Appendix H: Octavia LBaaS¶

Generate Certificates¶

Octavia uses client certificates for authentication and security of communication between Amphorae (load balancers) and the Octavia control plane; for the initial version of the Octavia charm, these must be generated by the operator and provided to the Octavia charm as configuration.

The script below generates example certificates and keys with a 365 day expiry period:

mkdir -p demoCA/newcerts
touch demoCA/index.txt
touch demoCA/index.txt.attr
openssl genrsa -passout pass:foobar -des3 -out issuing_ca_key.pem 2048
openssl req -x509 -passin pass:foobar -new -nodes -key issuing_ca_key.pem \
    -config /etc/ssl/openssl.cnf \
    -subj "/C=US/ST=Somestate/O=Org/CN=www.example.com" \
    -days 365 \
    -out issuing_ca.pem

openssl genrsa -passout pass:foobar -des3 -out controller_ca_key.pem 2048
openssl req -x509 -passin pass:foobar -new -nodes \
        -key controller_ca_key.pem \
    -config /etc/ssl/openssl.cnf \
    -subj "/C=US/ST=Somestate/O=Org/CN=www.example.com" \
    -days 365 \
    -out controller_ca.pem
openssl req \
    -newkey rsa:2048 -nodes -keyout controller_key.pem \
    -subj "/C=US/ST=Somestate/O=Org/CN=www.example.com" \
    -out controller.csr
openssl ca -passin pass:foobar -config /etc/ssl/openssl.cnf \
    -cert controller_ca.pem -keyfile controller_ca_key.pem \
    -create_serial -batch \
    -in controller.csr -days 365 -out controller_cert.pem
cat controller_cert.pem controller_key.pem > controller_cert_bundle.pem

The generated certs and keys must then be provided to the octavia charm:

juju config octavia \
    lb-mgmt-issuing-cacert="$(base64 controller_ca.pem)" \
    lb-mgmt-issuing-ca-private-key="$(base64 controller_ca_key.pem)" \
    lb-mgmt-issuing-ca-key-passphrase=foobar \
    lb-mgmt-controller-cacert="$(base64 controller_ca.pem)" \
    lb-mgmt-controller-cert="$(base64 controller_cert_bundle.pem)"

Resource Configuration¶

The charm will automatically create and maintain the resources required for operation of the Octavia service by running the configure-resources action on the lead octavia unit:

juju run-action --wait octavia/0 configure-resources

This action must be run before Octavia is fully operational.

Access to the Octavia load-balancer API is guarded by policies and end users must have specific roles to gain access to the service. The charm will request Keystone to pre-create these roles for you on deployment but you must assign the roles to your end users as you see fit. Take a look at Octavia Policies.

The charm also allows the operator to pre-configure these resources to support full custom configuration of the management network for Octavia. If you want to manage these resources yourself you must set the create-mgmt-network configuration option to false.

Network resources for use by Octavia must be tagged using Neutron resource tags (typically by passing a ‘–tag’ CLI parameter when creating resources - see the OpenStack CLI for more details) using the following schema:

Execution of the configure-resources action will detect the pre-configured network resources in Neutron using tags and configure the Octavia service as appropriate.

The UUID of the Nova flavor to use for Amphorae can be set using the custom-amp-flavor-id configuration option.

Amphora image¶

Octavia uses Amphorae (cloud instances running haproxy) to provide LBaaS services; an appropriate image must be uploaded to Glance with the tag octavia-amphora.

curl http://tarballs.openstack.org/octavia/test-images/test-only-amphora-x64-haproxy-ubuntu-xenial.qcow2 | \
    openstack image create --tag octavia-amphora --disk-format=qcow2 \
        --container-format=bare --private amphora-haproxy-xenial

Octavia will use this image for all Amphora instances.