents/dhcp/start.sh
new file mode 100755
index 000000000..81f35dd87
--- /dev/null
+++ b/docker/neutron/agents/dhcp/start.sh
@@ -0,0 +1,37 @@
+#!/bin/bash
+
+set -e
+
+. /opt/kolla/config-neutron.sh
+. /sudoers.sh
+
+: ${INTERFACE_DRIVER:=neutron.agent.linux.interface.BridgeInterfaceDriver}
+: ${DHCP_DRIVER:=neutron.agent.linux.dhcp.Dnsmasq}
+: ${USE_NAMESPACES:=false}
+
+cfg=/etc/neutron/dhcp_agent.ini
+
+# Configure dhcp_agent.ini
+crudini --set $cfg \
+        DEFAULT \
+        verbose \
+        "${VERBOSE_LOGGING}"
+crudini --set $cfg \
+        DEFAULT \
+        debug \
+        "${DEBUG_LOGGING}"
+crudini --set $cfg \
+        DEFAULT \
+        interface_driver \
+        "${INTERFACE_DRIVER}"
+crudini --set $cfg \
+        DEFAULT \
+        dhcp_driver \
+        "${DHCP_DRIVER}"
+crudini --set $cfg \
+        DEFAULT \
+        use_namespaces \
+        "${USE_NAMESPACES}"
+
+# Start DHCP Agent
+exec /usr/bin/neutron-dhcp-agent
diff --git a/docker/neutron/agents/dhcp/sudoers.sh b/docker/neutron/agents/dhcp/sudoers.sh
new file mode 100644
index 000000000..198420026
--- /dev/null
+++ b/docker/neutron/agents/dhcp/sudoers.sh
@@ -0,0 +1,12 @@
+#!/bin/bash
+
+# Neutron uses rootwrap which requires a tty for sudo.
+# Since the container is running in daemon mode, a tty
+# is not present and requiretty must be commented out.
+if [ ! -f /var/run/sudo-modified ]; then
+  chmod 0640 /etc/sudoers
+  sed -i '/Defaults    requiretty/s/^/#/' /etc/sudoers
+  chmod 0440 /etc/sudoers
+fi
+
+touch /var/run/sudo-modified
diff --git a/docker/neutron/agents/l3/Dockerfile b/docker/neutron/agents/l3/Dockerfile
new file mode 100644
index 000000000..021940c9c
--- /dev/null
+++ b/docker/neutron/agents/l3/Dockerfile
@@ -0,0 +1,14 @@
+FROM kollaglue/fedora-rdo-neutron-base:l3_ovs_wip
+MAINTAINER Kolla Project (https://launchpad.net/kolla)
+
+# Install required packages
+RUN yum install -y openstack-neutron \
+        yum clean all;
+
+# Add required scripts
+ADD ./start.sh /start.sh
+ADD ./check.sh /check.sh
+ADD ./sudoers.sh /sudoers.sh
+
+# Configure and run the service
+CMD ["/start.sh"]
diff --git a/docker/neutron/agents/l3/build b/docker/neutron/agents/l3/build
new file mode 120000
index 000000000..8d652f7ee
--- /dev/null
+++ b/docker/neutron/agents/l3/build
@@ -0,0 +1 @@
+../../../../tools/build-docker-image
\ No newline at end of file
diff --git a/docker/neutron/agents/l3/check.sh b/docker/neutron/agents/l3/check.sh
new file mode 100755
index 000000000..b79caf8ff
--- /dev/null
+++ b/docker/neutron/agents/l3/check.sh
@@ -0,0 +1,13 @@
+#!/bin/sh
+
+RES=0
+
+check=$(/usr/bin/neutron agent-list | awk '/ L3 / {print $9}')
+error="ERROR: Neutron L3 Agent is not alive."
+
+if [[ $check != ":-)" ]]; then
+    echo $error >&2
+    RES=1
+fi
+
+exit $RES
diff --git a/docker/neutron/agents/l3/start.sh b/docker/neutron/agents/l3/start.sh
new file mode 100755
index 000000000..602bf3193
--- /dev/null
+++ b/docker/neutron/agents/l3/start.sh
@@ -0,0 +1,52 @@
+#!/bin/bash
+
+set -e
+
+. /opt/kolla/config-neutron.sh
+. /sudoers.sh
+
+: ${INTERFACE_DRIVER:=neutron.agent.linux.interface.BridgeInterfaceDriver}
+: ${USE_NAMESPACES:=false}
+
+cfg=/etc/neutron/l3_agent.ini
+
+# Configure l3_agent.ini
+crudini --set $cfg \
+        DEFAULT \
+        verbose \
+        "${VERBOSE_LOGGING}"
+crudini --set $cfg \
+        DEFAULT \
+        debug \
+        "${DEBUG_LOGGING}"
+crudini --set $cfg \
+        DEFAULT \
+        interface_driver \
+        "${INTERFACE_DRIVER}"
+crudini --set $cfg \
+        DEFAULT \
+        gateway_external_network_id \
+        ""
+crudini --set $cfg \
+        DEFAULT \
+        external_network_bridge \
+        ""
+crudini --set $cfg \
+        DEFAULT \
+        use_namespaces \
+        "${USE_NAMESPACES}"
+
+if [ "${USE_NAMESPACES}" == "false" ] || [ "${USE_NAMESPACES}" == "False" ] ; then
