Skip to content
Snippets Groups Projects
Select Git revision
  • deployment default
1 result
Blame Permalink
  • Mark Goddard's avatar
    7f7c4e2a
    Add documentation for routed control plane networks · 7f7c4e2a
    Mark Goddard authored 
    Kayobe currently supports definition of various different networks -
public, internal, tunnel, etc. These typically map to a VLAN or flat
network, with an IP subnet. When a cloud exceeds the size of a single
VLAN/subnet, this approach no longer works.

One way to resolve this is to have multiple subnets that map to a single
logical network, and provide routing between them. This is a similar
concept to neutron's routed networks, but for the control plane.

This change provides documentation for the currently tested parts of
this feature.

Change-Id: Ic06c6d4fff0fa568eb9ed3a9c30ce21c7699d965
Story: 2008180
Task: 40938
    7f7c4e2a
    History
    Add documentation for routed control plane networks
    Mark Goddard authored 
    Kayobe currently supports definition of various different networks -
public, internal, tunnel, etc. These typically map to a VLAN or flat
network, with an IP subnet. When a cloud exceeds the size of a single
VLAN/subnet, this approach no longer works.

One way to resolve this is to have multiple subnets that map to a single
logical network, and provide routing between them. This is a similar
concept to neutron's routed networks, but for the control plane.

This change provides documentation for the currently tested parts of
this feature.

Change-Id: Ic06c6d4fff0fa568eb9ed3a9c30ce21c7699d965
Story: 2008180
Task: 40938
kolla-ansible.rst 27.66 KiB

Kolla Ansible Configuration

Kayobe relies heavily on Kolla Ansible for deployment of the OpenStack control plane. Kolla Ansible is installed locally on the Ansible control host (the host from which Kayobe commands are executed), and Kolla Ansible commands are executed from there.

Kolla Ansible configuration is stored in ${KAYOBE_CONFIG_PATH}/kolla.yml.

Configuration of Ansible

Ansible configuration is described in detail in the Ansible documentation. In addition to the standard locations, Kayobe supports using an Ansible configuration file located in the Kayobe configuration at ${KAYOBE_CONFIG_PATH}/kolla/ansible.cfg or ${KAYOBE_CONFIG_PATH}/ansible.cfg. Note that if the ANSIBLE_CONFIG environment variable is specified it takes precedence over this file.

Kolla Ansible Installation

Prior to deploying containers, Kolla Ansible and its dependencies will be installed on the Ansible control host. The following variables affect the installation of Kolla Ansible:

kolla_ansible_ctl_install_type
Type of Kolla Ansible control installation. One of binary (PyPI) or source (git). Default is source.
kolla_ansible_source_url
URL of Kolla Ansible source code repository if type is source. Default is https://opendev.org/openstack/kolla-ansible.
kolla_ansible_source_version
Version (branch, tag, etc.) of Kolla Ansible source code repository if type is source. Default is the same as the Kayobe upstream branch.
kolla_ansible_venv_extra_requirements
Extra requirements to install inside the Kolla Ansible virtualenv. Default is an empty list.
kolla_upper_constraints_file
Upper constraints file for installation of Kolla. Default is {{ pip_upper_constraints_file }}, which has a default of https://releases.openstack.org/constraints/upper/{{ openstack_branch }}.

Example: custom git repository

To install Kolla Ansible from a custom git repository:

Virtual Environment Extra Requirements

Extra Python packages can be installed inside the Kolla Ansible virtualenv, such as when required by Ansible plugins.

For example, to use the hashi_vault Ansible lookup plugin, its hvac dependency can be installed using:

Local environment

The following variables affect the local environment on the Ansible control host. They reference environment variables, and should be configured using those rather than modifying the Ansible variable directly. The file kayobe-env in the kayobe-config git repository sets some sensible defaults for these variables, based on the recommended environment directory structure.

kolla_ansible_source_path
Path to directory for Kolla Ansible source code checkout. Default is $KOLLA_SOURCE_PATH, or $PWD/src/kolla-ansible.
kolla_ansible_venv
Path to virtualenv in which to install Kolla Ansible on the Ansible control host. Default is $KOLLA_VENV_PATH or $PWD/venvs/kolla-ansible.
kolla_config_path
Path to Kolla Ansible configuration directory. Default is $KOLLA_CONFIG_PATH or /etc/kolla.

Global Configuration

The following variables are global, affecting all containers. They are used to generate the Kolla Ansible configuration file, globals.yml, and also affect :ref:`Kolla image build configuration <configuration-kolla-global>`.

Kolla Images

The following variables affect which Kolla images are used, and how they are accessed.

kolla_base_distro
Kolla base container image distribution. Default is centos.
kolla_install_type
Kolla container image type: binary or source. Default is binary.
kolla_docker_registry
URL of docker registry to use for Kolla images. Default is not set, in which case Dockerhub will be used.
kolla_docker_namespace
Docker namespace to use for Kolla images. Default is kolla.
kolla_docker_registry_username
Username to use to access a docker registry. Default is not set, in which case the registry will be used without authentication.
kolla_docker_registry_password
Password to use to access a docker registry. Default is not set, in which case the registry will be used without authentication.
kolla_openstack_release
Kolla OpenStack release version. This should be a Docker image tag. Default is {{ openstack_release }}, which takes the OpenStack release name (e.g. rocky) on stable branches and tagged releases, or master on the Kayobe master branch.

