Using Octavia for Load Balancing-as-a-Service

Procedure

1. Log in to the undercloud host as the stack user.

2. Source the undercloud credentials file:

   $ source ~/stackrc

3. Create a YAML custom environment file.

   Example

   $ vi /home/stack/templates/my-octavia-environment.yaml

4. In the YAML environment file, add the following parameters with values appropriate for your site:

   • OctaviaCaCert:

     The certificate for the CA that Octavia uses to generate certificates.

   • OctaviaCaKey:

     The private CA key used to sign the generated certificates.

   • OctaviaCaKeyPassphrase:

     The passphrase used with the private CA key above.

   • OctaviaClientCert:

     The client certificate and un-encrypted key issued by the Octavia CA for the controllers.

   • OctaviaGenerateCerts:

     The Boolean that instructs director to enable (true) or disable (false) automatic certificate and key generation.

     Important

     You must set OctaviaGenerateCerts to false.

     Example

     parameter_defaults:
         OctaviaCaCert: |
           -----BEGIN CERTIFICATE-----
           MIIDgzCCAmugAwIBAgIJAKk46qw6ncJaMA0GCSqGSIb3DQEBCwUAMFgxCzAJBgNV
           [snip]
           sFW3S2roS4X0Af/kSSD8mlBBTFTCMBAj6rtLBKLaQbIxEpIzrgvp
           -----END CERTIFICATE-----
     
         OctaviaCaKey: |
           -----BEGIN RSA PRIVATE KEY-----
           Proc-Type: 4,ENCRYPTED
           [snip]
           -----END RSA PRIVATE KEY-----[
     
         OctaviaClientCert: |
           -----BEGIN CERTIFICATE-----
           MIIDmjCCAoKgAwIBAgIBATANBgkqhkiG9w0BAQsFADBcMQswCQYDVQQGEwJVUzEP
           [snip]
           270l5ILSnfejLxDH+vI=
           -----END CERTIFICATE-----
           -----BEGIN PRIVATE KEY-----
           MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDU771O8MTQV8RY
           [snip]
           KfrjE3UqTF+ZaaIQaz3yayXW
           -----END PRIVATE KEY-----
     
         OctaviaCaKeyPassphrase:
           b28c519a-5880-4e5e-89bf-c042fc75225d
     
         OctaviaGenerateCerts: false
         [rest of file snipped]

5. Run the openstack overcloud deploy command and include the core heat templates, environment files, and this new custom environment file.

   Important

   The order of the environment files is important as the parameters and resources defined in subsequent environment files take precedence.

   Example

   $ openstack overcloud deploy --templates \
   -e <your_environment_files> \
   -e /usr/share/openstack-tripleo-heat-templates/environments/services/octavia.yaml \
   -e /home/stack/templates/my-octavia-environment.yaml

Procedure

1. Log in to the undercloud host as the stack user.

2. Source the undercloud credentials file:

   $ source ~/stackrc

3. Create a custom YAML environment file.

   Example

   $ vi /home/stack/templates/my-octavia-environment.yaml

4. In the custom environment file, add the following parameter:

   parameter_defaults:
       OctaviaLoadBalancerTopology: "ACTIVE_STANDBY"

5. Run the deployment command and include the core heat templates, environment files, and this new custom environment file.

   Important

   The order of the environment files is important as the parameters and resources defined in subsequent environment files take precedence.

   Example

   $ openstack overcloud deploy --templates \
   -e <your_environment_files> \
   -e /usr/share/openstack-tripleo-heat-templates/environments/services/octavia.yaml \
   -e /home/stack/templates/my-octavia-environment.yaml

Procedure

1. Log in to the undercloud host as the stack user.

2. Source the undercloud credentials file:

   $ source ~/stackrc

3. Create a custom YAML environment file.

   Example

   $ vi /home/stack/templates/my-octavia-environment.yaml

4. Your environment file must contain the keywords parameter_defaults. Put your parameter value pairs after the parameter_defaults keyword.

   Example

   parameter_defaults:
       OctaviaMgmtPortDevName: "o-hm0"
       OctaviaControlNetwork: 'lb-mgmt-net'
       OctaviaControlSubnet: 'lb-mgmt-subnet'
       OctaviaControlSecurityGroup: 'lb-mgmt-sec-group'
       OctaviaControlSubnetCidr: '172.24.0.0/16'
       OctaviaControlSubnetGateway: '172.24.0.1'
       OctaviaControlSubnetPoolStart: '172.24.0.2'
       OctaviaControlSubnetPoolEnd: '172.24.255.254'

5. Run the deployment command and include the core heat templates, environment files, and this new custom environment file.

   Important

   The order of the environment files is important as the parameters and resources defined in subsequent environment files take precedence.

   Example

   $ openstack overcloud deploy --templates \
   -e <your_environment_files> \
   -e /usr/share/openstack-tripleo-heat-templates/environments/services/octavia.yaml \
   -e /home/stack/templates/my-octavia-environment.yaml

Procedure

1. Log in to the undercloud host as the stack user.

2. Source the undercloud credentials file:

   $ source ~/stackrc

3. Create a custom YAML environment file.

   Example

   $ vi /home/stack/templates/my-octavia-environment.yaml

4. In the YAML environment file under parameter_defaults, set OctaviaLogOffload to true.

   parameter_defaults:
       OctaviaLogOffload: true
       ...

   Note

   The amphorae offload administrative logs use the syslog facility value of local1, by default, unless you specify another value with the OctaviaAdminLogFacility parameter.

   Example

   parameter_defaults:
       OctaviaLogOffload: true
       OctaviaAdminLogFacility: 2
       ...

5. The amphorae forward only load balancer-related administrative logs, such as the haproxy admin logs, keepalived, and amphora agent logs. If you want to configure the amphorae to send all of the administrative logs from the amphorae, such as the kernel, system, and security logs, set OctaviaForwardAllLogs to true.

   Example

   parameter_defaults:
       OctaviaLogOffload: true
       OctaviaForwardAllLogs: true
       ...

6. The amphorae use a set of default containers defined by the Orchestration service (heat) that contain syslog receivers listening for log messages. If you want to use a different set of endpoints, you can specify those with the OctaviaAdminLogTargets parameter:

   OctaviaAdminLogTargets: <ip_address>:<port>[, <ip_address>:<port>]

   Example

   parameter_defaults:
       OctaviaLogOffload: true
       OctaviaAdminLogTargets: 192.0.2.1:10514, 2001:db8:1::10:10514
       ...

7. By default, when you enable log offloading, tenant flow logs are also offloaded.

   If you want to disable tenant flow log offloading, set the OctaviaConnectionLogging to false.

   Example

   parameter_defaults:
       OctaviaLogOffload: true
       OctaviaConnectionLogging: false
       ...

8. Run the deployment command and include the core heat templates, environment files, and this new custom environment file.

   Important

   The order of the environment files is important as the parameters and resources defined in subsequent environment files take precedence.

   Example

   $ openstack overcloud deploy --templates \
   -e [your-environment-files] \
   -e /usr/share/openstack-tripleo-heat-templates/environments/services/octavia.yaml \
   -e /home/stack/templates/my-octavia-environment.yaml

Procedure

1. Log in to the undercloud host as the stack user.

2. Source the undercloud credentials file:

   $ source ~/stackrc

3. Locate the environment file in which the OctaviaConnectionLogging parameter is set:

   $ grep -rl OctaviaConnectionLogging /home/stack/templates/

4. If you do not find the file, create an environment file:

   $ vi /home/stack/templates/my-octavia-environment.yaml

5. Add the OctaviaLogOffload and OctaviaConnectionLogging parameters to the parameter_defaults section of the environment file and set the values to true:

   parameter_defaults:
       OctaviaLogOffload: true
       OctaviaConnectionLogging: true
       ...

   Note

   The amphorae use the syslog facility default value of local0 to offload tenant flow logs unless you use the OctaviaTenantLogFacility parameter to specify another value.

6. Optional: The amphorae use a set of default containers that contain syslog receivers that listen for log messages. You can change the admin and tenant log endpoints using the parameters OctaviaAdminLogTargets and OctaviaTenantLogTargets.

   OctaviaAdminLogTargets: <ip-address>:<port>[, <ip-address>:<port>]
   OctaviaTenantLogTargets: <ip-address>:<port>[, <ip-address>:<port>]

7. Run the deployment command and include the core heat templates, environment files, and the custom environment file you modified.

   Important

   The order of the environment files is important because the parameters and resources defined in subsequent environment files take precedence.

   $ openstack overcloud deploy --templates \
   -e <your_environment_files> \
   -e /usr/share/openstack-tripleo-heat-templates/environments/services/octavia.yaml \
   -e /home/stack/templates/my-octavia-environment.yaml

Procedure

1. Log in to the undercloud host as the stack user.

2. Source the undercloud credentials file:

   $ source ~/stackrc

3. Locate the YAML custom environment file in which amphora logging is configured.

   Example

   $ grep -rl OctaviaLogOffload /home/stack/templates/

4. In the custom environment file, under parameter_defaults, set OctaviaConnectionLogging to false.

   Example

   parameter_defaults:
       OctaviaLogOffload: true
       OctaviaConnectionLogging: false
       ...

5. Run the deployment command and include the core heat templates, environment files, and the custom environment file in which you set OctaviaConnectionLogging to true.

   Important

   The order of the environment files is important as the parameters and resources defined in subsequent environment files take precedence.

   Example

   $ openstack overcloud deploy --templates \
   -e [your-environment-files] \
   -e /usr/share/openstack-tripleo-heat-templates/environments/services/octavia.yaml \
   -e /home/stack/templates/my-octavia-environment.yaml

Procedure

1. Log in to the undercloud host as the stack user.

2. Source the undercloud credentials file:

   $ source ~/stackrc

3. Create a custom YAML environment file.

   Example

   $ vi /home/stack/templates/my-octavia-environment.yaml

4. In the environment file under parameter_defaults, set OctaviaDisableLocalLogStorage to true.

   parameter_defaults:
       OctaviaDisableLocalLogStorage: true
       ...

5. Run the deployment command and include the core heat templates, environment files, and this new custom environment file.

   Important

   The order of the environment files is important as the parameters and resources defined in subsequent environment files take precedence.

   Example

   $ openstack overcloud deploy --templates \
   -e <your_environment_files> \
   -e /usr/share/openstack-tripleo-heat-templates/environments/services/octavia.yaml \
   -e /home/stack/templates/my-octavia-environment.yaml

Procedure

1. Source a credentials file that gives you access to the overcloud with the RHOSP admin role.

   Example

   $ source ~/my_overcloudrc

2. List the capabilities for each driver:

   $ openstack loadbalancer provider capability list <provider>

   Replace <provider> with the name or UUID of the provider.

