Chapter 1. Configuring the overcloud to use an external load balancer

Procedure

1. Log in to the director host as the stack user and source the director credentials:

   $ source ~/stackrc

2. Create a node definition template instackenv.json and copy and edit the following example based on your environment:

   {
       "nodes":[
           {
               "mac":[
                   "bb:bb:bb:bb:bb:bb"
               ],
               "cpu":"4",
               "memory":"6144",
               "disk":"40",
               "arch":"x86_64",
               "pm_type":"ipmi",
               "pm_user":"admin",
               "pm_password":"p@55w0rd!",
               "pm_addr":"192.0.2.205"
           },
           {
               "mac":[
                   "cc:cc:cc:cc:cc:cc"
               ],
               "cpu":"4",
               "memory":"6144",
               "disk":"40",
               "arch":"x86_64",
               "pm_type":"ipmi",
               "pm_user":"admin",
               "pm_password":"p@55w0rd!",
               "pm_addr":"192.0.2.206"
           },
           {
               "mac":[
                   "dd:dd:dd:dd:dd:dd"
               ],
               "cpu":"4",
               "memory":"6144",
               "disk":"40",
               "arch":"x86_64",
               "pm_type":"ipmi",
               "pm_user":"admin",
               "pm_password":"p@55w0rd!",
               "pm_addr":"192.0.2.207"
           },
           {
               "mac":[
                   "ee:ee:ee:ee:ee:ee"
               ],
               "cpu":"4",
               "memory":"6144",
               "disk":"40",
               "arch":"x86_64",
               "pm_type":"ipmi",
               "pm_user":"admin",
               "pm_password":"p@55w0rd!",
               "pm_addr":"192.0.2.208"
           }
       ]
   }

3. Save the file to the home directory of the stack user, /home/stack/instackenv.json, then import it into director and register the nodes to the director:

   $ openstack overcloud node import ~/instackenv.json

4. Assign the kernel and ramdisk images to all nodes:

   $ openstack overcloud node configure

5. Inspect the hardware attributes of each node:

   $ openstack overcloud node introspect --all-manageable

   Important

   The nodes must be in the manageable state. Ensure that this process runs to completion. This process usually takes 15 minutes for bare metal nodes.

6. Get the list of your nodes to identify their UUIDs:

   $ openstack baremetal node list

7. Manually tag each node to a specific profile by adding a profile option in the properties/capabilities parameter for each node. For example, to tag three nodes to use a Controller profile and one node to use a Compute profile, use the following commands:

   $ openstack baremetal node set 1a4e30da-b6dc-499d-ba87-0bd8a3819bc0 --property capabilities='profile:control,boot_option:local'
   $ openstack baremetal node set 6faba1a9-e2d8-4b7c-95a2-c7fbdc12129a --property capabilities='profile:control,boot_option:local'
   $ openstack baremetal node set 5e3b2f50-fcd9-4404-b0a2-59d79924b38e --property capabilities='profile:control,boot_option:local'
   $ openstack baremetal node set 58c3d07e-24f2-48a7-bbb6-6843f0e8ee13 --property capabilities='profile:compute,boot_option:local'

   The profile:compute and profile:control options tag the nodes into each respective profile.

Procedure

1. To configure the node interfaces for each role, customize the following network interface templates:

   • To configure a single NIC with VLANs for each role, use the example templates in the following directory:

     /usr/share/openstack-tripleo-heat-templates/network/config/single-nic-vlans

   • To configure bonded NICs for each role, use the example templates in the following directory:

     /usr/share/openstack-tripleo-heat-templates/network/config/bond-with-vlans

2. Create a network environment file by copying the file from /home/stack/network-environment.yaml and editing the content based on your environment.

Procedure

1. If you use a self-signed certificate or if the certificate signer is not in the default trust store on the overcloud image, inject the certificate into the overcloud image by copying the inject-trust-anchor.yaml environment file from the heat template collection:

   $ cp -r /usr/share/openstack-tripleo-heat-templates/environments/inject-trust-anchor.yaml ~/templates/

2. Open the file in a text editor and copy the contents of the root certificate authority file to the SSLRootCertificate parameter:

   parameter_defaults:
     SSLRootCertificate: |
     -----BEGIN CERTIFICATE-----
     MIIDgzCCAmugAwIBAgIJAKk46qw6ncJaMA0GCSqGSIb3DQEBCwUAMFgxCzAJBgNV
     ...
     sFW3S2roS4X0Af/kSSD8mlBBTFTCMBAj6rtLBKLaQbIxEpIzrgvp
     -----END CERTIFICATE-----

   Important

   The certificate authority content requires the same indentation level for all new lines.

3. Change the resource URL for the OS::TripleO::NodeTLSCAData: parameter to an absolute URL:

   resource_registry:
     OS::TripleO::NodeTLSCAData: /usr/share/openstack-tripleo-heat-templates/puppet/extraconfig/tls/ca-inject.yaml

4. Optional: If you use a DNS hostname to access the overcloud through SSL/TLS, create a new environment file ~/templates/cloudname.yaml and define the hostname of the overcloud endpoints in the following parameters:

   parameter_defaults:
     CloudName: overcloud.example.com
     DnsServers: 10.0.0.1

   Replace the following values with actual values in your environment:

   • CloudName: Replace overcloud.example.com with the DNS hostname for the overcloud endpoints.
   • DnsServers: List of the DNS servers that you want to use. The configured DNS servers must contain an entry for the configured CloudName that matches the IP for the Public API.

Procedure

1. Deploy the overcloud with all the environment and configuration files for an external load balancer:

   $ openstack overcloud deploy --templates /
     -e /usr/share/openstack-tripleo-heat-templates/environments/network-isolation.yaml /
     -e ~/network-environment.yaml /
     -e /usr/share/openstack-tripleo-heat-templates/environments/external-loadbalancer-vip.yaml /
     -e ~/external-lb.yaml --control-scale 3 --compute-scale 1 --control-flavor control --compute-flavor compute /
     -e <SSL/TLS endpoint environment file> /
     -e <DNS hostname environment file> /
     -e <root certificate injection environment file> /
     -e <additional_options_if_needed>

   Replace the values in angle brackets <> with the file paths you defined for your environment.

   Important

   You must add the network environment files to the command in the order listed in this example.

   This command includes the following environment files:

   • network-isolation.yaml: Network isolation configuration file.
   • network-environment.yaml: Network configuration file.
   • external-loadbalancer-vip.yaml: External load balancing virtual IP addresses configuration file.

   • external-lb.yaml: External load balancer configuration file. You can also set the following options for this file and adjust the values for your environment:

     • --control-scale 3: Scale the Controller nodes to three.
     • --compute-scale 3: Scale the Compute nodes to three.
     • --control-flavor control: Use a specific flavor for the Controller nodes.
     • --compute-flavor compute: Use a specific flavor for the Compute nodes.

   • SSL/TLS environment files:

     • SSL/TLS endpoint environment file: Environment file that defines how to connect to public endpoinst. Use tls-endpoints-public-dns.yaml or tls-endpoints-public-ip.yaml.
     • (Optional) DNS hostname environment file: The environment file to set the DNS hostname.
     • Root certificate injection environment file: The environment file to inject the root certificate authority.

   During the overcloud deployment process, Red Hat OpenStack Platform director provisions your nodes. This process takes some time to complete.

2. To view the status of the overcloud deployment, enter the following commands:

   $ source ~/stackrc
   $ openstack stack list --nested