Chapter 3. Post-deployment configuration
You must complete some post-deployment configuration tasks before you create NFS shares, grant user access, and mount NFS shares.
- Map the Networking service (neutron) storage network to the isolated data center storage network.
- Make the storage provider network available to trusted tenants only through custom role based access control (RBAC). Do not share the storage provider network globally.
- Create a private share type.
- Grant access to specific trusted tenants.
After you complete these steps, the tenant compute instances can create, allow access to, and mount native CephFS shares.
3.1. Creating the storage provider network
You must map the new isolated storage network to a Networking (neutron) provider network. The Compute VMs attach to the network to access native CephFS share export locations.
For information about network security with the Shared File Systems service, see Hardening the Shared File Systems Service in the Security and Hardening Guide.
openstack network create command defines the configuration for the storage neutron network.
From an undercloud node, enter the following command:
[stack@undercloud ~]$ source ~/overcloudrc
On an undercloud node, create the storage network:
(overcloud) [stack@undercloud-0 ~]$ openstack network create Storage --provider-network-type vlan --provider-physical-network datacentre --provider-segment 30
You can enter this command with the following options:
--provider-physical-networkoption, use the default value
datacentre, unless you set another tag for the br-isolated bridge through NeutronBridgeMappings in your tripleo-heat-templates.
--provider-segmentoption, use the value set for the Storage isolated network in your network environment file. If this was not customized, the default environment file is
/usr/share/openstack-tripleo-heat-templates/network_data.yaml. The VLAN associated with the Storage network value is
30unless you modified the isolated network definitions.
--provider-network-typeoption, use the value
- For the
3.2. Configuring the storage provider network
Create a corresponding
StorageSubnet on the neutron provider network. Ensure that the subnet is the same for the
storage_subnet in the undercloud, and that the allocation range for the storage subnet and the corresponding undercloud subnet do not overlap.
- The starting and ending IP range for the allocation pool
- The subnet IP range
- Log in to an overcloud node.
Use the sample command to provision the network. Update the values to suit your environment.
[stack@undercloud-0 ~]$ openstack subnet create \ --allocation-pool start=172.17.3.10,end=172.17.3.149 \ --dhcp \ --network Storage \ --subnet-range 172.17.3.0/24 \ --gateway none StorageSubnet
--allocation-pooloption, replace the
start=172.17.3.10,end=172.17.3.149IP values with the IP values for your network.
--subnet-rangeoption, replace the
172.17.3.0/24subnet range with the subnet range for your network.
- For the
3.3. Configuring role-based access control for the storage provider network
After you identify the trusted tenants or projects that can use the storage network, configure role-based access control (RBAC) rules for them through the Networking service (neutron).
Names of the projects that need access to the storage network
- Log in to an overcloud node.
Identify the projects that require access:
[stack@undercloud-0 ~]$ openstack project list +----------------------------------+---------+ | ID | Name | +----------------------------------+---------+ | 06f1068f79d2400b88d1c2c33eacea87 | demo | | 5038dde12dfb44fdaa0b3ee4bfe487ce | service | | 820e2d9c956644c2b1530b514127fd0d | admin | +----------------------------------+---------+
Create network RBAC rules with the desired projects:
[stack@undercloud-0 ~]$ openstack network rbac create \ --action access_as_shared Storage \ --type network \ --target-project demo
Repeat this step for all of the projects that require access to the storage network.