Chapter 2. Preparing Red Hat OpenShift Container Platform for Red Hat OpenStack Services on OpenShift

Procedure

1. Create the openstack project for the deployed RHOSO environment:

   $ oc new-project openstack

2. Ensure the openstack namespace is labeled to enable privileged pod creation by the OpenStack Operators:

   $ oc get namespace openstack -ojsonpath='{.metadata.labels}' | jq
   {
     "kubernetes.io/metadata.name": "openstack",
     "pod-security.kubernetes.io/enforce": "privileged",
     "security.openshift.io/scc.podSecurityLabelSync": "false"
   }

   If the security context constraint (SCC) is not "privileged", use the following commands to change it:

   $ oc label ns openstack security.openshift.io/scc.podSecurityLabelSync=false --overwrite
   $ oc label ns openstack pod-security.kubernetes.io/enforce=privileged --overwrite

3. Optional: To remove the need to specify the namespace when executing commands on the openstack namespace, set the default namespace to openstack:

   $ oc project openstack

Procedure

1. Create a Secret CR file on your workstation, for example, openstack_service_secret.yaml.

2. Add the following initial configuration to openstack_service_secret.yaml:

   apiVersion: v1
   data:
     AdminPassword: <base64_password>
     AodhPassword: <base64_password>
     AodhDatabasePassword: <base64_password>
     BarbicanDatabasePassword: <base64_password>
     BarbicanPassword: <base64_password>
     BarbicanSimpleCryptoKEK: <base64_fernet_key>
     CeilometerPassword: <base64_password>
     CinderDatabasePassword: <base64_password>
     CinderPassword: <base64_password>
     DatabasePassword: <base64_password>
     DbRootPassword: <base64_password>
     DesignateDatabasePassword: <base64_password>
     DesignatePassword: <base64_password>
     GlanceDatabasePassword: <base64_password>
     GlancePassword: <base64_password>
     HeatAuthEncryptionKey: <base64_password>
     HeatDatabasePassword: <base64_password>
     HeatPassword: <base64_password>
     IronicDatabasePassword: <base64_password>
     IronicInspectorDatabasePassword: <base64_password>
     IronicInspectorPassword: <base64_password>
     IronicPassword: <base64_password>
     KeystoneDatabasePassword: <base64_password>
     ManilaDatabasePassword: <base64_password>
     ManilaPassword: <base64_password>
     MetadataSecret: <base64_password>
     NeutronDatabasePassword: <base64_password>
     NeutronPassword: <base64_password>
     NovaAPIDatabasePassword: <base64_password>
     NovaAPIMessageBusPassword: <base64_password>
     NovaCell0DatabasePassword: <base64_password>
     NovaCell0MessageBusPassword: <base64_password>
     NovaCell1DatabasePassword: <base64_password>
     NovaCell1MessageBusPassword: <base64_password>
     NovaPassword: <base64_password>
     OctaviaDatabasePassword: <base64_password>
     OctaviaPassword: <base64_password>
     PlacementDatabasePassword: <base64_password>
     PlacementPassword: <base64_password>
     SwiftPassword: <base64_password>
   kind: Secret
   metadata:
     name: osp-secret
     namespace: openstack
   type: Opaque

   • Replace <base64_password> with a 32-character key that is base64 encoded. You can use the following command to manually generate a base64 encoded password:

     $ echo -n <password> | base64

     Alternatively, if you are using a Linux workstation and you are generating the Secret CR definition file by using a Bash command such as cat, you can replace <base64_password> with the following command to auto-generate random passwords for each service:

     $(tr -dc 'A-Za-z0-9' < /dev/urandom | head -c 32 | base64)

   • Replace the <base64_fernet_key> with a fernet key that is base64 encoded. You can use the following command to manually generate the fernet key:

     python3 -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode('UTF-8'))" | base64

   Note

   The HeatAuthEncryptionKey password must be a 32-character key for Orchestration service (heat) encryption. If you increase the length of the passwords for all other services, ensure that the HeatAuthEncryptionKey password remains at length 32.

3. Create the Secret CR in the cluster:

   $ oc create -f openstack_service_secret.yaml -n openstack

4. Verify that the Secret CR is created:

   $ oc describe secret osp-secret -n openstack