   Example

   $ openstack loadbalancer provider capability list amphora

   The command output lists all of the capabilities that the provider supports.

   Sample output

   +-----------------------+---------------------------------------------------+
   | name                  | description                                       |
   +-----------------------+---------------------------------------------------+
   | loadbalancer_topology | The load balancer topology. One of: SINGLE - One  |
   |                       | amphora per load balancer. ACTIVE_STANDBY - Two   |
   |                       | amphora per load balancer.                        |
   | ...                   | ...                                               |
   +-----------------------+---------------------------------------------------+

3. Note the names of the capabilities that you want to include in the flavor that you are creating.

Procedure

1. Source a credentials file that gives you access to the overcloud with the RHOSP admin role.

   Example

   $ source ~/my_overcloudrc

2. Create a flavor profile:

   $ openstack loadbalancer flavorprofile create --name <profile_name> --provider <provider_name> --flavor-data '{"<capability>": "<value>"}'

   Example

   $ openstack loadbalancer flavorprofile create --name amphora-single-profile --provider amphora --flavor-data '{"loadbalancer_topology": "SINGLE"}'

   Sample output

   +---------------+--------------------------------------+
   | Field         | Value                                |
   +---------------+--------------------------------------+
   | id            | 72b53ac2-b191-48eb-8f73-ed012caca23a |
   | name          | amphora-single-profile               |
   | provider_name | amphora                              |
   | flavor_data   | {"loadbalancer_topology": "SINGLE"}  |
   +---------------+--------------------------------------+

   In this example, a flavor profile is created for the amphora provider. When this profile is specified in a flavor, the load balancer that users create by using the flavor is a single amphora load balancer.

Procedure

1. Source a credentials file that gives you access to the overcloud with the RHOSP admin role.

   Example

   $ source ~/my_overcloudrc

2. Create a flavor:

   $ openstack loadbalancer flavor create --name <flavor_name> \
   --flavorprofile <flavor-profile> --description "<string>"

   Tip

   Provide a detailed description so that users can understand the capabilities of the flavor that you are providing.

   Example

   $ openstack loadbalancer flavor create --name standalone-lb --flavorprofile amphora-single-profile --description "A non-high availability load balancer for testing."

   Sample output

   +-------------------+--------------------------------------+
   | Field             | Value                                |
   +-------------------+--------------------------------------+
   | id                | 25cda2d8-f735-4744-b936-d30405c05359 |
   | name              | standalone-lb                        |
   | flavor_profile_id | 72b53ac2-b191-48eb-8f73-ed012caca23a |
   | enabled           | True                                 |
   | description       | A non-high availability load         |
   |                   | balancer for testing.                |
   +-------------------+--------------------------------------+

   In this example, a flavor has been defined. When users specify this flavor, they create a load balancer that uses one Load-balancing service instance (amphora) and is not highly available.

Procedure

1. Source your credentials file.

   Example

   $ source ~/overcloudrc

2. Run the openstack loadbalancer healthmonitor create command, using argument values that are appropriate for your site.

   • All health monitor types require the following configurable arguments:

     <pool>

     Name or ID of the pool of back-end member servers to be monitored.

     --type

     The type of health monitor. One of HTTP, HTTPS, PING, TCP, TLS-HELLO, or UDP-CONNECT.

     --delay

     Number of seconds to wait between health checks.

     --timeout

     Number of seconds to wait for any given health check to complete. timeout must always be smaller than delay.

     --max-retries

     Number of health checks a back-end server must fail before it is considered down. Also, the number of health checks that a failed back-end server must pass to be considered up again.

   • In addition, HTTP health monitor types also require the following arguments, which are set by default:

     --url-path

     Path part of the URL that should be retrieved from the back-end server. By default this is /.

     --http-method

     HTTP method that is used to retrieve the url_path. By default this is GET.

     --expected-codes

     List of HTTP status codes that indicate an OK health check. By default this is 200.

     Example

     $ openstack loadbalancer healthmonitor create --name my-health-monitor --delay 10 --max-retries 4 --timeout 5 --type TCP lb-pool-1

Procedure

1. Source your credentials file.

   Example

   $ source ~/overcloudrc

2. Modify your health monitor (my-health-monitor).

   In this example, a user is changing the time in seconds that the health monitor waits between sending probes to members.

   Example

   $ openstack loadbalancer healthmonitor set my_health_monitor --delay 600

Procedure

1. Source your credentials file.

   Example

   $ source ~/overcloudrc

2. Delete the health monitor (my-health-monitor).

   Example

   $ openstack loadbalancer healthmonitor delete my-health-monitor

Procedure

1. Source your credentials file.

   Example

   $ source ~/overcloudrc

2. Create a load balancer (lb1) on a public subnet (public_subnet).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer create --name lb1 \
   --vip-subnet-id public_subnet --wait

3. Create a listener (listener1) on a port (80).

   Example

   $ openstack loadbalancer listener create --name listener1 \
   --protocol HTTP --protocol-port 80 lb1

4. Verify the state of the listener.

   Example

   $ openstack loadbalancer listener show listener1

   Before going to the next step, ensure that the status is ACTIVE.

5. Create the listener default pool (pool1).

   Example

   $ openstack loadbalancer pool create --name pool1 \
   --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP

6. Create a health monitor (healthmon1) of type (HTTP) on the pool (pool1) that connects to the back-end servers and tests the path (/).

   Health checks are recommended but not required. If no health monitor is defined, the member server is assumed to be ONLINE.

   Example

   $ openstack loadbalancer healthmonitor create --name healthmon1 \
   --delay 15 --max-retries 4 --timeout 10 --type HTTP --url-path / pool1

7. Add load balancer members (192.0.2.10 and 192.0.2.11) on the private subnet (private_subnet) to the default pool.

   Example

   In this example, the back-end servers, 192.0.2.10 and 192.0.2.11, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --name member1 --subnet-id \
   private_subnet --address 192.0.2.10 --protocol-port 80 pool1
   
   $ openstack loadbalancer member create --name member2 --subnet-id \
   private_subnet --address 192.0.2.11 --protocol-port 80 pool1

Verification

1. View and verify the load balancer (lb1) settings:

   Example

   $ openstack loadbalancer show lb1

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | admin_state_up      | True                                 |
   | created_at          | 2022-01-15T11:11:09                  |
   | description         |                                      |
   | flavor              |                                      |
   | id                  | 788fe121-3dec-4e1b-8360-4020642238b0 |
   | listeners           | 09f28053-fde8-4c78-88b9-0f191d84120e |
   | name                | lb1                                  |
   | operating_status    | ONLINE                               |
   | pools               | 627842b3-eed8-4f5f-9f4a-01a738e64d6a |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | provider            | amphora                              |
   | provisioning_status | ACTIVE                               |
   | updated_at          | 2022-01-15T11:12:13                  |
   | vip_address         | 198.51.100.12                        |
   | vip_network_id      | 9bca13be-f18d-49a5-a83d-9d487827fd16 |
   | vip_port_id         | 69a85edd-5b1c-458f-96f2-b4552b15b8e6 |
   | vip_qos_policy_id   | None                                 |
   | vip_subnet_id       | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   +---------------------+--------------------------------------+

2. When a health monitor is present and functioning properly, you can check the status of each member.

   A working member (member1) has an ONLINE value for its operating_status.

   Example

   $ openstack loadbalancer member show pool1 member1

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | address             | 192.0.2.10                           |
   | admin_state_up      | True                                 |
   | created_at          | 2022-01-15T11:16:23                  |
   | id                  | b85c807e-4d7c-4cbd-b725-5e8afddf80d2 |
   | name                | member1                              |
   | operating_status    | ONLINE                               |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | protocol_port       | 80                                   |
   | provisioning_status | ACTIVE                               |
   | subnet_id           | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   | updated_at          | 2022-01-15T11:20:45                  |
   | weight              | 1                                    |
   | monitor_port        | None                                 |
   | monitor_address     | None                                 |
   | backup              | False                                |
   +---------------------+--------------------------------------+

Procedure

1. Source your credentials file.

   Example

   $ source ~/overcloudrc

2. Create a load balancer (lb1) on a private subnet (private_subnet).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer create --name lb1 \
   --vip-subnet-id private_subnet --wait

3. In the output from step 2, record the value of load_balancer_vip_port_id, because you must provide it in a later step.

4. Create a listener (listener1) on a port (80).

   Example

   $ openstack loadbalancer listener create --name listener1 \
   --protocol HTTP --protocol-port 80 lb1

5. Create the listener default pool (pool1).

   Example

   The command in this example creates an HTTP pool that uses a private subnet containing back-end servers that host non-secure HTTP applications on TCP port 80:

   $ openstack loadbalancer pool create --name pool1 \
   --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP

6. Create a health monitor (healthmon1) of type (HTTP) on the pool (pool1) that connects to the back-end servers and tests the path (/).

   Health checks are recommended but not required. If no health monitor is defined, the member server is assumed to be ONLINE.

   Example

   $ openstack loadbalancer healthmonitor create --name healthmon1 \
   --delay 15 --max-retries 4 --timeout 10 --type HTTP --url-path / pool1

7. Add load balancer members (192.0.2.10 and 192.0.2.11) on the private subnet to the default pool.

   Example

   In this example, the back-end servers, 192.0.2.10 and 192.0.2.11, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --name member1 --subnet-id \
   private_subnet --address 192.0.2.10 --protocol-port 80 pool1
   
   $ openstack loadbalancer member create --name member2 --subnet-id \
   private_subnet --address 192.0.2.11 --protocol-port 80 pool1

8. Create a floating IP address on the shared external subnet (public).

   Example

   $ openstack floating ip create public

9. In the output from step 8, record the value of floating_ip_address, because you must provide it in a later step.

10. Associate this floating IP (203.0.113.0) with the load balancer vip_port_id (69a85edd-5b1c-458f-96f2-b4552b15b8e6).

    Example

    $ openstack floating ip set --port 69a85edd-5b1c-458f-96f2-b4552b15b8e6 203.0.113.0

Verification

1. Verify HTTP traffic flows across the load balancer by using the floating IP (203.0.113.0).

   Example

   $ curl -v http://203.0.113.0 --insecure

   Sample output

   * About to connect() to 203.0.113.0 port 80 (#0)
   *   Trying 203.0.113.0...
   * Connected to 203.0.113.0 (203.0.113.0) port 80 (#0)
   > GET / HTTP/1.1
   > User-Agent: curl/7.29.0
   > Host: 203.0.113.0
   > Accept: */*
   >
   < HTTP/1.1 200 OK
   < Content-Length: 30
   <
   * Connection #0 to host 203.0.113.0 left intact

2. When a health monitor is present and functioning properly, you can check the status of each member.

   A working member (member1) has an ONLINE value for its operating_status.

