DHCPv6固定分配

Question

尝试将固定的ipv6地址分配给来自Centos的coreos主节点和工作节点，以便在集群上运行双堆栈。但是，我很难让它分配我在dhcp6.conf文件中硬编码的固定ip地址，如下所示：

[root@ocp-svc ~]# cat /etc/dhcp/dhcpd6.conf
#
# DHCPv6 Server Configuration file.
#   see /usr/share/doc/dhcp-server/dhcpd6.conf.example
#   see dhcpd.conf(5) man page
#
authoritative;
ddns-update-style interim;
allow booting;
allow bootp;
allow unknown-clients;
ignore client-updates;
default-lease-time 14400;
max-lease-time 14400;


subnet6 fd00::/64 {
 range6 fd::1000 fd::2000
 option dhcp6.name-servers fd00::1;
 option dhcp6.domain-search "ocp.lan";
}
host otherclient {
        # This host entry is hopefully matched if the client supplies a DUID-LL
        # or DUID-LLT containing this MAC address.
        hardware ethernet 00:0c:29:5e:d2:37;
        fixed-address6 fd00::211;
}

我使用的系统如下：

[root@ocp-svc performanceoperator]# cat /etc/redhat-release
CentOS Linux release 8.5.2111

还在配置中添加了以下两行，以便允许SE访问目录：

ausearch -c 'dhcpd' --raw | audit2allow -M my-dhcpd
semodule -X 300 -i my-dhcpd.pp
systemctl restart dhcpd

并在messages日志工具中看到这些消息：

Dec 13 19:52:13 ocp-svc systemd[1]: Stopping DHCPv4 Server Daemon...
Dec 13 19:52:13 ocp-svc systemd[1]: dhcpd.service: Succeeded.
Dec 13 19:52:13 ocp-svc systemd[1]: Stopped DHCPv4 Server Daemon.
Dec 13 19:52:13 ocp-svc systemd[1]: Starting DHCPv4 Server Daemon...
Dec 13 19:52:13 ocp-svc dhcpd[199778]: Internet Systems Consortium DHCP Server 4.3.6
Dec 13 19:52:13 ocp-svc dhcpd[199778]: Copyright 2004-2017 Internet Systems Consortium.
Dec 13 19:52:13 ocp-svc dhcpd[199778]: All rights reserved.
Dec 13 19:52:13 ocp-svc dhcpd[199778]: For info, please visit https://www.isc.org/software/dhcp/
Dec 13 19:52:13 ocp-svc dhcpd[199778]: ldap_gssapi_principal is not set,GSSAPI Authentication for LDAP will not be used
Dec 13 19:52:13 ocp-svc dhcpd[199778]: Not searching LDAP since ldap-server, ldap-port and ldap-base-dn were not specified in the config file
Dec 13 19:52:13 ocp-svc dbus-daemon[1024]: [system] Activating service name='org.fedoraproject.Setroubleshootd' requested by ':1.14' (uid=0 pid=1001 comm="/usr/sbin/sedispatch " label="system_u:system_r:auditd_t:s0") (using servicehelper)
Dec 13 19:52:13 ocp-svc dhcpd[199778]: Config file: /etc/dhcp/dhcpd.conf
Dec 13 19:52:13 ocp-svc dhcpd[199778]: Database file: /var/lib/dhcpd/dhcpd.leases
Dec 13 19:52:13 ocp-svc dhcpd[199778]: PID file: /var/run/dhcpd.pid
Dec 13 19:52:13 ocp-svc dhcpd[199778]: Source compiled to use binary-leases
Dec 13 19:52:13 ocp-svc dhcpd[199778]: Wrote 0 deleted host decls to leases file.
Dec 13 19:52:13 ocp-svc dhcpd[199778]: Wrote 0 new dynamic host decls to leases file.
Dec 13 19:52:13 ocp-svc dhcpd[199778]: Wrote 1 leases to leases file.
Dec 13 19:52:13 ocp-svc dhcpd[199778]: Listening on LPF/ens224/00:0c:29:70:9c:d0/192.168.22.0/24
Dec 13 19:52:13 ocp-svc dhcpd[199778]: Sending on   LPF/ens224/00:0c:29:70:9c:d0/192.168.22.0/24
Dec 13 19:52:13 ocp-svc dhcpd[199778]:
Dec 13 19:52:13 ocp-svc dhcpd[199778]: No subnet declaration for ens192 (192.168.0.139).
Dec 13 19:52:13 ocp-svc dhcpd[199778]: ** Ignoring requests on ens192.  If this is not what
Dec 13 19:52:13 ocp-svc dhcpd[199778]:   you want, please write a subnet declaration
Dec 13 19:52:13 ocp-svc dhcpd[199778]:   in your dhcpd.conf file for the network segment
Dec 13 19:52:13 ocp-svc dhcpd[199778]:   to which interface ens192 is attached. **
Dec 13 19:52:13 ocp-svc dhcpd[199778]:
Dec 13 19:52:13 ocp-svc dhcpd[199778]: Sending on   Socket/fallback/fallback-net
Dec 13 19:52:13 ocp-svc dhcpd[199778]: Server starting service.
Dec 13 19:52:13 ocp-svc systemd[1]: Started DHCPv4 Server Daemon.
Dec 13 19:52:14 ocp-svc dbus-daemon[1024]: [system] Successfully activated service 'org.fedoraproject.Setroubleshootd'
Dec 13 19:52:15 ocp-svc dbus-daemon[1024]: [system] Activating service name='org.fedoraproject.SetroubleshootPrivileged' requested by ':1.224' (uid=995 pid=199781 comm="/usr/libexec/platform-python -Es /usr/sbin/setroub" label="system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023") (using servicehelper)
Dec 13 19:52:16 ocp-svc dbus-daemon[1024]: [system] Successfully activated service 'org.fedoraproject.SetroubleshootPrivileged'

