Chapter 3. Preparing for Red Hat Quay (high availability)

Procedure

1. On the first two systems, q01 and q02, install the HAProxy load balancer and the PostgreSQL database. This configures HAProxy as the access point and load balancer for the following services running on other systems:

   • Red Hat Quay (ports 80 and 443 on B systems)
   • Redis (port 6379 on B systems)
   • RADOS (port 7480 on C systems)

1. Open all HAProxy ports in SELinux and selected HAProxy ports in the firewall:

   # setsebool -P haproxy_connect_any=on
   # firewall-cmd --permanent --zone=public --add-port=6379/tcp --add-port=7480/tcp
   success
   # firewall-cmd --reload
   success

   Copy to Clipboard Toggle word wrap

1. Configure the /etc/haproxy/haproxy.cfg to point to the systems and ports providing the Red Hat Quay, Redis and Ceph RADOS services. The following are examples of defaults and added frontend and backend settings:

   #---------------------------------------------------------------------
   # common defaults that all the 'listen' and 'backend' sections will
   # use if not designated in their block
   #---------------------------------------------------------------------
   defaults
       mode                    tcp
       log                     global
       option                  httplog
       option                  dontlognull
       option http-server-close
       option forwardfor       except 127.0.0.0/8
       option                  redispatch
       retries                 3
       timeout http-request    10s
       timeout queue           1m
       timeout connect         10s
       timeout client          1m
       timeout server          1m
       timeout http-keep-alive 10s
       timeout check           10s
       maxconn                 3000
   
   #---------------------------------------------------------------------
   # main frontend which proxys to the backends
   #---------------------------------------------------------------------
   
   frontend  fe_http *:80
       default_backend             be_http
   frontend  fe_https *:443
       default_backend             be_https
   frontend fe_redis *:6379
      default_backend              be_redis
   frontend  fe_rdgw *:7480
       default_backend             be_rdgw
   backend be_http
       balance     roundrobin
       server quay01 quay01:80 check
       server quay02 quay02:80 check
       server quay03 quay03:80 check
   backend be_https
       balance     roundrobin
       server quay01 quay01:443 check
       server quay02 quay02:443 check
       server quay03 quay03:443 check
   backend be_rdgw
       balance     roundrobin
       server ceph01 ceph01:7480 check
       server ceph02 ceph02:7480 check
       server ceph03 ceph03:7480 check
   backend be_redis
   server quay01 quay01:6379 check inter 1s
   server quay02 quay02:6379 check inter 1s
   server quay03 quay03:6379 check inter 1s

   Copy to Clipboard Toggle word wrap

   After the new haproxy.cfg file is in place, restart the HAProxy service by entering the following command:

   # systemctl restart haproxy

   Copy to Clipboard Toggle word wrap

2. Create a folder for the PostgreSQL database by entering the following command:

   $ mkdir -p /var/lib/pgsql/data

   Copy to Clipboard Toggle word wrap

3. Set the following permissions for the /var/lib/pgsql/data folder:

   $ chmod 777 /var/lib/pgsql/data

   Copy to Clipboard Toggle word wrap

4. Enter the following command to start the PostgreSQL database:

   $ sudo podman run -d --name postgresql_database \
       -v /var/lib/pgsql/data:/var/lib/pgsql/data:Z  \
       -e POSTGRESQL_USER=quayuser -e POSTGRESQL_PASSWORD=quaypass \
       -e POSTGRESQL_DATABASE=quaydb -p 5432:5432 \
       registry.redhat.io/rhel8/postgresql-13:1-109

   Copy to Clipboard Toggle word wrap
   Note

   Data from the container will be stored on the host system in the /var/lib/pgsql/data directory.

5. List the available extensions by entering the following command:

   $ sudo podman exec -it postgresql_database /bin/bash -c 'echo "SELECT * FROM pg_available_extensions" | /opt/rh/rh-postgresql96/root/usr/bin/psql'

   Copy to Clipboard Toggle word wrap

   Example output

      name    | default_version | installed_version |           comment
   -----------+-----------------+-------------------+----------------------------------------
    adminpack | 1.0             |                   | administrative functions for PostgreSQL
   ...

   Copy to Clipboard Toggle word wrap

6. Create the pg_trgm extension by entering the following command:

   $ sudo podman exec -it postgresql_database /bin/bash -c 'echo "CREATE EXTENSION IF NOT EXISTS pg_trgm;" | /opt/rh/rh-postgresql96/root/usr/bin/psql -d quaydb'

   Copy to Clipboard Toggle word wrap

7. Confirm that the pg_trgm has been created by entering the following command:

   $ sudo podman exec -it postgresql_database /bin/bash -c 'echo "SELECT * FROM pg_extension" | /opt/rh/rh-postgresql96/root/usr/bin/psql'

   Copy to Clipboard Toggle word wrap

   Example output

    extname | extowner | extnamespace | extrelocatable | extversion | extconfig | extcondition
   ---------+----------+--------------+----------------+------------+-----------+--------------
    plpgsql |       10 |           11 | f              | 1.0        |           |
    pg_trgm |       10 |         2200 | t              | 1.3        |           |
   (2 rows)

   Copy to Clipboard Toggle word wrap

8. Alter the privileges of the Postgres user quayuser and grant them the superuser role to give the user unrestricted access to the database:

   $ sudo podman exec -it postgresql_database /bin/bash -c 'echo "ALTER USER quayuser WITH SUPERUSER;" | /opt/rh/rh-postgresql96/root/usr/bin/psql'

   Copy to Clipboard Toggle word wrap

   Example output

   ALTER ROLE

   Copy to Clipboard Toggle word wrap

9. If you have a firewalld service active on your system, run the following commands to make the PostgreSQL port available through the firewall:

   # firewall-cmd --permanent --zone=trusted --add-port=5432/tcp

   Copy to Clipboard Toggle word wrap

   # firewall-cmd --reload

   Copy to Clipboard Toggle word wrap

10. Optional. If you do not have the postgres CLI package installed, install it by entering the following command:

    # yum install postgresql -y

    Copy to Clipboard Toggle word wrap

11. Use the psql command to test connectivity to the PostgreSQL database.

    Note

    To verify that you can access the service remotely, run the following command on a remote system.

    # psql -h localhost quaydb quayuser

    Copy to Clipboard Toggle word wrap

    Example output

    Password for user test:
    psql (9.2.23, server 9.6.5)
    WARNING: psql version 9.2, server version 9.6.
             Some psql features might not work.
    Type "help" for help.
    
    test=> \q

    Copy to Clipboard Toggle word wrap

1. Install / Deploy Redis: Run Redis as a container on each of the three quay0* systems:

   # mkdir -p /var/lib/redis
   # chmod 777 /var/lib/redis
   # sudo podman run -d -p 6379:6379 \
       -v /var/lib/redis:/var/lib/redis/data:Z \
       registry.redhat.io/rhel8/redis-5

   Copy to Clipboard Toggle word wrap

2. Check redis connectivity: You can use the telnet command to test connectivity to the redis service. Type MONITOR (to begin monitoring the service) and QUIT to exit:

   # yum install telnet -y
   # telnet 192.168.122.99 6379
   Trying 192.168.122.99...
   Connected to 192.168.122.99.
   Escape character is '^]'.
   MONITOR
   +OK
   +1525703165.754099 [0 172.17.0.1:43848] "PING"
   QUIT
   +OK
   Connection closed by foreign host.

   Copy to Clipboard Toggle word wrap