Chapter 15. Load Balancing-as-a-Service (LBaaS) with Octavia

Procedure

1. Create a load balancer (lb1) on the subnet (public-subnet):

   Note

   Replace the names in parentheses () with names that your site uses.

   $ openstack loadbalancer create --name lb1 --vip-subnet-id public-subnet

2. Re-run the following command until the load balancer (lb1) shows a status that is ACTIVE and ONLINE:

   $ openstack loadbalancer show lb1

3. Create listener (listener1) with the allowed CIDRs:

   $ openstack loadbalancer listener create --name listener1 --protocol TCP --protocol-port 80 --allowed-cidr 192.0.2.0/24 --allowed-cidr 198.51.100/24 lb1

4. Create the default pool (pool1) for the listener (listener1):

   $ openstack loadbalancer pool create --name pool1 --lb-algorithm ROUND_ROBIN --listener listener1 --protocol TCP

5. Add members 192.0.2.10 and 192.0.2.11 on the subnet (private-subnet) to the pool (pool1) that you created:

   $ openstack loadbalancer member create --subnet-id private-subnet --address 192.0.2.10 --protocol-port 80 pool1
   
   $ openstack loadbalancer member create --subnet-id private-subnet --address 192.0.2.11 --protocol-port 80 pool1

Verification steps

1. Enter the following command:

   $ openstack loadbalancer listener show listener1

   You should see output similar to the following:

   +-----------------------------+--------------------------------------+
   | Field                       | Value                                |
   +-----------------------------+--------------------------------------+
   | admin_state_up              | True                                 |
   | connection_limit            | -1                                   |
   | created_at                  | 2019-12-09T11:38:05                  |
   | default_pool_id             | None                                 |
   | default_tls_container_ref   | None                                 |
   | description                 |                                      |
   | id                          | d26ba156-03c3-4051-86e8-f8997a202d8e |
   | insert_headers              | None                                 |
   | l7policies                  |                                      |
   | loadbalancers               | 2281487a-54b9-4c2a-8d95-37262ec679d6 |
   | name                        | listener1                            |
   | operating_status            | ONLINE                               |
   | project_id                  | 308ca9f600064f2a8b3be2d57227ef8f     |
   | protocol                    | TCP                                  |
   | protocol_port               | 80                                   |
   | provisioning_status         | ACTIVE                               |
   | sni_container_refs          | []                                   |
   | timeout_client_data         | 50000                                |
   | timeout_member_connect      | 5000                                 |
   | timeout_member_data         | 50000                                |
   | timeout_tcp_inspect         | 0                                    |
   | updated_at                  | 2019-12-09T11:38:14                  |
   | client_ca_tls_container_ref | None                                 |
   | client_authentication       | NONE                                 |
   | client_crl_container_ref    | None                                 |
   | allowed_cidrs               | 192.0.2.0/24                         |
   |                             | 198.51.100/24                        |
   +-----------------------------+--------------------------------------+

   The parameter, allowed_cidrs, is set to allow traffic only from 192.0.2.0/24 and 198.51.100/24.

2. To verify that the load balancer is secure, try to make a request to the listener from a client whose CIDR is not in the allowed_cidrs list; the request should not succeed. You should see output similar to the following:

   curl: (7) Failed to connect to 10.0.0.226 port 80: Connection timed out
   curl: (7) Failed to connect to 10.0.0.226 port 80: Connection timed out
   curl: (7) Failed to connect to 10.0.0.226 port 80: Connection timed out
   curl: (7) Failed to connect to 10.0.0.226 port 80: Connection timed out

1. Create the load balancer on a subnet:

   $ openstack loadbalancer create --name lb1 --vip-subnet-id private-subnet

2. Monitor the state of the load balancer:

   $ openstack loadbalancer show lb1

   When you see a status of Active and ONLINE, the load balancer is created and running and you can go to the next step.

   Note

   To check load balancer status from the Compute service (nova), use the openstack server list --all | grep amphora command. Creating load balancers can be a slow process (status displaying as PENDING) because load balancers are virtual machines (VMs) and not containers.

3. Create a listener:

   $ openstack loadbalancer listener create --name listener1 --protocol HTTP --protocol-port 80 lb1

4. Create the listener default pool:

   $ openstack loadbalancer pool create --name pool1 --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP

5. Create a health monitor on the pool to test the “/healthcheck” path:

   $ openstack loadbalancer healthmonitor create --delay 5 --max-retries 4 --timeout 10 --type HTTP --url-path /healthcheck pool1

6. Add load balancer members to the pool:

   $ openstack loadbalancer member create --subnet-id private-subnet --address 192.0.2.10 --protocol-port 80 pool1
   $ openstack loadbalancer member create --subnet-id private-subnet --address 192.0.2.11 --protocol-port 80 pool1

7. Create a floating IP address on a public subnet:

   $ openstack floating ip create public

8. Associate this floating IP with the load balancer VIP port:

   $ openstack floating ip set --port `_LOAD_BALANCER_VIP_PORT_` `_FLOATING_IP_`

   Tip

   To locate LOAD_BALANCER_VIP_PORT, run the openstack loadbalancer show lb1 command.

1. Run the openstack loadbalancer show command to verify the load balancer settings:

   (overcloud) [stack@undercloud-0 ~]$ openstack loadbalancer show lb1
   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | admin_state_up      | True                                 |
   | created_at          | 2018-04-18T12:28:34                  |
   | description         |                                      |
   | flavor              |                                      |
   | id                  | 788fe121-3dec-4e1b-8360-4020642238b0 |
   | listeners           | 09f28053-fde8-4c78-88b9-0f191d84120e |
   | name                | lb1                                  |
   | operating_status    | ONLINE                               |
   | pools               | 627842b3-eed8-4f5f-9f4a-01a738e64d6a |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | provider            | octavia                              |
   | provisioning_status | ACTIVE                               |
   | updated_at          | 2018-04-18T14:03:09                  |
   | vip_address         | 192.168.0.11                         |
   | vip_network_id      | 9bca13be-f18d-49a5-a83d-9d487827fd16 |
   | vip_port_id         | 69a85edd-5b1c-458f-96f2-b4552b15b8e6 |
   | vip_qos_policy_id   | None                                 |
   | vip_subnet_id       | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   +---------------------+--------------------------------------+

2. Run the amphora list command to find the UUID of the amphora associated with load balancer lb1:

   (overcloud) [stack@undercloud-0 ~]$ openstack loadbalancer amphora list | grep <UUID of loadbalancer lb1>

3. Run the amphora show command with the amphora UUID to view amphora information:

   (overcloud) [stack@undercloud-0 ~]$ openstack loadbalancer amphora show 62e41d30-1484-4e50-851c-7ab6e16b88d0
   +-----------------+--------------------------------------+
   | Field           | Value                                |
   +-----------------+--------------------------------------+
   | id              | 62e41d30-1484-4e50-851c-7ab6e16b88d0 |
   | loadbalancer_id | 53a497b3-267d-4abc-968f-94237829f78f |
   | compute_id      | 364efdb9-679c-4af4-a80c-bfcb74fc0563 |
   | lb_network_ip   | 192.168.0.13                         |
   | vrrp_ip         | 10.0.0.11                            |
   | ha_ip           | 10.0.0.10                            |
   | vrrp_port_id    | 74a5c1b4-a414-46b8-9263-6328d34994d4 |
   | ha_port_id      | 3223e987-5dd6-4ec8-9fb8-ee34e63eef3c |
   | cert_expiration | 2020-07-16T12:26:07                  |
   | cert_busy       | False                                |
   | role            | BACKUP                               |
   | status          | ALLOCATED                            |
   | vrrp_interface  | eth1                                 |
   | vrrp_id         | 1                                    |
   | vrrp_priority   | 90                                   |
   | cached_zone     | nova                                 |
   | created_at      | 2018-07-17T12:26:07                  |
   | updated_at      | 2018-07-17T12:30:36                  |
   | image_id        | a3f9f3e4-92b6-4a27-91c8-ddc69714da8f |
   +-----------------+--------------------------------------+

