Skip to content

Commit 9a99428

Browse files
cardoecardoe
authored
Merge pull request #813 from rackerlabs/PUC-851-20250331
feat: Adds OpenStack Octavia load balancers
2 parents 97a9fff + 6bed2a1 commit 9a99428

File tree

11 files changed

+306
-2
lines changed

11 files changed

+306
-2
lines changed

‎.github/workflows/containers.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ jobs:
3333
strategy:
3434
matrix:
3535
# if you add a container here, add it to the 'clean_containers' job below
36-
project: [ironic, neutron, keystone, nova, openstack-client, cinder]
36+
project: [ironic, neutron, keystone, nova, openstack-client, cinder, octavia]
3737

3838
steps:
3939
- name: setup docker buildx
@@ -182,6 +182,7 @@ jobs:
182182
- neutron
183183
- keystone
184184
- nova
185+
- octavia
185186
- openstack-client
186187
- dnsmasq
187188
- ironic-nautobot-client

‎apps/openstack/octavia.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
component: octavia
3+
repoURL: https://tarballs.opendev.org/openstack/openstack-helm
4+
chartVersion: 2025.1.12+80041dfbb

‎components/images-openstack.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,4 +101,12 @@ images:
101101
cinder_backup: "ghcr.io/rackerlabs/understack/cinder:2024.2-ubuntu_jammy"
102102
cinder_storage_init: "docker.io/openstackhelm/ceph-config-helper:latest-ubuntu_jammy"
103103
cinder_backup_storage_init: "docker.io/openstackhelm/ceph-config-helper:latest-ubuntu_jammy"
104+
105+
# octavia
106+
octavia_api: "ghcr.io/rackerlabs/understack/octavia:2024.2-ubuntu_jammy"
107+
octavia_db_sync: "ghcr.io/rackerlabs/understack/octavia:2024.2-ubuntu_jammy"
108+
octavia_worker: "ghcr.io/rackerlabs/understack/octavia:2024.2-ubuntu_jammy"
109+
octavia_housekeeping: "ghcr.io/rackerlabs/understack/octavia:2024.2-ubuntu_jammy"
110+
octavia_health_manager: "ghcr.io/rackerlabs/understack/octavia:2024.2-ubuntu_jammy"
111+
octavia_health_manager_init: "docker.io/openstackhelm/heat:2024.2-ubuntu_jammy"
104112
...

‎components/octavia/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
# OpenStack Octavia Load Balancers

‎components/octavia/kustomization.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
---
2+
apiVersion: kustomize.config.k8s.io/v1beta1
3+
kind: Kustomization
4+
5+
resources:
6+
- octavia-rabbitmq-queue.yaml
7+
- octavia-mariadb-db.yaml

‎components/octavia/octavia-mariadb-db.yaml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
---
2+
apiVersion: k8s.mariadb.com/v1alpha1
3+
kind: Database
4+
metadata:
5+
name: octavia
6+
namespace: openstack
7+
spec:
8+
# If you want the database to be created with a different name than the resource name
9+
# name: data-custom
10+
mariaDbRef:
11+
name: mariadb # name of the MariaDB kind
12+
waitForIt: true
13+
characterSet: utf8
14+
collate: utf8_general_ci
15+
retryInterval: 5s
16+
---
17+
apiVersion: k8s.mariadb.com/v1alpha1
18+
kind: User
19+
metadata:
20+
name: octavia
21+
namespace: openstack
22+
spec:
23+
# If you want the user to be created with a different name than the resource name
24+
# name: user-custom
25+
mariaDbRef:
26+
name: mariadb # name of the MariaDB kind
27+
waitForIt: true
28+
passwordSecretKeyRef:
29+
name: octavia-db-password
30+
key: password
31+
# This field is immutable and defaults to 10, 0 means unlimited.
32+
maxUserConnections: 0
33+
host: "%"
34+
retryInterval: 5s
35+
---
36+
apiVersion: k8s.mariadb.com/v1alpha1
37+
kind: Grant
38+
metadata:
39+
name: octavia-grant
40+
namespace: openstack
41+
spec:
42+
mariaDbRef:
43+
name: mariadb # name of the MariaDB kind
44+
waitForIt: true
45+
privileges:
46+
- "ALL"
47+
database: "octavia"
48+
table: "*"
49+
username: octavia
50+
grantOption: true
51+
host: "%"
52+
retryInterval: 5s

‎components/octavia/octavia-rabbitmq-queue.yaml‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
---
2+
apiVersion: rabbitmq.com/v1beta1
3+
kind: User
4+
metadata:
5+
name: octavia
6+
namespace: openstack
7+
spec:
8+
tags:
9+
- management # available tags are 'management', 'policymaker', 'monitoring' and 'administrator'
10+
- policymaker
11+
rabbitmqClusterReference:
12+
name: rabbitmq # rabbitmqCluster must exist in the same namespace as this resource
13+
namespace: openstack
14+
importCredentialsSecret:
15+
name: octavia-rabbitmq-password
16+
---
17+
apiVersion: rabbitmq.com/v1beta1
18+
kind: Vhost
19+
metadata:
20+
name: octavia-vhost
21+
namespace: openstack
22+
spec:
23+
name: "octavia" # vhost name; required and cannot be updated
24+
defaultQueueType: quorum # default queue type for this vhost; require RabbitMQ version 3.11.12 or above
25+
rabbitmqClusterReference:
26+
name: rabbitmq # rabbitmqCluster must exist in the same namespace as this resource
27+
namespace: openstack
28+
---
29+
apiVersion: rabbitmq.com/v1beta1
30+
kind: Queue
31+
metadata:
32+
name: octavia-queue
33+
namespace: openstack
34+
spec:
35+
name: octavia-qq # name of the queue
36+
vhost: "octavia" # default to '/' if not provided
37+
type: quorum # without providing a queue type, rabbitmq creates a classic queue
38+
autoDelete: false
39+
durable: true # setting 'durable' to false means this queue won't survive a server restart
40+
rabbitmqClusterReference:
41+
name: rabbitmq # rabbitmqCluster must exist in the same namespace as this resource
42+
namespace: openstack
43+
---
44+
apiVersion: rabbitmq.com/v1beta1
45+
kind: Permission
46+
metadata:
47+
name: octavia-permission
48+
namespace: openstack
49+
spec:
50+
vhost: "octavia" # name of a vhost
51+
userReference:
52+
name: "octavia" # name of a user.rabbitmq.com in the same namespace; must specify either spec.userReference or spec.user
53+
permissions:
54+
write: ".*"
55+
configure: ".*"
56+
read: ".*"
57+
rabbitmqClusterReference:
58+
name: rabbitmq # rabbitmqCluster must exist in the same namespace as this resource
59+
namespace: openstack
60+
---
61+
apiVersion: rabbitmq.com/v1beta1
62+
kind: Policy
63+
metadata:
64+
name: octavia-notifications-ttl
65+
namespace: openstack
66+
spec:
67+
name: octavia-notifications-ttl # name of the policy
68+
vhost: "octavia" # default to '/' if not provided
69+
pattern: "^notifications.*" # regex used to match queues and exchanges
70+
applyTo: "queues" # set to 'queues', 'exchanges', or 'all'
71+
priority: 1 # defaults to 0
72+
definition: # policy definition
73+
message-ttl: 86400000
74+
rabbitmqClusterReference:
75+
name: rabbitmq # rabbitmqCluster must exist in the same namespace as this resource
76+
namespace: openstack

‎components/octavia/values.yaml‎

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
---
2+
3+
# typically overridden by environmental
4+
# values, but should include all endpoints
5+
# required by this chart
6+
endpoints:
7+
oslo_messaging:
8+
statefulset:
9+
replicas: 3
10+
name: rabbitmq-server
11+
hosts:
12+
default: rabbitmq-nodes
13+
load_balancer:
14+
port:
15+
api:
16+
public: 443
17+
scheme:
18+
public: https
19+
host_fqdn_override:
20+
public:
21+
tls:
22+
secretName: octavia-tls-public
23+
issuerRef:
24+
name: understack-cluster-issuer
25+
kind: ClusterIssuer
26+
27+
network:
28+
# configure OpenStack Helm to use Undercloud's ingress
29+
# instead of expecting the ingress controller provided
30+
# by OpenStack Helm
31+
use_external_ingress_controller: true
32+
api:
33+
ingress:
34+
annotations:
35+
nginx.ingress.kubernetes.io/rewrite-target: /
36+
# set our default issuer
37+
cert-manager.io/cluster-issuer: understack-cluster-issuer
38+
external_policy_local: false
39+
node_port:
40+
enabled: false
41+
42+
conf:
43+
octavia:
44+
api_settings:
45+
enabled_provider_drivers: >-
46+
ovn: "The Octavia OVN driver",
47+
default_provider_driver: ovn
48+
driver_agent:
49+
enabled_provider_agents: ovn
50+
ovn:
51+
ovn_nb_connection: tcp:ovn-ovsdb-nb.openstack.svc.cluster.local:6641
52+
ovn_sb_connection: tcp:ovn-ovsdb-sb.openstack.svc.cluster.local:6642
53+
54+
dependencies:
55+
dynamic:
56+
common:
57+
local_image_registry:
58+
jobs: null
59+
static:
60+
api:
61+
jobs:
62+
- octavia-db-sync
63+
- octavia-ks-user
64+
- octavia-ks-endpoints
65+
worker:
66+
jobs:
67+
- octavia-db-sync
68+
- octavia-ks-user
69+
- octavia-ks-endpoints
70+
housekeeping:
71+
jobs:
72+
- octavia-db-sync
73+
- octavia-ks-user
74+
- octavia-ks-endpoints
75+
health_manager:
76+
jobs:
77+
- octavia-db-sync
78+
- octavia-ks-user
79+
- octavia-ks-endpoints
80+
db_sync:
81+
jobs:
82+
83+
manifests:
84+
job_db_init: false
85+
job_rabbit_init: false
86+
pod_rally_test: false
87+
secret_db: true
88+
secret_keystone: true
89+
service_ingress_api: false
90+
91+
# we don't want to enable OpenStack Helm's
92+
# helm.sh/hooks because they set them as
93+
# post-install,post-upgrade which in ArgoCD
94+
# maps to PostSync. However the deployments
95+
# and statefulsets in OpenStack Helm
96+
# depend on the jobs to complete to become
97+
# healthy. Which they cannot because they are in
98+
# the post step and not in the main step.
99+
# Turning this on results in the keys jobs
100+
# editing the annotation which deletes the item
101+
# and wipes our keys.
102+
helm3_hook: false
103+
104+
annotations:
105+
job:
106+
octavia_db_sync:
107+
argocd.argoproj.io/hook: Sync
108+
argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
109+
argocd.argoproj.io/sync-options: Replace=true
110+
octavia_ks_service:
111+
argocd.argoproj.io/hook: Sync
112+
argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
113+
argocd.argoproj.io/sync-options: Replace=true
114+
octavia_ks_user:
115+
argocd.argoproj.io/hook: Sync
116+
argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
117+
argocd.argoproj.io/sync-options: Replace=true
118+
octavia_ks_endpoints:
119+
argocd.argoproj.io/hook: Sync
120+
argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
121+
argocd.argoproj.io/sync-options: Replace=true
122+
octavia_bootstrap:
123+
argocd.argoproj.io/hook: Sync
124+
argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
125+
argocd.argoproj.io/sync-options: Replace=true

‎components/openstack-secrets.tpl.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,9 @@ endpoints:
3131
# this user is the service account that cinder uses
3232
cinder:
3333
password: "${CINDER_KEYSTONE_PASSWORD}"
34+
# this user is the service account that octavia uses
35+
octavia:
36+
password: "${OCTAVIA_KEYSTONE_PASSWORD}"
3437

3538
# set our public facing URL
3639
host_fqdn_override:
@@ -70,6 +73,9 @@ endpoints:
7073
# this is what the cinder service uses to connect to MariaDB
7174
cinder:
7275
password: "${CINDER_DB_PASSWORD}"
76+
# this is what the octavia service uses to connect to MariaDB
77+
octavia:
78+
password: "${OCTAVIA_DB_PASSWORD}"
7379

7480
# 'oslo_db_api' is for MariaDB specific for nova
7581
oslo_db_api:
@@ -104,6 +110,9 @@ endpoints:
104110
# this is what the cinder service uses to connect to RabbitMQ
105111
cinder:
106112
password: "${CINDER_RABBITMQ_PASSWORD}"
113+
# this is what the octavia service uses to connect to RabbitMQ
114+
octavia:
115+
password: "${OCTAVIA_RABBITMQ_PASSWORD}"
107116

108117
# 'baremetal' is the ironic service
109118
baremetal:
@@ -153,4 +162,10 @@ endpoints:
153162
host_fqdn_override:
154163
public:
155164
host: cinder.${DNS_ZONE}
165+
# 'octavia' is the load balancer service
166+
load_balancer:
167+
# set our public facing URL
168+
host_fqdn_override:
169+
public:
170+
host: octavia.${DNS_ZONE}
156171
...

‎containers/octavia/Dockerfile‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# syntax=docker/dockerfile:1
2+
3+
ARG OPENSTACK_VERSION="required_argument"
4+
FROM quay.io/airshipit/octavia:${OPENSTACK_VERSION}-ubuntu_jammy
5+
6+
RUN apt-get update && \
7+
apt-get install -y --no-install-recommends \
8+
patch \
9+
quilt \
10+
libunbound-dev \
11+
libunwind-dev \
12+
python3-unbound \
13+
&& apt-get clean && rm -rf /var/lib/apt/lists/*
14+
15+
RUN pip install -U ovn-octavia-provider ovsdbapp

0 commit comments

Comments
 (0)