User Tools

Site Tools

Trace: • sign_ssl_certificates_with_own_ca
openstack_with_kolla

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
openstack_with_kolla [2017/06/24 18:37] – herwarthopenstack_with_kolla [2017/08/15 18:00] (current) – herwarth
Line 442: Line 442:
  
 # Helux # Helux
-helux = chrony,cinder,cron,designate,fluentd,glance,heat,heka,haproxy,horizon,iscsid,keepalived,keystone,kolla-toolbox,mariadb,memcached,mongodb,neutron,nova,openvswitch,rabbitmq+helux = chrony,cinder,cron,designate,fluentd,glance,heat,heka,haproxy,horizon,iscsid,keepalived,keystone,kolla-toolbox,linuxbridge,mariadb,memcached,mongodb,neutron,nova,openvswitch,rabbitmq,tgtd
 </code> </code>
 ====Passwords==== ====Passwords====
Line 518: Line 518:
 </code> </code>
 =====Additional configuration===== =====Additional configuration=====
 +====Ansible templates====
 +We need to alter an ansible template of Kolla to enable multi domains in Horizon
 +
 +<code - /usr/share/kolla-ansible/ansible/roles/horizon/templates/local_settings.j2>
 +.
 +.
 +#OPENSTACK_KEYSTONE_MULTIDOMAIN_SUPPORT = False
 +OPENSTACK_KEYSTONE_MULTIDOMAIN_SUPPORT = True
 +.
 +.
 +</code>
 +
 ====Kolla configuration directory==== ====Kolla configuration directory====
 The ansible scripts use the /etc/kolla directory to configure customer specific parts of Openstack. The ansible scripts use the /etc/kolla directory to configure customer specific parts of Openstack.
   mkdir -p /etc/kolla/config/keystone/domains   mkdir -p /etc/kolla/config/keystone/domains
 +===Own signed certificates===
 +  mkdir /etc/kolla/certificates
 +Create haproxy-ca.pem containg root CA certificate and create haproxy.pem containing the private key and certificate concatenated.
 +<code>
 +ls -l /etc/kolla/certificates/
 +total 8
 +-rw-r--r-- 1 root root 1192 Jun 20 17:44 haproxy-ca.pem
 +-rw-r----- 1 root root 2205 Jun 20 18:18 haproxy.pem
 +</code>
 I use NFS storage so create a file with the NFS share info.  I use NFS storage so create a file with the NFS share info. 
 <code - /etc/kolla/config/nfs_shares.j2> <code - /etc/kolla/config/nfs_shares.j2>
Line 536: Line 557:
 We are going to deploy on multiple nodes so copy the example over We are going to deploy on multiple nodes so copy the example over
   cp /usr/share/kolla-ansible/ansible/inventory/multinode /etc/kolla/   cp /usr/share/kolla-ansible/ansible/inventory/multinode /etc/kolla/
-I did some ajustments+Change matching environment:
 <code - /etc/kolla/multinode> <code - /etc/kolla/multinode>
 [control] [control]
Line 688: Line 709:
 openstack network create --provider-network-type vxlan demo-net openstack network create --provider-network-type vxlan demo-net
 openstack subnet create --subnet-range 10.0.0.0/24 --network demo-net \ openstack subnet create --subnet-range 10.0.0.0/24 --network demo-net \
-    --gateway 10.0.0.1 --dns-nameserver 8.8.8.8 demo-subnet+    --gateway 10.0.0.1 demo-subnet
  
 openstack router create demo-router openstack router create demo-router
Line 724: Line 745:
   keystone_admin_password: <STRING>   keystone_admin_password: <STRING>
 Use the <STRING> to login to Horizon Dashboard. In my case: [[http://cloud.mngt.bh.helux.nl]] Use the <STRING> to login to Horizon Dashboard. In my case: [[http://cloud.mngt.bh.helux.nl]]
-=====Notes===== +=====When stuff is running===== 
-Multiple storage backends:+====Multiple storage backends==== 
 +Run from Kolla deploy host:
 <code> <code>
 cinder type-create nfs-1 cinder type-create nfs-1
Line 736: Line 758:
 cinder extra-specs-list cinder extra-specs-list
 </code> </code>
-Bug in ldap module+====Bug in LDAP module of keystone==== 
 +Run from controller host:
 <code> <code>
 docker exec -ti -u0 keystone bash docker exec -ti -u0 keystone bash
Line 743: Line 766:
 curl https://git.openstack.org/cgit/openstack/keystone/plain/keystone/identity/backends/ldap/core.py?id=4e0029455ab45e3b9a15fe9fc151c14c502b7bdd -o core.py curl https://git.openstack.org/cgit/openstack/keystone/plain/keystone/identity/backends/ldap/core.py?id=4e0029455ab45e3b9a15fe9fc151c14c502b7bdd -o core.py
 </code> </code>
 +====Create domain====
 +Run from Kolla deploy host:
   openstack domain create helux   openstack domain create helux
   docker restart keystone   docker restart keystone
-Login with valid user on domain helux. You will get the error 'You are not authorized for any projects or domains.'  +Login with valid user on domain helux in Horizon. You will get the error 'You are not authorized for any projects or domains.' 
- +
-We cannot do the following: +
-  openstack role add --domain helux --user herwarth admin+
  
