Chapter 2. Planning your undercloud Before you configure and install director on the undercloud, you must plan your undercloud host to ensure it meets certain requirements. 2.1. Containerized undercloud The undercloud is the node that controls the configuration, installation, and management of your final Red Hat OpenStack Platform (RHOSP) environment, which is called the overcloud. The undercloud runs each RHOSP component service as a container. The undercloud uses these containerized services to create a toolset named director, which you use to create and manage your overcloud. Since both the undercloud and overcloud use containers, both use the same architecture to pull, configure, and run containers. This architecture is based on the OpenStack Orchestration service (heat) for provisioning nodes and uses Ansible to configure services and containers. It is useful to have some familiarity with heat and Ansible to help you troubleshoot issues that you might encounter. 2.2. Preparing your undercloud networking The undercloud requires access to two main networks: The Provisioning or Control Plane network , which is the network that director uses to provision your nodes and access them over SSH when executing Ansible configuration. This network also enables SSH access from the undercloud to overcloud nodes. The undercloud contains DHCP services for introspection and provisioning other nodes on this network, which means that no other DHCP services should exist on this network. The director configures the interface for this network. The External network , which enables access to OpenStack Platform repositories, container image sources, and other servers such as DNS servers or NTP servers. Use this network for standard access the undercloud from your workstation. You must manually configure an interface on the undercloud to access the external network. The undercloud requires a minimum of 2 x 1 Gbps Network Interface Cards: one for the Provisioning or Control Plane network and one for the External network . When you plan your network, review the following guidelines: Red Hat recommends using one network for provisioning and the control plane and another network for the data plane. Do not create provisioning and the control plane networks on top of an OVS bridge. The provisioning and control plane network can be configured on top of a Linux bond or on individual interfaces. If you use a Linux bond, configure it as an active-backup bond type. On non-controller nodes, the amount of traffic is relatively low on provisioning and control plane networks, and they do not require high bandwidth or load balancing. On Controllers, the provisioning and control plane networks need additional bandwidth. The reason for increased bandwidth is that Controllers serve many nodes in other roles. More bandwidth is also required when frequent changes are made to the environment. For best performance, Controllers with more than 50 compute nodes- or if more than four bare metal nodes are provisioned simultaneously- should have 4-10 times the bandwidth than the interfaces on the non-controller nodes. The undercloud should have a higher bandwidth connection to the provisioning network when more than 50 overcloud nodes are provisioned. Do not use the same Provisioning or Control Plane NIC as the one that you use to access the director machine from your workstation. The director installation creates a bridge by using the Provisioning NIC, which drops any remote connections. Use the External NIC for remote connections to the director system. The Provisioning network requires an IP range that fits your environment size. Use the following guidelines to determine the total number of IP addresses to include in this range: Include at least one temporary IP address for each node that connects to the Provisioning network during introspection. Include at least one permanent IP address for each node that connects to the Provisioning network during deployment. Include an extra IP address for the virtual IP of the overcloud high availability cluster on the Provisioning network. Include additional IP addresses within this range for scaling the environment. To prevent a Controller node network card or network switch failure disrupting overcloud services availability, ensure that the keystone admin endpoint is located on a network that uses bonded network cards or networking hardware redundancy. If you move the keystone endpoint to a different network, such as internal_api , ensure that the undercloud can reach the VLAN or subnet. For more information, see the Red Hat Knowledgebase solution How to migrate Keystone Admin Endpoint to internal_api network . 2.3. Determining environment scale Before you install the undercloud, determine the scale of your environment. Include the following factors when you plan your environment: How many nodes do you want to deploy in your overcloud? The undercloud manages each node within an overcloud. Provisioning overcloud nodes consumes resources on the undercloud. You must provide your undercloud with enough resources to adequately provision and control all of your overcloud nodes. How many simultaneous operations do you want the undercloud to perform? Most OpenStack services on the undercloud use a set of workers. Each worker performs an operation specific to that service. Multiple workers provide simultaneous operations. The default number of workers on the undercloud is determined by halving the total CPU thread count on the undercloud. In this instance, thread count refers to the number of CPU cores multiplied by the hyper-threading value. For example, if your undercloud has a CPU with 16 threads, then the director services spawn 8 workers by default. Director also uses a set of minimum and maximum caps by default: Service Minimum Maximum OpenStack Orchestration (heat) 4 24 All other service 2 12 The undercloud has the following minimum CPU and memory requirements: An 8-thread 64-bit x86 processor with support for the Intel 64 or AMD64 CPU extensions. This provides 4 workers for each undercloud service. A minimum of 24 GB of RAM. The ceph-ansible playbook consumes 1 GB resident set size (RSS) for every 10 hosts that the undercloud deploys. If you want to use a new or existing Ceph cluster in your deployment, you must provision the undercloud RAM accordingly. To use a larger number of workers, increase the vCPUs and memory of your undercloud using the following recommendations: Minimum: Use 1.5 GB of memory for each thread. For example, a machine with 48 threads requires 72 GB of RAM to provide the minimum coverage for 24 heat workers and 12 workers for other services. Recommended: Use 3 GB of memory for each thread. For example, a machine with 48 threads requires 144 GB of RAM to provide the recommended coverage for 24 heat workers and 12 workers for other services. 2.4. Undercloud disk sizing The recommended minimum undercloud disk size is 100 GB of available disk space on the root disk: 20 GB for container images 10 GB to accommodate QCOW2 image conversion and caching during the node provisioning process 70 GB+ for general usage, logging, metrics, and growth 2.5. Virtualization support Red Hat only supports a virtualized undercloud on the following platforms: Platform Notes Kernel-based Virtual Machine (KVM) Hosted by Red Hat Enterprise Linux 8.4, as listed on certified hypervisors. Red Hat Virtualization Hosted by Red Hat Virtualization 4.x, as listed on certified hypervisors. Microsoft Hyper-V Hosted by versions of Hyper-V as listed on the Red Hat Customer Portal Certification Catalogue . VMware ESX and ESXi Hosted by versions of ESX and ESXi as listed on the Red Hat Customer Portal Certification Catalogue . Important Ensure that your hypervisor supports Red Hat Enterprise Linux 8.4 guests. Virtual machine requirements Resource requirements for a virtual undercloud are similar to those of a bare-metal undercloud. Consider the various tuning options when provisioning such as network model, guest CPU capabilities, storage backend, storage format, and caching mode. Network considerations Power management The undercloud virtual machine (VM) requires access to the overcloud nodes' power management devices. This is the IP address set for the pm_addr parameter when registering nodes. Provisioning network The NIC used for the provisioning network, ctlplane , requires the ability to broadcast and serve DHCP requests to the NICs of the overcloud's bare-metal nodes. Create a bridge that connects the VM's NIC to the same network as the bare metal NICs. Allow traffic from an unknown address You must configure your virtual undercloud hypervisor to prevent the hypervisor blocking the undercloud from transmitting traffic from an unknown address. The configuration depends on the platform you are using for your virtual undercloud: Red Hat Enterprise Virtualization: Disable the anti-mac-spoofing parameter. VMware ESX or ESXi: On IPv4 ctlplane network: Allow forged transmits. On IPv6 ctlplane network: Allow forged transmits, MAC address changes, and promiscuous mode operation. For more information about how to configure VMware ESX or ESXi, see Securing vSphere Standard Switches on the VMware docs website. You must power off and on the director VM after you apply these settings. Rebooting the VM is not sufficient. 2.6. Character encoding configuration Red Hat OpenStack Platform has special character encoding requirements as part of the locale settings: Use UTF-8 encoding on all nodes. Ensure the LANG environment variable is set to en_US.UTF-8 on all nodes. Avoid using non-ASCII characters if you use Red Hat Ansible Tower to automate the creation of Red Hat OpenStack Platform resources. 2.7. Considerations when running the undercloud with a proxy Running the undercloud with a proxy has certain limitations, and Red Hat recommends that you use Red Hat Satellite for registry and package management. However, if your environment uses a proxy, review these considerations to best understand the different configuration methods of integrating parts of Red Hat OpenStack Platform with a proxy and the limitations of each method. System-wide proxy configuration Use this method to configure proxy communication for all network traffic on the undercloud. To configure the proxy settings, edit the /etc/environment file and set the following environment variables: http_proxy The proxy that you want to use for standard HTTP requests. https_proxy The proxy that you want to use for HTTPs requests. no_proxy A comma-separated list of domains that you want to exclude from proxy communications. The system-wide proxy method has the following limitations: The maximum length of no_proxy is 1024 characters due to a fixed size buffer in the pam_env PAM module. Some containers bind and parse the environment variables in /etc/environments incorrectly, which causes problems when running these services. For more information, see BZ#1916070 - proxy configuration updates in /etc/environment files are not being picked up in containers correctly and BZ#1918408 - mistral_executor container fails to properly set no_proxy environment parameter . dnf proxy configuration Use this method to configure dnf to run all traffic through a proxy. To configure the proxy settings, edit the /etc/dnf/dnf.conf file and set the following parameters: proxy The URL of the proxy server. proxy_username The username that you want to use to connect