   Example

   $ openstack loadbalancer member show pool1 member1

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | address             | 192.0.02.10                          |
   | admin_state_up      | True                                 |
   | created_at          | 2022-01-15T11:11:23                  |
   | id                  | b85c807e-4d7c-4cbd-b725-5e8afddf80d2 |
   | name                | member1                              |
   | operating_status    | ONLINE                               |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | protocol_port       | 80                                   |
   | provisioning_status | ACTIVE                               |
   | subnet_id           | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   | updated_at          | 2022-01-15T11:28:42                  |
   | weight              | 1                                    |
   | monitor_port        | None                                 |
   | monitor_address     | None                                 |
   | backup              | False                                |
   +---------------------+--------------------------------------+

Procedure

1. Source your credentials file.

   Example

   $ source ~/overcloudrc

2. Create a load balancer (lb1) on a public subnet (public_subnet).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer create --name lb1 \
   --vip-subnet-id public_subnet --wait

3. Create a listener (listener1) on a port (80).

   Example

   $ openstack loadbalancer listener create --name listener1 \
   --protocol HTTP --protocol-port 80 lb1

4. Create the listener default pool (pool1) that defines session persistence on a cookie (PHPSESSIONID).

   Example

   The command in this example creates an HTTP pool that uses a private subnet containing back-end servers that host non-secure HTTP applications on TCP port 80:

   $ openstack loadbalancer pool create --name pool1 \
   --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP \
   --session-persistence type=APP_COOKIE,cookie_name=PHPSESSIONID

5. Create a health monitor (healthmon1) of type (HTTP) on the pool (pool1) that connects to the back-end servers and tests the path (/).

   Health checks are recommended but not required. If no health monitor is defined, the member server is assumed to be ONLINE.

   Example

   $ openstack loadbalancer healthmonitor create --name healthmon1 \
   --delay 15 --max-retries 4 --timeout 10 --type HTTP --url-path / pool1

6. Add load balancer members (192.0.2.10 and 192.0.2.11) on the private subnet (private_subnet) to the default pool.

   Example

   In this example, the back-end servers, 192.0.2.10 and 192.0.2.11, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --name member1 --subnet-id \
   private_subnet --address 192.0.2.10 --protocol-port 80 pool1
   
   $ openstack loadbalancer member create --name member2 --subnet-id \
   private_subnet --address 192.0.2.11 --protocol-port 80 pool1

Verification

1. View and verify the load balancer (lb1) settings:

   Example

   $ openstack loadbalancer show lb1

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | admin_state_up      | True                                 |
   | created_at          | 2022-01-15T11:11:58                  |
   | description         |                                      |
   | flavor              |                                      |
   | id                  | 788fe121-3dec-4e1b-8360-4020642238b0 |
   | listeners           | 09f28053-fde8-4c78-88b9-0f191d84120e |
   | name                | lb1                                  |
   | operating_status    | ONLINE                               |
   | pools               | 627842b3-eed8-4f5f-9f4a-01a738e64d6a |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | provider            | amphora                              |
   | provisioning_status | ACTIVE                               |
   | updated_at          | 2022-01-15T11:28:42                  |
   | vip_address         | 198.51.100.22                        |
   | vip_network_id      | 9bca13be-f18d-49a5-a83d-9d487827fd16 |
   | vip_port_id         | 69a85edd-5b1c-458f-96f2-b4552b15b8e6 |
   | vip_qos_policy_id   | None                                 |
   | vip_subnet_id       | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   +---------------------+--------------------------------------+

2. When a health monitor is present and functioning properly, you can check the status of each member.

   A working member (member1) has an ONLINE value for its operating_status.

   Example

   $ openstack loadbalancer member show pool1 member1

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | address             | 192.0.02.10                          |
   | admin_state_up      | True                                 |
   | created_at          | 2022-01-15T11:11:23                  |
   | id                  | b85c807e-4d7c-4cbd-b725-5e8afddf80d2 |
   | name                | member1                              |
   | operating_status    | ONLINE                               |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | protocol_port       | 80                                   |
   | provisioning_status | ACTIVE                               |
   | subnet_id           | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   | updated_at          | 2022-01-15T11:28:42                  |
   | weight              | 1                                    |
   | monitor_port        | None                                 |
   | monitor_address     | None                                 |
   | backup              | False                                |
   +---------------------+--------------------------------------+

Procedure

1. Source your credentials file.

   Example

   $ source ~/overcloudrc

2. Create a load balancer (lb1) on a public subnet (public_subnet):

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer create --name lb1 --vip-subnet-id public_subnet

3. Monitor the state of the load balancer.

   Example

   $ openstack loadbalancer show lb1

4. Before going to the next step, ensure that the provisioning_status is ACTIVE.

5. Create a listener (listener1) on a port (443).

   Example

   $ openstack loadbalancer listener create --name listener1 --protocol HTTPS --protocol-port 443 lb1

6. Create the listener default pool (pool1).

   Example

   $ openstack loadbalancer pool create --name pool1 --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTPS

7. Create a health monitor on the pool (pool1) that connects to the back-end servers and tests the path (/).

   Example

   $ openstack loadbalancer healthmonitor create --delay 15 --max-retries 4 --timeout 10 --type TLS-HELLO --url-path / pool1

8. Add load balancer members (192.0.2.10 and 192.0.2.11) on the private subnet (private_subnet) to the default pool.

   Example

   $ openstack loadbalancer member create --subnet-id private_subnet --address 192.0.2.10 --protocol-port 443 pool1
   $ openstack loadbalancer member create --subnet-id private_subnet --address 192.0.2.11 --protocol-port 443 pool1

Verification

1. View and verify the load balancer (lb1) settings.

   Example

   $ openstack loadbalancer show lb1

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | admin_state_up      | True                                 |
   | created_at          | 2022-01-15T11:11:09                  |
   | description         |                                      |
   | flavor              |                                      |
   | id                  | 788fe121-3dec-4e1b-8360-4020642238b0 |
   | listeners           | 09f28053-fde8-4c78-88b9-0f191d84120e |
   | name                | lb1                                  |
   | operating_status    | ONLINE                               |
   | pools               | 627842b3-eed8-4f5f-9f4a-01a738e64d6a |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | provider            | amphora                              |
   | provisioning_status | ACTIVE                               |
   | updated_at          | 2022-01-15T11:12:42                  |
   | vip_address         | 198.51.100.11                        |
   | vip_network_id      | 9bca13be-f18d-49a5-a83d-9d487827fd16 |
   | vip_port_id         | 69a85edd-5b1c-458f-96f2-b4552b15b8e6 |
   | vip_qos_policy_id   | None                                 |
   | vip_subnet_id       | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   +---------------------+--------------------------------------+

2. When a health monitor is present and functioning properly, you can check the status of each member.

   A working member (b85c807e-4d7c-4cbd-b725-5e8afddf80d2) has an ONLINE value for its operating_status.

   Example

   $ openstack loadbalancer member show pool1 b85c807e-4d7c-4cbd-b725-5e8afddf80d2

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | address             | 192.0.2.10                           |
   | admin_state_up      | True                                 |
   | created_at          | 2022-01-15T11:11:09                  |
   | id                  | b85c807e-4d7c-4cbd-b725-5e8afddf80d2 |
   | name                |                                      |
   | operating_status    | ONLINE                               |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | protocol_port       | 443                                  |
   | provisioning_status | ACTIVE                               |
   | subnet_id           | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   | updated_at          | 2022-01-15T11:12:42                  |
   | weight              | 1                                    |
   | monitor_port        | None                                 |
   | monitor_address     | None                                 |
   | backup              | False                                |
   +---------------------+--------------------------------------+

Procedure

1. Combine the key (server.key), certificate (server.crt), and intermediate certificate chain (ca-chain.crt) into a single PKCS12 file (server.p12).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openssl pkcs12 -export -inkey server.key -in server.crt -certfile ca-chain.crt -passout pass: -out server.p12

   Note

   The following procedure does not work if you password protect the PKCS12 file.

2. Source your credentials file.

   Example

   $ source ~/overcloudrc

3. Use the Key Manager service to create a secret resource (tls_secret1) for the PKCS12 file.

   Example

   $ openstack secret store --name='tls_secret1' -t 'application/octet-stream' -e 'base64' --payload="$(base64 < server.p12)"

4. Create a load balancer (lb1) on the public subnet (public_subnet).

   Example

   $ openstack loadbalancer create --name lb1 --vip-subnet-id public_subnet

5. Monitor the state of the load balancer.

   Example

   $ openstack loadbalancer show lb1

6. Before going to the next step, ensure that the provisioning_status is ACTIVE.

7. Create a TERMINATED_HTTPS listener (listener1), and reference the secret resource as the default TLS container for the listener.

   Example

   $ openstack loadbalancer listener create --protocol-port 443 --protocol TERMINATED_HTTPS --name listener1 --default-tls-container=$(openstack secret list | awk '/ tls_secret1 / {print $2}') lb1

8. Create a pool (pool1) and make it the default pool for the listener.

   Example

   $ openstack loadbalancer pool create --name pool1 --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP

9. Create a health monitor on the pool (pool1) that connects to the back-end servers and tests the path (/).

   Example

   $ openstack loadbalancer healthmonitor create --delay 15 --max-retries 4 --timeout 10 --type HTTP --url-path / pool1

10. Add the non-secure HTTP back-end servers (192.0.2.10 and 192.0.2.11) on the private subnet (private_subnet) to the pool.

    Example

    $ openstack loadbalancer member create --subnet-id private_subnet --address 192.0.2.10 --protocol-port 80 pool1
    $ openstack loadbalancer member create --subnet-id private_subnet --address 192.0.2.11 --protocol-port 80 pool1

Verification

1. View and verify the load balancer (lb1) settings.

   Example

   $ openstack loadbalancer show lb1

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | admin_state_up      | True                                 |
   | created_at          | 2022-01-15T11:11:09                  |
   | description         |                                      |
   | flavor              |                                      |
   | id                  | 788fe121-3dec-4e1b-8360-4020642238b0 |
   | listeners           | 09f28053-fde8-4c78-88b9-0f191d84120e |
   | name                | lb1                                  |
   | operating_status    | ONLINE                               |
   | pools               | 627842b3-eed8-4f5f-9f4a-01a738e64d6a |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | provider            | amphora                              |
   | provisioning_status | ACTIVE                               |
   | updated_at          | 2022-01-15T11:12:42                  |
   | vip_address         | 198.51.100.11                        |
   | vip_network_id      | 9bca13be-f18d-49a5-a83d-9d487827fd16 |
   | vip_port_id         | 69a85edd-5b1c-458f-96f2-b4552b15b8e6 |
   | vip_qos_policy_id   | None                                 |
   | vip_subnet_id       | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   +---------------------+--------------------------------------+

2. When a health monitor is present and functioning properly, you can check the status of each member.

   A working member (b85c807e-4d7c-4cbd-b725-5e8afddf80d2) has an ONLINE value for its operating_status.