4. Run the openstack loadbalancer listener show command to view the listener details:

   (overcloud) [stack@undercloud-0 ~]$ openstack loadbalancer listener show listener1
   ---------------------------------------------------------------------------------------------------+
   | Field                     | Value                                                                  |
   ---------------------------------------------------------------------------------------------------+
   | admin_state_up            | True                                                                   |
   | connection_limit          | -1                                                                     |
   | created_at                | 2018-04-18T12:51:25                                                    |
   | default_pool_id           | 627842b3-eed8-4f5f-9f4a-01a738e64d6a                                   |
   | default_tls_container_ref | http://10.0.0.101:9311/v1/secrets/7eafeabb-b4a1-4bc4-8098-b6281736bfe2 |
   | description               |                                                                        |
   | id                        | 09f28053-fde8-4c78-88b9-0f191d84120e                                   |
   | insert_headers            | None                                                                   |
   | l7policies                |                                                                        |
   | loadbalancers             | 788fe121-3dec-4e1b-8360-4020642238b0                                   |
   | name                      | listener1                                                              |
   | operating_status          | ONLINE                                                                 |
   | project_id                | dda678ca5b1241e7ad7bf7eb211a2fd7                                       |
   | protocol                  | TERMINATED_HTTPS                                                       |
   | protocol_port             | 443                                                                    |
   | provisioning_status       | ACTIVE                                                                 |
   | sni_container_refs        | []                                                                     |
   | updated_at                | 2018-04-18T14:03:09                                                    |
   ---------------------------------------------------------------------------------------------------+

5. Run the openstack loadbalancer pool show command to view the pool and load-balancer members:

   (overcloud) [stack@undercloud-0 ~]$ openstack loadbalancer pool show pool1
   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | admin_state_up      | True                                 |
   | created_at          | 2018-04-18T12:53:49                  |
   | description         |                                      |
   | healthmonitor_id    |                                      |
   | id                  | 627842b3-eed8-4f5f-9f4a-01a738e64d6a |
   | lb_algorithm        | ROUND_ROBIN                          |
   | listeners           | 09f28053-fde8-4c78-88b9-0f191d84120e |
   | loadbalancers       | 788fe121-3dec-4e1b-8360-4020642238b0 |
   | members             | b85c807e-4d7c-4cbd-b725-5e8afddf80d2 |
   |                     | 40db746d-063e-4620-96ee-943dcd351b37 |
   | name                | pool1                                |
   | operating_status    | ONLINE                               |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | protocol            | HTTP                                 |
   | provisioning_status | ACTIVE                               |
   | session_persistence | None                                 |
   | updated_at          | 2018-04-18T14:03:09                  |
   +---------------------+--------------------------------------+

6. Run the openstack floating ip list command to verify the floating IP address:

   (overcloud) [stack@undercloud-0 ~]$ openstack floating ip list
   -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
   | ID                                   | Floating IP Address | Fixed IP Address | Port                                 | Floating Network                     | Project                          |
   -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
   | 89661971-fa65-4fa6-b639-563967a383e7 | 10.0.0.213          | 192.168.0.11     | 69a85edd-5b1c-458f-96f2-b4552b15b8e6 | fe0f3854-fcdc-4433-bc57-3e4568e4d944 | dda678ca5b1241e7ad7bf7eb211a2fd7 |
   -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+

7. Verify HTTPS traffic flows across the load balancer:

   (overcloud) [stack@undercloud-0 ~]$ curl -v https://10.0.0.213 --insecure
   * About to connect() to 10.0.0.213 port 443 (#0)
   *   Trying 10.0.0.213...
   * Connected to 10.0.0.213 (10.0.0.213) port 443 (#0)
   * Initializing NSS with certpath: sql:/etc/pki/nssdb
   * skipping SSL peer certificate verification
   * SSL connection using TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
   * Server certificate:
   * 	subject: CN=www.example.com,O=Dis,L=Springfield,ST=Denial,C=US
   * 	start date: Apr 18 09:21:45 2018 GMT
   * 	expire date: Apr 18 09:21:45 2019 GMT
   * 	common name: www.example.com
   * 	issuer: CN=www.example.com,O=Dis,L=Springfield,ST=Denial,C=US
   > GET / HTTP/1.1
   > User-Agent: curl/7.29.0
   > Host: 10.0.0.213
   > Accept: */*
   >
   < HTTP/1.1 200 OK
   < Content-Length: 30
   <
   * Connection #0 to host 10.0.0.213 left intact

Procedure

1. Combine the key (server.key), certificate (server.crt), and intermediate certificate chain (ca-chain.crt) into a single PKCS12 file (server.p12).

   Note

   The values in parentheses are provided as examples. Replace these with values appropriate for your site.

   $ openssl pkcs12 -export -inkey server.key -in server.crt -certfile ca-chain.crt -passout pass: -out server.p12

2. Using the Key Manager service, create a secret resource (tls_secret1) for the PKCS12 file.

   $ openstack secret store --name='tls_secret1' -t 'application/octet-stream' -e 'base64' --payload="$(base64 < server.p12)"

3. Create a load balancer (lb1) on the public subnet (public-subnet).

   $ openstack loadbalancer create --name lb1 --vip-subnet-id public-subnet

4. Before you can proceed, the load balancer that you created (lb1) must be in an active and online state.

   Run the openstack loadbalancer show command, until the load balancer responds with an ACTIVE and ONLINE status. (You might need to run this command more than once.)

   $ openstack loadbalancer show lb1

5. Create a TERMINATED_HTTPS listener (listener1), and reference the secret resource as the default TLS container for the listener.

   $ openstack loadbalancer listener create --protocol-port 443 --protocol TERMINATED_HTTPS --name listener1 --default-tls-container=$(openstack secret list | awk '/ tls_secret1 / {print $2}') lb1

6. Create a pool (pool1) and make it the default pool for the listener.

   $ openstack loadbalancer pool create --name pool1 --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP

7. Add the non-secure HTTP back end servers (192.0.2.10 and 192.0.2.11) on the private subnet (private-subnet) to the pool.

   $ openstack loadbalancer member create --subnet-id private-subnet --address 192.0.2.10 --protocol-port 80 pool1
   $ openstack loadbalancer member create --subnet-id private-subnet --address 192.0.2.11 --protocol-port 80 pool1

Procedure

1. For each of the TLS certificates in the SNI list, combine the key (server.key), certificate (server.crt), and intermediate certificate chain (ca-chain.crt) into a single PKCS12 file (server.p12).

   In this example, you create two PKCS12 files (server.p12 and server2.p12) one for each certificate (www.example.com and www2.example.com).

   Note

   The values in parentheses are provided as examples. Replace these with values appropriate for your site.

   $ openssl pkcs12 -export -inkey server.key -in server.crt -certfile ca-chain.crt -passout pass: -out server.p12
   
   $ openssl pkcs12 -export -inkey server2.key -in server2.crt -certfile ca-chain2.crt -passout pass: -out server2.p12

2. Using the Key Manager service, create secret resources (tls_secret1 and tls_secret2) for the PKCS12 file.

   $ openstack secret store --name='tls_secret1' -t 'application/octet-stream' -e 'base64' --payload="$(base64 < server.p12)"
   $ openstack secret store --name='tls_secret2' -t 'application/octet-stream' -e 'base64' --payload="$(base64 < server2.p12)"

3. Create a load balancer (lb1) on the public subnet (public-subnet).

   $ openstack loadbalancer create --name lb1 --vip-subnet-id public-subnet

4. Before you can proceed, the load balancer that you created (lb1) must be in an active and online state.

   Run the openstack loadbalancer show command, until the load balancer responds with an ACTIVE and ONLINE status. (You might need to run this command more than once.)