+  # source Keystone credential file
+  source /openrc
+  # Create router if it does not exist
+  /usr/bin/neutron router-list | grep admin-router || /usr/bin/neutron router-create admin-router
+  # Set router-id
+  crudini --set $cfg \
+        DEFAULT \
+        router_id \
+        "$(/usr/bin/neutron router-list | awk '/ admin-router / {print $2}')"
+fi
+
+# Start L3 Agent
+exec /usr/bin/neutron-l3-agent --config-file /usr/share/neutron/neutron-dist.conf --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/l3_agent.ini --config-file /etc/neutron/fwaas_driver.ini
diff --git a/docker/neutron/agents/l3/sudoers.sh b/docker/neutron/agents/l3/sudoers.sh
new file mode 100644
index 000000000..198420026
--- /dev/null
+++ b/docker/neutron/agents/l3/sudoers.sh
@@ -0,0 +1,12 @@
+#!/bin/bash
+
+# Neutron uses rootwrap which requires a tty for sudo.
+# Since the container is running in daemon mode, a tty
+# is not present and requiretty must be commented out.
+if [ ! -f /var/run/sudo-modified ]; then
+  chmod 0640 /etc/sudoers
+  sed -i '/Defaults    requiretty/s/^/#/' /etc/sudoers
+  chmod 0440 /etc/sudoers
+fi
+
+touch /var/run/sudo-modified
diff --git a/docker/neutron/agents/linux-bridge/Dockerfile b/docker/neutron/agents/linux-bridge/Dockerfile
new file mode 100644
index 000000000..40e4d17a9
--- /dev/null
+++ b/docker/neutron/agents/linux-bridge/Dockerfile
@@ -0,0 +1,15 @@
+FROM kollaglue/fedora-rdo-neutron-base:l3_ovs_wip
+MAINTAINER Kolla Project (https://launchpad.net/kolla)
+
+# Install required packages
+RUN yum install -y openstack-neutron \
+        openstack-neutron-linuxbridge \
+        yum clean all;
+
+# Add required scripts
+ADD ./start.sh /start.sh
+ADD ./check.sh /check.sh
+ADD ./sudoers.sh /sudoers.sh
+
+# Configure and run the service
+CMD ["/start.sh"]
diff --git a/docker/neutron/agents/linux-bridge/build b/docker/neutron/agents/linux-bridge/build
new file mode 120000
index 000000000..8d652f7ee
--- /dev/null
+++ b/docker/neutron/agents/linux-bridge/build
@@ -0,0 +1 @@
+../../../../tools/build-docker-image
\ No newline at end of file
diff --git a/docker/neutron/agents/linux-bridge/check.sh b/docker/neutron/agents/linux-bridge/check.sh
new file mode 100755
index 000000000..6b7db95e7
--- /dev/null
+++ b/docker/neutron/agents/linux-bridge/check.sh
@@ -0,0 +1,10 @@
+#!/bin/sh
+
+RES=0
+
+if ! /usr/sbin/brctl show; then
+    echo "ERROR: brctl show failed" >&2
+    RES=1
+fi
+
+exit $RES
diff --git a/docker/neutron/agents/linux-bridge/start.sh b/docker/neutron/agents/linux-bridge/start.sh
new file mode 100755
index 000000000..e5982fe66
--- /dev/null
+++ b/docker/neutron/agents/linux-bridge/start.sh
@@ -0,0 +1,31 @@
+#!/bin/bash
+
+set -e
+
+. /opt/kolla/config-neutron.sh
+. /sudoers.sh
+
+: ${BRIDGE_PHYSICAL_INTERFACE:=eth1}
+: ${ML2_FLAT_NETWORK:=physnet1}
+
+cfg=/etc/neutron/plugins/ml2/ml2_conf.ini
+
+# Configure ml2_conf.ini
+crudini --set $cfg \
+        ml2_type_flat \
+        flat_networks \
+        "${ML2_FLAT_NETWORK}"
+crudini --set $cfg \
+        vxlan \
+        local_ip \
+        "${PUBLIC_IP}"
+crudini --set $cfg \
+        linux_bridge \
+        physical_interface_mappings \
+        "${ML2_FLAT_NETWORK}:${BRIDGE_PHYSICAL_INTERFACE}"
+
+#Initialization scripts expect a symbolic link
+/usr/bin/ln -s /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugin.ini
+
+# Start the linux bridge agent.
+exec /usr/bin/neutron-linuxbridge-agent
diff --git a/docker/neutron/agents/linux-bridge/sudoers.sh b/docker/neutron/agents/linux-bridge/sudoers.sh
new file mode 100644
index 000000000..198420026
--- /dev/null
+++ b/docker/neutron/agents/linux-bridge/sudoers.sh
@@ -0,0 +1,12 @@
+#!/bin/bash
+
+# Neutron uses rootwrap which requires a tty for sudo.
+# Since the container is running in daemon mode, a tty
+# is not present and requiretty must be commented out.