to the proxy server. proxy_password The password that you want to use to connect to the proxy server. proxy_auth_method The authentication method used by the proxy server. For more information about these options, run man dnf.conf . The dnf proxy method has the following limitations: This method provides proxy support only for dnf . The dnf proxy method does not include an option to exclude certain hosts from proxy communication. Red Hat Subscription Manager proxy Use this method to configure Red Hat Subscription Manager to run all traffic through a proxy. To configure the proxy settings, edit the /etc/rhsm/rhsm.conf file and set the following parameters: proxy_hostname Host for the proxy. proxy_scheme The scheme for the proxy when writing out the proxy to repo definitions. proxy_port The port for the proxy. proxy_username The username that you want to use to connect to the proxy server. proxy_password The password to use for connecting to the proxy server. no_proxy A comma-separated list of hostname suffixes for specific hosts that you want to exclude from proxy communication. For more information about these options, run man rhsm.conf . The Red Hat Subscription Manager proxy method has the following limitations: This method provides proxy support only for Red Hat Subscription Manager. The values for the Red Hat Subscription Manager proxy configuration override any values set for the system-wide environment variables. Transparent proxy If your network uses a transparent proxy to manage application layer traffic, you do not need to configure the undercloud itself to interact with the proxy because proxy management occurs automatically. A transparent proxy can help overcome limitations associated with client-based proxy configuration in Red Hat OpenStack Platform. 2.8. Undercloud repositories RHOSP (RHOSP) 16.2 runs on Red Hat Enterprise Linux (RHEL) 8.4. As a result, you must lock the content from these repositories to the respective RHEL version. Note If you synchronize repositories by using Red Hat Satellite, you can enable specific versions of the RHEL repositories. However, the repository label remains the same despite the version you choose. For example, if you enable the 8.4 version of the BaseOS repository, the repository name includes the specific version that you enabled, but the repository label is still rhel-8-for-x86_64-baseos-eus-rpms . The advanced-virt-for-rhel-8-x86_64-rpms and advanced-virt-for-rhel-8-x86_64-eus-rpms repositories are no longer required. To disable these repositories, see the Red Hat Knowledgebase solution advanced-virt-for-rhel-8-x86_64-rpms are no longer required in OSP 16.2 . Warning Any repositories outside the ones specified here are not supported. Unless recommended, do not enable any other products or repositories outside the ones listed in the following tables or else you might encounter package dependency issues. Do not enable Extra Packages for Enterprise Linux (EPEL). Core repositories The following table lists core repositories for installing the undercloud. Name Repository Description of requirement Red Hat Enterprise Linux 8 for x86_64 - BaseOS (RPMs) Extended Update Support (EUS) rhel-8-for-x86_64-baseos-eus-rpms Base operating system repository for x86_64 systems. Red Hat Enterprise Linux 8 for x86_64 - AppStream (RPMs) rhel-8-for-x86_64-appstream-eus-rpms Contains RHOSP dependencies. Red Hat Enterprise Linux 8 for x86_64 - High Availability (RPMs) Extended Update Support (EUS) rhel-8-for-x86_64-highavailability-eus-rpms High availability tools for RHEL. Used for Controller node high availability. Red Hat Ansible Engine 2.9 for RHEL 8 x86_64 (RPMs) ansible-2.9-for-rhel-8-x86_64-rpms Ansible Engine for RHEL. Used to provide the latest version of Ansible. RHOSP 16.2 for RHEL 8 (RPMs) openstack-16.2-for-rhel-8-x86_64-rpms Core RHOSP repository, which contains packages for RHOSP director. Red Hat Fast Datapath for RHEL 8 (RPMS) fast-datapath-for-rhel-8-x86_64-rpms Provides Open vSwitch (OVS) packages for OpenStack Platform. Ceph repositories The following table lists Ceph Storage related repositories for the undercloud. Name Repository Description of Requirement Red Hat Ceph Storage Tools 4 for RHEL 8 x86_64 (RPMs) rhceph-4-tools-for-rhel-8-x86_64-rpms Provides tools for nodes to communicate with the Ceph Storage cluster. The undercloud requires the ceph-ansible package from this repository if you plan to use Ceph Storage in your overcloud or if you want to integrate with an existing Ceph Storage cluster. IBM POWER repositories The following table contains a list of repositories for RHOSP on POWER PC architecture. Use these repositories in place of equivalents in the Core repositories. Name Repository Description of requirement Red Hat Enterprise Linux for IBM Power, little endian - BaseOS (RPMs) rhel-8-for-ppc64le-baseos-rpms Base operating system repository for ppc64le systems. Red Hat Enterprise Linux 8 for IBM Power, little endian - AppStream (RPMs) rhel-8-for-ppc64le-appstream-rpms Contains RHOSP dependencies. Red Hat Enterprise Linux 8 for IBM Power, little endian - High Availability (RPMs) rhel-8-for-ppc64le-highavailability-rpms High availability tools for RHEL. Used for Controller node high availability. Red Hat Fast Datapath for RHEL 8 IBM Power, little endian (RPMS) fast-datapath-for-rhel-8-ppc64le-rpms Provides Open vSwitch (OVS) packages for OpenStack Platform. Red Hat Ansible Engine 2.9 for RHEL 8 IBM Power, little endian (RPMs) ansible-2.9-for-rhel-8-ppc64le-rpms Ansible Engine for RHEL. Provides the latest version of Ansible. Red Hat OpenStack Platform 16.2 for RHEL 8 (RPMs) openstack-16.2-for-rhel-8-ppc64le-rpms Core RHOSP repository for ppc64le systems.

Commands: