OpenStack Zed : Configure Magnum (Network Node)2022/11/11

Install OpenStack Container Infrastructure Management Service (Magnum).

This example is based on the environment like follows.
Install Magnum services on Network Node.

------------+-----------------------------+-----------------------------+------------
            |                             |                             |
        eth0|10.0.0.30                eth0|10.0.0.50                eth0|10.0.0.51
+-----------+-----------+     +-----------+-----------+     +-----------+-----------+
|   [ dlp.srv.world ]   |     | [ network.srv.world ] |     |  [ node01.srv.world ] |
|     (Control Node)    |     |     (Network Node)    |     |     (Compute Node)    |
|                       |     |                       |     |                       |
|  MariaDB    RabbitMQ  |     |      Open vSwitch     |     |        Libvirt        |
|  Memcached  Nginx     |     |     Neutron Server    |     |      Nova Compute     |
|  Keystone   httpd     |     |      OVN-Northd       |     |      Open vSwitch     |
|  Glance     Nova API  |     |  Nginx  iSCSI Target  |     |   OVN Metadata Agent  |
|  Cinder API           |     |     Cinder Volume     |     |     OVN-Controller    |
|  Barbican API         |     |    Heat API/Engine    |     |                       |
|                       |     |    Magnum Services    |     |                       |
+-----------------------+     +-----------------------+     +-----------------------+

[1]	Install Magnum services on Network Node.

# install from Zed, EPEL, CRB

[root@network ~]#

dnf --enablerepo=centos-openstack-zed,epel,crb -y install openstack-magnum-api openstack-magnum-conductor python3-magnumclient

[2]	Configure Magnum.

[root@network ~]#

mv /etc/magnum/magnum.conf /etc/magnum/magnum.conf.org

[root@network ~]#

vi /etc/magnum/magnum.conf

# create new

[DEFAULT]
state_path = /var/lib/magnum
log_dir = /var/log/magnum
# RabbitMQ connection info
transport_url = rabbit://openstack:password@dlp.srv.world

[api]
host = 127.0.0.1
port = 9511
enabled_ssl = false

[database]
# MariaDB connection info
connection = mysql+pymysql://magnum:password@dlp.srv.world/magnum

[certificates]
cert_manager_type = barbican

[cinder]
default_docker_volume_type = lvm-magnum

[cinder_client]
region_name = RegionOne

[magnum_client]
region_name = RegionOne

# Keystone auth info
[keystone_authtoken]
www_authenticate_uri = https://dlp.srv.world:5000
auth_url = https://dlp.srv.world:5000
memcached_servers = dlp.srv.world:11211
auth_type = password
auth_version = v3
project_domain_name = default
user_domain_name = default
project_name = service
username = magnum
password = servicepassword
admin_user = magnum
admin_password = servicepassword
admin_tenant_name = service

[oslo_policy]
enforce_scope = false
enforce_new_defaults = false
policy_file = /etc/magnum/policy.json

[oslo_messaging_notifications]
driver = messagingv2

[trust]
trustee_domain_name = magnum
trustee_domain_admin_name = magnum_domain_admin
trustee_domain_admin_password = servicepassword
trustee_keystone_interface = public

