Chapter 3. Creating the control plane

Procedure

1. Create a file on your workstation named openstack_control_plane.yaml to define the OpenStackControlPlane CR:

   apiVersion: core.openstack.org/v1beta1
   kind: OpenStackControlPlane
   metadata:
     name: openstack-control-plane

2. Specify the Secret CR you created to provide secure access to the RHOSO service pods in Providing secure access to the Red Hat OpenStack Services on OpenShift services:

   apiVersion: core.openstack.org/v1beta1
   kind: OpenStackControlPlane
   metadata:
     name: openstack-control-plane
   spec:
     secret: osp-secret

3. Specify the storageClass you created for your Red Hat OpenShift Container Platform (RHOCP) cluster storage back end:

   apiVersion: core.openstack.org/v1beta1
   kind: OpenStackControlPlane
   metadata:
     name: openstack-control-plane
   spec:
     secret: osp-secret
     storageClass: your-RHOCP-storage-class

   Note

   For information about storage classes, see Creating a storage class.

4. Add configuration for the following core, mandatory services:

   • Block Storage service (cinder):

       cinder:
         apiOverride:
           route: {}
         template:
           databaseInstance: openstack
           secret: osp-secret
           cinderAPI:
             override:
               service:
                 internal:
                   metadata:
                     annotations:
                       metallb.universe.tf/address-pool: internalapi
                       metallb.universe.tf/allow-shared-ip: internalapi
                       metallb.universe.tf/loadBalancerIPs: 172.17.0.80
                   spec:
                     type: LoadBalancer
           cinderScheduler:
             replicas: 1
           cinderBackup:
             networkAttachments:
             - storage
             replicas: 0 # backend needs to be configured
           cinderVolumes:
             volume1:
               networkAttachments:
               - storage
               replicas: 0 # backend needs to be configured

   • Compute service (nova):

       nova:
         apiOverride:
           route: {}
         template:
           apiServiceTemplate:
             override:
               service:
                 internal:
                   metadata:
                     annotations:
                       metallb.universe.tf/address-pool: internalapi
                       metallb.universe.tf/allow-shared-ip: internalapi
                       metallb.universe.tf/loadBalancerIPs: 172.17.0.80
                   spec:
                     type: LoadBalancer
           metadataServiceTemplate:
             override:
               service:
                 metadata:
                   annotations:
                     metallb.universe.tf/address-pool: internalapi
                     metallb.universe.tf/allow-shared-ip: internalapi
                     metallb.universe.tf/loadBalancerIPs: 172.17.0.80
                 spec:
                   type: LoadBalancer
           secret: osp-secret

     Note

     A full set of Compute services (nova) are deployed by default for each of the default cells, cell0 and cell1: nova-api, nova-metadata, nova-scheduler, and nova-conductor. The novncproxy service is also enabled for cell1 by default.

   • A Galera cluster for use by all RHOSO services (openstack), and a Galera cluster for use by the Compute service for cell1 (openstack-cell1):

       galera:
         templates:
           openstack:
             storageRequest: 5000M
             secret: osp-secret
             replicas: 3
           openstack-cell1:
             storageRequest: 5000M
             secret: osp-secret
             replicas: 3

   • Identity service (keystone)

       keystone:
         apiOverride:
           route: {}
         template:
           override:
             service:
               internal:
                 metadata:
                   annotations:
                     metallb.universe.tf/address-pool: internalapi
                     metallb.universe.tf/allow-shared-ip: internalapi
                     metallb.universe.tf/loadBalancerIPs: 172.17.0.80
                 spec:
                   type: LoadBalancer
           databaseInstance: openstack
           secret: osp-secret

   • Image service (glance):

       glance:
         apiOverrides:
           default:
             route: {}
         template:
           databaseInstance: openstack
           storageClass: ""
           storageRequest: 10G
           secret: osp-secret
           keystoneEndpoint: default
           glanceAPIs:
             default:
               type: single
               replicas: 1
               override:
                 service:
                   internal:
                     metadata:
                       annotations:
                         metallb.universe.tf/address-pool: internalapi
                         metallb.universe.tf/allow-shared-ip: internalapi
                         metallb.universe.tf/loadBalancerIPs: 172.17.0.80
                     spec:
                       type: LoadBalancer
               networkAttachments:
               - storage

     Note

     You must configure a back end for the Image service. If you do not configure a back end for the Image service, then the service is deployed but not activated (replicas: 0). For information about configuring a back end for the Image service, see the Configuring storage guide.