   Example

   $ openstack loadbalancer member show pool1 b85c807e-4d7c-4cbd-b725-5e8afddf80d2

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | address             | 192.0.2.10                           |
   | admin_state_up      | True                                 |
   | created_at          | 2022-01-15T11:11:09                  |
   | id                  | b85c807e-4d7c-4cbd-b725-5e8afddf80d2 |
   | name                |                                      |
   | operating_status    | ONLINE                               |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | protocol_port       | 80                                   |
   | provisioning_status | ACTIVE                               |
   | subnet_id           | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   | updated_at          | 2022-01-15T11:12:42                  |
   | weight              | 1                                    |
   | monitor_port        | None                                 |
   | monitor_address     | None                                 |
   | backup              | False                                |
   +---------------------+--------------------------------------+

Procedure

1. For each of the TLS certificates in the SNI list, combine the key (server.key), certificate (server.crt), and intermediate certificate chain (ca-chain.crt) into a single PKCS12 file (server.p12).

   In this example, you create two PKCS12 files (server.p12 and server2.p12) one for each certificate (www.example.com and www2.example.com).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   $ openssl pkcs12 -export -inkey server.key -in server.crt -certfile ca-chain.crt -passout pass: -out server.p12
   
   $ openssl pkcs12 -export -inkey server2.key -in server2.crt -certfile ca-chain2.crt -passout pass: -out server2.p12

2. Source your credentials file.

   Example

   $ source ~/overcloudrc

3. Use the Key Manager service to create secret resources (tls_secret1 and tls_secret2) for the PKCS12 file.

   $ openstack secret store --name='tls_secret1' -t 'application/octet-stream' -e 'base64' --payload="$(base64 < server.p12)"
   $ openstack secret store --name='tls_secret2' -t 'application/octet-stream' -e 'base64' --payload="$(base64 < server2.p12)"

4. Create a load balancer (lb1) on the public subnet (public_subnet).

   $ openstack loadbalancer create --name lb1 --vip-subnet-id public_subnet

5. Monitor the state of the load balancer.

   Example

   $ openstack loadbalancer show lb1

6. Before going to the next step, ensure that the provisioning_status is ACTIVE.

7. Create a TERMINATED_HTTPS listener (listener1), and use SNI to reference both the secret resources.

   (Reference tls_secret1 as the default TLS container for the listener.)

   $ openstack loadbalancer listener create --protocol-port 443 \
   --protocol TERMINATED_HTTPS --name listener1 \
   --default-tls-container=$(openstack secret list | awk '/ tls_secret1 / {print $2}') \
   --sni-container-refs $(openstack secret list | awk '/ tls_secret1 / {print $2}') \
   $(openstack secret list | awk '/ tls_secret2 / {print $2}') -- lb1

8. Create a pool (pool1) and make it the default pool for the listener.

   $ openstack loadbalancer pool create --name pool1 --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP

9. Create a health monitor on the pool (pool1) that connects to the back-end servers and tests the path (/).

   Example

   $ openstack loadbalancer healthmonitor create --delay 15 --max-retries 4 --timeout 10 --type HTTP --url-path / pool1

10. Add the non-secure HTTP back-end servers (192.0.2.10 and 192.0.2.11) on the private subnet (private_subnet) to the pool.

    $ openstack loadbalancer member create --subnet-id private_subnet --address 192.0.2.10 --protocol-port 80 pool1
    $ openstack loadbalancer member create --subnet-id private_subnet --address 192.0.2.11 --protocol-port 80 pool1

Verification

1. View and verify the load balancer (lb1) settings.

   Example

   $ openstack loadbalancer show lb1

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | admin_state_up      | True                                 |
   | created_at          | 2022-01-15T11:11:09                  |
   | description         |                                      |
   | flavor              |                                      |
   | id                  | 788fe121-3dec-4e1b-8360-4020642238b0 |
   | listeners           | 09f28053-fde8-4c78-88b9-0f191d84120e |
   | name                | lb1                                  |
   | operating_status    | ONLINE                               |
   | pools               | 627842b3-eed8-4f5f-9f4a-01a738e64d6a |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | provider            | amphora                              |
   | provisioning_status | ACTIVE                               |
   | updated_at          | 2022-01-15T11:12:42                  |
   | vip_address         | 198.51.100.11                        |
   | vip_network_id      | 9bca13be-f18d-49a5-a83d-9d487827fd16 |
   | vip_port_id         | 69a85edd-5b1c-458f-96f2-b4552b15b8e6 |
   | vip_qos_policy_id   | None                                 |
   | vip_subnet_id       | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   +---------------------+--------------------------------------+

2. When a health monitor is present and functioning properly, you can check the status of each member.

   A working member (b85c807e-4d7c-4cbd-b725-5e8afddf80d2) has an ONLINE value for its operating_status.

   Example

   $ openstack loadbalancer member show pool1 b85c807e-4d7c-4cbd-b725-5e8afddf80d2

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | address             | 192.0.2.10                           |
   | admin_state_up      | True                                 |
   | created_at          | 2022-01-15T11:11:09                  |
   | id                  | b85c807e-4d7c-4cbd-b725-5e8afddf80d2 |
   | name                |                                      |
   | operating_status    | ONLINE                               |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | protocol_port       | 80                                   |
   | provisioning_status | ACTIVE                               |
   | subnet_id           | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   | updated_at          | 2022-01-15T11:12:42                  |
   | weight              | 1                                    |
   | monitor_port        | None                                 |
   | monitor_address     | None                                 |
   | backup              | False                                |
   +---------------------+--------------------------------------+

Procedure

1. Combine the key (server.key), certificate (server.crt), and intermediate certificate chain (ca-chain.crt) into a single PKCS12 file (server.p12).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   $ openssl pkcs12 -export -inkey server.key -in server.crt -certfile ca-chain.crt -passout pass: -out server.p12

2. Source your credentials file.

   Example

   $ source ~/overcloudrc

3. Use the Key Manager service to create a secret resource (tls_secret1) for the PKCS12 file.

   $ openstack secret store --name='tls_secret1' -t 'application/octet-stream' -e 'base64' --payload="$(base64 < server.p12)"

4. Create a load balancer (lb1) on the public subnet (public_subnet).

   $ openstack loadbalancer create --name lb1 --vip-subnet-id public_subnet

5. Monitor the state of the load balancer.

   Example

   $ openstack loadbalancer show lb1

6. Before going to the next step, ensure that the provisioning_status is ACTIVE.

7. Create a TERMINATED_HTTPS listener (listener1), and reference the secret resource as the default TLS container for the listener.

   $ openstack loadbalancer listener create --protocol-port 443 --protocol TERMINATED_HTTPS --name listener1 --default-tls-container=$(openstack secret list | awk '/ tls_secret1 / {print $2}') lb1

8. Create a pool (pool1) and make it the default pool for the listener.

   $ openstack loadbalancer pool create --name pool1 --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP

9. Create a health monitor on the pool (pool1) that connects to the back-end servers and tests the path (/):

   Example

   $ openstack loadbalancer healthmonitor create --delay 15 --max-retries 4 --timeout 10 --type HTTP --url-path / pool1

10. Add the non-secure HTTP back-end servers (192.0.2.10 and 192.0.2.11) on the private subnet (private_subnet) to the pool.

    $ openstack loadbalancer member create --subnet-id private_subnet --address 192.0.2.10 --protocol-port 80 pool1
    $ openstack loadbalancer member create --subnet-id private_subnet --address 192.0.2.11 --protocol-port 80 pool1

11. Create a non-secure, HTTP listener (listener2), and make its default pool, the same as the secure listener.

    $ openstack loadbalancer listener create --protocol-port 80 --protocol HTTP --name listener2 --default-pool pool1 lb1

Verification

1. View and verify the load balancer (lb1) settings.

   Example

   $ openstack loadbalancer show lb1

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | admin_state_up      | True                                 |
   | created_at          | 2022-01-15T11:11:09                  |
   | description         |                                      |
   | flavor              |                                      |
   | id                  | 788fe121-3dec-4e1b-8360-4020642238b0 |
   | listeners           | 09f28053-fde8-4c78-88b9-0f191d84120e |
   | name                | lb1                                  |
   | operating_status    | ONLINE                               |
   | pools               | 627842b3-eed8-4f5f-9f4a-01a738e64d6a |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | provider            | amphora                              |
   | provisioning_status | ACTIVE                               |
   | updated_at          | 2022-01-15T11:12:42                  |
   | vip_address         | 198.51.100.11                        |
   | vip_network_id      | 9bca13be-f18d-49a5-a83d-9d487827fd16 |
   | vip_port_id         | 69a85edd-5b1c-458f-96f2-b4552b15b8e6 |
   | vip_qos_policy_id   | None                                 |
   | vip_subnet_id       | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   +---------------------+--------------------------------------+

2. When a health monitor is present and functioning properly, you can check the status of each member.

   A working member (b85c807e-4d7c-4cbd-b725-5e8afddf80d2) has an ONLINE value for its operating_status.

   Example

   $ openstack loadbalancer member show pool1 b85c807e-4d7c-4cbd-b725-5e8afddf80d2

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | address             | 192.0.2.10                           |
   | admin_state_up      | True                                 |
   | created_at          | 2022-01-15T11:11:09                  |
   | id                  | b85c807e-4d7c-4cbd-b725-5e8afddf80d2 |
   | name                |                                      |
   | operating_status    | ONLINE                               |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | protocol_port       | 80                                   |
   | provisioning_status | ACTIVE                               |
   | subnet_id           | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   | updated_at          | 2022-01-15T11:12:42                  |
   | weight              | 1                                    |
   | monitor_port        | None                                 |
   | monitor_address     | None                                 |
   | backup              | False                                |
   +---------------------+--------------------------------------+

Procedure

1. Source your credentials file.

   Example

   $ source ~/overcloudrc

2. Create a load balancer (lb1) on the public subnet (public_subnet).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer create --name lb1 \
   --vip-subnet-id public_subnet --wait

3. Create a TCP listener (listener1) on the specified port (23456) for which the custom application is configured.

   Example

   $ openstack loadbalancer listener create --name listener1 \
   --protocol TCP --protocol-port 23456 lb1

4. Create a pool (pool1) and make it the default pool for the listener.

   Example

   In this example, a pool is created that uses a private subnet containing back-end servers that host a custom application on a specific TCP port:

   $ openstack loadbalancer pool create --name pool1 \
   --lb-algorithm ROUND_ROBIN --listener listener1 \
   --protocol TCP

5. Create a health monitor (healthmon1) on the pool (pool1) that connects to the back-end servers and probes the TCP service port.

   Example

   Health checks are recommended but not required. If no health monitor is defined, the member server is assumed to be ONLINE.

   $ openstack loadbalancer healthmonitor create --name healthmon1 \
   --delay 15 --max-retries 4 --timeout 10 --type TCP pool1

6. Add the back-end servers (192.0.2.10 and 192.0.2.11) on the private subnet (private_subnet) to the pool.

   Example

   In this example, the back-end servers, 192.0.2.10 and 192.0.2.11, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --name member1 --subnet-id \
   private_subnet --address 192.0.2.10 --protocol-port 443 pool1
   
   $ openstack loadbalancer member create --name member2 --subnet-id \
   private_subnet --address 192.0.2.11 --protocol-port 443 pool1

Verification

1. View and verify the load balancer (lb1) settings.

   Example

   $ openstack loadbalancer show lb1

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | admin_state_up      | True                                 |
   | created_at          | 2022-01-15T11:11:09                  |
   | description         |                                      |
   | flavor              |                                      |
   | id                  | 788fe121-3dec-4e1b-8360-4020642238b0 |
   | listeners           | 09f28053-fde8-4c78-88b9-0f191d84120e |
   | name                | lb1                                  |
   | operating_status    | ONLINE                               |
   | pools               | 627842b3-eed8-4f5f-9f4a-01a738e64d6a |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | provider            | amphora                              |
   | provisioning_status | ACTIVE                               |
   | updated_at          | 2022-01-15T11:12:42                  |
   | vip_address         | 198.51.100.11                         |
   | vip_network_id      | 9bca13be-f18d-49a5-a83d-9d487827fd16 |
   | vip_port_id         | 69a85edd-5b1c-458f-96f2-b4552b15b8e6 |
   | vip_qos_policy_id   | None                                 |
   | vip_subnet_id       | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   +---------------------+--------------------------------------+

2. When a health monitor is present and functioning properly, you can check the status of each member. Use the following command to obtain a member ID:

   Example

   $ openstack loadbalancer member list pool1

   A working member (member1) has an ONLINE value for its operating_status.

   Example

   $ openstack loadbalancer member show pool1 member1

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | address             | 192.0.2.10                           |
   | admin_state_up      | True                                 |
   | created_at          | 2022-01-15T11:11:09                  |
   | id                  | b85c807e-4d7c-4cbd-b725-5e8afddf80d2 |
   | name                | member1                              |
   | operating_status    | ONLINE                               |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | protocol_port       | 80                                   |
   | provisioning_status | ACTIVE                               |
   | subnet_id           | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   | updated_at          | 2022-01-15T11:12:42                  |
   | weight              | 1                                    |
   | monitor_port        | None                                 |
   | monitor_address     | None                                 |
   | backup              | False                                |
   +---------------------+--------------------------------------+

Procedure

1. Source your credentials file.

   Example

   $ source ~/overcloudrc

2. Create a load balancer (lb1) on a private subnet (private_subnet).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer create --name lb1 \
   --vip-subnet-id private_subnet --wait

3. Create a listener (listener1) on a port (1234).

   Example

   $ openstack loadbalancer listener create --name listener1 \
   --protocol UDP --protocol-port 1234 lb1

4. Create the listener default pool (pool1).

   Example

   The command in this example creates a pool that uses a private subnet containing back-end servers that host one or more applications configured to use UDP ports:

   $ openstack loadbalancer pool create --name pool1 \
   --lb-algorithm ROUND_ROBIN --listener listener1 --protocol UDP

5. Create a health monitor (healthmon1) on the pool (pool1) that connects to the back-end servers by using UDP (UDP-CONNECT).

   Health checks are recommended but not required. If no health monitor is defined, the member server is assumed to be ONLINE.

   Example

   $ openstack loadbalancer healthmonitor create --name healthmon1 \
   --delay 5 --max-retries 2 --timeout 3 --type UDP-CONNECT pool1

6. Add the back-end servers (192.0.2.10 and 192.0.2.11) on the private subnet (private_subnet) to the default pool.

   Example

   In this example, the back-end servers, 192.0.2.10 and 192.0.2.11, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --name member1 --subnet-id \
   private_subnet --address 192.0.2.10 --protocol-port 1234 pool1
   
   $ openstack loadbalancer member create --name member2 --subnet-id \
   private_subnet --address 192.0.2.11 --protocol-port 1234 pool1

Verification

1. View and verify the load balancer (lb1) settings.

   Example

   $ openstack loadbalancer show lb1

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | admin_state_up      | True                                 |
   | created_at          | 2022-01-15T11:11:09                  |
   | description         |                                      |
   | flavor              |                                      |
   | id                  | 788fe121-3dec-4e1b-8360-4020642238b0 |
   | listeners           | 09f28053-fde8-4c78-88b9-0f191d84120e |
   | name                | lb1                                  |
   | operating_status    | ONLINE                               |
   | pools               | 627842b3-eed8-4f5f-9f4a-01a738e64d6a |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | provider            | amphora                              |
   | provisioning_status | ACTIVE                               |
   | updated_at          | 2022-01-15T11:12:42                  |
   | vip_address         | 198.51.100.11                        |
   | vip_network_id      | 9bca13be-f18d-49a5-a83d-9d487827fd16 |
   | vip_port_id         | 69a85edd-5b1c-458f-96f2-b4552b15b8e6 |
   | vip_qos_policy_id   | None                                 |
   | vip_subnet_id       | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   +---------------------+--------------------------------------+

2. When a health monitor is present and functioning properly, you can check the status of each member.

   Example

   $ openstack loadbalancer member show pool1 member1

   A working member (member1) has an ONLINE value for its operating_status.

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | address             | 192.0.2.10                           |
   | admin_state_up      | True                                 |
   | created_at          | 2022-01-15T11:11:09                  |
   | id                  | b85c807e-4d7c-4cbd-b725-5e8afddf80d2 |
   | name                | member1                              |
   | operating_status    | ONLINE                               |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | protocol_port       | 1234                                 |
   | provisioning_status | ACTIVE                               |
   | subnet_id           | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   | updated_at          | 2022-01-15T11:12:42                  |
   | weight              | 1                                    |
   | monitor_port        | None                                 |
   | monitor_address     | None                                 |
   | backup              | False                                |
   +---------------------+--------------------------------------+

Procedure

1. Source your credentials file.

   Example

   $ source ~/overcloudrc

2. Create a network bandwidth QoS policy (qos_policy_bandwidth) with a maximum 1024 kbps and a maximum burst rate of 1024 kb.

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack network qos policy create qos_policy_bandwidth
   
   $ openstack network qos rule create --type bandwidth-limit --max-kbps 1024 --max-burst-kbits 1024 qos-policy-bandwidth

3. Create a load balancer (lb1) on the public subnet (public_subnet) by using a QoS policy (qos-policy-bandwidth).

   Example

   $ openstack loadbalancer create --name lb1 \
   --vip-subnet-id public_subnet \
   --vip-qos-policy-id qos-policy-bandwidth --wait

4. Create a listener (listener1) on a port (80).

   Example

   $ openstack loadbalancer listener create --name listener1 \
   --protocol HTTP --protocol-port 80 lb1

5. Create the listener default pool (pool1).

   Example

   The command in this example creates an HTTP pool that uses a private subnet containing back-end servers that host an HTTP application on TCP port 80:

   $ openstack loadbalancer pool create --name pool1 --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP

6. Create a health monitor (healthmon1) on the pool that connects to the back-end servers and tests the path (/).

   Health checks are recommended but not required. If no health monitor is defined, the member server is assumed to be ONLINE.

   Example

   $ openstack loadbalancer healthmonitor create --name healthmon1 \
   --delay 15 --max-retries 4 --timeout 10 --type HTTP --url-path / \
   pool1

7. Add load balancer members (192.0.2.10 and 192.0.2.11) on the private subnet (private_subnet) to the default pool.

   Example

   In this example, the back-end servers, 192.0.2.10 and 192.0.2.11, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --name member1 --subnet-id \
   private_subnet --address 192.0.2.10 --protocol-port 443 pool1
   
   $ openstack loadbalancer member create --name member2 --subnet-id \
   private_subnet --address 192.0.2.11 --protocol-port 443 pool1

Procedure

1. Source your credentials file.

   Example

   $ source ~/overcloudrc

2. Create a load balancer (lb1) on the public subnet (public_subnet).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer create --name lb1 --vip-subnet-id public_subnet --wait

3. Create a listener (listener1) with the allowed CIDRs (192.0.2.0/24 and 198.51.100.0/24).

   Example

   $ openstack loadbalancer listener create --name listener1 --protocol TCP --protocol-port 80 --allowed-cidr 192.0.2.0/24 --allowed-cidr 198.51.100.0/24 lb1

4. Create the listener default pool (pool1).

   Example

   In this example, a pool is created that uses a private subnet containing back-end servers that are configured with a custom application on TCP port 80:

   $ openstack loadbalancer pool create --name pool1 --lb-algorithm ROUND_ROBIN --listener listener1 --protocol TCP

5. Create a health monitor on the pool that connects to the back-end servers and tests the path (/).

   Health checks are recommended but not required. If no health monitor is defined, the member server is assumed to be ONLINE.

   Example

   $ openstack loadbalancer healthmonitor create --name healthmon1 \
   --delay 15 --max-retries 4 --timeout 10 --type HTTP --url-path / pool1

6. Add load balancer members (192.0.2.10 and 192.0.2.11) on the private subnet (private_subnet) to the default pool.

   Example

   In this example, the back-end servers, 192.0.2.10 and 192.0.2.11, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --subnet-id private_subnet --address 192.0.2.10 --protocol-port 80 pool1
   
   $ openstack loadbalancer member create --subnet-id private_subnet --address 192.0.2.11 --protocol-port 80 pool1

Verification

1. View and verify the listener (listener1) settings.

   Example

   $ openstack loadbalancer listener show listener1

   Sample output

   +-----------------------------+--------------------------------------+
   | Field                       | Value                                |
   +-----------------------------+--------------------------------------+
   | admin_state_up              | True                                 |
   | connection_limit            | -1                                   |
   | created_at                  | 2022-01-15T11:11:09                  |
   | default_pool_id             | None                                 |
   | default_tls_container_ref   | None                                 |
   | description                 |                                      |
   | id                          | d26ba156-03c3-4051-86e8-f8997a202d8e |
   | insert_headers              | None                                 |
   | l7policies                  |                                      |
   | loadbalancers               | 2281487a-54b9-4c2a-8d95-37262ec679d6 |
   | name                        | listener1                            |
   | operating_status            | ONLINE                               |
   | project_id                  | 308ca9f600064f2a8b3be2d57227ef8f     |
   | protocol                    | TCP                                  |
   | protocol_port               | 80                                   |
   | provisioning_status         | ACTIVE                               |
   | sni_container_refs          | []                                   |
   | timeout_client_data         | 50000                                |
   | timeout_member_connect      | 5000                                 |
   | timeout_member_data         | 50000                                |
   | timeout_tcp_inspect         | 0                                    |
   | updated_at                  | 2022-01-15T11:12:42                  |
   | client_ca_tls_container_ref | None                                 |
   | client_authentication       | NONE                                 |
   | client_crl_container_ref    | None                                 |
   | allowed_cidrs               | 192.0.2.0/24                         |
   |                             | 198.51.100.0/24                      |
   +-----------------------------+--------------------------------------+

   In this example the parameter, allowed_cidrs, is set to allow traffic only from 192.0.2.0/24 and 198.51.100.0/24.

2. To verify that the load balancer is secure, ensure that a request to the listener from a client whose CIDR is not in the allowed_cidrs list; the request does not succeed.

   Sample output

   curl: (7) Failed to connect to 203.0.113.226 port 80: Connection timed out
   curl: (7) Failed to connect to 203.0.113.226 port 80: Connection timed out
   curl: (7) Failed to connect to 203.0.113.226 port 80: Connection timed out
   curl: (7) Failed to connect to 203.0.113.226 port 80: Connection timed out

Procedure

1. Source your credentials file.

   Example

   $ source ~/overcloudrc

2. Create a load balancer (lb1) on the private subnet (private_subnet) using the --provider ovn argument.

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer create --name lb1 --provider ovn \
   --vip-subnet-id private_subnet --wait

3. Create a listener (listener1) that uses the protocol (tcp) on the specified port (80) for which the custom application is configured.

   Note

   The OVN provider only supports Layer 4 TCP and UDP network traffic.

   Example

   $ openstack loadbalancer listener create --name listener1 \
   --protocol tcp --protocol-port 80 lb1

4. Create the listener default pool (pool1).

   Note

   The only supported load-balancing algorithm for OVN is SOURCE_IP_PORT.

   Example

   The command in this example creates an HTTP pool that uses a private subnet containing back-end servers that host a custom application on a specific TCP port:

   $ openstack loadbalancer pool create --name pool1 --lb-algorithm \
   SOURCE_IP_PORT --listener listener1 --protocol tcp

   Important

   OVN does not support the health monitor feature for load-balancing.

5. Add the back-end servers (192.0.2.10 and 192.0.2.11) on the private subnet (private_subnet) to the pool.

   Example

   In this example, the back-end servers, 192.0.2.10 and 192.0.2.11, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --name member1 --subnet-id \
   private_subnet --address 192.0.2.10 --protocol-port 80 pool1
   
   $ openstack loadbalancer member create --name member2 --subnet-id \
   private_subnet --address 192.0.2.11 --protocol-port 80 pool1

Verification

1. View and verify the load balancer (lb1) settings.

   Example

   $ openstack loadbalancer show lb1

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | admin_state_up      | True                                 |
   | created_at          | 2022-01-15T11:11:09                  |
   | description         |                                      |
   | flavor              |                                      |
   | id                  | 788fe121-3dec-4e1b-8360-4020642238b0 |
   | listeners           | 09f28053-fde8-4c78-88b9-0f191d84120e |
   | name                | lb1                                  |
   | operating_status    | ONLINE                               |
   | pools               | 627842b3-eed8-4f5f-9f4a-01a738e64d6a |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | provider            | ovn                                  |
   | provisioning_status | ACTIVE                               |
   | updated_at          | 2022-01-15T11:12:42                  |
   | vip_address         | 198.51.100.11                        |
   | vip_network_id      | 9bca13be-f18d-49a5-a83d-9d487827fd16 |
   | vip_port_id         | 69a85edd-5b1c-458f-96f2-b4552b15b8e6 |
   | vip_qos_policy_id   | None                                 |
   | vip_subnet_id       | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   +---------------------+--------------------------------------+

2. Run the openstack loadbalancer listener show command to view the listener details.

   Example

   $ openstack loadbalancer listener show listener1

   Sample output

   +-----------------------------+--------------------------------------+
   | Field                       | Value                                |
   +-----------------------------+--------------------------------------+
   | admin_state_up              | True                                 |
   | connection_limit            | -1                                   |
   | created_at                  | 2022-01-15T11:13:52                  |
   | default_pool_id             | a5034e7a-7ddf-416f-9c42-866863def1f2 |
   | default_tls_container_ref   | None                                 |
   | description                 |                                      |
   | id                          | a101caba-5573-4153-ade9-4ea63153b164 |
   | insert_headers              | None                                 |
   | l7policies                  |                                      |
   | loadbalancers               | 653b8d79-e8a4-4ddc-81b4-e3e6b42a2fe3 |
   | name                        | listener1                            |
   | operating_status            | ONLINE                               |
   | project_id                  | 7982a874623944d2a1b54fac9fe46f0b     |
   | protocol                    | TCP                                  |
   | protocol_port               | 64015                                |
   | provisioning_status         | ACTIVE                               |
   | sni_container_refs          | []                                   |
   | timeout_client_data         | 50000                                |
   | timeout_member_connect      | 5000                                 |
   | timeout_member_data         | 50000                                |
   | timeout_tcp_inspect         | 0                                    |
   | updated_at                  | 2022-01-15T11:15:17                  |
   | client_ca_tls_container_ref | None                                 |
   | client_authentication       | NONE                                 |
   | client_crl_container_ref    | None                                 |
   | allowed_cidrs               | None                                 |
   +-----------------------------+--------------------------------------+

3. Run the openstack loadbalancer pool show command to view the pool (pool1) and load-balancer members.

   Example

   $ openstack loadbalancer pool show pool1

   Sample output

   +----------------------+--------------------------------------+
   | Field                | Value                                |
   +----------------------+--------------------------------------+
   | admin_state_up       | True                                 |
   | created_at           | 2022-01-15T11:17:34                  |
   | description          |                                      |
   | healthmonitor_id     |                                      |
   | id                   | a5034e7a-7ddf-416f-9c42-866863def1f2 |
   | lb_algorithm         | SOURCE_IP_PORT                       |
   | listeners            | a101caba-5573-4153-ade9-4ea63153b164 |
   | loadbalancers        | 653b8d79-e8a4-4ddc-81b4-e3e6b42a2fe3 |
   | members              | 90d69170-2f73-4bfd-ad31-896191088f59 |
   | name                 | pool1                                |
   | operating_status     | ONLINE                               |
   | project_id           | 7982a874623944d2a1b54fac9fe46f0b     |
   | protocol             | TCP                                  |
   | provisioning_status  | ACTIVE                               |
   | session_persistence  | None                                 |
   | updated_at           | 2022-01-15T11:18:59                  |
   | tls_container_ref    | None                                 |
   | ca_tls_container_ref | None                                 |
   | crl_container_ref    | None                                 |
   | tls_enabled          | False                                |
   +----------------------+--------------------------------------+

Procedure

1. Source your credentials file.

   Example

   $ source ~/overcloudrc

2. Create an HTTP listener (http_listener) on a load balancer (lb1) port (80).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer listener create --name http_listener \
   --protocol HTTP --protocol-port 80 lb1

3. Create an L7 policy (policy1) on the listener (http_listener). The policy must contain the action (REDIRECT_TO_URL) and point to the URL (https://www.example.com/).

   Example

   $ openstack loadbalancer l7policy create --name policy1 \
   --action REDIRECT_PREFIX --redirect-prefix https://www.example.com/ \
   http_listener

4. Add an L7 rule that matches all requests to a policy (policy1).

   Example

   $ openstack loadbalancer l7rule create --compare-type STARTS_WITH \
   --type PATH --value / policy1

Verification

1. Run the openstack loadbalancer l7policy list command and verify that the policy, policy1, exists.

2. Run the openstack loadbalancer l7rule list <l7policy> command and verify that a rule with a compare_type of STARTS_WITH exists.

   Example

   $ openstack loadbalancer l7rule list policy1

Procedure

1. Source your credentials file.

   Example

   $ source ~/overcloudrc

2. Create a second pool (static_pool) on a load balancer (lb1).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer pool create --name static_pool \
   --lb-algorithm ROUND_ROBIN --loadbalancer lb1 --protocol HTTP

3. Add load balancer members (192.0.2.10 and 192.0.2.11) on the private subnet (private_subnet) to the pool (static_pool):

   Example

   In this example, the back-end servers, 192.0.2.10 and 192.0.2.11, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --name member1 --subnet-id \
   private_subnet --address 192.0.2.10 --protocol-port 80 static_pool
   
   $ openstack loadbalancer member create --name member2 --subnet-id \
   private_subnet --address 192.0.2.11 --protocol-port 80 static_pool

4. Create an L7 policy (policy1) on the listener (listener1). The policy must contain the action (REDIRECT_TO_POOL) and point to the pool (static_pool).

   Example

   $ openstack loadbalancer l7policy create --name policy1 \
   --action REDIRECT_TO_POOL --redirect-pool static_pool listener1

5. Add an L7 rule that looks for /js at the start of the request path to the policy.

   Example

   $ openstack loadbalancer l7rule create --compare-type STARTS_WITH \
   --type PATH --value /js policy1

6. Create an L7 policy (policy2) with an action (REDIRECT_TO_POOL) and add the listener (listener1) pointed at the pool.

   Example

   $ openstack loadbalancer l7policy create --name policy2 \
   --action REDIRECT_TO_POOL --redirect-pool static_pool listener1

7. Add an L7 rule that looks for /images at the start of the request path to the policy.

   Example

   $ openstack loadbalancer l7rule create --compare-type STARTS_WITH \
   --type PATH --value /images policy2

Verification

1. Run the openstack loadbalancer l7policy list command and verify that the policies, policy1 and policy2, exist.

2. Run the openstack loadbalancer l7rule list <l7policy> command and verify that a rule with a compare_type of STARTS_WITH exists for each respective policy.

   Example

   $ openstack loadbalancer l7rule list policy1
   
   $ openstack loadbalancer l7rule list policy2

Procedure

1. Source your credentials file.

   Example

   $ source ~/overcloudrc

2. Create a second pool (pool2) on the load balancer (lb1).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer pool create --name pool2 \
   --lb-algorithm ROUND_ROBIN --loadbalancer lb1 --protocol HTTP

3. Create an L7 policy (policy1) on the listener (listener1). The policy must contain the action (REDIRECT_TO_POOL) and point to the pool (pool2).

   Example

   $ openstack loadbalancer l7policy create --name policy1 \
   --action REDIRECT_TO_POOL --redirect-pool pool2 listener1

4. Add an L7 rule to the policy that sends any requests using the HTTP/1.1 hostname, www2.example.com, to the second pool (pool2).

