第 6 章 使用 Red Hat OpenStack Platform control plane 服务
采用 Red Hat OpenStack Platform 17.1 control plane 服务在 OpenShift (RHOSO) 18.0 control plane 上的 Red Hat OpenStack Services 中部署。
6.1. 使用 Identity 服务 复制链接链接已复制到粘贴板!
要采用 Identity 服务(keystone),您可以修补禁用 Identity 服务的现有 OpenStackControlPlane 自定义资源(CR)。补丁使用 Red Hat OpenStack Platform (RHOSP)环境提供的配置参数启动服务。
先决条件
创建包含从 RHOSP 环境复制的 Fernet 密钥的 keystone secret:
$ oc apply -f - <<EOF apiVersion: v1 data: CredentialKeys0: $($CONTROLLER1_SSH sudo cat /var/lib/config-data/puppet-generated/keystone/etc/keystone/credential-keys/0 | base64 -w 0) CredentialKeys1: $($CONTROLLER1_SSH sudo cat /var/lib/config-data/puppet-generated/keystone/etc/keystone/credential-keys/1 | base64 -w 0) FernetKeys0: $($CONTROLLER1_SSH sudo cat /var/lib/config-data/puppet-generated/keystone/etc/keystone/fernet-keys/0 | base64 -w 0) FernetKeys1: $($CONTROLLER1_SSH sudo cat /var/lib/config-data/puppet-generated/keystone/etc/keystone/fernet-keys/1 | base64 -w 0) kind: Secret metadata: name: keystone type: Opaque EOF
流程
对
OpenStackControlPlaneCR 进行补丁来部署 Identity 服务:$ oc patch openstackcontrolplane openstack --type=merge --patch ' \ spec: \ keystone: \ enabled: true \ apiOverride: \ route: {} \ template: \ override: \ service: \ internal: \ metadata: \ annotations: \ metallb.universe.tf/address-pool: internalapi \ metallb.universe.tf/allow-shared-ip: internalapi \ metallb.universe.tf/loadBalancerIPs: 172.17.0.80 \1 spec: \ type: LoadBalancer \ databaseInstance: openstack \ secret: osp-secret \ '- 1
- 如果使用 IPv6,请将负载均衡器 IP 更改为环境中的负载均衡器 IP,如
metallb.universe.tf/loadBalancerIPs: fd00:bbbb::80。
在 OpenShift (RHOSO)部署中的 Red Hat OpenStack Services 中创建一个别名来使用
openstack命令:$ alias openstack="oc exec -t openstackclient -- openstack"删除仍指向 RHOSP control plane 的服务和端点,不包括 Identity 服务及其端点:
$ openstack endpoint list | grep keystone | awk '/admin/{ print $2; }' | xargs ${BASH_ALIASES[openstack]} endpoint delete || true $ for service in aodh heat heat-cfn barbican cinderv3 glance gnocchi manila manilav2 neutron nova placement swift ironic-inspector ironic octavia; do openstack service list | awk "/ $service /{ print \$2; }" | xargs -r ${BASH_ALIASES[openstack]} service delete || true \ done
验证
-
验证您可以访问
OpenStackClient容器集。如需更多信息,请参阅在 OpenShift 部署中 访问 Red Hat OpenStack Services 中的访问 OpenStackClient pod。 确认定义了 Identity 服务端点,并指向 control plane FQDN:
$ openstack endpoint list | grep keystone等待
OpenStackControlPlane资源变为Ready:$ oc wait --for=condition=Ready --timeout=1m OpenStackControlPlane openstack