Configuring load balancing as a service

Procedure

1. Generate a Base64, encoded password.

   Retain the encoded output to use in a later step.

   Example

   In this example, the password, my_password is encoded using the Base64 encoding scheme:

   $ echo -n my_password | base64

   Copy to Clipboard Toggle word wrap

2. Create a Secret CR file on your workstation, for example, octavia-ca-passphrase.yaml.

3. Add the following configuration to octavia-ca-passphrase.yaml:

   apiVersion: v1
   data:
     server-ca-passphrase: <Base64_password>
   kind: Secret
   metadata:
     name: octavia-ca-passphrase
     namespace: openstack
   type: Opaque

   Copy to Clipboard Toggle word wrap
   • Replace the <Base64_password> with the Base64-encoded password that you created earlier.

4. Create the Secret CR in the cluster:

   $ oc create -f octavia-ca-passphrase.yaml

   Copy to Clipboard Toggle word wrap

Procedure

1. Using the Skopeo utility, obtain the amphora image version. You will need the image version in a SHA format for a later step:

   $ podman login registry.redhat.io
   
   $ sudo dnf install -y skopeo
   
   $ skopeo inspect docker://registry.redhat.io/rhoso/\
   octavia-amphora-image-rhel9:$(oc get openstackversion \
   -o jsonpath='{.items[0].status.deployedVersion}' | \
   awk -F '-' '{print $1}') --format '{{.Name}}@{{.Digest}}'

   Copy to Clipboard Toggle word wrap

2. Open your OpenStackControlPlane CR file, and enable the Load-balancing service (octavia) by adding the following service configuration:

   apiVersion: core.openstack.org/v1beta1
   kind: OpenStackControlPlane
   metadata:
     name: openstack-control-plane
     namespace: openstack
     spec:
   ...
       octavia:
         enabled: true
         template:
           octaviaHousekeeping:
             networkAttachments:
               - octavia
           octaviaHealthManager:
             networkAttachments:
               - octavia
           octaviaWorker:
             networkAttachments:
               - octavia
   ...

   Copy to Clipboard Toggle word wrap

3. With the amphora image version that you obtained in an earlier step, use the octavia.template.amphoraImageContainerImage parameter to add the amphora image to the Image service (glance):

   Example

   ...
       octavia:
         enabled: true
         template:
           octaviaHousekeeping:
             networkAttachments:
               - octavia
           octaviaHealthManager:
             networkAttachments:
               - octavia
           octaviaWorker:
             networkAttachments:
               - octavia
           amphoraImageContainerImage: registry.redhat.io/rhoso/\
           octavia-amphora-image-rhel9@sha256:312cd5e8ea9fe261c1929aefececbeb22afe5e433ae76ef0860d98e561db21c9
   ...

   Copy to Clipboard Toggle word wrap

4. Optional: to enable flow resumption, perform the following steps.

   For more information, see Avoiding taskflow interruptions by using flow resumption.

   1. Create the octavia-redis database in Redis by adding the schema name, octavia-redis:, and the number of replicas, replicas: 1:

      apiVersion: core.openstack.org/v1beta1
      kind: OpenStackControlPlane
      metadata:
        name: openstack-control-plane
        namespace: openstack
        spec:
      ...
          redis:
            enabled: true
            templates:
              octavia-redis:
                replicas: 1
      ...

      Copy to Clipboard Toggle word wrap

   2. Enable the octavia-redis database by adding the line, redisServiceName: octavia-redis:

      apiVersion: core.openstack.org/v1beta1
      kind: OpenStackControlPlane
      metadata:
        name: openstack-control-plane
        namespace: openstack
        spec:
      ...
          octavia:
            enabled: true
            template:
              databaseInstance: <Galera_CR>
              redisServiceName: octavia-redis
              octaviaHousekeeping:
                networkAttachments:
                  - octavia
              octaviaHealthManager:
                networkAttachments:
                  - octavia
              octaviaWorker:
                networkAttachments:
                  - octavia
      ...

      Copy to Clipboard Toggle word wrap

5. Locate the service configuration for ovn, and add the following configuration under template:

   ...
     ovn:
       template:
         ovnController:
           networkAttachment: tenant
           nicMappings:
             octavia: octbr

   Copy to Clipboard Toggle word wrap
   • networkAttachment - Note the one-character difference between the OVN networkAttachment property and the octavia networkAttachments property. The name tenant is an example value.
   • nicMappings - The value must be octavia: octbr.

6. Update the OpenStackControlPlane custom resource with the required values for the Load-balancing service.

   Example

   $ oc apply -f openstack_control_plane.yaml -n openstack

   Copy to Clipboard Toggle word wrap

Verification

1. Wait until RHOCP creates the Load-balancing service resources. Run the following command to check the status:

   $ oc wait octavia octavia --for condition=Ready

   Copy to Clipboard Toggle word wrap

   Sample output

   You should see output similar to the following:

   octavia.octavia.openstack.org/octavia condition met

   Copy to Clipboard Toggle word wrap

2. Confirm that the Load-balancing service pods are running:

   $ oc get pods | grep octavia

   Copy to Clipboard Toggle word wrap

   Sample output

   You should see output similar to the following:

   octavia-api-78b56bb844-ngjhc                  2/2     Running     0          12s
   octavia-healthmanager-f6hpx                   1/1     Running     0          14s
   octavia-housekeeping-knwpf                    1/1     Running     0          10s
   octavia-redis-redis-0                         2/2     Running     0          20s
   octavia-rsyslog-4nkv8                         1/1     Running     0          23s
   octavia-worker-l5hs4                          1/1     Running     0          26s