   • Key Management service (barbican):

       barbican
         apiOverride:
           route: {}
         template:
           databaseInstance: openstack
           secret: osp-secret
           barbicanAPI:
             replicas: 1
             override:
               service:
                 internal:
                   metadata:
                     annotations:
                       metallb.universe.tf/address-pool: internalapi
                       metallb.universe.tf/allow-shared-ip: internalapi
                       metallb.universe.tf/loadBalancerIPs: 172.17.0.80
                   spec:
                     type: LoadBalancer
           barbicanWorker:
             replicas: 1
           barbicanKeystoneListener:
             replicas: 1

   • Memcached:

       memcached:
         templates:
           memcached:
              replicas: 3

   • Networking service (neutron):

       neutron:
         apiOverride:
           route: {}
         template:
           replicas: 3
           override:
             service:
               internal:
                 metadata:
                   annotations:
                     metallb.universe.tf/address-pool: internalapi
                     metallb.universe.tf/allow-shared-ip: internalapi
                     metallb.universe.tf/loadBalancerIPs: 172.17.0.80
                 spec:
                   type: LoadBalancer
           databaseInstance: openstack
           secret: osp-secret
           networkAttachments:
           - internalapi

   • Object Storage service (swift):

       swift:
         enabled: true
         proxyOverride:
           route: {}
         template:
           swiftProxy:
             networkAttachments:
             - storage
             override:
               service:
                 internal:
                   metadata:
                     annotations:
                       metallb.universe.tf/address-pool: internalapi
                       metallb.universe.tf/allow-shared-ip: internalapi
                       metallb.universe.tf/loadBalancerIPs: 172.17.0.80
                   spec:
                     type: LoadBalancer
             replicas: 2
           swiftRing:
             ringReplicas: 3
           swiftStorage:
             networkAttachments:
             - storage
             replicas: 3
             storageClass: local-storage
             storageRequest: 10Gi

   • OVN:

       ovn:
         template:
           ovnDBCluster:
             ovndbcluster-nb:
               replicas: 3
               dbType: NB
               storageRequest: 10G
               networkAttachment: internalapi
             ovndbcluster-sb:
               dbType: SB
               storageRequest: 10G
               networkAttachment: internalapi
           ovnNorthd:
             networkAttachment: internalapi
           ovnController:
             networkAttachment: tenant
             nicMappings:
               <network_name: nic_name>

     • Replace <network_name> with the name of the network your gateway is on.
     • Replace <nic_name> with the name of the NIC connecting to the gateway network.
     • Optional: Add additional <network_name>:<nic_name> pairs under nicMappings as required.

   • Placement service (placement):

       placement:
         apiOverride:
           route: {}
         template:
           override:
             service:
               internal:
                 metadata:
                   annotations:
                     metallb.universe.tf/address-pool: internalapi
                     metallb.universe.tf/allow-shared-ip: internalapi
                     metallb.universe.tf/loadBalancerIPs: 172.17.0.80
                 spec:
                   type: LoadBalancer
           databaseInstance: openstack
           secret: osp-secret

   • RabbitMQ:

       rabbitmq:
         templates:
           rabbitmq:
             replicas: 3
             override:
               service:
                 metadata:
                   annotations:
                     metallb.universe.tf/address-pool: internalapi
                     metallb.universe.tf/loadBalancerIPs: 172.17.0.85
                 spec:
                   type: LoadBalancer
           rabbitmq-cell1:
              replicas: 3
              override:
                service:
                  metadata:
                    annotations:
                          metallb.universe.tf/address-pool: internalapi
                          metallb.universe.tf/loadBalancerIPs: 172.17.0.86
                    spec:
                      type: LoadBalancer

