Configuring load balancing as a service

Procedure

1. Generate a Base64, encoded password.

   Retain the encoded output to use in a later step.

   Example

   In this example, the password, my_password is encoded using the Base64 encoding scheme:

   $ echo -n my_password | base64

2. Create a Secret CR file on your workstation, for example, octavia-ca-passphrase.yaml.

3. Add the following configuration to octavia-ca-passphrase.yaml:

   apiVersion: v1
   data:
     server-ca-passphrase: <Base64_password>
   kind: Secret
   metadata:
     name: octavia-ca-passphrase
     namespace: openstack
   type: Opaque

   • Replace the <Base64_password> with the Base64-encoded password that you created earlier.

4. Create the Secret CR in the cluster:

   $ oc create -f octavia-ca-passphrase.yaml

Procedure

1. Using the Skopeo utility, obtain the amphora image version. You will need the image version in a SHA format for a later step:

   $ podman login registry.redhat.io
   
   $ sudo dnf install -y skopeo
   
   $ skopeo inspect docker://registry.redhat.io/rhoso/\
   octavia-amphora-image-rhel9:$(oc get openstackversion \
   -o jsonpath='{.items[0].status.deployedVersion}' | \
   awk -F '-' '{print $1}') --format '{{.Name}}@{{.Digest}}'

2. Open your OpenStackControlPlane CR file, and enable the Load-balancing service (octavia) by adding the following service configuration:

   apiVersion: core.openstack.org/v1beta1
   kind: OpenStackControlPlane
   metadata:
     name: openstack-control-plane
     namespace: openstack
     spec:
   ...
       octavia:
         enabled: true
         template:
           octaviaHousekeeping:
             networkAttachments:
               - octavia
           octaviaHealthManager:
             networkAttachments:
               - octavia
           octaviaWorker:
             networkAttachments:
               - octavia
   ...

3. With the amphora image version that you obtained in an earlier step, use the octavia.template.amphoraImageContainerImage parameter to add the amphora image to the Image service (glance):

   Example

   ...
       octavia:
         enabled: true
         template:
           octaviaHousekeeping:
             networkAttachments:
               - octavia
           octaviaHealthManager:
             networkAttachments:
               - octavia
           octaviaWorker:
             networkAttachments:
               - octavia
           amphoraImageContainerImage: registry.redhat.io/rhoso/\
           octavia-amphora-image-rhel9@sha256:312cd5e8ea9fe261c1929aefececbeb22afe5e433ae76ef0860d98e561db21c9
   ...

4. Optional: to enable flow resumption, perform the following steps.

   For more information, see Avoiding taskflow interruptions by using flow resumption.

   1. Create the octavia-redis database in Redis by adding the schema name, octavia-redis:, and the number of replicas, replicas: 1:

      apiVersion: core.openstack.org/v1beta1
      kind: OpenStackControlPlane
      metadata:
        name: openstack-control-plane
        namespace: openstack
        spec:
      ...
          redis:
            enabled: true
            templates:
              octavia-redis:
                replicas: 1
      ...

   2. Enable the octavia-redis database by adding the line, redisServiceName: octavia-redis:

      apiVersion: core.openstack.org/v1beta1
      kind: OpenStackControlPlane
      metadata:
        name: openstack-control-plane
        namespace: openstack
        spec:
      ...
          octavia:
            enabled: true
            template:
              databaseInstance: <Galera_CR>
              redisServiceName: octavia-redis
              octaviaHousekeeping:
                networkAttachments:
                  - octavia
              octaviaHealthManager:
                networkAttachments:
                  - octavia
              octaviaWorker:
                networkAttachments:
                  - octavia
      ...

5. Locate the service configuration for ovn, and add the following configuration under template:

   ...
     ovn:
       template:
         ovnController:
           networkAttachment: tenant
           nicMappings:
             octavia: octbr

   • networkAttachment - Note the one-character difference between the OVN networkAttachment property and the octavia networkAttachments property. The name tenant is an example value.
   • nicMappings - The value must be octavia: octbr.

6. Update the OpenStackControlPlane custom resource with the required values for the Load-balancing service.

   Example

   $ oc apply -f openstack_control_plane.yaml -n openstack

Verification

1. Wait until RHOCP creates the Load-balancing service resources. Run the following command to check the status:

   $ oc wait octavia octavia --for condition=Ready

   Sample output

   You should see output similar to the following:

   octavia.octavia.openstack.org/octavia condition met

2. Confirm that the Load-balancing service pods are running:

   $ oc get pods | grep octavia

   Sample output

   You should see output similar to the following:

   octavia-api-78b56bb844-ngjhc                  2/2     Running     0          12s
   octavia-healthmanager-f6hpx                   1/1     Running     0          14s
   octavia-housekeeping-knwpf                    1/1     Running     0          10s
   octavia-redis-redis-0                         2/2     Running     0          20s
   octavia-rsyslog-4nkv8                         1/1     Running     0          23s
   octavia-worker-l5hs4                          1/1     Running     0          26s

3. Access the remote shell for the OpenStackClient pod from your workstation:

   $ oc rsh -n openstack openstackclient

4. Confirm that the networks octavia-provider-net and lb-mgmt-net are present:

   $ openstack network list -f yaml

   Sample output

   - ID: 2e4fc309-546b-4ac8-9eae-aa8d70a27a9b
     Name: octavia-provider-net
     Subnets:
     - eea45073-6e56-47fd-9153-12f7f49bc115
   - ID: 77881d3f-04b0-46cb-931f-d54003cce9f0
     Name: lb-mgmt-net
     Subnets:
     - e4ab96af-8077-4971-baa4-e0d40a16f55a

   The network, octavia-provider-net, is the external provider network, and is limited to the RHOSO control plane. The lb-mgmt-net network connects the Load-balancing service to amphora instances.

5. Exit the openstackclient pod:

   $ exit

Procedure

1. Open your OpenStackControlPlane CR file, openstack_control_plane.yaml, on your workstation.

2. Add the following configuration to the octavia service configuration:

     octavia:
       template:
         octaviaHousekeeping:
           customServiceConfig: |
             [amphora_agent]
             tenant_log_targets =
         octaviaHealthManager:
           customServiceConfig: |
             [amphora_agent]
             tenant_log_targets =
         octaviaWorker:
           customServiceConfig: |
             [amphora_agent]
             tenant_log_targets =

3. Update the control plane:

   $ oc apply -f openstack_control_plane.yaml -n openstack

4. Wait until RHOCP creates the resources related to the OpenStackControlPlane CR. Run the following command to check the status:

   $ oc get openstackcontrolplane -n openstack
   NAME 						STATUS 	MESSAGE
   openstack-control-plane 	Unknown 	Setup started

   The OpenStackControlPlane resources are created when the status is "Setup complete".

   Tip

   Append the -w option to the end of the get command to track deployment progress.

5. Confirm that the control plane is deployed by reviewing the pods in the openstack namespace:

   $ oc get pods -n openstack

   The control plane is deployed when all the pods are either completed or running.

Procedure

1. Open your OpenStackControlPlane` custom resource (CR) file, openstack_control_plane.yaml, on your workstation.

2. Add the following configuration to the octavia service configuration:

     octavia:
       template:
         octaviaHousekeeping:
           customServiceConfig: |
             [amphora_agent]
             disable_local_log_storage=true
         octaviaHealthManager:
           customServiceConfig: |
             [amphora_agent]
             disable_local_log_storage=true
         octaviaWorker:
           customServiceConfig: |
              [amphora_agent]
              disable_local_log_storage=true

3. Update the control plane:

   $ oc apply -f openstack_control_plane.yaml -n openstack

4. Wait until RHOCP creates the resources related to the OpenStackControlPlane CR. Run the following command to check the status:

   $ oc get openstackcontrolplane -n openstack
   NAME 						STATUS 	MESSAGE
   openstack-control-plane 	Unknown 	Setup started

   The OpenStackControlPlane resources are created when the status is "Setup complete".

   Tip

   Append the -w option to the end of the get command to track deployment progress.

5. Confirm that the control plane is deployed by reviewing the pods in the openstack namespace:

   $ oc get pods -n openstack

   The control plane is deployed when all the pods are either completed or running.

Procedure

1. Access the remote shell for the OpenStackClient pod from your workstation:

   $ oc rsh -n openstack openstackclient

2. List the capabilities for each driver:

   $ openstack loadbalancer provider capability list <provider>

   Replace <provider> with the name or UUID of the provider.

   Example

   $ openstack loadbalancer provider capability list amphora

   The command output lists all of the capabilities that the provider supports.

   Sample output

   +-----------------------+---------------------------------------------------+
   | name                  | description                                       |
   +-----------------------+---------------------------------------------------+
   | loadbalancer_topology | The load balancer topology. One of: SINGLE - One  |
   |                       | amphora per load balancer. ACTIVE_STANDBY - Two   |
   |                       | amphora per load balancer.                        |
   | ...                   | ...                                               |
   +-----------------------+---------------------------------------------------+

3. Note the names of the capabilities that you want to include in the flavor that you are creating. You will use these capability names later when you create the profile for the flavor.

4. Exit the openstackclient pod:

   $ exit

Procedure

1. Access the remote shell for the OpenStackClient pod from your workstation:

   $ oc rsh -n openstack openstackclient

2. Create a flavor profile:

   $ openstack loadbalancer flavorprofile create --name <profile_name> --provider <provider_name> --flavor-data '{"<capability>": "<value>"}'

   Example

   In this example, a flavor profile is created for the amphora provider. When this profile is specified in a flavor, the load balancer that users create by using the flavor is a single amphora load balancer.

   $ openstack loadbalancer flavorprofile create --name amphora-single-profile \
   --provider amphora --flavor-data '{"loadbalancer_topology": "SINGLE"}'

   Sample output

   +---------------+--------------------------------------+
   | Field         | Value                                |
   +---------------+--------------------------------------+
   | id            | 72b53ac2-b191-48eb-8f73-ed012caca23a |
   | name          | amphora-single-profile               |
   | provider_name | amphora                              |
   | flavor_data   | {"loadbalancer_topology": "SINGLE"}  |
   +---------------+--------------------------------------+

Procedure

1. Access the remote shell for the OpenStackClient pod from your workstation:

   $ oc rsh -n openstack openstackclient

2. Create a flavor:

   $ openstack loadbalancer flavor create --name <flavor_name> \
   --flavorprofile <flavor-profile> --description "<string>"

   Tip

   Provide a detailed description so that users can understand the capabilities of the flavor that you are providing.

   Example

   In this example, a flavor has been defined. When users specify this flavor, they create a load balancer that uses one Load-balancing service instance (amphora) and is not highly available.

   $ openstack loadbalancer flavor create --name standalone-lb --flavorprofile amphora-single-profile --description "A non-high availability load balancer for testing."

   Sample output

   +-------------------+--------------------------------------+
   | Field             | Value                                |
   +-------------------+--------------------------------------+
   | id                | 25cda2d8-f735-4744-b936-d30405c05359 |
   | name              | standalone-lb                        |
   | flavor_profile_id | 72b53ac2-b191-48eb-8f73-ed012caca23a |
   | enabled           | True                                 |
   | description       | A non-high availability load         |
   |                   | balancer for testing.                |
   +-------------------+--------------------------------------+

   Note

   Disabled flavors are still visible to users, but users cannot use the disabled flavor to create a load balancer.

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Create a load balancer using the load-balancing flavor provided.

   EXAMPLE

   In this example, a non-secure HTTP load balancer (lb1) is created on a public subnet (public_subnet), using the flavor (amphora-4vcpus):

   $ openstack loadbalancer create --name lb1 \
   --vip-subnet-id public_subnet \
   --flavor amphora-4vcpus --wait

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Run the openstack loadbalancer healthmonitor create command, using argument values that are appropriate for your site.

   • All health monitor types require the following configurable arguments:

     <pool>

     Name or ID of the pool of back-end member servers to be monitored.

     --type

     The type of health monitor. One of HTTP, HTTPS, PING, SCTP, TCP, TLS-HELLO, or UDP-CONNECT.

     --delay

     Number of seconds to wait between health checks.

     --timeout

     Number of seconds to wait for any given health check to complete. timeout must always be smaller than delay.