+if [ ! -f /var/run/sudo-modified ]; then
+  chmod 0640 /etc/sudoers
+  sed -i '/Defaults    requiretty/s/^/#/' /etc/sudoers
+  chmod 0440 /etc/sudoers
+fi
+
+touch /var/run/sudo-modified
diff --git a/docker/neutron/agents/metadata/Dockerfile b/docker/neutron/agents/metadata/Dockerfile
new file mode 100644
index 000000000..021940c9c
--- /dev/null
+++ b/docker/neutron/agents/metadata/Dockerfile
@@ -0,0 +1,14 @@
+FROM kollaglue/fedora-rdo-neutron-base:l3_ovs_wip
+MAINTAINER Kolla Project (https://launchpad.net/kolla)
+
+# Install required packages
+RUN yum install -y openstack-neutron \
+        yum clean all;
+
+# Add required scripts
+ADD ./start.sh /start.sh
+ADD ./check.sh /check.sh
+ADD ./sudoers.sh /sudoers.sh
+
+# Configure and run the service
+CMD ["/start.sh"]
diff --git a/docker/neutron/agents/metadata/build b/docker/neutron/agents/metadata/build
new file mode 120000
index 000000000..8d652f7ee
--- /dev/null
+++ b/docker/neutron/agents/metadata/build
@@ -0,0 +1 @@
+../../../../tools/build-docker-image
\ No newline at end of file
diff --git a/docker/neutron/agents/metadata/check.sh b/docker/neutron/agents/metadata/check.sh
new file mode 100755
index 000000000..ba2474d48
--- /dev/null
+++ b/docker/neutron/agents/metadata/check.sh
@@ -0,0 +1,13 @@
+#!/bin/sh
+
+RES=0
+
+check=$(/usr/bin/neutron agent-list | awk '/ Metadata / {print $9}')
+error="ERROR: Neutron Metadata Agent is not alive."
+
+if [[ $check != ":-)" ]]; then
+    echo $error >&2
+    RES=1
+fi
+
+exit $RES
diff --git a/docker/neutron/agents/metadata/start.sh b/docker/neutron/agents/metadata/start.sh
new file mode 100755
index 000000000..fbe72e18f
--- /dev/null
+++ b/docker/neutron/agents/metadata/start.sh
@@ -0,0 +1,51 @@
+#!/bin/bash
+
+set -e
+
+. /opt/kolla/config-neutron.sh
+. /sudoers.sh
+
+: ${KEYSTONE_REGION:=RegionOne}
+
+cfg=/etc/neutron/metadata_agent.ini
+
+# Configure metadata_agent.ini
+crudini --set $cfg \
+        DEFAULT \
+        verbose \
+        "${VERBOSE_LOGGING}"
+crudini --set $cfg \
+        DEFAULT \
+        debug \
+        "${DEBUG_LOGGING}"
+crudini --set $cfg \
+        DEFAULT \
+        auth_region \
+        "${KEYSTONE_REGION}"
+crudini --set $cfg \
+        DEFAULT \
+        auth_url \
+        "${KEYSTONE_AUTH_PROTOCOL}://${KEYSTONE_PUBLIC_SERVICE_HOST}:5000/v2.0"
+crudini --set $cfg \
+        DEFAULT \
+        admin_tenant_name \
+        "${ADMIN_TENANT_NAME}"
+crudini --set $cfg \
+        DEFAULT \
+        admin_user \
+        "${NEUTRON_KEYSTONE_USER}"
+crudini --set $cfg \
+        DEFAULT \
+        admin_password \
+        "${NEUTRON_KEYSTONE_PASSWORD}"
+crudini --set $cfg \
+        DEFAULT \
+        nova_metadata_ip \
+        "${NOVA_API_SERVICE_HOST}"
+crudini --set $cfg \
+        DEFAULT \
+        metadata_proxy_shared_secret \
+        "${NEUTRON_SHARED_SECRET}"
+
+# Start Metadata Agent
+exec /usr/bin/neutron-metadata-agent
diff --git a/docker/neutron/agents/metadata/sudoers.sh b/docker/neutron/agents/metadata/sudoers.sh
new file mode 100644
index 000000000..198420026
--- /dev/null
+++ b/docker/neutron/agents/metadata/sudoers.sh
@@ -0,0 +1,12 @@
+#!/bin/bash
+
+# Neutron uses rootwrap which requires a tty for sudo.
+# Since the container is running in daemon mode, a tty
+# is not present and requiretty must be commented out.
+if [ ! -f /var/run/sudo-modified ]; then
+  chmod 0640 /etc/sudoers
+  sed -i '/Defaults    requiretty/s/^/#/' /etc/sudoers
+  chmod 0440 /etc/sudoers
+fi
+
+touch /var/run/sudo-modified
diff --git a/docker/neutron/neutron-base/Dockerfile b/docker/neutron/neutron-base/Dockerfile
index 33bcc371f..bf5618817 100644
--- a/docker/neutron/neutron-base/Dockerfile
+++ b/docker/neutron/neutron-base/Dockerfile
@@ -1,4 +1,4 @@
-FROM kollaglue/fedora-rdo-base
+FROM kollaglue/fedora-rdo-base:l3_ovs_wip
 MAINTAINER Kolla Project (https://launchpad.net/kolla)
 
