Merge "docs: add octavia auto-configuration"
This commit is contained in:
Zuul
Gerrit Code Review
commit
5424f09ef3
@ -7,12 +7,225 @@ of Octavia for the Amphora driver. See the :octavia-doc:`Octavia documentation
|
|||||||
<>` for full details. The :octavia-doc:`installation guide
|
<>` for full details. The :octavia-doc:`installation guide
|
||||||
<install/install-ubuntu.html>` is a useful reference.
|
<install/install-ubuntu.html>` is a useful reference.
|
||||||
|
|
||||||
Resources
|
Enabling Octavia
|
||||||
=========
|
================
|
||||||
|
|
||||||
Currently in Kolla Ansible it is necessary to manually register the OpenStack
|
Enable the octavia service in ``globals.yml``:
|
||||||
resources required by Octavia. Kolla Ansible aims to automate this in the
|
|
||||||
future.
|
.. code-block:: yaml
|
||||||
|
|
||||||
|
enable_octavia: "yes"
|
||||||
|
|
||||||
|
Certificates
|
||||||
|
============
|
||||||
|
|
||||||
|
Octavia requires various TLS certificates for operation. Since the Victoria
|
||||||
|
release, Kolla Ansible supports generating these certificates automatically.
|
||||||
|
|
||||||
|
Option 1: Automatically generating Certificates
|
||||||
|
-----------------------------------------------
|
||||||
|
|
||||||
|
Kolla Ansible provides default values for the certificate issuer and owner
|
||||||
|
fields. You can customize this via ``globals.yml``, for example:
|
||||||
|
|
||||||
|
.. code-block:: yaml
|
||||||
|
|
||||||
|
octavia_certs_country: US
|
||||||
|
octavia_certs_state: Oregon
|
||||||
|
octavia_certs_organization: OpenStack
|
||||||
|
octavia_certs_organizational_unit: Octavia
|
||||||
|
|
||||||
|
Generate octavia certificates:
|
||||||
|
|
||||||
|
.. code-block:: console
|
||||||
|
|
||||||
|
kolla-ansible octavia-certificates
|
||||||
|
|
||||||
|
The certificates and keys will be generated under
|
||||||
|
``/etc/kolla/config/octavia``.
|
||||||
|
|
||||||
|
Option 2: Manually generating certificates
|
||||||
|
------------------------------------------
|
||||||
|
|
||||||
|
Follow the :octavia-doc:`octavia documentation
|
||||||
|
<admin/guides/certificates.html>` to generate certificates for Amphorae. These
|
||||||
|
should be copied to the Kolla Ansible configuration as follows:
|
||||||
|
|
||||||
|
.. code-block:: ini
|
||||||
|
|
||||||
|
cp client_ca/certs/ca.cert.pem /etc/kolla/config/octavia/client_ca.cert.pem
|
||||||
|
cp server_ca/certs/ca.cert.pem /etc/kolla/config/octavia/server_ca.cert.pem
|
||||||
|
cp server_ca/private/ca.key.pem /etc/kolla/config/octavia/server_ca.key.pem
|
||||||
|
cp client_ca/private/client.cert-and-key.pem /etc/kolla/config/octavia/client.cert-and-key.pem
|
||||||
|
|
||||||
|
The following option should be set in ``passwords.yml``, matching the password
|
||||||
|
used to encrypt the CA key:
|
||||||
|
|
||||||
|
.. code-block:: yaml
|
||||||
|
|
||||||
|
octavia_ca_password: <CA key password>
|
||||||
|
|
||||||
|
.. _octavia-network:
|
||||||
|
|
||||||
|
Networking
|
||||||
|
==========
|
||||||
|
|
||||||
|
Octavia worker and health manager nodes must have access to the Octavia
|
||||||
|
management network for communication with Amphorae.