   Copy to Clipboard Toggle word wrap

3. Access the remote shell for the OpenStackClient pod from your workstation:

   $ oc rsh -n openstack openstackclient

   Copy to Clipboard Toggle word wrap

4. Confirm that the networks octavia-provider-net and lb-mgmt-net are present:

   $ openstack network list -f yaml

   Copy to Clipboard Toggle word wrap

   Sample output

   - ID: 2e4fc309-546b-4ac8-9eae-aa8d70a27a9b
     Name: octavia-provider-net
     Subnets:
     - eea45073-6e56-47fd-9153-12f7f49bc115
   - ID: 77881d3f-04b0-46cb-931f-d54003cce9f0
     Name: lb-mgmt-net
     Subnets:
     - e4ab96af-8077-4971-baa4-e0d40a16f55a

   Copy to Clipboard Toggle word wrap

   The network, octavia-provider-net, is the external provider network, and is limited to the RHOSO control plane. The lb-mgmt-net network connects the Load-balancing service to amphora instances.

5. Exit the openstackclient pod:

   $ exit

   Copy to Clipboard Toggle word wrap

Procedure

1. Open your OpenStackControlPlane CR file, openstack_control_plane.yaml, on your workstation.

2. Add the following configuration to the octavia service configuration:

     octavia:
       template:
         octaviaHousekeeping:
           customServiceConfig: |
             [amphora_agent]
             tenant_log_targets =
         octaviaHealthManager:
           customServiceConfig: |
             [amphora_agent]
             tenant_log_targets =
         octaviaWorker:
           customServiceConfig: |
             [amphora_agent]
             tenant_log_targets =

   Copy to Clipboard Toggle word wrap

3. Update the control plane:

   $ oc apply -f openstack_control_plane.yaml -n openstack

   Copy to Clipboard Toggle word wrap

4. Wait until RHOCP creates the resources related to the OpenStackControlPlane CR. Run the following command to check the status:

   $ oc get openstackcontrolplane -n openstack
   NAME 						STATUS 	MESSAGE
   openstack-control-plane 	Unknown 	Setup started

   Copy to Clipboard Toggle word wrap

   The OpenStackControlPlane resources are created when the status is "Setup complete".

   Tip

   Append the -w option to the end of the get command to track deployment progress.

5. Confirm that the control plane is deployed by reviewing the pods in the openstack namespace:

   $ oc get pods -n openstack

   Copy to Clipboard Toggle word wrap

   The control plane is deployed when all the pods are either completed or running.

Procedure

1. Open your OpenStackControlPlane` custom resource (CR) file, openstack_control_plane.yaml, on your workstation.

2. Add the following configuration to the octavia service configuration:

     octavia:
       template:
         octaviaHousekeeping:
           customServiceConfig: |
             [amphora_agent]
             disable_local_log_storage=true
         octaviaHealthManager:
           customServiceConfig: |
             [amphora_agent]
             disable_local_log_storage=true
         octaviaWorker:
           customServiceConfig: |
              [amphora_agent]
              disable_local_log_storage=true

   Copy to Clipboard Toggle word wrap

3. Update the control plane:

   $ oc apply -f openstack_control_plane.yaml -n openstack

   Copy to Clipboard Toggle word wrap

4. Wait until RHOCP creates the resources related to the OpenStackControlPlane CR. Run the following command to check the status:

   $ oc get openstackcontrolplane -n openstack
   NAME 						STATUS 	MESSAGE
   openstack-control-plane 	Unknown 	Setup started

   Copy to Clipboard Toggle word wrap

   The OpenStackControlPlane resources are created when the status is "Setup complete".

   Tip

   Append the -w option to the end of the get command to track deployment progress.

5. Confirm that the control plane is deployed by reviewing the pods in the openstack namespace:

   $ oc get pods -n openstack

   Copy to Clipboard Toggle word wrap

   The control plane is deployed when all the pods are either completed or running.

Procedure

1. Access the remote shell for the OpenStackClient pod from your workstation:

   $ oc rsh -n openstack openstackclient

   Copy to Clipboard Toggle word wrap

2. List the capabilities for each driver:

   $ openstack loadbalancer provider capability list <provider>

   Copy to Clipboard Toggle word wrap

   Replace <provider> with the name or UUID of the provider.

   Example

   $ openstack loadbalancer provider capability list amphora

   Copy to Clipboard Toggle word wrap

   The command output lists all of the capabilities that the provider supports.

   Sample output

   +-----------------------+---------------------------------------------------+
   | name                  | description                                       |
   +-----------------------+---------------------------------------------------+
   | loadbalancer_topology | The load balancer topology. One of: SINGLE - One  |
   |                       | amphora per load balancer. ACTIVE_STANDBY - Two   |
   |                       | amphora per load balancer.                        |
   | ...                   | ...                                               |
   +-----------------------+---------------------------------------------------+

   Copy to Clipboard Toggle word wrap

3. Note the names of the capabilities that you want to include in the flavor that you are creating. You will use these capability names later when you create the profile for the flavor.

4. Exit the openstackclient pod:

   $ exit

   Copy to Clipboard Toggle word wrap

Procedure

1. Access the remote shell for the OpenStackClient pod from your workstation:

   $ oc rsh -n openstack openstackclient

   Copy to Clipboard Toggle word wrap

2. Create a flavor profile:

   $ openstack loadbalancer flavorprofile create --name <profile_name> --provider <provider_name> --flavor-data '{"<capability>": "<value>"}'

   Copy to Clipboard Toggle word wrap

   Example

   In this example, a flavor profile is created for the amphora provider. When this profile is specified in a flavor, the load balancer that users create by using the flavor is a single amphora load balancer.

