使用 Red Hat OpenStack Platform director Operator 环境

流程

1. 以具有适当权限的用户身份登录 Compute 节点主机。

2. 列出主机上运行的实例：

   $ sudo machinectl list

   输出示例

   MACHINE                  CLASS SERVICE      OS VERSION ADDRESSES
   qemu-1-instance-000000b9 vm    libvirt-qemu -  -       -
   qemu-2-instance-000000c2 vm    libvirt-qemu -  -       -
   
   2 machines listed.

3. 验证 systemd-machined 服务是否正在运行：

   $ sudo systemctl status systemd-machined.service

   输出示例

   systemd-machined.service - Virtual Machine and Container Registration Service
        Loaded: loaded (/usr/lib/systemd/system/systemd-machined.service; static)
        Active: active (running) since Mon 2025-06-16 11:42:07 EDT; 2min 48s ago
          Docs: man:systemd-machined.service(8)
                man:org.freedesktop.machine1(5)
      Main PID: 136614 (systemd-machine)
        Status: "Processing requests..."
         Tasks: 1 (limit: 838860)
        Memory: 1.4M
           CPU: 33ms
        CGroup: /system.slice/systemd-machined.service
                └─136614 /usr/lib/systemd/systemd-machined
   
   Jun 16 11:42:07 computehost001 systemd[1]: Starting Virtual Machine and Container Registration Service...
   Jun 16 11:42:07 computehost001 systemd[1]: Started Virtual Machine and Container Registration Service.
   Jun 16 11:43:44 computehost001 systemd-machined[136614]: New machine qemu-1-instance-000000b9.
   Jun 16 11:43:51 computehost001 systemd-machined[136614]: New machine qemu-2-instance-000000c2.

   重要

   如果 systemd-machined 服务正在运行，请跳过这个过程的其余部分。确保您验证 systemd-machined 服务是否正在运行集群中的每个 Compute 节点主机。

4. 如果 systemd-machined 服务没有运行，在安装 systemd-container 软件包之前，先从主机实时迁移所有虚拟机。有关实时迁移的更多信息，请参阅 执行 Red Hat OpenStack Platform 次要更新中的重新启动计算节点。https://docs.redhat.com/en/documentation/red_hat_openstack_platform/17.1/html/performing_a_minor_update_of_red_hat_openstack_platform/assembly_rebooting-the-overcloud_keeping-updated#proc_rebooting-compute-nodes_rebooting-the-overcloud

5. 在主机上安装 systemd-container:

   • 如果您从早期版本的 Red Hat OpenStack Platform 升级了您的环境，请重启 Compute 主机来自动安装 systemd-container。

   • 如果您部署了新的 RHOSO 环境，请使用以下命令手动安装 systemd-container。不需要重新引导 Compute 主机：

     $ sudo dnf -y install systemd-container

     注意

     如果您的 Compute 主机没有运行虚拟机，您可以自动安装 systemd-container 或手动安装。

6. 在 systemd-machined 服务没有运行的集群中，在集群中的每个 Compute 主机上重复此步骤。

1. 删除自定义策略。
2. 运行采用。
3. 使用新的 SRBAC 语法重新添加自定义策略。

流程

1. 根据您的环境配置 /etc/os-diff/os-diff.cfg 文件和 /etc/os-diff/ssh.config 文件。要允许 os-diff 连接到云并从 config.yaml 文件中描述的服务拉取文件，您必须在 os-diff.cfg 文件中设置以下选项：

   [Default]
   
   local_config_dir=/tmp/
   service_config_file=config.yaml
   
   [Tripleo]
   
   ssh_cmd=ssh -F ssh.config 

   1

   
   director_host=standalone 

   2

   
   container_engine=podman
   connection=ssh
   remote_config_path=/tmp/tripleo
   local_config_path=/tmp/
   
   [Openshift]
   
   ocp_local_config_path=/tmp/ocp
   connection=local
   ssh_cmd=""

   1

   指示 os-diff 通过 SSH 访问 director Operator 主机。默认值为 ssh -F ssh.config。但是，您可以在不使用 ssh.config 文件的情况下设置值，例如 ssh -i /home/user/.ssh/id_rsa stack@my.undercloud.local。

   2

   用于访问云的主机，并且 podman/docker 二进制文件已安装，并允许与正在运行的容器交互。您可以将此键留空。

2. 如果您使用主机文件连接到云，请将 ssh.config 文件配置为允许 os-diff 访问 RHOSP 环境，例如：

   Host *
       IdentitiesOnly yes
   
   Host virthost
       Hostname virthost
       IdentityFile ~/.ssh/id_rsa
       User root
       StrictHostKeyChecking no
       UserKnownHostsFile=/dev/null
   
   
   Host standalone
       Hostname standalone
       IdentityFile <path to SSH key>
       User root
       StrictHostKeyChecking no
       UserKnownHostsFile=/dev/null
   
   Host crc
       Hostname crc
       IdentityFile ~/.ssh/id_rsa
       User stack
       StrictHostKeyChecking no
       UserKnownHostsFile=/dev/null

   • 将 <path to SSH key > 替换为 SSH 密钥的路径。您必须为 IdentityFile 提供值，才能获得对 RHOSP 环境的完整工作访问权限。

3. 如果使用清单文件连接到云，请从 Ansible 清单生成 ssh.config 文件，例如 tripleo-ansible-inventory.yaml 文件：

   $ os-diff configure -i tripleo-ansible-inventory.yaml -o ssh.config --yaml

流程

1. 登录到部署 RHOSP OSPdO 的 RHOCP 环境，并更改到托管 RHOSP 部署的项目：

   $ oc project openstack

2. 定义通用环境变量：

   export PASSWORD_FILE="tripleo-passwords.yaml"
   
   export RHOSO18_NAMESPACE="rhoso"
   
   export OSPDO_NAMESPACE="openstack"
   
   export OS_CLIENT="oc exec -c openstackclient -t openstackclient -- "
   
   export CONTROLLER_SSH="oc rsh -n $OSPDO_NAMESPACE -c openstackclient openstackclient ssh controller-0.ctlplane"
   
   export CONTROLLER1_SSH="oc -n $OSPDO_NAMESPACE rsh -c openstackclient openstackclient ssh controller-0.ctlplane"
   export CONTROLLER2_SSH=
   export CONTROLLER3_SSH=
   
   export OSPDO_INTERNAL_API_NET="internalapi"
   
   export STORAGE_CLASS=$(oc get -n $OSPDO_NAMESPACE pvc openstackclient-hosts -o jsonpath='{.spec.storageClassName}')

3. 获取运行当前 RHOSP Controller 虚拟机(VM)的节点的名称：

   $ export CONTROLLER_NODE=$(oc -n $OSPDO_NAMESPACE get vmi -ojson | jq -r '.items[0].status.nodeName')

4. 如果您将 master/worker 集群与高可用性 OSPdO 环境结合使用，请将 OSPdO 配置为使用单个 RHOSP Controller 节点：

   1. 禁用 stonith ：

      $ stonith_resources=$($CONTROLLER1_SSH sudo pcs stonith status|grep Started|awk '{print $2}')
      for resource in stonith_resources ;do $CONTROLLER1_SSH sudo pcs stonith disable $resource;done

   2. 将非Controller 节点置于维护状态：

      $CONTROLLER1_SSH sudo pcs node maintenance <controller-1> <controller-2>

      • 将 <controller -1& gt; 和 & lt;controller-2> 替换为环境中 Controller 节点的名称。

   3. 为单一节点更新仲裁：

      $CONTROLLER1_SSH sudo systemctl stop corosync
      $CONTROLLER2_SSH sudo systemctl stop corosync
      $CONTROLLER3_SSH sudo systemctl stop corosync
      $CONTROLLER1_SSH sudo pcs quorum update last_man_standing=1 wait_for_all=1
      $CONTROLLER1_SSH sudo systemctl restart corosync

   4. 重启 Pacemaker 集群：

      $CONTROLLER1_SSH sudo pcs cluster stop
      $CONTROLLER1_SSH sudo pcs cluster start

   5. 检查是否只启动 Controller-0，并且其他 2 Controller 是否已停止：

      $CONTROLLER_SSH sudo pcs status

   6. 检查 RHOSP control plane 是否仍然可以正常工作：

      $OS_CLIENT openstack compute service list

      注意

      您可能需要等待几分钟，以便 control plane 正常运行。此时，control plane 响应会减慢。

   7. 当 Pacemaker 只管理其中一个控制器时，删除 Controller 虚拟机的 2。以下示例指定了要删除的 Controller-1 和 Controller-2 虚拟机：

      $ oc -n "${OSPDO_NAMESPACE}"annotate vm controller-1 osp-director.openstack.org/delete-host=true
      $ oc -n "${OSPDO_NAMESPACE}"annotate vm controller-2 osp-director.openstack.org/delete-host=true

   8. 将 OpenStackControlPlane CR 中的 Controller 角色的 roleCount 减小到 1：

      $ oc -n "${OSPDO_NAMESPACE}"patch OpenStackControlPlane overcloud --type json -p '[{"op": "replace", "path":"/spec/virtualMachineRoles/controller/roleCount", "value": 1}]'

   9. 确保 OpenStackClient 容器集与剩余的 Controller 虚拟机在同一 RHOCP 节点上运行。如果 OpenStackClient pod 没有在同一节点上，则通过封锁到 RHOSO 的两个节点来移动它。然后，您将删除 OpenStackClient pod，以便在具有剩余的 Controller 虚拟机的 RHOCP 节点上重新调度。pod 移到正确的节点后，取消协调所有节点：

      $ oc adm cordon $OSP18_NODE1
      $ oc adm cordon $OSP18_NODE2
      $ oc delete pod openstackclient
      $ oc adm uncordon $OSP18_NODE1
      $ oc adm uncordon $OSP18_NODE2

   10. 通过将 nodeSelector 放置到包含 Controller 虚拟机的 RHOCP 节点上，从没有运行 Controller 虚拟机的其他两个节点中删除 OSPdO 节点网络配置策略：

       $ for i in br-ctlplane br-ex br-osp; do oc patch osnetconfig openstacknetconfig --type json -p '[{"op": "replace", "path": "/spec/attachConfigurations/'$i'/nodeNetworkConfigurationPolicy/nodeSelector", "value": {"kubernetes.io/hostname": "'$CONTROLLER_NODE'"}}]'; done

流程

1. 将剩余的两个节点的主机名保存到 RHOSO_NODES 变量中：

   $ RHOSO_NODES=$(oc get nodes -o name | grep -v $CONTROLLER_NODE | sed 's#node/##g' | tr '\n' ' ')

2. 提取要用于 RHOSO 安装和标签节点的节点：

   $ export RHOSO18_NODE1=$(echo "${RHOSO_NODES}" | cut -d ' ' -f 1)
   $ export RHOSO18_NODE2=$(echo "${RHOSO_NODES}" | cut -d ' ' -f 2)
   $ oc label nodes "${RHOSO18_NODE1}" type=openstack
   $ oc label nodes "${RHOSO18_NODE2}" type=openstack

3. 创建一个新命名空间，用于安装 RHOSO。您必须在与 director Operator (OSPdO)不同的命名空间中安装 RHOSO：

   $ oc get namespace ${RHOSO18_NAMESPACE} 2>/dev/null || {
       oc create namespace ${RHOSO18_NAMESPACE} || {
           echo "Failed to create namespace ${RHOSO18_NAMESPACE}"
           exit 1
       }
       oc project ${RHOSO18_NAMESPACE}
   }

4. 为 RHOSO 创建自定义节点网络配置策略：

   注意

   节点网络配置策略使用 nodeSelector 属性限制为 OSP18_NODE1/2。新节点网络配置策略会镜像现有节点网络配置策略。在以下示例中，子网范围会被重复使用。此外，OSPdO 将网桥用于控制，外部接口会重复。

   $ oc apply -f - <<EOF
   apiVersion: nmstate.io/v1
   kind: NodeNetworkConfigurationPolicy
   metadata:
     labels:
       osp/interface: enp7s0
     name: enp7s0-<RHOSO18_NODE1>
   spec:
     desiredState:
       dns-resolver:
         config:
           search: []
           server:
           - 172.22.0.1
       interfaces:
       - description: internalapi vlan interface
         name: enp7s0.20
         state: up
         type: vlan
         vlan:
           base-iface: enp7s0
           id: 20
           reorder-headers: true
         ipv4:
           address:
           - ip: 172.17.0.5
             prefix-length: 24
           enabled: true
           dhcp: false
         ipv6:
           enabled: false
       - description: storage vlan interface
         name: enp7s0.30
         state: up
         type: vlan
         vlan:
           base-iface: enp7s0
           id: 30
           reorder-headers: true
         ipv4:
           address:
           - ip: 172.18.0.5
             prefix-length: 24
           enabled: true
           dhcp: false
         ipv6:
           enabled: false
       - description: tenant vlan interface
         name: enp7s0.50
         state: up
         type: vlan
         vlan:
           base-iface: enp7s0
           id: 50
           reorder-headers: true
         ipv4:
           address:
           - ip: 172.19.0.5
             prefix-length: 24
           enabled: true
           dhcp: false
         ipv6:
           enabled: false
       - description: storagemgmt vlan interface
         name: enp7s0.40
         state: up
         type: vlan
         vlan:
           base-iface: enp7s0
           id: 40
           reorder-headers: true
         ipv4:
           address:
           - ip: 172.20.0.5
             prefix-length: 24
           enabled: true
           dhcp: false
         ipv6:
           enabled: false
       - description: Configuring Bridge ospbr with interface enp1s0
         name: br-ctlplane
         mtu: 1500
         type: linux-bridge
         state: up
         bridge:
           options:
             stp:
               enabled: false
           port:
             - name: enp1s0
               vlan: {}
         ipv4:
           address:
           - ip: 172.22.0.51
             prefix-length: 24
           enabled: true
           dhcp: false
         ipv6:
           enabled: false
       - description: external bridge
         name: br-external
         type: linux-bridge
         mtu: 1500
         ipv6:
           enabled: false
         ipv4:
           enabled: false
         bridge:
           options:
             stp:
               enabled: false
           port:
           - name: enp6s0
     nodeSelector:
       kubernetes.io/hostname: <RHOSO18_NODE1>
       node-role.kubernetes.io/worker: ""
   EOF

   • 将 <RHOSO18_NODE 1> 替换为节点的名称。

5. 为每个隔离网络应用 RHOSO 的 NetworkAttachmentDefinition 自定义资源，以将服务 pod 附加到网络：

   $ oc apply -f - <<EOF
   apiVersion: k8s.cni.cncf.io/v1
   kind: NetworkAttachmentDefinition
   metadata:
     name: ctlplane
   spec:
     config: |
       {
         "cniVersion": "0.3.1",
         "name": "ctlplane",
         "type": "bridge",
         "master": "br-ctlplane",
         "ipam": {
           "type": "whereabouts",
           "range": "172.22.0.0/24",
           "range_start": "172.22.0.30",
           "range_end": "172.22.0.70"
         }
       }
   ---
   apiVersion: k8s.cni.cncf.io/v1
   kind: NetworkAttachmentDefinition
   metadata:
     name: internalapi
   spec:
     config: |
       {
         "cniVersion": "0.3.1",
         "name": "internalapi",
         "type": "macvlan",
         "master": "enp7s0.20",
         "ipam": {
           "type": "whereabouts",
           "range": "172.17.0.0/24",
           "range_start": "172.17.0.30",
           "range_end": "172.17.0.70"
         }
       }
   ---
   apiVersion: k8s.cni.cncf.io/v1
   kind: NetworkAttachmentDefinition
   metadata:
     name: external
   spec:
     config: |
       {
         "cniVersion": "0.3.1",
         "name": "external",
         "type": "macvlan",
         "master": "br-external",
         "ipam": {
           "type": "whereabouts",
           "range": "10.0.0.0/24",
           "range_start": "10.0.0.30",
           "range_end": "10.0.0.70"
         }
       }
   ---
   apiVersion: k8s.cni.cncf.io/v1
   kind: NetworkAttachmentDefinition
   metadata:
     name: storage
   spec:
     config: |
       {
         "cniVersion": "0.3.1",
         "name": "storage",
         "type": "macvlan",
         "master": "enp7s0.30",
         "ipam": {
           "type": "whereabouts",
           "range": "172.18.0.0/24",
           "range_start": "172.18.0.30",
           "range_end": "172.18.0.70"
         }
       }
   ---
   apiVersion: k8s.cni.cncf.io/v1
   kind: NetworkAttachmentDefinition
   metadata:
     name: storagemgmt
   spec:
     config: |
       {
         "cniVersion": "0.3.1",
         "name": "storagemgmt",
         "type": "macvlan",
         "master": "enp7s0.40",
         "ipam": {
           "type": "whereabouts",
           "range": "172.19.0.0/24",
           "range_start": "172.19.0.30",
           "range_end": "172.19.0.70"
         }
       }
   ---
   apiVersion: k8s.cni.cncf.io/v1
   kind: NetworkAttachmentDefinition
   metadata:
     name: tenant
   spec:
     config: |
       {
         "cniVersion": "0.3.1",
         "name": "tenant",
         "type": "macvlan",
         "master": "enp7s0.50",
         "ipam": {
           "type": "whereabouts",
           "range": "172.20.0.0/24",
           "range_start": "172.20.0.30",
           "range_end": "172.20.0.70"
         }
       }
   EOF

   • 将 <RHOSO18_NAMESPACE& gt; 替换为您的 OpenStack 18 命名空间。

6. 确保 OVNKubernetes IPForwarding 字段设置为 enabled ：

   $ oc patch network.operator cluster -p '{"spec":{"defaultNetwork":{"ovnKubernetesConfig":{"gatewayConfig":{"ipForwarding": "Global"}}}}}' --type=merge

7. 从 OSPdO 中提取并保存密码：

   $ oc get secret tripleo-passwords -n $OSPDO_NAMESPACE -o json | jq -r '.data["tripleo-overcloud-passwords.yaml"]' | base64 -d >"${PASSWORD_FILE}" || {
       echo "ERROR: Failed to extract passwords from OSPdO"
       exit 1
   }

8. 安装 RHOSO 操作器。如需更多信息，请参阅在 OpenShift 上部署 Red Hat OpenStack Services 中的 安装和准备 Operator。

9. 应用与新的 OpenStack 18 部署匹配的 IPAddressPool 资源，以配置哪些 IP 可用作虚拟 IP (VIP)：

   $ oc apply -f - <<EOF
   apiVersion: metallb.io/v1beta1
   kind: IPAddressPool
   ...