   • Telemetry service (ceilometer, prometheus):

       telemetry:
         enabled: true
         template:
           metricStorage:
             enabled: true
             monitoringStack:
               alertingEnabled: true
               scrapeInterval: 30s
               storage:
                 strategy: persistent
                 retention: 24h
                 persistent:
                   pvcStorageRequest: 20G
           autoscaling:
             enabled: false
             aodh:
               passwordSelectors:
               databaseUser: aodh
               databaseInstance: openstack
               memcachedInstance: memcached
               secret: osp-secret
             heatInstance: heat
           ceilometer:
             enabled: true
             secret: osp-secret
           logging:
             enabled: false
             network: internalapi
             ipaddr: <ip_address>

     • Replace <ip_address> with the IP address for your environment.

5. Create the control plane:

   $ oc create -f openstack_control_plane.yaml -n openstack

6. Wait until RHOCP creates the resources related to the OpenStackControlPlane CR. Run the following command to check the status:

   $ oc get openstackcontrolplane -n openstack
   NAME                                STATUS MESSAGE
   openstack-galera-network-isolation  Unknown Setup started

   The OpenStackControlPlane resources are created when the status is "Setup complete".

   Tip

   Append the -w option to the end of the get command to track deployment progress.

7. Optional: Confirm that the control plane is deployed by reviewing the pods in the openstack namespace:

   $ oc get pods -n openstack

   The control plane is deployed when all the pods are either completed or running.

Verification

1. Open a remote shell connection to the OpenStackClient pod:

   $ oc rsh -n openstack openstackclient

2. Confirm that the internal service endpoints are registered with each service:

   $ openstack endpoint list -c 'Service Name' -c Interface -c URL --service glance
   +--------------+-----------+---------------------------------------------------------------+
   | Service Name | Interface | URL                                                           |
   +--------------+-----------+---------------------------------------------------------------+
   | glance       | internal  | http://glance-internal.openstack.svc:9292                     |
   | glance       | public    | http://glance-public-openstack.apps.ostest.test.metalkube.org |
   +--------------+-----------+---------------------------------------------------------------+

3. Exit the OpenStackClient pod:

   $ exit

Procedure

1. Open your OpenStackControlPlane custom resource (CR) file, openstack_control_plane.yaml, on your workstation.

2. Add the following cellTemplates configuration to the nova service configuration:

     nova:
       apiOverride:
         route: {}
       template:
         ...
         secret: osp-secret
         cellTemplates:
           cell0:
             cellDatabaseUser: nova_cell0
             hasAPIAccess: true
           cell1:
             cellDatabaseUser: nova_cell1
             cellDatabaseInstance: openstack-cell1
             cellMessageBusInstance: rabbitmq-cell1
             hasAPIAccess: true
             novaComputeTemplates:
               compute-ironic: 1
                 computeDriver: ironic.IronicDriver

   1

   The name of the Compute service. The name has a limit of 20 characters, and must contain only lowercase alphanumeric characters and the - symbol.

3. Create the network that the ironic service pod attaches to, for example, baremetal. For more information about how to create an isolated network, see Preparing RHOCP for RHOSO network isolation.

4. Enable and configure the ironic service:

   spec:
     ...
     ironic:
       enabled: true
       template:
         rpcTransport: oslo
         databaseInstance: openstack
         ironicAPI:
           replicas: 1
           override:
             service:
               internal:
                 metadata:
                   annotations:
                     metallb.universe.tf/address-pool: internalapi
                     metallb.universe.tf/allow-shared-ip: internalapi
                     metallb.universe.tf/loadBalancerIPs: 172.17.0.80
                 spec:
                   type: LoadBalancer
         ironicConductors:
         - replicas: 1
           storageRequest: 10G
           networkAttachments:
           - baremetal 1
           provisionNetwork: baremetal
           customServiceConfig: |
             [neutron]
             cleaning_network = provisioning
             provisioning_network = provisioning
             rescuing_network = provisioning
         ironicInspector:
           replicas: 0
           networkAttachments:
           - baremetal
           inspectionNetwork: baremetal
         ironicNeutronAgent:
           replicas: 1
         secret: osp-secret

   1

   The NetworkAttachmentDefinition CR for your baremetal network.

5. Update the control plane:

   $ oc apply -f openstack_control_plane.yaml -n openstack

6. Wait until RHOCP creates the resources related to the OpenStackControlPlane CR. Run the following command to check the status:

   $ oc get openstackcontrolplane -n openstack
   NAME 							STATUS 	MESSAGE
   openstack-network-isolation-ironic 	Unknown 	Setup started

   The OpenStackControlPlane resources are created when the status is "Setup complete".

   Tip

   Append the -w option to the end of the get command to track deployment progress.

7. Confirm that the control plane is deployed by reviewing the pods in the openstack namespace:

   $ oc get pods -n openstack

   The control plane is deployed when all the pods are either completed or running.

Verification

1. Open a remote shell connection to the OpenStackClient pod:

   $ oc rsh -n openstack openstackclient

2. Confirm that the internal service endpoints are registered with each service:

   $ openstack endpoint list -c 'Service Name' -c Interface -c URL --service ironic
   +--------------+-----------+---------------------------------------------------------------+
   | Service Name | Interface | URL                                                           |
   +--------------+-----------+---------------------------------------------------------------+
   | ironic       | internal  | http://ironic-internal.openstack.svc:9292                     |
   | ironic       | public    | http://ironic-public-openstack.apps.ostest.test.metalkube.org |
   +--------------+-----------+---------------------------------------------------------------+

3. Exit the openstackclient pod:

   $ exit

Procedure

1. Open your OpenStackControlPlane custom resource (CR) file, openstack_control_plane.yaml, on your workstation.

2. Create a database server for each new cell that you want to add to your RHOSO environment:

   apiVersion: core.openstack.org/v1beta1
   kind: OpenStackControlPlane
   metadata:
     name: openstack-galera-network-isolation
   spec:
     secret: osp-secret
     storageClass: local-storage
     ...
     galera:
       enabled: true
       templates:
         openstack: 1
           storageRequest: 5G
           secret: cell0-secret
           replicas: 1
         openstack-cell1: 2
           storageRequest: 5G
           secret: cell1-secret
           replicas: 1
         openstack-cell2: 3
           storageRequest: 5G
           secret: cell2-secret
           replicas: 1

   1

   The database used by most of the RHOSO services, including the Compute services nova-api and nova-scheduler, and cell0.

   2

   The database to be used by cell1.

   3

   The database to be used by cell2.

3. Create a message bus with unique IPs for the load balancer for each new cell that you want to add to your RHOSO environment:

   apiVersion: core.openstack.org/v1beta1
   kind: OpenStackControlPlane
   metadata:
     name: openstack-galera-network-isolation
   spec:
     secret: osp-secret
     storageClass: local-storage
     ...
     rabbitmq:
       templates:
         rabbitmq: 1
           override:
             service:
               metadata:
                 annotations:
                   metallb.universe.tf/address-pool: internalapi
                   metallb.universe.tf/loadBalancerIPs: 172.17.0.85
               spec:
                 type: LoadBalancer
         rabbitmq-cell1: 2
           override:
             service:
               metadata:
                 annotations:
                   metallb.universe.tf/address-pool: internalapi
                   metallb.universe.tf/loadBalancerIPs: 172.17.0.86
               spec:
                 type: LoadBalancer
          rabbitmq-cell2: 3
          override:
            service:
              metadata:
                annotations:
                  metallb.universe.tf/address-pool: internalapi
                  metallb.universe.tf/loadBalancerIPs: 172.17.0.87
              spec:
                type: LoadBalancer

   1

   The message bus used by most of the RHOSO services, including the Compute services nova-api and nova-scheduler, and cell0.

   2

   The message bus to be used by cell1.

   3

   The message bus to be used by cell2.