     --max-retries

     Number of health checks a back-end server must fail before it is considered down. Also, the number of health checks that a failed back-end server must pass to be considered up again.

   • In addition, HTTP health monitor types also require the following arguments, which are set by default:

     --url-path

     Path part of the URL that should be retrieved from the back-end server. By default this is /.

     --http-method

     HTTP method that is used to retrieve the url_path. By default this is GET.

     --expected-codes

     List of HTTP status codes that indicate an OK health check. By default this is 200.

     Example

     $ openstack loadbalancer healthmonitor create --name my-health-monitor --delay 10 --max-retries 4 --timeout 5 --type TCP lb-pool-1 --wait

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Modify your health monitor (my-health-monitor).

   In this example, a user is changing the time in seconds that the health monitor waits between sending probes to members.

   Example

   $ openstack loadbalancer healthmonitor set my_health_monitor --delay 600

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Delete the health monitor (my-health-monitor).

   Example

   $ openstack loadbalancer healthmonitor delete my-health-monitor

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Create a load balancer (lb1) on a public subnet (public_subnet).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer create --name lb1 \
   --vip-subnet-id public_subnet --wait

3. Create a listener (listener1) on a port (80).

   Example

   $ openstack loadbalancer listener create --name listener1 \
   --protocol HTTP --protocol-port 80 lb1 --wait

4. Verify the state of the listener.

   Example

   $ openstack loadbalancer listener show listener1

   Before going to the next step, ensure that the status is ACTIVE.

5. Create the listener default pool (pool1).

   Example

   $ openstack loadbalancer pool create --name pool1 \
   --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP --wait

6. Create a health monitor (healthmon1) of type (HTTP) on the pool (pool1) that connects to the back-end servers and tests the path (/).

   Health checks can help to avoid a false positive. If no health monitor is defined, the member server is assumed to be ONLINE.

   Example

   $ openstack loadbalancer healthmonitor create --name healthmon1 \
   --delay 15 --max-retries 4 --timeout 10 --type HTTP --url-path / \
   pool1 --wait

7. Add load balancer members (192.0.2.10 and 192.0.2.11) on the private subnet (private_subnet) to the default pool.

   Example

   In this example, the back-end servers, 192.0.2.10 and 192.0.2.11, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --name member1 --subnet-id \
   private_subnet --address 192.0.2.10 --protocol-port 80 pool1 --wait
   
   $ openstack loadbalancer member create --name member2 --subnet-id \
   private_subnet --address 192.0.2.11 --protocol-port 80 pool1 --wait

Verification

1. View and verify the load balancer (lb1) settings:

   Example

   $ openstack loadbalancer show lb1

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | admin_state_up      | True                                 |
   | created_at          | 2024-01-15T11:11:09                  |
   | description         |                                      |
   | flavor              |                                      |
   | id                  | 788fe121-3dec-4e1b-8360-4020642238b0 |
   | listeners           | 09f28053-fde8-4c78-88b9-0f191d84120e |
   | name                | lb1                                  |
   | operating_status    | ONLINE                               |
   | pools               | 627842b3-eed8-4f5f-9f4a-01a738e64d6a |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | provider            | amphora                              |
   | provisioning_status | ACTIVE                               |
   | updated_at          | 2024-01-15T11:12:13                  |
   | vip_address         | 198.51.100.12                        |
   | vip_network_id      | 9bca13be-f18d-49a5-a83d-9d487827fd16 |
   | vip_port_id         | 69a85edd-5b1c-458f-96f2-b4552b15b8e6 |
   | vip_qos_policy_id   | None                                 |
   | vip_subnet_id       | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   +---------------------+--------------------------------------+

2. When a health monitor is present and functioning properly, you can check the status of each member.

   A working member (member1) has an ONLINE value for its operating_status.

   Example

   $ openstack loadbalancer member show pool1 member1

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | address             | 192.0.2.10                           |
   | admin_state_up      | True                                 |
   | created_at          | 2024-01-15T11:16:23                  |
   | id                  | b85c807e-4d7c-4cbd-b725-5e8afddf80d2 |
   | name                | member1                              |
   | operating_status    | ONLINE                               |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | protocol_port       | 80                                   |
   | provisioning_status | ACTIVE                               |
   | subnet_id           | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   | updated_at          | 2024-01-15T11:20:45                  |
   | weight              | 1                                    |
   | monitor_port        | None                                 |
   | monitor_address     | None                                 |
   | backup              | False                                |
   +---------------------+--------------------------------------+

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Create a load balancer (lb1) on a private subnet (private_subnet).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer create --name lb1 \
   --vip-subnet-id private_subnet --wait

3. In the output from the previous step, record the value of load_balancer_vip_port_id, because you must provide it in a later step.

4. Create a listener (listener1) on a port (80).

   Example

   $ openstack loadbalancer listener create --name listener1 \
   --protocol HTTP --protocol-port 80 lb1 --wait

5. Create the listener default pool (pool1).

   Example

   The command in this example creates an HTTP pool that uses a private subnet containing back-end servers that host non-secure HTTP applications on TCP port 80:

   $ openstack loadbalancer pool create --name pool1 \
   --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP --wait

6. Create a health monitor (healthmon1) of type (HTTP) on the pool (pool1) that connects to the back-end servers and tests the path (/).

   Health checks can help to avoid a false positive. If no health monitor is defined, the member server is assumed to be ONLINE.

   Example

   $ openstack loadbalancer healthmonitor create --name healthmon1 \
   --delay 15 --max-retries 4 --timeout 10 --type HTTP --url-path / \
   pool1 --wait

7. Add load balancer members (192.0.2.10 and 192.0.2.11) on the private subnet to the default pool.

   Example

   In this example, the back-end servers, 192.0.2.10 and 192.0.2.11, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --name member1 --subnet-id \
   private_subnet --address 192.0.2.10 --protocol-port 80 pool1 --wait
   
   $ openstack loadbalancer member create --name member2 --subnet-id \
   private_subnet --address 192.0.2.11 --protocol-port 80 pool1 --wait

8. Create a floating IP address on the shared external subnet (public).

   Example

   $ openstack floating ip create public

9. In the output from step 8, record the value of floating_ip_address, because you must provide it in a later step.

10. Associate this floating IP (203.0.113.0) with the load balancer vip_port_id (69a85edd-5b1c-458f-96f2-b4552b15b8e6).

    Example

    $ openstack floating ip set --port 69a85edd-5b1c-458f-96f2-b4552b15b8e6 203.0.113.0

Verification

1. Verify HTTP traffic flows across the load balancer by using the floating IP (203.0.113.0).

   Example

   $ curl -v http://203.0.113.0 --insecure

   Sample output

   * About to connect() to 203.0.113.0 port 80 (#0)
   *   Trying 203.0.113.0...
   * Connected to 203.0.113.0 (203.0.113.0) port 80 (#0)
   > GET / HTTP/1.1
   > User-Agent: curl/7.29.0
   > Host: 203.0.113.0
   > Accept: */*
   >
   < HTTP/1.1 200 OK
   < Content-Length: 30
   <
   * Connection #0 to host 203.0.113.0 left intact

2. When a health monitor is present and functioning properly, you can check the status of each member.

   A working member (member1) has an ONLINE value for its operating_status.

   Example

   $ openstack loadbalancer member show pool1 member1

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | address             | 192.0.02.10                          |
   | admin_state_up      | True                                 |
   | created_at          | 2024-01-15T11:11:23                  |
   | id                  | b85c807e-4d7c-4cbd-b725-5e8afddf80d2 |
   | name                | member1                              |
   | operating_status    | ONLINE                               |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | protocol_port       | 80                                   |
   | provisioning_status | ACTIVE                               |
   | subnet_id           | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   | updated_at          | 2024-01-15T11:28:42                  |
   | weight              | 1                                    |
   | monitor_port        | None                                 |
   | monitor_address     | None                                 |
   | backup              | False                                |
   +---------------------+--------------------------------------+

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Create a load balancer (lb1) on a public subnet (public_subnet).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer create --name lb1 \
   --vip-subnet-id public_subnet --wait

3. Create a listener (listener1) on a port (80).

   Example

   $ openstack loadbalancer listener create --name listener1 \
   --protocol HTTP --protocol-port 80 lb1 --wait

4. Create the listener default pool (pool1) that defines session persistence on a cookie (PHPSESSIONID).

   Example

   The command in this example creates an HTTP pool that uses a private subnet containing back-end servers that host non-secure HTTP applications on TCP port 80:

   $ openstack loadbalancer pool create --name pool1 \
   --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP \
   --session-persistence type=APP_COOKIE,cookie_name=PHPSESSIONID --wait

5. Create a health monitor (healthmon1) of type (HTTP) on the pool (pool1) that connects to the back-end servers and tests the path (/).

   Health checks can help to avoid a false positive. If no health monitor is defined, the member server is assumed to be ONLINE.

   Example

   $ openstack loadbalancer healthmonitor create --name healthmon1 \
   --delay 15 --max-retries 4 --timeout 10 --type HTTP --url-path / \
   pool1 --wait

6. Add load balancer members (192.0.2.10 and 192.0.2.11) on the private subnet (private_subnet) to the default pool.

   Example

   In this example, the back-end servers, 192.0.2.10 and 192.0.2.11, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --name member1 --subnet-id \
   private_subnet --address 192.0.2.10 --protocol-port 80 pool1 --wait
   
   $ openstack loadbalancer member create --name member2 --subnet-id \
   private_subnet --address 192.0.2.11 --protocol-port 80 pool1 --wait

Verification

1. View and verify the load balancer (lb1) settings:

   Example

   $ openstack loadbalancer show lb1

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | admin_state_up      | True                                 |
   | created_at          | 2024-01-15T11:11:58                  |
   | description         |                                      |
   | flavor              |                                      |
   | id                  | 788fe121-3dec-4e1b-8360-4020642238b0 |
   | listeners           | 09f28053-fde8-4c78-88b9-0f191d84120e |
   | name                | lb1                                  |
   | operating_status    | ONLINE                               |
   | pools               | 627842b3-eed8-4f5f-9f4a-01a738e64d6a |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | provider            | amphora                              |
   | provisioning_status | ACTIVE                               |
   | updated_at          | 2024-01-15T11:28:42                  |
   | vip_address         | 198.51.100.22                        |
   | vip_network_id      | 9bca13be-f18d-49a5-a83d-9d487827fd16 |
   | vip_port_id         | 69a85edd-5b1c-458f-96f2-b4552b15b8e6 |
   | vip_qos_policy_id   | None                                 |
   | vip_subnet_id       | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   +---------------------+--------------------------------------+

2. When a health monitor is present and functioning properly, you can check the status of each member.

   A working member (member1) has an ONLINE value for its operating_status.

   Example

   $ openstack loadbalancer member show pool1 member1

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | address             | 192.0.02.10                          |
   | admin_state_up      | True                                 |
   | created_at          | 2024-01-15T11:11:23                  |
   | id                  | b85c807e-4d7c-4cbd-b725-5e8afddf80d2 |
   | name                | member1                              |
   | operating_status    | ONLINE                               |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | protocol_port       | 80                                   |
   | provisioning_status | ACTIVE                               |
   | subnet_id           | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   | updated_at          | 2024-01-15T11:28:42                  |
   | weight              | 1                                    |
   | monitor_port        | None                                 |
   | monitor_address     | None                                 |
   | backup              | False                                |
   +---------------------+--------------------------------------+

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Create a load balancer (lb1) on a public subnet (public_subnet).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer create --name lb1 \
   --vip-subnet-id public_subnet --wait

3. Create a listener (listener1) on a port (443).

   Example

   $ openstack loadbalancer listener create --name listener1 \
   --protocol HTTPS --protocol-port 443 lb1 --wait

4. Create the listener default pool (pool1).

   Example

   The command in this example creates an HTTPS pool that uses a private subnet containing back-end servers that host HTTPS applications configured with a TLS-encrypted web application on TCP port 443:

   $ openstack loadbalancer pool create --name pool1 \
   --lb-algorithm ROUND_ROBIN --listener listener1 \
   --protocol HTTPS --wait

5. Create a health monitor (healthmon1) on the pool (pool1) of type (TLS-HELLO) that connects to the back-end servers and tests the path (/).