   $ openstack loadbalancer flavorprofile create --name amphora-single-profile \
   --provider amphora --flavor-data '{"loadbalancer_topology": "SINGLE"}'

   Copy to Clipboard Toggle word wrap

   Sample output

   +---------------+--------------------------------------+
   | Field         | Value                                |
   +---------------+--------------------------------------+
   | id            | 72b53ac2-b191-48eb-8f73-ed012caca23a |
   | name          | amphora-single-profile               |
   | provider_name | amphora                              |
   | flavor_data   | {"loadbalancer_topology": "SINGLE"}  |
   +---------------+--------------------------------------+

   Copy to Clipboard Toggle word wrap

Procedure

1. Access the remote shell for the OpenStackClient pod from your workstation:

   $ oc rsh -n openstack openstackclient

   Copy to Clipboard Toggle word wrap

2. Create a flavor:

   $ openstack loadbalancer flavor create --name <flavor_name> \
   --flavorprofile <flavor-profile> --description "<string>"

   Copy to Clipboard Toggle word wrap
   Tip

   Provide a detailed description so that users can understand the capabilities of the flavor that you are providing.

   Example

   In this example, a flavor has been defined. When users specify this flavor, they create a load balancer that uses one Load-balancing service instance (amphora) and is not highly available.

   $ openstack loadbalancer flavor create --name standalone-lb --flavorprofile amphora-single-profile --description "A non-high availability load balancer for testing."

   Copy to Clipboard Toggle word wrap

   Sample output

   +-------------------+--------------------------------------+
   | Field             | Value                                |
   +-------------------+--------------------------------------+
   | id                | 25cda2d8-f735-4744-b936-d30405c05359 |
   | name              | standalone-lb                        |
   | flavor_profile_id | 72b53ac2-b191-48eb-8f73-ed012caca23a |
   | enabled           | True                                 |
   | description       | A non-high availability load         |
   |                   | balancer for testing.                |
   +-------------------+--------------------------------------+

   Copy to Clipboard Toggle word wrap

   Note

   Disabled flavors are still visible to users, but users cannot use the disabled flavor to create a load balancer.

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Copy to Clipboard Toggle word wrap

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   Copy to Clipboard Toggle word wrap

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Create a load balancer using the load-balancing flavor provided.

   EXAMPLE

   In this example, a non-secure HTTP load balancer (lb1) is created on a public subnet (public_subnet), using the flavor (amphora-4vcpus):

   $ openstack loadbalancer create --name lb1 \
   --vip-subnet-id public_subnet \
   --flavor amphora-4vcpus --wait

   Copy to Clipboard Toggle word wrap

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Copy to Clipboard Toggle word wrap

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   Copy to Clipboard Toggle word wrap

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Run the openstack loadbalancer healthmonitor create command, using argument values that are appropriate for your site.

   • All health monitor types require the following configurable arguments:

     <pool>

     Name or ID of the pool of back-end member servers to be monitored.

     --type

     The type of health monitor. One of HTTP, HTTPS, PING, SCTP, TCP, TLS-HELLO, or UDP-CONNECT.

     --delay

     Number of seconds to wait between health checks.

     --timeout

     Number of seconds to wait for any given health check to complete. timeout must always be smaller than delay.

     --max-retries

     Number of health checks a back-end server must fail before it is considered down. Also, the number of health checks that a failed back-end server must pass to be considered up again.

   • In addition, HTTP health monitor types also require the following arguments, which are set by default:

     --url-path

     Path part of the URL that should be retrieved from the back-end server. By default this is /.

     --http-method

     HTTP method that is used to retrieve the url_path. By default this is GET.

     --expected-codes

     List of HTTP status codes that indicate an OK health check. By default this is 200.

     Example

     $ openstack loadbalancer healthmonitor create --name my-health-monitor --delay 10 --max-retries 4 --timeout 5 --type TCP lb-pool-1 --wait

     Copy to Clipboard Toggle word wrap

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Copy to Clipboard Toggle word wrap

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   Copy to Clipboard Toggle word wrap

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Modify your health monitor (my-health-monitor).

   In this example, a user is changing the time in seconds that the health monitor waits between sending probes to members.

   Example

   $ openstack loadbalancer healthmonitor set my_health_monitor --delay 600

   Copy to Clipboard Toggle word wrap

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Copy to Clipboard Toggle word wrap

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   Copy to Clipboard Toggle word wrap

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Delete the health monitor (my-health-monitor).

   Example

   $ openstack loadbalancer healthmonitor delete my-health-monitor

   Copy to Clipboard Toggle word wrap

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Copy to Clipboard Toggle word wrap

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   Copy to Clipboard Toggle word wrap

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Create a load balancer (lb1) on a public subnet (public_subnet).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer create --name lb1 \
   --vip-subnet-id public_subnet --wait

   Copy to Clipboard Toggle word wrap

3. Create a listener (listener1) on a port (80).

   Example

   $ openstack loadbalancer listener create --name listener1 \
   --protocol HTTP --protocol-port 80 lb1 --wait

   Copy to Clipboard Toggle word wrap

4. Verify the state of the listener.

   Example

   $ openstack loadbalancer listener show listener1

   Copy to Clipboard Toggle word wrap

   Before going to the next step, ensure that the status is ACTIVE.

5. Create the listener default pool (pool1).

   Example

   $ openstack loadbalancer pool create --name pool1 \
   --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP --wait

   Copy to Clipboard Toggle word wrap

6. Create a health monitor (healthmon1) of type (HTTP) on the pool (pool1) that connects to the back-end servers and tests the path (/).

   Health checks can help to avoid a false positive. If no health monitor is defined, the member server is assumed to be ONLINE.

