Chapter 2. Installing and preparing director Operator

Procedure

1. Create the OSPdO project:

   $ oc new-project openstack

2. Obtain the latest osp-director-operator-bundle image from https://catalog.redhat.com/software/containers/search.
3. Download the Operator Package Manager (opm) tool from https://console.redhat.com/openshift/downloads.

4. Use the opm tool to create an index image:

   $ BUNDLE_IMG="registry.redhat.io/rhosp-rhel9/osp-director-operator-bundle:1.3.1"
   $ INDEX_IMG="quay.io/<account>/osp-director-operator-index:x.y.z-a"
   $ opm index add --bundles ${BUNDLE_IMG} --tag ${INDEX_IMG} -u podman --pull-tool podman

5. Push the index image to your registry:

   $ podman push ${INDEX_IMG}

6. Create an environment file to configure the CatalogSource, OperatorGroup, and Subscription CRs required to install OSPdO, for example, osp-director-operator.yaml.

7. To configure the CatalogSource CR, add the following configuration to osp-director-operator.yaml:

   apiVersion: operators.coreos.com/v1alpha1
   kind: CatalogSource
   metadata:
     name: osp-director-operator-index
     namespace: openstack
   spec:
     sourceType: grpc
     image: quay.io/<account>/osp-director-operator-index:x.y.z-a

   For information about how to apply the Quay authentication so that the Operator deployment can pull the image, see Accessing images for Operators from private registries.

8. To configure the OperatorGroup CR, add the following configuration to osp-director-operator.yaml:

   ---
   apiVersion: operators.coreos.com/v1
   kind: OperatorGroup
   metadata:
     name: "osp-director-operator-group"
     namespace: openstack
   spec:
     targetNamespaces:
     - openstack

9. To configure the Subscription CR, add the following configuration to osp-director-operator.yaml:

   ---
   apiVersion: operators.coreos.com/v1alpha1
   kind: Subscription
   metadata:
     name: osp-director-operator-subscription
     namespace: openstack
   spec:
     config:
       env:
       - name: WATCH_NAMESPACE
         value: openstack,openshift-machine-api,openshift-sriov-network-operator
     source: osp-director-operator-index
     sourceNamespace: openstack
     name: osp-director-operator

10. Create the new CatalogSource, OperatorGroup, and Subscription CRs within the openstack namespace:

    $ oc apply -f osp-director-operator.yaml

11. Confirm that you have installed OSPdO, osp-director-operator.openstack, by listing the installed operators:

    $ oc get operators
    NAME                                     AGE
    osp-director-operator.openstack          5m

Procedure

1. Download a RHEL 9.2 QCOW2 image from the Product Download section of the Red Hat Customer Portal to your workstation.

2. Optional: Add a custom CA certificate:

   $ sudo -s
   $ export LIBGUESTFS_BACKEND=direct
   $ virt-copy-in -a <local_path_to_image> <ca_certificate>.pem /etc/pki/ca-trust/source/anchors/

   You might want to add a custom CA certificate to secure LDAP communication for the Identity service, or to communicate with any non-RHOSP system.

3. Create a script to customize the image to assign predictable network interface names:

   #!/bin/bash
   set -eux
   
   if [ -e /etc/kernel/cmdline ]; then
     echo 'Updating /etc/kernel/cmdline'
     sed -i -e "s/^\(.*\)net\.ifnames=0\s*\(.*\)/\1\2/" /etc/kernel/cmdline
   fi
   
   source /etc/default/grub
   if grep -q "net.ifnames=0" <<< "$GRUB_CMDLINE_LINUX"; then
     echo 'Updating /etc/default/grub'
     sed -i -e "s/^\(GRUB_CMDLINE_LINUX=.*\)net\.ifnames=0\s*\(.*\)/\1\2/" /etc/default/grub
   fi
   if [ "$GRUB_ENABLE_BLSCFG" == "true" ]; then
     echo 'Fixing BLS entries'
     find /boot/loader/entries -type f -exec sed -i -e "s/^\(.*\)net\.ifnames=0\s*\(.*\)/\1\2/" {} \;
   fi
   # Always do this, on RHEL8 with BLS we still need it as the BLS entry uses $kernelopts from grubenv
   echo 'Running grub2-mkconfig'
   grub2-mkconfig -o /etc/grub2.cfg
   grub2-mkconfig -o /etc/grub2-efi.cfg
   rm -f /etc/sysconfig/network-scripts/ifcfg-ens* /etc/sysconfig/network-scripts/ifcfg-eth*
   update-ca-trust extract

4. Run the image customization script:

   $ sudo -s
   $ export LIBGUESTFS_BACKEND=direct
   $ chmod 755 customize_image.sh
   $ virt-customize -a <local_path_to_image> --run customize_image.sh --truncate /etc/machine-id

5. Use virtctl to upload the image to OpenShift Virtualization:

   $ virtctl image-upload dv <datavolume_name> -n openstack \
    --size=<size> --image-path=<local_path_to_image> \
    --storage-class <storage_class> --access-mode <access_mode> --insecure

   • Replace <datavolume_name> with the name of the data volume, for example, openstack-base-img.
   • Replace <size> with the size of the data volume required for your environment, for example, 500Gi. The minimum size is 500GB.

   • Replace <storage_class> with the required storage class from your cluster. Use the following command to retrieve the available storage classes:

     $ oc get storageclass

   • Replace <access_mode> with the access mode for the PVC. The default value is ReadWriteOnce.

Procedure

1. Create the git-secret Secret resource:

   $ oc create secret generic <secret_name> -n <namespace> \
    --from-file=git_ssh_identity=<path_to_private_SSH_key> \
    --from-literal=git_url=<git_server_URL>

   • Replace <secret_name> with the name of the secret, in this case, git-secret.
   • Replace <namespace> with the name of the namespace to create the secret in, for example, openstack.
   • Replace <path_to_private_SSH_key> with the path to the private key to access the Git repository.
   • Replace <git_server_URL> with the SSH URL of the git repository that stores the OSPdO configuration, for example, ssh://<user>@<server>:2202/repo.git.

2. Verify that the Secret resource is created:

   $ oc get secret/git-secret -n openstack

Procedure

1. Convert your chosen password to a base64 value:

   $ echo -n "p@ssw0rd!" | base64
   cEBzc3cwcmQh

   Important

   The -n option removes the trailing newline from the echo output.

2. Create a file named openstack-userpassword.yaml on your workstation. Include the following resource specification for the Secret in the file:

   apiVersion: v1
   kind: Secret
   metadata:
     name: <secret_name>
     namespace: openstack
   data:
     NodeRootPassword: "<password>"

   • Replace <secret_name> with the name of this Secret resource, for example, userpassword.
   • Replace <password> with your base64 encoded password.

3. Create the userpassword Secret:

   $ oc create -f openstack-userpassword.yaml -n openstack