4. Add the new cells to the cellTemplates configuration in the nova service configuration:

     nova:
       apiOverride:
         route: {}
       template:
         ...
         secret: osp-secret
         cellTemplates:
           cell0:
             cellDatabaseUser: nova_cell0
             hasAPIAccess: true
           cell1:
             cellDatabaseInstance: openstack-cell1
             cellDatabaseUser: nova_cell1
             cellMessageBusInstance: rabbitmq-cell1
             hasAPIAccess: true
           cell2: 1
             cellDatabaseInstance: openstack-cell2
             cellDatabaseUser: nova_cell1
             cellMessageBusInstance: rabbitmq-cell2
             hasAPIAccess: true

   1

   The name of the new Compute cell. The name has a limit of 20 characters, and must contain only lowercase alphanumeric characters and the - symbol. For more information about the properties you can configure for a cell, view the definition for the Nova CRD:

   $ oc describe crd nova

5. Update the control plane:

   $ oc apply -f openstack_control_plane.yaml -n openstack

6. Wait until RHOCP creates the resources related to the OpenStackControlPlane CR. Run the following command to check the status:

   $ oc get openstackcontrolplane -n openstack
   NAME 							STATUS 	MESSAGE
   openstack-galera-network-isolation 	Unknown 	Setup started

   The OpenStackControlPlane resources are created when the status is "Setup complete".

   Tip

   Append the -w option to the end of the get command to track deployment progress.

7. Optional: Confirm that the control plane is deployed by reviewing the pods in the openstack namespace for each of the cells you created:

   $ oc get pods -n openstack | grep cell2
   nova-cell2-conductor-0             1/1     Running     2               5d20h
   nova-cell2-novncproxy-0            1/1     Running     2               5d20h
   openstack-cell2-galera-0           1/1     Running     2               5d20h
   rabbitmq-cell2-server-0            1/1     Running     2               5d20h

   The control plane is deployed when all the pods are either completed or running.

8. Optional: Confirm that the new cells are created:

   $ oc exec -it nova-cell0-conductor-0 /bin/bash
   # nova-manage cell_v2 list_cells
   +-------+--------------------------------------+----------------------------------------------------------------------------------+------------------------------------------------------------+----------+| Name | UUID | Transport URL | Database Connection | Disabled |+-------+--------------------------------------+----------------------------------------------------------------------------------+------------------------------------------------------------+----------+| cell0 | 00000000-0000-0000-0000-000000000000 | rabbit: | mysql+pymysql://nova_cell0:****@openstack/nova_cell0 | False || cell1 | c5bf5e35-6677-40aa-80d0-33a440cac14e | rabbit://default_user_CuUVnXz-PvgzXvPxypU:****@rabbitmq-cell1.openstack.svc:5672 | mysql+pymysql://nova_cell1:****@openstack-cell1/nova_cell1 | False || cell2 | c5bf5e35-6677-40aa-80d0-33a440cac14e | rabbit://default_user_CuUVnXz-PvgzXvPxypU:****@rabbitmq-cell2.openstack.svc:5672 | mysql+pymysql://nova_cell2:****@openstack-cell2/nova_cell2| False |+-------+--------------------------------------+----------------------------------------------------------------------------------+------------------------------------------------------------+----------+

Procedure

1. Obtain the OpenStackControlPlane CR name:

   $ oc get openstackcontrolplanes

2. Enable the Dashboard service in the OpenStackControlPlane CR:

   $ oc patch openstackcontrolplanes/<openstackcontrolplane_name> -p='[{"op": "replace", "path": "/spec/horizon/enabled", "value": true}]' --type json

   • Replace <openstackcontrolplane_name> with the name of your OpenStackControlPlane CR, for example, openstack-galera-network-isolation.

3. Retrieve the Dashboard service endpoint URL:

   $ oc get horizons horizon -o jsonpath='{.status.endpoint}'

   Use this URL to access the Horizon interface.

Verification

1. To log in as the admin user, obtain the admin password from the AdminPassword parameter in the osp-secret secret:

   $ oc get secret osp-secret -o jsonpath='{.data.AdminPassword}' | base64 -d

2. Open a web browser.
3. Enter the Dashboard endpoint URL.
4. Log in to the dashboard with your username and password.