   Health checks can help to avoid a false positive. If no health monitor is defined, the member server is assumed to be ONLINE.

   Example

   $ openstack loadbalancer healthmonitor create --name healthmon1 \
   --delay 15 --max-retries 4 --timeout 10 --type TLS-HELLO \
   --url-path / pool1 --wait

6. Add load balancer members (192.0.2.10 and 192.0.2.11) on the private subnet (private_subnet) to the default pool.

   Example

   In this example, the back-end servers, 192.0.2.10 and 192.0.2.11, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --name member1 --subnet-id \
   private_subnet --address 192.0.2.10 --protocol-port 443 pool1 --wait
   
   $ openstack loadbalancer member create --name member2 --subnet-id \
   private_subnet --address 192.0.2.11 --protocol-port 443 pool1 --wait

Verification

1. View and verify the load balancer (lb1) settings.

   Example

   $ openstack loadbalancer show lb1

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | admin_state_up      | True                                 |
   | created_at          | 2024-01-15T11:11:09                  |
   | description         |                                      |
   | flavor              |                                      |
   | id                  | 788fe121-3dec-4e1b-8360-4020642238b0 |
   | listeners           | 09f28053-fde8-4c78-88b9-0f191d84120e |
   | name                | lb1                                  |
   | operating_status    | ONLINE                               |
   | pools               | 627842b3-eed8-4f5f-9f4a-01a738e64d6a |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | provider            | amphora                              |
   | provisioning_status | ACTIVE                               |
   | updated_at          | 2024-01-15T11:12:42                  |
   | vip_address         | 198.51.100.11                        |
   | vip_network_id      | 9bca13be-f18d-49a5-a83d-9d487827fd16 |
   | vip_port_id         | 69a85edd-5b1c-458f-96f2-b4552b15b8e6 |
   | vip_qos_policy_id   | None                                 |
   | vip_subnet_id       | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   +---------------------+--------------------------------------+

2. When a health monitor is present and functioning properly, you can check the status of each member.

   Example

   A working member (member1) has an ONLINE value for its operating_status.

   $ openstack loadbalancer member show pool1 member1

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | address             | 192.0.2.10                           |
   | admin_state_up      | True                                 |
   | created_at          | 2024-01-15T11:11:09                  |
   | id                  | b85c807e-4d7c-4cbd-b725-5e8afddf80d2 |
   | name                | member1                              |
   | operating_status    | ONLINE                               |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | protocol_port       | 443                                  |
   | provisioning_status | ACTIVE                               |
   | subnet_id           | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   | updated_at          | 2024-01-15T11:12:42                  |
   | weight              | 1                                    |
   | monitor_port        | None                                 |
   | monitor_address     | None                                 |
   | backup              | False                                |
   +---------------------+--------------------------------------+

Procedure

1. Combine the key (server.key), certificate (server.crt), and intermediate certificate chain (ca-chain.crt) into a single PKCS12 file (server.p12).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openssl pkcs12 -export -inkey server.key -in server.crt \
   -certfile ca-chain.crt -passout pass: -out server.p12

   Note

   The following procedure does not work if you password protect the PKCS12 file.

2. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

3. Use the Key Manager service to create a secret resource (tls_secret1) for the PKCS12 file.

   Example

   $ openstack secret store --name='tls_secret1' \
   -t 'application/octet-stream' -e 'base64' \
   --payload="$(base64 < server.p12)"

4. Create a load balancer (lb1) on the public subnet (public_subnet).

   Example

   $ openstack loadbalancer create --name lb1 \
   --vip-subnet-id public_subnet --wait

5. Create a TERMINATED_HTTPS listener (listener1), and reference the secret resource as the default TLS container for the listener.

   Example

   $ openstack loadbalancer listener create --protocol-port 443 \
   --protocol TERMINATED_HTTPS \
   --default-tls-container=\
   $(openstack secret list | awk '/ tls_secret1 / {print $2}') lb1 --wait

6. Create a pool (pool1) and make it the default pool for the listener.

   Example

   The command in this example creates an HTTP pool that uses a private subnet containing back-end servers that host non-secure HTTP applications on TCP port 80:

   $ openstack loadbalancer pool create --name pool1 --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP --wait

7. Create a health monitor (healthmon1) of type (HTTP) on the pool (pool1) that connects to the back-end servers and tests the path (/).

   Health checks can help to avoid a false positive. If no health monitor is defined, the member server is assumed to be ONLINE.

   Example

   $ openstack loadbalancer healthmonitor create --name healthmon1 \
   --delay 15 --max-retries 4 --timeout 10 --type HTTP --url-path / \
   pool1 --wait

8. Add the non-secure HTTP back-end servers (192.0.2.10 and 192.0.2.11) on the private subnet (private_subnet) to the pool.

   Example

   In this example, the back-end servers, 192.0.2.10 and 192.0.2.11, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --name member1 --subnet-id \
   private_subnet --address 192.0.2.10 --protocol-port 443 pool1 --wait
   
   $ openstack loadbalancer member create --name member2 --subnet-id \
   private_subnet --address 192.0.2.11 --protocol-port 443 pool1 --wait

Verification

1. View and verify the load balancer (lb1) settings.

   Example

   $ openstack loadbalancer show lb1

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | admin_state_up      | True                                 |
   | created_at          | 2024-01-15T11:11:09                  |
   | description         |                                      |
   | flavor              |                                      |
   | id                  | 788fe121-3dec-4e1b-8360-4020642238b0 |
   | listeners           | 09f28053-fde8-4c78-88b9-0f191d84120e |
   | name                | lb1                                  |
   | operating_status    | ONLINE                               |
   | pools               | 627842b3-eed8-4f5f-9f4a-01a738e64d6a |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | provider            | amphora                              |
   | provisioning_status | ACTIVE                               |
   | updated_at          | 2024-01-15T11:12:42                  |
   | vip_address         | 198.51.100.11                        |
   | vip_network_id      | 9bca13be-f18d-49a5-a83d-9d487827fd16 |
   | vip_port_id         | 69a85edd-5b1c-458f-96f2-b4552b15b8e6 |
   | vip_qos_policy_id   | None                                 |
   | vip_subnet_id       | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   +---------------------+--------------------------------------+

2. When a health monitor is present and functioning properly, you can check the status of each member.

   Example

   $ openstack loadbalancer member show pool1 member1

   A working member (member1) has an ONLINE value for its operating_status:

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | address             | 192.0.2.10                           |
   | admin_state_up      | True                                 |
   | created_at          | 2024-01-15T11:11:09                  |
   | id                  | b85c807e-4d7c-4cbd-b725-5e8afddf80d2 |
   | name                | member1                              |
   | operating_status    | ONLINE                               |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | protocol_port       | 80                                   |
   | provisioning_status | ACTIVE                               |
   | subnet_id           | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   | updated_at          | 2024-01-15T11:12:42                  |
   | weight              | 1                                    |
   | monitor_port        | None                                 |
   | monitor_address     | None                                 |
   | backup              | False                                |
   +---------------------+--------------------------------------+

Procedure

1. For each of the TLS certificates in the SNI list, combine the key (server.key), certificate (server.crt), and intermediate certificate chain (ca-chain.crt) into a single PKCS12 file (server.p12).

   In this example, you create two PKCS12 files (server.p12 and server2.p12) one for each certificate (www.example.com and www2.example.com).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openssl pkcs12 -export -inkey server.key -in server.crt \
   -certfile ca-chain.crt -passout pass: -out server.p12
   
   $ openssl pkcs12 -export -inkey server2.key -in server2.crt \
   -certfile ca-chain2.crt -passout pass: -out server2.p12

2. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

3. Use the Key Manager service to create secret resources (tls_secret1 and tls_secret2) for the PKCS12 file.

   Example

   $ openstack secret store --name='tls_secret1' \
   -t 'application/octet-stream' -e 'base64' \
   --payload="$(base64 < server.p12)"
   
   $ openstack secret store --name='tls_secret2' \
   -t 'application/octet-stream' -e 'base64' \
   --payload="$(base64 < server2.p12)"

4. Create a load balancer (lb1) on the public subnet (public_subnet).

   Example

   $ openstack loadbalancer create --name lb1 \
   --vip-subnet-id public_subnet --wait

5. Create a TERMINATED_HTTPS listener (listener1), and use SNI to reference both the secret resources.

   (Reference tls_secret1 as the default TLS container for the listener.)

   Example

   $ openstack loadbalancer listener create  --name listener1 \
   --protocol-port 443 --protocol TERMINATED_HTTPS \
   --default-tls-container=\
   $(openstack secret list | awk '/ tls_secret1 / {print $2}') \
   --sni-container-refs \
   $(openstack secret list | awk '/ tls_secret1 / {print $2}') \
   $(openstack secret list | awk '/ tls_secret2 / {print $2}') -- lb1 --wait

6. Create a pool (pool1) and make it the default pool for the listener.

   Example

   The command in this example creates an HTTP pool that uses a private subnet containing back-end servers that host non-secure HTTP applications on TCP port 80:

   $ openstack loadbalancer pool create --name pool1 \
   --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP --wait

7. Create a health monitor (healthmon1) of type (HTTP) on the pool (pool1) that connects to the back-end servers and tests the path (/).

   Health checks can help to avoid a false positive. If no health monitor is defined, the member server is assumed to be ONLINE.

   Example

   $ openstack loadbalancer healthmonitor create --name healthmon1 \
   --delay 15 --max-retries 4 --timeout 10 --type HTTP --url-path / \
   pool1 --wait

8. Add the non-secure HTTP back-end servers (192.0.2.10 and 192.0.2.11) on the private subnet (private_subnet) to the pool.

   Example

   In this example, the back-end servers, 192.0.2.10 and 192.0.2.11, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --name member1 --subnet-id \
   private_subnet --address 192.0.2.10 --protocol-port 443 pool1 --wait
   
   $ openstack loadbalancer member create --name member2 --subnet-id \
   private_subnet --address 192.0.2.11 --protocol-port 443 pool1 --wait

Verification

1. View and verify the load balancer (lb1) settings.

   Example

   $ openstack loadbalancer show lb1

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | admin_state_up      | True                                 |
   | created_at          | 2024-01-15T11:11:09                  |
   | description         |                                      |
   | flavor              |                                      |
   | id                  | 788fe121-3dec-4e1b-8360-4020642238b0 |
   | listeners           | 09f28053-fde8-4c78-88b9-0f191d84120e |
   | name                | lb1                                  |
   | operating_status    | ONLINE                               |
   | pools               | 627842b3-eed8-4f5f-9f4a-01a738e64d6a |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | provider            | amphora                              |
   | provisioning_status | ACTIVE                               |
   | updated_at          | 2024-01-15T11:12:42                  |
   | vip_address         | 198.51.100.11                        |
   | vip_network_id      | 9bca13be-f18d-49a5-a83d-9d487827fd16 |
   | vip_port_id         | 69a85edd-5b1c-458f-96f2-b4552b15b8e6 |
   | vip_qos_policy_id   | None                                 |
   | vip_subnet_id       | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   +---------------------+--------------------------------------+

2. When a health monitor is present and functioning properly, you can check the status of each member.

   Example

   $ openstack loadbalancer member show pool1 member1

   Sample output

   A working member (member1) has an ONLINE value for its operating_status:

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | address             | 192.0.2.10                           |
   | admin_state_up      | True                                 |
   | created_at          | 2024-01-15T11:11:09                  |
   | id                  | b85c807e-4d7c-4cbd-b725-5e8afddf80d2 |
   | name                | member1                              |
   | operating_status    | ONLINE                               |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | protocol_port       | 80                                   |
   | provisioning_status | ACTIVE                               |
   | subnet_id           | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   | updated_at          | 2024-01-15T11:12:42                  |
   | weight              | 1                                    |
   | monitor_port        | None                                 |
   | monitor_address     | None                                 |
   | backup              | False                                |
   +---------------------+--------------------------------------+

Procedure

1. Combine the key (server.key), certificate (server.crt), and intermediate certificate chain (ca-chain.crt) into a single PKCS12 file (server.p12).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Important

   When you create the PKCS12 file, do not password protect the file.