   Example

   $ openstack loadbalancer healthmonitor create --name healthmon1 \
   --delay 15 --max-retries 4 --timeout 10 --type HTTP --url-path / \
   pool1 --wait

   Copy to Clipboard Toggle word wrap

7. Add load balancer members (192.0.2.10 and 192.0.2.11) on the private subnet (private_subnet) to the default pool.

   Example

   In this example, the back-end servers, 192.0.2.10 and 192.0.2.11, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --name member1 --subnet-id \
   private_subnet --address 192.0.2.10 --protocol-port 80 pool1 --wait
   
   $ openstack loadbalancer member create --name member2 --subnet-id \
   private_subnet --address 192.0.2.11 --protocol-port 80 pool1 --wait

   Copy to Clipboard Toggle word wrap

Verification

1. View and verify the load balancer (lb1) settings:

   Example

   $ openstack loadbalancer show lb1

   Copy to Clipboard Toggle word wrap

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | admin_state_up      | True                                 |
   | created_at          | 2024-01-15T11:11:09                  |
   | description         |                                      |
   | flavor              |                                      |
   | id                  | 788fe121-3dec-4e1b-8360-4020642238b0 |
   | listeners           | 09f28053-fde8-4c78-88b9-0f191d84120e |
   | name                | lb1                                  |
   | operating_status    | ONLINE                               |
   | pools               | 627842b3-eed8-4f5f-9f4a-01a738e64d6a |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | provider            | amphora                              |
   | provisioning_status | ACTIVE                               |
   | updated_at          | 2024-01-15T11:12:13                  |
   | vip_address         | 198.51.100.12                        |
   | vip_network_id      | 9bca13be-f18d-49a5-a83d-9d487827fd16 |
   | vip_port_id         | 69a85edd-5b1c-458f-96f2-b4552b15b8e6 |
   | vip_qos_policy_id   | None                                 |
   | vip_subnet_id       | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   +---------------------+--------------------------------------+

   Copy to Clipboard Toggle word wrap

2. When a health monitor is present and functioning properly, you can check the status of each member.

   A working member (member1) has an ONLINE value for its operating_status.

   Example

   $ openstack loadbalancer member show pool1 member1

   Copy to Clipboard Toggle word wrap

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | address             | 192.0.2.10                           |
   | admin_state_up      | True                                 |
   | created_at          | 2024-01-15T11:16:23                  |
   | id                  | b85c807e-4d7c-4cbd-b725-5e8afddf80d2 |
   | name                | member1                              |
   | operating_status    | ONLINE                               |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | protocol_port       | 80                                   |
   | provisioning_status | ACTIVE                               |
   | subnet_id           | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   | updated_at          | 2024-01-15T11:20:45                  |
   | weight              | 1                                    |
   | monitor_port        | None                                 |
   | monitor_address     | None                                 |
   | backup              | False                                |
   +---------------------+--------------------------------------+

   Copy to Clipboard Toggle word wrap

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Copy to Clipboard Toggle word wrap

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   Copy to Clipboard Toggle word wrap

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Create a load balancer (lb1) on a private subnet (private_subnet).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer create --name lb1 \
   --vip-subnet-id private_subnet --wait

   Copy to Clipboard Toggle word wrap

3. In the output from the previous step, record the value of load_balancer_vip_port_id, because you must provide it in a later step.

4. Create a listener (listener1) on a port (80).

   Example

   $ openstack loadbalancer listener create --name listener1 \
   --protocol HTTP --protocol-port 80 lb1 --wait

   Copy to Clipboard Toggle word wrap

5. Create the listener default pool (pool1).

   Example

   The command in this example creates an HTTP pool that uses a private subnet containing back-end servers that host non-secure HTTP applications on TCP port 80:

   $ openstack loadbalancer pool create --name pool1 \
   --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP --wait

   Copy to Clipboard Toggle word wrap

6. Create a health monitor (healthmon1) of type (HTTP) on the pool (pool1) that connects to the back-end servers and tests the path (/).

   Health checks can help to avoid a false positive. If no health monitor is defined, the member server is assumed to be ONLINE.

   Example

   $ openstack loadbalancer healthmonitor create --name healthmon1 \
   --delay 15 --max-retries 4 --timeout 10 --type HTTP --url-path / \
   pool1 --wait

   Copy to Clipboard Toggle word wrap

7. Add load balancer members (192.0.2.10 and 192.0.2.11) on the private subnet to the default pool.

   Example

   In this example, the back-end servers, 192.0.2.10 and 192.0.2.11, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --name member1 --subnet-id \
   private_subnet --address 192.0.2.10 --protocol-port 80 pool1 --wait
   
   $ openstack loadbalancer member create --name member2 --subnet-id \
   private_subnet --address 192.0.2.11 --protocol-port 80 pool1 --wait

   Copy to Clipboard Toggle word wrap

8. Create a floating IP address on the shared external subnet (public).

   Example

   $ openstack floating ip create public

   Copy to Clipboard Toggle word wrap

9. In the output from step 8, record the value of floating_ip_address, because you must provide it in a later step.

10. Associate this floating IP (203.0.113.0) with the load balancer vip_port_id (69a85edd-5b1c-458f-96f2-b4552b15b8e6).

    Example

    $ openstack floating ip set --port 69a85edd-5b1c-458f-96f2-b4552b15b8e6 203.0.113.0

    Copy to Clipboard Toggle word wrap

Verification

1. Verify HTTP traffic flows across the load balancer by using the floating IP (203.0.113.0).

   Example

   $ curl -v http://203.0.113.0 --insecure

   Copy to Clipboard Toggle word wrap

   Sample output

   * About to connect() to 203.0.113.0 port 80 (#0)
   *   Trying 203.0.113.0...
   * Connected to 203.0.113.0 (203.0.113.0) port 80 (#0)
   > GET / HTTP/1.1
   > User-Agent: curl/7.29.0
   > Host: 203.0.113.0
   > Accept: */*
   >
   < HTTP/1.1 200 OK
   < Content-Length: 30
   <
   * Connection #0 to host 203.0.113.0 left intact

   Copy to Clipboard Toggle word wrap

2. When a health monitor is present and functioning properly, you can check the status of each member.

   A working member (member1) has an ONLINE value for its operating_status.

