4.2. 部署后在 RHOSO 环境中启用 TLS

如果在 OpenShift (RHOSO)环境中部署的 Red Hat OpenStack Services 中禁用了 TLS，您可以在可正常工作的 RHOSO 环境中重新启用它，并尽可能减少中断。

先决条件

RHOSO 环境部署在 Red Hat OpenShift Container Platform (RHOCP)集群中。如需更多信息，请参阅在 OpenShift 上部署 Red Hat OpenStack Services。
以具有 cluster-admin 权限的用户身份登录到可访问 RHOCP 集群的工作站。

流程

在工作站上打开 OpenStackControlPlane 自定义资源(CR)文件 openstack_control_plane.yaml。

在 spec 配置中添加以下 tls 配置（如果尚不存在）：

spec:
  tls:
    ingress:
      ca:
        duration: 87600h0m0s
      cert:
        duration: 43800h0m0s
      enabled: true
    podLevel:
      enabled: true 
      internal:
        ca:
          duration: 87600h0m0s
        cert:
          duration: 43800h0m0s
      libvirt:
        ca:
          duration: 87600h0m0s
        cert:
          duration: 43800h0m0s
      ovn:
        ca:
          duration: 87600h0m0s
        cert:
          duration: 43800h0m0s

spec:
  tls:
    ingress:
      ca:
        duration: 87600h0m0s
      cert:
        duration: 43800h0m0s
      enabled: true
    podLevel:
      enabled: true


      internal:
        ca:
          duration: 87600h0m0s
        cert:
          duration: 43800h0m0s
      libvirt:
        ca:
          duration: 87600h0m0s
        cert:
          duration: 43800h0m0s
      ovn:
        ca:
          duration: 87600h0m0s
        cert:
          duration: 43800h0m0s

Copy to Clipboard

Toggle word wrap

1: 如果定义文件中已存在 tls 配置，请确保启用了'podLevel'。

更新 control plane：

oc apply -f openstack_control_plane.yaml -n <namespace>

$ oc apply -f openstack_control_plane.yaml -n <namespace>

Copy to Clipboard

Toggle word wrap

rabbitmq pod 无法更改操作环境中的 TLS 配置，因此您必须删除现有 rabbitmq pod，以使用启用了 TLS 的新 rabbitmq pod 更新 control plane：
```
oc delete pod -n openstack -l app.kubernetes.io/component=rabbitmq
```
```
$ oc delete pod -n openstack -l app.kubernetes.io/component=rabbitmq
```
Copy to Clipboard Toggle word wrap

等待 control plane 就绪：

oc wait openstackcontrolplane -n <namespace> --for=condition=Ready --timeout=400s -l core.openstack.org/openstackcontrolplane

$ oc wait openstackcontrolplane -n <namespace> --for=condition=Ready --timeout=400s -l core.openstack.org/openstackcontrolplane

Copy to Clipboard

Toggle word wrap

在等待 control plane 就绪时，无法创建新的工作负载，并且无法使用 OpenStack API 管理现有工作负载。data plane 节点上的 nova-compute 服务无法连接到 cell1 rabbitmq，并报告为 down ：

oc rsh openstackclient
openstack compute service list -c Binary -c Host -c Status -c State

$ oc rsh openstackclient
$ openstack compute service list -c Binary -c Host -c Status -c State
+----------------+-------------------------------------+---------+-------+
| Binary         | Host                                | Status  | State |
+----------------+-------------------------------------+---------+-------+
| nova-conductor | nova-cell0-conductor-0              | enabled | up    |
| nova-scheduler | nova-scheduler-0                    | enabled | up    |
| nova-conductor | nova-cell1-conductor-0              | enabled | up    |
| nova-compute   | edpm-compute-0.ctlplane.example.com | enabled | down  |
| nova-compute   | edpm-compute-1.ctlplane.example.com | enabled | down  |
+----------------+-------------------------------------+---------+-------+

Copy to Clipboard

Toggle word wrap

OVN 控制器和 OVN 元数据代理无法连接到南向数据库：

openstack network agent list -c 'Agent Type' -c Host -c Alive -c State

$ openstack network agent list -c 'Agent Type' -c Host -c Alive -c State
+------------------------------+-------------------------------------+-------+-------+
| Agent Type                   | Host                                | Alive | State |
+------------------------------+-------------------------------------+-------+-------+
| OVN Controller Gateway agent | crc                                 | :-)   | UP    |
| OVN Controller agent         | edpm-compute-1.ctlplane.example.com | XXX   | UP    |
| OVN Metadata agent           | edpm-compute-1.ctlplane.example.com | XXX   | UP    |
| OVN Controller agent         | edpm-compute-0.ctlplane.example.com | XXX   | UP    |
| OVN Metadata agent           | edpm-compute-0.ctlplane.example.com | XXX   | UP    |
+------------------------------+-------------------------------------+-------+-------+

Copy to Clipboard

Toggle word wrap

注意

如果没有通过 control plane 路由工作负载流量，现有工作负载不会受到影响。

为 data plane 上的每个节点打开 OpenStackDataPlaneNodeSet CR 定义文件，并各自启用 TLS：

apiVersion: dataplane.openstack.org/v1beta1
kind: OpenStackDataPlaneNodeSet
metadata:
  name: <node_set_name>
  namespace: openstack
spec:
  tlsEnabled: true

apiVersion: dataplane.openstack.org/v1beta1
kind: OpenStackDataPlaneNodeSet
metadata:
  name: <node_set_name>
  namespace: openstack
spec:
  tlsEnabled: true

Copy to Clipboard

Toggle word wrap

保存更新的 OpenStackDataPlaneNodeSet CR 定义文件并应用更新：
```
oc apply -f openstack_data_plane.yaml -n <namespace>
```
```
$ oc apply -f openstack_data_plane.yaml -n <namespace>
```
Copy to Clipboard Toggle word wrap

检查每个节点中是否启用了 TLS：

oc get openstackdataplanenodeset <node_set_name> -n <namespace> -o json | jq .items[0].spec.tlsEnabled

$ oc get openstackdataplanenodeset <node_set_name> -n <namespace> -o json | jq .items[0].spec.tlsEnabled
true

Copy to Clipboard

Toggle word wrap

在工作站上创建一个文件来定义 OpenStackDataPlaneDeployment CR：
```
apiVersion: dataplane.openstack.org/v1beta1
kind: OpenStackDataPlaneDeployment
metadata:
  name: <node_set_deployment_name>
```
```
apiVersion: dataplane.openstack.org/v1beta1
kind: OpenStackDataPlaneDeployment
metadata:
  name: <node_set_deployment_name>
```
Copy to Clipboard Toggle word wrap
- 将 <node_set_deployment_name > 替换为 OpenStackDataPlaneDeployment CR 的名称。名称必须是唯一的，必须包含小写字母数字字符(hyphen)或 . （句点），且必须以字母数字字符开头和结尾。
提示
为定义文件和 OpenStackDataPlaneDeployment CR 提供唯一和描述性名称，以指示修改的节点集的用途。
添加您修改的 OpenStackDataPlaneNodeSet CR 来启用 TLS：
```
spec:
  nodeSets:
    - <nodeSet_name>
```
```
spec:
  nodeSets:
    - <nodeSet_name>
```
Copy to Clipboard Toggle word wrap
保存 OpenStackDataPlaneDeployment CR 部署文件。

部署修改后的 OpenStackDataPlaneNodeSet CR：

oc create -f openstack_data_plane_deploy.yaml -n <namespace>

$ oc create -f openstack_data_plane_deploy.yaml -n <namespace>

Copy to Clipboard

Toggle word wrap

您可以在部署执行时查看 Ansible 日志：

oc get pod -l app=openstackansibleee -n <namespace> -w
oc logs -l app=openstackansibleee -f --max-log-requests 10 -n <namespace>

$ oc get pod -l app=openstackansibleee -n <namespace> -w
$ oc logs -l app=openstackansibleee -f --max-log-requests 10 -n <namespace>

Copy to Clipboard

Toggle word wrap

如果 oc logs 命令返回类似以下错误的错误，请提高 --max-log-requests 值：

error: you are attempting to follow 19 log streams, but maximum allowed concurrency is 10, use --max-log-requests to increase the limit

error: you are attempting to follow 19 log streams, but maximum allowed concurrency is 10, use --max-log-requests to increase the limit

Copy to Clipboard

Toggle word wrap

验证修改后的 OpenStackDataPlaneNodeSet CR 是否已部署：
```
oc get openstackdataplanedeployment -n <namespace>
oc get openstackdataplanenodeset -n <namespace>
```
```
$ oc get openstackdataplanedeployment -n <namespace>
NAME             	STATUS   MESSAGE
openstack-data-plane   True     Setup Complete


$ oc get openstackdataplanenodeset -n <namespace>
NAME             	STATUS   MESSAGE
openstack-data-plane   True     NodeSet Ready
```
Copy to Clipboard Toggle word wrap
有关返回状态的信息，请参阅在 OpenShift 上部署 Red Hat OpenStack Services 指南中的 Data plane 条件和状态。
如果状态表示 data plane 尚未部署，则对部署进行故障排除。如需更多信息，请参阅在 OpenShift 上部署 Red Hat OpenStack Services 指南中的对 data plane 创建和部署进行故障排除。

验证 nova-compute 服务是否已重新连接到 TLS rabbitmq：

oc rsh openstackclient
openstack compute service list -c Binary -c Host -c Status -c State

$ oc rsh openstackclient
$ openstack compute service list -c Binary -c Host -c Status -c State
+----------------+-------------------------------------+---------+-------+
| Binary         | Host                                | Status  | State |
+----------------+-------------------------------------+---------+-------+
| nova-conductor | nova-cell0-conductor-0              | enabled | up    |
| nova-scheduler | nova-scheduler-0                    | enabled | up    |
| nova-conductor | nova-cell1-conductor-0              | enabled | up    |
| nova-compute   | edpm-compute-0.ctlplane.example.com | enabled | up    |
| nova-compute   | edpm-compute-1.ctlplane.example.com | enabled | up    |
+----------------+-------------------------------------+---------+-------+

Copy to Clipboard

Toggle word wrap

验证 OVN 代理是否已再次运行：

openstack network agent list -c 'Agent Type' -c Host -c Alive -c State

$ openstack network agent list -c 'Agent Type' -c Host -c Alive -c State
+------------------------------+-------------------------------------+-------+-------+
| Agent Type                   | Host                                | Alive | State |
+------------------------------+-------------------------------------+-------+-------+
| OVN Controller Gateway agent | crc                                 | :-)   | UP    |
| OVN Controller agent         | edpm-compute-1.ctlplane.example.com | :-)   | UP    |
| OVN Metadata agent           | edpm-compute-1.ctlplane.example.com | :-)   | UP    |
| OVN Controller agent         | edpm-compute-0.ctlplane.example.com | :-)   | UP    |
| OVN Metadata agent           | edpm-compute-0.ctlplane.example.com | :-)   | UP    |
+------------------------------+-------------------------------------+-------+-------+

Copy to Clipboard

Toggle word wrap

4.2. 部署后在 RHOSO 环境中启用 TLS

学习

尝试、购买和销售

社区

关于红帽文档

让开源更具包容性

關於紅帽

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links