检查了dhcpd服务状态，它看起来也不错：

[root@ocp-svc ~]# systemctl status dhcpd
● dhcpd.service - DHCPv4 Server Daemon
   Loaded: loaded (/usr/lib/systemd/system/dhcpd.service; enabled; vendor preset: disabled)
   Active: active (running) since Mon 2021-12-13 20:05:21 CST; 8s ago
     Docs: man:dhcpd(8)
           man:dhcpd.conf(5)
 Main PID: 213030 (dhcpd)
   Status: "Dispatching packets..."
    Tasks: 1 (limit: 101086)
   Memory: 10.2M
   CGroup: /system.slice/dhcpd.service
           └─213030 /usr/sbin/dhcpd -f -cf /etc/dhcp/dhcpd.conf -user dhcpd -group dhcpd --no-pid

Dec 13 20:05:21 ocp-svc.lab.ocp.lan dhcpd[213030]:
Dec 13 20:05:21 ocp-svc.lab.ocp.lan dhcpd[213030]: No subnet declaration for ens192 (192.168.0.139).
Dec 13 20:05:21 ocp-svc.lab.ocp.lan dhcpd[213030]: ** Ignoring requests on ens192.  If this is not what
Dec 13 20:05:21 ocp-svc.lab.ocp.lan dhcpd[213030]:    you want, please write a subnet declaration
Dec 13 20:05:21 ocp-svc.lab.ocp.lan dhcpd[213030]:    in your dhcpd.conf file for the network segment
Dec 13 20:05:21 ocp-svc.lab.ocp.lan dhcpd[213030]:    to which interface ens192 is attached. **
Dec 13 20:05:21 ocp-svc.lab.ocp.lan dhcpd[213030]:
Dec 13 20:05:21 ocp-svc.lab.ocp.lan dhcpd[213030]: Sending on   Socket/fallback/fallback-net
Dec 13 20:05:21 ocp-svc.lab.ocp.lan dhcpd[213030]: Server starting service.
Dec 13 20:05:21 ocp-svc.lab.ocp.lan systemd[1]: Started DHCPv4 Server Daemon.

有人能说明一下我还会错过什么吗？任何帮助都是非常感谢的。

为了遵守SElinux (dhcpd6)，在一些research....but还没有做much...argh之后，我现在添加了以下内容。

[root@ocp-svc etc]# ausearch -c 'dhcpd6' --raw | audit2allow -M my-dhcpd6
Nothing to do
[root@ocp-svc etc]# semodule -i my-dhcpd6.pp

Answer 1

当您可能需要dhcpd时启动dhcpd6

subnet6 fd00::/64 {和range6 fd::不匹配。

host声明在subnet之外

一次重新安排的尝试，希望能奏效。

subnet6 fd00::/64 {
 range6 fd00::1000 fd00::2000
 option dhcp6.name-servers fd00::1;
 option dhcp6.domain-search "ocp.lan";

 host otherclient {
        # This host entry is hopefully matched if the client supplies a DUID-LL
        # or DUID-LLT containing this MAC address.
        hardware ethernet 00:0c:29:5e:d2:37;
        fixed-address6 fd00::211;
 }
}

我会尝试使用一个可能更统一的范围，只是为了简化将来与其他网的任何合并，请参阅https://en.wikipedia.org/wiki/Unique_本地_address#Attempts_的_注册_和_分配。

例如：fd00:10c9::用于1AN-0cp。