Skip to content

Commit d0ae8d7

Browse files
cardoecardoe
committed
chore(openstack): create schema and document configuration
Created a schema for the current chart and validated samples we have against it. Updated a few fields from JSON to YAML to make it consistent and let my validation test pass. Symlink the schema so that it is able to be fetched. Added documentation around how to configure this part of a deployment.
1 parent f945588 commit d0ae8d7

File tree

5 files changed

+321
-2
lines changed

5 files changed

+321
-2
lines changed

‎components/openstack/templates/mariadb-instance.yaml.tpl‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,14 +7,16 @@ metadata:
77
# do not allow ArgoCD to delete our DB
88
argocd.argoproj.io/sync-options: Delete=false
99
spec:
10-
rootPasswordSecretKeyRef: {{ .Values.mariadb.rootPasswordSecretKeyRef | toJson }}
10+
rootPasswordSecretKeyRef:
11+
{{ toYaml .Values.mariadb.rootPasswordSecretKeyRef | indent 4 }}
1112

1213
# renovate: datasource=docker
1314
image: docker-registry1.mariadb.com/library/mariadb:11.4.4
1415
imagePullPolicy: IfNotPresent
1516

1617
port: 3306
17-
storage: {{ .Values.mariadb.storage | toJson }}
18+
storage:
19+
{{ toYaml .Values.mariadb.storage | indent 4 }}
1820
replicas: {{ .Values.mariadb.replicas }}
1921
service:
2022
type: ClusterIP

‎components/openstack/values.schema.json‎

Lines changed: 144 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,144 @@
1+
{
2+
"$schema": "http://json-schema.org/draft-07/schema#",
3+
"title": "OpenStack Helm Chart Values",
4+
"description": "Schema for OpenStack component values.yaml configuration",
5+
"type": "object",
6+
"properties": {
7+
"mariadb": {
8+
"type": "object",
9+
"description": "OpenStack mariadb instance settings",
10+
"properties": {
11+
"rootPasswordSecretKeyRef": {
12+
"type": "object",
13+
"description": "Root password settings",
14+
"properties": {
15+
"name": {
16+
"type": "string",
17+
"description": "Secret name containing the root password"
18+
},
19+
"key": {
20+
"type": "string",
21+
"description": "Key within the secret containing the password"
22+
},
23+
"generate": {
24+
"type": "boolean",
25+
"description": "Whether to generate the password if it doesn't exist"
26+
}
27+
},
28+
"required": ["name", "key"],
29+
"additionalProperties": false
30+
},
31+
"storage": {
32+
"type": "object",
33+
"description": "Storage settings",
34+
"properties": {
35+
"size": {
36+
"type": "string",
37+
"pattern": "^[0-9]+(Gi|G|Mi|M|Ki|K)$",
38+
"description": "Storage size (e.g., 10Gi)"
39+
},
40+
"resizeInUseVolumes": {
41+
"type": "boolean",
42+
"description": "Enable resizing volumes while in use"
43+
},
44+
"waitForVolumeResize": {
45+
"type": "boolean",
46+
"description": "Wait for volume resize to complete"
47+
},
48+
"volumeClaimTemplate": {
49+
"type": "object",
50+
"description": "Volume claim template configuration",
51+
"properties": {
52+
"storageClassName": {
53+
"type": "string",
54+
"description": "Storage class name for the volume"
55+
},
56+
"accessModes": {
57+
"type": "array",
58+
"items": {
59+
"type": "string",
60+
"enum": ["ReadWriteOnce", "ReadOnlyMany", "ReadWriteMany"]
61+
},
62+
"description": "Access modes for the volume"
63+
},
64+
"resources": {
65+
"type": "object",
66+
"properties": {
67+
"requests": {
68+
"type": "object",
69+
"properties": {
70+
"storage": {
71+
"type": "string",
72+
"pattern": "^[0-9]+(Gi|G|Mi|M|Ki|K)$",
73+
"description": "Storage request size"
74+
}
75+
},
76+
"additionalProperties": false
77+
}
78+
},
79+
"additionalProperties": false
80+
}
81+
},
82+
"additionalProperties": false
83+
}
84+
},
85+
"additionalProperties": false
86+
},
87+
"replicas": {
88+
"type": "integer",
89+
"minimum": 1,
90+
"description": "Number of MariaDB replicas (Galera cluster size)"
91+
}
92+
},
93+
"additionalProperties": false
94+
},
95+
"rabbitmq": {
96+
"type": "object",
97+
"description": "OpenStack RabbitMQ instance settings",
98+
"properties": {
99+
"persistence": {
100+
"type": "object",
101+
"description": "Storage persistence settings",
102+
"additionalProperties": true
103+
}
104+
},
105+
"additionalProperties": false
106+
},
107+
"extraObjects": {
108+
"type": "array",
109+
"description": "Array of extra Kubernetes manifests to deploy",
110+
"items": {
111+
"type": "object",
112+
"properties": {
113+
"apiVersion": {
114+
"type": "string",
115+
"description": "Kubernetes API version"
116+
},
117+
"kind": {
118+
"type": "string",
119+
"description": "Kubernetes resource kind"
120+
},
121+
"metadata": {
122+
"type": "object",
123+
"properties": {
124+
"name": {
125+
"type": "string"
126+
},
127+
"namespace": {
128+
"type": "string"
129+
}
130+
},
131+
"additionalProperties": true
132+
},
133+
"spec": {
134+
"type": "object",
135+
"additionalProperties": true
136+
}
137+
},
138+
"required": ["apiVersion", "kind"],
139+
"additionalProperties": true
140+
}
141+
}
142+
},
143+
"additionalProperties": false
144+
}

‎docs/deploy-guide/config-openstack.md‎

Lines changed: 171 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,171 @@
1+
# Configuring OpenStack (Shared)
2+
3+
The `openstack` component provides shared infrastructure and prerequisites for all OpenStack services in UnderStack. This includes database, messaging, and common resources needed by individual OpenStack services like Keystone, Nova, Neutron, and Ironic.
4+
5+
## Overview
6+
7+
The OpenStack component is a Helm chart that creates:
8+
9+
- **MariaDB cluster** - Primary database for OpenStack services
10+
- **RabbitMQ cluster** - Message broker for OpenStack communication
11+
- **Shared secrets and credentials** - Common authentication resources
12+
- **Kubernetes Service accounts** - Kubernetes RBAC for workflow automation
13+
- **External secret stores** - Integration with external secret management
14+
15+
## Configuration
16+
17+
Configure the OpenStack component by editing `$DEPLOY_NAME/helm-configs/openstack.yaml` in your deployment repository.
18+
19+
### MariaDB Database Configuration
20+
21+
The MariaDB cluster provides the primary database for OpenStack services:
22+
23+
```yaml
24+
mariadb:
25+
# Root password configuration
26+
rootPasswordSecretKeyRef:
27+
name: mariadb
28+
key: root-password
29+
generate: true # Auto-generate if not provided
30+
31+
# Storage configuration
32+
storage:
33+
size: 10Gi
34+
resizeInUseVolumes: true
35+
waitForVolumeResize: true
36+
volumeClaimTemplate:
37+
storageClassName: ceph-block-single
38+
accessModes:
39+
- ReadWriteOnce
40+
resources:
41+
requests:
42+
storage: 10Gi
43+
44+
# Enable Galera cluster with 3 replicas for HA
45+
replicas: 3
46+
```
47+
48+
#### Storage Considerations
49+
50+
- **Size**: Start with 10Gi minimum, scale based on your deployment size
51+
- **Storage Class**: Use your cluster's high-performance storage class
52+
- **Replicas**: 3 replicas provide high availability via Galera clustering
53+
- **Resize**: Enable volume resizing for future scaling needs
54+
55+
### RabbitMQ Message Broker Configuration
56+
57+
RabbitMQ handles inter-service communication for OpenStack:
58+
59+
```yaml
60+
rabbitmq:
61+
# Configure persistent storage for message queues
62+
persistence:
63+
enabled: true
64+
size: 8Gi
65+
storageClassName: ceph-block-single
66+
```
67+
68+
### Additional Kubernetes Resources
69+
70+
Use `extraObjects` to deploy additional Kubernetes manifests alongside the OpenStack component:
71+
72+
```yaml
73+
extraObjects:
74+
- apiVersion: external-secrets.io/v1beta1
75+
kind: ExternalSecret
76+
metadata:
77+
name: openstack-credentials
78+
spec:
79+
secretStoreRef:
80+
kind: ClusterSecretStore
81+
name: vault-backend
82+
target:
83+
name: openstack-admin-credentials
84+
dataFrom:
85+
- extract:
86+
key: openstack/admin
87+
```
88+
89+
## Integration with OpenStack Services
90+
91+
Individual OpenStack services (Keystone, Nova, Neutron, etc.) depend on resources created by this component:
92+
93+
- **Database**: Each service gets dedicated MariaDB databases
94+
- **Messaging**: Services connect to the shared RabbitMQ cluster
95+
- **Secrets**: Common credentials are managed centrally
96+
- **Kubernetes Service Accounts**: Argo Workflows automation uses shared service accounts
97+
98+
## Security Considerations
99+
100+
### Secret Management
101+
102+
- Use External Secrets Operator for production deployments
103+
- Rotate database and RabbitMQ credentials regularly
104+
- Ensure proper RBAC for service accounts
105+
106+
### Network Security
107+
108+
- Configure network policies to restrict inter-pod communication
109+
- Use TLS for all database and message broker connections
110+
- Isolate OpenStack traffic using Kubernetes namespaces
111+
112+
## Monitoring and Observability
113+
114+
The OpenStack component integrates with cluster monitoring:
115+
116+
```yaml
117+
# Enable monitoring for MariaDB
118+
mariadb:
119+
metrics:
120+
enabled: true
121+
serviceMonitor:
122+
enabled: true
123+
124+
# Enable monitoring for RabbitMQ
125+
rabbitmq:
126+
metrics:
127+
enabled: true
128+
serviceMonitor:
129+
enabled: true
130+
```
131+
132+
## Troubleshooting
133+
134+
### Database Connection Issues
135+
136+
If OpenStack services can't connect to MariaDB:
137+
138+
1. Check MariaDB pod status: `kubectl get pods -l app=mariadb`
139+
2. Verify service endpoints: `kubectl get endpoints mariadb`
140+
3. Test connectivity from a service pod: `kubectl exec -it <pod> -- mysql -h mariadb -u root -p`
141+
142+
### Message Queue Problems
143+
144+
For RabbitMQ connectivity issues:
145+
146+
1. Check RabbitMQ cluster status: `kubectl exec -it rabbitmq-0 -- rabbitmqctl cluster_status`
147+
2. Verify queue status: `kubectl exec -it rabbitmq-0 -- rabbitmqctl list_queues`
148+
3. Check service connectivity: `kubectl get svc rabbitmq`
149+
150+
### Resource Scaling
151+
152+
To scale the database cluster:
153+
154+
```yaml
155+
mariadb:
156+
replicas: 5 # Scale to 5 nodes
157+
storage:
158+
size: 50Gi # Increase storage per node
159+
```
160+
161+
Apply changes and monitor the scaling process:
162+
163+
```bash
164+
kubectl get pods -l app=mariadb -w
165+
```
166+
167+
## Related Documentation
168+
169+
- [Component Configuration](./component-config.md) - General component configuration patterns
170+
- [Override OpenStack Service Config](./override-openstack-svc-config.md) - Service-specific configuration overrides
171+
- [Deploy Repo](./deploy-repo.md) - Deployment repository structure

‎docs/schema/component-openstack.schema.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../../components/openstack/values.schema.json

‎mkdocs.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -130,6 +130,7 @@ nav:
130130
- deploy-guide/deploy-repo.md
131131
- deploy-guide/component-config.md
132132
- deploy-guide/config-dex.md
133+
- deploy-guide/config-openstack.md
133134
- deploy-guide/auth.md
134135
- deploy-guide/config-argo-workflows.md
135136
- Starting the Deployment:

0 commit comments

Comments
 (0)