For example, to deploy Kolla centos binary images with a namespace of example, and a private Docker registry at registry.example.com:4000, tagged with 7.0.0.1:

The deployed ironic-api image would be referenced as follows:

registry.example.com:4000/example/centos-binary-ironic-api:7.0.0.1

Ansible

The following variables affect how Ansible accesses the remote hosts.

kolla_ansible_user
User account to use for Kolla SSH access. Default is kolla.
kolla_ansible_group
Primary group of Kolla SSH user. Default is kolla.
kolla_ansible_become
Whether to use privilege escalation for all operations performed via Kolla Ansible. Default is false since the 8.0.0 Ussuri release.
kolla_ansible_target_venv
Path to a virtual environment on remote hosts to use for Ansible module execution. Default is {{ virtualenv_path }}/kolla-ansible. May be set to None to use the system Python interpreter.

Context: Remote Execution Environment

By default, Ansible executes modules remotely using the system python interpreter, even if the Ansible control process is executed from within a virtual environment (unless the local connection plugin is used). This is not ideal if there are python dependencies that must be installed with isolation from the system python packages. Ansible can be configured to use a virtualenv by setting the host variable ansible_python_interpreter to a path to a python interpreter in an existing virtual environment.

The variable kolla_ansible_target_venv configures the use of a virtual environment on the remote hosts. The default configuration should work in most cases.

User account creation

Since the Ussuri release, Kayobe creates a user account for Kolla Ansible rather than this being done during Kolla Ansible's bootstrap-servers command. This workflow is more compatible with Ansible fact caching, but does mean that Kolla Ansible's create_kolla_user variable cannot be used to disable creation of the user account. Instead, set kolla_ansible_create_user to false.

kolla_ansible_create_user
Whether to create a user account, configure passwordless sudo and authorise an SSH key for Kolla Ansible. Default is true.

OpenStack Logging

The following variable affects OpenStack debug logging.

kolla_openstack_logging_debug
Whether debug logging is enabled for OpenStack services. Default is false.

Example: enabling debug logging

In certain situations it may be necessary to enable debug logging for all OpenStack services. This is not usually advisable in production.

API Addresses

Note

These variables should be used over the deprecated vip_address and fqdn network attributes <configuration-network-global>

The following variables affect the addresses used for the external and internal API.

kolla_internal_vip_address
Virtual IP address of OpenStack internal API. Default is the vip_address attribute of the internal network.
kolla_internal_fqdn
Fully Qualified Domain Name (FQDN) of OpenStack internal API. Default is the fqdn attribute of the internal network if set, otherwise kolla_internal_vip_address.
kolla_external_vip_address
Virtual IP address of OpenStack external API. Default is the vip_address attribute of the external network.
kolla_external_fqdn
Fully Qualified Domain Name (FQDN) of OpenStack external API. Default is the fqdn attribute of the external network if set, otherwise kolla_external_vip_address.

TLS Encryption of APIs

The following variables affect TLS encryption of the public API.

kolla_enable_tls_external
Whether TLS is enabled for the public API endpoints. Default is no.
kolla_external_tls_cert
A TLS certificate bundle to use for the public API endpoints, if kolla_enable_tls_external is true. Note that this should be formatted as a literal style block scalar.
kolla_external_fqdn_cacert
Path to a CA certificate file to use for the OS_CACERT environment variable in openrc files when TLS is enabled, instead of Kolla Ansible's default.

The following variables affect TLS encryption of the internal API. Currently this requires all Kolla images to be built with the API's root CA trusted.

kolla_enable_tls_internal
Whether TLS is enabled for the internal API endpoints. Default is no.
kolla_internal_tls_cert
A TLS certificate bundle to use for the internal API endpoints, if kolla_enable_tls_internal is true. Note that this should be formatted as a literal style block scalar.
kolla_internal_fqdn_cacert
Path to a CA certificate file to use for the OS_CACERT environment variable in openrc files when TLS is enabled, instead of Kolla Ansible's default.

Example: enabling TLS for the public API

It is highly recommended to use TLS encryption to secure the public API. Here is an example:

Example: enabling TLS for the internal API

It is highly recommended to use TLS encryption to secure the internal API. Here is an example:

Other certificates

In general, Kolla Ansible expects certificates to be in a directory configured via kolla_certificates_dir, which defaults to a directory named certificates in the same directory as globals.yml. Kayobe follows this pattern, and will pass files and directories added to ${KAYOBE_CONFIG_PATH}/kolla/certificates/ through to Kolla Ansible. This can be useful when enabling backend API TLS encryption, or providing custom CA certificates to be added to the trust store in containers. It is also possible to use this path to provide certificate bundles for the external or internal APIs, as an alternative to kolla_external_tls_cert and kolla_internal_tls_cert.

Note that Ansible will automatically decrypt these files if they are encrypted via Ansible Vault and it has access to a Vault password.

Example: adding a trusted custom CA certificate to containers

In an environment with a private CA, it may be necessary to add the root CA certificate to the trust store of containers.

These files should be PEM-formatted, and have a .crt extension.

Example: adding certificates for backend TLS

Kolla Ansible backend TLS can be used to provide end-to-end encryption of API traffic.

See the :kolla-ansible-doc:`Kolla Ansible documentation <admin/advanced-configuration.html#tls-configuration>` for how to provide service and/or host-specific certificates and keys.