   Example

   In this example, the PKCS12 file is created without a password:

   $ openssl pkcs12 -export -inkey server.key -in server.crt \
   -certfile ca-chain.crt -passout pass: -out server.p12

2. Use the Key Manager service to create a secret resource (tls_secret1) for the PKCS12 file.

   Example

   $ openstack secret store --name='tls_secret1' \
   -t 'application/octet-stream' -e 'base64' \
   --payload="$(base64 < server.p12)"

3. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

4. Create a load balancer (lb1) on the public subnet (public_subnet).

   Example

   $ openstack loadbalancer create --name lb1 --vip-subnet-id \
   public_subnet --wait

5. Create a TERMINATED_HTTPS listener (listener1) and do the following:

   • reference the secret resource (tls_secret1) as the default TLS container for the listener.
   • set the ALPN protocol (h2).

   • set the fallback protocol if the client does not support HTTP/2 (http/1.1).

     Example

     $ openstack loadbalancer listener create --name listener1 \
     --protocol-port 443 --protocol TERMINATED_HTTPS --alpn-protocol h2 \
     --alpn-protocol http/1.1 --default-tls-container=\
     $(openstack secret list | awk '/ tls_secret1 / {print $2}') lb1 --wait

6. Create a pool (pool1) and make it the default pool for the listener.

   Example

   The command in this example creates an HTTP pool containing back-end servers that host HTTP applications configured with a web application on TCP port 80:

   $ openstack loadbalancer pool create --name pool1 \
   --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP --wait

7. Create a health monitor (healthmon1) of type (TCP) on the pool (pool1) that connects to the back-end servers.

   Health checks can help to avoid a false positive. If no health monitor is defined, the member server is assumed to be ONLINE.

   Example

   $ openstack loadbalancer healthmonitor create --name healthmon1 \
   --delay 15  --max-retries 4 --timeout 10 --type TCP pool1 --wait

8. Add the HTTP back-end servers (192.0.2.10 and 192.0.2.11) on the private subnet (private_subnet) to the pool.

   Example

   In this example, the back-end servers, 192.0.2.10 and 192.0.2.11, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --name member1 --subnet-id \
   private_subnet --address 192.0.2.10 --protocol-port 80 pool1 --wait
   
   $ openstack loadbalancer member create --name member2 --subnet-id \
   private_subnet --address 192.0.2.11 --protocol-port 80 pool1 --wait

Verification

1. View and verify the load balancer (lb1) settings.

   Example

   $ openstack loadbalancer status show lb1

   Sample output

   {
       "loadbalancer": {
           "id": "936dad29-4c3f-4f24-84a8-c0e6f10ed810",
           "name": "lb1",
           "operating_status": "ONLINE",
           "provisioning_status": "ACTIVE",
           "listeners": [
               {
                   "id": "708b82c6-8a6b-4ec1-ae53-e619769821d4",
                   "name": "listener1",
                   "operating_status": "ONLINE",
                   "provisioning_status": "ACTIVE",
                   "pools": [
                       {
                           "id": "5ad7c678-23af-4422-8edb-ac3880bd888b",
                           "name": "pool1",
                           "provisioning_status": "ACTIVE",
                           "operating_status": "ONLINE",
                           "health_monitor": {
                               "id": "4ad786ef-6661-4e31-a325-eca07b2b3dd1",
                               "name": "healthmon1",
                               "type": "TCP",
                               "provisioning_status": "ACTIVE",
                               "operating_status": "ONLINE"
                           },
                           "members": [
                               {
                                   "id": "facca0d3-61a7-4b46-85e8-da6994883647",
                                   "name": "member1",
                                   "operating_status": "ONLINE",
                                   "provisioning_status": "ACTIVE",
                                   "address": "192.0.2.10",
                                   "protocol_port": 80
                               },
                               {
                                   "id": "2b0d9e0b-8e0c-48b8-aa57-90b2fde2eae2",
                                   "name": "member2",
                                   "operating_status": "ONLINE",
                                   "provisioning_status": "ACTIVE",
                                   "address": "192.0.2.11",
                                   "protocol_port": 80
                               }
   ...

2. When a health monitor is present and functioning properly, you can check the status of each member.

   Example

   $ openstack loadbalancer member show pool1 member1

   Sample output

   A working member (member1) has an ONLINE value for its operating_status:

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | address             | 192.0.2.10                           |
   | admin_state_up      | True                                 |
   | created_at          | 2024-08-16T20:08:01                  |
   | id                  | facca0d3-61a7-4b46-85e8-da6994883647 |
   | name                | member1                              |
   | operating_status    | ONLINE                               |
   | project_id          | 9b29c91f67314bd09eda9018616851cf     |
   | protocol_port       | 80                                   |
   | provisioning_status | ACTIVE                               |
   | subnet_id           | 3b459c95-64d2-4cfa-b348-01aacc4b3fa9 |
   | updated_at          | 2024-08-16T20:25:42                  |
   | weight              | 1                                    |
   | monitor_port        | None                                 |
   | monitor_address     | None                                 |
   | backup              | False                                |
   | tags                |                                      |
   +---------------------+--------------------------------------+

Procedure

1. Combine the key (server.key), certificate (server.crt), and intermediate certificate chain (ca-chain.crt) into a single PKCS12 file (server.p12).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openssl pkcs12 -export -inkey server.key -in server.crt \
   -certfile ca-chain.crt -passout pass: -out server.p12

2. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

3. Use the Key Manager service to create a secret resource (tls_secret1) for the PKCS12 file.

   Example

   $ openstack secret store --name='tls_secret1' \
   -t 'application/octet-stream' -e 'base64' \
   --payload="$(base64 < server.p12)"

4. Create a load balancer (lb1) on the public subnet (public_subnet).

   Example

   $ openstack loadbalancer create --name lb1 \
   --vip-subnet-id external_subnet --wait

5. Create a TERMINATED_HTTPS listener (listener1), and reference the secret resource as the default TLS container for the listener.

   Example

   $ openstack loadbalancer listener create --name listener1 \
   --protocol-port 443 --protocol TERMINATED_HTTPS \
   --default-tls-container=\
   $(openstack secret list | awk '/ tls_secret1 / {print $2}') lb1 --wait

6. Create a pool (pool1) and make it the default pool for the listener.

   Example

   The command in this example creates an HTTP pool that uses a private subnet containing back-end servers that host non-secure HTTP applications on TCP port 80:

   $ openstack loadbalancer pool create --name pool1 \
   --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP --wait

7. Create a health monitor (healthmon1) of type (HTTP) on the pool (pool1) that connects to the back-end servers and tests the path (/).

   Health checks can help to avoid a false positive. If no health monitor is defined, the member server is assumed to be ONLINE.

   Example

   $ openstack loadbalancer healthmonitor create --name healthmon1 \
   --delay 15 --max-retries 4 --timeout 10 --type HTTP --url-path / \
   pool1 --wait

8. Add the non-secure HTTP back-end servers (192.0.2.10 and 192.0.2.11) on the private subnet (private_subnet) to the pool.

   Example

   In this example, the back-end servers, 192.0.2.10 and 192.0.2.11, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --name member1 --subnet-id \
   private_subnet --address 192.0.2.10 --protocol-port 443 pool1 --wait
   
   $ openstack loadbalancer member create --name member2 --subnet-id \
   private_subnet --address 192.0.2.11 --protocol-port 443 pool1 --wait

9. Create a non-secure, HTTP listener (listener2), and make its default pool, the same as the secure listener.

   Example

   $ openstack loadbalancer listener create --name listener2 \
   --protocol-port 80 --protocol HTTP --default-pool pool1 lb1 --wait

Verification

1. View and verify the load balancer (lb1) settings.

   Example

   $ openstack loadbalancer show lb1

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | admin_state_up      | True                                 |
   | created_at          | 2024-01-15T11:11:09                  |
   | description         |                                      |
   | flavor              |                                      |
   | id                  | 788fe121-3dec-4e1b-8360-4020642238b0 |
   | listeners           | 09f28053-fde8-4c78-88b9-0f191d84120e |
   | name                | lb1                                  |
   | operating_status    | ONLINE                               |
   | pools               | 627842b3-eed8-4f5f-9f4a-01a738e64d6a |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | provider            | amphora                              |
   | provisioning_status | ACTIVE                               |
   | updated_at          | 2024-01-15T11:12:42                  |
   | vip_address         | 198.51.100.11                        |
   | vip_network_id      | 9bca13be-f18d-49a5-a83d-9d487827fd16 |
   | vip_port_id         | 69a85edd-5b1c-458f-96f2-b4552b15b8e6 |
   | vip_qos_policy_id   | None                                 |
   | vip_subnet_id       | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   +---------------------+--------------------------------------+

2. When a health monitor is present and functioning properly, you can check the status of each member.

   Example

   $ openstack loadbalancer member show pool1 member1

   Sample output

   A working member (member1) has an ONLINE value for its operating_status:

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | address             | 192.0.2.10                           |
   | admin_state_up      | True                                 |
   | created_at          | 2024-01-15T11:11:09                  |
   | id                  | b85c807e-4d7c-4cbd-b725-5e8afddf80d2 |
   | name                | member1                              |
   | operating_status    | ONLINE                               |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | protocol_port       | 80                                   |
   | provisioning_status | ACTIVE                               |
   | subnet_id           | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   | updated_at          | 2024-01-15T11:12:42                  |
   | weight              | 1                                    |
   | monitor_port        | None                                 |
   | monitor_address     | None                                 |
   | backup              | False                                |
   +---------------------+--------------------------------------+

Procedure

1. Combine the key (server.key), certificate (server.crt), and intermediate certificate chain (ca-chain.crt) into a single PKCS12 file (server.p12).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openssl pkcs12 -export -inkey server.key -in server.crt \
   -certfile ca-chain.crt -passout pass: -out server.p12

2. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

3. Use the Key Manager service to create a secret resource (tls_secret1) for the PKCS12 file.

   Example

   $ openstack secret store --name='tls_secret1' \
   -t 'application/octet-stream' -e 'base64' \
   --payload="$(base64 < server.p12)"

1. Use the Key Manager service to create a secret resource (client_ca_cert) for the client CA certificate.

   Example

   $ openstack secret store --name='client_ca_cert' \
   -t 'application/octet-stream' -e 'base64' \
   --payload="$(base64 < client_ca.pem)"

1. (Optional) use the Key Manager service to create a secret resource (client_ca_crl) for the CRL file.

   Example

   $ openstack secret store --name='client_ca_crl' \
   -t 'application/octet-stream' -e 'base64' \
   --payload="$(base64 < client_ca.crl)"

2. Create a load balancer (lb1) on the public subnet (public_subnet).

   Example

   $ openstack loadbalancer create --name lb1 \
   --vip-subnet-id external_subnet --wait

3. Create a TERMINATED_HTTPS listener (listener1) and do the following:

   • reference the secret resource (tls_secret1) as the default TLS container for the listener.
   • enable client authentication.
   • reference the secret resource (client_ca_cert) as the default TLS container for the client CA certificate.

   • reference the secret resource (client_ca_crl) as the default TLS container for the client CRL file.

     Example

     $ openstack loadbalancer listener create --name listener1\
     --protocol-port 443 --protocol TERMINATED_HTTPS \
     --default-tls-container=\
     $(openstack secret list | awk '/ tls_secret1 / {print $2}') \
     --client-authentication=MANDATORY \
     --client-ca-tls-container-ref=\
     $(openstack secret list | awk '/ client_ca_cert / {print $2}') \
     --client-crl-container=\
     $(openstack secret list | awk '/ client_ca_crl / {print $2}') \
     --wait lb1

4. Create a pool (pool1) and configure it as the default pool for the listener.

   Example

   The command in this example creates an HTTP pool that uses a private subnet containing back-end servers that host non-secure HTTP applications on TCP port 80:

   $ openstack loadbalancer pool create --name pool1 \
   --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP --wait

5. Create a health monitor (healthmon1) of type (HTTP) on the pool (pool1) that connects to the back-end servers and tests the path (/).

   Health checks can help to avoid a false positive. If no health monitor is defined, the member server is assumed to be ONLINE.

   Example

   $ openstack loadbalancer healthmonitor create --name healthmon1 \
   --delay 15 --max-retries 4 --timeout 10 --type HTTP --url-path / \
   --wait pool1

6. Add the non-secure HTTP back-end servers (192.0.2.10 and 192.0.2.11) on the private subnet (private_subnet) to the pool.

   Example

   In this example, the back-end servers, 192.0.2.10 and 192.0.2.11, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --name member1 --subnet-id \
   private_subnet --address 192.0.2.10 --protocol-port 443 --wait pool1 \
   --wait
   
   $ openstack loadbalancer member create --name member2 --subnet-id \
   private_subnet --address 192.0.2.11 --protocol-port 443 --wait pool1 \
   --wait

7. Create a non-secure, HTTP listener (listener2), and make its default pool, the same as the secure listener.

   Example

   $ openstack loadbalancer listener create --name listener2 \
   --protocol-port 80 --protocol HTTP --default-pool pool1 lb1 --wait

Verification

1. View and verify the load balancer listener (lb1) settings.

   Example

   $ openstack loadbalancer listener show listener2

   Sample output

   The client_authentication value should read MANDATORY.

   ---------------------------------------------------------------------------+
   | Field                       | Value                                        |
   ---------------------------------------------------------------------------+
   | admin_state_up              | True                                         |
   | connection_limit            | -1                                           |
   | created_at                  | 2025-06-18T14:35:45                          |
   | default_pool_id             | f43b4259-3ca2-4393-bc7f-12143f6ec015         |
   | default_tls_container_ref   | https://barbican.openstack.svc:9311/v1/secre |
   |                             | ts/eb16233e-0cb1-4750-85af-d01931b409ca      |
   | description                 |                                              |
   | id                          | 5ab57588-6c9c-49f1-a562-6596eded84ff         |
   | insert_headers              | None                                         |
   | l7policies                  |                                              |
   | loadbalancers               | 5cb69415-281a-486e-96d4-b10c67291997         |
   | name                        | listener2                                    |
   | operating_status            | ONLINE                                       |
   | project_id                  | 4676472cb1344f449b367b6ac473bf93             |
   | protocol                    | TERMINATED_HTTPS                             |
   | protocol_port               | 443                                          |
   | provisioning_status         | ACTIVE                                       |
   | sni_container_refs          | []                                           |
   | timeout_client_data         | 50000                                        |
   | timeout_member_connect      | 5000                                         |
   | timeout_member_data         | 50000                                        |
   | timeout_tcp_inspect         | 0                                            |
   | updated_at                  | 2025-06-18T14:41:20                          |
   | client_ca_tls_container_ref | https://barbican.openstack.svc:9311/v1/secre |
   |                             | ts/81086194-3e51-474f-a6f6-fa9afd850939      |
   | client_authentication       | MANDATORY                                    |
   | client_crl_container_ref    | https://barbican.openstack.svc:9311/v1/secre |
   |                             | ts/8e3f75e1-611d-4fa2-b7e6-83a195270a91      |
   | allowed_cidrs               | None                                         |
   | tls_ciphers                 | TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305 |
   |                             | _SHA256:TLS_AES_128_GCM_SHA256:DHE-RSA-      |
   |                             | AES256-GCM-SHA384:DHE-RSA-AES128-GCM-        |
   |                             | SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-    |
   |                             | RSA-AES128-GCM-SHA256:DHE-RSA-               |
   |                             | AES256-SHA256:DHE-RSA-AES128-SHA256:ECDHE-   |
   |                             | RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256    |
   | tls_versions                | [TLSv1.2, TLSv1.3]                       |
   | alpn_protocols              | [h2, http/1.1, http/1.0]               |
   | tags                        |                                              |
   ---------------------------------------------------------------------------+

2. When a health monitor is present and functioning properly, you can check the status of each member.

   Example

   $ openstack loadbalancer member show pool1 member1

   Sample output

   A working member (member1) has an ONLINE value for its operating_status:

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | address             | 192.0.2.10                           |
   | admin_state_up      | True                                 |
   | created_at          | 2025-06-18T14:36:28                  |
   | id                  | 9da5aac4-b8c2-f113-6cef-a7f14327cb4a |
   | name                | member1                              |
   | operating_status    | ONLINE                               |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | protocol_port       | 80                                   |
   | provisioning_status | ACTIVE                               |
   | subnet_id           | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   | updated_at          | 2025-06-18T14:36:49                  |
   | weight              | 1                                    |
   | monitor_port        | None                                 |
   | monitor_address     | None                                 |
   | backup              | False                                |
   +---------------------+--------------------------------------+

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Create a load balancer (lb1) on the public subnet (public_subnet).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer create --name lb1 \
   --vip-subnet-id public_subnet --wait

3. Create a TCP listener (listener1) on the specified port (23456) for which the custom application is configured.

   Example

   $ openstack loadbalancer listener create --name listener1 \
   --protocol TCP --protocol-port 23456 lb1 --wait

4. Create a pool (pool1) and make it the default pool for the listener.

   Example

   In this example, a pool is created that uses a private subnet containing back-end servers that host a custom application on a specific TCP port:

   $ openstack loadbalancer pool create --name pool1 \
   --lb-algorithm ROUND_ROBIN --listener listener1 \
   --protocol TCP --wait

5. Create a health monitor (healthmon1) on the pool (pool1) that connects to the back-end servers and probes the TCP service port.

   Example

   Health checks can help to avoid a false positive. If no health monitor is defined, the member server is assumed to be ONLINE.

   $ openstack loadbalancer healthmonitor create --name healthmon1 \
   --delay 15 --max-retries 4 --timeout 10 --type TCP pool1 --wait

6. Add the back-end servers (192.0.2.10 and 192.0.2.11) on the private subnet (private_subnet) to the pool.

   Example

   In this example, the back-end servers, 192.0.2.10 and 192.0.2.11, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --name member1 --subnet-id \
   private_subnet --address 192.0.2.10 --protocol-port 443 pool1 --wait
   
   $ openstack loadbalancer member create --name member2 --subnet-id \
   private_subnet --address 192.0.2.11 --protocol-port 443 pool1 --wait

Verification

1. View and verify the load balancer (lb1) settings.

   Example

   $ openstack loadbalancer show lb1

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | admin_state_up      | True                                 |
   | created_at          | 2024-01-15T11:11:09                  |
   | description         |                                      |
   | flavor              |                                      |
   | id                  | 788fe121-3dec-4e1b-8360-4020642238b0 |
   | listeners           | 09f28053-fde8-4c78-88b9-0f191d84120e |
   | name                | lb1                                  |
   | operating_status    | ONLINE                               |
   | pools               | 627842b3-eed8-4f5f-9f4a-01a738e64d6a |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | provider            | amphora                              |
   | provisioning_status | ACTIVE                               |
   | updated_at          | 2024-01-15T11:12:42                  |
   | vip_address         | 198.51.100.11                        |
   | vip_network_id      | 9bca13be-f18d-49a5-a83d-9d487827fd16 |
   | vip_port_id         | 69a85edd-5b1c-458f-96f2-b4552b15b8e6 |
   | vip_qos_policy_id   | None                                 |
   | vip_subnet_id       | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   +---------------------+--------------------------------------+

2. When a health monitor is present and functioning properly, you can check the status of each member. Use the following command to obtain a member ID:

   Example

   $ openstack loadbalancer member list pool1

   A working member (member1) has an ONLINE value for its operating_status.

   Example

   $ openstack loadbalancer member show pool1 member1

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | address             | 192.0.2.10                           |
   | admin_state_up      | True                                 |
   | created_at          | 2024-01-15T11:11:09                  |
   | id                  | b85c807e-4d7c-4cbd-b725-5e8afddf80d2 |
   | name                | member1                              |
   | operating_status    | ONLINE                               |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | protocol_port       | 80                                   |
   | provisioning_status | ACTIVE                               |
   | subnet_id           | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   | updated_at          | 2024-01-15T11:12:42                  |
   | weight              | 1                                    |
   | monitor_port        | None                                 |
   | monitor_address     | None                                 |
   | backup              | False                                |
   +---------------------+--------------------------------------+

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Create a load balancer (lb1) on a private subnet (private_subnet).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer create --name lb1 \
   --vip-subnet-id private_subnet --wait

3. Create a listener (listener1) on a port (1234).

   Example

   $ openstack loadbalancer listener create --name listener1 \
   --protocol UDP --protocol-port 1234 lb1 --wait

4. Create the listener default pool (pool1).

   Example

   The command in this example creates a pool that uses a private subnet containing back-end servers that host one or more applications configured to use UDP ports:

   $ openstack loadbalancer pool create --name pool1 \
   --lb-algorithm ROUND_ROBIN --listener listener1 --protocol UDP --wait

5. Create a health monitor (healthmon1) on the pool (pool1) that connects to the back-end servers by using UDP (UDP-CONNECT).

   Health checks can help to avoid a false positive. If no health monitor is defined, the member server is assumed to be ONLINE.

   Example

   $ openstack loadbalancer healthmonitor create --name healthmon1 \
   --delay 5 --max-retries 2 --timeout 3 --type UDP-CONNECT pool1 --wait

6. Add the back-end servers (192.0.2.10 and 192.0.2.11) on the private subnet (private_subnet) to the default pool.

   Example

   In this example, the back-end servers, 192.0.2.10 and 192.0.2.11, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --name member1 --subnet-id \
   private_subnet --address 192.0.2.10 --protocol-port 1234 pool1 --wait
   
   $ openstack loadbalancer member create --name member2 --subnet-id \
   private_subnet --address 192.0.2.11 --protocol-port 1234 pool1 --wait

Verification

1. View and verify the load balancer (lb1) settings.

   Example

   $ openstack loadbalancer show lb1

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | admin_state_up      | True                                 |
   | created_at          | 2024-01-15T11:11:09                  |
   | description         |                                      |
   | flavor              |                                      |
   | id                  | 788fe121-3dec-4e1b-8360-4020642238b0 |
   | listeners           | 09f28053-fde8-4c78-88b9-0f191d84120e |
   | name                | lb1                                  |
   | operating_status    | ONLINE                               |
   | pools               | 627842b3-eed8-4f5f-9f4a-01a738e64d6a |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | provider            | amphora                              |
   | provisioning_status | ACTIVE                               |
   | updated_at          | 2024-01-15T11:12:42                  |
   | vip_address         | 198.51.100.11                        |
   | vip_network_id      | 9bca13be-f18d-49a5-a83d-9d487827fd16 |
   | vip_port_id         | 69a85edd-5b1c-458f-96f2-b4552b15b8e6 |
   | vip_qos_policy_id   | None                                 |
   | vip_subnet_id       | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   +---------------------+--------------------------------------+

2. When a health monitor is present and functioning properly, you can check the status of each member.

   Example

   $ openstack loadbalancer member show pool1 member1

   A working member (member1) has an ONLINE value for its operating_status.

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | address             | 192.0.2.10                           |
   | admin_state_up      | True                                 |
   | created_at          | 2024-01-15T11:11:09                  |
   | id                  | b85c807e-4d7c-4cbd-b725-5e8afddf80d2 |
   | name                | member1                              |
   | operating_status    | ONLINE                               |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | protocol_port       | 1234                                 |
   | provisioning_status | ACTIVE                               |
   | subnet_id           | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   | updated_at          | 2024-01-15T11:12:42                  |
   | weight              | 1                                    |
   | monitor_port        | None                                 |
   | monitor_address     | None                                 |
   | backup              | False                                |
   +---------------------+--------------------------------------+

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Create a network bandwidth QoS policy (qos_policy_bandwidth) with a maximum 1024 kbps and a maximum burst rate of 1024 kb.

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack network qos policy create qos_policy_bandwidth
   
   $ openstack network qos rule create --type bandwidth-limit --max-kbps 1024 --max-burst-kbits 1024 qos-policy-bandwidth

3. Create a load balancer (lb1) on the public subnet (public_subnet) by using a QoS policy (qos-policy-bandwidth).

   Example

   $ openstack loadbalancer create --name lb1 \
   --vip-subnet-id public_subnet \
   --vip-qos-policy-id qos-policy-bandwidth --wait

4. Create a listener (listener1) on a port (80).

   Example

   $ openstack loadbalancer listener create --name listener1 \
   --protocol HTTP --protocol-port 80 lb1 --wait

5. Create the listener default pool (pool1).

   Example

   The command in this example creates an HTTP pool that uses a private subnet containing back-end servers that host an HTTP application on TCP port 80:

   $ openstack loadbalancer pool create --name pool1 --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP --wait

6. Create a health monitor (healthmon1) on the pool that connects to the back-end servers and tests the path (/).

   Health checks can help to avoid a false positive. If no health monitor is defined, the member server is assumed to be ONLINE.