 RUN yum -y install openstack-neutron-ml2 ; yum clean all
diff --git a/docker/neutron/neutron-base/config-neutron.sh b/docker/neutron/neutron-base/config-neutron.sh
index 1b60709af..7a68b19f2 100644
--- a/docker/neutron/neutron-base/config-neutron.sh
+++ b/docker/neutron/neutron-base/config-neutron.sh
@@ -12,6 +12,8 @@ set -e
 : ${RABBIT_HOST:=$RABBITMQ_SERVICE_HOST}
 : ${RABBIT_USER:=guest}
 : ${RABBIT_PASSWORD:=guest}
+: ${VERBOSE_LOGGING:=true}
+: ${DEBUG_LOGGING:=false}
 
 check_required_vars NEUTRON_KEYSTONE_PASSWORD
 dump_vars
@@ -23,65 +25,135 @@ export OS_PASSWORD="${NEUTRON_KEYSTONE_PASSWORD}"
 export OS_TENANT_NAME="${ADMIN_TENANT_NAME}"
 EOF
 
+core_cfg=/etc/neutron/neutron.conf
+ml2_cfg=/etc/neutron/plugins/ml2/ml2_conf.ini
+
+# Logging
+crudini --set $core_cfg \
+        DEFAULT \
+        log_dir \
+        "/var/log/neutron"
+crudini --set $core_cfg \
+        DEFAULT \
+        verbose \
+        "${VERBOSE_LOGGING}"
+crudini --set $core_cfg \
+        DEFAULT \
+        debug \
+        "${DEBUG_LOGGING}"
+
 # Rabbit
-crudini --set /etc/neutron/neutron.conf \
+crudini --set $core_cfg \
         DEFAULT \
         rabbit_host \
         "${RABBIT_HOST}"
-crudini --set /etc/neutron/neutron.conf \
+crudini --set $core_cfg \
         DEFAULT \
         rabbit_userid \
         "${RABBIT_USER}"
-crudini --set /etc/neutron/neutron.conf \
+crudini --set $core_cfg \
         DEFAULT \
         rabbit_password \
         "${RABBIT_PASSWORD}"
 