 +Run from controller host:
   docker exec -ti -u0 mariadb bash   docker exec -ti -u0 mariadb bash
   mysql -u keystone -p   mysql -u keystone -p
Line 765: Line 788:
 </code> </code>
 Now we can add the LDAP user to the domain as admin Now we can add the LDAP user to the domain as admin
 +
 +Run from kolla deploy host:
   openstack role add --domain helux --user 6b647e1415bf57d15eda4200586059a9f5839994c9aeb03b4e7a6487244ecca4 admin   openstack role add --domain helux --user 6b647e1415bf57d15eda4200586059a9f5839994c9aeb03b4e7a6487244ecca4 admin
 +====DNS as a Service (designate)====
 +Run from kolla deploy host:
 +<code>
 +openstack zone create --email info@helux.nl openstack.helux.nl.
 ++----------------+--------------------------------------+
 +| Field          | Value                                |
 ++----------------+--------------------------------------+
 +| action         | CREATE                               |
 +| attributes     |                                      |
 +| created_at     | 2017-06-24T16:27:53.000000           |
 +| description    | None                                 |
 +| email          | info@helux.nl                        |
 +| id             | 80ca9c9c-0152-4779-8cd4-388cf0c2a433 |
 +| masters        |                                      |
 +| name           | openstack.helux.nl.                  |
 +| pool_id        | b2624c53-15cb-4521-81dd-7d4b30c47593 |
 +| project_id     | f01d9fc8069241b5b217e30ab9078294     |
 +| serial         | 1498321673                           |
 +| status         | PENDING                              |
 +| transferred_at | None                                 |
 +| ttl            | 3600                                 |
 +| type           | PRIMARY                              |
 +| updated_at     | None                                 |
 +| version        | 1                                    |
 ++----------------+--------------------------------------+
 +</code>
 +  mkdir -p /etc/kolla/config/designate/designate-sink/
 +<code - /etc/kolla/config/designate/designate-sink.conf>
 +[handler:nova_fixed]
 +zone_id = 80ca9c9c-0152-4779-8cd4-388cf0c2a433
 +[handler:neutron_floatingip]
 +zone_id = 80ca9c9c-0152-4779-8cd4-388cf0c2a433
 +</code>
 +  kolla-ansible reconfigure -i /etc/kolla/multinode --tags designate
 +Now we are going to create a DNS domain and add network demo-net to the domain.
 +<code>
 +[root@kolla ~]# neutron net-list
 ++--------------------------------------+----------+----------------------------------+----------------------------------------------------+
 +| id                                   | name     | tenant_id                        | subnets                                            |
 ++--------------------------------------+----------+----------------------------------+----------------------------------------------------+
 +| 3ae68d4d-b123-4604-b003-c340d43c542a | demo-net | f01d9fc8069241b5b217e30ab9078294 | d7ef8a40-f7ab-446b-9865-3709713700d3 10.0.0.0/24   |
 +| 5293f890-079b-497c-b09b-914c3ef9d740 | public   | f01d9fc8069241b5b217e30ab9078294 | e182e72d-fa34-4963-bcb3-d3ae0fa7e1eb 172.16.3.0/24 |
 ++--------------------------------------+----------+----------------------------------+----------------------------------------------------+
 +</code>
 +<code>
 +[root@kolla ~]# neutron net-update 3ae68d4d-b123-4604-b003-c340d43c542a --dns_domain openstack.helux.nl.
 +Updated network: 3ae68d4d-b123-4604-b003-c340d43c542a
 +</code>
 +<code>
 +[root@kolla ~]# neutron net-show 3ae68d4d-b123-4604-b003-c340d43c542a
 ++---------------------------+--------------------------------------+
 +| Field                     | Value                                |
 ++---------------------------+--------------------------------------+
 +| admin_state_up            | True                                 |
 +| availability_zone_hints   |                                      |
 +| availability_zones        | nova                                 |
 +| created_at                | 2017-06-24T15:32:04Z                 |
 +| description               |                                      |
 +| dns_domain                | openstack.helux.nl.                  |
 +| id                        | 3ae68d4d-b123-4604-b003-c340d43c542a |
 +| ipv4_address_scope        |                                      |
 +| ipv6_address_scope        |                                      |
 +| mtu                       | 1450                                 |
 +| name                      | demo-net                             |
 +| port_security_enabled     | True                                 |
