Chapter 6. Planning your overcloud The following section contains some guidelines for planning various aspects of your Red Hat OpenStack Platform (RHOSP) environment. This includes defining node roles, planning your network topology, and storage. 6.1. Node roles Director includes the following default node types to build your overcloud: Controller Provides key services for controlling your environment. This includes the dashboard (horizon), authentication (keystone), image storage (glance), networking (neutron), orchestration (heat), and high availability services. A Red Hat OpenStack Platform (RHOSP) environment requires three Controller nodes for a highly available production-level environment. Note Use environments with one Controller node only for testing purposes, not for production. Environments with two Controller nodes or more than three Controller nodes are not supported. Compute A physical server that acts as a hypervisor and contains the processing capabilities required to run virtual machines in the environment. A basic RHOSP environment requires at least one Compute node. Ceph Storage A host that provides Red Hat Ceph Storage. Additional Ceph Storage hosts scale into a cluster. This deployment role is optional. Swift Storage A host that provides external object storage to the OpenStack Object Storage (swift) service. This deployment role is optional. The following table contains some examples of different overclouds and defines the node types for each scenario. Table 6.1. Node Deployment Roles for Scenarios Controller Compute Ceph Storage Swift Storage Total Small overcloud 3 1 - - 4 Medium overcloud 3 3 - - 6 Medium overcloud with additional object storage 3 3 - 3 9 Medium overcloud with Ceph Storage cluster 3 3 3 - 9 In addition, consider whether to split individual services into custom roles. For more information about the composable roles architecture, see "Composable Services and Custom Roles" in the Advanced Overcloud Customization guide. 6.2. Overcloud networks It is important to plan the networking topology and subnets in your environment so that you can map roles and services to communicate with each other correctly. Red Hat OpenStack Platform (RHOSP) uses the Openstack Networking (neutron) service, which operates autonomously and manages software-based networks, static and floating IP addresses, and DHCP. By default, director configures nodes to use the Provisioning / Control Plane for connectivity. However, it is possible to isolate network traffic into a series of composable networks, that you can customize and assign services. In a typical RHOSP installation, the number of network types often exceeds the number of physical network links. To connect all the networks to the proper hosts, the overcloud uses VLAN tagging to deliver more than one network on each interface. Most of the networks are isolated subnets but some networks require a Layer 3 gateway to provide routing for Internet access or infrastructure network connectivity. If you use VLANs to isolate your network traffic types, you must use a switch that supports 802.1Q standards to provide tagged VLANs. Note It is recommended that you deploy a project network (tunneled with GRE or VXLAN) even if you intend to use a neutron VLAN mode with tunneling disabled at deployment time. This requires minor customization at deployment time and leaves the option available to use tunnel networks as utility networks or virtualization networks in the future. You still create Tenant networks using VLANs, but you can also create VXLAN tunnels for special-use networks without consuming tenant VLANs. It is possible to add VXLAN capability to a deployment with a Tenant VLAN, but it is not possible to add a Tenant VLAN to an existing overcloud without causing disruption. Director also includes a set of templates that you can use to configure NICs with isolated composable networks. The following configurations are the default configurations: Single NIC configuration - One NIC for the Provisioning network on the native VLAN and tagged VLANs that use subnets for the different overcloud network types. Bonded NIC configuration - One NIC for the Provisioning network on the native VLAN and two NICs in a bond for tagged VLANs for the different overcloud network types. Multiple NIC configuration - Each NIC uses a subnet for a different overcloud network type. You can also create your own templates to map a specific NIC configuration. The following details are also important when you consider your network configuration: During the overcloud creation, you refer to NICs using a single name across all overcloud machines. Ideally, you should use the same NIC on each overcloud node for each respective network to avoid confusion. For example, use the primary NIC for the Provisioning network and the secondary NIC for the OpenStack services. Set all overcloud systems to PXE boot off the Provisioning NIC, and disable PXE boot on the External NIC and any other NICs on the system. Also ensure that the Provisioning NIC has PXE boot at the top of the boot order, ahead of hard disks and CD/DVD drives. All overcloud bare metal systems require a supported power management interface, such as an Intelligent Platform Management Interface (IPMI), so that director can control the power management of each node. Make a note of the following details for each overcloud system: the MAC address of the Provisioning NIC, the IP address of the IPMI NIC, IPMI username, and IPMI password. This information is useful later when you configure the overcloud nodes. If an instance must be accessible from the external internet, you can allocate a floating IP address from a public network and associate the floating IP with an instance. The instance retains its private IP but network traffic uses NAT to traverse through to the floating IP address. Note that a floating IP address can be assigned only to a single instance rather than multiple private IP addresses. However, the floating IP address is reserved for use only by a single tenant, which means that the tenant can associate or disassociate the floating IP address with a particular instance as required. This configuration exposes your infrastructure to the external internet and you must follow suitable security practices. To mitigate the risk of network loops in Open vSwitch, only a single interface or a single bond can be a member of a given bridge. If you require multiple bonds or interfaces, you can configure multiple bridges. Red Hat recommends using DNS hostname resolution so that your overcloud nodes can connect to external services, such as the Red Hat Content Delivery Network and network time servers. Note You can virtualize the overcloud control plane if you are using Red Hat Virtualization (RHV). For more information, see Creating virtualized control planes . 6.3. Overcloud storage Note Using LVM on a guest instance that uses a back end cinder-volume of any driver or back-end type results in issues with performance, volume visibility and availability, and data corruption. Use an LVM filter to mitigate these issues. For more information, see section 2.1 Back Ends in the Storage Guide and KCS article 3213311, "Using LVM on a cinder volume exposes the data to the compute host." Director includes different storage options for the overcloud environment: Ceph Storage nodes Director creates a set of scalable storage nodes using Red Hat Ceph Storage. The overcloud uses these nodes for the following storage types: Images - The Image service (glance) manages images for virtual machines. Images are immutable. OpenStack treats images as binary blobs and downloads them accordingly. You can use the Image service (glance) to store images in a Ceph Block Device. Volumes - OpenStack manages volumes with the Block Storage service (cinder). The Block Storage service (cinder) volumes are block devices. OpenStack uses volumes to boot virtual machines, or to attach volumes to running virtual machines. You can use the Block Storage serivce to boot a virtual machine using a copy-on-write clone of an image. File Systems - Openstack manages shared file systems with the Shared File Systems service (manila). Shares are backed by file systems. You can use manila to manage shares backed by a CephFS file system with data on the Ceph Storage nodes. Guest Disks - Guest disks are guest operating system disks. By default, when you boot a virtual machine with the Compute service (nova), the virtual machine disk appears as a file on the filesystem of the hypervisor (usually under /var/lib/nova/instances/<uuid>/ ). Every virtual machine inside Ceph can be booted without using the Block Storage service (cinder). As a result, you can perform maintenance operations easily with the live-migration process. Additionally, if your hypervisor fails, it is also convenient to trigger nova evacuate and run the virtual machine elsewhere. Important For information about supported image formats, see the Image Service chapter in the Instances and Images Guide . For more information about Ceph Storage, see the Red Hat Ceph Storage Architecture Guide . Swift Storage nodes Director creates an external object storage node. This is useful in situations where you need to scale or replace Controller nodes in your overcloud environment but need to retain object storage outside of a high availability cluster. 6.4. Overcloud security Your OpenStack Platform implementation is only as secure as your environment. Follow good security principles in your networking environment to ensure that you control network access properly: Use network segmentation to mitigate network movement and isolate sensitive data. A flat network is much less secure. Restrict services access and ports to a minimum. Enforce proper firewall rules and password usage. Ensure that SELinux is enabled. For more information about securing your system, see the following Red Hat guides: Security Hardening for Red Hat Enterprise Linux 8 Using SELinux for Red Hat Enterprise Linux 8 6.5. Overcloud high availability To deploy a highly-available overcloud, director configures multiple Controller, Compute and Storage nodes to work together as a single cluster. In case of node failure, an automated fencing and re-spawning process is triggered based on the type of node that failed. For more information about overcloud high availability architecture and services, see High Availability Deployment and Usage . Note Deploying a highly available overcloud without STONITH is not supported. You must configure a STONITH device for each node that is a part of the Pacemaker cluster in a highly available overcloud. For more information on STONITH and Pacemaker, see Fencing in a Red Hat High Availability Cluster and Support Policies for RHEL High Availability Clusters . You can also configure high availability for Compute instances with director (Instance HA). This high availability mechanism automates evacuation and re-spawning of instances on Compute nodes in case of node failure. The requirements for Instance HA are the same as the general overcloud requirements, but you must perform a few additional steps to prepare your environment for the deployment. For more information about Instance HA and installation instructions, see the High Availability for Compute Instances guide. 6.6. Controller node requirements Controller nodes host the core services in a Red Hat OpenStack Platform environment, such as the Dashboard (horizon), the back-end database server, the Identity service (keystone) authentication, and high availability services. Processor 64-bit x86 processor with support for the Intel 64 or AMD64 CPU extensions. Memory The minimum amount of memory is 32 GB. However, the amount of recommended memory depends on the number of vCPUs, which is based on the number of CPU cores multiplied by hyper-threading value. Use the following calculations to determine your RAM requirements: Controller RAM minimum calculation: Use 1.5 GB of memory for each vCPU. For example, a machine with 48 vCPUs should have 72 GB of RAM. Controller RAM recommended calculation: Use 3 GB of memory for each vCPU. For example, a machine with 48 vCPUs should have 144 GB of RAM For more information about measuring memory requirements, see "Red Hat OpenStack Platform Hardware Requirements for Highly Available Controllers" on the Red Hat Customer Portal. Disk Storage and layout A minimum amount of 40 GB storage is required if the Object Storage service (swift) is not running on the Controller nodes. However, the Telemetry and Object Storage services are both installed on the Controllers, with both configured to use the root disk. These defaults are suitable for deploying small overclouds built on commodity hardware. These environments are typical of proof-of-concept and test environments. You can use these defaults to deploy overclouds with minimal planning, but they offer little in terms of workload capacity and performance. In an enterprise environment, however, the defaults could cause a significant bottleneck because Telemetry accesses storage constantly. This results in heavy disk I/O usage, which severely impacts the performance of all other Controller services. In this type of environment, you must plan your overcloud and configure it accordingly. Red Hat provides several configuration recommendations for both Telemetry and Object Storage. For more information, see Deployment Recommendations for Specific Red Hat OpenStack Platform Services . Network Interface Cards A minimum of 2 x 1 Gbps Network Interface Cards. Use additional network interface cards for bonded interfaces or to delegate tagged VLAN traffic. Power management Each Controller node requires a supported power management interface, such as an Intelligent Platform Management Interface (IPMI) functionality, on the server motherboard. Virtualization support Red Hat supports virtualized Controller nodes only on Red Hat Virtualization platforms. For more information, see Virtualized control planes . 