 # Keystone
-crudini --set /etc/neutron/neutron.conf \
+crudini --set $core_cfg \
         DEFAULT \
         auth_strategy \
         "keystone"
-crudini --set /etc/neutron/neutron.conf \
+crudini --set $core_cfg \
         keystone_authtoken \
         auth_protocol \
         "${KEYSTONE_AUTH_PROTOCOL}"
-crudini --set /etc/neutron/neutron.conf \
+crudini --set $core_cfg \
         keystone_authtoken \
         auth_host \
         "${KEYSTONE_ADMIN_SERVICE_HOST}"
-crudini --set /etc/neutron/neutron.conf \
+crudini --set $core_cfg \
         keystone_authtoken \
         auth_port \
         "${KEYSTONE_ADMIN_SERVICE_PORT}"
-crudini --set /etc/neutron/neutron.conf \
+crudini --set $core_cfg \
         keystone_authtoken \
         auth_uri \
         "${KEYSTONE_AUTH_PROTOCOL}://${KEYSTONE_PUBLIC_SERVICE_HOST}:5000/"
-crudini --set /etc/neutron/neutron.conf \
+crudini --set $core_cfg \
         keystone_authtoken \
         admin_tenant_name \
         "${ADMIN_TENANT_NAME}"
-crudini --set /etc/neutron/neutron.conf \
+crudini --set $core_cfg \
         keystone_authtoken \
         admin_user \
         "${NEUTRON_KEYSTONE_USER}"
-crudini --set /etc/neutron/neutron.conf \
+crudini --set $core_cfg \
         keystone_authtoken \
         admin_password \
         "${NEUTRON_KEYSTONE_PASSWORD}"
 
-# ML2
-crudini --set /etc/neutron/neutron.conf \
+# neutron.conf ml2 configuration
+crudini --set $core_cfg \
         DEFAULT \
         core_plugin \
         "ml2"
-crudini --set /etc/neutron/neutron.conf \
+crudini --set $core_cfg \
         DEFAULT \
         service_plugins \
         "router"
-crudini --set /etc/neutron/neutron.conf \
+crudini --set $core_cfg \
         DEFAULT \
         allow_overlapping_ips \
-        "True"
+        "False"
 
+# Configure ml2_conf.ini
+crudini --set $ml2_cfg \
+        ml2 \
+        type_drivers \
+        "flat,vxlan"
+crudini --set $ml2_cfg \
+        ml2 \
+        tenant_network_types \
+        "vxlan"
+crudini --set $ml2_cfg \
+        ml2 \
+        mechanism_drivers \
+        "linuxbridge,l2population"
+crudini --set $ml2_cfg \
+        ml2_type_vxlan \
+        vxlan_group \
+        ""
+crudini --set $ml2_cfg \
+        ml2_type_vxlan \
+        vni_ranges \
+        "1:1000"
+crudini --set $ml2_cfg \
+        vxlan \
+        enable_vxlan \
+        "True"
+crudini --set $ml2_cfg \
+        vxlan \
+        vxlan_group \
+        ""
+crudini --set $ml2_cfg \
+        vxlan \
+        l2_population \
+        "True"
+crudini --set $ml2_cfg \
+        agent \
+        tunnel_types \
+        "vxlan"
+crudini --set $ml2_cfg \
+        agent \
+        vxlan_udp_port \
+        "4789"
+crudini --set $ml2_cfg \
+        l2pop \
+        agent_boot_time \
+        "180"
+crudini --set $ml2_cfg \
+        securitygroup \
+        enable_security_group \
+        "True"
+crudini --set $ml2_cfg \
+        securitygroup \
+        firewall_driver \
+        "neutron.agent.linux.iptables_firewall.IptablesFirewallDriver"
diff --git a/docker/neutron/neutron-server/Dockerfile b/docker/neutron/neutron-server/Dockerfile
index 02e2e809f..6c3025e0c 100644
--- a/docker/neutron/neutron-server/Dockerfile
+++ b/docker/neutron/neutron-server/Dockerfile
@@ -1,4 +1,4 @@
-FROM kollaglue/fedora-rdo-neutron-base
+FROM kollaglue/fedora-rdo-neutron-base:l3_ovs_wip
 MAINTAINER Kolla Project (https://launchpad.net/kolla)
 
 #Install required packages
diff --git a/docker/neutron/neutron-server/start.sh b/docker/neutron/neutron-server/start.sh
index 92ab935c5..ffa90a218 100755
--- a/docker/neutron/neutron-server/start.sh
+++ b/docker/neutron/neutron-server/start.sh
@@ -73,32 +73,6 @@ crudini --set /etc/neutron/neutron.conf \
         nova_admin_password \
         "${NOVA_ADMIN_PASSWORD}"
 
-# Configure ml2_conf.ini
-crudini --set /etc/neutron/plugins/ml2/ml2_conf.ini \
-        ml2 \
-        type_drivers \
-        "gre"
-crudini --set /etc/neutron/plugins/ml2/ml2_conf.ini \
-        ml2 \
-        tenant_network_types \
-        "gre"
-crudini --set /etc/neutron/plugins/ml2/ml2_conf.ini \
-        ml2 \
-        mechanism_drivers \
-        "openvswitch"
-crudini --set /etc/neutron/plugins/ml2/ml2_conf.ini \
-        ml2_type_gre \
-        tunnel_id_ranges \
-        "1:1000"
-crudini --set /etc/neutron/plugins/ml2/ml2_conf.ini \
-        securitygroup \
-        firewall_driver \
-        "neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver"
-crudini --set /etc/neutron/plugins/ml2/ml2_conf.ini \
-        securitygroup \
-        enable_security_group \
-        "True"
-
 /usr/bin/ln -s /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugin.ini
 
 exec /usr/bin/neutron-server
diff --git a/docker/nova-base/config-nova.sh b/docker/nova-base/config-nova.sh
index 3f8e4c624..359468e92 100755
--- a/docker/nova-base/config-nova.sh
+++ b/docker/nova-base/config-nova.sh
@@ -9,6 +9,7 @@
 : ${ADMIN_TENANT_NAME:=admin}
 : ${RABBIT_USERID:=guest}
 : ${RABBIT_PASSWORD:=guest}
+: ${NETWORK_MANAGER:=nova}
 
 check_required_vars KEYSTONE_ADMIN_TOKEN \
     NOVA_DB_PASSWORD
@@ -61,6 +62,30 @@ crudini --set $cfg DEFAULT admin_token "${KEYSTONE_ADMIN_TOKEN}"
 
