Chapter 1. Install and Configure OpenStack Bare Metal Provisioning (ironic)

1. Source the overcloudrc file:

   # source ~stack/overcloudrc

2. Create the OpenStack Bare Metal Provisioning user:

   # openstack user create --password IRONIC_PASSWORD --enable IRONIC_USER
   # openstack role add --project service --user IRONIC_USER admin

   Here, IRONIC_USER is the user for the Bare Metal Provisioning service and IRONIC_PASSWORD is the password.

3. Create the OpenStack Bare Metal Provisioning service:

   # openstack service create --name ironic --description "Ironic bare metal provisioning service" baremetal

4. Verify the virtual IP (VIP) address that the other OpenStack services are using:

   # openstack endpoint list -c "Service Name" -c "PublicURL" --long

   The output of this command lists the services and their Public URL, which are usually all on the same server and use the same IP address.

5. Get the Internal API network address of the Compute node that you are installing the Bare Metal Provisioning service on:

   # route -n

   The output of this command lists the IP routing table with the IP addresses and the interface for each of the IP addresses.

   The Internal API network address is then used to create a service endpoint.

6. You can check the IP address associated with the NIC to use for the Internal and Admin URLs as follows:

   # ifconfig INTERFACE

7. Create the service endpoint:

   # openstack endpoint create --publicurl http://VIP:6385 --internalurl http://COMPUTE_INTERNAL_API_IP:6385 --adminurl http://COMPUTE_INTERNAL_API_IP:6385 --region regionOne SERVICE_ID

   Here, VIP is the virtual IP address configured in HAProxy, COMPUTE_INTERNAL_API_IP is the IP address for the Compute node running the Bare Metal Provisioning service that is connected to the Internal API network and SERVICE_ID is the ID of the Bare Metal Provisioning service created using the service create command.

1. Edit the /etc/haproxy/haproxy.cfg file and add the following line at the end of the file:

   listen ironic
   
     bind VIP:6385 transparent
     server SERVER_NAME COMPUTE_INTERNAL_API_IP:6385 check fall 5 inter 2000 rise 2

   In this example:

   • VIP is the virtual IP address.
   • SERVER_NAME is the HAProxy identifying name for the Compute server where the Bare Metal Provisioning service will be installed and running.
   • COMPUTE_INTERNAL_API_IP is the Internal API IP address of the Compute server where the Bare Metal Provisioning service will be installed and running.
   • transparent allows the HAProxy to bind the IP address even if it does not exist on the Controller node so that in a clustered environment, the virtual IP address can move between controllers.

   • check fall 5 inter 2000 rise 2 refers to the following health checks on the back end server:

     • fall 5 - the server is considered unavailable after 5 consecutive failed health checks.
     • inter 2000 - the interval between health checks is 2000 ms or 2 seconds.
     • rise 2 - the server is considered available after 2 consecutive successful health checks.

2. Restart the HAProxy to make sure the changes take effect:

   # systemctl restart haproxy.service

   You can get the following message stating the back end server is not available: haproxy[4249]: proxy ironic has no server available!. This message can be ignored for now, since you have not yet installed or configured the service.

1. Add a bridge into Open vSwitch:

   # ovs-vsctl add-br br-ironic
   # ovs-vsctl add-port br-ironic IRONIC_PROVISIONING_NIC
   # ovs-vsctl show

   Here br-ironic is the name of the bridge and IRONIC_PROVISIONING_NIC is the NIC connected to the Bare Metal Provisioning Network.

   With the ovs-vsctl show command, you can see that a new bridge is created with the associated port, however you will notice that the br-int integration bridge lacks a patch to the new bridge.

2. To get the new bridge added to the integration bridge, you need to update the following plugin files:

   1. Update the ML2 configuration file, /etc/neutron/plugins/ml2/ml2_conf.ini as follows:

      • For the type_drivers parameter, make sure flat is listed among the drivers, for example, type_drivers = vxlan,vlan,flat,gre. This is a comma delimited list.
      • For the mechanism_drivers parameter, make sure openvswitch option is listed among the drivers, for example, mechanism_drivers =openvswitch. This is a comma delimited list.
      • For the flat_networks parameters, create a name to refer to the Bare Metal Provisioning Network, for example, ironicnet. Make sure this name is listed among the flat_networks listed, for example, flat_networks =datacentre,ironicnet. This is a comma delimited list.
      • If you are using a VLAN for the Bare Metal Provisioning Network, add the network_vlan_ranges parameter with the following format: ironicnet:VLAN_START:VLAN_END, for example, network_vlan_ranges =datacentre:1:1000. This is a comma delimited list.
      • The enable_security_group parameter should already be enabled. But if it is not set, change the value to True, for example, enable_security_group = True.

   2. In the /etc/neutron/plugins/ml2/openvswitch_agent.ini file, find the bridge_mappings parameter and update as follows:

      bridge_mappings =datacentre:br-ex,ironicnet:br-ironic

      The value of this comma delimited key-value pair maps the name of the Bare Metal Provisioning Network to the physical device which is connected to the network.

3. Restart the neutron-openvswitch-agent.service to see the br-ironic bridge as a part of the integration bridge:

   # systemctl restart neutron-openvswitch-agent.service

4. Restart the neutron-server.service so that it detects the new connection:

   # systemctl restart neutron-server.service

   Note

   If you do not perform this step, trying to create the Bare Metal Provisioning Network within the OpenStack Networking service will fail with a message that the requested flat network does not exist.

1. To connect the Bare Metal Provisioning NIC, eth6 in this example, to Open vSwitch.
2. To assign an IP address on this connection as the Bare Metal server needs to pull down the boot images from the bare metal node as a part of the iPXE process.

Connecting eth6 to Open vSwitch

1. As with the Controller node in Section 1.3, “Configure the Controller Nodes for Bare Metal Provisioning Service”, create a bridge within Open vSwitch on the Compute node running the Bare Metal Provisioning service:

   # ovs-vsctl add-br br-ironic
   # ovs-vsctl add-port br-ironic IRONIC_PROVISIONING_NIC

   Here, br-ironic is the name of the bridge and IRONIC_PROVISIONING NIC is the NIC connected to the Bare Metal Provisioning Network, for example, eth6.

   Note

   The only difference between this and Section 1.3, “Configure the Controller Nodes for Bare Metal Provisioning Service” is that you do not restart the OpenStack Networking service on the Compute node.

   This adds the bridge and port to the Open vSwitch, which you can verify using the ovs-vsctl show command. However, it does not connect it to the integration bridge (br-int) for use by OpenStack.

2. To create the connection, you need to update the OpenStack Networking plugin files as follows:

   1. Update the ML2 configuration file, /etc/neutron/plugins/ml2/ml2_conf.ini as follows:

      • For the type_drivers parameter, make sure flat is listed among the drivers, for example, type_drivers = vxlan,vlan,flat,gre. This is a comma delimited list.
      • For the mechanism_drivers parameter, make sure openvswitch option is listed among the drivers, for example, mechanism_drivers =openvswitch. This is a comma delimited list.
      • For the flat_networks parameters, create a name to refer to the Bare Metal Provisioning Network, for example, ironicnet. Make sure this name is listed among the flat_networks listed, for example, flat_networks =datacentre,ironicnet. This is a comma delimited list.
      • If you are using a VLAN for the Bare Metal Provisioning Network, add the network_vlan_ranges parameter with the following format: ironicnet:VLAN_START:VLAN_END, for example, network_vlan_ranges =datacentre:1:1000. This is a comma delimited list.
      • The enable_security_group parameter should already be enabled. But if it is not set, change the value to True, for example, enable_security_group = True.

   2. In the /etc/neutron/plugins/ml2/openvswitch_agent.ini file, find the bridge_mappings parameter and update as follows:

      bridge_mappings =datacentre:br-ex,ironicnet:br-ironic

      The value of this comma delimited key-value pair maps the name of the Bare Metal Provisioning Network to the physical device which is connected to the network.

3. Restart the OpenStack Networking Open vSwitch Agent service:

   # systemctl restart neutron-openvswitch-agent.service

Assigning an IP address to the Bare Metal server

1. Create standard configuration files in the /etc/sysconfig/network-scripts location. You can copy the ifcfg* files already available in the tenant network and edit the following values: device, ipaddr, ovs_bridge, bridge name and MAC addresses for the br-ironic and eth6. When you have completed updating the new files, they should have the following values:

   ifcfg-br-ironic

   DEVICE=br-ironic
   ONBOOT=yes
   HOTPLUG=no
   NM_CONTROLLED=no
   PEERDNS=no
   DEVICETYPE=ovs
   TYPE=OVSBridge
   BOOTPROTO=static
   IPADDR=BARE_METAL_PROVISIONING_IP
   NETMASK=255.255.255.0
   OVS_EXTRA="set bridge br-ironic other-config:hwaddr=MAC_ADDRESS"

   ifcfg-eth6

   DEVICE=eth6
   ONBOOT=yes
   HOTPLUG=no
   NM_CONTROLLED=no
   PEERDNS=no
   DEVICETYPE=ovs
   TYPE=OVSPort
   OVS_BRIDGE=br-ironic
   BOOTPROTO=none

2. Restart the network bridge to make your IP address pingable.

   # ifup br-ironic

   Note

   If you get disconnected from the node when you restart the network services, reboot the server.