6.7. Compute node requirements Compute nodes are responsible for running virtual machine instances after they are launched. Compute nodes must support hardware virtualization. Compute nodes must also have enough memory and disk space to support the requirements of the virtual machine instances that they host. Processor 64-bit x86 processor with support for the Intel 64 or AMD64 CPU extensions, and the AMD-V or Intel VT hardware virtualization extensions enabled. It is recommended that this processor has a minimum of 4 cores. IBM POWER 8 processor. Memory A minimum of 6 GB of RAM. Add additional RAM to this requirement based on the amount of memory that you intend to make available to virtual machine instances. Disk space A minimum of 40 GB of available disk space. Network Interface Cards A minimum of one 1 Gbps Network Interface Cards, although it is recommended to use at least two NICs in a production environment. Use additional network interface cards for bonded interfaces or to delegate tagged VLAN traffic. Power management Each Compute node requires a supported power management interface, such as an Intelligent Platform Management Interface (IPMI) functionality, on the server motherboard. 6.8. Ceph Storage node requirements Ceph Storage nodes are responsible for providing object storage in a Red Hat OpenStack Platform environment. Placement Groups (PGs) Ceph uses placement groups to facilitate dynamic and efficient object tracking at scale. In the case of OSD failure or cluster rebalancing, Ceph can move or replicate a placement group and its contents, which means a Ceph cluster can re-balance and recover efficiently. The default placement group count that director creates is not always optimal so it is important to calculate the correct placement group count according to your requirements. You can use the placement group calculator to calculate the correct count: Placement Groups (PGs) per Pool Calculator Processor 64-bit x86 processor with support for the Intel 64 or AMD64 CPU extensions. Memory Red Hat typically recommends a baseline of 16 GB of RAM per OSD host, with an additional 2 GB of RAM per OSD daemon. Disk layout Sizing is dependent on your storage requirements. Red Hat recommends that your Ceph Storage node configuration includes three or more disks in a layout similar to the following example: /dev/sda - The root disk. The director copies the main overcloud image to the disk. Ensure that the disk has a minimum of 40 GB of available disk space. /dev/sdb - The journal disk. This disk divides into partitions for Ceph OSD journals. For example, /dev/sdb1 , /dev/sdb2 , and /dev/sdb3 . The journal disk is usually a solid state drive (SSD) to aid with system performance. /dev/sdc and onward - The OSD disks. Use as many disks as necessary for your storage requirements. Note Red Hat OpenStack Platform director uses ceph-ansible , which does not support installing the OSD on the root disk of Ceph Storage nodes. This means that you need at least two disks for a supported Ceph Storage node. Network Interface Cards A minimum of one 1 Gbps Network Interface Cards, although Red Hat recommends that you use at least two NICs in a production environment. Use additional network interface cards for bonded interfaces or to delegate tagged VLAN traffic. Red Hat recommends that you use a 10 Gbps interface for storage nodes, especially if you want to create an OpenStack Platform environment that serves a high volume of traffic. Power management Each Controller node requires a supported power management interface, such as Intelligent Platform Management Interface (IPMI) functionality on the motherboard of the server. For more information about installing an overcloud with a Ceph Storage cluster, see the Deploying an Overcloud with Containerized Red Hat Ceph guide. 6.9. Object Storage node requirements Object Storage nodes provide an object storage layer for the overcloud. The Object Storage proxy is installed on Controller nodes. The storage layer requires bare metal nodes with multiple disks on each node. Processor 64-bit x86 processor with support for the Intel 64 or AMD64 CPU extensions. Memory Memory requirements depend on the amount of storage space. Use at minimum 1 GB of memory for each 1 TB of hard disk space. For optimal performance, it is recommended to use 2 GB for each 1 TB of hard disk space, especially for workloads with files smaller than 100GB. Disk space Storage requirements depend on the capacity needed for the workload. It is recommended to use SSD drives to store the account and container data. The capacity ratio of account and container data to objects is approximately 1 per cent. For example, for every 100TB of hard drive capacity, provide 1TB of SSD capacity for account and container data. However, this depends on the type of stored data. If you want to store mostly small objects, provide more SSD space. For large objects (videos, backups), use less SSD space. Disk layout The recommended node configuration requires a disk layout similar to the following example: /dev/sda - The root disk. Director copies the main overcloud image to the disk. /dev/sdb - Used for account data. /dev/sdc - Used for container data. /dev/sdd and onward - The object server disks. Use as many disks as necessary for your storage requirements. Network Interface Cards A minimum of 2 x 1 Gbps Network Interface Cards. Use additional network interface cards for bonded interfaces or to delegate tagged VLAN traffic. Power management Each Controller node requires a supported power management interface, such as an Intelligent Platform Management Interface (IPMI) functionality, on the server motherboard. 6.10. Overcloud repositories Red Hat OpenStack Platform 16.0 runs on Red Hat Enterprise Linux 8.1. After overcloud deployment, lock each host to a specific version with the subscription-manager release command: You must enable the following repositories to install and configure the overcloud. Core repositories The following table lists core repositories for installing the overcloud. Name Repository Description of requirement Red Hat Enterprise Linux 8 for x86_64 - BaseOS (RPMs) Extended Update Support (EUS) rhel-8-for-x86_64-baseos-eus-rpms Base operating system repository for x86_64 systems. Red Hat Enterprise Linux 8 for x86_64 - AppStream (RPMs) Extended Update Support (EUS) rhel-8-for-x86_64-appstream-eus-rpms Contains Red Hat OpenStack Platform dependencies. Red Hat Enterprise Linux 8 for x86_64 - High Availability (RPMs) Extended Update Support (EUS) rhel-8-for-x86_64-highavailability-eus-rpms High availability tools for Red Hat Enterprise Linux. Used for Controller node high availability. Red Hat Ansible Engine 2.8 for RHEL 8 x86_64 (RPMs) ansible-2.8-for-rhel-8-x86_64-rpms Ansible Engine for Red Hat Enterprise Linux. Used to provide the latest version of Ansible. Advanced Virtualization for RHEL 8 x86_64 (RPMs) advanced-virt-for-rhel-8-x86_64-rpms Provides virtualization packages for OpenStack Platform. Red Hat Satellite Tools for RHEL 8 Server RPMs x86_64 satellite-tools-6.5-for-rhel-8-x86_64-rpms Tools for managing hosts with Red Hat Satellite 6. Red Hat OpenStack Platform 16.0 for RHEL 8 (RPMs) openstack-16-for-rhel-8-x86_64-rpms Core Red Hat OpenStack Platform repository. Red Hat Fast Datapath for RHEL 8 (RPMS) fast-datapath-for-rhel-8-x86_64-rpms Provides Open vSwitch (OVS) packages for OpenStack Platform. Ceph repositories The following table lists Ceph Storage related repositories for the overcloud. Name Repository Description of Requirement Red Hat Enterprise Linux 8 for x86_64 - BaseOS (RPMs) rhel-8-for-x86_64-baseos-rpms Base operating system repository for x86_64 systems. Red Hat Enterprise Linux 8 for x86_64 - AppStream (RPMs) rhel-8-for-x86_64-appstream-eus-rpms Contains Red Hat OpenStack Platform dependencies. Red Hat Enterprise Linux 8 for x86_64 - High Availability (RPMs) rhel-8-for-x86_64-highavailability-rpms High availability tools for Red Hat Enterprise Linux. Red Hat Ansible Engine 2.8 for RHEL 8 x86_64 (RPMs) ansible-2.8-for-rhel-8-x86_64-rpms Ansible Engine for Red Hat Enterprise Linux. Used to provide the latest version of Ansible. Red Hat OpenStack Platform 16.0 Director Deployment Tools for RHEL 8 x86_64 (RPMs) openstack-16-deployment-tools-for-rhel-8-x86_64-rpms Packages to help director configure Ceph Storage nodes. Red Hat Ceph Storage OSD 4 for RHEL 8 x86_64 (RPMs) rhceph-4-osd-for-rhel-8-x86_64-rpms (For Ceph Storage Nodes) Repository for Ceph Storage Object Storage daemon. Installed on Ceph Storage nodes. Red Hat Ceph Storage MON 4 for RHEL 8 x86_64 (RPMs) rhceph-4-mon-for-rhel-8-x86_64-rpms (For Ceph Storage Nodes) Repository for Ceph Storage Monitor daemon. Installed on Controller nodes in OpenStack environments using Ceph Storage nodes. Red Hat Ceph Storage Tools 4 for RHEL 8 x86_64 (RPMs) rhceph-4-tools-for-rhel-8-x86_64-rpms Provides tools for nodes to communicate with the Ceph Storage cluster. Enable this repository for all nodes when you deploy an overcloud with a Ceph Storage cluster or when you integrate your overcloud with an existing Ceph Storage cluster. Real Time repositories The following table lists repositories for Real Time Compute (RTC) functionality. Name Repository Description of requirement Red Hat Enterprise Linux 8 for x86_64 - Real Time (RPMs) rhel-8-for-x86_64-rt-rpms Repository for Real Time KVM (RT-KVM). Contains packages to enable the real time kernel. Enable this repository for all Compute nodes targeted for RT-KVM. NOTE: You need a separate subscription to a Red Hat OpenStack Platform for Real Time SKU to access this repository. Red Hat Enterprise Linux 8 for x86_64 - Real Time for NFV (RPMs) rhel-8-for-x86_64-nfv-rpms Repository for Real Time KVM (RT-KVM) for NFV. Contains packages to enable the real time kernel. Enable this repository for all NFV Compute nodes targeted for RT-KVM. NOTE: You need a separate subscription to a Red Hat OpenStack Platform for Real Time SKU to access this repository. IBM POWER repositories The following table lists repositories for Openstack Platform on POWER PC architecture. Use these repositories in place of equivalents in the Core repositories. Name Repository Description of requirement Red Hat Enterprise Linux for IBM Power, little endian - BaseOS (RPMs) rhel-8-for-ppc64le-baseos-rpms Base operating system repository for ppc64le systems. Red Hat Enterprise Linux 8 for IBM Power, little endian - AppStream (RPMs) rhel-8-for-ppc64le-appstream-rpms Contains Red Hat OpenStack Platform dependencies. Red Hat Enterprise Linux 8 for IBM Power, little endian - High Availability (RPMs) rhel-8-for-ppc64le-highavailability-rpms High availability tools for Red Hat Enterprise Linux. Used for Controller node high availability. Red Hat Ansible Engine 2.8 for RHEL 8 IBM Power, little endian (RPMs) ansible-2.8-for-rhel-8-ppc64le-rpms Ansible Engine for Red Hat Enterprise Linux. Used to provide the latest version of Ansible. Red Hat OpenStack Platform 16.0 for RHEL 8 (RPMs) openstack-16-for-rhel-8-ppc64le-rpms Core Red Hat OpenStack Platform repository for ppc64le systems. 6.11. Provisioning methods There are three main methods that you can use to provision the nodes for your Red Hat OpenStack Platform environment: Provisioning with director Red Hat OpenStack Platform director is the standard provisioning method. In this scenario, the openstack overcloud deploy command performs both the provisioning and the configuration of your deployment. For more information about the standard provisioning and deployment method, see Chapter 7, Configuring a basic overcloud with CLI tools . Provisioning with the OpenStack Bare Metal (ironic) service In this scenario, you can separate the provisioning and configuration stages of the standard director deployment into two distinct processes. This is useful if you want to mitigate some of the risk involved with the standard director deployment and identify points of failure more efficiently. For more information about this scenario, see Chapter 8, Provisioning bare metal nodes before deploying the overcloud . Important This feature is available in this release as a Technology Preview , and therefore is not fully supported by Red Hat. It should only be used for testing, and should not be deployed in a production environment. For more information about Technology Preview features, see Scope of Coverage Details . Provisioning with an external tool In this scenario, director controls the overcloud configuration on nodes that you pre-provision with an external tool. This is useful if you want to create an overcloud without power management control, use networks that have DHCP/PXE boot restrictions, or if you want to use nodes that have a custom partitioning layout that does not rely on the QCOW2 overcloud-full image. This scenario does not use the OpenStack Compute (nova), OpenStack Bare Metal (ironic), or OpenStack Image (glance) services for managing nodes. For more information about this scenario, see Chapter 9, Configuring a basic overcloud with pre-provisioned nodes . Important You cannot combine pre-provisioned nodes with director-provisioned nodes.

Commands:
sudo subscription-manager release --set=8.1