10. 应用 L2Advertisement 资源来定义如何宣布 VIP：

    $ cat << EOF | oc apply -f -
    apiVersion: metallb.io/v1beta1
    kind: L2Advertisement

先决条件

1. 定义以下 shell 变量：将示例值替换为您的环境正确的值：

   注意

   如果您使用 IPv6，请定义没有方括号的 SOURCE_MARIADB_IP 值。例如，SOURCE_MARIADB_IP=fd00:bbbb::2。

   $ PASSWORD_FILE="$HOME/overcloud-passwords.yaml"
   $ MARIADB_IMAGE=registry.redhat.io/rhoso/openstack-mariadb-rhel9:18.0
   $ declare -A TRIPLEO_PASSWORDS
   $ CELLS="default"
   $ for CELL in $(echo $CELLS); do
   >    TRIPLEO_PASSWORDS[$CELL]="$PASSWORD_FILE"
   > done
   $ oc get secret tripleo-passwords -o json | jq -r '.data["tripleo-overcloud-passwords.yaml"]' | base64 -d >"${TRIPLEO_PASSWORDS[$CELLS]}"
   $ declare -A SOURCE_DB_ROOT_PASSWORD
   $ for CELL in $(echo $CELLS); do
   >     SOURCE_DB_ROOT_PASSWORD[$CELL]=$(cat ${TRIPLEO_PASSWORDS[$CELL]} | grep ' MysqlRootPassword:' | awk -F ': ' '{ print $2; }')
   > done

   • 您只能在源云上部署单个 Compute 服务单元。

2. 获取运行 RHOSP Controller 虚拟机的 RHOCP 节点的名称：

   $ export CONTROLLER_NODE=$(oc get vmi -ojson | jq -r '.items[0].status.nodeName')
   $ export SOURCE_OVN_OVSDB_IP=172.17.0.160 # get this from the source OVN DB

3. 在 tripleo-exports-default ConfigMap 的 ctlplane-export.yaml 部分查找 mysql 服务 IP：

   $ cpexport=$(oc get cm tripleo-exports-default -o json | jq -r '.data["ctlplane-export.yaml"]')
   $ declare -A SOURCE_MARIADB_IP
   $ for CELL in $(echo $CELLS); do
   >     SOURCE_MARIADB_IP[$CELL]=$(echo "$cpexport" | sed -e '0,/ MysqlInternal/d' | sed -n '0,/host_nobrackets/s/^.*host_nobrackets\:\s*\(.*\)$/\1/p')
   > done
   $ RUN_OVERRIDES='{
   >     "apiVersion": "v1",
   >     "metadata": {
   >         "annotations": {
   >             "k8s.v1.cni.cncf.io/networks": "[{\"name\": \"internalapi-static\",\"namespace\": \"openstack\", \"ips\":[\"172.17.0.99/24\"]}]"
   >         }
   >     },
   >     "spec": {
   >         "nodeName": "'"$CONTROLLER_NODE"'",
   >         "securityContext": {
   >             "allowPrivilegeEscalation": false,
   >             "capabilities": {
   >                 "drop": ["ALL"]
   >             },
   >             "runAsNonRoot": true,
   >             "seccompProfile": {
   >                 "type": "RuntimeDefault"
   >             }
   >         }
   >     }
   > }'

   • mariadb-client 需要在运行 RHOSP Controller 节点的同一 Red Hat OpenShift Container Platform (RHOCP)节点上运行。另外，内部api-static 网络需要附加到 pod。

4. 定义以下 shell 变量：将示例值替换为您的环境正确的值：

   $ MARIADB_RUN_OVERRIDES="--overrides=${RUN_OVERRIDES} $MARIADB_CLIENT_ANNOTATIONS"
   
   $ CONTROLLER1_SSH="oc rsh -c openstackclient openstackclient ssh controller-0.ctlplane"
   $ oc get secret tripleo-passwords -o json | jq -r '.data["tripleo-overcloud-passwords.yaml"]' |
   base64 -d >"${PASSWORD_FILE}"
   
   $ declare -A SOURCE_MARIADB_IP
   $ SOURCE_MARIADB_IP[default]=*<galera cluster VIP>*

   • 为源 director Operator 云的任何非单元控制器提供 CONTROLLER1_SSH 设置。
   • 对于 CELLS 中定义的每个单元，将 SOURCE_MARIADB_IP[*]= ... 替换为源 director Operator 云的单元名称和 VIP 地址的记录列表，包括源 director Operator 云的单元。

   • 要获取 SOURCE_MARIADB_IP 的值，请在 Controller 节点上查询 puppet-generated 配置：

     $ sudo grep -rI 'listen mysql' -A10 /var/lib/config-data/puppet-generated/ | grep bind

     注意

     源云始终对单元数据库使用相同的密码。因此，相同的密码文件用于所有单元堆栈。但是，split-stack 拓扑允许为每个堆栈使用不同的密码文件。

流程

1. 导出以下输出的 shell 变量，并测试到 RHOSP 数据库的连接：

   $ unset PULL_OPENSTACK_CONFIGURATION_DATABASES
   $ declare -xA PULL_OPENSTACK_CONFIGURATION_DATABASES
   $ for CELL in $(echo $CELLS); do
   >     PULL_OPENSTACK_CONFIGURATION_DATABASES[$CELL]=$(oc run mariadb-client-1-$CELL ${MARIADB_RUN_OVERRIDES} -q --image ${MARIADB_IMAGE} -i --rm --restart=Never -- \
   >         mysql -rsh "${SOURCE_MARIADB_IP[$CELL]}" -uroot -p"${SOURCE_DB_ROOT_PASSWORD[$CELL]}" -e 'SHOW databases;')
   > done

   如果连接成功，则预期的输出不会进行任何操作。

   注意

   nova、nova_api 和 nova_cell0 数据库包含在主 overcloud Orchestration 服务(heat)堆栈的同一数据库主机上。

2. 在 RHOSP 数据库上运行 mysqlcheck 以检查是否存在不准确：

   $ unset PULL_OPENSTACK_CONFIGURATION_MYSQLCHECK_NOK
   $ declare -xA PULL_OPENSTACK_CONFIGURATION_MYSQLCHECK_NOK
   $ run_mysqlcheck() {
   >     PULL_OPENSTACK_CONFIGURATION_MYSQLCHECK_NOK=$(oc run mariadb-client-2-$1 ${MARIADB_RUN_OVERRIDES} -q --image ${MARIADB_IMAGE} -i --rm --restart=Never -- \
   >         mysqlcheck --all-databases -h ${SOURCE_MARIADB_IP[$CELL]} -u root -p"${SOURCE_DB_ROOT_PASSWORD[$CELL]}" | grep -v OK)
   > }
   $ for CELL in $(echo $CELLS); do
   >     run_mysqlcheck $CELL
   > done
   $ if [ "$PULL_OPENSTACK_CONFIGURATION_MYSQLCHECK_NOK" != "" ]; then
   >     for CELL in $(echo $CELLS); do
   >         MYSQL_UPGRADE=$(oc run mariadb-client-3 ${MARIADB_RUN_OVERRIDES} -q --image ${MARIADB_IMAGE} -i --rm --restart=Never -- \
   >             mysql_upgrade -v -h ${SOURCE_MARIADB_IP[$CELL]} -u root -p"${SOURCE_DB_ROOT_PASSWORD[$CELL]}")
   >         # rerun mysqlcheck to check if problem is resolved
   >         run_mysqlcheck
   >     done
   > fi

3. 获取 Compute 服务(nova)单元映射：

   export PULL_OPENSTACK_CONFIGURATION_NOVADB_MAPPED_CELLS=$(oc run mariadb-client-1 ${MARIADB_RUN_OVERRIDES} -q --image ${MARIADB_IMAGE} -i --rm --restart=Never -- \
       mysql -rsh "${SOURCE_MARIADB_IP['default']}" -uroot -p"${SOURCE_DB_ROOT_PASSWORD['default']}" nova_api -e \
       'select uuid,name,transport_url,database_connection,disabled from cell_mappings;')

4. 获取注册的 Compute 服务的主机名：

   $ unset PULL_OPENSTACK_CONFIGURATION_NOVA_COMPUTE_HOSTNAMES
   $ declare -xA PULL_OPENSTACK_CONFIGURATION_NOVA_COMPUTE_HOSTNAMES
   $ for CELL in $(echo $CELLS); do
   >     PULL_OPENSTACK_CONFIGURATION_NOVA_COMPUTE_HOSTNAMES[$CELL]=$(oc run mariadb-client-4-$CELL ${MARIADB_RUN_OVERRIDES} -q --image ${MARIADB_IMAGE} -i --rm --restart=Never -- \
   >         mysql -rsh "${SOURCE_MARIADB_IP[$CELL]}" -uroot -p"${SOURCE_DB_ROOT_PASSWORD[$CELL]}" -e \
   >             "select host from nova.services where services.binary='nova-compute' and deleted=0;")
   > done

5. 获取映射的 Compute 服务单元列表：

   export PULL_OPENSTACK_CONFIGURATION_NOVAMANAGE_CELL_MAPPINGS=$($CONTROLLER1_SSH sudo podman exec -it nova_conductor nova-manage cell_v2 list_cells)

6. 存储导出的变量以供以后使用：

   $ unset SRIOV_AGENTS
   $ declare -xA SRIOV_AGENTS 

   1

   
   $ for CELL in $(echo $CELLS); do
   >     RCELL=$CELL
   >     [ "$CELL" = "$DEFAULT_CELL_NAME" ] && RCELL=default
   >     cat > ~/.source_cloud_exported_variables_$CELL << EOF
   > unset PULL_OPENSTACK_CONFIGURATION_DATABASES
   > unset PULL_OPENSTACK_CONFIGURATION_MYSQLCHECK_NOK
   > unset PULL_OPENSTACK_CONFIGURATION_NOVA_COMPUTE_HOSTNAMES
   > declare -xA PULL_OPENSTACK_CONFIGURATION_DATABASES
   > declare -xA PULL_OPENSTACK_CONFIGURATION_MYSQLCHECK_NOK
   > declare -xA PULL_OPENSTACK_CONFIGURATION_NOVA_COMPUTE_HOSTNAMES
   > PULL_OPENSTACK_CONFIGURATION_DATABASES[$CELL]="$(oc run mariadb-client-5-$CELL ${MARIADB_RUN_OVERRIDES} -q --image ${MARIADB_IMAGE} -i --rm --restart=Never -- \
   >     mysql -rsh ${SOURCE_MARIADB_IP[$RCELL]} -uroot -p${SOURCE_DB_ROOT_PASSWORD[$RCELL]} -e 'SHOW databases;')"
   > PULL_OPENSTACK_CONFIGURATION_MYSQLCHECK_NOK[$CELL]="$(oc run mariadb-client-6-$CELL ${MARIADB_RUN_OVERRIDES} -q --image ${MARIADB_IMAGE} -i --rm --restart=Never -- \
   >     mysqlcheck --all-databases -h ${SOURCE_MARIADB_IP[$RCELL]} -u root -p${SOURCE_DB_ROOT_PASSWORD[$RCELL]} | grep -v OK)"
   > PULL_OPENSTACK_CONFIGURATION_NOVA_COMPUTE_HOSTNAMES[$CELL]="$(oc run mariadb-client-7-$CELL ${MARIADB_RUN_OVERRIDES} -q --image ${MARIADB_IMAGE} -i --rm --restart=Never -- \
   >     mysql -rsh ${SOURCE_MARIADB_IP[$RCELL]} -uroot -p${SOURCE_DB_ROOT_PASSWORD[$RCELL]} -e \
   >     "select host from nova.services where services.binary='nova-compute' and deleted=0;")"
   > if [ "$RCELL" = "default" ]; then
   >     PULL_OPENSTACK_CONFIGURATION_NOVADB_MAPPED_CELLS="$(oc run mariadb-client-2 ${MARIADB_RUN_OVERRIDES} -q --image ${MARIADB_IMAGE} -i --rm --restart=Never -- \
   >         mysql -rsh ${SOURCE_MARIADB_IP[$RCELL]} -uroot -p${SOURCE_DB_ROOT_PASSWORD[$RCELL]} nova_api -e \
   >             'select uuid,name,transport_url,database_connection,disabled from cell_mappings;')"
   >     PULL_OPENSTACK_CONFIGURATION_NOVAMANAGE_CELL_MAPPINGS="$($CONTROLLER1_SSH sudo podman exec -it nova_conductor nova-manage cell_v2 list_cells)"
   > fi
   > EOF
   > done
   $ chmod 0600 ~/.source_cloud_exported_variables*

   1

   如果在 RHOSP 部署中运行 neutron-sriov-nic-agent 代理，获取用于数据平面的配置。

流程

1. 确保您在使用要部署 control plane 的 Red Hat OpenShift Container Platform (RHOCP)命名空间：

   $ oc project openstack

2. 创建 RHOSP secret。如需更多信息，请参阅在 OpenShift 上部署 Red Hat OpenStack Services 中的 为 Red Hat OpenStack Services 提供安全访问 OpenShift 服务。

3. 如果 $ADMIN_PASSWORD 与您在 osp-secret 中设置的密码不同，请修改 osp-secret 中的 AdminPassword 键：

   $ oc set data secret/osp-secret "AdminPassword=$ADMIN_PASSWORD"

4. 在 osp-secret 中设置服务帐户密码，以匹配原始部署中的服务帐户密码：

   $ oc set data secret/osp-secret "AodhPassword=$AODH_PASSWORD"
   $ oc set data secret/osp-secret "BarbicanPassword=$BARBICAN_PASSWORD"
   $ oc set data secret/osp-secret "CeilometerPassword=$CEILOMETER_PASSWORD"
   $ oc set data secret/osp-secret "CinderPassword=$CINDER_PASSWORD"
   $ oc set data secret/osp-secret "GlancePassword=$GLANCE_PASSWORD"
   $ oc set data secret/osp-secret "HeatAuthEncryptionKey=$HEAT_AUTH_ENCRYPTION_KEY"
   $ oc set data secret/osp-secret "HeatPassword=$HEAT_PASSWORD"
   $ oc set data secret/osp-secret "HeatStackDomainAdminPassword=$HEAT_STACK_DOMAIN_ADMIN_PASSWORD"
   $ oc set data secret/osp-secret "IronicPassword=$IRONIC_PASSWORD"
   $ oc set data secret/osp-secret "IronicInspectorPassword=$IRONIC_PASSWORD"
   $ oc set data secret/osp-secret "ManilaPassword=$MANILA_PASSWORD"
   $ oc set data secret/osp-secret "MetadataSecret=$METADATA_SECRET"
   $ oc set data secret/osp-secret "NeutronPassword=$NEUTRON_PASSWORD"
   $ oc set data secret/osp-secret "NovaPassword=$NOVA_PASSWORD"
   $ oc set data secret/osp-secret "OctaviaPassword=$OCTAVIA_PASSWORD"
   $ oc set data secret/osp-secret "PlacementPassword=$PLACEMENT_PASSWORD"
   $ oc set data secret/osp-secret "SwiftPassword=$SWIFT_PASSWORD"

5. 部署 OpenStackControlPlane CR。确保您只启用 DNS、Galera、Memcached 和 RabbitMQ 服务。所有其他服务必须禁用：

   $ oc apply -f - <<EOF
   apiVersion: core.openstack.org/v1beta1
   kind: OpenStackControlPlane
   metadata:
     name: openstack
   spec:
     secret: osp-secret
     storageClass: <storage_class> 

   1

   
   
   
     barbican:
       enabled: false
       template:
         barbicanAPI: {}
         barbicanWorker: {}
         barbicanKeystoneListener: {}
   
     cinder:
       enabled: false
       template:
         cinderAPI: {}
         cinderScheduler: {}
         cinderBackup: {}
         cinderVolumes: {}
   
     dns:
       template:
         override:
           service:
             metadata:
               annotations:
                 metallb.universe.tf/address-pool: <address_pool> 

   2

   
                 metallb.universe.tf/allow-shared-ip: <address_pool>
                 metallb.universe.tf/loadBalancerIPs: <loadBalancer_IP> 

   3

   
             spec:
               type: LoadBalancer
         options:
         - key: server
           values:
           - 192.168.122.1
         replicas: 1
   
     glance:
       enabled: false
       template:
         glanceAPIs: {}
   
     heat:
       enabled: false
       template: {}
   
     horizon:
       enabled: false
       template: {}
   
     ironic:
       enabled: false
       template:
         ironicConductors: []
   
     keystone:
       enabled: false
       template: {}
   
     manila:
       enabled: false
       template:
         manilaAPI: {}
         manilaScheduler: {}
         manilaShares: {}
   
     galera:
       enabled: true
       templates:
         openstack:
           secret: osp-secret
           replicas: 3
           storageRequest: 5G
         openstack-cell1: 

   4

   
           secret: osp-secret
           replicas: 3
           storageRequest: 5G
         openstack-cell2:
           secret: osp-secret
           replicas: 1
           storageRequest: 5G
         openstack-cell3:
           secret: osp-secret
           replicas: 1
           storageRequest: 5G
     memcached:
       enabled: true
       templates:
         memcached:
           replicas: 3
   
     neutron:
       enabled: false
       template: {}
   
     nova:
       enabled: false
       template: {}
   
     ovn:
       enabled: false
       template:
         ovnController:
           networkAttachment: tenant
           nodeSelector:
             node: non-existing-node-name
         ovnNorthd:
           replicas: 0
         ovnDBCluster:
           ovndbcluster-nb:
             replicas: 3
             dbType: NB
             networkAttachment: <networkAttachment_name> 

   5

   
           ovndbcluster-sb:
             replicas: 3
             dbType: SB
             networkAttachment: <networkAttachment_name>
   
     placement:
       enabled: false
       template: {}
   
     rabbitmq:
       templates:
         rabbitmq:
           override:
             service:
               metadata:
                 annotations:
                   metallb.universe.tf/address-pool: internalapi
                   metallb.universe.tf/loadBalancerIPs: 172.17.0.85
               spec:
                 type: LoadBalancer
         rabbitmq-cell1:
           persistence:
             storage: 1G
           override:
             service:
               metadata:
                 annotations:
                   metallb.universe.tf/address-pool: <networkAttachment_name>
                   metallb.universe.tf/loadBalancerIPs: <loadBalancer_IP>
               spec:
                 type: LoadBalancer
         rabbitmq-cell2:
           persistence:
             storage: 1G
           override:
             service:
               metadata:
                 annotations:
                   metallb.universe.tf/address-pool: internalapi
                   metallb.universe.tf/loadBalancerIPs: 172.17.0.87
               spec:
                 type: LoadBalancer
         rabbitmq-cell3:
           persistence:
             storage: 1G
           override:
             service:
               metadata:
                 annotations:
                   metallb.universe.tf/address-pool: internalapi
                   metallb.universe.tf/loadBalancerIPs: 172.17.0.88
               spec:
                 type: LoadBalancer
     telemetry:
       enabled: false
   
     tls: 

   6

   
       podLevel:
         enabled: false
       ingress:
         enabled: false
   
     swift:
       enabled: false
       template:
         swiftRing:
           ringReplicas: 1
         swiftStorage:
           replicas: 0
         swiftProxy:
           replicas: 1
   EOF

   1

   在 RHOCP 集群中选择一个现有的 < storage_class >。

   2

   将 <address_pool > 替换为网络定义的名称。

   3

   将 <loadBalancer_IP& gt; 替换为 LoadBalancer IP 地址。

   4

   本例为 3 个计算单元提供所需的基础架构数据库和消息传递服务，名为 cell1、 cell2 和 cell3。根据需要，调整每个 Compute 单元 的副本、存储 或storage Request 等字段的值。

   5

   将 <networkAttachment_name > 替换为您的网络的名称。

   6

   如果您在 RHOSP 环境中启用了 TLS-e，在 spec:tls 部分将 tls 设置为以下内容：

   spec:
     ...
     tls:
       podLevel:
         enabled: true
         internal:
           ca:
             customIssuer: rootca-internal
         libvirt:
           ca:
             customIssuer: rootca-internal
         ovn:
           ca:
             customIssuer: rootca-internal
       ingress:
         ca:
           customIssuer: rootca-internal
         enabled: true

