Skip to content

Commit 61c0db3

Browse files
abhimanyu003abhimanyu003
authored
Merge branch 'main' into renovate/github.com-google-go-github-v55-74.x
2 parents e09c460 + df6d7fd commit 61c0db3

22 files changed

+1525
-258
lines changed

‎components/keystone/kustomization.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
33
kind: Kustomization
44

55
resources:
6+
- secret-keystone-keys.yaml
67
- keystone-mariadb-db.yaml
78
- keystone-rabbitmq-queue.yaml
89
- external-secret-keystone-sso.yaml

‎components/keystone/secret-keystone-keys.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
# Explicitly define this secret as empty so that OpenStack Helm does not
2+
# create it for us because it will put helm hook annotations on the one
3+
# it generates. This causes the secret to get re-generated by subsequent
4+
# helm runs. Specifically ArgoCD cleans up anything with a helm hook
5+
# before applying the chart again. We do not want this to go away and
6+
# instead allow other jobs to update it so it should persist.
7+
# TODO: remove after https://review.opendev.org/c/openstack/openstack-helm/+/959251 is released.
8+
---
9+
apiVersion: v1
10+
kind: Secret
11+
metadata:
12+
name: keystone-fernet-keys
13+
---
14+
apiVersion: v1
15+
kind: Secret
16+
metadata:
17+
name: keystone-credential-keys

‎components/keystone/values.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -306,6 +306,9 @@ manifests:
306306
secret_db: false
307307
secret_keystone: true
308308
service_ingress_api: false
309+
# these next two we create ourselves to avoid helm hooks issues
310+
secret_credential_keys: false
311+
secret_fernet_keys: false
309312

310313
annotations:
311314
# we need to modify the annotations on OpenStack Helm

‎components/openstack/templates/mariadb-instance.yaml.tpl‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,14 +7,16 @@ metadata:
77
# do not allow ArgoCD to delete our DB
88
argocd.argoproj.io/sync-options: Delete=false
99
spec:
10-
rootPasswordSecretKeyRef: {{ .Values.mariadb.rootPasswordSecretKeyRef | toJson }}
10+
rootPasswordSecretKeyRef:
11+
{{ toYaml .Values.mariadb.rootPasswordSecretKeyRef | indent 4 }}
1112

1213
# renovate: datasource=docker
1314
image: docker-registry1.mariadb.com/library/mariadb:11.4.4
1415
imagePullPolicy: IfNotPresent
1516

1617
port: 3306
17-
storage: {{ .Values.mariadb.storage | toJson }}
18+
storage:
19+
{{ toYaml .Values.mariadb.storage | indent 4 }}
1820
replicas: {{ .Values.mariadb.replicas }}
1921
service:
2022
type: ClusterIP

‎components/openstack/values.schema.json‎

Lines changed: 144 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,144 @@
1+
{
2+
"$schema": "http://json-schema.org/draft-07/schema#",
3+
"title": "OpenStack Helm Chart Values",
4+
"description": "Schema for OpenStack component values.yaml configuration",
5+
"type": "object",
6+
"properties": {
7+
"mariadb": {
8+
"type": "object",
9+
"description": "OpenStack mariadb instance settings",
10+
"properties": {
11+
"rootPasswordSecretKeyRef": {
12+
"type": "object",
13+
"description": "Root password settings",
14+
"properties": {
15+
"name": {
16+
"type": "string",
17+
"description": "Secret name containing the root password"
18+
},
19+
"key": {
20+
"type": "string",
21+
"description": "Key within the secret containing the password"
22+
},
23+
"generate": {
24+
"type": "boolean",
25+
"description": "Whether to generate the password if it doesn't exist"
26+
}
27+
},
28+
"required": ["name", "key"],
29+
"additionalProperties": false
30+
},
31+
"storage": {
32+
"type": "object",
33+
"description": "Storage settings",
34+
"properties": {
35+
"size": {
36+
"type": "string",
37+
"pattern": "^[0-9]+(Gi|G|Mi|M|Ki|K)$",
38+
"description": "Storage size (e.g., 10Gi)"
39+
},
40+
"resizeInUseVolumes": {
41+
"type": "boolean",
42+
"description": "Enable resizing volumes while in use"
43+
},
44+
"waitForVolumeResize": {
45+
"type": "boolean",
46+
"description": "Wait for volume resize to complete"
47+
},
48+
"volumeClaimTemplate": {
49+
"type": "object",
50+
"description": "Volume claim template configuration",
51+
"properties": {
52+
"storageClassName": {
53+
"type": "string",
54+
"description": "Storage class name for the volume"
55+
},
56+
"accessModes": {
57+
"type": "array",
58+
"items": {
59+
"type": "string",
60+
"enum": ["ReadWriteOnce", "ReadOnlyMany", "ReadWriteMany"]
61+
},
62+
"description": "Access modes for the volume"
63+
},
64+
"resources": {
65+
"type": "object",
66+
"properties": {
67+
"requests": {
68+
"type": "object",
69+
"properties": {
70+
"storage": {
71+
"type": "string",
72+
"pattern": "^[0-9]+(Gi|G|Mi|M|Ki|K)$",
73+
"description": "Storage request size"
74+
}
75+
},
76+
"additionalProperties": false
77+
}
78+
},
79+
"additionalProperties": false
80+
}
81+
},
82+
"additionalProperties": false
83+
}
84+
},
85+
"additionalProperties": false
86+
},
87+
"replicas": {
88+
"type": "integer",
89+
"minimum": 1,
90+
"description": "Number of MariaDB replicas (Galera cluster size)"
91+
}
92+
},
93+
"additionalProperties": false
94+
},
95+
"rabbitmq": {
96+
"type": "object",
97+
"description": "OpenStack RabbitMQ instance settings",
98+
"properties": {
99+
"persistence": {
100+
"type": "object",
101+
"description": "Storage persistence settings",
102+
"additionalProperties": true
103+
}
104+
},
105+
"additionalProperties": false
106+
},
107+
"extraObjects": {
108+
"type": "array",
109+
"description": "Array of extra Kubernetes manifests to deploy",
110+
"items": {
111+
"type": "object",
112+
"properties": {
113+
"apiVersion": {
114+
"type": "string",
115+
"description": "Kubernetes API version"
116+
},
117+
"kind": {
118+
"type": "string",
119+
"description": "Kubernetes resource kind"
120+
},
121+
"metadata": {
122+
"type": "object",
123+
"properties": {
124+
"name": {
125+
"type": "string"
126+
},
127+
"namespace": {
128+
"type": "string"
129+
}
130+
},
131+
"additionalProperties": true
132+
},
133+
"spec": {
134+
"type": "object",
135+
"additionalProperties": true
136+
}
137+
},
138+
"required": ["apiVersion", "kind"],
139+
"additionalProperties": true
140+
}
141+
}
142+
},
143+
"additionalProperties": false
144+
}

‎containers/nova/patches/ironic-attach-debug.patch‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
diff --git a/nova/virt/ironic/driver.py b/nova/virt/ironic/driver.py
2+
index 64ccdaa50c..cf7cc872d8 100644
3+
--- a/nova/virt/ironic/driver.py
4+
+++ b/nova/virt/ironic/driver.py
5+
@@ -2237,3 +2237,17 @@ class IronicDriver(virt_driver.ComputeDriver):
6+
"""IronicDriver manages port bindings for baremetal instances.
7+
"""
8+
return True
9+
+
10+
+ def attach_volume(self, context, connection_info, instance, mountpoint,
11+
+ disk_bus=None, device_type=None, encryption=None):
12+
+ """Attach the disk to the instance at mountpoint using info.
13+
+
14+
+ :raises TooManyDiskDevices: if the maximum allowed devices to attach
15+
+ to a single instance is exceeded.
16+
+ """
17+
+ LOG.debug("attach_volume connection_info %s", connection_info, instance=instance)
18+
+
19+
+ def detach_volume(self, context, connection_info, instance, mountpoint,
20+
+ encryption=None):
21+
+ """Detach the disk attached to the instance."""
22+
+ LOG.debug("detach_volume connection_info %s", connection_info, instance=instance)

‎containers/nova/patches/series‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
11
0001_trunk_details_metadata.patch
2+
ironic-attach-debug.patch

‎docs/deploy-guide/config-openstack.md‎

Lines changed: 171 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,171 @@
1+
# Configuring OpenStack (Shared)
2+
3+
The `openstack` component provides shared infrastructure and prerequisites for all OpenStack services in UnderStack. This includes database, messaging, and common resources needed by individual OpenStack services like Keystone, Nova, Neutron, and Ironic.
4+
5+
## Overview
6+
7+
The OpenStack component is a Helm chart that creates:
8+
9+
- **MariaDB cluster** - Primary database for OpenStack services
10+
- **RabbitMQ cluster** - Message broker for OpenStack communication
11+
- **Shared secrets and credentials** - Common authentication resources
12+
- **Kubernetes Service accounts** - Kubernetes RBAC for workflow automation
13+
- **External secret stores** - Integration with external secret management
14+
15+
## Configuration
16+
17+
Configure the OpenStack component by editing `$DEPLOY_NAME/helm-configs/openstack.yaml` in your deployment repository.
18+
19+
### MariaDB Database Configuration
20+
21+
The MariaDB cluster provides the primary database for OpenStack services:
22+
23+
```yaml
24+
mariadb:
25+
# Root password configuration
26+
rootPasswordSecretKeyRef:
27+
name: mariadb
28+
key: root-password
29+
generate: true # Auto-generate if not provided
30+
31+
# Storage configuration
32+
storage:
33+
size: 10Gi
34+
resizeInUseVolumes: true
35+
waitForVolumeResize: true
36+
volumeClaimTemplate:
37+
storageClassName: ceph-block-single
38+
accessModes:
39+
- ReadWriteOnce
40+
resources:
41+
requests:
42+
storage: 10Gi
43+
44+
# Enable Galera cluster with 3 replicas for HA
45+
replicas: 3
46+
```
47+
48+
#### Storage Considerations
49+
50+
- **Size**: Start with 10Gi minimum, scale based on your deployment size
51+
- **Storage Class**: Use your cluster's high-performance storage class
52+
- **Replicas**: 3 replicas provide high availability via Galera clustering
53+
- **Resize**: Enable volume resizing for future scaling needs
54+
55+
### RabbitMQ Message Broker Configuration
56+
57+
RabbitMQ handles inter-service communication for OpenStack:
58+
59+
```yaml
60+
rabbitmq:
61+
# Configure persistent storage for message queues
62+
persistence:
63+
enabled: true
64+
size: 8Gi
65+
storageClassName: ceph-block-single
66+
```
67+
68+
### Additional Kubernetes Resources
69+
70+
Use `extraObjects` to deploy additional Kubernetes manifests alongside the OpenStack component:
71+
72+
```yaml
73+
extraObjects:
74+
- apiVersion: external-secrets.io/v1beta1
75+
kind: ExternalSecret
76+
metadata:
77+
name: openstack-credentials
78+
spec:
79+
secretStoreRef:
80+
kind: ClusterSecretStore
81+
name: vault-backend
82+
target:
83+
name: openstack-admin-credentials
84+
dataFrom:
85+
- extract:
86+
key: openstack/admin
87+
```
88+
89+
## Integration with OpenStack Services
90+
91+
Individual OpenStack services (Keystone, Nova, Neutron, etc.) depend on resources created by this component:
92+
93+
- **Database**: Each service gets dedicated MariaDB databases
94+
- **Messaging**: Services connect to the shared RabbitMQ cluster
95+
- **Secrets**: Common credentials are managed centrally
96+
- **Kubernetes Service Accounts**: Argo Workflows automation uses shared service accounts
97+
98+
## Security Considerations
99+
100+
### Secret Management
101+
102+
- Use External Secrets Operator for production deployments
103+
- Rotate database and RabbitMQ credentials regularly
104+
- Ensure proper RBAC for service accounts
105+
106+
### Network Security
107+
108+
- Configure network policies to restrict inter-pod communication
109+
- Use TLS for all database and message broker connections
110+
- Isolate OpenStack traffic using Kubernetes namespaces
111+
112+
## Monitoring and Observability
113+
114+
The OpenStack component integrates with cluster monitoring:
115+
116+
```yaml
117+
# Enable monitoring for MariaDB
118+
mariadb:
119+
metrics:
120+
enabled: true
121+
serviceMonitor:
122+
enabled: true
123+
124+
# Enable monitoring for RabbitMQ
125+
rabbitmq:
126+
metrics:
127+
enabled: true
128+
serviceMonitor:
129+
enabled: true
130+
```
131+
132+
## Troubleshooting
133+
134+
### Database Connection Issues
135+
136+
If OpenStack services can't connect to MariaDB:
137+
138+
1. Check MariaDB pod status: `kubectl get pods -l app=mariadb`
139+
2. Verify service endpoints: `kubectl get endpoints mariadb`
140+
3. Test connectivity from a service pod: `kubectl exec -it <pod> -- mysql -h mariadb -u root -p`
141+
142+
### Message Queue Problems
143+
144+
For RabbitMQ connectivity issues:
145+
146+
1. Check RabbitMQ cluster status: `kubectl exec -it rabbitmq-0 -- rabbitmqctl cluster_status`
147+
2. Verify queue status: `kubectl exec -it rabbitmq-0 -- rabbitmqctl list_queues`
148+
3. Check service connectivity: `kubectl get svc rabbitmq`
149+
150+
### Resource Scaling
151+
152+
To scale the database cluster:
153+
154+
```yaml
155+
mariadb:
156+
replicas: 5 # Scale to 5 nodes
157+
storage:
158+
size: 50Gi # Increase storage per node
159+
```
160+
161+
Apply changes and monitor the scaling process:
162+
163+
```bash
164+
kubectl get pods -l app=mariadb -w
165+
```
166+
167+
## Related Documentation
168+
169+
- [Component Configuration](./component-config.md) - General component configuration patterns
170+
- [Override OpenStack Service Config](./override-openstack-svc-config.md) - Service-specific configuration overrides
171+
- [Deploy Repo](./deploy-repo.md) - Deployment repository structure

0 commit comments

Comments
 (0)