   Example

   $ openstack loadbalancer healthmonitor create --name healthmon1 \
   --delay 15 --max-retries 4 --timeout 10 --type HTTP --url-path / \
   pool1 --wait

7. Add load balancer members (192.0.2.10 and 192.0.2.11) on the private subnet (private_subnet) to the default pool.

   Example

   In this example, the back-end servers, 192.0.2.10 and 192.0.2.11, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --name member1 --subnet-id \
   private_subnet --address 192.0.2.10 --protocol-port 443 pool1 --wait
   
   $ openstack loadbalancer member create --name member2 --subnet-id \
   private_subnet --address 192.0.2.11 --protocol-port 443 pool1 --wait

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Create a load balancer (lb1) on the public subnet (public_subnet).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer create --name lb1 --vip-subnet-id public_subnet --wait

3. Create a listener (listener1) with the allowed CIDRs (192.0.2.0/24 and 198.51.100.0/24).

   Example

   $ openstack loadbalancer listener create --name listener1 --protocol TCP --protocol-port 80 --allowed-cidr 192.0.2.0/24 --allowed-cidr 198.51.100.0/24 lb1 --wait

4. Create the listener default pool (pool1).

   Example

   In this example, a pool is created that uses a private subnet containing back-end servers that are configured with a custom application on TCP port 80:

   $ openstack loadbalancer pool create --name pool1 --lb-algorithm ROUND_ROBIN --listener listener1 --protocol TCP --wait

5. Create a health monitor on the pool that connects to the back-end servers and tests the path (/).

   Health checks can help to avoid a false positive. If no health monitor is defined, the member server is assumed to be ONLINE.

   Example

   $ openstack loadbalancer healthmonitor create --name healthmon1 \
   --delay 15 --max-retries 4 --timeout 10 --type HTTP --url-path / \
   pool1 --wait

6. Add load balancer members (192.0.2.10 and 192.0.2.11) on the private subnet (private_subnet) to the default pool.

   Example

   In this example, the back-end servers, 192.0.2.10 and 192.0.2.11, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --subnet-id private_subnet --address 192.0.2.10 --protocol-port 80 pool1 --wait
   
   $ openstack loadbalancer member create --subnet-id private_subnet --address 192.0.2.11 --protocol-port 80 pool1 --wait

Verification

1. View and verify the listener (listener1) settings.

   Example

   $ openstack loadbalancer listener show listener1

   Sample output

   +-----------------------------+--------------------------------------+
   | Field                       | Value                                |
   +-----------------------------+--------------------------------------+
   | admin_state_up              | True                                 |
   | connection_limit            | -1                                   |
   | created_at                  | 2024-01-15T11:11:09                  |
   | default_pool_id             | None                                 |
   | default_tls_container_ref   | None                                 |
   | description                 |                                      |
   | id                          | d26ba156-03c3-4051-86e8-f8997a202d8e |
   | insert_headers              | None                                 |
   | l7policies                  |                                      |
   | loadbalancers               | 2281487a-54b9-4c2a-8d95-37262ec679d6 |
   | name                        | listener1                            |
   | operating_status            | ONLINE                               |
   | project_id                  | 308ca9f600064f2a8b3be2d57227ef8f     |
   | protocol                    | TCP                                  |
   | protocol_port               | 80                                   |
   | provisioning_status         | ACTIVE                               |
   | sni_container_refs          | []                                   |
   | timeout_client_data         | 50000                                |
   | timeout_member_connect      | 5000                                 |
   | timeout_member_data         | 50000                                |
   | timeout_tcp_inspect         | 0                                    |
   | updated_at                  | 2024-01-15T11:12:42                  |
   | client_ca_tls_container_ref | None                                 |
   | client_authentication       | NONE                                 |
   | client_crl_container_ref    | None                                 |
   | allowed_cidrs               | 192.0.2.0/24                         |
   |                             | 198.51.100.0/24                      |
   +-----------------------------+--------------------------------------+

   In this example the parameter, allowed_cidrs, is set to allow traffic only from 192.0.2.0/24 and 198.51.100.0/24.

2. To verify that the load balancer is secure, ensure that a request to the listener from a client whose CIDR is not in the allowed_cidrs list; the request does not succeed.

   Sample output

   curl: (7) Failed to connect to 203.0.113.226 port 80: Connection timed out
   curl: (7) Failed to connect to 203.0.113.226 port 80: Connection timed out
   curl: (7) Failed to connect to 203.0.113.226 port 80: Connection timed out
   curl: (7) Failed to connect to 203.0.113.226 port 80: Connection timed out

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Create a load balancer (lb1) on the private subnet (private_subnet) using the --provider ovn argument.

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer create --name lb1 --provider ovn \
   --vip-subnet-id private_subnet --wait

3. Create a listener (listener1) that uses the protocol (tcp) on the specified port (80) for which the custom application is configured.

   Note

   The OVN provider only supports Layer 4 TCP and UDP network traffic.

   Example

   $ openstack loadbalancer listener create --name listener1 \
   --protocol tcp --protocol-port 80 lb1 --wait

4. Create the listener default pool (pool1).

   Note

   The only supported load-balancing algorithm for OVN is SOURCE_IP_PORT.

   Example

   The command in this example creates an HTTP pool that uses a private subnet containing back-end servers that host a custom application on a specific TCP port:

   $ openstack loadbalancer pool create --name pool1 --lb-algorithm \
   SOURCE_IP_PORT --listener listener1 --protocol tcp --wait

   Important

   OVN does not support the health monitor feature for load-balancing.

5. Add the back-end servers (192.0.2.10 and 192.0.2.11) on the private subnet (private_subnet) to the pool.

   Example

   In this example, the back-end servers, 192.0.2.10 and 192.0.2.11, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --name member1 --subnet-id \
   private_subnet --address 192.0.2.10 --protocol-port 80 pool1 --wait
   
   $ openstack loadbalancer member create --name member2 --subnet-id \
   private_subnet --address 192.0.2.11 --protocol-port 80 pool1 --wait

Verification

1. View and verify the load balancer (lb1) settings.

   Example

   $ openstack loadbalancer show lb1

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | admin_state_up      | True                                 |
   | created_at          | 2024-01-15T11:11:09                  |
   | description         |                                      |
   | flavor              |                                      |
   | id                  | 788fe121-3dec-4e1b-8360-4020642238b0 |
   | listeners           | 09f28053-fde8-4c78-88b9-0f191d84120e |
   | name                | lb1                                  |
   | operating_status    | ONLINE                               |
   | pools               | 627842b3-eed8-4f5f-9f4a-01a738e64d6a |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | provider            | ovn                                  |
   | provisioning_status | ACTIVE                               |
   | updated_at          | 2024-01-15T11:12:42                  |
   | vip_address         | 198.51.100.11                        |
   | vip_network_id      | 9bca13be-f18d-49a5-a83d-9d487827fd16 |
   | vip_port_id         | 69a85edd-5b1c-458f-96f2-b4552b15b8e6 |
   | vip_qos_policy_id   | None                                 |
   | vip_subnet_id       | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   +---------------------+--------------------------------------+

2. Run the openstack loadbalancer listener show command to view the listener details.

   Example

   $ openstack loadbalancer listener show listener1 --wait

   Sample output

   +-----------------------------+--------------------------------------+
   | Field                       | Value                                |
   +-----------------------------+--------------------------------------+
   | admin_state_up              | True                                 |
   | connection_limit            | -1                                   |
   | created_at                  | 2024-01-15T11:13:52                  |
   | default_pool_id             | a5034e7a-7ddf-416f-9c42-866863def1f2 |
   | default_tls_container_ref   | None                                 |
   | description                 |                                      |
   | id                          | a101caba-5573-4153-ade9-4ea63153b164 |
   | insert_headers              | None                                 |
   | l7policies                  |                                      |
   | loadbalancers               | 653b8d79-e8a4-4ddc-81b4-e3e6b42a2fe3 |
   | name                        | listener1                            |
   | operating_status            | ONLINE                               |
   | project_id                  | 7982a874623944d2a1b54fac9fe46f0b     |
   | protocol                    | TCP                                  |
   | protocol_port               | 64015                                |
   | provisioning_status         | ACTIVE                               |
   | sni_container_refs          | []                                   |
   | timeout_client_data         | 50000                                |
   | timeout_member_connect      | 5000                                 |
   | timeout_member_data         | 50000                                |
   | timeout_tcp_inspect         | 0                                    |
   | updated_at                  | 2024-01-15T11:15:17                  |
   | client_ca_tls_container_ref | None                                 |
   | client_authentication       | NONE                                 |
   | client_crl_container_ref    | None                                 |
   | allowed_cidrs               | None                                 |
   +-----------------------------+--------------------------------------+

3. Run the openstack loadbalancer pool show command to view the pool (pool1) and load-balancer members.

   Example

   $ openstack loadbalancer pool show pool1

   Sample output

   +----------------------+--------------------------------------+
   | Field                | Value                                |
   +----------------------+--------------------------------------+
   | admin_state_up       | True                                 |
   | created_at           | 2024-01-15T11:17:34                  |
   | description          |                                      |
   | healthmonitor_id     |                                      |
   | id                   | a5034e7a-7ddf-416f-9c42-866863def1f2 |
   | lb_algorithm         | SOURCE_IP_PORT                       |
   | listeners            | a101caba-5573-4153-ade9-4ea63153b164 |
   | loadbalancers        | 653b8d79-e8a4-4ddc-81b4-e3e6b42a2fe3 |
   | members              | 90d69170-2f73-4bfd-ad31-896191088f59 |
   | name                 | pool1                                |
   | operating_status     | ONLINE                               |
   | project_id           | 7982a874623944d2a1b54fac9fe46f0b     |
   | protocol             | TCP                                  |
   | provisioning_status  | ACTIVE                               |
   | session_persistence  | None                                 |
   | updated_at           | 2024-01-15T11:18:59                  |
   | tls_container_ref    | None                                 |
   | ca_tls_container_ref | None                                 |
   | crl_container_ref    | None                                 |
   | tls_enabled          | False                                |
   +----------------------+--------------------------------------+

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Create an HTTP listener (http_listener) on a load balancer (lb1) port (80).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer listener create --name http_listener \
   --protocol HTTP --protocol-port 80 lb1 --wait

3. Create an L7 policy (policy1) on the listener (http_listener). The policy must contain the action (REDIRECT_TO_URL) and point to the URL (https://www.example.com/).

   Example

   $ openstack loadbalancer l7policy create --name policy1 \
   --action REDIRECT_PREFIX --redirect-prefix https://www.example.com/ \
   http_listener --wait

4. Add an L7 rule that matches all requests to a policy (policy1).

   Example

   $ openstack loadbalancer l7rule create --compare-type STARTS_WITH \
   --type PATH --value / policy1 --wait

Verification

1. Run the openstack loadbalancer l7policy list command and verify that the policy, policy1, exists.

2. Run the openstack loadbalancer l7rule list <l7policy> command and verify that a rule with a compare_type of STARTS_WITH exists.

   Example

   $ openstack loadbalancer l7rule list policy1

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Create a second pool (static_pool) on a load balancer (lb1).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer pool create --name static_pool \
   --lb-algorithm ROUND_ROBIN --loadbalancer lb1 --protocol HTTP --wait

3. Add load balancer members (192.0.2.10 and 192.0.2.11) on the private subnet (private_subnet) to the pool (static_pool):

   Example

   In this example, the back-end servers, 192.0.2.10 and 192.0.2.11, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --name member1 --subnet-id \
   private_subnet --address 192.0.2.10 --protocol-port 80 static_pool \
   --wait
   
   $ openstack loadbalancer member create --name member2 --subnet-id \
   private_subnet --address 192.0.2.11 --protocol-port 80 static_pool \
   --wait

4. Create an L7 policy (policy1) on the listener (listener1). The policy must contain the action (REDIRECT_TO_POOL) and point to the pool (static_pool).

   Example

   $ openstack loadbalancer l7policy create --name policy1 \
   --action REDIRECT_TO_POOL --redirect-pool static_pool listener1 \
   --wait

5. Add an L7 rule that looks for /js at the start of the request path to the policy.

   Example

   $ openstack loadbalancer l7rule create --compare-type STARTS_WITH \
   --type PATH --value /js policy1 --wait

6. Create an L7 policy (policy2) with an action (REDIRECT_TO_POOL) and add the listener (listener1) pointed at the pool.

   Example

   $ openstack loadbalancer l7policy create --name policy2 \
   --action REDIRECT_TO_POOL --redirect-pool static_pool listener1 \
   --wait

7. Add an L7 rule that looks for /images at the start of the request path to the policy.

   Example

   $ openstack loadbalancer l7rule create --compare-type STARTS_WITH \
   --type PATH --value /images policy2 --wait

Verification

1. Run the openstack loadbalancer l7policy list command and verify that the policies, policy1 and policy2, exist.

2. Run the openstack loadbalancer l7rule list <l7policy> command and verify that a rule with a compare_type of STARTS_WITH exists for each respective policy.

   Example

   $ openstack loadbalancer l7rule list policy1
   
   $ openstack loadbalancer l7rule list policy2

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Create a second pool (pool2) on the load balancer (lb1).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer pool create --name pool2 \
   --lb-algorithm ROUND_ROBIN --loadbalancer lb1 --protocol HTTP --wait

3. Create an L7 policy (policy1) on the listener (listener1). The policy must contain the action (REDIRECT_TO_POOL) and point to the pool (pool2).

   Example

   $ openstack loadbalancer l7policy create --name policy1 \
   --action REDIRECT_TO_POOL --redirect-pool pool2 listener1 --wait

4. Add an L7 rule to the policy that sends any requests using the HTTP/1.1 hostname, www2.example.com, to the second pool (pool2).

   Example

   $ openstack loadbalancer l7rule create --compare-type EQUAL_TO \
   --type HOST_NAME --value wwwexample.com policy1 --wait

Verification

1. Run the openstack loadbalancer l7policy list command and verify that the policy, policy1, exists.

2. Run the openstack loadbalancer l7rule list <l7policy> command and verify that a rule with a compare_type of EQUAL_TO exists for the policy.

   Example

   $ openstack loadbalancer l7rule list policy1

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Create a second pool (pool2) on the load balancer (lb1).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer pool create --name pool2 \
   --lb-algorithm ROUND_ROBIN --loadbalancer lb1 --protocol HTTP --wait

3. Create an L7 policy (policy1) on the listener (listener1). The policy must contain the action (REDIRECT_TO_POOL) and point to the pool (pool2).

   Example

   $ openstack loadbalancer l7policy create --name policy1 \
   --action REDIRECT_TO_POOL --redirect-pool pool2 listener1 --wait

4. Add an L7 rule to the policy that sends any requests that use an HTTP/1.1 hostname (www2.example.com) to the second pool (pool2).

   Example

   $ openstack loadbalancer l7rule create --compare-type ENDS_WITH \
   --type HOST_NAME --value .example.com policy1 --wait

Verification

1. Run the openstack loadbalancer l7policy list command and verify that the policy, policy1, exists.

2. Run the openstack loadbalancer l7rule list <l7policy> command and verify that a rule with a compare_type of EQUAL_TO exists for the policy.

   Example

   $ openstack loadbalancer l7rule list policy1

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Create a second pool (login_pool) on the load balancer (lb1).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer pool create --name login_pool \
   --lb-algorithm ROUND_ROBIN --loadbalancer lb1 --protocol HTTP --wait

3. Add a member, the secure authentication server (192.0.2.10) on the authenticating subnet (secure_subnet), to the second pool.

   Example

   In this example, the back-end server, 192.0.2.10, is named member1:

   $ openstack loadbalancer member create --name member1 \
   --address 192.0.2.10 --protocol-port 80 --subnet-id secure_subnet \
   login_pool --wait

4. Create an L7 policy (policy1) on the listener (listener1). The policy must contain the action (REDIRECT_TO_POOL) and point to the second pool (login_pool).

   Example

   $ openstack loadbalancer l7policy create --name policy1 \
   --action REDIRECT_TO_POOL --redirect-pool login_pool listener1 \
   --wait

5. Add an L7 rule to the policy (policy1) that searches for the browser cookie (auth_token) with any value, and matches if the cookie is NOT present.

   Example

   $ openstack loadbalancer l7rule create --compare-type REGEX \
   --key auth_token --type COOKIE --value '.*' --invert policy1 --wait

Verification

1. Run the openstack loadbalancer l7policy list command and verify that the policy, policy1, exists.

2. Run the openstack loadbalancer l7rule list <l7policy> command and verify that a rule with a compare_type of REGEX exists.

   Example

   $ openstack loadbalancer l7rule list policy1

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Create a second pool (login_pool) on the load balancer (lb1).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer pool create --name login_pool \
   --lb-algorithm ROUND_ROBIN --loadbalancer lb1 --protocol HTTP --wait

3. Add a member, the secure authentication server (192.0.2.10) on the authenticating subnet (secure_subnet), to the second pool.

   Example

   In this example, the back-end server, 192.0.2.10, is named member1:

   $ openstack loadbalancer member create --name member1 \
   --address 192.0.2.10 --protocol-port 80 --subnet-id secure_subnet \
   login_pool --wait

4. Create an L7 policy (policy1) on the listener (listener1). The policy must contain the action (REDIRECT_TO_POOL) and point to the second pool (login_pool).

   Example

   $ openstack loadbalancer l7policy create --action REDIRECT_TO_POOL \
   --redirect-pool login_pool --name policy1 listener1 --wait

5. Add an L7 rule to the policy (policy1) that searches for the browser cookie (auth_token) with any value, and matches if the cookie is NOT present.

   Example

   $ openstack loadbalancer l7rule create --compare-type REGEX \
   --key auth_token --type COOKIE --value '.*' --invert policy1 --wait

6. Create a second L7 policy (policy2) on the listener (listener1). The policy must contain the action (REDIRECT_TO_POOL) and point to the second pool (login_pool).

   Example

   $ openstack loadbalancer l7policy create --action REDIRECT_TO_POOL \
   --redirect-pool login_pool --name policy2 listener1 --wait

7. Add an L7 rule to the second policy (policy2) that searches for the browser cookie (auth_token) and matches if the cookie value equals the string INVALID.

   Example

   $ openstack loadbalancer l7rule create --compare-type EQUAL_TO \
   --key auth_token --type COOKIE --value INVALID policy2 --wait

Verification

1. Run the openstack loadbalancer l7policy list command and verify that the policies, policy1 and policy2, exist.

2. Run the openstack loadbalancer l7rule list <l7policy> command and verify that a rule with a compare_type of REGEX exists for policy1 and a rule with a compare_type of EQUAL_TO exists for policy2.

   Example

   $ openstack loadbalancer l7rule list policy1
   
   $ openstack loadbalancer l7rule list policy2

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Create a second pool (api_pool) on the load balancer (lb1).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer pool create --name api_pool \
   --lb-algorithm ROUND_ROBIN --loadbalancer lb1 --protocol HTTP --wait

3. Add load balancer members (192.0.2.10 and 192.0.2.11) on the private subnet (private_subnet) to the pool (static_pool):

   Example

   In this example, the back-end servers, 192.0.2.10 and 192.0.2.11, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --name member1 --subnet-id \
   private_subnet --address 192.0.2.10 --protocol-port 80 static_pool \
   --wait
   
   $ openstack loadbalancer member create --name member2 --subnet-id \
   private_subnet --address 192.0.2.11 --protocol-port 80 static_pool \
   --wait

4. Create an L7 policy (policy1) on the listener (listener1). The policy must contain the action (REDIRECT_TO_POOL) and point to the pool (api_pool).

   Example

   $ openstack loadbalancer l7policy create --action REDIRECT_TO_POOL \
   --redirect-pool api_pool --name policy1 listener1 --wait

5. Add an L7 rule to the policy that matches the hostname api.example.com.

   Example

   $ openstack loadbalancer l7rule create --compare-type EQUAL_TO \
   --type HOST_NAME --value api.example.com policy1 --wait

6. Add a second L7 rule to the policy that matches /api at the start of the request path.

   This rule is logically ANDed with the first rule.

   Example

   $ openstack loadbalancer l7rule create --compare-type STARTS_WITH \
   --type PATH --value /api policy1 --wait

Verification

1. Run the openstack loadbalancer l7policy list command and verify that the policy, policy1, exists.

2. Run the openstack loadbalancer l7rule list <l7policy> command and verify that rules with a compare_type of EQUAL_TO and STARTS_WITH, respectively, both exist for policy1.

   Example

   $ openstack loadbalancer l7rule list policy1
   
   $ openstack loadbalancer l7rule list policy2

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Create a third pool (pool_B) on a load balancer (lb1).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer pool create --name pool_B \
   --lb-algorithm ROUND_ROBIN --loadbalancer lb1 --protocol HTTP --wait

3. Add load balancer members (192.0.2.50 and 192.0.2.51) on the private subnet (private_subnet) to the pool (pool_B):

   Example

   In this example, the back-end servers, 192.0.2.50 and 192.0.2.51, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --name member1 \
   --address 192.0.2.50 --protocol-port 80 \
   --subnet-id private_subnet pool_B --wait
   
   $ openstack loadbalancer member create --name member2 \
   --address 192.0.2.51 --protocol-port 80 \
   --subnet-id private_subnet pool_B --wait

4. Create a fourth pool (static_pool_B) on a load balancer (lb1).

   Example

   $ openstack loadbalancer pool create --name static_pool_B \
   --lb-algorithm ROUND_ROBIN --loadbalancer lb1 --protocol HTTP --wait

5. Add load balancer members (192.0.2.100 and 192.0.2.101) on the private subnet (private_subnet) to the pool (static_pool_B):

   Example

   $ openstack loadbalancer member create --name member3 \
   --address 192.0.2.100 --protocol-port 80 \
   --subnet-id private_subnet static_pool_B --wait
   
   $ openstack loadbalancer member create --name member4 \
   --address 192.0.2.101 --protocol-port 80 \
   --subnet-id private_subnet static_pool_B --wait

6. Create an L7 policy (policy2) on the listener (listener1). The policy must contain the action (REDIRECT_TO_POOL) and point to the pool (static_pool_B). Insert the policy at position 1.

   Example

   $ openstack loadbalancer l7policy create --action REDIRECT_TO_POOL \
   --redirect-pool static_pool_B --name policy2 --position 1 listener1 \
   --wait

7. Add an L7 rule to the policy (policy2) that uses a regular expression to match either /js or /images at the start of the request path.

   Example

   $ openstack loadbalancer l7rule create --compare-type REGEX \
   --type PATH --value '^/(js|images)' policy2 --wait

8. Add a second L7 rule to the policy (policy2) that matches the cookie (site_version) to the exact string (B).

   Example

   $ openstack loadbalancer l7rule create --compare-type EQUAL_TO \
   --key site_version --type COOKIE --value B policy2 --wait

9. Create an L7 policy (policy3) on the listener (listener1). The policy must contain the action (REDIRECT_TO_POOL) and point to the pool (pool_B). Insert the policy at position 2.

   Example

   $ openstack loadbalancer l7policy create --action REDIRECT_TO_POOL \
   --redirect-pool pool_B --name policy3 --position 2 listener1 --wait

10. Add an L7 rule to the policy (policy3) that matches the cookie (site_version) to the exact string (B).

    Example

    $ openstack loadbalancer l7rule create --compare-type EQUAL_TO \
    --key site_version --type COOKIE --value B policy3 --wait

    Note

    It is important to assign L7 policies with the most specific rules to a lower position, because the first policy whose rules all evaluate to True is the policy whose action is followed. In this procedure, policy2 needs to be evaluated before policy3 to avoid requests being sent to the incorrect pool.

Verification

1. Run the openstack loadbalancer l7policy list command and verify that the policies, policy2 and policy3, exist.

2. Run the openstack loadbalancer l7rule list <l7policy> command and verify that a rule with a compare_type of STARTS_WITH exists for each respective policy.

   Example

   $ openstack loadbalancer l7rule list policy2
   
   $ openstack loadbalancer l7rule list policy3

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Add a tag to a load-balancing object when you create it by using the --tag <tag> option with the appropriate create command for the object:

   Note

   A tag can be any valid unicode string with a maximum length of 255 characters.

   Example - creating and tagging a load balancer

   In this example a load balancer, lb1, is created with two tags, Finance and Sales:

   $ openstack loadbalancer create --name lb1 \
   --vip-subnet-id public_subnet --tag Finance --tag Sales --wait

   Note

   Load-balancing service objects can have one or more tags. Repeat the --tag <tag> option for each additional tag that you want to add.

   Example - creating and tagging a listener

   In this example a listener, listener1, is created with a tag, Sales:

   $ openstack loadbalancer listener create --name listener1 --protocol HTTP --protocol-port 80 --tag Sales lb1 --wait

   Example - creating and tagging a pool

   In this example a pool, pool1, is created with a tag, Sales:

   $ openstack loadbalancer pool create --name pool1 \
   --lb-algorithm ROUND_ROBIN --listener listener1 \
   --protocol HTTP --tag Sales --wait

   Example - creating a member in a pool and tagging it

   In this example a member, 192.0.2.10, is created in pool1 with a tag, Sales:

   $ openstack loadbalancer member create --name member1 \
   --subnet-id private_subnet --address 192.0.2.10 --protocol-port 80 \
   --tag Sales pool1 --wait

   Example - creating and tagging a health monitor

   In this example a health monitor, healthmon1, is created with a tag, Sales:

   $ openstack loadbalancer healthmonitor create --name healthmon1 \
   --delay 15 --max-retries 4 --timeout 10 --type HTTP --url-path / \
   --tag Sales pool1 --wait

   Example - creating and tagging an L7 policy

   In this example an L7 policy, policy1, is created with a tag, Sales:

   $ openstack loadbalancer l7policy create --action REDIRECT_PREFIX \
   --redirect-prefix https://www.example.com/ \
   --name policy1 http_listener --tag Sales --wait

   Example - creating and tagging an L7 rule

   In this example an L7 rule, rule1, is created with a tag, Sales:

   $ openstack loadbalancer l7rule create --compare-type STARTS_WITH \
   --type PATH --value / --tag Sales policy1 --wait

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Do one of the following:

   • Add a tag to a pre-existing load-balancing object by using the --tag <tag> option with the appropriate set command for the object:

     • openstack loadbalancer set --tag <tag> <load_balancer_name_or_ID>
     • openstack loadbalancer listener set --tag <tag> <listener_name_or_ID>
     • openstack loadbalancer pool set --tag <tag> <pool_name_or_ID>
     • openstack loadbalancer member set --tag <tag> <pool_name_or_ID> <member_name_or_ID>
     • openstack loadbalancer healthmonitor set --tag <tag> <healthmon_name_or_ID>
     • openstack loadbalancer l7policy set --tag <tag> <l7policy_name_or_ID>

     • openstack loadbalancer l7rule set --tag <tag> <l7policy_name_or_ID> <l7rule_ID>

       Note

       A tag can be any valid unicode string with a maximum length of 255 characters.

       Example

       In this example the tags, Finance and Sales, are added to the load balancer, lb1:

       $ openstack loadbalancer set --tag Finance --tag Sales lb1

       Note

       Load-balancing service objects can have one or more tags. Repeat the --tag <tag> option for each additional tag that you want to add.

   • Remove a tag from a pre-existing load-balancing object by using the --tag <tag> option with the appropriate unset command for the object:

     • openstack loadbalancer unset --tag <tag> <load_balancer_name_or_ID>
     • openstack loadbalancer listener unset --tag <tag> <listener_name_or_ID>
     • openstack loadbalancer pool unset --tag <tag> <pool_name_or_ID>
     • openstack loadbalancer member unset --tag <tag> <pool_name_or_ID> <member_name_or_ID>
     • openstack loadbalancer healthmonitor unset --tag <tag> <healthmon_name_or_ID>
     • openstack loadbalancer l7policy unset --tag <tag> <policy_name_or_ID>

     • openstack loadbalancer l7rule unset --tag <tag> <policy_name_or_ID> <l7rule_ID>

       Example

       In this example, the tag, Sales, is removed from the load balancer, lb1:

       $ openstack loadbalancer unset --tag Sales lb1

   • Remove all tags from a pre-existing load-balancing object by using the --no-tag option with the appropriate set command for the object:

     • openstack loadbalancer set --no-tag <load_balancer_name_or_ID>
     • openstack loadbalancer listener set --no-tag <listener_name_or_ID>
     • openstack loadbalancer pool set --no-tag <pool_name_or_ID>
     • openstack loadbalancer member set --no-tag <pool_name_or_ID> <member_name_or_ID>
     • openstack loadbalancer healthmonitor set --no-tag <healthmon_name_or_ID>
     • openstack loadbalancer l7policy set --no-tag <l7policy_name_or_ID>

     • openstack loadbalancer l7rule set --no-tag <l7policy_name_or_ID> <l7rule_ID>

       Example

       In this example, all tags are removed from the load balancer, lb1:

       $ openstack loadbalancer set --no-tag lb1

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Filter the objects that you want to list by running the appropriate loadbalancer list command for the objects with one of the tag options:

   Expand

   Table 11.1. Tag options for filtering objects

   In my list, I want to…​	Examples
   include objects that match all specified tags.	$ openstack loadbalancer list --tags Sales,Finance $ openstack loadbalancer listener list --tags Sales,Finance $ openstack loadbalancer l7pool list --tags Sales,Finance $ openstack loadbalancer member list --tags Sales,Finance pool1 $ openstack loadbalancer healthmonitor list --tags Sales,Finance $ openstack loadbalancer l7policy list --tags Sales,Finance $ openstack loadbalancer l7rule list --tags Sales,Finance policy1
   include objects that match one or more specified tags.	$ openstack loadbalancer list --any-tags Sales,Finance $ openstack loadbalancer listener list --any-tags Sales,Finance $ openstack loadbalancer l7pool list --any-tags Sales,Finance $ openstack loadbalancer member list --any-tags Sales,Finance pool1 $ openstack loadbalancer healthmonitor list --any-tags Sales,Finance $ openstack loadbalancer l7policy list --any-tags Sales,Finance $ openstack loadbalancer l7rule list --any-tags Sales,Finance policy1
   exclude objects that match all specified tags.	$ openstack loadbalancer list --not-tags Sales,Finance $ openstack loadbalancer listener list --not-tags Sales,Finance $ openstack loadbalancer l7pool list --not-tags Sales,Finance $ openstack loadbalancer member list --not-tags Sales,Finance pool1 $ openstack loadbalancer healthmonitor list --not-tags Sales,Finance $ openstack loadbalancer l7policy list --not-tags Sales,Finance $ openstack loadbalancer l7rule list --not-tags Sales,Finance policy1
   exclude objects that match one or more specified tags.	$ openstack loadbalancer list --not-any-tags Sales,Finance $ openstack loadbalancer listener list --not-any-tags Sales,Finance $ openstack loadbalancer l7pool list --not-any-tags Sales,Finance $ openstack loadbalancer member list --not-any-tags Sales,Finance pool1 $ openstack loadbalancer healthmonitor list --not-any-tags Sales,Finance $ openstack loadbalancer l7policy list --not-any-tags Sales,Finance $ openstack loadbalancer l7rule list --not-any-tags Sales,Finance policy1

   Show more
   Note

   When specifying more than one tag, separate the tags by using a comma.

Procedure

1. Access the remote shell for the OpenStackClient pod from your workstation:

   $ oc rsh -n openstack openstackclient

2. Gather the names of the Compute service AZs that you will use for your Load-balancing service AZs.

   Tip

   Naming your Load-balancing service AZs to match the names of your Compute service AZs can facilitate AZ management.

   $ openstack availability zone list --compute

   Sample output

   +-----------+-------------+
   | Zone Name | Zone Status |
   +-----------+-------------+
   | az0       | available   |
   | az1       | available   |
   | az2       | available   |
   | internal  | available   |
   +-----------+-------------+

3. Gather the IDs for the management networks that you will use to create your Load-balancing service AZs:

   $ openstack network list -c Name -c ID

   Sample output

   +--------------------------------------+----------------------+
   | ID                                   | Name                 |
   +--------------------------------------+----------------------+
   | 0947ddcf-d9be-4b8c-94a1-be3852e5d905 | dcn2-public          |
   | 4f35cb1c-69d7-4582-b3a5-0cf380c56f62 | dcn1-public          |
   | 55e761de-ef4c-4a5c-8198-89d20a06eca3 | lb-mgmt-az2-net      |
   | a1894c48-823c-4def-bb6f-e9b7ec4d0c0a | public               |
   | bf72ef9b-e0f1-4d4e-a8b5-7f5bb036a275 | lb-mgmt-az1-net      |
   | ff8f3153-a74b-499c-a850-947ad199fc6d | octavia-provider-net |
   +--------------------------------------+----------------------+

   Note

   Ensure that you know which networks are valid for creating VIPs for your site.

4. Create an AZ profile:

   $ openstack loadbalancer availabilityzoneprofile create \
   --name <AZ_profile_name> --provider amphora --availability-zone-data \
   '{"compute_zone": "<compute_AZ_name>","management_network": \
   "<lb_mgmt_AZ_net_UUID>", "valid_vip_networks": ["<valid_AZ_VIP_net_UUID>"]}'

   • Replace <AZ_profile_name> with the name of the AZ profile that you are creating.
   • Replace <compute_AZ_name> with the name of the Compute AZ where you are creating the AZ profile.
   • Replace <lb_mgmt_AZ_net_UUID> with the ID of the management network available to the AZ that will be created.

   • (Optional) replace <valid_AZ_VIP_net_UUID> with the network ID that is allowed for VIP use. Use valid_vip_networks if you want to restrict the networks available for VIPs in this AZ.

     Example - create profile for az0

     In this example, an AZ profile (az0_profile) is created that uses the management network (lb-mgmt-net) on a Compute node that runs in the Compute AZ (az0):

     $ openstack loadbalancer availabilityzoneprofile create \
     --name az0_profile --provider amphora --availability-zone-data \
     '{"compute_zone": "az0","management_network": \
     "662a94f5-51eb-4a4c-86c4-52dcbf471ef9"}'

5. Repeat step 4 to create an AZ profile for each Load-balancing service AZ that you want to create.

   Example - create profile for az1

   In this example, an AZ profile (az1-profile) is created that uses the management network (lb-mgmt-az1-net) on a Compute node that runs in the Compute AZ (az1):

   $ openstack loadbalancer availabilityzoneprofile create \
   --name az1-profile --provider amphora --availability-zone-data \
   '{"compute-zone": "az1","management-network": \
   "a2884aaf-846c-4936-9982-3083f6a71d9b"}'

   Example - create profile for az2

   In this example, an AZ profile (az2-profile) is created that uses the management network (lb-mgmt-az2-net) on a Compute node that runs in the Compute AZ (az2):

   $ openstack loadbalancer availabilityzoneprofile create \
   --name az2-profile --provider amphora --availability-zone-data \
   '{"compute-zone": "az2","management-network": \
   "10458d6b-e7c9-436f-92d9-711677c9d9fd"}'

6. Using the AZ profile, create a Load-balancing service AZ. Repeat this step for any additional AZs, using the appropriate profile for each AZ.

   Example - create AZ: az0

   In this example, a Load-balancing service AZ (az0) is created by using the AZ profile (az0-profile):

   $ openstack loadbalancer availabilityzone create --name az0 \
   --availabilityzoneprofile az0-profile \
   --description "AZ for Headquarters" --enable

   Example - create AZ: az1

   In this example, a Load-balancing service AZ (az1) is created by using the AZ profile (az1-profile):

   $ openstack loadbalancer availabilityzone create --name az1 \
   --availabilityzoneprofile az1-profile \
   --description "AZ for South Region" --enable

   Example - create AZ: az2

   In this example, a Load-balancing service AZ (az2) is created by using the AZ profile (az2-profile):

   $ openstack loadbalancer availabilityzone create --name az2 \
   --availabilityzoneprofile az2-profile \
   --description "AZ for North Region" --enable