 +| project_id                | f01d9fc8069241b5b217e30ab9078294     |
 +| provider:network_type     | vxlan                                |
 +| provider:physical_network |                                      |
 +| provider:segmentation_id  | 38                                   |
 +| revision_number           | 6                                    |
 +| router:external           | False                                |
 +| shared                    | False                                |
 +| status                    | ACTIVE                               |
 +| subnets                   | d7ef8a40-f7ab-446b-9865-3709713700d3 |
 +| tags                      |                                      |
 +| tenant_id                 | f01d9fc8069241b5b217e30ab9078294     |
 +| updated_at                | 2017-06-24T16:34:41Z                 |
 ++---------------------------+--------------------------------------+
 +</code>
 +<code>
 +[root@kolla ~]# openstack recordset list openstack.helux.nl.
 ++--------------------------------------+--------------------------------+------+---------------------------------------------+--------+--------+
 +| id                                   | name                           | type | records                                     | status | action |
 ++--------------------------------------+--------------------------------+------+---------------------------------------------+--------+--------+
 +| 00c1fb58-b504-4038-9f4f-fba1947e8417 | openstack.helux.nl.            | NS   | openstack.helux.nl.                         | ACTIVE | NONE   |
 +| 89a3bcd3-ebec-4a0d-9ab2-dd1aeac95913 | openstack.helux.nl.            | SOA  | openstack.helux.nl. info.helux.nl.          | ACTIVE | NONE   |
 +|                                      |                                |      | 1498322265 3550 600 86400 3600              |        |        |
 ++--------------------------------------+--------------------------------+------+---------------------------------------------+--------+--------+
 +</code>
 +After creating some instances DNS is automatically provisioned:
 +<code>
 ++--------------------------------------+--------------------------------+------+---------------------------------------------+--------+--------+
 +| id                                   | name                           | type | records                                     | status | action |
 ++--------------------------------------+--------------------------------+------+---------------------------------------------+--------+--------+
 +| 00c1fb58-b504-4038-9f4f-fba1947e8417 | openstack.helux.nl.            | NS   | openstack.helux.nl.                         | ACTIVE | NONE   |
 +| 89a3bcd3-ebec-4a0d-9ab2-dd1aeac95913 | openstack.helux.nl.            | SOA  | openstack.helux.nl. info.helux.nl.          | ACTIVE | NONE   |
 +|                                      |                                |      | 1498328424 3550 600 86400 3600              |        |        |
 +| 02089897-050d-4bd9-9bf6-ce599898c332 | 10-1-0-8.openstack.helux.nl.   | A    | 10.1.0.8                                    | ACTIVE | NONE   |
 +| 6bfd53b1-9302-4592-b3bf-a83fa7cd31dc | test1.openstack.helux.nl.      | A    | 10.1.0.8                                    | ACTIVE | NONE   |
 +| 75ddff18-b2ee-4c1f-8a42-5d69d84cdb03 | test1.None.openstack.helux.nl. | A    | 10.1.0.8                                    | ACTIVE | NONE   |
 +| 0bcee6fe-13db-4cfa-ac04-34b9cf549bf2 | test2.openstack.helux.nl.      | A    | 10.1.0.12                                   | ACTIVE | NONE   |
 +| 8440a5a2-0601-453e-a0f7-e74b9d2788b0 | test2.None.openstack.helux.nl. | A    | 10.1.0.12                                   | ACTIVE | NONE   |
 +| e3ed9ba5-ce44-409d-879d-e29b5b9b949b | 10-1-0-12.openstack.helux.nl.  | A    | 10.1.0.12                                   | ACTIVE | NONE   |
 +| 0efa2b91-5480-47e6-bef8-f04e52cb3415 | 10-1-0-6.openstack.helux.nl.   | A    | 10.1.0.6                                    | ACTIVE | NONE   |
 +| 10f5b137-c5fb-46aa-a5fd-3315dbcd5895 | test3.None.openstack.helux.nl. | A    | 10.1.0.6                                    | ACTIVE | NONE   |
 +| e48546b1-764c-48e2-86df-791677b979bc | test3.openstack.helux.nl.      | A    | 10.1.0.6                                    | ACTIVE | NONE   |
 ++--------------------------------------+--------------------------------+------+---------------------------------------------+--------+--------+
 +</code>
  
 {{tag>centos}} {{tag>centos}}
openstack_with_kolla.1498329421.txt.gz · Last modified: by herwarth

Page Tools

Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki