OpenStack Epoxy : Configure Octavia (Network Node)

Install OpenStack Load Balancing as a Service (Octavia). This example is based on the environment like follows. ------------+--------------------------+--------------------------+------------ | | | eth0|10.0.0.30 eth0|10.0.0.50 eth0|10.0.0.51 +-----------+-----------+ +-----------+-----------+ +-----------+-----------+ | [ dlp.srv.world ] | | [ network.srv.world ] | | [ node01.srv.world ] | | (Control Node) | | (Network Node) | | (Compute Node) | | | | | | | | MariaDB RabbitMQ | | Open vSwitch | | Libvirt | | Memcached Nginx | | Neutron Server | | Nova Compute | | Keystone httpd | | OVN-Northd | | Open vSwitch | | Glance Nova API | | Nginx iSCSI Target | | OVN Metadata Agent | | Cinder API | | Cinder Volume | | OVN-Controller | | | | Octavia Services | | | +-----------------------+ +-----------------------+ +-----------------------+

[1]	Install Octavia services. For questions during the installation, it's OK with [No] to all.

root@network:~#  apt -y install octavia-api octavia-health-manager octavia-housekeeping octavia-worker python3-ovn-octavia-provider git

[2]	Create certificates that are used among LoadBalancer Instance and Octavia services.

root@network:~#  mkdir -p /etc/octavia/certs/private root@network:~#  mkdir ~/work root@network:~#  cd ~/work root@network:~/work#  git clone https://opendev.org/openstack/octavia.git root@network:~/work#  cd octavia/bin root@network:~/work/octavia/bin#  ./create_dual_intermediate_CA.sh root@network:~/work/octavia/bin#  cp -p ./dual_ca/etc/octavia/certs/server_ca.cert.pem /etc/octavia/certs root@network:~/work/octavia/bin#  cp -p ./dual_ca/etc/octavia/certs/server_ca-chain.cert.pem /etc/octavia/certs root@network:~/work/octavia/bin#  cp -p ./dual_ca/etc/octavia/certs/server_ca.key.pem /etc/octavia/certs/private root@network:~/work/octavia/bin#  cp -p ./dual_ca/etc/octavia/certs/client_ca.cert.pem /etc/octavia/certs root@network:~/work/octavia/bin#  cp -p ./dual_ca/etc/octavia/certs/client.cert-and-key.pem /etc/octavia/certs/private root@network:~/work/octavia/bin#  chown -R octavia /etc/octavia/certs

[3]	Configure Octavia.

root@network:~#  mv /etc/octavia/octavia.conf /etc/octavia/octavia.conf.org root@network:~#  vi /etc/octavia/octavia.conf # create new [DEFAULT] # RabbitMQ connection info transport_url = rabbit://openstack:password@dlp.srv.world [api_settings] bind_host = 127.0.0.1 bind_port = 9876 auth_strategy = keystone api_base_uri = https://network.srv.world:9876 # MariaDB connection info [database] connection = mysql+pymysql://octavia:password@dlp.srv.world/octavia [health_manager] bind_ip = 10.0.0.50 bind_port = 5555 # Keystone auth info [keystone_authtoken] www_authenticate_uri = https://dlp.srv.world:5000 auth_url = https://dlp.srv.world:5000 memcached_servers = dlp.srv.world:11211 auth_type = password project_domain_name = Default user_domain_name = Default project_name = service username = octavia password = servicepassword # if using self-signed certs on Apache2 Keystone, turn to [true] insecure = false # specify certificates created on [2] [certificates] ca_private_key = /etc/octavia/certs/private/server_ca.key.pem ca_certificate = /etc/octavia/certs/server_ca.cert.pem server_certs_key_passphrase = insecure-key-do-not-use-this-key ca_private_key_passphrase = not-secure-passphrase # specify certificates created on [2] [haproxy_amphora] server_ca = /etc/octavia/certs/server_ca-chain.cert.pem client_cert = /etc/octavia/certs/private/client.cert-and-key.pem # specify certificates created on [2] [controller_worker] client_ca = /etc/octavia/certs/client_ca.cert.pem [oslo_messaging] topic = octavia_prov # Keystone auth info [service_auth] auth_url = https://dlp.srv.world:5000 memcached_servers = dlp.srv.world:11211 auth_type = password project_domain_name = Default user_domain_name = Default project_name = service username = octavia password = servicepassword # if using self-signed certs on Apache2 Keystone, turn to [true] insecure = false root@network:~#  vi /etc/octavia/policy.yaml # create new "context_is_admin": "role:admin or role:load-balancer_admin" "admin_or_owner": "is_admin:True or project_id:%(project_id)s" "load-balancer:read": "rule:admin_or_owner" "load-balancer:read-global": "is_admin:True" "load-balancer:write": "rule:admin_or_owner" "load-balancer:read-quota": "rule:admin_or_owner" "load-balancer:read-quota-global": "is_admin:True" "load-balancer:write-quota": "is_admin:True" root@network:~#  chmod 640 /etc/octavia/{octavia.conf,policy.yaml} root@network:~#  chgrp octavia /etc/octavia/{octavia.conf,policy.yaml} root@network:~#  sed -i -e "s/UWSGI_BIND_IP=\"\"/UWSGI_BIND_IP=\"127.0.0.1\"/" /etc/init.d/octavia-api

[4]	Configure Nginx for proxy settings.

root@network:~#  vi /etc/nginx/nginx.conf # add into the [stream] section stream { upstream neutron-api { server 127.0.0.1:9696; } server { listen 10.0.0.50:9696 ssl; proxy_pass neutron-api; } upstream octavia-api { server 127.0.0.1:9876; } server { listen 10.0.0.50:9876 ssl; proxy_pass octavia-api; } ssl_certificate "/etc/letsencrypt/live/network.srv.world/fullchain.pem"; ssl_certificate_key "/etc/letsencrypt/live/network.srv.world/privkey.pem"; }

[5]	Add Data into Database and start Octavia services.

root@network:~#  su -s /bin/bash octavia -c "octavia-db-manage --config-file /etc/octavia/octavia.conf upgrade head" root@network:~#  systemctl restart octavia-api octavia-health-manager octavia-housekeeping octavia-worker root@network:~#  systemctl enable octavia-api octavia-health-manager octavia-housekeeping octavia-worker root@network:~#  systemctl restart nginx

Matched Content