   Example

   $ openstack loadbalancer member show pool1 member1

   Copy to Clipboard Toggle word wrap

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | address             | 192.0.02.10                          |
   | admin_state_up      | True                                 |
   | created_at          | 2024-01-15T11:11:23                  |
   | id                  | b85c807e-4d7c-4cbd-b725-5e8afddf80d2 |
   | name                | member1                              |
   | operating_status    | ONLINE                               |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | protocol_port       | 80                                   |
   | provisioning_status | ACTIVE                               |
   | subnet_id           | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   | updated_at          | 2024-01-15T11:28:42                  |
   | weight              | 1                                    |
   | monitor_port        | None                                 |
   | monitor_address     | None                                 |
   | backup              | False                                |
   +---------------------+--------------------------------------+

   Copy to Clipboard Toggle word wrap

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Copy to Clipboard Toggle word wrap

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   Copy to Clipboard Toggle word wrap

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Create a load balancer (lb1) on a public subnet (public_subnet).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer create --name lb1 \
   --vip-subnet-id public_subnet --wait

   Copy to Clipboard Toggle word wrap

3. Create a listener (listener1) on a port (80).

   Example

   $ openstack loadbalancer listener create --name listener1 \
   --protocol HTTP --protocol-port 80 lb1 --wait

   Copy to Clipboard Toggle word wrap

4. Create the listener default pool (pool1) that defines session persistence on a cookie (PHPSESSIONID).

   Example

   The command in this example creates an HTTP pool that uses a private subnet containing back-end servers that host non-secure HTTP applications on TCP port 80:

   $ openstack loadbalancer pool create --name pool1 \
   --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP \
   --session-persistence type=APP_COOKIE,cookie_name=PHPSESSIONID --wait

   Copy to Clipboard Toggle word wrap

5. Create a health monitor (healthmon1) of type (HTTP) on the pool (pool1) that connects to the back-end servers and tests the path (/).

   Health checks can help to avoid a false positive. If no health monitor is defined, the member server is assumed to be ONLINE.

   Example

   $ openstack loadbalancer healthmonitor create --name healthmon1 \
   --delay 15 --max-retries 4 --timeout 10 --type HTTP --url-path / \
   pool1 --wait

   Copy to Clipboard Toggle word wrap

6. Add load balancer members (192.0.2.10 and 192.0.2.11) on the private subnet (private_subnet) to the default pool.

   Example

   In this example, the back-end servers, 192.0.2.10 and 192.0.2.11, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --name member1 --subnet-id \
   private_subnet --address 192.0.2.10 --protocol-port 80 pool1 --wait
   
   $ openstack loadbalancer member create --name member2 --subnet-id \
   private_subnet --address 192.0.2.11 --protocol-port 80 pool1 --wait

   Copy to Clipboard Toggle word wrap

Verification

1. View and verify the load balancer (lb1) settings:

   Example

   $ openstack loadbalancer show lb1

   Copy to Clipboard Toggle word wrap

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | admin_state_up      | True                                 |
   | created_at          | 2024-01-15T11:11:58                  |
   | description         |                                      |
   | flavor              |                                      |
   | id                  | 788fe121-3dec-4e1b-8360-4020642238b0 |
   | listeners           | 09f28053-fde8-4c78-88b9-0f191d84120e |
   | name                | lb1                                  |
   | operating_status    | ONLINE                               |
   | pools               | 627842b3-eed8-4f5f-9f4a-01a738e64d6a |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | provider            | amphora                              |
   | provisioning_status | ACTIVE                               |
   | updated_at          | 2024-01-15T11:28:42                  |
   | vip_address         | 198.51.100.22                        |
   | vip_network_id      | 9bca13be-f18d-49a5-a83d-9d487827fd16 |
   | vip_port_id         | 69a85edd-5b1c-458f-96f2-b4552b15b8e6 |
   | vip_qos_policy_id   | None                                 |
   | vip_subnet_id       | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   +---------------------+--------------------------------------+

   Copy to Clipboard Toggle word wrap

2. When a health monitor is present and functioning properly, you can check the status of each member.

   A working member (member1) has an ONLINE value for its operating_status.

   Example

   $ openstack loadbalancer member show pool1 member1

   Copy to Clipboard Toggle word wrap

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | address             | 192.0.02.10                          |
   | admin_state_up      | True                                 |
   | created_at          | 2024-01-15T11:11:23                  |
   | id                  | b85c807e-4d7c-4cbd-b725-5e8afddf80d2 |
   | name                | member1                              |
   | operating_status    | ONLINE                               |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | protocol_port       | 80                                   |
   | provisioning_status | ACTIVE                               |
   | subnet_id           | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   | updated_at          | 2024-01-15T11:28:42                  |
   | weight              | 1                                    |
   | monitor_port        | None                                 |
   | monitor_address     | None                                 |
   | backup              | False                                |
   +---------------------+--------------------------------------+

   Copy to Clipboard Toggle word wrap

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Copy to Clipboard Toggle word wrap

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   Copy to Clipboard Toggle word wrap

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Create a load balancer (lb1) on a public subnet (public_subnet).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer create --name lb1 \
   --vip-subnet-id public_subnet --wait

   Copy to Clipboard Toggle word wrap

3. Create a listener (listener1) on a port (443).

   Example

   $ openstack loadbalancer listener create --name listener1 \
   --protocol HTTPS --protocol-port 443 lb1 --wait

   Copy to Clipboard Toggle word wrap

4. Create the listener default pool (pool1).

   Example

   The command in this example creates an HTTPS pool that uses a private subnet containing back-end servers that host HTTPS applications configured with a TLS-encrypted web application on TCP port 443:

   $ openstack loadbalancer pool create --name pool1 \
   --lb-algorithm ROUND_ROBIN --listener listener1 \
   --protocol HTTPS --wait

   Copy to Clipboard Toggle word wrap

5. Create a health monitor (healthmon1) on the pool (pool1) of type (TLS-HELLO) that connects to the back-end servers and tests the path (/).

