Menu Close

8.4.3.3. Configuring Octavia

Kuryr SDN uses Red Hat OpenStack Platform (RHOSP)'s Octavia LBaaS to implement OpenShift Container Platform services. Thus, you must install and configure Octavia components in RHOSP to use Kuryr SDN.

To enable Octavia, you must include the Octavia service during the installation of the RHOSP Overcloud, or upgrade the Octavia service if the Overcloud already exists. The following steps for enabling Octavia apply to both a clean install of the Overcloud or an Overcloud update.

注記

The following steps only capture the key pieces required during the deployment of RHOSP when dealing with Octavia. It is also important to note that registry methods vary.

This example uses the local registry method.

Procedure

  1. If you are using the local registry, create a template to upload the images to the registry. For example:

    (undercloud) $ openstack overcloud container image prepare \
    -e /usr/share/openstack-tripleo-heat-templates/environments/services-docker/octavia.yaml \
    --namespace=registry.access.redhat.com/rhosp13 \
    --push-destination=<local-ip-from-undercloud.conf>:8787 \
    --prefix=openstack- \
    --tag-from-label {version}-{release} \
    --output-env-file=/home/stack/templates/overcloud_images.yaml \
    --output-images-file /home/stack/local_registry_images.yaml
  2. Verify that the local_registry_images.yaml file contains the Octavia images. For example:

    ...
    - imagename: registry.access.redhat.com/rhosp13/openstack-octavia-api:13.0-43
      push_destination: <local-ip-from-undercloud.conf>:8787
    - imagename: registry.access.redhat.com/rhosp13/openstack-octavia-health-manager:13.0-45
      push_destination: <local-ip-from-undercloud.conf>:8787
    - imagename: registry.access.redhat.com/rhosp13/openstack-octavia-housekeeping:13.0-45
      push_destination: <local-ip-from-undercloud.conf>:8787
    - imagename: registry.access.redhat.com/rhosp13/openstack-octavia-worker:13.0-44
      push_destination: <local-ip-from-undercloud.conf>:8787
    注記

    The Octavia container versions vary depending upon the specific RHOSP release installed.

  3. Pull the container images from registry.redhat.io to the Undercloud node:

    (undercloud) $ sudo openstack overcloud container image upload \
      --config-file  /home/stack/local_registry_images.yaml \
      --verbose

    This may take some time depending on the speed of your network and Undercloud disk.

  4. Since an Octavia load balancer is used to access the OpenShift Container Platform API, you must increase their listeners' default timeouts for the connections. The default timeout is 50 seconds. Increase the timeout to 20 minutes by passing the following file to the Overcloud deploy command:

    (undercloud) $ cat octavia_timeouts.yaml
    parameter_defaults:
      OctaviaTimeoutClientData: 1200000
      OctaviaTimeoutMemberData: 1200000
    注記

    This is not needed for RHOSP 13.0.13+.

  5. Install or update your Overcloud environment with Octavia:

    $ openstack overcloud deploy --templates \
      -e /usr/share/openstack-tripleo-heat-templates/environments/services-docker/octavia.yaml \
      -e octavia_timeouts.yaml
    注記

    This command only includes the files associated with Octavia; it varies based on your specific installation of RHOSP. See the RHOSP documentation for further information. For more information on customizing your Octavia installation, see installation of Octavia using Director.

    注記

    When leveraging Kuryr SDN, the Overcloud installation requires the Neutron trunk extension. This is available by default on director deployments. Use the openvswitch firewall instead of the default ovs-hybrid when the Neutron backend is ML2/OVS. There is no need for modifications if the backend is ML2/OVN.

  6. In RHOSP versions earlier than 13.0.13, add the project ID to the octavia.conf configuration file after you create the project.

    • To enforce network policies across services, like when traffic goes through the Octavia load balancer, you must ensure Octavia creates the Amphora VM security groups on the user project.

      This change ensures that required load balancer security groups belong to that project, and that they can be updated to enforce services isolation.

      注記

      This task is unnecessary in RHOSP version 13.0.13 or later.

      Octavia implements a new ACL API that restricts access to the load balancers VIP.

      1. Get the project ID

        $ openstack project show <project>

        Example output

        +-------------+----------------------------------+
        | Field       | Value                            |
        +-------------+----------------------------------+
        | description |                                  |
        | domain_id   | default                          |
        | enabled     | True                             |
        | id          | PROJECT_ID                       |
        | is_domain   | False                            |
        | name        | *<project>*                      |
        | parent_id   | default                          |
        | tags        | []                               |
        +-------------+----------------------------------+

      2. Add the project ID to octavia.conf for the controllers.

        1. Source the stackrc file:

          $ source stackrc  # Undercloud credentials
        2. List the Overcloud controllers:

          $ openstack server list

          Example output

          +--------------------------------------+--------------+--------+-----------------------+----------------+------------+
          │
          | ID                                   | Name         | Status | Networks
          | Image          | Flavor     |
          │
          +--------------------------------------+--------------+--------+-----------------------+----------------+------------+
          │
          | 6bef8e73-2ba5-4860-a0b1-3937f8ca7e01 | controller-0 | ACTIVE |
          ctlplane=192.168.24.8 | overcloud-full | controller |
          │
          | dda3173a-ab26-47f8-a2dc-8473b4a67ab9 | compute-0    | ACTIVE |
          ctlplane=192.168.24.6 | overcloud-full | compute    |
          │
          +--------------------------------------+--------------+--------+-----------------------+----------------+------------+

        3. SSH into the controller(s).

          $ ssh heat-admin@192.168.24.8
        4. Edit the octavia.conf file to add the project into the list of projects where Amphora security groups are on the user’s account.

          # List of project IDs that are allowed to have Load balancer security groups
          # belonging to them.
          amp_secgroup_allowed_projects = PROJECT_ID
      3. Restart the Octavia worker so the new configuration loads.

        controller-0$ sudo docker restart octavia_worker
注記

Depending on your RHOSP environment, Octavia might not support UDP listeners. If you use Kuryr SDN on RHOSP version 13.0.13 or earlier, UDP services are not supported. RHOSP version 16 or later support UDP.

8.4.3.3.1. The Octavia OVN Driver

Octavia supports multiple provider drivers through the Octavia API.

To see all available Octavia provider drivers, on a command line, enter:

$ openstack loadbalancer provider list

Example output

+---------+-------------------------------------------------+
| name    | description                                     |
+---------+-------------------------------------------------+
| amphora | The Octavia Amphora driver.                     |
| octavia | Deprecated alias of the Octavia Amphora driver. |
| ovn     | Octavia OVN driver.                             |
+---------+-------------------------------------------------+

Beginning with RHOSP version 16, the Octavia OVN provider driver (ovn) is supported on OpenShift Container Platform on RHOSP deployments.

ovn is an integration driver for the load balancing that Octavia and OVN provide. It supports basic load balancing capabilities, and is based on OpenFlow rules. The driver is automatically enabled in Octavia by Director on deployments that use OVN Neutron ML2.

The Amphora provider driver is the default driver. If ovn is enabled, however, Kuryr uses it.

If Kuryr uses ovn instead of Amphora, it offers the following benefits:

  • Decreased resource requirements. Kuryr does not require a load balancer VM for each service.
  • Reduced network latency.
  • Increased service creation speed by using OpenFlow rules instead of a VM for each service.
  • Distributed load balancing actions across all nodes instead of centralized on Amphora VMs.