流程

1. 创建包含 Red Hat Ceph Storage 配置的 ceph-conf-files secret：

   $ oc apply -f - <<EOF
   apiVersion: v1
   data:
     ceph.client.openstack.keyring: $CEPH_KEY
     ceph.conf: $CEPH_CONF
   kind: Secret
   metadata:
     name: ceph-conf-files
   type: Opaque
   EOF

   文件的内容应类似以下示例：

   apiVersion: v1
   kind: Secret
   metadata:
     name: ceph-conf-files
   stringData:
     ceph.client.openstack.keyring: |
       [client.openstack]
           key = <secret key>
           caps mgr = "allow *"
           caps mon = "allow r, profile rbd"
           caps osd = "pool=vms, profile rbd pool=volumes, profile rbd pool=images, allow rw pool manila_data'
     ceph.conf: |
       [global]
       fsid = 7a1719e8-9c59-49e2-ae2b-d7eb08c695d4
       mon_host = 10.1.1.2,10.1.1.3,10.1.1.4 

   1

   1

   如果您使用 IPv6，请将括号用于 mon_host。例如： mon_host = [v2:[fd00:cc::100]:3300/0,v1:[fd00:cccc::100]:6789/0]

2. 在 OpenStackControlPlane CR 中，将 ceph.conf 和 ceph.client.openstack.keyring 注入传播列表中定义的 RHOSP 服务。例如：

   $ oc patch openstackcontrolplane openstack --type=merge --patch '
   spec:
     extraMounts:
       - name: v1
         region: r1
         extraVol:
           - propagation:
             - CinderVolume
             - CinderBackup
             - GlanceAPI
             - ManilaShare
             extraVolType: Ceph
             volumes:
             - name: ceph
               projected:
                 sources:
                 - secret:
                     name: ceph-conf-files
             mounts:
             - name: ceph
               mountPath: "/etc/ceph"
               readOnly: true
   '

流程

1. 如果您的部署通过 NFS 作为共享文件系统服务(manila)的后端启用 CephFS，请删除以下 Pacemaker 排序和共同定位约束，以管理 ceph-nfs 服务和 manila-share 服务的虚拟 IP 地址：

   # check the co-location and ordering constraints concerning "manila-share"
   sudo pcs constraint list --full
   
   # remove these constraints
   sudo pcs constraint remove colocation-openstack-manila-share-ceph-nfs-INFINITY
   sudo pcs constraint remove order-ceph-nfs-openstack-manila-share-Optional

2. 禁用 RHOSP control plane 服务：

   # Update the services list to be stopped
   ServicesToStop=("tripleo_aodh_api.service"
                   "tripleo_aodh_api_cron.service"
                   "tripleo_aodh_evaluator.service"
                   "tripleo_aodh_listener.service"
                   "tripleo_aodh_notifier.service"
                   "tripleo_ceilometer_agent_central.service"
                   "tripleo_ceilometer_agent_notification.service"
                   "tripleo_octavia_api.service"
                   "tripleo_octavia_health_manager.service"
                   "tripleo_octavia_rsyslog.service"
                   "tripleo_octavia_driver_agent.service"
                   "tripleo_octavia_housekeeping.service"
                   "tripleo_octavia_worker.service"
                   "tripleo_horizon.service"
                   "tripleo_keystone.service"
                   "tripleo_barbican_api.service"
                   "tripleo_barbican_worker.service"
                   "tripleo_barbican_keystone_listener.service"
                   "tripleo_cinder_api.service"
                   "tripleo_cinder_api_cron.service"
                   "tripleo_cinder_scheduler.service"
                   "tripleo_cinder_volume.service"
                   "tripleo_cinder_backup.service"
                   "tripleo_collectd.service"
                   "tripleo_glance_api.service"
                   "tripleo_gnocchi_api.service"
                   "tripleo_gnocchi_metricd.service"
                   "tripleo_gnocchi_statsd.service"
                   "tripleo_manila_api.service"
                   "tripleo_manila_api_cron.service"
                   "tripleo_manila_scheduler.service"
                   "tripleo_neutron_api.service"
                   "tripleo_placement_api.service"
                   "tripleo_nova_api_cron.service"
                   "tripleo_nova_api.service"
                   "tripleo_nova_conductor.service"
                   "tripleo_nova_metadata.service"
                   "tripleo_nova_scheduler.service"
                   "tripleo_nova_vnc_proxy.service"
                   "tripleo_aodh_api.service"
                   "tripleo_aodh_api_cron.service"
                   "tripleo_aodh_evaluator.service"
                   "tripleo_aodh_listener.service"
                   "tripleo_aodh_notifier.service"
                   "tripleo_ceilometer_agent_central.service"
                   "tripleo_ceilometer_agent_compute.service"
                   "tripleo_ceilometer_agent_ipmi.service"
                   "tripleo_ceilometer_agent_notification.service"
                   "tripleo_ovn_cluster_northd.service"
                   "tripleo_ironic_neutron_agent.service"
                   "tripleo_ironic_api.service"
                   "tripleo_ironic_inspector.service"
                   "tripleo_ironic_conductor.service")
   
   PacemakerResourcesToStop=("openstack-cinder-volume"
                             "openstack-cinder-backup"
                             "openstack-manila-share")
   
   echo "Stopping systemd OpenStack services"
   for service in ${ServicesToStop[*]}; do
           SSH_CMD=CONTROLLER_SSH
           if [ ! -z "${!SSH_CMD}" ]; then
               echo "Stopping the $service in controller $i"
               if ${!SSH_CMD} sudo systemctl is-active $service; then
                   ${!SSH_CMD} sudo systemctl stop $service
               fi
           fi
   done
   
   echo "Checking systemd OpenStack services"
   for service in ${ServicesToStop[*]}; do
       for i in {1..3}; do
           SSH_CMD=CONTROLLER${i}_SSH
           if [ ! -z "${!SSH_CMD}" ]; then
               if ! ${!SSH_CMD} systemctl show $service | grep ActiveState=inactive >/dev/null; then
                   echo "ERROR: Service $service still running on controller $i"
               else
                   echo "OK: Service $service is not running on controller $i"
               fi
           fi
       done
   done
   
   echo "Stopping pacemaker OpenStack services"
       SSH_CMD=CONTROLLER_SSH
       if [ ! -z "${!SSH_CMD}" ]; then
           echo "Using controller $i to run pacemaker commands"
           for resource in ${PacemakerResourcesToStop[*]}; do
               if ${!SSH_CMD} sudo pcs resource config $resource &>/dev/null; then
                   echo "Stopping $resource"
                   ${!SSH_CMD} sudo pcs resource disable $resource
               else
                   echo "Service $resource not present"
               fi
           break
       fi
   done
   
   echo "Checking pacemaker OpenStack services"
       SSH_CMD=CONTROLLER_SSH
       if [ ! -z "${!SSH_CMD}" ]; then
           echo "Using controller $i to run pacemaker commands"
           for resource in ${PacemakerResourcesToStop[*]}; do
               if ${!SSH_CMD} sudo pcs resource config $resource &>/dev/null; then
                   if ! ${!SSH_CMD} sudo pcs resource status $resource | grep Started; then
                       echo "OK: Service $resource is stopped"
                   else
                       echo "ERROR: Service $resource is started"
                   fi
               fi
           done
           break
       fi

   如果每个服务的状态为 OK，则服务成功停止。

流程

1. 检查每个单元中的源 Galera 数据库集群是否在线并同步：

   $ for CELL in $(echo $CELLS); do
   >   MEMBERS=SOURCE_GALERA_MEMBERS_$(echo ${CELL}|tr '[:lower:]' '[:upper:]')[@]
   >   for i in "${!MEMBERS}"; do
   >     echo "Checking for the database node $i WSREP status Synced"
   >     oc rsh mariadb-copy-data mysql \
   >       -h "$i" -uroot -p"${SOURCE_DB_ROOT_PASSWORD[$CELL]}" \
   >       -e "show global status like 'wsrep_local_state_comment'" | \
   >       grep -qE "\bSynced\b"
   >   done
   > done

   每个额外的 Compute 服务(nova) v2 单元运行一个专用的 Galera 数据库集群，因此命令会检查每个单元。

2. 获取具有 NOK (not-OK)状态的源数据库计数：

   $ for CELL in $(echo $CELLS); do
   >   oc rsh mariadb-copy-data mysql -h "${SOURCE_MARIADB_IP[$CELL]}" -uroot -p"${SOURCE_DB_ROOT_PASSWORD[$CELL]}" -e "SHOW databases;"
   > end

3. 检查 mysqlcheck 是否没有错误：

   $ for CELL in $(echo $CELLS); do
   >   set +u
   >   . ~/.source_cloud_exported_variables_$CELL
   >   set -u
   > done
   $ test -z "$PULL_OPENSTACK_CONFIGURATION_MYSQLCHECK_NOK"  || [ "x$PULL_OPENSTACK_CONFIGURATION_MYSQLCHECK_NOK" = "x " ] && echo "OK" || echo "CHECK FAILED"

4. 测试到 control plane upcall 和 cells 数据库的连接：

   $ for CELL in $(echo "super $RENAMED_CELLS"); do
   >   oc run mariadb-client --image $MARIADB_IMAGE -i --rm --restart=Never -- \
   >     mysql -rsh "${PODIFIED_MARIADB_IP[$CELL]}" -uroot -p"${PODIFIED_DB_ROOT_PASSWORD[$CELL]}" -e 'SHOW databases;'
   > done

   注意

   您必须通过从 cell1 开始，删除单元数据库中的旧服务记录，将稍后导入的 Compute 服务转换为超级编排器架构。新记录注册了由 Compute 服务操作器提供的不同主机名。除 Compute 代理外的所有 Compute 服务都没有内部状态，您可以安全地删除其服务记录。您还需要将前 一个默认的 单元重命名为 DEFAULT_CELL_NAME。

5. 创建原始数据库的转储：

   $ for CELL in $(echo $CELLS); do
   >   oc rsh mariadb-copy-data << EOF
   >     mysql -h"${SOURCE_MARIADB_IP[$CELL]}" -uroot -p"${SOURCE_DB_ROOT_PASSWORD[$CELL]}" \
   >     -N -e "show databases" | grep -E -v "schema|mysql|gnocchi|aodh" | \
   >     while read dbname; do
   >       echo "Dumping $CELL cell \${dbname}";
   >       mysqldump -h"${SOURCE_MARIADB_IP[$CELL]}" -uroot -p"${SOURCE_DB_ROOT_PASSWORD[$CELL]}" \
   >         --single-transaction --complete-insert --skip-lock-tables --lock-tables=0 \
   >         "\${dbname}" > /backup/"${CELL}.\${dbname}".sql;
   >     done
   > EOF
   > done

   请注意，过滤信息和性能模式表。Gnocchi 不再用作指标存储

6. 将数据库从 .sql 文件恢复到 control plane MariaDB 中：

   $ for CELL in $(echo $CELLS); do
   >   RCELL=$CELL
   >   [ "$CELL" = "default" ] && RCELL=$DEFAULT_CELL_NAME
   >   oc rsh mariadb-copy-data << EOF
   >     declare -A db_name_map  

   1

   
   >     db_name_map['nova']="nova_$RCELL"
   >     db_name_map['ovs_neutron']='neutron'
   >     db_name_map['ironic-inspector']='ironic_inspector'
   >     declare -A db_cell_map  

   2

   
   >     db_cell_map['nova']="nova_$DEFAULT_CELL_NAME"
   >     db_cell_map["nova_$RCELL"]="nova_$RCELL"  

   3

   
   >     declare -A db_server_map  

   4

   
   >     db_server_map['default']=${PODIFIED_MARIADB_IP['super']}
   >     db_server_map["nova"]=${PODIFIED_MARIADB_IP[$DEFAULT_CELL_NAME]}
   >     db_server_map["nova_$RCELL"]=${PODIFIED_MARIADB_IP[$RCELL]}
   >     declare -A db_server_password_map  

   5

   
   >     db_server_password_map['default']=${PODIFIED_DB_ROOT_PASSWORD['super']}
   >     db_server_password_map["nova"]=${PODIFIED_DB_ROOT_PASSWORD[$DEFAULT_CELL_NAME]}
   >     db_server_password_map["nova_$RCELL"]=${PODIFIED_DB_ROOT_PASSWORD[$RCELL]}
   >     cd /backup
   >     for db_file in \$(ls ${CELL}.*.sql); do
   >       db_name=\$(echo \${db_file} | awk -F'.' '{ print \$2; }')
   >       [[ "$CELL" != "default" && ! -v "db_cell_map[\${db_name}]" ]] && continue
   >       if [[ "$CELL" == "default" && -v "db_cell_map[\${db_name}]" ]] ; then
   >         target=$DEFAULT_CELL_NAME
   >       elif [[ "$CELL" == "default" && ! -v "db_cell_map[\${db_name}]" ]] ; then
   >         target=super
   >       else
   >         target=$RCELL
   >       fi  

   6

   
   >       renamed_db_file="\${target}_new.\${db_name}.sql"
   >       mv -f \${db_file} \${renamed_db_file}
   >       if [[ -v "db_name_map[\${db_name}]" ]]; then
   >         echo "renaming $CELL cell \${db_name} to \$target \${db_name_map[\${db_name}]}"
   >         db_name=\${db_name_map[\${db_name}]}
   >       fi
   >       db_server=\${db_server_map["default"]}
   >       if [[ -v "db_server_map[\${db_name}]" ]]; then
   >         db_server=\${db_server_map[\${db_name}]}
   >       fi
   >       db_password=\${db_server_password_map['default']}
   >       if [[ -v "db_server_password_map[\${db_name}]" ]]; then
   >         db_password=\${db_server_password_map[\${db_name}]}
   >       fi
   >       echo "creating $CELL cell \${db_name} in \$target \${db_server}"
   >       mysql -h"\${db_server}" -uroot "-p\${db_password}" -e \
   >         "CREATE DATABASE IF NOT EXISTS \${db_name} DEFAULT \
   >         CHARACTER SET ${CHARACTER_SET} DEFAULT COLLATE ${COLLATION};"
   >       echo "importing $CELL cell \${db_name} into \$target \${db_server} from \${renamed_db_file}"
   >       mysql -h "\${db_server}" -uroot "-p\${db_password}" "\${db_name}" < "\${renamed_db_file}"
   >     done
   >     if [ "$CELL" = "default" ] ; then
   >       mysql -h "\${db_server_map['default']}" -uroot -p"\${db_server_password_map['default']}" -e \
   >         "update nova_api.cell_mappings set name='$DEFAULT_CELL_NAME' where name='default';"
   >     fi
   >     mysql -h "\${db_server_map["nova_$RCELL"]}" -uroot -p"\${db_server_password_map["nova_$RCELL"]}" -e \
   >       "delete from nova_${RCELL}.services where host not like '%nova_${RCELL}-%' and services.binary != 'nova-compute';"
   > EOF
   > done

   1

   定义在导入时要重命名的通用数据库。

   2

   定义要导入的单元数据库，以及如何重命名它们（如果需要）。

   3

   省略了导入单元的特殊 cell0 数据库，因为它的内容在采用过程中无法合并。

   4

   定义要将哪些数据库导入到哪些服务器，通常为单元专用。

   5

   定义数据库服务器的 root 密码映射。现在，您只能使用相同的密码。

   6

   分配在从 默认单元 提取数据库时将哪些数据库导入到哪些主机。

1. 检查数据库是否已正确导入：

   $ set +u
   $ . ~/.source_cloud_exported_variables_default
   $ set -u
   $ dbs=$(oc exec openstack-galera-0 -c galera -- mysql -rs -uroot -p"${PODIFIED_DB_ROOT_PASSWORD['super']}" -e 'SHOW databases;')
   $ echo $dbs | grep -Eq '\bkeystone\b' && echo "OK" || echo "CHECK FAILED"
   $ echo $dbs | grep -Eq '\bneutron\b' && echo "OK" || echo "CHECK FAILED"
   $ echo "${PULL_OPENSTACK_CONFIGURATION_DATABASES[@]}" | grep -Eq '\bovs_neutron\b' && echo "OK" || echo "CHECK FAILED" 

   1

   
   $ novadb_mapped_cells=$(oc exec openstack-galera-0 -c galera -- mysql -rs -uroot -p"${PODIFIED_DB_ROOT_PASSWORD['super']}" \
   >   nova_api -e 'select uuid,name,transport_url,database_connection,disabled from cell_mappings;') 

   2

   
   $ uuidf='\S{8,}-\S{4,}-\S{4,}-\S{4,}-\S{12,}'
   $ default=$(printf "%s\n" "$PULL_OPENSTACK_CONFIGURATION_NOVADB_MAPPED_CELLS" | sed -rn "s/^($uuidf)\s+default\b.*$/\1/p")
   $ difference=$(diff -ZNua \
   >   <(printf "%s\n" "$PULL_OPENSTACK_CONFIGURATION_NOVADB_MAPPED_CELLS") \
   >   <(printf "%s\n" "$novadb_mapped_cells")) || true
   $ if [ "$DEFAULT_CELL_NAME" != "default" ]; then
   >   printf "%s\n" "$difference" | grep -qE "^\-$default\s+default\b" && echo "OK" || echo "CHECK FAILED"
   >   printf "%s\n" "$difference" | grep -qE "^\+$default\s+$DEFAULT_CELL_NAME\b" && echo "OK" || echo "CHECK FAILED"
   >   [ $(grep -E "^[-\+]$uuidf" <<<"$difference" | wc -l) -eq 2 ] && echo "OK" || echo "CHECK FAILED"
   > else
   >   [ "x$difference" = "x" ] && echo "OK" || echo "CHECK FAILED"
   > fi
   $ for CELL in $(echo $RENAMED_CELLS); do 

   3

   
   >   RCELL=$CELL
   >   [ "$CELL" = "$DEFAULT_CELL_NAME" ] && RCELL=default
   >   set +u
   >   . ~/.source_cloud_exported_variables_$RCELL
   >   set -u
   >   c1dbs=$(oc exec openstack-$CELL-galera-0 -c galera -- mysql -rs -uroot -p${PODIFIED_DB_ROOT_PASSWORD[$CELL]} -e 'SHOW databases;') 

   4

   
   >   echo $c1dbs | grep -Eq "\bnova_${CELL}\b" && echo "OK" || echo "CHECK FAILED"
   >   novadb_svc_records=$(oc exec openstack-$CELL-galera-0 -c galera -- mysql -rs -uroot -p${PODIFIED_DB_ROOT_PASSWORD[$CELL]} \
   >     nova_$CELL -e "select host from services where services.binary='nova-compute' and deleted=0 order by host asc;")
   >   diff -Z <(echo "x$novadb_svc_records") <(echo "x${PULL_OPENSTACK_CONFIGURATION_NOVA_COMPUTE_HOSTNAMES[@]}") && echo "OK" || echo "CHECK FAILED" 

   5

   
   > done

   1

   确保 Networking 服务(neutron)数据库从 ovs_neutron 重命名。

   2

   确保 默认单元 重命名为 $DEFAULT_CELL_NAME，并保留单元 UUID。

   3

   确保注册的 Compute 服务名称没有改变。

   4

   确保计算服务单元数据库提取到单独的数据库服务器，并从 nova 重命名为 nova_cell<X&gt;。

   5

   确保注册的 Compute 服务名称没有改变。

2. 删除 mariadb-data pod 和 mariadb-copy-data 持久性卷声明，其中包含数据库备份：

   注意

   在删除前，请考虑为它们执行快照。

   $ oc delete pod mariadb-copy-data
   $ oc delete pvc mariadb-data

流程

1. 获取包含 RHOSP Controller 节点的 RHOCP master 节点：

   $ oc get vmi -n $<ospdo_namespace> -o jsonpath='{.items[0].metadata.labels.kubevirt\.io/nodeName}'

