OpenShift on Red Hat OpenStack Platform
The Red Hat OpenStack Platform delivers an integrated foundation to create, deploy, and scale a secure and reliable private OpenStack cloud.
OSP is an infrastructure-as-a-service (IaaS) cloud implemented by a collection of control services that manage compute, storage, and networking resources. The environment is managed using a web-based interface that allows administrators and users to control, provision, and automate OpenStack resources. Additionally, the OpenStack infrastructure is facilitated through an extensive command line interface and API enabling full automation capabilities for administrators and end-users.
The OpenStack project is a rapidly developed community project that provides updated releases every six months. Initially Red Hat OpenStack Platform kept pace with this release cycle by publishing a new release along with every upstream release and providing long term support for every third release. Recently, with the OSP 16.0 release (based on OpenStack Train), Red Hat has chosen not to keep pace with release numbers but instead has backported new features into sub-releases. The most recent release is Red Hat OpenStack Platform 16.1, which includes backported advanced features from the Ussuri and Victoria releases upstream.
For more information about OSP see the Red Hat OpenStack Platform website.
OpenStack services
OpenStack Platform services are deployed as containers, which isolates services from one another and enables easy upgrades. The OpenStack Platform uses a set of containers built and managed with Kolla. The deployment of services is performed by pulling container images from the Red Hat Custom Portal. These service containers are managed using the Podman command and are deployed, configured, and maintained with Red Hat OpenStack Director.
Service | Project name | Description |
---|---|---|
Dashboard |
Horizon |
Web browser-based dashboard that you use to manage OpenStack services. |
Identity |
Keystone |
Centralized service for authentication and authorization of OpenStack services and for managing users, projects, and roles. |
OpenStack networking |
Neutron |
Provides connectivity between the interfaces of OpenStack services. |
Block storage |
Cinder |
Manages persistent block storage volumes for virtual machines (VMs). |
Compute |
Nova |
Manages and provisions VMs running on compute nodes. |
Image |
Glance |
Registry service used to store resources such as VM images and volume snapshots. |
Object storage |
Swift |
Allows users to storage and retrieve files and arbitrary data. |
Telemetry |
Ceilometer |
Provides measurements of use of cloud resources. |
Orchestration |
Heat |
Template-based orchestration engine that supports automatic creation of resource stacks. |
Network design
The Red Hat OpenShift with NetApp solution uses two data switches to provide primary data connectivity at 25Gbps. It also uses two additional management switches that provide connectivity at 1Gbps for in-band management for the storage nodes and out-of-band management for IPMI functionality.
IPMI functionality is required by Red Hat OpenStack Director to deploy Red Hat OpenStack Platform using the Ironic bare-metal provision service.
VLAN requirements
Red Hat OpenShift with NetApp is designed to logically separate network traffic for different purposes by using virtual local area networks (VLANs). This configuration can be scaled to meet customer demands or to provide further isolation for specific network services. The following table lists the VLANs that are required to implement the solution while validating the solution at NetApp.
VLANs | Purpose | VLAN ID |
---|---|---|
Out-of-band management network |
Network used for management of physical nodes and IPMI service for Ironic. |
16 |
Storage infrastructure |
Network used for controller nodes to map volumes directly to support infrastructure services like Swift. |
201 |
Storage Cinder |
Network used to map and attach block volumes directly to virtual instances deployed in the environment. |
202 |
Internal API |
Network used for communication between the OpenStack services using API communication, RPC messages, and database communication. |
301 |
Tenant |
Neutron provides each tenant with their own networks via tunneling through VXLAN. Network traffic is isolated within each tenant network. Each tenant network has an IP subnet associated with it, and network namespaces mean that multiple tenant networks can use the same address range without causing conflicts. |
302 |
Storage management |
OpenStack Object Storage (Swift) uses this network to synchronize data objects between participating replica nodes. The proxy service acts as the intermediary interface between user requests and the underlying storage layer. The proxy receives incoming requests and locates the necessary replica to retrieve the requested data. |
303 |
PXE |
The OpenStack Director provides PXE boot as a part of the Ironic bare metal provisioning service to orchestrate the installation of the OSP Overcloud. |
3484 |
External |
Publicly available network which hosts the OpenStack Dashboard (Horizon) for graphical management and allows for public API calls to manage OpenStack services. |
3485 |
In-band management network |
Provides access for system administration functions such as SSH access, DNS traffic, and Network Time Protocol (NTP) traffic. This network also acts as a gateway for non-controller nodes. |
3486 |
Network infrastructure support resources
The following infrastructure should be in place prior to the deployment of the OpenShift Container Platform:
-
At least one DNS server which provides a full host-name resolution.
-
At least three NTP servers which can keep time synchronized for the servers in the solution.
-
(Optional) Outbound internet connectivity for the OpenShift environment.
Best practices for production deployments
This section lists several best practices that an organization should take into consideration before deploying this solution into production.
Deploy OpenShift to an OSP private cloud with at least three compute nodes
The verified architecture described in this document presents the minimum hardware deployment suitable for HA operations by deploying three OSP controller nodes and two OSP compute nodes. This architecture ensures a fault tolerant configuration in which both compute nodes can launch virtual instances and deployed VMs can migrate between the two hypervisors.
Because Red Hat OpenShift initially deploys with three master nodes, a two-node configuration might cause at least two masters to occupy the same node, which can lead to a possible outage for OpenShift if that specific node becomes unavailable. Therefore, it is a Red Hat best practice to deploy at least three OSP compute nodes so that the OpenShift masters can be distributed evenly and the solution receives an added degree of fault tolerance.
Configure virtual machine/host affinity
Distributing the OpenShift masters across multiple hypervisor nodes can be achieved by enabling VM/host affinity.
Affinity is a way to define rules for a set of VMs and/or hosts that determine whether the VMs run together on the same host or hosts in the group or on different hosts. It is applied to VMs by creating affinity groups that consist of VMs and/or hosts with a set of identical parameters and conditions. Depending on whether the VMs in an affinity group run on the same host or hosts in the group or separately on different hosts, the parameters of the affinity group can define either positive affinity or negative affinity. In the Red Hat OpenStack Platform, host affinity and anti-affinity rules can be created and enforced by creating server groups and configuring filters so that instances deployed by Nova in a server group deploy on different compute nodes.
A server group has a default maximum of 10 virtual instances that it can manage placement for. This can be modified by updating the default quotas for Nova.
There is a specific hard affinity/anti-affinity limit for OSP server groups; if there not enough resources to deploy on separate nodes or not enough resources to allow sharing of nodes, the VM fails to boot. |
To configure affinity groups, see How do I configure Affinity and Anti-Affinity for OpenStack instances?.
Use a custom install file for OpenShift deployment
IPI makes the deployment of OpenShift clusters easy through the interactive wizard discussed earlier in this document. However, it is possible that you might need to change some default values as a part of a cluster deployment.
In these instances, you can run and task the wizardwithout immediately deploying a cluster; instead it creates a configuration file from which the cluster can be deployed later. This is very useful if you need to change any IPI defaults, or if you want to deploy multiple identical clusters in your environment for other uses such as multitenancy. For more information about creating a customized install configuration for OpenShift, see Red Hat OpenShift Installing a Cluster on OpenStack with Customizations.