|
||||||
|
|
||||||
|
If using a VLAN for the Octavia management network, enable Neutron provider
|
||||||
|
networks:
|
||||||
|
|
||||||
|
.. code-block:: yaml
|
||||||
|
|
||||||
|
enable_neutron_provider_networks: yes
|
||||||
|
|
||||||
|
Configure the name of the network interface on the controllers used to access
|
||||||
|
the Octavia management network. If using a VLAN provider network, ensure that
|
||||||
|
the traffic is also bridged to Open vSwitch on the controllers.
|
||||||
|
|
||||||
|
.. code-block:: yaml
|
||||||
|
|
||||||
|
octavia_network_interface: <network interface on controllers>
|
||||||
|
|
||||||
|
This interface should have an IP address on the Octavia management subnet.
|
||||||
|
|
||||||
|
Registering OpenStack resources
|
||||||
|
===============================
|
||||||
|
|
||||||
|
Since the Victoria release, there are two ways to configure Octavia.
|
||||||
|
|
||||||
|
1. Kolla Ansible automatically registers resources for Octavia during
|
||||||
|
deployment
|
||||||
|
2. Operator registers resources for Octavia after it is deployed
|
||||||
|
|
||||||
|
The first option is simpler, and is recommended for new users. The second
|
||||||
|
option provides more flexibility, at the cost of complexity for the operator.
|
||||||
|
|
||||||
|
Option 1: Automatic resource registration (default, recommended)
|
||||||
|
================================================================
|
||||||
|
|
||||||
|
For automatic resource registration, Kolla Ansible will register the following
|
||||||
|
resources:
|
||||||
|
|
||||||
|
* Nova flavor
|
||||||
|
* Nova SSH keypair
|
||||||
|
* Neutron network and subnet
|
||||||
|
* Neutron security groups
|
||||||
|
|
||||||
|
The configuration for these resources may be customised before deployment.
|
||||||
|
|
||||||
|
Customize Amphora flavor
|
||||||
|
------------------------
|
||||||
|
|
||||||
|
The default amphora flavor is named ``amphora`` with 1 VCPUs, 1GB RAM and 5GB
|
||||||
|
disk. you can customize this flavor by changing ``octavia_amphora_flavor`` in
|
||||||
|
``globals.yml``
|
||||||
|
|
||||||
|
See the ``os_nova_flavor`` Ansible module for details. Supported parameters
|
||||||
|
are:
|
||||||
|
|
||||||
|
- ``disk``
|
||||||
|
- ``ephemeral`` (optional)
|
||||||
|
- ``extra_specs`` (optional)
|
||||||
|
- ``flavorid`` (optional)
|
||||||
|
- ``is_public`` (optional)
|
||||||
|
- ``name``
|
||||||
|
- ``ram``
|
||||||
|
- ``swap`` (optional)
|
||||||
|
- ``vcpus``
|
||||||
|
|
||||||
|
The following defaults are used:
|
||||||
|
|
||||||
|
.. code-block:: yaml
|
||||||
|
|
||||||
|
octavia_amp_flavor:
|
||||||
|
name: "amphora"
|
||||||
|
is_public: no
|
||||||
|
vcpus: 1
|
||||||
|
ram: 1024
|
||||||
|
disk: 5
|
||||||
|
|
||||||
|
Customise network and subnet
|
||||||
|
----------------------------
|
||||||
|
|
||||||
|
Configure octavia management network and subnet in ``globals.yml``. This must
|
||||||
|
be a network that is :ref:`accessible from the controllers
|
||||||
|
<octavia-network>`. Typically a VLAN provider network is used.
|
||||||
|
|
||||||
|
See the ``os_network`` and ``os_subnet`` Ansible modules for details. Supported
|
||||||
|
parameters:
|
||||||
|
|
||||||
|
The network parameter has the following supported parameters:
|
||||||
|
|
||||||
|
- ``external`` (optional)
|
||||||
|
- ``mtu`` (optional)
|
||||||
|
- ``name``
|
||||||
|
- ``provider_network_type`` (optional)
|
||||||
|
- ``provider_physical_network`` (optional)
|
||||||
|
- ``provider_segmentation_id`` (optional)
|
||||||
|
- ``shared`` (optional)
|
||||||
|
- ``subnet``
|
||||||
|
|
||||||
|
The subnet parameter has the following supported parameters:
|
||||||
|
|
||||||
|
- ``allocation_pool_start`` (optional)
|
||||||
|
- ``allocation_pool_end`` (optional)
|
||||||
|
- ``cidr``
|
||||||
|
- ``enable_dhcp`` (optional)
|
||||||
|
- ``gateway_ip`` (optional)
|
||||||
|
- ``name``
|
||||||
|
- ``no_gateway_ip`` (optional)
|
||||||
|
|
||||||
|
For example:
|
||||||
|
|
||||||
|
.. code-block:: yaml
|
||||||
|
|
||||||
|
octavia_amp_network:
|
||||||
|
name: lb-mgmt-net
|
||||||
|
provider_network_type: vlan
|
||||||
|
provider_segmentation_id: 1000
|
||||||
|
provider_physical_network: physnet1
|
||||||
|
external: false
|
||||||
|
shared: false
|
||||||
|
subnet:
|
||||||
|
name: lb-mgmt-subnet
|
||||||
|
cidr: "10.1.2.0/24"
|
||||||
|
allocation_pool_start: "10.1.2.100"
|
||||||
|
allocation_pool_end: "10.1.2.200"
|
||||||
|
gateway_ip: "10.1.2.1"
|
||||||
|
enable_dhcp: yes
|
||||||
|
|
||||||
|
Deploy Octavia with Kolla Ansible:
|
||||||
|
|
||||||
|
.. code-block:: console
|
||||||
|
|
||||||
|
kolla-ansible -i <inventory> deploy --tags common,horizon,octavia
|
||||||
|
|
||||||
|
Once the installation is completed, you need to :ref:`register an amphora image
|
||||||
|
in glance <octavia-amphora-image>`.
|
||||||
|
|
||||||
|
Option 2: Manual resource registration
|
||||||
|
======================================
|
||||||
|
|
||||||
|
In this case, Kolla Ansible will not register resources for Octavia. Set
|
||||||
|
``octavia_auto_configure`` to no in ``globals.yml``:
|
||||||
|
|
||||||
|
.. code-block:: yaml
|
||||||
|
|
||||||
|
octavia_auto_configure: no
|
||||||
|
|
||||||
|
All resources should be registered in the ``service`` project. This can be done
|
||||||
|
as follows:
|
||||||
|
|
||||||
|
.. code-block:: console
|
||||||
|
|
||||||
|
source /etc/kolla/octavia-openrc.sh
|
||||||
|
|
||||||
|
.. note::
|
||||||
|
|
||||||
|
Ensure that you have executed ``kolla-ansible post-deploy`` and set
|
||||||
|
``enable_octavia`` to yes in ``global.yml``
|
||||||
|
|
||||||
.. note::
|
.. note::
|
||||||
|
|
||||||
@ -24,21 +237,83 @@ future.
|
|||||||
network should be recreated in the new project, although this will impact
|
network should be recreated in the new project, although this will impact
|
||||||
existing Amphorae.
|
existing Amphorae.
|
||||||
|
|
||||||
All resources should be registered in the ``service`` project. This can be done
|
Amphora flavor
|
||||||
as follows:
|
--------------
|
||||||
|
|
||||||
|
Register the flavor in Nova:
|
||||||
|
|
||||||
.. code-block:: console
|
.. code-block:: console
|
||||||
|
|
||||||
source admin-openrc.sh
|
openstack flavor create --vcpus 1 --ram 1024 --disk 2 "amphora" --private
|
||||||
export OS_USERNAME=octavia
|
|
||||||
export OS_PASSWORD=<octavia keystone password>
|
|
||||||
export OS_PROJECT_NAME=service
|
|
||||||
export OS_TENANT_NAME=service
|
|
||||||
|
|
||||||
You can find the Octavia password in ``passwords.yml``.
|
Make a note of the ID of the flavor, or specify one via ``--id``.
|
||||||
|
|
||||||
|
Keypair
|
||||||
|
-------
|
||||||
|
|
||||||
|
Register the keypair in Nova:
|
||||||
|
|
||||||
|
.. code-block:: console
|
||||||
|
|
||||||
|
openstack keypair create --public-key <path to octavia public key> octavia_ssh_key
|
||||||
|
|
||||||
|
Network and subnet
|
||||||
|
------------------
|
||||||
|
|
||||||
|
Register the management network and subnet in Neutron. This must be a network
|
||||||
|
that is :ref:`accessible from the controllers <octavia-network>`. Typically
|
||||||
|
a VLAN provider network is used.
|
||||||
|
|
||||||
|
.. code-block:: console
|
||||||
|
|
||||||
|
OCTAVIA_MGMT_SUBNET=192.168.43.0/24
|
||||||
|
OCTAVIA_MGMT_SUBNET_START=192.168.43.10
|
||||||
|
OCTAVIA_MGMT_SUBNET_END=192.168.43.254
|
||||||
|
|
||||||
|
openstack network create lb-mgmt-net --provider-network-type vlan --provider-segment 107 --provider-physical-network physnet1
|
||||||
|
openstack subnet create --subnet-range $OCTAVIA_MGMT_SUBNET --allocation-pool \
|
||||||
|
start=$OCTAVIA_MGMT_SUBNET_START,end=$OCTAVIA_MGMT_SUBNET_END \
|
||||||
|
--network lb-mgmt-net lb-mgmt-subnet
|
||||||
|
|
||||||
|
Make a note of the ID of the network.
|
||||||
|
|
||||||
|
Security group
|
||||||
|
--------------
|
||||||
|
|
||||||
|
Register the security group in Neutron.
|
||||||
|
|
||||||
|
.. code-block:: console
|
||||||
|
|
||||||
|
openstack security group create lb-mgmt-sec-grp
|
||||||
|
openstack security group rule create --protocol icmp lb-mgmt-sec-grp
|
||||||
|
openstack security group rule create --protocol tcp --dst-port 22 lb-mgmt-sec-grp
|
||||||
|
openstack security group rule create --protocol tcp --dst-port 9443 lb-mgmt-sec-grp
|
||||||
|
|
||||||
|
Make a note of the ID of the security group.
|
||||||
|
|
||||||
|
Kolla Ansible configuration
|
||||||
|
---------------------------
|
||||||
|
|
||||||
|
The following options should be added to ``globals.yml``.
|
||||||
|
|
||||||
|
Set the IDs of the resources registered previously:
|
||||||
|
|
||||||
|
.. code-block:: yaml
|
||||||
|
|
||||||
|
octavia_amp_boot_network_list: <ID of lb-mgmt-net>
|
||||||
|
octavia_amp_secgroup_list: <ID of lb-mgmt-sec-grp>
|
||||||
|
octavia_amp_flavor_id: <ID of amphora flavor>
|
||||||
|
|
||||||
|
Now deploy Octavia:
|
||||||
|
|
||||||
|
.. code-block:: console
|
||||||
|
|
||||||
|
kolla-ansible -i <inventory> deploy --tags common,horizon,octavia
|
||||||
|
|
||||||
|
.. _octavia-amphora-image:
|
||||||
|
|
||||||
Amphora image
|
Amphora image
|
||||||
-------------
|
=============
|
||||||
|
|
||||||
It is necessary to build an Amphora image. On CentOS / RHEL 8:
|
It is necessary to build an Amphora image. On CentOS / RHEL 8:
|
||||||
|
|
||||||
@ -74,125 +349,47 @@ Create the Amphora image:
|
|||||||
cd octavia/diskimage-create
|
cd octavia/diskimage-create
|
||||||
./diskimage-create.sh
|
./diskimage-create.sh
|
||||||
|
|
||||||
|
Source octavia user openrc:
|
||||||
|
|
||||||
|
.. code-block:: console
|
||||||
|
|
||||||
|
source /etc/kolla/octavia-openrc.sh
|
||||||
|
|
||||||
|
.. note::
|
||||||
|
|
||||||
|
Ensure that you have executed ``kolla-ansible post-deploy``
|
||||||
|
|
||||||
Register the image in Glance:
|
Register the image in Glance:
|
||||||
|
|
||||||
.. code-block:: console
|
.. code-block:: console
|
||||||
|
|
||||||
openstack image create amphora-x64-haproxy.qcow2 --container-format bare --disk-format qcow2 --private --tag amphora --file amphora-x64-haproxy.qcow2
|
openstack image create amphora-x64-haproxy.qcow2 --container-format bare --disk-format qcow2 --private --tag amphora --file amphora-x64-haproxy.qcow2 --property hw_architecture='x86_64' --property hw_rng_model=virtio
|
||||||
|
|
||||||
Octavia uses the tag to determine which image to use.
|
.. note::
|
||||||
|
|
||||||
Amphora flavor
|
the tag should match the ``octavia_amp_image_tag`` in ``/etc/kolla/globals.yml``, by default,
|
||||||
--------------
|
the tag is "amphora", octavia uses the tag to determine which image to use.
|
||||||
|
|
||||||
Register the flavor in Nova:
|
Debug
|
||||||
|
=====
|
||||||
|
|
||||||
|
SSH to an amphora
|
||||||
|
-----------------
|
||||||
|
|
||||||
|
login into one of octavia-worker nodes, and ssh into amphora.
|
||||||
|
|
||||||
.. code-block:: console
|
.. code-block:: console
|
||||||
|
|
||||||
openstack flavor create --vcpus 1 --ram 1024 --disk 2 "amphora" --private
|
ssh -i /etc/kolla/octavia-worker/octavia_ssh_key ubuntu@<amphora_ip>
|
||||||
|
|
||||||
Make a note of the ID of the flavor, or specify one via ``--id``.
|
.. note::
|
||||||
|
|
||||||
Keypair
|
amphora private key is located at ``/etc/kolla/octavia-worker/octavia_ssh_key`` on all
|
||||||
-------
|
octavia-worker nodes.
|
||||||
|
|
||||||
Register the keypair in Nova:
|
Upgrade
|
||||||
|
=======
|
||||||
|
|
||||||
.. code-block:: console
|
If you upgrade from the Ussuri release, you must disable
|
||||||
|
``octavia_auto_configure`` in ``globals.yml`` and keep your other octavia
|
||||||
openstack keypair create --public-key <path to octavia public key> octavia_ssh_key
|
config as before.
|
||||||
|
|
||||||
Network and subnet
|
|
||||||
------------------
|
|
||||||
|
|
||||||
Register the management network and subnet in Neutron. This must be a network
|
|
||||||
that is accessible from the controllers. Typically a VLAN provider network is
|
|
||||||
used. In that case it will be necessary to enable Neutron provider networks.
|
|
||||||
|
|
||||||
.. code-block:: console
|
|
||||||
|
|
||||||
OCTAVIA_MGMT_SUBNET=192.168.43.0/24
|
|
||||||
OCTAVIA_MGMT_SUBNET_START=192.168.43.10
|
|
||||||
OCTAVIA_MGMT_SUBNET_END=192.168.43.254
|
|
||||||
|
|
||||||
openstack network create lb-mgmt-net --provider-network-type vlan --provider-segment 107 --provider-physical-network physnet1
|
|
||||||
openstack subnet create --subnet-range $OCTAVIA_MGMT_SUBNET --allocation-pool \
|
|
||||||
start=$OCTAVIA_MGMT_SUBNET_START,end=$OCTAVIA_MGMT_SUBNET_END \
|
|
||||||
--network lb-mgmt-net lb-mgmt-subnet
|
|
||||||
|
|
||||||
Make a note of the ID of the network.
|
|
||||||
|
|
||||||
Security group
|
|
||||||
--------------
|
|
||||||
|
|
||||||
Register the security group in Neutron.
|
|
||||||
|
|
||||||
.. code-block:: console
|
|
||||||
|
|
||||||
openstack security group create lb-mgmt-sec-grp
|
|
||||||
openstack security group rule create --protocol icmp lb-mgmt-sec-grp
|
|
||||||
openstack security group rule create --protocol tcp --dst-port 22 lb-mgmt-sec-grp
|
|
||||||
openstack security group rule create --protocol tcp --dst-port 9443 lb-mgmt-sec-grp
|
|
||||||
|
|
||||||
Make a note of the ID of the security group.
|
|
||||||
|
|
||||||
Kolla Ansible configuration
|
|
||||||
===========================
|
|
||||||
|
|
||||||
Globals
|
|
||||||
-------
|
|
||||||
|
|
||||||
The following options should be added to ``globals.yml``.
|
|
||||||
|
|
||||||
Enable the Octavia service:
|
|
||||||
|
|
||||||
.. code-block:: yaml
|
|
||||||
|
|
||||||
enable_octavia: yes
|
|
||||||
|
|
||||||
If using a VLAN for the Octavia management network, enable Neutron provider
|
|
||||||
networks:
|
|
||||||
|
|
||||||
.. code-block:: yaml
|
|
||||||
|
|
||||||
enable_neutron_provider_networks: yes
|
|
||||||
|
|
||||||
Configure the name of the network interface on the controllers used to access
|
|
||||||
the Octavia management network. If using a VLAN provider network, ensure that
|
|
||||||
the traffic is also bridged to Open vSwitch on the controllers.
|
|
||||||
|
|
||||||
.. code-block:: yaml
|
|
||||||
|
|
||||||
octavia_network_interface: <network interface on controllers>
|
|
||||||
|
|
||||||
Set the IDs of the resources registered previously:
|
|
||||||
|
|
||||||
.. code-block:: yaml
|
|
||||||
|
|
||||||
octavia_amp_boot_network_list: <ID of lb-mgmt-net>
|
|
||||||
octavia_amp_secgroup_list: <ID of lb-mgmt-sec-grp>
|
|
||||||
octavia_amp_flavor_id: <ID of amphora flavor>
|
|
||||||
|
|
||||||
Passwords
|
|
||||||
---------
|
|
||||||
|
|
||||||
The following option should be set in ``passwords.yml``, matching the password
|
|
||||||
used to encrypt the CA key:
|
|
||||||
|
|
||||||
.. code-block:: yaml
|
|
||||||
|
|
||||||
octavia_ca_password: <CA key password>
|
|
||||||
|
|
||||||
Certificates
|
|
||||||
============
|
|
||||||
|
|
||||||
Follow the :octavia-doc:`octavia documentation
|
|
||||||
<admin/guides/certificates.html>` to generate certificates for Amphorae. These
|
|
||||||
should be copied to the Kolla Ansible configuration as follows:
|
|
||||||
|
|
||||||
.. code-block:: ini
|
|
||||||
|
|
||||||
cp client_ca/certs/ca.cert.pem /etc/kolla/config/octavia/client_ca.cert.pem
|
|
||||||
cp server_ca/certs/ca.cert.pem /etc/kolla/config/octavia/server_ca.cert.pem
|
|
||||||
cp server_ca/private/ca.key.pem /etc/kolla/config/octavia/server_ca.key.pem
|
|
||||||
cp client_ca/private/client.cert-and-key.pem /etc/kolla/config/octavia/client.cert-and-key.pem
|
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user