   $ openstack loadbalancer show lb1

5. Create a TERMINATED_HTTPS listener (listener1), and reference both the secret resources using SNI.

   (Reference tls_secret1 as the default TLS container for the listener.)

   $ openstack loadbalancer listener create --protocol-port 443 \
   --protocol TERMINATED_HTTPS --name listener1 \
   --default-tls-container=$(openstack secret list | awk '/ tls_secret1 / {print $2}') \
   --sni-container-refs $(openstack secret list | awk '/ tls_secret1 / {print $2}') \
   $(openstack secret list | awk '/ tls_secret2 / {print $2}') -- lb1

6. Create a pool (pool1) and make it the default pool for the listener.

   $ openstack loadbalancer pool create --name pool1 --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP

7. Add the non-secure HTTP back end servers (192.0.2.10 and 192.0.2.11) on the private subnet (private-subnet) to the pool.

   $ openstack loadbalancer member create --subnet-id private-subnet --address 192.0.2.10 --protocol-port 80 pool1
   $ openstack loadbalancer member create --subnet-id private-subnet --address 192.0.2.11 --protocol-port 80 pool1

Procedure

1. Combine the key (server.key), certificate (server.crt), and intermediate certificate chain (ca-chain.crt) into a single PKCS12 file (server.p12).

   Note

   The values in parentheses are provided as examples. Replace these with values appropriate for your site.

   $ openssl pkcs12 -export -inkey server.key -in server.crt -certfile ca-chain.crt -passout pass: -out server.p12

2. Using the Key Manager service, create a secret resource (tls_secret1) for the PKCS12 file.

   $ openstack secret store --name='tls_secret1' -t 'application/octet-stream' -e 'base64' --payload="$(base64 < server.p12)"

3. Create a load balancer (lb1) on the public subnet (public-subnet).

   $ openstack loadbalancer create --name lb1 --vip-subnet-id public-subnet

4. Before you can proceed, the load balancer that you created (lb1) must be in an active and online state.

   Run the openstack loadbalancer show command, until the load balancer responds with an ACTIVE and ONLINE status. (You might need to run this command more than once.)

   $ openstack loadbalancer show lb1

5. Create a TERMINATED_HTTPS listener (listener1), and reference the secret resource as the default TLS container for the listener.

   $ openstack loadbalancer listener create --protocol-port 443 --protocol TERMINATED_HTTPS --name listener1 --default-tls-container=$(openstack secret list | awk '/ tls_secret1 / {print $2}') lb1

6. Create a pool (pool1) and make it the default pool for the listener.

   $ openstack loadbalancer pool create --name pool1 --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP

7. Add the non-secure HTTP back end servers (192.0.2.10 and 192.0.2.11) on the private subnet (private-subnet) to the pool.

   $ openstack loadbalancer member create --subnet-id private-subnet --address 192.0.2.10 --protocol-port 80 pool1
   $ openstack loadbalancer member create --subnet-id private-subnet --address 192.0.2.11 --protocol-port 80 pool1

8. Create a non-secure, HTTP listener (listener2), and make its default pool, the same as the secure listener.

   $ openstack loadbalancer listener create --protocol-port 80 --protocol HTTP --name listener2 --default-pool pool1 lb1

1. Start the ssh-agent, and add your user identity key to the agent:

   [stack@undercloud-0] $ eval `ssh-agent -s`
   [stack@undercloud-0] $ ssh-add

2. Use SSH to connect to the Amphora instance:

   [stack@undercloud-0] $ ssh -A -t heat-admin@<controller node IP address> ssh cloud-user@<IP address of Amphora in load-balancing management network>

3. View the systemd journal:

   [cloud-user@amphora-f60af64d-570f-4461-b80a-0f1f8ab0c422 ~] $ sudo journalctl

   Refer to the journalctl man page for information about filtering journal output.

4. When you are finished viewing the journal, and have closed your connections to the Amphora instance and the Controller node, make sure that you stop the SSH agent:

   [stack@undercloud-0] $ exit