   Example

   $ openstack loadbalancer l7rule create --compare-type EQUAL_TO \
   --type HOST_NAME --value www2.example.com policy1

Verification

1. Run the openstack loadbalancer l7policy list command and verify that the policy, policy1, exists.

2. Run the openstack loadbalancer l7rule list <l7policy> command and verify that a rule with a compare_type of EQUAL_TO exists for the policy.

   Example

   $ openstack loadbalancer l7rule list policy1

Procedure

1. Source your credentials file.

   Example

   $ source ~/overcloudrc

2. Create a second pool (pool2) on the load balancer (lb1).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer pool create --name pool2 \
   --lb-algorithm ROUND_ROBIN --loadbalancer lb1 --protocol HTTP

3. Create an L7 policy (policy1) on the listener (listener1). The policy must contain the action (REDIRECT_TO_POOL) and point to the pool (pool2).

   Example

   $ openstack loadbalancer l7policy create --name policy1 \
   --action REDIRECT_TO_POOL --redirect-pool pool2 listener1

4. Add an L7 rule to the policy that sends any requests that use an HTTP/1.1 hostname (www2.example.com) to the second pool (pool2).

   Example

   $ openstack loadbalancer l7rule create --compare-type ENDS_WITH \
   --type HOST_NAME --value .example.com policy1

Verification

1. Run the openstack loadbalancer l7policy list command and verify that the policy, policy1, exists.

2. Run the openstack loadbalancer l7rule list <l7policy> command and verify that a rule with a compare_type of EQUAL_TO exists for the policy.

   Example

   $ openstack loadbalancer l7rule list policy1

Procedure

1. Source your credentials file.

   Example

   $ source ~/overcloudrc

2. Create a second pool (login_pool) on the load balancer (lb1).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer pool create --name login_pool \
   --lb-algorithm ROUND_ROBIN --loadbalancer lb1 --protocol HTTP

3. Add a member, the secure authentication server (192.0.2.10) on the authenticating subnet (secure_subnet), to the second pool.

   Example

   In this example, the back-end server, 192.0.2.10, is named member1:

   $ openstack loadbalancer member create --name member1 \
   --address 192.0.2.10 --protocol-port 80 --subnet-id secure_subnet \
   login_pool

4. Create an L7 policy (policy1) on the listener (listener1). The policy must contain the action (REDIRECT_TO_POOL) and point to the second pool (login_pool).

   Example

   $ openstack loadbalancer l7policy create --name policy1 \
   --action REDIRECT_TO_POOL --redirect-pool login_pool listener1

5. Add an L7 rule to the policy (policy1) that searches for the browser cookie (auth_token) with any value, and matches if the cookie is NOT present.

   Example

   $ openstack loadbalancer l7rule create --compare-type REGEX \
   --key auth_token --type COOKIE --value '.*' --invert policy1

Verification

1. Run the openstack loadbalancer l7policy list command and verify that the policy, policy1, exists.

2. Run the openstack loadbalancer l7rule list <l7policy> command and verify that a rule with a compare_type of REGEX exists.

   Example

   $ openstack loadbalancer l7rule list policy1

   Additional resources

   • loadbalancer pool create in the Command Line Interface Reference
   • loadbalancer member create in the Command Line Interface Reference
   • loadbalancer l7policy create in the Command Line Interface Reference
   • loadbalancer l7rule create in the Command Line Interface Reference

Procedure

1. Source your credentials file.

   Example

   $ source ~/overcloudrc

2. Create a second pool (login_pool) on the load balancer (lb1).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer pool create --name login_pool \
   --lb-algorithm ROUND_ROBIN --loadbalancer lb1 --protocol HTTP

3. Add a member, the secure authentication server (192.0.2.10) on the authenticating subnet (secure_subnet), to the second pool.

   Example

   In this example, the back-end server, 192.0.2.10, is named member1:

   $ openstack loadbalancer member create --name member1 \
   --address 192.0.2.10 --protocol-port 80 --subnet-id secure_subnet \
   login_pool

4. Create an L7 policy (policy1) on the listener (listener1). The policy must contain the action (REDIRECT_TO_POOL) and point to the second pool (login_pool).

   Example

   $ openstack loadbalancer l7policy create --action REDIRECT_TO_POOL \
   --redirect-pool login_pool --name policy1 listener1

5. Add an L7 rule to the policy (policy1) that searches for the browser cookie (auth_token) with any value, and matches if the cookie is NOT present.

   Example

   $ openstack loadbalancer l7rule create --compare-type REGEX \
   --key auth_token --type COOKIE --value '.*' --invert policy1

6. Create a second L7 policy (policy2) on the listener (listener1). The policy must contain the action (REDIRECT_TO_POOL) and point to the second pool (login_pool).

   Example

   $ openstack loadbalancer l7policy create --action REDIRECT_TO_POOL \
   --redirect-pool login_pool --name policy2 listener1

7. Add an L7 rule to the second policy (policy2) that searches for the browser cookie (auth_token) and matches if the cookie value equals the string INVALID.

   Example

   $ openstack loadbalancer l7rule create --compare-type EQUAL_TO \
   --key auth_token --type COOKIE --value INVALID policy2

Verification

1. Run the openstack loadbalancer l7policy list command and verify that the policies, policy1 and policy2, exist.

2. Run the openstack loadbalancer l7rule list <l7policy> command and verify that a rule with a compare_type of REGEX exists for policy1 and a rule with a compare_type of EQUAL_TO exists for policy2.

   Example

   $ openstack loadbalancer l7rule list policy1
   
   $ openstack loadbalancer l7rule list policy2

Procedure

1. Source your credentials file.

   Example

   $ source ~/overcloudrc

2. Create a second pool (api_pool) on the load balancer (lb1).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer pool create --name api_pool \
   --lb-algorithm ROUND_ROBIN --loadbalancer lb1 --protocol HTTP

3. Add load balancer members (192.0.2.10 and 192.0.2.11) on the private subnet (private_subnet) to the pool (static_pool):

   Example

   In this example, the back-end servers, 192.0.2.10 and 192.0.2.11, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --name member1 --subnet-id \
   private_subnet --address 192.0.2.10 --protocol-port 80 static_pool
   
   $ openstack loadbalancer member create --name member2 --subnet-id \
   private_subnet --address 192.0.2.11 --protocol-port 80 static_pool

4. Create an L7 policy (policy1) on the listener (listener1). The policy must contain the action (REDIRECT_TO_POOL) and point to the pool (api_pool).

   Example

   $ openstack loadbalancer l7policy create --action REDIRECT_TO_POOL \
   --redirect-pool api_pool --name policy1 listener1

5. Add an L7 rule to the policy that matches the hostname api.example.com.

   Example

   $ openstack loadbalancer l7rule create --compare-type EQUAL_TO \
   --type HOST_NAME --value api.example.com policy1

6. Add a second L7 rule to the policy that matches /api at the start of the request path.

   This rule is logically ANDed with the first rule.

   Example

   $ openstack loadbalancer l7rule create --compare-type STARTS_WITH \
   --type PATH --value /api policy1

Verification

1. Run the openstack loadbalancer l7policy list command and verify that the policy, policy1, exists.

2. Run the openstack loadbalancer l7rule list <l7policy> command and verify that rules with a compare_type of EQUAL_TO and STARTS_WITH, respectively, both exist for policy1.

   Example

   $ openstack loadbalancer l7rule list policy1
   
   $ openstack loadbalancer l7rule list policy2

Procedure

1. Source your credentials file.

   Example

   $ source ~/overcloudrc

2. Create a third pool (pool_B) on a load balancer (lb1).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer pool create --name pool_B \
   --lb-algorithm ROUND_ROBIN --loadbalancer lb1 --protocol HTTP

3. Add load balancer members (192.0.2.50 and 192.0.2.51) on the private subnet (private_subnet) to the pool (pool_B):

   Example

   In this example, the back-end servers, 192.0.2.50 and 192.0.2.51, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --name member1 \
   --address 192.0.2.50 --protocol-port 80 \
   --subnet-id private_subnet pool_B
   
   $ openstack loadbalancer member create --name member2 \
   --address 192.0.2.51 --protocol-port 80 \
   --subnet-id private_subnet pool_B

4. Create a fourth pool (static_pool_B) on a load balancer (lb1).

   Example

   $ openstack loadbalancer pool create --name static_pool_B \
   --lb-algorithm ROUND_ROBIN --loadbalancer lb1 --protocol HTTP

5. Add load balancer members (192.0.2.100 and 192.0.2.101) on the private subnet (private_subnet) to the pool (static_pool_B):

   Example

   $ openstack loadbalancer member create --name member3 \
   --address 192.0.2.100 --protocol-port 80 \
   --subnet-id private_subnet static_pool_B
   
   $ openstack loadbalancer member create --name member4 \
   --address 192.0.2.101 --protocol-port 80 \
   --subnet-id private_subnet static_pool_B

6. Create an L7 policy (policy2) on the listener (listener1). The policy must contain the action (REDIRECT_TO_POOL) and point to the pool (static_pool_B). Insert the policy at position 1.

   Example

   $ openstack loadbalancer l7policy create --action REDIRECT_TO_POOL \
   --redirect-pool static_pool_B --name policy2 --position 1 listener1

7. Add an L7 rule to the policy (policy2) that uses a regular expression to match either /js or /images at the start of the request path.

   Example

   $ openstack loadbalancer l7rule create --compare-type REGEX \
   --type PATH --value '^/(js|images)' policy2

8. Add a second L7 rule to the policy (policy2) that matches the cookie (site_version) to the exact string (B).

   Example

   $ openstack loadbalancer l7rule create --compare-type EQUAL_TO \
   --key site_version --type COOKIE --value B policy2

9. Create an L7 policy (policy3) on the listener (listener1). The policy must contain the action (REDIRECT_TO_POOL) and point to the pool (pool_B). Insert the policy at position 2.

   Example

   $ openstack loadbalancer l7policy create --action REDIRECT_TO_POOL \
   --redirect-pool pool_B --name policy3 --position 2 listener1

10. Add an L7 rule to the policy (policy3) that matches the cookie (site_version) to the exact string (B).

    Example

    $ openstack loadbalancer l7rule create --compare-type EQUAL_TO \
    --key site_version --type COOKIE --value B policy3

    Note

    It is important to assign L7 policies with the most specific rules to a lower position, because the first policy whose rules all evaluate to True is the policy whose action is followed. In this procedure, policy2 needs to be evaluated before policy3 to avoid requests being sent to the incorrect pool.

Verification

1. Run the openstack loadbalancer l7policy list command and verify that the policies, policy2 and policy3, exist.

2. Run the openstack loadbalancer l7rule list <l7policy> command and verify that a rule with a compare_type of STARTS_WITH exists for each respective policy.