   • 将 <ospdo_namespace& gt; 替换为您的 OSPdO 命名空间。

2. 为 OVN 备份准备临时 PersistentVolume 声明和 helper pod。如果需要，调整大型数据库的存储请求：

   $ oc apply -f - <<EOF
   ---
   apiVersion: cert-manager.io/v1
   kind: Certificate
   metadata:
     name: ovn-data-cert
   spec:
     commonName: ovn-data-cert
     secretName: ovn-data-cert
     issuerRef:
       name: rootca-internal
   ---
   apiVersion: v1
   kind: PersistentVolumeClaim
   metadata:
     namespace: $OSPDO_NAMESPACE
     name: ovn-data
   spec:
     storageClassName: $STORAGE_CLASS
     accessModes:
       - ReadWriteOnce
     resources:
       requests:
         storage: 10Gi
   ---
   apiVersion: v1
   kind: Pod
   metadata:
     name: ovn-copy-data
     annotations:
       openshift.io/scc: anyuid
     '[{"name": "internalapi-static", "namespace": $<ospdo_namespace>, "ips": ["<internalapi-static-ips>"]}]'
     labels:
       app: adoption
     namespace: $OSPDO_NAMESPACE
   spec:
     nodeName: '{{ <ocp_node_holding_controller> }}' 

   1

   
     containers:
     - image: $OVSDB_IMAGE
       command: [ "sh", "-c", "sleep infinity"]
       name: adoption
       volumeMounts:
       - mountPath: /backup
         name: ovn-data
       - mountPath: /etc/pki/tls/misc
         name: ovn-data-cert
         readOnly: true
     securityContext:
       allowPrivilegeEscalation: false
       capabilities:
         drop: ALL
       runAsNonRoot: true
       seccompProfile:
         type: RuntimeDefault
     volumes:
     - name: ovn-data
       persistentVolumeClaim:
         claimName: ovn-data
     - name: ovn-data-cert
       secret:
         secretName: ovn-data-cert
   EOF

   1

   将 <ocp_node_holding_controller > 替换为包含 Controller 节点的 RHOSP 节点。

3. 等待 pod 就绪：

   $ oc wait --for=condition=Ready -n $OSPDO_NAMESPACE pod/ovn-copy-data --timeout=30s

4. 如果 podified internalapi cidr 与源 internalapi cidr 不同，请在 Controller 节点上添加 iptables accept 规则：

   $ $CONTROLLER1_SSH sudo iptables -I INPUT -s {PODIFIED_INTERNALAPI_NETWORK} -p tcp -m tcp --dport 6641 -m conntrack --ctstate NEW -j ACCEPT
   $ $CONTROLLER1_SSH sudo iptables -I INPUT -s {PODIFIED_INTERNALAPI_NETWORK} -p tcp -m tcp --dport 6642 -m conntrack --ctstate NEW -j ACCEPT

5. 备份 OVN 数据库：

   • 如果您没有在任何位置启用 TLS，请运行以下命令：

     $ oc exec -n $OSPDO_NAMESPACE ovn-copy-data -- bash -c "ovsdb-client backup tcp:$SOURCE_OVSDB_IP:6641 > /backup/ovs-nb.db"
     $ oc exec -n $OSPDO_NAMESPACE ovn-copy-data -- bash -c "ovsdb-client backup tcp:$SOURCE_OVSDB_IP:6642 > /backup/ovs-sb.db"

   • 如果您随处启用 TLS，请运行以下命令：

     $ oc exec ovn-copy-data -- bash -c "ovsdb-client backup --ca-cert=/etc/pki/tls/misc/ca.crt --private-key=/etc/pki/tls/misc/tls.key --certificate=/etc/pki/tls/misc/tls.crt ssl:$SOURCE_OVSDB_IP:6641 > /backup/ovs-nb.db"
     $ oc exec ovn-copy-data -- bash -c "ovsdb-client backup --ca-cert=/etc/pki/tls/misc/ca.crt --private-key=/etc/pki/tls/misc/tls.key --certificate=/etc/pki/tls/misc/tls.crt ssl:$SOURCE_OVSDB_IP:6642 > /backup/ovs-sb.db"

6. 在导入前启动 control plane OVN 数据库服务，禁用 northd ：

   $ oc patch openstackcontrolplane openstack --type=merge --patch '
   spec:
     ovn:
       enabled: true
       template:
         ovnDBCluster:
           ovndbcluster-nb:
             replicas: 3
             dbType: NB
             storageRequest: 10G
             networkAttachment: internalapi
           ovndbcluster-sb:
             replicas: 3
             dbType: SB
             storageRequest: 10G
             networkAttachment: internalapi
         ovnNorthd:
           replicas: 0
   '

7. 等待 OVN 数据库服务进入 Running 阶段：

   $ oc wait --for=jsonpath='{.status.phase}'=Running pod --selector=service=ovsdbserver-nb
   $ oc wait --for=jsonpath='{.status.phase}'=Running pod --selector=service=ovsdbserver-sb

8. 在 clusterIP 服务网络上获取 OVN 数据库 IP 地址：

   PODIFIED_OVSDB_NB_IP=$(oc get svc --selector "statefulset.kubernetes.io/pod-name=ovsdbserver-nb-0" -ojsonpath='{.items[0].spec.clusterIP}')
   PODIFIED_OVSDB_SB_IP=$(oc get svc --selector "statefulset.kubernetes.io/pod-name=ovsdbserver-sb-0" -ojsonpath='{.items[0].spec.clusterIP}')

9. 如果您使用 IPv6，请将地址调整为 ovsdb channel 工具期望的格式：

   PODIFIED_OVSDB_NB_IP=[$PODIFIED_OVSDB_NB_IP]
   PODIFIED_OVSDB_SB_IP=[$PODIFIED_OVSDB_SB_IP]

10. 升级备份文件的数据库模式：

    1. 如果您没有在任何位置启用 TLS，请使用以下命令：

       $ oc exec ovn-copy-data -- bash -c "ovsdb-client get-schema tcp:$PODIFIED_OVSDB_NB_IP:6641 > /backup/ovs-nb.ovsschema && ovsdb-tool convert /backup/ovs-nb.db /backup/ovs-nb.ovsschema"
       $ oc exec ovn-copy-data -- bash -c "ovsdb-client get-schema tcp:$PODIFIED_OVSDB_SB_IP:6642 > /backup/ovs-sb.ovsschema && ovsdb-tool convert /backup/ovs-sb.db /backup/ovs-sb.ovsschema"

    2. 如果您随处启用 TLS，请使用以下命令：

       $ oc exec ovn-copy-data -- bash -c "ovsdb-client get-schema --ca-cert=/etc/pki/tls/misc/ca.crt --private-key=/etc/pki/tls/misc/tls.key --certificate=/etc/pki/tls/misc/tls.crt ssl:$PODIFIED_OVSDB_NB_IP:6641 > /backup/ovs-nb.ovsschema && ovsdb-tool convert /backup/ovs-nb.db /backup/ovs-nb.ovsschema"
       $ oc exec ovn-copy-data -- bash -c "ovsdb-client get-schema --ca-cert=/etc/pki/tls/misc/ca.crt --private-key=/etc/pki/tls/misc/tls.key --certificate=/etc/pki/tls/misc/tls.crt ssl:$PODIFIED_OVSDB_SB_IP:6642 > /backup/ovs-sb.ovsschema && ovsdb-tool convert /backup/ovs-sb.db /backup/ovs-sb.ovsschema"

11. 将数据库备份恢复到新的 OVN 数据库服务器：

    1. 如果您没有在任何位置启用 TLS，请使用以下命令：

    2. 如果您随处启用 TLS，请使用以下命令：

       $ oc exec ovn-copy-data -- bash -c "ovsdb-client restore --ca-cert=/etc/pki/tls/misc/ca.crt --private-key=/etc/pki/tls/misc/tls.key --certificate=/etc/pki/tls/misc/tls.crt ssl:$PODIFIED_OVSDB_NB_IP:6641 < /backup/ovs-nb.db"
       $ oc exec ovn-copy-data -- bash -c "ovsdb-client restore --ca-cert=/etc/pki/tls/misc/ca.crt --private-key=/etc/pki/tls/misc/tls.key --certificate=/etc/pki/tls/misc/tls.crt ssl:$PODIFIED_OVSDB_SB_IP:6642 < /backup/ovs-sb.db"

12. 通过针对新的数据库服务器运行以下命令来检查数据是否已成功迁移，例如：

    $ oc exec -it ovsdbserver-nb-0 -- ovn-nbctl show
    $ oc exec -it ovsdbserver-sb-0 -- ovn-sbctl list Chassis

13. 启动 control plane ovn-northd 服务，以便两个 OVN 数据库保持同步：

    $ oc patch openstackcontrolplane openstack --type=merge --patch '
    spec:
      ovn:
        enabled: true
        template:
          ovnNorthd:
            replicas: 1
    '

14. 如果您在 RHOCP 节点上运行 OVN 网关服务，请启用 control plane ovn-controller 服务：

    $ oc patch openstackcontrolplane openstack --type=merge --patch '
    spec:
      ovn:
        enabled: true
        template:
          ovnController:
            nicMappings:
              physNet: NIC 

    1

    1

    physnet 是物理网络的名称。NIC 是连接到您的物理网络的物理接口的名称。

    注意

    在 RHOCP 节点上运行 OVN 网关，在 Open vSwitch 升级过程中可能会容易出现数据平面停机时间。考虑在专用的 Networker data plane 节点上运行 OVN 网关，用于生产环境部署。

15. 删除 ovn-data helper pod 和用于存储 OVN 数据库备份文件的临时 PersistentVolumeClaim ：

    $ oc delete --ignore-not-found=true pod ovn-copy-data
    $ oc delete --ignore-not-found=true pvc ovn-data

    注意

    在删除 ovn-data helper pod 和临时 PersistentVolumeClaim 前，请考虑为它们执行快照。如需更多信息，请参阅 OpenShift Container Platform 存储概述 中的 关于卷快照。

16. 停止采用的 OVN 数据库服务器：

    ServicesToStop=("tripleo_ovn_cluster_north_db_server.service"
                    "tripleo_ovn_cluster_south_db_server.service")
    
    echo "Stopping systemd OpenStack services"
    for service in ${ServicesToStop[*]}; do
            SSH_CMD=CONTROLLER_SSH
            if [ ! -z "${!SSH_CMD}" ]; then
                echo "Stopping the $service in controller $i"
                if ${!SSH_CMD} sudo systemctl is-active $service; then
                    ${!SSH_CMD} sudo systemctl stop $service
                fi
            fi
    done
    
    echo "Checking systemd OpenStack services"
    for service in ${ServicesToStop[*]}; do
            SSH_CMD=CONTROLLER_SSH
            if [ ! -z "${!SSH_CMD}" ]; then
                if ! ${!SSH_CMD} systemctl show $service | grep ActiveState=inactive >/dev/null; then
                    echo "ERROR: Service $service still running on controller $i"
                else
                    echo "OK: Service $service is not running on controller $i"
                fi
            fi
    done

流程

1. 对 OpenStackControlPlane CR 进行补丁来部署 Identity 服务：

   $ oc patch openstackcontrolplane openstack --type=merge --patch ' \
   spec: \
     keystone: \
       enabled: true \
       apiOverride: \
         route: {} \
       template: \
         override: \
           service: \
             internal: \
               metadata: \
                 annotations: \
                   metallb.universe.tf/address-pool: internalapi \
                   metallb.universe.tf/allow-shared-ip: internalapi \
                   metallb.universe.tf/loadBalancerIPs: 172.17.0.80 \ 

   1

   
               spec: \
                 type: LoadBalancer \
         databaseInstance: openstack \
         secret: osp-secret \
   '

   1

   如果使用 IPv6，请将负载均衡器 IP 更改为环境中的负载均衡器 IP，如 metallb.universe.tf/loadBalancerIPs: fd00:bbbb::80。

2. 在 OpenShift (RHOSO)部署中的 Red Hat OpenStack Services 中创建一个别名来使用 openstack 命令：

   $ alias openstack="oc exec -t openstackclient -- openstack"

3. 删除仍指向 RHOSP control plane 的服务和端点，不包括 Identity 服务及其端点：

   $ openstack endpoint list | grep keystone | awk '/admin/{ print $2; }' | xargs ${BASH_ALIASES[openstack]} endpoint delete || true
   
   $ for service in aodh heat heat-cfn barbican cinderv3 glance gnocchi manila manilav2 neutron nova placement swift ironic-inspector ironic octavia; do
     openstack service list | awk "/ $service /{ print \$2; }" | xargs -r ${BASH_ALIASES[openstack]} service delete || true \
   done

验证

1. 验证您可以访问 OpenStackClient 容器集。如需更多信息，请参阅在 OpenShift 部署中 访问 Red Hat OpenStack Services 中的访问 OpenStackClient pod。

2. 确认定义了 Identity 服务端点，并指向 control plane FQDN：

   $ openstack endpoint list | grep keystone

3. 等待 OpenStackControlPlane 资源变为 Ready ：

   $ oc wait --for=condition=Ready --timeout=1m OpenStackControlPlane openstack

流程

1. 添加 kek secret：

   $ oc set data secret/osp-secret "BarbicanSimpleCryptoKEK=$($CONTROLLER1_SSH "python3 -c \"import configparser; c = configparser.ConfigParser(); c.read('/var/lib/config-data/puppet-generated/barbican/etc/barbican/barbican.conf'); print(c['simple_crypto_plugin']['kek'])\"")"

2. 对 OpenStackControlPlane CR 进行补丁来部署 Key Manager 服务：

   $ oc patch openstackcontrolplane openstack --type=merge --patch '
   spec:
     barbican:
       enabled: true
       apiOverride:
         route: {}
       template:
         databaseInstance: openstack
         databaseAccount: barbican
         rabbitMqClusterName: rabbitmq
         secret: osp-secret
         simpleCryptoBackendSecret: osp-secret
         serviceAccount: barbican
         serviceUser: barbican
         passwordSelectors:
           service: BarbicanPassword
           simplecryptokek: BarbicanSimpleCryptoKEK
         barbicanAPI:
           replicas: 1
           override:
             service:
               internal:
                 metadata:
                   annotations:
                     metallb.universe.tf/address-pool: internalapi
                     metallb.universe.tf/allow-shared-ip: internalapi
                     metallb.universe.tf/loadBalancerIPs: 172.17.0.80 

   1

   
                 spec:
                   type: LoadBalancer
         barbicanWorker:
           replicas: 1
         barbicanKeystoneListener:
           replicas: 1
   '

   1

   如果使用 IPv6，请将负载均衡器 IP 更改为环境中的负载均衡器 IP，如 metallb.universe.tf/loadBalancerIPs: fd00:bbbb::80。

流程

1. 创建包含对象存储服务哈希路径后缀和前缀的 swift-conf secret：

   $ oc apply -f - <<EOF
   apiVersion: v1
   kind: Secret
   metadata:
     name: swift-conf
   type: Opaque
   data:
     swift.conf: $($CONTROLLER1_SSH sudo cat /var/lib/config-data/puppet-generated/swift/etc/swift/swift.conf | base64 -w0)
   EOF

2. 创建包含对象存储服务 ring 文件的 swift-ring-files ConfigMap ：

   $ oc apply -f - <<EOF
   apiVersion: v1
   kind: ConfigMap
   metadata:
     name: swift-ring-files
   binaryData:
     swiftrings.tar.gz: $($CONTROLLER1_SSH "cd /var/lib/config-data/puppet-generated/swift/etc/swift && tar cz *.builder *.ring.gz backups/ | base64 -w0")
     account.ring.gz: $($CONTROLLER1_SSH "base64 -w0 /var/lib/config-data/puppet-generated/swift/etc/swift/account.ring.gz")
     container.ring.gz: $($CONTROLLER1_SSH "base64 -w0 /var/lib/config-data/puppet-generated/swift/etc/swift/container.ring.gz")
     object.ring.gz: $($CONTROLLER1_SSH "base64 -w0 /var/lib/config-data/puppet-generated/swift/etc/swift/object.ring.gz")
   EOF

3. 修补 OpenStackControlPlane 自定义资源来部署对象存储服务：

   $ oc patch openstackcontrolplane openstack --type=merge --patch '
   spec:
     swift:
       enabled: true
       template:
         memcachedInstance: memcached
         swiftRing:
           ringReplicas: 1
         swiftStorage:
           replicas: 0
           networkAttachments:
           - storage
           storageClass: local-storage 

   1

   
           storageRequest: 10Gi
         swiftProxy:
           secret: osp-secret
           replicas: 1
           passwordSelectors:
             service: SwiftPassword
           serviceUser: swift
           override:
             service:
               internal:
                 metadata:
                   annotations:
                     metallb.universe.tf/address-pool: internalapi
                     metallb.universe.tf/allow-shared-ip: internalapi
                     metallb.universe.tf/loadBalancerIPs: 172.17.0.80 

   2

   
                 spec:
                   type: LoadBalancer
           networkAttachments: 

   3

   
           - storage
   '

   1

   必须与 RHOSO 部署存储类匹配。

   2

   如果使用 IPv6，请将负载均衡器 IP 更改为环境中的负载均衡器 IP，如 metallb.universe.tf/loadBalancerIPs: fd00:bbbb::80。

   3

   必须与 RHOSP 部署中之前的对象存储服务配置的网络附加匹配。

流程

1. 对 OpenStackControlPlane CR 进行补丁来部署 Compute 服务：

   注意

   此流程假设 Compute 服务元数据部署在顶层，而不是在每个单元级别。如果 RHOSP 部署有每单元元数据部署，请根据需要调整以下补丁。您不能在 cell0 中运行元数据服务。要启用本地单元的元数据服务，请在 OpenStackControlPlane CR 中的 local cell 的 metadataServiceTemplate 字段中将 enabled 属性设置为 true。

   $ rm -f celltemplates
   $ for CELL in $(echo $RENAMED_CELLS); do
    $ cat >> celltemplates << EOF
           ${CELL}:
             hasAPIAccess: true 

   1

   
             cellDatabaseAccount: nova-$CELL
             cellDatabaseInstance: openstack-$CELL 

   2

   
             cellMessageBusInstance: rabbitmq-$CELL 

   3

   
             metadataServiceTemplate:
               enabled: false
               override:
                   service:
                     metadata:
                       annotations:
                         metallb.universe.tf/address-pool: internalapi
                         metallb.universe.tf/allow-shared-ip: internalapi
                         metallb.universe.tf/loadBalancerIPs: 172.17.0.$(( 79 + ${CELL##*cell} ))
                     spec:
                       type: LoadBalancer
               customServiceConfig: |
                 [workarounds]
                 disable_compute_service_check_for_ffu=true
             conductorServiceTemplate:
               customServiceConfig: |
                 [workarounds]
                 disable_compute_service_check_for_ffu=true
   EOF
   done
   
   $ cat > oscp-patch.yaml << EOF
   spec:
     nova:
       enabled: true
       apiOverride:
         route: {}
       template:
         secret: osp-secret
         apiDatabaseAccount: nova-api
         apiServiceTemplate:
           override:
             service:
               internal:
                 metadata:
                   annotations:
                     metallb.universe.tf/address-pool: internalapi
                     metallb.universe.tf/allow-shared-ip: internalapi
                     metallb.universe.tf/loadBalancerIPs: 172.17.0.80 

   4

   
                 spec:
                   type: LoadBalancer
           customServiceConfig: |
             [workarounds]
             disable_compute_service_check_for_ffu=true
         metadataServiceTemplate:
           enabled: true
           override:
             service:
               metadata:
                 annotations:
                   metallb.universe.tf/address-pool: internalapi
                   metallb.universe.tf/allow-shared-ip: internalapi
                   metallb.universe.tf/loadBalancerIPs: 172.17.0.80
               spec:
                 type: LoadBalancer
           customServiceConfig: |
             [workarounds]
             disable_compute_service_check_for_ffu=true
         schedulerServiceTemplate:
           customServiceConfig: |
             [workarounds]
             disable_compute_service_check_for_ffu=true
         cellTemplates:
           cell0:
             hasAPIAccess: true
             cellDatabaseAccount: nova-cell0
             cellDatabaseInstance: openstack
             cellMessageBusInstance: rabbitmq
             conductorServiceTemplate:
               customServiceConfig: |
                 [workarounds]
                 disable_compute_service_check_for_ffu=true
   EOF
   
   $ cat celltemplates >> oscp-patch.yaml
   $ oc patch openstackcontrolplane openstack  --type=merge --patch-file=oscp-patch.yaml

   1

   在源云中，单元总是配置有主要 Nova API 数据库访问。您可以通过将 hasAPIAccess 设置为 false 来禁用对 API 的 upcall 访问。但是，在采用过程中不要更改 API。

   2

   单元使用的数据库实例。在部署后端服务时，数据库实例名称必须与您在部署后端服务时创建的 OpenStackControlPlane CR 中定义的名称匹配，如 部署后端服务 中所述。

   3

   单元使用的消息总线实例。消息总线实例名称必须与 OpenStackControlPlane CR 中定义的名称匹配。

   4

   如果使用 IPv6，请将负载均衡器 IP 更改为环境中的负载均衡器 IP，如 metallb.universe.tf/loadBalancerIPs: fd00:bbbb::80。

2. 如果您使用 Compute 服务与 Bare Metal Provisioning 服务(ironic)，请在 Compute 服务 CR 补丁中的每个单元格中附加 novaComputeTemplates 字段。例如：

           cell1:
             novaComputeTemplates:
               standalone:
                 customServiceConfig: |
                   [DEFAULT]
                   host = <hostname>
                   [workarounds]
                   disable_compute_service_check_for_ffu=true
                 computeDriver: ironic.IronicDriver
           ...

   • 将 &lt;hostname> 替换为在源云中运行 ironic Compute 驱动程序的节点主机名。

3. 等待 CR 就绪计算 control plane 服务：

   $ oc wait --for condition=Ready --timeout=300s Nova/nova

   注意

   每个单元启动本地 Conductor 服务，而超级编排器在 cell0 中运行。请注意, disable_compute_service_check_for_ffu 对所有导入的 Compute 服务是必须的，直到导入外部数据平面前，直到 Compute 服务被快速升级为止。如需更多信息，请参阅将 Compute 服务部署到 RHOSO 数据平面 ，并对计算服务执行快速升级。

流程

1. 创建新文件，如 cinder_api.patch，并应用配置：

   $ oc patch openstackcontrolplane openstack --type=merge --patch-file=<patch_name>

   • 将 <patch_name > 替换为补丁文件的名称。

     以下示例显示了 cinder_api.patch 文件：

     spec:
       extraMounts:
       - extraVol:
         - extraVolType: Ceph
           mounts:
           - mountPath: /etc/ceph
             name: ceph
             readOnly: true
           propagation:
           - CinderVolume
           - CinderBackup
           - Glance
           volumes:
           - name: ceph
             projected:
               sources:
               - secret:
                   name: ceph-conf-files
       cinder:
         enabled: true
         apiOverride:
           route: {}
         template:
           databaseInstance: openstack
           databaseAccount: cinder
           secret: osp-secret
           cinderAPI:
             override:
               service:
                 internal:
                   metadata:
                     annotations:
                       metallb.universe.tf/address-pool: internalapi
                       metallb.universe.tf/allow-shared-ip: internalapi
                       metallb.universe.tf/loadBalancerIPs: 172.17.0.80 

     1

     
                   spec:
                     type: LoadBalancer
             replicas: 1
             customServiceConfig: |
               [DEFAULT]
               default_volume_type=tripleo
           cinderScheduler:
             replicas: 0
           cinderBackup:
             networkAttachments:
             - storage
             replicas: 0
           cinderVolumes:
             ceph:
               networkAttachments:
               - storage
               replicas: 0

     1

     如果使用 IPv6，请将负载均衡器 IP 更改为环境中的负载均衡器 IP，如 metallb.universe.tf/loadBalancerIPs: fd00:bbbb::80。

2. 检索之前调度程序和备份服务的列表：

   $ openstack volume service list
   
   +------------------+------------------------+------+---------+-------+----------------------------+
   | Binary           | Host                   | Zone | Status  | State | Updated At                 |
   +------------------+------------------------+------+---------+-------+----------------------------+
   | cinder-scheduler | standalone.localdomain | nova | enabled | down  | 2024-11-04T17:47:14.000000 |
   | cinder-backup    | standalone.localdomain | nova | enabled | down  | 2024-11-04T17:47:14.000000 |
   | cinder-volume    | hostgroup@tripleo_ceph | nova | enabled | down  | 2024-11-04T17:47:14.000000 |
   +------------------+------------------------+------+---------+-------+----------------------------+

3. 删除处于 down 状态的主机的服务：

   $ oc exec -t cinder-api-0 -c cinder-api -- cinder-manage service remove <service_binary> <service_host>

   • 将 <service_binary > 替换为二进制名称，如 cinder-backup。
   • 将 <service_host > 替换为主机名，如 cinder-backup-0。

4. 部署调度程序、备份和卷服务：

   • 创建另一个文件，如 cinder_services.patch，并应用配置：

     $ oc patch openstackcontrolplane openstack --type=merge --patch-file=<patch_name>

   • 将 <patch_name > 替换为补丁文件的名称。

   • 以下示例显示了 Ceph RBD 部署的 cinder_services.patch 文件：

     spec:
       cinder:
         enabled: true
         template:
           cinderScheduler:
             replicas: 1
           cinderBackup:
             networkAttachments:
             - storage
             replicas: 1
             customServiceConfig: |
               [DEFAULT]
               backup_driver=cinder.backup.drivers.ceph.CephBackupDriver
               backup_ceph_conf=/etc/ceph/ceph.conf
               backup_ceph_user=openstack
               backup_ceph_pool=backups
           cinderVolumes:
             ceph:
               networkAttachments:
               - storage
               replicas: 1
               customServiceConfig: |
                 [tripleo_ceph]
                 backend_host=hostgroup
                 volume_backend_name=tripleo_ceph
                 volume_driver=cinder.volume.drivers.rbd.RBDDriver
                 rbd_ceph_conf=/etc/ceph/ceph.conf
                 rbd_user=openstack
                 rbd_pool=volumes
                 rbd_flatten_volume_from_snapshot=False
                 report_discard_supported=True

     注意

     确保源集群中使用的驱动程序使用相同的配置组名称。在本例中，customServiceConfig 中的驱动程序配置组名为 tripleo_ceph，因为它反映源 OpenStack 集群的 cinder.conf 文件中的配置组名称的值。

5. 配置 NetApp NFS 块存储卷服务：

   1. 创建 secret，使其包含用于访问第三方 NetApp NFS 存储的敏感信息，如主机名、密码和用户名。您可以在从 director Operator 部署生成的 cinder.conf 文件中找到凭证。

      $ oc apply -f - <<EOF
      apiVersion: v1
      kind: Secret
      metadata:
        labels:
          service: cinder
          component: cinder-volume
        name: cinder-volume-ontap-secrets
      type: Opaque
      stringData:
        ontap-cinder-secrets: |
          [tripleo_netapp]
          netapp_login= netapp_username
          netapp_password= netapp_password
          netapp_vserver= netapp_vserver
          nas_host= netapp_nfsip
          nas_share_path=/netapp_nfspath
          netapp_pool_name_search_pattern=(netapp_poolpattern)
      EOF

   2. 对 OpenStackControlPlane CR 进行补丁，以部署 NetApp NFS Block Storage 卷后端：

      $ oc patch openstackcontrolplane openstack --type=merge --patch-file=<cinder_netappNFS.patch>

      • 以下示例显示了配置 NetApp NFS Block Storage 卷服务的 cinder_netappNFS.patch 文件：

        spec:
          cinder:
            enabled: true
            template:
              cinderVolumes:
                ontap-nfs:
                  networkAttachments:
                    - storage
                  customServiceConfig: |
                    [tripleo_netapp]
                    volume_backend_name=ontap-nfs
                    volume_driver=cinder.volume.drivers.netapp.common.NetAppDriver
                    nfs_snapshot_support=true
                    nas_secure_file_operations=false
                    nas_secure_file_permissions=false
                    netapp_server_hostname= netapp_backendip
                    netapp_server_port=80
                    netapp_storage_protocol=nfs
                    netapp_storage_family=ontap_cluster
                  customServiceConfigSecrets:
                  - cinder-volume-ontap-secrets

6. 检查所有服务是否已启动并正在运行：

   $ openstack volume service list
   
   +------------------+--------------------------+------+---------+-------+----------------------------+
   | Binary           | Host                     | Zone | Status  | State | Updated At                 |
   +------------------+--------------------------+------+---------+-------+----------------------------+
   | cinder-volume    | hostgroup@tripleo_netapp | nova | enabled | up    | 2023-06-28T17:00:03.000000 |
   | cinder-scheduler | cinder-scheduler-0       | nova | enabled | up    | 2023-06-28T17:00:02.000000 |
   | cinder-backup    | cinder-backup-0          | nova | enabled | up    | 2023-06-28T17:00:01.000000 |
   +------------------+--------------------------+------+---------+-------+----------------------------+

7. 应用 DB 数据迁移：

   注意

   您不需要在此步骤中运行数据迁移，但您必须在下一次升级前运行它们。但是，对于采用，您可以现在运行迁移以确保在部署上运行生产工作负载前没有问题。

   $ oc exec -it cinder-scheduler-0 -- cinder-manage db online_data_migrations

验证

1. 确保定义了 openstack 别名：

   $ alias openstack="oc exec -t openstackclient -- openstack"

2. 确认定义了块存储服务端点并指向 control plane FQDN：

   $ openstack endpoint list --service <endpoint>

   • 将 <endpoint > 替换为您要确认的端点的名称。

3. 确认块存储服务正在运行：

   $ openstack volume service list

   注意

   Cinder API 服务不会出现在列表中。但是，如果您从 openstack volume service list 命令获得响应，这表示至少有一个 cinder API 服务正在运行。

4. 确认已有以前的卷类型、卷、快照和备份：

   $ openstack volume type list
   $ openstack volume list
   $ openstack volume snapshot list
   $ openstack volume backup list

5. 要确认配置是否正常工作，请执行以下步骤：

   1. 从镜像创建卷，以检查与镜像服务(glance)的连接是否正常工作：

      $ openstack volume create --image cirros --bootable --size 1 disk_new

   2. 备份之前附加的卷：

      $ openstack --os-volume-api-version 3.47 volume create --backup <backup_name>

      • 将 <backup_name > 替换为新备份位置的名称。

        注意

        您不能使用新卷从镜像启动计算服务(nova)实例，或者尝试分离上一个卷，因为计算服务和块存储服务仍然未连接。

验证

1. 验证 Dashboard 服务实例是否已成功部署并就绪：

   $ oc get horizon

2. 确认 Dashboard 服务可访问并返回 200 状态代码：

   PUBLIC_URL=$(oc get horizon horizon -o jsonpath='{.status.endpoint}')
   curl --silent --output /dev/stderr --head --write-out "%{http_code}" "$PUBLIC_URL/dashboard/auth/login/?next=/dashboard/" -k | grep 200

流程

1. 检索现有的 auth_encryption_key 和 service 密码。您可以使用这些密码来修补 osp-secret。在以下示例中，auth_encryption_key 用作 HeatAuthEncryptionKey，服务 密码用作 HeatPassword ：

   [stack@rhosp17 ~]$ grep -E 'HeatPassword|HeatAuth|HeatStackDomainAdmin' ~/overcloud-deploy/overcloud/overcloud-passwords.yaml
     HeatAuthEncryptionKey: Q60Hj8PqbrDNu2dDCbyIQE2dibpQUPg2
     HeatPassword: dU2N0Vr2bdelYH7eQonAwPfI3
     HeatStackDomainAdminPassword: dU2N0Vr2bdelYH7eQonAwPfI3

2. 登录到 Controller 节点，并验证正在使用的 auth_encryption_key 值：

   [stack@rhosp17 ~]$ ansible -i overcloud-deploy/overcloud/config-download/overcloud/tripleo-ansible-inventory.yaml overcloud-controller-0 -m shell -a "grep auth_encryption_key /var/lib/config-data/puppet-generated/heat/etc/heat/heat.conf | grep -Ev '^#|^$'" -b
   overcloud-controller-0 | CHANGED | rc=0 >>
   auth_encryption_key=Q60Hj8PqbrDNu2dDCbyIQE2dibpQUPg2

3. 将密码编码为 Base64 格式：

   $ echo Q60Hj8PqbrDNu2dDCbyIQE2dibpQUPg2 | base64
   UTYwSGo4UHFickROdTJkRENieUlRRTJkaWJwUVVQZzIK

4. 对 osp-secret 进行补丁，以更新 HeatAuthEncryptionKey 和 HeatPassword 参数。这些值必须与 director Operator Orchestration 服务配置中的值匹配：

   $ oc patch secret osp-secret --type='json' -p='[{"op" : "replace" ,"path" : "/data/HeatAuthEncryptionKey" ,"value" : "UTYwSGo4UHFickROdTJkRENieUlRRTJkaWJwUVVQZzIK"}]'
   secret/osp-secret patched

5. 对 OpenStackControlPlane CR 进行补丁来部署编排服务：

   $ oc patch openstackcontrolplane openstack --type=merge --patch '
   spec:
     heat:
       enabled: true
       apiOverride:
         route: {}
       template:
         databaseInstance: openstack
         databaseAccount: heat
         secret: osp-secret
         memcachedInstance: memcached
         passwordSelectors:
           authEncryptionKey: HeatAuthEncryptionKey
           service: HeatPassword
           stackDomainAdminPassword: HeatStackDomainAdminPassword
   '

验证

1. 确保所有 CR 的状态都是 Setup complete:

   $ oc get Heat,HeatAPI,HeatEngine,HeatCFNAPI
   NAME                           STATUS   MESSAGE
   heat.heat.openstack.org/heat   True     Setup complete
   
   NAME                                  STATUS   MESSAGE
   heatapi.heat.openstack.org/heat-api   True     Setup complete
   
   NAME                                        STATUS   MESSAGE
   heatengine.heat.openstack.org/heat-engine   True     Setup complete
   
   NAME                                        STATUS   MESSAGE
   heatcfnapi.heat.openstack.org/heat-cfnapi   True     Setup complete

2. 检查编排服务是否在 Identity 服务中注册：

   $ oc exec -it openstackclient -- openstack service list -c Name -c Type
   +------------+----------------+
   | Name       | Type           |
   +------------+----------------+
   | heat       | orchestration  |
   | glance     | image          |
   | heat-cfn   | cloudformation |
   | ceilometer | Ceilometer     |
   | keystone   | identity       |
   | placement  | placement      |
   | cinderv3   | volumev3       |
   | nova       | compute        |
   | neutron    | network        |
   +------------+----------------+

   $ oc exec -it openstackclient -- openstack endpoint list --service=heat -f yaml
   - Enabled: true
     ID: 1da7df5b25b94d1cae85e3ad736b25a5
     Interface: public
     Region: regionOne
     Service Name: heat
     Service Type: orchestration
     URL: http://heat-api-public-openstack-operators.apps.okd.bne-shift.net/v1/%(tenant_id)s
   - Enabled: true
     ID: 414dd03d8e9d462988113ea0e3a330b0
     Interface: internal
     Region: regionOne
     Service Name: heat
     Service Type: orchestration
     URL: http://heat-api-internal.openstack-operators.svc:8004/v1/%(tenant_id)s

3. 检查编排服务引擎服务是否正在运行：

   $ oc exec -it openstackclient -- openstack orchestration service list -f yaml
   - Binary: heat-engine
     Engine ID: b16ad899-815a-4b0c-9f2e-e6d9c74aa200
     Host: heat-engine-6d47856868-p7pzz
     Hostname: heat-engine-6d47856868-p7pzz
     Status: up
     Topic: engine
     Updated At: '2023-10-11T21:48:01.000000'
   - Binary: heat-engine
     Engine ID: 887ed392-0799-4310-b95c-ac2d3e6f965f
     Host: heat-engine-6d47856868-p7pzz
     Hostname: heat-engine-6d47856868-p7pzz
     Status: up
     Topic: engine
     Updated At: '2023-10-11T21:48:00.000000'
   - Binary: heat-engine
     Engine ID: 26ed9668-b3f2-48aa-92e8-2862252485ea
     Host: heat-engine-6d47856868-p7pzz
     Hostname: heat-engine-6d47856868-p7pzz
     Status: up
     Topic: engine
     Updated At: '2023-10-11T21:48:00.000000'
   - Binary: heat-engine
     Engine ID: 1011943b-9fea-4f53-b543-d841297245fd
     Host: heat-engine-6d47856868-p7pzz
     Hostname: heat-engine-6d47856868-p7pzz
     Status: up
     Topic: engine
     Updated At: '2023-10-11T21:48:01.000000'

4. 验证您是否可以看到您的编配服务堆栈：

   $ openstack stack list -f yaml
   - Creation Time: '2023-10-11T22:03:20Z'
     ID: 20f95925-7443-49cb-9561-a1ab736749ba
     Project: 4eacd0d1cab04427bc315805c28e66c9
     Stack Name: test-networks
     Stack Status: CREATE_COMPLETE
     Updated Time: null

流程

1. 对 OpenStackControlPlane CR 进行补丁来部署 cluster-observability-operator ：

   $ oc create -f - <<EOF
   apiVersion: operators.coreos.com/v1alpha1
   kind: Subscription
   metadata:
     name: cluster-observability-operator
     namespace: openshift-operators
   spec:
     channel: stable
     installPlanApproval: Automatic
     name: cluster-observability-operator
     source: redhat-operators
     sourceNamespace: openshift-marketplace
   EOF

2. 等待安装成功：

   $ oc wait --for jsonpath="{.status.phase}"=Succeeded csv --namespace=openshift-operators -l operators.coreos.com/cluster-observability-operator.openshift-operators

3. 修补 OpenStackControlPlane CR 来部署 Ceilometer 服务：

   $ oc patch openstackcontrolplane openstack --type=merge --patch '
   spec:
     telemetry:
       enabled: true
       template:
         ceilometer:
           passwordSelector:
             ceilometerService: CeilometerPassword
           enabled: true
           secret: osp-secret
           serviceUser: ceilometer
   '

4. 启用 metrics 存储后端：

   $ oc patch openstackcontrolplane openstack --type=merge --patch '
   spec:
     telemetry:
       template:
         metricStorage:
           enabled: true
           monitoringStack:
             alertingEnabled: true
             scrapeInterval: 30s
             storage:
               strategy: persistent
               retention: 24h
               persistent:
                 pvcStorageRequest: 20G
   '

验证

1. 验证 alertmanager 和 prometheus pod 是否可用：

   $ oc get pods -l alertmanager=metric-storage
   NAME                            READY   STATUS    RESTARTS   AGE
   alertmanager-metric-storage-0   2/2     Running   0          46s
   alertmanager-metric-storage-1   2/2     Running   0          46s
   
   $ oc get pods -l prometheus=metric-storage
   NAME                          READY   STATUS    RESTARTS   AGE
   prometheus-metric-storage-0   3/3     Running   0          46s

2. 检查生成的 Ceilometer pod：

   CEILOMETETR_POD=`oc get pods -l service=ceilometer | tail -n 1 | cut -f 1 -d' '`
   oc exec -t $CEILOMETETR_POD -c ceilometer-central-agent -- cat /etc/ceilometer/ceilometer.conf

3. 检查已启用的 pollsters:

   $ oc get secret ceilometer-config-data -o jsonpath="{.data['polling\.yaml\.j2']}"  | base64 -d

4. 可选：根据环境要求覆盖默认 pollsters：

   $ oc patch openstackcontrolplane controlplane --type=merge --patch '
   spec:
     telemetry:
       template:
         ceilometer:
             defaultConfigOverwrite:
               polling.yaml.j2: |
                 ---
                 sources:
                   - name: pollsters
                     interval: 100
                     meters:
                       - volume.*
                       - image.size
             enabled: true
             secret: osp-secret
   '

后续步骤

1. 可选：对 OpenStackControlPlane CR 进行补丁，使其包含 日志记录 ：

   $ oc patch openstackcontrolplane openstack --type=merge --patch '
   spec:
     telemetry:
       template:
         logging:
         enabled: false
         ipaddr: 172.17.0.80
         port: 10514
         cloNamespace: openshift-logging
   '

流程

1. 对 OpenStackControlPlane CR 进行补丁来部署自动扩展服务：

   $ oc patch openstackcontrolplane openstack --type=merge --patch '
   spec:
     telemetry:
       enabled: true
       template:
         autoscaling:
           enabled: true
           aodh:
             passwordSelector:
               aodhService: AodhPassword
             databaseAccount: aodh
             databaseInstance: openstack
             secret: osp-secret
             serviceUser: aodh
           heatInstance: heat
   '

2. 检查 aodh pod:

   $ AODH_POD=`oc get pods -l service=aodh | tail -n 1 | cut -f 1 -d' '`
   $ oc exec -t $AODH_POD -c aodh-api -- cat /etc/aodh/aodh.conf

3. 检查 aodh API 服务是否在 Identity 服务中注册：

   $ openstack endpoint list | grep aodh
   | d05d120153cd4f9b8310ac396b572926 | regionOne | aodh  | alarming  | True    | internal  | http://aodh-internal.openstack.svc:8042  |
   | d6daee0183494d7a9a5faee681c79046 | regionOne | aodh  | alarming  | True    | public    | http://aodh-public.openstack.svc:8042    |

4. 可选：使用 PrometheusAlarm 警报类型创建 aodh 警报：

   注意

   您必须使用 PrometheusAlarm 警报类型，而不是 GnocchiAggregationByResourcesAlarm。

   $ openstack alarm create --name high_cpu_alarm \
   --type prometheus \
   --query "(rate(ceilometer_cpu{resource_name=~'cirros'})) * 100" \
   --alarm-action 'log://' \
   --granularity 15 \
   --evaluation-periods 3 \
   --comparison-operator gt \
   --threshold 7000000000

   1. 验证警报是否已启用：

      $ openstack alarm list
      +--------------------------------------+------------+------------------+-------------------+----------+
      | alarm_id                             | type       | name             | state  | severity | enabled  |
      +--------------------------------------+------------+------------------+-------------------+----------+
      | 209dc2e9-f9d6-40e5-aecc-e767ce50e9c0 | prometheus | prometheus_alarm |   ok   |    low   |   True   |
      +--------------------------------------+------------+------------------+-------------------+----------+

流程

1. 根据您的环境在 os-diff.cfg 中更新您的 ssh 参数。os-diff 使用 ssh 参数连接到 director Operator 节点，然后查询并下载配置文件：

   ssh_cmd=ssh -F ssh.config standalone
   container_engine=podman
   connection=ssh
   remote_config_path=/tmp/tripleo

   确保您在 ssh_cmd 参数中提供的 ssh 命令正确，并包含密钥身份验证。

2. 启用您要包含在 /etc/os-diff/config.yaml 文件中的服务，并禁用您要从文件中排除的服务。确保具有编辑文件的正确权限：

   $ chown ospng:ospng /etc/os-diff/config.yaml

   以下示例允许默认 Identity 服务(keystone)包含在 /etc/os-diff/config.yaml 文件中：

   # service name and file location
   services:
     # Service name
     keystone:
       # Bool to enable/disable a service (not implemented yet)
       enable: true
       # Pod name, in both OCP and podman context.
       # It could be strict match or will only just grep the podman_name
       # and work with all the pods which matched with pod_name.
       # To enable/disable use strict_pod_name_match: true/false
       podman_name: keystone
       pod_name: keystone
       container_name: keystone-api
       # pod options
       # strict match for getting pod id in TripleO and podman context
       strict_pod_name_match: false
       # Path of the config files you want to analyze.
       # It could be whatever path you want:
       # /etc/<service_name> or /etc or /usr/share/<something> or even /
       # @TODO: need to implement loop over path to support multiple paths such as:
       # - /etc
       # - /usr/share
       path:
         - /etc/
         - /etc/keystone
         - /etc/keystone/keystone.conf
         - /etc/keystone/logging.conf

   对您要禁用或启用的每个 RHOSP 服务重复此步骤。

3. 如果您使用非容器化服务，如 ovs-external-ids，请拉取配置或命令输出。例如：

   services:
     ovs_external_ids:
       hosts: 

   1

   
         - standalone
       service_command: "ovs-vsctl list Open_vSwitch . | grep external_ids | awk -F ': ' '{ print $2; }'" 

   2

   
       cat_output: true 

   3

   
       path:
         - ovs_external_ids.json
       config_mapping: 

   4

   
         ovn-bridge-mappings: edpm_ovn_bridge_mappings 

   5

   
         ovn-bridge: edpm_ovn_bridge
         ovn-encap-type: edpm_ovn_encap_type
         ovn-monitor-all: ovn_monitor_all
         ovn-remote-probe-interval: edpm_ovn_remote_probe_interval
         ovn-ofctrl-wait-before-clear: edpm_ovn_ofctrl_wait_before_clear

   注意

   您必须正确配置 SSH 配置文件或相当于非标准服务，如 OVS。ovs_external_ids 服务不在容器中运行，并且 OVS 数据存储在云的每个主机上，如 controller_1/controller_2/ 等。

   1

   主机列表，如 compute-1、compute-2。

   2

   针对主机运行的命令。

   3

   os-diff 获取命令的输出，并将输出存储在由密钥路径指定的文件中。

   4

   在这个示例中，在 data plane 自定义资源定义和 ovs-vsctl 输出之间提供一个映射。

   5

   edpm_ovn_bridge_mappings 变量必须是字符串列表，如 ["datacentre:br-ex "]。

   1. 比较值：

      $ os-diff diff ovs_external_ids.json edpm.crd --crd --service ovs_external_ids

      例如，要在每台主机上检查 /etc/yum.conf，您必须将以下语句放在 config.yaml 文件中。以下示例使用一个名为 yum_config 的文件：

      services:
        yum_config:
          hosts:
            - undercloud
            - controller_1
            - compute_1
            - compute_2
          service_command: "cat /etc/yum.conf"
          cat_output: true
          path:
            - yum.conf

4. 拉取配置：

   注意

   以下命令拉取 /etc/os-diff/config.yaml 文件中包含的所有配置文件。您可以使用--update 或--update- only 选项，将 os-diff 配置为根据运行的环境 自动更新此文件。这些选项将 podman 信息设置为所有正在运行的容器的 config.yaml 中。当所有 Red Hat OpenStack Platform 服务都已关闭时，podman 信息可能会很有用。

   请注意，当 config.yaml 文件自动填充时，您必须手动为每个服务提供配置路径。

   # will only update the /etc/os-diff/config.yaml
   os-diff pull --update-only

   # will update the /etc/os-diff/config.yaml and pull configuration
   os-diff pull --update

   # will update the /etc/os-diff/config.yaml and pull configuration
   os-diff pull

   配置默认拉取并存储在以下目录中：

   /tmp/tripleo/

流程

1. 要将源云恢复到工作状态，请启动之前在采用过程中停止的 RHOSP control plane 服务：

   ServicesToStart=("tripleo_horizon.service"
                    "tripleo_keystone.service"
                    "tripleo_barbican_api.service"
                    "tripleo_barbican_worker.service"
                    "tripleo_barbican_keystone_listener.service"
                    "tripleo_cinder_api.service"
                    "tripleo_cinder_api_cron.service"
                    "tripleo_cinder_scheduler.service"
                    "tripleo_cinder_volume.service"
                    "tripleo_cinder_backup.service"
                    "tripleo_glance_api.service"
                    "tripleo_manila_api.service"
                    "tripleo_manila_api_cron.service"
                    "tripleo_manila_scheduler.service"
                    "tripleo_neutron_api.service"
                    "tripleo_placement_api.service"
                    "tripleo_nova_api_cron.service"
                    "tripleo_nova_api.service"
                    "tripleo_nova_conductor.service"
                    "tripleo_nova_metadata.service"
                    "tripleo_nova_scheduler.service"
                    "tripleo_nova_vnc_proxy.service"
                    "tripleo_aodh_api.service"
                    "tripleo_aodh_api_cron.service"
                    "tripleo_aodh_evaluator.service"
                    "tripleo_aodh_listener.service"
                    "tripleo_aodh_notifier.service"
                    "tripleo_ceilometer_agent_central.service"
                    "tripleo_ceilometer_agent_compute.service"
                    "tripleo_ceilometer_agent_ipmi.service"
                    "tripleo_ceilometer_agent_notification.service"
                    "tripleo_ovn_cluster_north_db_server.service"
                    "tripleo_ovn_cluster_south_db_server.service"
                    "tripleo_ovn_cluster_northd.service"
                    "tripleo_octavia_api.service"
                    "tripleo_octavia_health_manager.service"
                    "tripleo_octavia_rsyslog.service"
                    "tripleo_octavia_driver_agent.service"
                    "tripleo_octavia_housekeeping.service"
                    "tripleo_octavia_worker.service")
   
   PacemakerResourcesToStart=("galera-bundle"
                              "haproxy-bundle"
                              "rabbitmq-bundle"
                              "openstack-cinder-volume"
                              "openstack-cinder-backup"
                              "openstack-manila-share")
   
   echo "Starting systemd OpenStack services"
   for service in ${ServicesToStart[*]}; do
       for i in {1..3}; do
           SSH_CMD=CONTROLLER${i}_SSH
           if [ ! -z "${!SSH_CMD}" ]; then
               if ${!SSH_CMD} sudo systemctl is-enabled $service &> /dev/null; then
                   echo "Starting the $service in controller $i"
                   ${!SSH_CMD} sudo systemctl start $service
               fi
           fi
       done
   done
   
   echo "Checking systemd OpenStack services"
   for service in ${ServicesToStart[*]}; do
       for i in {1..3}; do
           SSH_CMD=CONTROLLER${i}_SSH
           if [ ! -z "${!SSH_CMD}" ]; then
               if ${!SSH_CMD} sudo systemctl is-enabled $service &> /dev/null; then
                   if ! ${!SSH_CMD} systemctl show $service | grep ActiveState=active >/dev/null; then
                       echo "ERROR: Service $service is not running on controller $i"
                   else
                       echo "OK: Service $service is running in controller $i"
                   fi
               fi
           fi
       done
   done
   
   echo "Starting pacemaker OpenStack services"
   for i in {1..3}; do
       SSH_CMD=CONTROLLER${i}_SSH
       if [ ! -z "${!SSH_CMD}" ]; then
           echo "Using controller $i to run pacemaker commands"
           for resource in ${PacemakerResourcesToStart[*]}; do
               if ${!SSH_CMD} sudo pcs resource config $resource &>/dev/null; then
                   echo "Starting $resource"
                   ${!SSH_CMD} sudo pcs resource enable $resource
               else
                   echo "Service $resource not present"
               fi
           done
           break
       fi
   done
   
   echo "Checking pacemaker OpenStack services"
   for i in {1..3}; do
       SSH_CMD=CONTROLLER${i}_SSH
       if [ ! -z "${!SSH_CMD}" ]; then
           echo "Using controller $i to run pacemaker commands"
           for resource in ${PacemakerResourcesToStop[*]}; do
               if ${!SSH_CMD} sudo pcs resource config $resource &>/dev/null; then
                   if ${!SSH_CMD} sudo pcs resource status $resource | grep Started >/dev/null; then
                       echo "OK: Service $resource is started"
                   else
                       echo "ERROR: Service $resource is stopped"
                   fi
               fi
           done
           break
       fi
   done

2. 如果 Ceph NFS 服务在作为共享文件系统服务(manila)后端部署上运行，您必须为 openstack-manila-share 服务恢复 Pacemaker 顺序和 colocation 约束：

   $ sudo pcs constraint order start ceph-nfs then openstack-manila-share kind=Optional id=order-ceph-nfs-openstack-manila-share-Optional
   $ sudo pcs constraint colocation add openstack-manila-share with ceph-nfs score=INFINITY id=colocation-openstack-manila-share-ceph-nfs-INFINITY

3. 验证源云是否可再次运行，例如，您可以运行 openstack CLI 命令，如 openstack server list，或检查您可以访问 Dashboard 服务(horizon)。

4. 删除部分或完全部署的 control plane，以便以后可以再次尝试采用：

   $ oc delete --ignore-not-found=true --wait=false openstackcontrolplane/openstack
   $ oc patch openstackcontrolplane openstack --type=merge --patch '
   metadata:
     finalizers: []
   ' || true
   
   while oc get pod | grep rabbitmq-server-0; do
       sleep 2
   done
   while oc get pod | grep openstack-galera-0; do
       sleep 2
   done
   
   $ oc delete --ignore-not-found=true --wait=false pod mariadb-copy-data
   $ oc delete --ignore-not-found=true --wait=false pvc mariadb-data
   $ oc delete --ignore-not-found=true --wait=false pod ovn-copy-data
   $ oc delete --ignore-not-found=true secret osp-secret

流程

1. 为 data plane 节点创建 SSH 身份验证 secret：

   $ oc apply -f - <<EOF
   apiVersion: v1
   kind: Secret
   metadata:
       name: dataplane-adoption-secret
   data:
       ssh-privatekey: |
   $(cat <path_to_SSH_key> | base64 | sed 's/^/        /')
   EOF

   • 将 <path_to_SSH_key > 替换为 SSH 密钥的路径。

2. 生成 ssh 密钥对 nova-migration-ssh-key secret：

   $ cd "$(mktemp -d)"
   $ ssh-keygen -f ./id -t ecdsa-sha2-nistp521 -N ''
   $ oc get secret nova-migration-ssh-key || oc create secret generic nova-migration-ssh-key \
     --from-file=ssh-privatekey=id \
     --from-file=ssh-publickey=id.pub \
     --type kubernetes.io/ssh-auth
   $ rm -f id*
   $ cd -

3. 如果启用了 TLS Everywhere，将 LIBVIRT_PASSWORD 设置为与现有的 RHOSP 部署密码匹配：

   declare -A TRIPLEO_PASSWORDS
   TRIPLEO_PASSWORDS[default]="$HOME/overcloud-passwords.yaml"
   LIBVIRT_PASSWORD=$(cat ${TRIPLEO_PASSWORDS[default]} | grep ' LibvirtTLSPassword:' | awk -F ': ' '{ print $2; }')
   LIBVIRT_PASSWORD_BASE64=$(echo -n "$LIBVIRT_PASSWORD" | base64)

   1. 启用 TLS-e 时创建 libvirt-secret：

      $ oc apply -f - <<EOF
      apiVersion: v1
      kind: Secret
      metadata:
        name: libvirt-secret
      type: Opaque
      data:
        LibvirtPassword: ${LIBVIRT_PASSWORD_BASE64}
      EOF

4. 创建一个配置映射，用于所有单元来为 libvirt 配置本地存储后端：

   $ oc apply -f - <<EOF
   apiVersion: v1
   kind: ConfigMap
   metadata:
     name: nova-cells-global-config
   data: 

   1

   
     99-nova-compute-cells-workarounds.conf: | 

   2

   
       [workarounds]
       disable_compute_service_check_for_ffu=true
   EOF

   1

   ConfigMap 中的 data 资源为所有单元提供配置文件。

   2

   根据优先级将 &lt ;*.conf& gt; 文件从 03 索引为 99。& lt;99636.conf > 文件具有最高的优先级，而以下 03 的索引则保留给内部使用。

   注意

   如果您采用 live 云，您可能需要执行存储在 cell1 默认 nova -extra-config 配置映射中的默认 nova data plane 服务的额外配置。不要删除或覆盖分配给 nova 的 cell1 默认 nova-extra-config 配置映射中的现有配置。覆盖配置可能会破坏依赖于 nova-extra-config 配置映射特定内容的数据位置服务。

5. 为 libvirt 配置 Red Hat Ceph Storage 后端：

   $ oc apply -f - <<EOF
   apiVersion: v1
   kind: ConfigMap
   metadata:
     name: nova-cells-global-config
   data:
     99-nova-compute-cells-workarounds.conf: |
       [workarounds]
       disable_compute_service_check_for_ffu=true
     03-ceph-nova.conf: |
       [libvirt]
       images_type=rbd
       images_rbd_pool=vms
       images_rbd_ceph_conf=/etc/ceph/ceph.conf
       images_rbd_glance_store_name=default_backend
       images_rbd_glance_copy_poll_interval=15
       images_rbd_glance_copy_timeout=600
       rbd_user=openstack
       rbd_secret_uuid=$CEPH_FSID
   EOF

   注意

   对于带有多单元配置的 Red Hat Ceph Storage 环境，您必须命名配置映射和 Red Hat OpenStack Platform 数据平面服务，如下例所示： nova-custom-ceph-cellX 和 nova-compute-extraconfig-cellX。

6. 为 Compute 服务单元创建 data plane 服务以启用预升级临时解决方案，并为您选择的存储后端配置 Compute 服务：

   for CELL in $(echo $RENAMED_CELLS); do
    $ oc apply -f - <<EOF
   ---
   apiVersion: dataplane.openstack.org/v1beta1
   kind: OpenStackDataPlaneService
   metadata:
     name: nova-$CELL
   spec:
     dataSources: 

   1

   
       - secretRef:
           name: nova-$CELL-compute-config 

   2

   
       - secretRef:
           name: nova-migration-ssh-key 

   3

   
       - configMapRef:
           name: nova-cells-global-config
     playbook: osp.edpm.nova
     caCerts: combined-ca-bundle
     edpmServiceType: nova
     containerImageFields:
     - NovaComputeImage
     - EdpmIscsidImage
   EOF
     done

   • 如果启用了 TLS Everywhere，请将以下内容附加到 OpenStackDataPlaneService CR 中：

       tlsCerts:
         contents:
           - dnsnames
           - ips
         networks:
           - ctlplane
         issuer: osp-rootca-issuer-internal
         edpmRoleServiceName: nova
       caCerts: combined-ca-bundle
       edpmServiceType: nova

     1

     要为 cell<X> 启用本地元数据服务，请附加 spec.dataSources.secretRef 来引用额外的自动生成的 nova-cell<X>-metadata-neutron-config secret。您还应该在 OpenStackControlPlane/openstack CR 中设置 spec.nova.template.cellTemplates.cell<X>.metadataServiceTemplate.enable，如 Adopt ing the Compute 服务 中所述。您可以配置单个顶级元数据，或者定义每个单元的元数据。

     2

     每个单元格的 secret nova-cell<X>-compute-config auto-generates。

     3

     您必须为每个与 Compute 服务相关的自定义 OpenStackDataPlaneService CR 附加 nova-cell<X>-compute-config 和 nova-migration-ssh-key 引用。

     注意

     为 Compute 服务单元创建数据平面服务时，请查看以下注意事项：

     • 在本例中，相同的 nova-migration-ssh-key 键在单元格之间共享。但是，您应该对不同的单元使用不同的键。
     • 对于简单的配置覆盖，您不需要自定义数据平面服务。但是，要重新配置单元 cell1，st 选项是创建自定义服务和专用配置映射。
     • 单元 cell1 已使用名为 nova 及其 nova-extra-config 配置映射的默认 OpenStackDataPlaneService CR 管理。不要更改默认的 data plane 服务 nova 定义。当使用 OLM 更新 RHOSO Operator 时，这些更改将会丢失。
     • 当单元跨越多个节点集时，为自定义 OpenStackDataPlaneService 资源提供与节点集合相关的名称，如 nova-cell1-nfv 和 nova-cell1-enterprise。然后，自动生成的配置映射命名为 nova-cell1-nfv-extra-config 和 nova-cell1-enterprise-extra-config。
     • 也支持同一单元的多个节点集合中节点的不同配置，但本指南中不阐述。

7. 为订阅管理器创建 secret：

   $ oc create secret generic subscription-manager \
   --from-literal rhc_auth='{"login": {"username": "<subscription_manager_username>", "password": "<subscription_manager_password>"}}'

   • 将 <subscription_manager_username& gt; 替换为适用的用户名。
   • 将 <subscription_manager_password& gt; 替换为适用的密码。

8. 为 Red Hat registry 创建 secret：

   $ oc create secret generic redhat-registry \
   --from-literal edpm_container_registry_logins='{"registry.redhat.io": {"<registry_username>": "<registry_password>"}}'

   • 将 <registry_username& gt; 替换为适用的用户名。

   • 将 <registry_password& gt; 替换为适用的密码。

     注意

     您不需要在 OpenStackDataPlaneService CR 的 dataSources 字段中引用 subscription-manager secret。secret 已通过 nodeTemplate 字段中 ansibleVarsFrom 属性中的特定于节点的 OpenStackDataPlaneNodeSet CR 传递。

9. 为每个单元创建 data plane 节点设置定义：

   $ declare -A names
   $ for CELL in $(echo $RENAMED_CELLS); do
     ref="COMPUTES_$(echo ${CELL}|tr '[:lower:]' '[:upper:]')"
     eval names=\${!${ref}[@]}
     ref_api="COMPUTES_API_$(echo ${CELL}|tr '[:lower:]' '[:upper:]')"
     [ -z "$names" ] && continue
     ind=0
     rm -f computes-$CELL
     for compute in $names; do
       ip="${ref}['$compute']"
       ip_api="${ref_api}['$compute']"
       cat >> computes-$CELL << EOF
       ${compute}:
         hostName: $compute 

   1

   
         ansible:
           ansibleHost: $compute
         networks: 

   2

   
         - defaultRoute: true
           fixedIP: ${!ip}
           name: ctlplane
           subnetName: subnet1
         - name: internalapi
           subnetName: subnet1
           fixedIP: ${!ip_api}
         - name: storage
           subnetName: subnet1
         - name: tenant
           subnetName: subnet1
   EOF
       ind=$(( ind + 1 ))
     done
   
     test -f computes-$CELL || continue
     cat > nodeset-${CELL}.yaml <<EOF
   apiVersion: dataplane.openstack.org/v1beta1
   kind: OpenStackDataPlaneNodeSet
   metadata:
     name: openstack-$CELL 

   3

   
   spec:
     tlsEnabled: false 

   4

   
     networkAttachments:
         - ctlplane
     preProvisioned: true
     services:
       - redhat
       - bootstrap
       - download-cache
       - configure-network
       - validate-network
       - install-os
       - configure-os
       - ssh-known-hosts
       - run-os
       - reboot-os
       - install-certs
       - ovn
       - neutron-metadata
       - libvirt
       - nova-$CELL
       - telemetry 

   5

   
     env:
       - name: ANSIBLE_CALLBACKS_ENABLED
         value: "profile_tasks"
       - name: ANSIBLE_FORCE_COLOR
         value: "True"
       - name: ANSIBLE_VERBOSITY
         value: '3'
     nodeTemplate:
       ansibleSSHPrivateKeySecret: dataplane-adoption-secret
       ansible:
         ansibleUser: root
         ansibleVarsFrom:
         - secretRef:
             name: subscription-manager
         - secretRef:
             name: redhat-registry
         ansibleVars:
           rhc_release: 9.2
           rhc_repositories:
               - {name: "*", state: disabled}
               - {name: "rhel-9-for-x86_64-baseos-eus-rpms", state: enabled}
               - {name: "rhel-9-for-x86_64-appstream-eus-rpms", state: enabled}
               - {name: "rhel-9-for-x86_64-highavailability-eus-rpms", state: enabled}
               - {name: "rhoso-18.0-for-rhel-9-x86_64-rpms", state: enabled}
               - {name: "fast-datapath-for-rhel-9-x86_64-rpms", state: enabled}
               - {name: "rhceph-7-tools-for-rhel-9-x86_64-rpms", state: enabled}
           edpm_bootstrap_release_version_package: []
           # edpm_network_config
           # Default nic config template for a EDPM node
           # These vars are edpm_network_config role vars
           edpm_network_config_template: |
              ---
              {% set mtu_list = [ctlplane_mtu] %}
              {% for network in nodeset_networks %}
              {% set _ = mtu_list.append(lookup('vars', networks_lower[network] ~ '_mtu')) %}
              {%- endfor %}
              {% set min_viable_mtu = mtu_list | max %}
              network_config:
              - type: ovs_bridge
                name: {{ neutron_physical_bridge_name }}
                mtu: {{ min_viable_mtu }}
                use_dhcp: false
                dns_servers: {{ ctlplane_dns_nameservers }}
                domain: {{ dns_search_domains }}
                addresses:
                - ip_netmask: {{ ctlplane_ip }}/{{ ctlplane_cidr }}
                routes: {{ ctlplane_host_routes }}
                members:
                - type: interface
                  name: nic1
                  mtu: {{ min_viable_mtu }}
                  # force the MAC address of the bridge to this interface
                  primary: true
              {% for network in nodeset_networks %}
                - type: vlan
                  mtu: {{ lookup('vars', networks_lower[network] ~ '_mtu') }}
                  vlan_id: {{ lookup('vars', networks_lower[network] ~ '_vlan_id') }}
                  addresses:
                  - ip_netmask:
                      {{ lookup('vars', networks_lower[network] ~ '_ip') }}/{{ lookup('vars', networks_lower[network] ~ '_cidr') }}
                  routes: {{ lookup('vars', networks_lower[network] ~ '_host_routes') }}
              {% endfor %}
   
           edpm_network_config_nmstate: false
           # Control resolv.conf management by NetworkManager
           # false = disable NetworkManager resolv.conf update (default)
           # true = enable NetworkManager resolv.conf update
           edpm_bootstrap_network_resolvconf_update: false
           edpm_network_config_hide_sensitive_logs: false
           #
           # These vars are for the network config templates themselves and are
           # considered EDPM network defaults.
           neutron_physical_bridge_name: br-ctlplane 

   6

   
           neutron_public_interface_name: eth0
   
           # edpm_nodes_validation
           edpm_nodes_validation_validate_controllers_icmp: false
           edpm_nodes_validation_validate_gateway_icmp: false
   
           # edpm ovn-controller configuration
           edpm_ovn_bridge_mappings: <bridge_mappings> 

   7

   
           edpm_ovn_bridge: br-int
           edpm_ovn_encap_type: geneve
           ovn_monitor_all: true
           edpm_ovn_remote_probe_interval: 60000
           edpm_ovn_ofctrl_wait_before_clear: 8000
   
           timesync_ntp_servers:
           - hostname: clock.redhat.com
           - hostname: clock2.redhat.com
   
           edpm_bootstrap_command: |
             # FIXME: perform dnf upgrade for other packages in EDPM ansible
             # here we only ensuring that decontainerized libvirt can start
             dnf -y upgrade openstack-selinux
             rm -f /run/virtlogd.pid
   
           gather_facts: false
           # edpm firewall, change the allowed CIDR if needed
           edpm_sshd_configure_firewall: true
           edpm_sshd_allowed_ranges: ['192.168.122.0/24']
   
           # Do not attempt OVS major upgrades here
           edpm_ovs_packages:
           - openvswitch3.3
           edpm_default_mounts: 

   8

   
             - path: /dev/hugepages<size>
               opts: pagesize=<size>
               fstype: hugetlbfs
               group: hugetlbfs
     nodes:
   EOF
     cat computes-$CELL >> nodeset-${CELL}.yaml
   done

   1

   如果您的部署有一个自定义 DNS 域，请指定节点的 FQDN。

   2

   网络组成必须与源云配置匹配，以避免数据平面连接停机时间。ctlplane 网络必须首先出现。命令仅保留 ctlplane 和 internalapi 网络上的主机的 IP 地址。对其他隔离网络重复此步骤，或者手动更新生成的文件。

   3

   使用节点集名称，如 openstack-cell1、 openstack-cell2。仅为包含 Compute 节点的单元创建节点集。

   4

   如果启用了 TLS Everywhere，请将 tlsEnabled 更改为 true。

   5

   如果没有使用 telemetry 服务，请从 services 列表中省略它。

   6

   网桥名称和其他 OVN 和网络服务特定值必须与源云配置匹配，以避免数据平面连接停机时间。

   7

   将 <bridge_mappings > 替换为您的配置中网桥映射的值，如 "datacentre:br-ctlplane "。

   8

   要配置巨页，将 &lt ;size > 替换为页面的大小。要配置多大小巨页，请在列表中创建更多项目。请注意，挂载点必须与源云配置匹配。

   注意

   在采用前，请确保在 Compute 服务节点中使用的 OpenStackDataPlaneNodeSet CR 中使用相同的 ovn-controller 设置。此配置存储在 Open vSwitch 数据库的 Open_vSwitch 表中的 external_ids 列中：

   $ ovs-vsctl list Open .
   ...
   external_ids        : {hostname=standalone.localdomain, ovn-bridge=br-int, ovn-bridge-mappings=<bridge_mappings>, ovn-chassis-mac-mappings="datacentre:1e:0a:bb:e6:7c:ad", ovn-encap-ip="172.19.0.100", ovn-encap-tos="0", ovn-encap-type=geneve, ovn-match-northd-version=False, ovn-monitor-all=True, ovn-ofctrl-wait-before-clear="8000", ovn-openflow-probe-interval="60", ovn-remote="tcp:ovsdbserver-sb.openstack.svc:6642", ovn-remote-probe-interval="60000", rundir="/var/run/openvswitch", system-id="2eec68e6-aa21-4c95-a868-31aeafc11736"}
   ...

10. 为每个 Compute 单元部署 OpenStackDataPlaneNodeSet CR：

    $ for CELL in $(echo $RENAMED_CELLS); do
    > test -f nodeset-${CELL}.yaml || continue
    > oc apply -f nodeset-${CELL}.yaml
    > done

11. 如果将 Red Hat Ceph Storage 后端用于块存储服务(cinder)，请准备采用的 data plane 工作负载：

    $ for CELL in $(echo $RENAMED_CELLS); do
      test -f nodeset-${CELL}.yaml || continue
    $ oc patch osdpns/openstack-$CELL --type=merge --patch "
      spec:
        services:
          - redhat
          - bootstrap
          - download-cache
          - configure-network
          - validate-network
          - install-os
          - configure-os
          - ssh-known-hosts
          - run-os
          - reboot-os
          - ceph-client
          - install-certs
          - ovn
          - neutron-metadata
          - libvirt
          - nova-$CELL
          - telemetry
        nodeTemplate:
          extraMounts:
          - extraVolType: Ceph
            volumes:
            - name: ceph
              secret:
                secretName: ceph-conf-files
            mounts:
            - name: ceph
              mountPath: "/etc/ceph"
              readOnly: true
      "
    done

    注意

    确保使用与原始 OpenStackDataPlaneNodeSet CR 相同的服务列表，但 ceph-client 和 ceph-hci-pre 服务除外。

12. 可选：在 OpenStackDataPlaneNodeSet CR 中启用 neutron-sriov-nic-agent ：

    $ for CELL in $(echo $RENAMED_CELLS); do
      test -f nodeset-${CELL}.yaml || continue
    $ oc patch openstackdataplanenodeset openstack-$CELL --type='json' --patch='[
      {
        "op": "add",
        "path": "/spec/services/-",
        "value": "neutron-sriov"
      }, {
        "op": "add",
        "path": "/spec/nodeTemplate/ansible/ansibleVars/edpm_neutron_sriov_agent_SRIOV_NIC_physical_device_mappings",
        "value": "dummy_sriov_net:dummy-dev"
      }, {
        "op": "add",
        "path": "/spec/nodeTemplate/ansible/ansibleVars/edpm_neutron_sriov_agent_SRIOV_NIC_resource_provider_bandwidths",
        "value": "dummy-dev:40000000:40000000"
      }, {
        "op": "add",
        "path": "/spec/nodeTemplate/ansible/ansibleVars/edpm_neutron_sriov_agent_SRIOV_NIC_resource_provider_hypervisors",
        "value": "dummy-dev:standalone.localdomain"
      }]'
      done

13. 可选：在 OpenStackDataPlaneNodeSet CR 中启用 neutron-dhcp ：

    $ for CELL in $(echo $RENAMED_CELLS); do
      test -f nodeset-${CELL}.yaml || continue
    $ oc patch openstackdataplanenodeset openstack-$CELL --type='json' --patch='[
      {
        "op": "add",
        "path": "/spec/services/-",
        "value": "neutron-dhcp"
      }]'
    done

    注意

    要将 neutron-dhcp 与 OVN 用于裸机置备服务(ironic)，您必须将 Networking 服务(neutron)的 disable_ovn_dhcp_for_baremetal_ports 配置选项设为 true。您可以在 NeutronAPI spec 中设置此配置：

    ..
    spec:
      serviceUser: neutron
       ...
          customServiceConfig: |
              [DEFAULT]
              dhcp_agent_notification = True
              [ovn]
              disable_ovn_dhcp_for_baremetal_ports = true

14. 运行 pre-adoption 验证：

    1. 创建验证服务：

       $ oc apply -f - <<EOF
       apiVersion: dataplane.openstack.org/v1beta1
       kind: OpenStackDataPlaneService
       metadata:
         name: pre-adoption-validation
       spec:
         playbook: osp.edpm.pre_adoption_validation
       EOF

    2. 创建仅运行验证的 OpenStackDataPlaneDeployment CR：

       $ oc apply -f - <<EOF
       apiVersion: dataplane.openstack.org/v1beta1
       kind: OpenStackDataPlaneDeployment
       metadata:
         name: openstack-pre-adoption
       spec:
         nodeSets: $NODESETS
         servicesOverride:
         - pre-adoption-validation
       EOF

       注意

       如果您为不同的 OpenStackDataPlaneService CR 创建不同的迁移 SSH 密钥，则也应该为代表单元的每个节点设置或节点集定义一个单独的 OpenStackDataPlaneDeployment CR。

    3. 验证完成后，确认 Ansible EE pod 的状态为 Completed ：

       $ watch oc get pod -l app=openstackansibleee

       $ oc logs -l app=openstackansibleee -f --max-log-requests 20

    4. 等待部署变为 Ready 状态：

       $ oc wait --for condition=Ready openstackdataplanedeployment/openstack-pre-adoption --timeout=10m

       重要

       如果任何 openstack-pre-adoption 验证失败，您必须引用 Ansible 日志来确定哪些失败，然后尝试以下故障排除选项：

       • 如果主机名验证失败，请检查 data plane 节点的主机名是否在 OpenStackDataPlaneNodeSet CR 中正确列出。
       • 如果内核参数检查失败，请确保 OpenStackDataPlaneNodeSet CR 中的 edpm_kernel_args 和 edpm_kernel_hugepages 变量中的内核参数配置与您在 Red Hat OpenStack Platform (RHOSP) 17.1 节点中使用的内核参数配置相同。
       • 如果 tuned 配置集检查失败，请确保 OpenStackDataPlaneNodeSet CR 中的 edpm_tuned_profile 变量配置为使用与 RHOSP 17.1 节点上的设置相同的配置集。

15. 删除剩余的 director Operator 服务：

    1. 创建 OpenStackDataPlaneService CR 来清理您正在使用的数据平面服务：

       $ oc apply -f - <<EOF
       apiVersion: dataplane.openstack.org/v1beta1
       kind: OpenStackDataPlaneService
       metadata:
         name: tripleo-cleanup
       spec:
         playbook: osp.edpm.tripleo_cleanup
       EOF

    2. 创建 OpenStackDataPlaneDeployment CR 以运行清理：

       $ oc apply -f - <<EOF
       apiVersion: dataplane.openstack.org/v1beta1
       kind: OpenStackDataPlaneDeployment
       metadata:
         name: tripleo-cleanup
       spec:
         nodeSets: $NODESETS
         servicesOverride:
         - tripleo-cleanup
       EOF

16. 完成清理后，部署 OpenStackDataPlaneDeployment CR：

    $ oc apply -f - <<EOF
    apiVersion: dataplane.openstack.org/v1beta1
    kind: OpenStackDataPlaneDeployment
    metadata:
      name: openstack
    spec:
      nodeSets: $NODESETS
    EOF

    注意

    如果将其他节点设置为要部署的，如 Networker 节点，您可以在此步骤的 nodeSets 列表中添加它们，或者稍后创建单独的 OpenStackDataPlaneDeployment CR。您不能在部署后将新节点设置为 OpenStackDataPlaneDeployment CR。

验证

1. 确认所有 Ansible EE pod 都到达 Completed 状态：

   $ watch oc get pod -l app=openstackansibleee

   $ oc logs -l app=openstackansibleee -f --max-log-requests 20

2. 等待 data plane 节点设置为 Ready 状态：

   $ for CELL in $(echo $RENAMED_CELLS); do
   > oc wait --for condition=Ready osdpns/openstack-$CELL --timeout=30m
   > done

3. 验证 Networking 服务(neutron)代理是否正在运行：

   $ oc exec openstackclient -- openstack network agent list
   +--------------------------------------+------------------------------+------------------------+-------------------+-------+-------+----------------------------+
   | ID                                   | Agent Type                   | Host                   | Availability Zone | Alive | State | Binary                     |
   +--------------------------------------+------------------------------+------------------------+-------------------+-------+-------+----------------------------+
   | 174fc099-5cc9-4348-b8fc-59ed44fcfb0e | DHCP agent                   | standalone.localdomain | nova              | :-)   | UP    | neutron-dhcp-agent         |
   | 10482583-2130-5b0d-958f-3430da21b929 | OVN Metadata agent           | standalone.localdomain |                   | :-)   | UP    | neutron-ovn-metadata-agent |
   | a4f1b584-16f1-4937-b2b0-28102a3f6eaa | OVN Controller agent         | standalone.localdomain |                   | :-)   | UP    | ovn-controller             |
   +--------------------------------------+------------------------------+------------------------+-------------------+-------+-------+----------------------------+

流程

1. 等待 Compute 服务数据平面服务版本为所有单元更新：

   $ for CELL in $(echo $RENAMED_CELLS); do
   > oc exec openstack-$CELL-galera-0 -c galera -- mysql -rs -uroot -p"${PODIFIED_DB_ROOT_PASSWORD[$CELL]}" \
   >   -e "select a.version from nova_${CELL}.services a join nova_${CELL}.services b where a.version!=b.version and a.binary='nova-compute' and a.deleted=0;"
   > done

   注意

   更新完成后，查询会返回空结果。对于虚拟机工作负载，预计不会停机。

   查看 data plane 上的 nova Compute 代理日志中的任何错误，以及 control plane 上的 nova-conductor 日志记录。

2. 对 OpenStackControlPlane CR 进行补丁，以删除 Compute control plane 服务中的前向升级临时解决方案：

   $ rm -f celltemplates
   $ for CELL in $(echo $RENAMED_CELLS); do
   $ cat >> celltemplates << EOF
           ${CELL}:
             metadataServiceTemplate:
               customServiceConfig: |
                 [workarounds]
                 disable_compute_service_check_for_ffu=false
             conductorServiceTemplate:
               customServiceConfig: |
                 [workarounds]
                 disable_compute_service_check_for_ffu=false
   EOF
   done
   
   $ cat > oscp-patch.yaml << EOF
   spec:
     nova:
       template:
         apiServiceTemplate:
           customServiceConfig: |
             [workarounds]
             disable_compute_service_check_for_ffu=false
         metadataServiceTemplate:
           customServiceConfig: |
             [workarounds]
             disable_compute_service_check_for_ffu=false
         schedulerServiceTemplate:
           customServiceConfig: |
             [workarounds]
             disable_compute_service_check_for_ffu=false
         cellTemplates:
           cell0:
             conductorServiceTemplate:
               customServiceConfig: |
                 [workarounds]
                 disable_compute_service_check_for_ffu=false
   EOF
   $ cat celltemplates >> oscp-patch.yaml

   • 如果您使用 Compute 服务与裸机置备服务(ironic)，请在 Compute 服务 CR 补丁的 cell<X&gt; 部分中追加以下 novaComputeTemplates ：

             cell<X>:
               novaComputeTemplates:
                 <hostname>: 

     1

     
                   customServiceConfig: |
                     [DEFAULT]
                     host = <hostname>
                     [workarounds]
                     disable_compute_service_check_for_ffu=true
                   computeDriver: ironic.IronicDriver
             ...

     1

     将 < hostname> 替换为在 cell<X> 源云中运行 ironic Compute 驱动程序的节点主机名。

3. 应用补丁文件：

   $ oc patch openstackcontrolplane openstack --type=merge --patch-file=oscp-patch.yaml

4. 等待 Compute control plane 服务 CR 就绪：

   $ oc wait --for condition=Ready --timeout=300s Nova/nova

5. 从 Compute data plane 服务中删除预先转发的升级临时解决方案：

   $ oc patch cm nova-cells-global-config --type=json -p='[{"op": "replace", "path": "/data/99-nova-compute-cells-workarounds.conf", "value": "[workarounds]\n"}]'
   $ for CELL in $(echo $RENAMED_CELLS); do
   $ oc get Openstackdataplanenodeset openstack-${CELL} || continue
   $ oc apply -f - <<EOF
   ---
   apiVersion: dataplane.openstack.org/v1beta1
   kind: OpenStackDataPlaneDeployment
   metadata:
     name: openstack-nova-compute-ffu-$CELL
   spec:
     nodeSets:
       - openstack-${CELL}
     servicesOverride:
       - nova-${CELL}
   backoffLimit: 3
   EOF
   done

6. 等待 Compute data plane 服务准备所有单元：

   $ oc wait --for condition=Ready openstackdataplanedeployments --all --timeout=5m

7. 运行 Compute 数据库在线迁移来完成升级：

   $ oc exec -it nova-cell0-conductor-0 -- nova-manage db online_data_migrations
   $ for CELL in $(echo $RENAMED_CELLS); do
   $ oc exec -it nova-${CELL}-conductor-0 -- nova-manage db online_data_migrations
   done

8. 在单元格中发现 Compute 主机：

   $ oc rsh nova-cell0-conductor-0 nova-manage cell_v2 discover_hosts --verbose

9. 验证现有测试虚拟机实例是否正在运行：

   ${BASH_ALIASES[openstack]} server --os-compute-api-version 2.48 show --diagnostics test 2>&1 || echo FAIL

10. 验证 Compute 服务是否可以停止现有的测试虚拟机实例：

    ${BASH_ALIASES[openstack]} server list -c Name -c Status -f value | grep -qF "test ACTIVE" && ${BASH_ALIASES[openstack]} server stop test || echo PASS
    ${BASH_ALIASES[openstack]} server list -c Name -c Status -f value | grep -qF "test SHUTOFF" || echo FAIL
    ${BASH_ALIASES[openstack]} server --os-compute-api-version 2.48 show --diagnostics test 2>&1 || echo PASS

11. 验证 Compute 服务是否可以启动现有的测试虚拟机实例：

    ${BASH_ALIASES[openstack]} server list -c Name -c Status -f value | grep -qF "test SHUTOFF" && ${BASH_ALIASES[openstack]} server start test || echo PASS
    ${BASH_ALIASES[openstack]} server list -c Name -c Status -f value | grep -qF "test ACTIVE" && \
      ${BASH_ALIASES[openstack]} server --os-compute-api-version 2.48 show --diagnostics test --fit-width -f json | jq -r '.state' | grep running || echo FAIL

1. 检查运行 OVN Controller 网关代理 的节点。代理列表因您启用的服务而异：

   $ oc exec openstackclient -- openstack network agent list
   +--------------------------------------+------------------------------+--------------------------+-------------------+-------+-------+----------------------------+
   | ID                                   | Agent Type                   | Host                     | Availability Zone | Alive | State | Binary                     |
   +--------------------------------------+------------------------------+--------------------------+-------------------+-------+-------+----------------------------+
   | e5075ee0-9dd9-4f0a-a42a-6bbdf1a6111c | OVN Controller Gateway agent | controller-0.localdomain |                   | XXX   | UP    | ovn-controller             |
   | f3112349-054c-403a-b00a-e219238192b8 | OVN Controller agent         | compute-0.localdomain    |                   | XXX   | UP    | ovn-controller             |
   | af9dae2d-1c1c-55a8-a743-f84719f6406d | OVN Metadata agent           | compute-0.localdomain    |                   | XXX   | UP    | neutron-ovn-metadata-agent |
   | 51a11df8-a66e-47a2-aec0-52eb8589626c | OVN Controller Gateway agent | controller-1.localdomain |                   | XXX   | UP    | ovn-controller             |
   | bb817e5e-7832-410a-9e67-934dac8c602f | OVN Controller Gateway agent | controller-2.localdomain |                   | XXX   | UP    | ovn-controller             |
   +--------------------------------------+------------------------------+--------------------------+-------------------+-------+-------+----------------------------+

流程

1. 为您的节点部署 OpenStackDataPlaneNodeSet CR：

   注意

   您可以重复使用为 Compute 节点指定的 OpenStackDataPlaneNodeSet CR 中的大多数 nodeTemplate 部分。您可以省略一些变量，因为 Networker 节点上运行的一组有限服务。

   $ oc apply -f - <<EOF
   apiVersion: dataplane.openstack.org/v1beta1
   kind: OpenStackDataPlaneNodeSet
   metadata:
     name: openstack-networker
   spec:
     tlsEnabled: false 

   1

   
     networkAttachments:
         - ctlplane
     preProvisioned: true
     services:
       - redhat
       - bootstrap
       - download-cache
       - configure-network
       - validate-network
       - install-os
       - configure-os
       - ssh-known-hosts
       - run-os
       - install-certs
       - ovn
     env:
       - name: ANSIBLE_CALLBACKS_ENABLED
         value: "profile_tasks"
       - name: ANSIBLE_FORCE_COLOR
         value: "True"
     nodes:
       controller-0:
         hostName: controller-0
         ansible:
           ansibleHost: ${networkers[controller-0.localdomain]}
         networks:
         - defaultRoute: true
           fixedIP: ${networkers[controller-0.localdomain]}
           name: ctlplane
           subnetName: subnet1
         - name: internalapi
           subnetName: subnet1
         - name: storage
           subnetName: subnet1
         - name: tenant
           subnetName: subnet1
       controller-1:
         hostName: controller-1
         ansible:
           ansibleHost: ${networkers[controller-1.localdomain]}
         networks:
         - defaultRoute: true
           fixedIP: ${networkers[controller-1.localdomain]}
           name: ctlplane
           subnetName: subnet1
         - name: internalapi
           subnetName: subnet1
         - name: storage
           subnetName: subnet1
         - name: tenant
           subnetName: subnet1
       controller-2:
         hostName: controller-2
         ansible:
           ansibleHost: ${networkers[controller-2.localdomain]}
         networks:
         - defaultRoute: true
           fixedIP: ${networkers[controller-2.localdomain]}
           name: ctlplane
           subnetName: subnet1
         - name: internalapi
           subnetName: subnet1
         - name: storage
           subnetName: subnet1
         - name: tenant
           subnetName: subnet1
     nodeTemplate:
       ansibleSSHPrivateKeySecret: dataplane-adoption-secret
       ansible:
         ansibleUser: root
         ansibleVarsFrom:
         - secretRef:
             name: subscription-manager
         - secretRef:
             name: redhat-registry
         ansibleVars:
           rhc_release: 9.2
           rhc_repositories:
               - {name: "*", state: disabled}
               - {name: "rhel-9-for-x86_64-baseos-eus-rpms", state: enabled}
               - {name: "rhel-9-for-x86_64-appstream-eus-rpms", state: enabled}
               - {name: "rhel-9-for-x86_64-highavailability-eus-rpms", state: enabled}
               - {name: "rhoso-18.0-for-rhel-9-x86_64-rpms", state: enabled}
               - {name: "fast-datapath-for-rhel-9-x86_64-rpms", state: enabled}
               - {name: "rhceph-7-tools-for-rhel-9-x86_64-rpms", state: enabled}
           edpm_bootstrap_release_version_package: []
           # edpm_network_config
           # Default nic config template for a EDPM node
           # These vars are edpm_network_config role vars
           edpm_network_config_template: |
              ---
              {% set mtu_list = [ctlplane_mtu] %}
              {% for network in nodeset_networks %}
              {% set _ = mtu_list.append(lookup('vars', networks_lower[network] ~ '_mtu')) %}
              {%- endfor %}
              {% set min_viable_mtu = mtu_list | max %}
              network_config:
              - type: ovs_bridge
                name: {{ neutron_physical_bridge_name }}
                mtu: {{ min_viable_mtu }}
                use_dhcp: false
                dns_servers: {{ ctlplane_dns_nameservers }}
                domain: {{ dns_search_domains }}
                addresses:
                - ip_netmask: {{ ctlplane_ip }}/{{ ctlplane_cidr }}
                routes: {{ ctlplane_host_routes }}
                members:
                - type: interface
                  name: nic1
                  mtu: {{ min_viable_mtu }}
                  # force the MAC address of the bridge to this interface
                  primary: true
              {% for network in nodeset_networks %}
                - type: vlan
                  mtu: {{ lookup('vars', networks_lower[network] ~ '_mtu') }}
                  vlan_id: {{ lookup('vars', networks_lower[network] ~ '_vlan_id') }}
                  addresses:
                  - ip_netmask:
                      {{ lookup('vars', networks_lower[network] ~ '_ip') }}/{{ lookup('vars', networks_lower[network] ~ '_cidr') }}
                  routes: {{ lookup('vars', networks_lower[network] ~ '_host_routes') }}
              {% endfor %}
   
           edpm_network_config_hide_sensitive_logs: false
           #
           # These vars are for the network config templates themselves and are
           # considered EDPM network defaults.
           neutron_physical_bridge_name: br-ctlplane
           neutron_public_interface_name: eth0
   
           # edpm_nodes_validation
           edpm_nodes_validation_validate_controllers_icmp: false
           edpm_nodes_validation_validate_gateway_icmp: false
   
           # edpm ovn-controller configuration
           edpm_ovn_bridge_mappings: <bridge_mappings> 

   2

   
           edpm_ovn_bridge: br-int
           edpm_ovn_encap_type: geneve
           ovn_monitor_all: true
           edpm_ovn_remote_probe_interval: 60000
           edpm_ovn_ofctrl_wait_before_clear: 8000
   
           # serve as a OVN gateway
           edpm_enable_chassis_gw: true 

   3

   
   
           timesync_ntp_servers:
           - hostname: clock.redhat.com
           - hostname: clock2.redhat.com
   
   
           gather_facts: false
           enable_debug: false
           # edpm firewall, change the allowed CIDR if needed
           edpm_sshd_configure_firewall: true
           edpm_sshd_allowed_ranges: ['192.168.122.0/24']
           # SELinux module
           edpm_selinux_mode: enforcing
   
           # Do not attempt OVS major upgrades here
           edpm_ovs_packages:
           - openvswitch3.3
   EOF

   1

   如果启用了 TLS Everywhere，请将 spec:tlsEnabled 更改为 true。

   2

   设置为您在 Red Hat OpenStack Platform 17.1 部署中使用的相同值。

   3

   设置为 true 以在网关模式下运行 ovn-controller。

2. 在采用前，请确保在 Networker 节点中使用的 OpenStackDataPlaneNodeSet CR 中使用相同的 ovn-controller 设置。此配置存储在 Open vSwitch 数据库的 Open_vSwitch 表中的 external_ids 列中：

   ovs-vsctl list Open .
   ...
   external_ids        : {hostname=controller-0.localdomain, ovn-bridge=br-int, ovn-bridge-mappings=<bridge_mappings>, ovn-chassis-mac-mappings="datacentre:1e:0a:bb:e6:7c:ad", ovn-cms-options=enable-chassis-as-gw, ovn-encap-ip="172.19.0.100", ovn-encap-tos="0", ovn-encap-type=geneve, ovn-match-northd-version=False, ovn-monitor-all=True, ovn-ofctrl-wait-before-clear="8000", ovn-openflow-probe-interval="60", ovn-remote="tcp:ovsdbserver-sb.openstack.svc:6642", ovn-remote-probe-interval="60000", rundir="/var/run/openvswitch", system-id="2eec68e6-aa21-4c95-a868-31aeafc11736"}
   ...

   • 将 <bridge_mappings > 替换为您的配置中网桥映射的值，如 "datacentre:br-ctlplane "。

3. 可选：在 OpenStackDataPlaneNodeSet CR 中启用 neutron-metadata ：

   $ oc patch openstackdataplanenodeset <networker_CR_name> --type='json' --patch='[
     {
       "op": "add",
       "path": "/spec/services/-",
       "value": "neutron-metadata"
     }]'

   • 将 <networker_CR_name > 替换为您为 Networker 节点部署的 CR 名称，如 openstack-networker。

4. 可选：在 OpenStackDataPlaneNodeSet CR 中启用 neutron-dhcp ：

   $ oc patch openstackdataplanenodeset <networker_CR_name> --type='json' --patch='[
     {
       "op": "add",
       "path": "/spec/services/-",
       "value": "neutron-dhcp"
     }]'

5. 为 Networker 节点运行 pre-adoption-validation 服务：

   1. 创建仅运行验证的 OpenStackDataPlaneDeployment CR：

      $ oc apply -f - <<EOF
      apiVersion: dataplane.openstack.org/v1beta1
      kind: OpenStackDataPlaneDeployment
      metadata:
        name: openstack-pre-adoption-networker
      spec:
        nodeSets:
        - openstack-networker
        servicesOverride:
        - pre-adoption-validation
      EOF

   2. 验证完成后，确认 Ansible EE pod 的状态为 Completed ：

      $ watch oc get pod -l app=openstackansibleee

      $ oc logs -l app=openstackansibleee -f --max-log-requests 20

   3. 等待部署变为 Ready 状态：

      $ oc wait --for condition=Ready openstackdataplanedeployment/openstack-pre-adoption-networker --timeout=10m

6. 为 Networker 节点部署 OpenStackDataPlaneDeployment CR：

   $ oc apply -f - <<EOF
   apiVersion: dataplane.openstack.org/v1beta1
   kind: OpenStackDataPlaneDeployment
   metadata:
     name: openstack-networker
   spec:
     nodeSets:
     - openstack-networker
   EOF

   注意

   另外，在部署主 OpenStackDataPlaneDeployment CR 前，您可以在 nodeSets 列表中包含 Networker 节点。您不能在部署后将新节点设置为 OpenStackDataPlaneDeployment CR。

7. 清理不再运行的任何网络服务(neutron)代理。

   注意

   在某些情况下，来自被替换或停用的旧数据平面的代理保留在 RHOSO 中。提供的这些代理可能由 RHOSO 中运行的新代理提供，或者功能可能被其他组件替代。例如，可能不再需要 DHCP 代理，因为 RHOSO 中的 OVN DHCP 可以提供此功能。

   1. 列出代理：

      $ oc exec openstackclient -- openstack network agent list
      +--------------------------------------+------------------------------+--------------------------+-------------------+-------+-------+----------------------------+
      | ID                                   | Agent Type                   | Host                     | Availability Zone | Alive | State | Binary                     |
      +--------------------------------------+------------------------------+--------------------------+-------------------+-------+-------+----------------------------+
      | e5075ee0-9dd9-4f0a-a42a-6bbdf1a6111c | OVN Controller Gateway agent | controller-0.localdomain |                   | :-)   | UP    | ovn-controller             |
      | 856960f0-5530-46c7-a331-6eadcba362da | DHCP agent                   | controller-1.localdomain | nova              | XXX   | UP    | neutron-dhcp-agent         |
      | 8bd22720-789f-45b8-8d7d-006dee862bf9 | DHCP agent                   | controller-2.localdomain | nova              | XXX   | UP    | neutron-dhcp-agent         |
      | e584e00d-be4c-4e98-a11a-4ecd87d21be7 | DHCP agent                   | controller-0.localdomain | nova              | XXX   | UP    | neutron-dhcp-agent         |
      +--------------------------------------+------------------------------+--------------------------+-------------------+-------+-------+----------------------------+

   2. 如果列表中的任何代理在 Alive 字段中显示 XXX，请验证 Host 和 Agent Type，如果不再需要此代理，且代理已在 Red Hat OpenStack Platform 主机上永久停止。然后，删除代理：

      $ oc exec openstackclient -- openstack network agent <agent_id>

      • 将 <agent_id > 替换为要删除的代理 ID，例如 856960f0-5530-46c7-a331-6eadcba362da。