 crudini --set $cfg conductor workers 8
 
+if [ "${NETWORK_MANAGER}" == "nova" ] ; then
+  crudini --set $cfg DEFAULT network_manager nova.network.manager.FlatDHCPManager
+  crudini --set $cfg DEFAULT firewall_driver nova.virt.libvirt.firewall.IptablesFirewallDriver
+  crudini --set $cfg DEFAULT network_size 254
+  crudini --set $cfg DEFAULT allow_same_net_traffic False
+  crudini --set $cfg DEFAULT multi_host True
+  crudini --set $cfg DEFAULT send_arp_for_ha True
+  crudini --set $cfg DEFAULT share_dhcp_address True
+  crudini --set $cfg DEFAULT force_dhcp_release True
+  crudini --set $cfg DEFAULT flat_interface eth0
+  crudini --set $cfg DEFAULT flat_network_bridge br100
+  crudini --set $cfg DEFAULT public_interface eth1
+elif [ "${NETWORK_MANAGER}" == "neutron" ] ; then
+  crudini --set $cfg DEFAULT service_neutron_metadata_proxy True
+  crudini --set $cfg DEFAULT neutron_metadata_proxy_shared_secret ${NEUTRON_SHARED_SECRET}
+  crudini --set $cfg DEFAULT neutron_default_tenant_id default
+  crudini --set $cfg DEFAULT network_api_class nova.network.neutronv2.api.API
+  crudini --set $cfg DEFAULT security_group_api neutron
+  crudini --set $cfg DEFAULT firewall_driver nova.virt.firewall.NoopFirewallDriver
+else
+  echo "Incorrect NETWORK_MANAGER ${NETWORK_MANAGER}. Supported options are nova and neutron."
+  exit 1
+fi
+
 # disabled pending answers to http://lists.openstack.org/pipermail/openstack/2014-October/009997.html
 #for option in auth_protocol auth_host auth_port; do
 #    crudini --del $cfg \
diff --git a/docker/nova-controller/nova-api/Dockerfile b/docker/nova-controller/nova-api/Dockerfile
index b20bd4547..22cb28bd9 100644
--- a/docker/nova-controller/nova-api/Dockerfile
+++ b/docker/nova-controller/nova-api/Dockerfile
@@ -1,4 +1,4 @@
-FROM kollaglue/fedora-rdo-nova-base
+FROM kollaglue/fedora-rdo-nova-base:l3_ovs_wip
 MAINTAINER Kolla Project (https://launchpad.net/kolla)
 
 RUN yum -y install \
diff --git a/docker/nova-controller/nova-conductor/Dockerfile b/docker/nova-controller/nova-conductor/Dockerfile
index 4d7502d41..958b682b8 100644
--- a/docker/nova-controller/nova-conductor/Dockerfile
+++ b/docker/nova-controller/nova-conductor/Dockerfile
@@ -1,4 +1,4 @@
-FROM kollaglue/fedora-rdo-nova-base
+FROM kollaglue/fedora-rdo-nova-base:l3_ovs_wip
 MAINTAINER Kolla Project (https://launchpad.net/kolla)
 
 RUN yum -y install \
diff --git a/docker/nova-controller/nova-scheduler/Dockerfile b/docker/nova-controller/nova-scheduler/Dockerfile
index 14b49ba0a..8a44cbe6e 100644
--- a/docker/nova-controller/nova-scheduler/Dockerfile
+++ b/docker/nova-controller/nova-scheduler/Dockerfile
@@ -1,4 +1,4 @@
-FROM kollaglue/fedora-rdo-nova-base
+FROM kollaglue/fedora-rdo-nova-base:l3_ovs_wip
 MAINTAINER Kolla Project (https://launchpad.net/kolla)
 
