juju deploy cs:octavia
OpenStack network load balancing Read more
Discuss this charm
Share your thoughts on this charm with the community on discourse.
This charm provides the Octavia load balancer service for an OpenStack Cloud.
OpenStack Rocky or later is required.
Octavia and the Octavia charm relies on services from a fully functional OpenStack Cloud and expects to be able to consume images from glance, create networks in Neutron, consume certificate secrets from Barbican (preferably utilizing a Vault backend) and spin up instances with Nova.
After the deployment is complete and has settled, you must run the
configure-resources action on the lead unit. This will prompt it to configure
required resources in the deployed cloud for Octavia to operate. You must also
configure certificates for internal communication between the controller and
its load balancer instances.
Excerpt from the upstream operator maintenance guide:
Octavia secures the communication between the amphora agent and the control plane with two-way SSL encryption. To accomplish that, several certificates are distributed in the system:
- Control plane:
- Amphora certificate authority (CA) certificate: Used to validate amphora certificates if Octavia acts as a Certificate Authority to issue new amphora certificates
- Client certificate: Used to authenticate with the amphora
- Client CA certificate: Used to validate control plane client certificate
- Amphora certificate: Presented to control plane processes to prove amphora identity.
The charm represents this with the following mandatory configuration options:
You must issue/request certificates that meets your organizations requirements.
Note: It is important not to use the same CA certificate for both
lb-mgmt-controller-cacertconfiguration options. Failing to keep them separate may lead to abuse of certificate data to gain access to other
Amphorainstances in the event one of them is compromised.
To get you started we include an example of generating your own certificates:
mkdir -p demoCA/newcerts touch demoCA/index.txt touch demoCA/index.txt.attr openssl genrsa -passout pass:foobar -des3 -out issuing_ca_key.pem 2048 openssl req -x509 -passin pass:foobar -new -nodes -key issuing_ca_key.pem \ -config /etc/ssl/openssl.cnf \ -subj "/C=US/ST=Somestate/O=Org/CN=www.example.com" \ -days 30 \ -out issuing_ca.pem openssl genrsa -passout pass:foobar -des3 -out controller_ca_key.pem 2048 openssl req -x509 -passin pass:foobar -new -nodes \ -key controller_ca_key.pem \ -config /etc/ssl/openssl.cnf \ -subj "/C=US/ST=Somestate/O=Org/CN=www.example.com" \ -days 30 \ -out controller_ca.pem openssl req \ -newkey rsa:2048 -nodes -keyout controller_key.pem \ -subj "/C=US/ST=Somestate/O=Org/CN=www.example.com" \ -out controller.csr openssl ca -passin pass:foobar -config /etc/ssl/openssl.cnf \ -cert controller_ca.pem -keyfile controller_ca_key.pem \ -create_serial -batch \ -in controller.csr -days 30 -out controller_cert.pem cat controller_cert.pem controller_key.pem > controller_cert_bundle.pem
To apply the configuration execute:
juju config octavia \ lb-mgmt-issuing-cacert="$(base64 controller_ca.pem)" \ lb-mgmt-issuing-ca-private-key="$(base64 controller_ca_key.pem)" \ lb-mgmt-issuing-ca-key-passphrase=foobar \ lb-mgmt-controller-cacert="$(base64 controller_ca.pem)" \ lb-mgmt-controller-cert="$(base64 controller_cert_bundle.pem)"
Optional resource configuration
By executing the
configure-resources action the charm will create the
resources required for operation of the Octavia service. If you want to manage
these resources yourself you must set the
option to False.
You can at any time use the
configure-resources action to prompt immediate
To let the charm discover the resources and apply the appropriate configuration to Octavia, you must use Neutron resource tags.
The UUID of the Nova flavor you want to use must be set with the
custom-amp-flavor-id configuration option.
|Neutron Network||charm-octavia||Management network|
|Neutron Subnet||charm-octavia||Management network subnet|
|Neutron Router||charm-octavia||(Optional) Router for IPv6 RA or north/south mgmt traffic|
|Amphora Security Group||charm-octavia||Security group for Amphora ports|
|Controller Security Group||charm-octavia-health||Security group for Controller ports|
Policy overrides is an advanced feature that allows an operator to override the default policy of an OpenStack service. The policies that the service supports, the defaults it implements in its code, and the defaults that a charm may include should all be clearly understood before proceeding.
Caution: It is possible to break the system (for tenants and other services) if policies are incorrectly applied to the service.
Policy statements are placed in a YAML file. This file (or files) is then (ZIP) compressed into a single file and used as an application resource. The override is then enabled via a Boolean charm option.
Here are the essential commands (filenames are arbitrary):
zip overrides.zip override-file.yaml juju attach-resource octavia policyd-override=overrides.zip juju config octavia use-policyd-override=true
Please report bugs on Launchpad.
For general charm questions refer to the OpenStack Charm Guide.