   Health checks can help to avoid a false positive. If no health monitor is defined, the member server is assumed to be ONLINE.

   Example

   $ openstack loadbalancer healthmonitor create --name healthmon1 \
   --delay 15 --max-retries 4 --timeout 10 --type TLS-HELLO \
   --url-path / pool1 --wait

   Copy to Clipboard Toggle word wrap

6. Add load balancer members (192.0.2.10 and 192.0.2.11) on the private subnet (private_subnet) to the default pool.

   Example

   In this example, the back-end servers, 192.0.2.10 and 192.0.2.11, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --name member1 --subnet-id \
   private_subnet --address 192.0.2.10 --protocol-port 443 pool1 --wait
   
   $ openstack loadbalancer member create --name member2 --subnet-id \
   private_subnet --address 192.0.2.11 --protocol-port 443 pool1 --wait

   Copy to Clipboard Toggle word wrap

Verification

1. View and verify the load balancer (lb1) settings.

   Example

   $ openstack loadbalancer show lb1

   Copy to Clipboard Toggle word wrap

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | admin_state_up      | True                                 |
   | created_at          | 2024-01-15T11:11:09                  |
   | description         |                                      |
   | flavor              |                                      |
   | id                  | 788fe121-3dec-4e1b-8360-4020642238b0 |
   | listeners           | 09f28053-fde8-4c78-88b9-0f191d84120e |
   | name                | lb1                                  |
   | operating_status    | ONLINE                               |
   | pools               | 627842b3-eed8-4f5f-9f4a-01a738e64d6a |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | provider            | amphora                              |
   | provisioning_status | ACTIVE                               |
   | updated_at          | 2024-01-15T11:12:42                  |
   | vip_address         | 198.51.100.11                        |
   | vip_network_id      | 9bca13be-f18d-49a5-a83d-9d487827fd16 |
   | vip_port_id         | 69a85edd-5b1c-458f-96f2-b4552b15b8e6 |
   | vip_qos_policy_id   | None                                 |
   | vip_subnet_id       | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   +---------------------+--------------------------------------+

   Copy to Clipboard Toggle word wrap

2. When a health monitor is present and functioning properly, you can check the status of each member.

   Example

   A working member (member1) has an ONLINE value for its operating_status.

   $ openstack loadbalancer member show pool1 member1

   Copy to Clipboard Toggle word wrap

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | address             | 192.0.2.10                           |
   | admin_state_up      | True                                 |
   | created_at          | 2024-01-15T11:11:09                  |
   | id                  | b85c807e-4d7c-4cbd-b725-5e8afddf80d2 |
   | name                | member1                              |
   | operating_status    | ONLINE                               |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | protocol_port       | 443                                  |
   | provisioning_status | ACTIVE                               |
   | subnet_id           | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   | updated_at          | 2024-01-15T11:12:42                  |
   | weight              | 1                                    |
   | monitor_port        | None                                 |
   | monitor_address     | None                                 |
   | backup              | False                                |
   +---------------------+--------------------------------------+

   Copy to Clipboard Toggle word wrap

Procedure

1. Combine the key (server.key), certificate (server.crt), and intermediate certificate chain (ca-chain.crt) into a single PKCS12 file (server.p12).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openssl pkcs12 -export -inkey server.key -in server.crt \
   -certfile ca-chain.crt -passout pass: -out server.p12

   Copy to Clipboard Toggle word wrap

   Note

   The following procedure does not work if you password protect the PKCS12 file.

2. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Copy to Clipboard Toggle word wrap

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   Copy to Clipboard Toggle word wrap

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

3. Use the Key Manager service to create a secret resource (tls_secret1) for the PKCS12 file.

   Example

   $ openstack secret store --name='tls_secret1' \
   -t 'application/octet-stream' -e 'base64' \
   --payload="$(base64 < server.p12)"

   Copy to Clipboard Toggle word wrap

4. Create a load balancer (lb1) on the public subnet (public_subnet).

   Example

   $ openstack loadbalancer create --name lb1 \
   --vip-subnet-id public_subnet --wait

   Copy to Clipboard Toggle word wrap

5. Create a TERMINATED_HTTPS listener (listener1), and reference the secret resource as the default TLS container for the listener.

   Example

   $ openstack loadbalancer listener create --protocol-port 443 \
   --protocol TERMINATED_HTTPS \
   --default-tls-container=\
   $(openstack secret list | awk '/ tls_secret1 / {print $2}') lb1 --wait

   Copy to Clipboard Toggle word wrap

6. Create a pool (pool1) and make it the default pool for the listener.

   Example

   The command in this example creates an HTTP pool that uses a private subnet containing back-end servers that host non-secure HTTP applications on TCP port 80:

   $ openstack loadbalancer pool create --name pool1 --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP --wait

   Copy to Clipboard Toggle word wrap

7. Create a health monitor (healthmon1) of type (HTTP) on the pool (pool1) that connects to the back-end servers and tests the path (/).

   Health checks can help to avoid a false positive. If no health monitor is defined, the member server is assumed to be ONLINE.

   Example

   $ openstack loadbalancer healthmonitor create --name healthmon1 \
   --delay 15 --max-retries 4 --timeout 10 --type HTTP --url-path / \
   pool1 --wait

   Copy to Clipboard Toggle word wrap

8. Add the non-secure HTTP back-end servers (192.0.2.10 and 192.0.2.11) on the private subnet (private_subnet) to the pool.

   Example

   In this example, the back-end servers, 192.0.2.10 and 192.0.2.11, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --name member1 --subnet-id \
   private_subnet --address 192.0.2.10 --protocol-port 443 pool1 --wait
   
   $ openstack loadbalancer member create --name member2 --subnet-id \
   private_subnet --address 192.0.2.11 --protocol-port 443 pool1 --wait

   Copy to Clipboard Toggle word wrap

Verification

1. View and verify the load balancer (lb1) settings.

   Example

   $ openstack loadbalancer show lb1

   Copy to Clipboard Toggle word wrap

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | admin_state_up      | True                                 |
   | created_at          | 2024-01-15T11:11:09                  |
   | description         |                                      |
   | flavor              |                                      |
   | id                  | 788fe121-3dec-4e1b-8360-4020642238b0 |
   | listeners           | 09f28053-fde8-4c78-88b9-0f191d84120e |
   | name                | lb1                                  |
   | operating_status    | ONLINE                               |
   | pools               | 627842b3-eed8-4f5f-9f4a-01a738e64d6a |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | provider            | amphora                              |
   | provisioning_status | ACTIVE                               |
   | updated_at          | 2024-01-15T11:12:42                  |
   | vip_address         | 198.51.100.11                        |
   | vip_network_id      | 9bca13be-f18d-49a5-a83d-9d487827fd16 |
   | vip_port_id         | 69a85edd-5b1c-458f-96f2-b4552b15b8e6 |
   | vip_qos_policy_id   | None                                 |
   | vip_subnet_id       | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   +---------------------+--------------------------------------+

   Copy to Clipboard Toggle word wrap

2. When a health monitor is present and functioning properly, you can check the status of each member.

   Example

   $ openstack loadbalancer member show pool1 member1

   Copy to Clipboard Toggle word wrap

   A working member (member1) has an ONLINE value for its operating_status:

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | address             | 192.0.2.10                           |
   | admin_state_up      | True                                 |
   | created_at          | 2024-01-15T11:11:09                  |
   | id                  | b85c807e-4d7c-4cbd-b725-5e8afddf80d2 |
   | name                | member1                              |
   | operating_status    | ONLINE                               |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | protocol_port       | 80                                   |
   | provisioning_status | ACTIVE                               |
   | subnet_id           | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   | updated_at          | 2024-01-15T11:12:42                  |
   | weight              | 1                                    |
   | monitor_port        | None                                 |
   | monitor_address     | None                                 |
   | backup              | False                                |
   +---------------------+--------------------------------------+

   Copy to Clipboard Toggle word wrap

Procedure

1. For each of the TLS certificates in the SNI list, combine the key (server.key), certificate (server.crt), and intermediate certificate chain (ca-chain.crt) into a single PKCS12 file (server.p12).

   In this example, you create two PKCS12 files (server.p12 and server2.p12) one for each certificate (www.example.com and www2.example.com).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openssl pkcs12 -export -inkey server.key -in server.crt \
   -certfile ca-chain.crt -passout pass: -out server.p12
   
   $ openssl pkcs12 -export -inkey server2.key -in server2.crt \
   -certfile ca-chain2.crt -passout pass: -out server2.p12

   Copy to Clipboard Toggle word wrap

2. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Copy to Clipboard Toggle word wrap

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   Copy to Clipboard Toggle word wrap

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

3. Use the Key Manager service to create secret resources (tls_secret1 and tls_secret2) for the PKCS12 file.

   Example

   $ openstack secret store --name='tls_secret1' \
   -t 'application/octet-stream' -e 'base64' \
   --payload="$(base64 < server.p12)"
   
   $ openstack secret store --name='tls_secret2' \
   -t 'application/octet-stream' -e 'base64' \
   --payload="$(base64 < server2.p12)"

   Copy to Clipboard Toggle word wrap

4. Create a load balancer (lb1) on the public subnet (public_subnet).

   Example

   $ openstack loadbalancer create --name lb1 \
   --vip-subnet-id public_subnet --wait

   Copy to Clipboard Toggle word wrap

5. Create a TERMINATED_HTTPS listener (listener1), and use SNI to reference both the secret resources.

   (Reference tls_secret1 as the default TLS container for the listener.)

   Example

   $ openstack loadbalancer listener create  --name listener1 \
   --protocol-port 443 --protocol TERMINATED_HTTPS \
   --default-tls-container=\
   $(openstack secret list | awk '/ tls_secret1 / {print $2}') \
   --sni-container-refs \
   $(openstack secret list | awk '/ tls_secret1 / {print $2}') \
   $(openstack secret list | awk '/ tls_secret2 / {print $2}') -- lb1 --wait

   Copy to Clipboard Toggle word wrap

6. Create a pool (pool1) and make it the default pool for the listener.

   Example

   The command in this example creates an HTTP pool that uses a private subnet containing back-end servers that host non-secure HTTP applications on TCP port 80:

   $ openstack loadbalancer pool create --name pool1 \
   --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP --wait

   Copy to Clipboard Toggle word wrap

7. Create a health monitor (healthmon1) of type (HTTP) on the pool (pool1) that connects to the back-end servers and tests the path (/).

   Health checks can help to avoid a false positive. If no health monitor is defined, the member server is assumed to be ONLINE.

   Example

   $ openstack loadbalancer healthmonitor create --name healthmon1 \
   --delay 15 --max-retries 4 --timeout 10 --type HTTP --url-path / \
   pool1 --wait

   Copy to Clipboard Toggle word wrap

8. Add the non-secure HTTP back-end servers (192.0.2.10 and 192.0.2.11) on the private subnet (private_subnet) to the pool.