   Example

   $ openstack loadbalancer l7rule list policy2
   
   $ openstack loadbalancer l7rule list policy3

Procedure

1. Perform the RHOSP update as described in the Keeping Red Hat OpenStack Platform Updated guide.
2. After the maintenance release is applied, if you need to use new features, then rotate running amphorae to update them to the latest amphora image.

Procedure

1. Source your credentials file.

   Example

   $ source ~/overcloudrc

2. List the IDs for all of the load balancers that you want to update:

   $ openstack loadbalancer list -c id -f value

3. Fail over each load balancer:

   $ openstack loadbalancer failover <loadbalancer_id>

   Note

   When you start failing over the load balancers, monitor system utilization, and as needed, adjust the rate at which you perform failovers. A load balancer failover creates new virtual machines and ports, which might temporarily increase the load on OpenStack Networking.

4. Monitor the state of the failed over load balancer:

   $ openstack loadbalancer show <loadbalancer_id>

   The update is complete when the load balancer status is ACTIVE.

Procedure

1. Source your credentials file.

   Example

   $ source ~/overcloudrc

2. Verify the load balancer (lb1) settings.

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer show lb1

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | admin_state_up      | True                                 |
   | created_at          | 2022-02-17T15:59:18                  |
   | description         |                                      |
   | flavor_id           | None                                 |
   | id                  | 265d0b71-c073-40f4-9718-8a182c6d53ca |
   | listeners           | 5aaa67da-350d-4125-9022-238e0f7b7f6f |
   | name                | lb1                                  |
   | operating_status    | ONLINE                               |
   | pools               | 48f6664c-b192-4763-846a-da568354da4a |
   | project_id          | 52376c9c5c2e434283266ae7cacd3a9c     |
   | provider            | amphora                              |
   | provisioning_status | ACTIVE                               |
   | updated_at          | 2022-02-17T16:01:21                  |
   | vip_address         | 192.0.2.177                          |
   | vip_network_id      | afeaf55e-7128-4dff-80e2-98f8d1f2f44c |
   | vip_port_id         | 94a12275-1505-4cdc-80c9-4432767a980f |
   | vip_qos_policy_id   | None                                 |
   | vip_subnet_id       | 06ffa90e-2b86-4fe3-9731-c7839b0be6de |
   +---------------------+--------------------------------------+

3. Using the loadbalancer ID (265d0b71-c073-40f4-9718-8a182c6d53ca) from the previous step, obtain the ID of the amphora associated with the load balancer (lb1).

   Example

   $ openstack loadbalancer amphora list | grep 265d0b71-c073-40f4-9718-8a182c6d53ca

   Sample output

   | 1afabefd-ba09-49e1-8c39-41770aa25070 | 265d0b71-c073-40f4-9718-8a182c6d53ca | ALLOCATED | STANDALONE | 198.51.100.7  | 192.0.2.177   |

4. Using the amphora ID (1afabefd-ba09-49e1-8c39-41770aa25070) from the previous step, view amphora information.

   Example

   $ openstack loadbalancer amphora show 1afabefd-ba09-49e1-8c39-41770aa25070

   Sample output

   +-----------------+--------------------------------------+
   | Field           | Value                                |
   +-----------------+--------------------------------------+
   | id              | 1afabefd-ba09-49e1-8c39-41770aa25070 |
   | loadbalancer_id | 265d0b71-c073-40f4-9718-8a182c6d53ca |
   | compute_id      | ba9fc1c4-8aee-47ad-b47f-98f12ea7b200 |
   | lb_network_ip   | 198.51.100.7                         |
   | vrrp_ip         | 192.0.2.36                           |
   | ha_ip           | 192.0.2.177                          |
   | vrrp_port_id    | 07dcd894-487a-48dc-b0ec-7324fe5d2082 |
   | ha_port_id      | 94a12275-1505-4cdc-80c9-4432767a980f |
   | cert_expiration | 2022-03-19T15:59:23                  |
   | cert_busy       | False                                |
   | role            | STANDALONE                           |
   | status          | ALLOCATED                            |
   | vrrp_interface  | None                                 |
   | vrrp_id         | 1                                    |
   | vrrp_priority   | None                                 |
   | cached_zone     | nova                                 |
   | created_at      | 2022-02-17T15:59:22                  |
   | updated_at      | 2022-02-17T16:00:50                  |
   | image_id        | 53001253-5005-4891-bb61-8784ae85e962 |
   | compute_flavor  | 65                                   |
   +-----------------+--------------------------------------+

5. View the listener (listener1) details.

   Example

   $ openstack loadbalancer listener show listener1

   Sample output

   +-----------------------------+--------------------------------------+
   | Field                       | Value                                |
   +-----------------------------+--------------------------------------+
   | admin_state_up              | True                                 |
   | connection_limit            | -1                                   |
   | created_at                  | 2022-02-17T16:00:59                  |
   | default_pool_id             | 48f6664c-b192-4763-846a-da568354da4a |
   | default_tls_container_ref   | None                                 |
   | description                 |                                      |
   | id                          | 5aaa67da-350d-4125-9022-238e0f7b7f6f |
   | insert_headers              | None                                 |
   | l7policies                  |                                      |
   | loadbalancers               | 265d0b71-c073-40f4-9718-8a182c6d53ca |
   | name                        | listener1                            |
   | operating_status            | ONLINE                               |
   | project_id                  | 52376c9c5c2e434283266ae7cacd3a9c     |
   | protocol                    | HTTP                                 |
   | protocol_port               | 80                                   |
   | provisioning_status         | ACTIVE                               |
   | sni_container_refs          | []                                   |
   | timeout_client_data         | 50000                                |
   | timeout_member_connect      | 5000                                 |
   | timeout_member_data         | 50000                                |
   | timeout_tcp_inspect         | 0                                    |
   | updated_at                  | 2022-02-17T16:01:21                  |
   | client_ca_tls_container_ref | None                                 |
   | client_authentication       | NONE                                 |
   | client_crl_container_ref    | None                                 |
   | allowed_cidrs               | None                                 |
   +-----------------------------+--------------------------------------+

6. View the pool (pool1) and load-balancer members.

   Example

   $ openstack loadbalancer pool show pool1

   Sample output

   +----------------------+--------------------------------------+
   | Field                | Value                                |
   +----------------------+--------------------------------------+
   | admin_state_up       | True                                 |
   | created_at           | 2022-02-17T16:01:08                  |
   | description          |                                      |
   | healthmonitor_id     | 4b24180f-74c7-47d2-b0a2-4783ada9a4f0 |
   | id                   | 48f6664c-b192-4763-846a-da568354da4a |
   | lb_algorithm         | ROUND_ROBIN                          |
   | listeners            | 5aaa67da-350d-4125-9022-238e0f7b7f6f |
   | loadbalancers        | 265d0b71-c073-40f4-9718-8a182c6d53ca |
   | members              | b92694bd-3407-461a-92f2-90fb2c4aedd1 |
   |                      | 4ccdd1cf-736d-4b31-b67c-81d5f49e528d |
   | name                 | pool1                                |
   | operating_status     | ONLINE                               |
   | project_id           | 52376c9c5c2e434283266ae7cacd3a9c     |
   | protocol             | HTTP                                 |
   | provisioning_status  | ACTIVE                               |
   | session_persistence  | None                                 |
   | updated_at           | 2022-02-17T16:01:21                  |
   | tls_container_ref    | None                                 |
   | ca_tls_container_ref | None                                 |
   | crl_container_ref    | None                                 |
   | tls_enabled          | False                                |
   +----------------------+--------------------------------------+

7. Verify HTTPS traffic flows across a load balancer whose listener is configured for HTTPS or TERMINATED_HTTPS protocols by connecting to the VIP address (192.0.2.177) of the load balancer.

   Tip

   Obtain the load-balancer VIP address by using the command, openstack loadbalancer show <load_balancer_name>.

   Note

   Security groups implemented for the load balancer VIP only allow data traffic for the required protocols and ports. For this reason you cannot ping load balancer VIPs, because ICMP traffic is blocked.

   Example

   $ curl -v https://192.0.2.177 --insecure

   Sample output

   * About to connect() to 192.0.2.177 port 443 (#0)
   *   Trying 192.0.2.177...
   * Connected to 192.0.2.177 (192.0.2.177) port 443 (#0)
   * Initializing NSS with certpath: sql:/etc/pki/nssdb
   * skipping SSL peer certificate verification
   * SSL connection using TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
   * Server certificate:
   * 	subject: CN=www.example.com,O=Dis,L=Springfield,ST=Denial,C=US
   * 	start date: Jan 15 09:21:45 2021 GMT
   * 	expire date: Jan 15 09:21:45 2021 GMT
   * 	common name: www.example.com
   * 	issuer: CN=www.example.com,O=Dis,L=Springfield,ST=Denial,C=US
   > GET / HTTP/1.1
   > User-Agent: curl/7.29.0
   > Host: 192.0.2.177
   > Accept: */*
   >
   < HTTP/1.1 200 OK
   < Content-Length: 30
   <
   * Connection #0 to host 192.0.2.177 left intact

Procedure

1. Source your credentials file.

   Example

   $ source ~/overcloudrc

2. Locate the ID of the amphora that you want to migrate. You need to provide the ID in a later step.

   $ openstack loadbalancer amphora list

3. To prevent the Compute scheduler service from scheduling any new amphorae to the Compute node being evacuated, disable the Compute node (compute-host-1).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack compute service set compute-host-1 nova-compute --disable

4. Fail over the amphora by using the amphora ID (ea17210a-1076-48ff-8a1f-ced49ccb5e53) that you obtained.

   Example

   $ openstack loadbalancer amphora failover ea17210a-1076-48ff-8a1f-ced49ccb5e53

Procedure

1. On the director node, start ssh-agent and add your user identity key to the agent:

   $ eval $(ssh-agent -s)
   $ ssh-add

2. Source your credentials file.

   Example

   $ source ~/overcloudrc

3. Determine the IP address on the load-balancing management network (lb_network_ip) for the amphora that you want to connect to:

   $ openstack loadbalancer amphora list

4. Use SSH to connect to the amphora:

   $ ssh -A -t heat-admin@<controller_node_IP_address> ssh cloud-user@<lb_network_ip>

5. When you are finished, close your connection to the amphora and stop the SSH agent:

   $ exit

Procedure

1. Source your credentials file.

   Example

   $ source ~/overcloudrc

2. View the stats for the listener (listener1).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer listener stats show listener1

   Tip

   If you do not know the name of the listener, enter the command loadbalancer listener list.

   Sample output

   +--------------------+-------+
   | Field              | Value |
   +--------------------+-------+
   | active_connections | 0     |
   | bytes_in           | 0     |
   | bytes_out          | 0     |
   | request_errors     | 0     |
   | total_connections  | 0     |
   +--------------------+-------+