Installing OpenStack Octavia Stein release on Ubuntu 18.04 manually |

This describes how to install and configure the OpenStack Load-balancer service(Octavia) on top of the Minimal deployment for Stein for Ubuntu. This is based on the octavia devstack plugin.

Note: I contributed Octavia installation guide to the community based on this article. Please visit Install and configure for Ubuntu!

Prerequites

Before you install and configure the service, you must create a database, service credentials, and API endpoints.

Create the database

mysql> CREATE DATABASE octavia;
mysql> CREATE USER ‘octavia’@’localhost’ IDENTIFIED BY 'password';
mysql> GRANT ALL PRIVILEGES ON octavia.* TO ‘octavia’@’localhost’;
mysql> GRANT ALL PRIVILEGES ON octavia.* TO 'octavia'@'%' IDENTIFIED BY 'password';
mysql>flush PRIVILEGES;

Create the octavia user

$ source admin-openrc.sh
$ openstack user create --domain default --password-prompt octavia
$ openstack role add --project service --user octavia admin

Create the service entry and endpoints

$ source admin-openrc.sh
$ openstack service create --name octavia --description "OpenStack Octavia" load-balancer
$ openstack endpoint create --region RegionOne octavia public http://<controller>:9876
$ openstack endpoint create --region RegionOne octavia internal http://<controller>:9876
$ openstack endpoint create --region RegionOne octavia admin http://<controller>:9876

Octavia deploys amphora based on a virtual machine disk image. you must create the disk image, upload the image to Glance and configure a Nova flavor to use for amphora.

Create the amphora image

$ git clone https://github.com/openstack/octavia.git
$ sudo apt update
$ sudo apt install tox qemu-utils git kpartx debootstrap
$ cd octavia/diskimage-create
$ tox -e build

Upload the amphora image

Create octavia-openrc.sh file.

export OS_PROJECT_DOMAIN_NAME=Default
export OS_USER_DOMAIN_NAME=Default
export OS_PROJECT_NAME=service
export OS_USERNAME=octavia
export OS_PASSWORD=<password>
export OS_AUTH_URL=http://<controller>:5000
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2
export OS_VOLUME_API_VERSION=3

$ source octavia-openrc.sh
$ openstack image create --disk-format qcow2 --container-format bare --public --tag amphora --file amphora-x64-haproxy.qcow2 amphora-x64-haproxy

Create a flavor for the amphora image

$ source octavia-openrc.sh
$ openstack flavor create --id 200 --vcpus 2 --ram 1024 --disk 10 "amphora" --public

Install and configure components

Install packages

$ sudo apt install octavia-api octavia-health-manager octavia-housekeeping octavia-worker python3-octavia python3-octaviaclient

If ocatavia-common package asks you to configure, choose No.

Create the certificates

$ sudo mkdir /etc/octavia/certs
$ sudo /home/ubuntu/octavia/bin/create_certificates.sh /etc/octavia/certs /home/ubuntu/octavia/etc/certificates/openssl.cnf

Create security groups

$ source octavia-openrc.sh
$ openstack security group create lb-mgmt-sec-grp
$ openstack security group rule create --protocol icmp lb-mgmt-sec-grp
$ openstack security group rule create --protocol tcp --dst-port 22 lb-mgmt-sec-grp
$ openstack security group rule create --protocol tcp --dst-port 9443 lb-mgmt-sec-grp

$ openstack security group create lb-health-mgr-sec-grp
$ openstack security group rule create --protocol udp --dst-port 5555 lb-health-mgr-sec-grp

Create a key pair for logining to the amphora instance

$ openstack keypair create --public-key ~/.ssh/id_rsa.pub mykey

Create a network

OCTAVIA_MGMT_SUBNET=172.16.0.0/12
OCTAVIA_MGMT_SUBNET_START=172.16.0.100
OCTAVIA_MGMT_SUBNET_END=172.16.31.254
OCTAVIA_MGMT_PORT_IP=172.16.0.2

openstack network create lb-mgmt-net
openstack subnet create --subnet-range $OCTAVIA_MGMT_SUBNET --allocation-pool start=$OCTAVIA_MGMT_SUBNET_START,end=$OCTAVIA_MGMT_SUBNET_END --network lb-mgmt-net lb-mgmt-subnet

SUBNET_ID=$(openstack subnet show lb-mgmt-subnet -f value -c id)
PORT_FIXED_IP="--fixed-ip subnet=$SUBNET_ID,ip-address=$OCTAVIA_MGMT_PORT_IP"

MGMT_PORT_ID=$(openstack port create --security-group lb-health-mgr-sec-grp --device-owner Octavia:health-mgr --host=$(hostname) -c id -f value --network lb-mgmt-net $PORT_FIXED_IP octavia-health-manager-listen-port)

MGMT_PORT_MAC=$(openstack port show -c mac_address -f value $MGMT_PORT_ID) 
MGMT_PORT_IP=$(openstack port show -f value -c fixed_ips $MGMT_PORT_ID | awk '{FS=",| "; gsub(",",""); gsub("'\''",""); for(i = 1; i <= NF; ++i) {if ($i ~ /^ip_address/) {n=index($i, "="); if (substr($i, n+1) ~ "\\.") print substr($i, n+1)}}}')

sudo ip link add o-hm0 type veth peer name o-bhm0
NETID=$(openstack network show lb-mgmt-net -c id -f value)
BRNAME=brq$(echo $NETID|cut -c 1-11)
sudo brctl addif $BRNAME o-bhm0
sudo ip link set o-bhm0 up
            
sudo ip link set dev o-hm0 address $MGMT_PORT_MAC
sudo iptables -I INPUT -i o-hm0 -p udp --dport 5555 -j ACCEPT
sudo dhclient -v o-hm0

Edit the /etc/octavia/octavia.conf file

[DEFAULT]
transport_url=rabbit://openstack:<password>@<controller>

[api_settings]
bind_host = 0.0.0.0
bind_port = 9876
 
[database]
connection = mysql+pymysql://octavia:<password>@<controller>/octavia

[health_manager]
event_streamer_driver = noop_event_streamer
heartbeat_key = insecure
controller_ip_port_list = 127.0.0.1:5555
bind_ip = 127.0.0.1
bind_port = 5555
 
[keystone_authtoken]
www_authenticate_uri = http://</controller><controller>:5000
auth_url = http://</controller><controller>:5000
username = octavia
password = <password>
project_name = service
project_domain_name = Default
user_domain_name = Default
auth_type = password

[certificates]
ca_certificate = /etc/octavia/certs/ca_01.pem
ca_private_key = /etc/octavia/certs/private/cakey.pem
ca_private_key_passphrase = foobar
 
[anchor]
[networking]
 
[haproxy_amphora]
bind_host = 0.0.0.0
bind_port = 9443
client_cert = /etc/octavia/certs/client.pem
server_ca = /etc/octavia/certs/ca_01.pem
base_path = /var/lib/octavia
base_cert_dir = /var/lib/octavia/certs
connection_max_retries = 1500
connection_retry_interval = 1
rest_request_conn_timeout = 10
rest_request_read_timeout = 120
 
[controller_worker]
amp_image_tag = amphora
amp_ssh_key_name = mykey
amp_secgroup_list = <lb -mgmt-sec-grp_id>
amp_boot_network_list = </lb><lb -mgmt-net_id>
amp_flavor_id = 200
network_driver = allowed_address_pairs_driver
compute_driver = compute_nova_driver
amphora_driver = amphora_haproxy_rest_driver
loadbalancer_topology = SINGLE
 
[task_flow]
 
[oslo_messaging]
rpc_thread_pool_size = 2
topic = octavia_prov
event_stream_transport_url = rabbit://openstack:<password>@<controller>
 
[house_keeping]
[amphora_agent]
[keepalived_vrrp]
 
[service_auth]
auth_url = http://</controller><controller>:5000
username = octavia
password = <password>
project_name = service
project_domain_name = Default
user_domain_name = Default
auth_type = password

Initialize the database

$ sudo octavia-db-manage upgrade head

Finalize installation

Restart the services:

$ sudo sytemctl restart octavia-api octavia-health-manager octavia-housekeeping octavia-worker

Test deployment

Add load-balancer_member role to non admin user for creating lb etc.

You need to add load-balancer_member role if non admin user wants to use loadbalancer service.

$ openstack role create load-balancer_member
$ openstack role add --user <user_id> --project <project_id> <load-balancer_member_id>

Deploy a basic HTTP load balancer using a floating IP

This is based on Deploy a basic HTTP load balancer using a floating IP

Prerequisites

$ source demo-openrc.sh
$ openstack security group create web
$ openstack security group rule create --protocol tcp --dst-port 80 web

$ openstack server create --flavor small --image bionic --nic net-id=<demo-net_id> --security-group default --security-group web --key-name mykey backend1
$ openstack server create --flavor small --image bionic --nic net-id=<demo-net_id> --security-group default --security-group web --key-name mykey backend2
$ openstack floating ip create provider
$ openstack server add floating ip backend1 <floating ip>
$ openstack floating ip create provider
$ openstack server add floating ip backend2 <floating ip>

These floating ips are just for installing apache2, not used for load balancing.

Deploy a load balancer

$ openstack loadbalancer create --name lb1 --vip-subnet-id <demo-net_name>
$ openstack loadbalancer show lb1
$ openstack loadbalancer listener create --name listener1 --protocol HTTP --protocol-port 80 lb1
$ openstack loadbalancer pool create --name pool1 --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP
$ openstack loadbalancer healthmonitor create --delay 5 --max-retries 4 --timeout 10 --type HTTP --url-path / pool1
$ openstack loadbalancer member create --subnet-id selfservice --address <backend1>  --protocol-port 80 pool1
$ openstack loadbalancer member create --subnet-id selfservice --address <backend2> --protocol-port 80 pool1
$ openstack floating ip create provider
$ openstack floating ip set --port <load_balancer_vip_port_id> <floating_ip_id>
# load_balancer_vip_port_id is vip_port_id in the output of loadbalancer show lb1
$ curl http://<floating ip>

www.hidekazuna.org

Installing OpenStack Octavia Stein release on Ubuntu 18.04 manually