   Example

   In this example, the back-end servers, 192.0.2.10 and 192.0.2.11, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --name member1 --subnet-id \
   private_subnet --address 192.0.2.10 --protocol-port 443 pool1 --wait
   
   $ openstack loadbalancer member create --name member2 --subnet-id \
   private_subnet --address 192.0.2.11 --protocol-port 443 pool1 --wait

   Copy to Clipboard Toggle word wrap

Verification

1. View and verify the load balancer (lb1) settings.

   Example

   $ openstack loadbalancer show lb1

   Copy to Clipboard Toggle word wrap

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | admin_state_up      | True                                 |
   | created_at          | 2024-01-15T11:11:09                  |
   | description         |                                      |
   | flavor              |                                      |
   | id                  | 788fe121-3dec-4e1b-8360-4020642238b0 |
   | listeners           | 09f28053-fde8-4c78-88b9-0f191d84120e |
   | name                | lb1                                  |
   | operating_status    | ONLINE                               |
   | pools               | 627842b3-eed8-4f5f-9f4a-01a738e64d6a |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | provider            | amphora                              |
   | provisioning_status | ACTIVE                               |
   | updated_at          | 2024-01-15T11:12:42                  |
   | vip_address         | 198.51.100.11                        |
   | vip_network_id      | 9bca13be-f18d-49a5-a83d-9d487827fd16 |
   | vip_port_id         | 69a85edd-5b1c-458f-96f2-b4552b15b8e6 |
   | vip_qos_policy_id   | None                                 |
   | vip_subnet_id       | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   +---------------------+--------------------------------------+

   Copy to Clipboard Toggle word wrap

2. When a health monitor is present and functioning properly, you can check the status of each member.

   Example

   $ openstack loadbalancer member show pool1 member1

   Copy to Clipboard Toggle word wrap

   Sample output

   A working member (member1) has an ONLINE value for its operating_status:

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | address             | 192.0.2.10                           |
   | admin_state_up      | True                                 |
   | created_at          | 2024-01-15T11:11:09                  |
   | id                  | b85c807e-4d7c-4cbd-b725-5e8afddf80d2 |
   | name                | member1                              |
   | operating_status    | ONLINE                               |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | protocol_port       | 80                                   |
   | provisioning_status | ACTIVE                               |
   | subnet_id           | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   | updated_at          | 2024-01-15T11:12:42                  |
   | weight              | 1                                    |
   | monitor_port        | None                                 |
   | monitor_address     | None                                 |
   | backup              | False                                |
   +---------------------+--------------------------------------+

   Copy to Clipboard Toggle word wrap

Procedure

1. Combine the key (server.key), certificate (server.crt), and intermediate certificate chain (ca-chain.crt) into a single PKCS12 file (server.p12).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Important

   When you create the PKCS12 file, do not password protect the file.

   Example

   In this example, the PKCS12 file is created without a password:

   $ openssl pkcs12 -export -inkey server.key -in server.crt \
   -certfile ca-chain.crt -passout pass: -out server.p12

   Copy to Clipboard Toggle word wrap

2. Use the Key Manager service to create a secret resource (tls_secret1) for the PKCS12 file.

   Example

   $ openstack secret store --name='tls_secret1' \
   -t 'application/octet-stream' -e 'base64' \
   --payload="$(base64 < server.p12)"

   Copy to Clipboard Toggle word wrap

3. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Copy to Clipboard Toggle word wrap

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   Copy to Clipboard Toggle word wrap

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

4. Create a load balancer (lb1) on the public subnet (public_subnet).

   Example

   $ openstack loadbalancer create --name lb1 --vip-subnet-id \
   public_subnet --wait

   Copy to Clipboard Toggle word wrap

5. Create a TERMINATED_HTTPS listener (listener1) and do the following:

   • reference the secret resource (tls_secret1) as the default TLS container for the listener.
   • set the ALPN protocol (h2).

   • set the fallback protocol if the client does not support HTTP/2 (http/1.1).

     Example

     $ openstack loadbalancer listener create --name listener1 \
     --protocol-port 443 --protocol TERMINATED_HTTPS --alpn-protocol h2 \
     --alpn-protocol http/1.1 --default-tls-container=\
     $(openstack secret list | awk '/ tls_secret1 / {print $2}') lb1 --wait

     Copy to Clipboard Toggle word wrap

6. Create a pool (pool1) and make it the default pool for the listener.

   Example

   The command in this example creates an HTTP pool containing back-end servers that host HTTP applications configured with a web application on TCP port 80:

   $ openstack loadbalancer pool create --name pool1 \
   --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP --wait

   Copy to Clipboard Toggle word wrap

7. Create a health monitor (healthmon1) of type (TCP) on the pool (pool1) that connects to the back-end servers.

   Health checks can help to avoid a false positive. If no health monitor is defined, the member server is assumed to be ONLINE.

   Example

   $ openstack loadbalancer healthmonitor create --name healthmon1 \
   --delay 15  --max-retries 4 --timeout 10 --type TCP pool1 --wait

   Copy to Clipboard Toggle word wrap

8. Add the HTTP back-end servers (192.0.2.10 and 192.0.2.11) on the private subnet (private_subnet) to the pool.

   Example

   In this example, the back-end servers, 192.0.2.10 and 192.0.2.11, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --name member1 --subnet-id \
   private_subnet --address 192.0.2.10 --protocol-port 80 pool1 --wait
   
   $ openstack loadbalancer member create --name member2 --subnet-id \
   private_subnet --address 192.0.2.11 --protocol-port 80 pool1 --wait

   Copy to Clipboard Toggle word wrap