[root@network ~]#

vi /etc/magnum/policy.json

# create new

{
    "context_is_admin": "role:admin",
    "admin_or_owner": "is_admin:True or project_id:%(project_id)s",
    "admin_api": "rule:context_is_admin",
    "admin_or_user": "is_admin:True or user_id:%(user_id)s",
    "cluster_user": "user_id:%(trustee_user_id)s",
    "deny_cluster_user": "not domain_id:%(trustee_domain_id)s",
    "bay:create": "rule:deny_cluster_user",
    "bay:delete": "rule:deny_cluster_user",
    "bay:detail": "rule:deny_cluster_user",
    "bay:get": "rule:deny_cluster_user",
    "bay:get_all": "rule:deny_cluster_user",
    "bay:update": "rule:deny_cluster_user",
    "baymodel:create": "rule:deny_cluster_user",
    "baymodel:delete": "rule:deny_cluster_user",
    "baymodel:detail": "rule:deny_cluster_user",
    "baymodel:get": "rule:deny_cluster_user",
    "baymodel:get_all": "rule:deny_cluster_user",
    "baymodel:update": "rule:deny_cluster_user",
    "baymodel:publish": "rule:admin_api",
    "certificate:create": "rule:admin_or_user or rule:cluster_user",
    "certificate:get": "rule:admin_or_user or rule:cluster_user",
    "certificate:rotate_ca": "rule:admin_or_owner",
    "cluster:create": "rule:deny_cluster_user",
    "cluster:delete": "rule:deny_cluster_user",
    "cluster:delete_all_projects": "rule:admin_api",
    "cluster:detail": "rule:deny_cluster_user",
    "cluster:detail_all_projects": "rule:admin_api",
    "cluster:get": "rule:deny_cluster_user",
    "cluster:get_one_all_projects": "rule:admin_api",
    "cluster:get_all": "rule:deny_cluster_user",
    "cluster:get_all_all_projects": "rule:admin_api",
    "cluster:update": "rule:deny_cluster_user",
    "cluster:update_health_status": "rule:admin_or_user or rule:cluster_user",
    "cluster:update_all_projects": "rule:admin_api",
    "cluster:resize": "rule:deny_cluster_user",
    "cluster:upgrade": "rule:deny_cluster_user",
    "cluster:upgrade_all_projects": "rule:admin_api",
    "clustertemplate:create": "rule:deny_cluster_user",
    "clustertemplate:delete": "rule:admin_or_owner",
    "clustertemplate:delete_all_projects": "rule:admin_api",
    "clustertemplate:detail_all_projects": "rule:admin_api",
    "clustertemplate:detail": "rule:deny_cluster_user",
    "clustertemplate:get": "rule:deny_cluster_user",
    "clustertemplate:get_one_all_projects": "rule:admin_api",
    "clustertemplate:get_all": "rule:deny_cluster_user",
    "clustertemplate:get_all_all_projects": "rule:admin_api",
    "clustertemplate:update": "rule:admin_or_owner",
    "clustertemplate:update_all_projects": "rule:admin_api",
    "clustertemplate:publish": "rule:admin_api",
    "federation:create": "rule:deny_cluster_user",
    "federation:delete": "rule:deny_cluster_user",
    "federation:detail": "rule:deny_cluster_user",
    "federation:get": "rule:deny_cluster_user",
    "federation:get_all": "rule:deny_cluster_user",
    "federation:update": "rule:deny_cluster_user",
    "magnum-service:get_all": "rule:admin_api",
    "quota:create": "rule:admin_api",
    "quota:delete": "rule:admin_api",
    "quota:get": "rule:admin_or_owner",
    "quota:get_all": "rule:admin_api",
    "quota:update": "rule:admin_api",
    "stats:get_all": "rule:admin_or_owner",
    "nodegroup:get": "rule:admin_or_owner",
    "nodegroup:get_all": "rule:admin_or_owner",
    "nodegroup:get_all_all_projects": "rule:admin_api",
    "nodegroup:get_one_all_projects": "rule:admin_api",
    "nodegroup:create": "rule:admin_or_owner",
    "nodegroup:delete": "rule:admin_or_owner",
    "nodegroup:update": "rule:admin_or_owner"
}

[root@network ~]#

chmod 640 /etc/magnum/{magnum.conf,policy.json}

[root@network ~]#

chgrp magnum /etc/magnum/{magnum.conf,policy.json}

[root@network ~]#

mkdir /var/lib/magnum/tmp

[root@network ~]#

chown magnum /var/lib/magnum/tmp

[3]	Configure Nginx for proxy settings.

[root@network ~]#

vi /etc/nginx/nginx.conf

# add into the [stream] section

stream {
    upstream neutron-api {
        server 127.0.0.1:9696;
    }
    server {
        listen 10.0.0.50:9696 ssl;
        proxy_pass neutron-api;
    }
    upstream magnum-api {
        server 127.0.0.1:9511;
    }
    server {
        listen 10.0.0.50:9511 ssl;
        proxy_pass magnum-api;
    }
    ssl_certificate "/etc/letsencrypt/live/network.srv.world/fullchain.pem";
    ssl_certificate_key "/etc/letsencrypt/live/network.srv.world/privkey.pem";
}

[4]	Add Data into Database and start Magnum services.

[root@network ~]#

su -s /bin/bash magnum -c "magnum-db-manage upgrade"

[root@network ~]#

systemctl enable --now openstack-magnum-api openstack-magnum-conductor

[root@network ~]#

systemctl restart nginx

[5]	If Firewalld is running, allow service port.

[root@network ~]#

firewall-cmd --add-port=9511/tcp

success
[root@network ~]#

firewall-cmd --runtime-to-permanent

success

[6]	Verify Magnum status on Control Node. It's OK if state is [up]. Also Create a Cinder volume type configured in [magnum.conf].

[root@dlp ~(keystone)]#

dnf --enablerepo=centos-openstack-zed,epel,crb -y install python3-magnumclient

[root@dlp ~(keystone)]#

openstack coe service list

+----+------+------------------+-------+----------+-----------------+---------------------------+---------------------------+
| id | host | binary           | state | disabled | disabled_reason | created_at                | updated_at                |
+----+------+------------------+-------+----------+-----------------+---------------------------+---------------------------+
|  1 | None | magnum-conductor | up    | False    | None            | 2022-11-11T06:10:32+00:00 | 2022-11-11T06:14:33+00:00 |
+----+------+------------------+-------+----------+-----------------+---------------------------+---------------------------+

[root@dlp ~(keystone)]#

openstack volume type create lvm-magnum --public

+-------------+--------------------------------------+
| Field       | Value                                |
+-------------+--------------------------------------+
| description | None                                 |
| id          | f014c406-11a4-46ff-a210-30403fff2b0b |
| is_public   | True                                 |
| name        | lvm-magnum                           |
+-------------+--------------------------------------+

Matched Content