Chapter 3. Deploying the Load-balancing service in an existing environment

Procedure

1. Generate a Base64, encoded password.

   Retain the encoded output to use in a later step.

   Example

   In this example, the password, my_password is encoded using the Base64 encoding scheme:

   $ echo -n my_password | base64

2. Create a Secret CR file on your workstation, for example, octavia-ca-passphrase.yaml.

3. Add the following configuration to octavia-ca-passphrase.yaml:

   apiVersion: v1
   data:
     server-ca-passphrase: <Base64_password>
   kind: Secret
   metadata:
     name: octavia-ca-passphrase
     namespace: openstack
   type: Opaque

   • Replace the <Base64_password> with the Base64-encoded password that you created earlier.

4. Create the Secret CR in the cluster:

   $ oc create -f octavia-ca-passphrase.yaml

Procedure

1. Using the Skopeo utility, obtain the amphora image version. You will need the image version in a SHA format for a later step:

   $ podman login registry.redhat.io
   
   $ sudo dnf install -y skopeo
   
   $ skopeo inspect docker://registry.redhat.io/rhoso/\
   octavia-amphora-image-rhel9:$(oc get openstackversion \
   -o jsonpath='{.items[0].status.deployedVersion}' | \
   awk -F '-' '{print $1}') --format '{{.Name}}@{{.Digest}}'

2. Open your OpenStackControlPlane CR file, and enable the Load-balancing service (octavia) by adding the following service configuration:

   apiVersion: core.openstack.org/v1beta1
   kind: OpenStackControlPlane
   metadata:
     name: openstack-control-plane
     namespace: openstack
     spec:
   ...
       octavia:
         enabled: true
         template:
           octaviaHousekeeping:
             networkAttachments:
               - octavia
           octaviaHealthManager:
             networkAttachments:
               - octavia
           octaviaWorker:
             networkAttachments:
               - octavia
   ...

3. With the amphora image version that you obtained in an earlier step, use the octavia.template.amphoraImageContainerImage parameter to add the amphora image to the Image service (glance):

   Example

   ...
       octavia:
         enabled: true
         template:
           octaviaHousekeeping:
             networkAttachments:
               - octavia
           octaviaHealthManager:
             networkAttachments:
               - octavia
           octaviaWorker:
             networkAttachments:
               - octavia
           amphoraImageContainerImage: registry.redhat.io/rhoso/\
           octavia-amphora-image-rhel9@sha256:312cd5e8ea9fe261c1929aefececbeb22afe5e433ae76ef0860d98e561db21c9
   ...

4. Optional: to enable flow resumption, perform the following steps.

   For more information, see Avoiding taskflow interruptions by using flow resumption.

   1. Create the octavia-redis database in Redis by adding the schema name, octavia-redis:, and the number of replicas, replicas: 1:

      apiVersion: core.openstack.org/v1beta1
      kind: OpenStackControlPlane
      metadata:
        name: openstack-control-plane
        namespace: openstack
        spec:
      ...
          redis:
            enabled: true
            templates:
              octavia-redis:
                replicas: 1
      ...

   2. Enable the octavia-redis database by adding the line, redisServiceName: octavia-redis:

      apiVersion: core.openstack.org/v1beta1
      kind: OpenStackControlPlane
      metadata:
        name: openstack-control-plane
        namespace: openstack
        spec:
      ...
          octavia:
            enabled: true
            template:
              databaseInstance: <Galera_CR>
              redisServiceName: octavia-redis
              octaviaHousekeeping:
                networkAttachments:
                  - octavia
              octaviaHealthManager:
                networkAttachments:
                  - octavia
              octaviaWorker:
                networkAttachments:
                  - octavia
      ...

5. Locate the service configuration for ovn, and add the following configuration under template:

   ...
     ovn:
       template:
         ovnController:
           networkAttachment: tenant
           nicMappings:
             octavia: octbr

   • networkAttachment - Note the one-character difference between the OVN networkAttachment property and the octavia networkAttachments property. The name tenant is an example value.
   • nicMappings - The value must be octavia: octbr.

6. Update the OpenStackControlPlane custom resource with the required values for the Load-balancing service.

   Example

   $ oc apply -f openstack_control_plane.yaml -n openstack

Verification

1. Wait until RHOCP creates the Load-balancing service resources. Run the following command to check the status:

   $ oc wait octavia octavia --for condition=Ready

   Sample output

   You should see output similar to the following:

   octavia.octavia.openstack.org/octavia condition met

2. Confirm that the Load-balancing service pods are running:

   $ oc get pods | grep octavia

   Sample output

   You should see output similar to the following:

   octavia-api-78b56bb844-ngjhc                  2/2     Running     0          12s
   octavia-healthmanager-f6hpx                   1/1     Running     0          14s
   octavia-housekeeping-knwpf                    1/1     Running     0          10s
   octavia-redis-redis-0                         2/2     Running     0          20s
   octavia-rsyslog-4nkv8                         1/1     Running     0          23s
   octavia-worker-l5hs4                          1/1     Running     0          26s

3. Access the remote shell for the OpenStackClient pod from your workstation:

   $ oc rsh -n openstack openstackclient

4. Confirm that the networks octavia-provider-net and lb-mgmt-net are present:

   $ openstack network list -f yaml

   Sample output

   - ID: 2e4fc309-546b-4ac8-9eae-aa8d70a27a9b
     Name: octavia-provider-net
     Subnets:
     - eea45073-6e56-47fd-9153-12f7f49bc115
   - ID: 77881d3f-04b0-46cb-931f-d54003cce9f0
     Name: lb-mgmt-net
     Subnets:
     - e4ab96af-8077-4971-baa4-e0d40a16f55a

   The network, octavia-provider-net, is the external provider network, and is limited to the RHOSO control plane. The lb-mgmt-net network connects the Load-balancing service to amphora instances.

5. Exit the openstackclient pod:

   $ exit