 RUN yum -y install \
diff --git a/k8s/pod/neutron-network-pod.yaml b/k8s/pod/neutron-network-pod.yaml
new file mode 100644
index 000000000..a9fcfacd2
--- /dev/null
+++ b/k8s/pod/neutron-network-pod.yaml
@@ -0,0 +1,30 @@
+desiredState:
+  manifest:
+    containers:
+      - name: neutron-linux-bridge
+        image: kollaglue/fedora-rdo-linux-bridge:l3_ovs_wip
+        env:
+          - name: CONFIG_NETWORK
+            value: true
+          - name: NEUTRON_KEYSTONE_PASSWORD
+            value: password
+      - name: neutron-l3-agent
+        image: kollaglue/fedora-rdo-l3:l3_ovs_wip
+        env:
+          - name: NEUTRON_KEYSTONE_PASSWORD
+            value: password
+      - name: neutron-dhcp-agent
+        image: kollaglue/fedora-rdo-dhcp:l3_ovs_wip
+        env:
+          - name: NEUTRON_KEYSTONE_PASSWORD
+            value: password
+      - name: neutron-metadata-agent
+        image: kollaglue/fedora-rdo-metadata:l3_ovs_wip
+        env:
+          - name: NEUTRON_KEYSTONE_PASSWORD
+            value: password
+    id: neutron-network-1
+    version: v1beta1
+id: neutron-network
+labels:
+  name: neutron-network
diff --git a/k8s/pod/neutron-controller-pod.yaml b/k8s/pod/neutron-server-pod.yaml
index b614bed41..a8d18ee8b 100644
--- a/k8s/pod/neutron-controller-pod.yaml
+++ b/k8s/pod/neutron-server-pod.yaml
@@ -17,14 +17,14 @@ desiredState:
             value: ADMINTOKEN
           - name: NOVA_ADMIN_PASSWORD
             value: kolla
-        image: kollaglue/fedora-rdo-neutron-server
+        image: kollaglue/fedora-rdo-neutron-server:l3_ovs_wip
         ports:
           - containerPort: 9696
         volumeMounts:
           - name: neutron-data
             mountPath: /var/lib/neutron
-    id: neutron-controller-1
+    id: neutron-server-1
     version: v1beta1
-id: neutron-controller
+id: neutron-server
 labels:
-  name: neutron
+  name: neutron-server
diff --git a/k8s/pod/nova-controller-pod.yaml b/k8s/pod/nova-controller-pod.yaml
index b7e9bce0d..903400887 100644
--- a/k8s/pod/nova-controller-pod.yaml
+++ b/k8s/pod/nova-controller-pod.yaml
@@ -2,6 +2,8 @@ desiredState:
   manifest:
     containers:
     - env:
+      - name: NETWORK_MANAGER
+        value: neutron
       - name: DB_ROOT_PASSWORD
         value: password
       - name: NOVA_DB_PASSWORD
@@ -10,9 +12,11 @@ desiredState:
         value: ADMINTOKEN
       - name: NEUTRON_SHARED_SECRET
         value: sharedsecret
-      image: kollaglue/fedora-rdo-nova-conductor
+      image: kollaglue/fedora-rdo-nova-conductor:l3_ovs_wip
       name: nova-conductor
     - env:
+      - name: NETWORK_MANAGER
+        value: neutron
       - name: DB_ROOT_PASSWORD
         value: password
       - name: NOVA_DB_PASSWORD
@@ -21,9 +25,11 @@ desiredState:
         value: ADMINTOKEN
       - name: NEUTRON_SHARED_SECRET
         value: sharedsecret
-      image: kollaglue/fedora-rdo-nova-scheduler
+      image: kollaglue/fedora-rdo-nova-scheduler:l3_ovs_wip
       name: nova-scheduler
     - env:
+      - name: NETWORK_MANAGER
+        value: neutron
       - name: DB_ROOT_PASSWORD
         value: password
       - name: NOVA_DB_PASSWORD
@@ -32,12 +38,11 @@ desiredState:
         value: ADMINTOKEN
       - name: NEUTRON_SHARED_SECRET
         value: sharedsecret
-      image: kollaglue/fedora-rdo-nova-api
+      image: kollaglue/fedora-rdo-nova-api:l3_ovs_wip
       name: nova-api
       privileged: true
     id: nova-1
     version: v1beta1
-
 id: nova
 labels:
   name: nova-controller