[install-guide] Import HTTPS, standalone and root device hints
Import root device hints under "Advanced" section. Change-Id: I5a3002620c73568698d2ebe1af202001a8f074e1 Partial-bug: #1612278
This commit is contained in:
Mathieu Mitchell
parent
0445213bbb
commit
6394c279ca
@ -630,52 +630,10 @@ Guide.
|
|||||||
Specifying the disk for deployment
|
Specifying the disk for deployment
|
||||||
==================================
|
==================================
|
||||||
|
|
||||||
Starting with the Kilo release, Bare Metal service supports passing
|
The `Specifying the disk for deployment`_ section has been moved to the Bare
|
||||||
hints to the deploy ramdisk about which disk it should pick for the
|
Metal service Install Guide.
|
||||||
deployment. The list of support hints is:
|
|
||||||
|
|
||||||
* model (STRING): device identifier
|
.. _`Specifying the disk for deployment`: http://docs.openstack.org/project-install-guide/baremetal/draft/advanced.html#specifying-the-disk-for-deployment-root-device-hints
|
||||||
* vendor (STRING): device vendor
|
|
||||||
* serial (STRING): disk serial number
|
|
||||||
* size (INT): size of the device in GiB
|
|
||||||
|
|
||||||
.. note::
|
|
||||||
A node's 'local_gb' property is often set to a value 1 GiB less than the
|
|
||||||
actual disk size to account for partitioning (this is how DevStack, TripleO
|
|
||||||
and Ironic Inspector work, to name a few). However, in this case ``size``
|
|
||||||
should be the actual size. For example, for a 128 GiB disk ``local_gb``
|
|
||||||
will be 127, but size hint will be 128.
|
|
||||||
|
|
||||||
* wwn (STRING): unique storage identifier
|
|
||||||
* wwn_with_extension (STRING): unique storage identifier with the vendor extension appended
|
|
||||||
* wwn_vendor_extension (STRING): unique vendor storage identifier
|
|
||||||
* rotational (BOOLEAN): whether it's a rotational device or not. This
|
|
||||||
hint makes it easier to distinguish HDDs (rotational) and SSDs (not
|
|
||||||
rotational) when choosing which disk Ironic should deploy the image onto.
|
|
||||||
* name (STRING): the device name, e.g /dev/md0
|
|
||||||
|
|
||||||
|
|
||||||
.. warning::
|
|
||||||
The root device hint name should only be used for devices with
|
|
||||||
constant names (e.g RAID volumes). For SATA, SCSI and IDE disk
|
|
||||||
controllers this hint is not recommended because the order in which
|
|
||||||
the device nodes are added in Linux is arbitrary, resulting in
|
|
||||||
devices like /dev/sda and /dev/sdb `switching around at boot time
|
|
||||||
<https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Storage_Administration_Guide/persistent_naming.html>`_.
|
|
||||||
|
|
||||||
|
|
||||||
To associate one or more hints with a node, update the node's properties
|
|
||||||
with a ``root_device`` key, for example::
|
|
||||||
|
|
||||||
ironic node-update <node-uuid> add properties/root_device='{"wwn": "0x4000cca77fc4dba1"}'
|
|
||||||
|
|
||||||
|
|
||||||
That will guarantee that Bare Metal service will pick the disk device that
|
|
||||||
has the ``wwn`` equal to the specified wwn value, or fail the deployment if it
|
|
||||||
can not be found.
|
|
||||||
|
|
||||||
.. note::
|
|
||||||
If multiple hints are specified, a device must satisfy all the hints.
|
|
||||||
|
|
||||||
|
|
||||||
.. _EnableHTTPSinSwift:
|
.. _EnableHTTPSinSwift:
|
||||||
@ -683,253 +641,49 @@ can not be found.
|
|||||||
Enabling HTTPS in Swift
|
Enabling HTTPS in Swift
|
||||||
=======================
|
=======================
|
||||||
|
|
||||||
The drivers using virtual media use swift for storing boot images
|
The `Enabling HTTPS in Swift`_ section has been moved to the Bare Metal service
|
||||||
and node configuration information (contains sensitive information for Ironic
|
Install Guide.
|
||||||
conductor to provision bare metal hardware). By default, HTTPS is not enabled
|
|
||||||
in swift. HTTPS is required to encrypt all communication between swift and Ironic
|
|
||||||
conductor and swift and bare metal (via virtual media). It can be enabled in one
|
|
||||||
of the following ways:
|
|
||||||
|
|
||||||
* `Using an SSL termination proxy
|
.. _`Enabling HTTPS in Swift`: http://docs.openstack.org/project-install-guide/baremetal/draft/enabling-https.html#enabling-https-in-swift
|
||||||
<http://docs.openstack.org/security-guide/secure-communication/tls-proxies-and-http-services.html>`_
|
|
||||||
|
|
||||||
* `Using native SSL support in swift
|
|
||||||
<http://docs.openstack.org/developer/swift/deployment_guide.html>`_
|
|
||||||
(recommended only for testing purpose by swift).
|
|
||||||
|
|
||||||
.. _EnableHTTPSinGlance:
|
.. _EnableHTTPSinGlance:
|
||||||
|
|
||||||
Enabling HTTPS in Image service
|
Enabling HTTPS in Image service
|
||||||
===============================
|
===============================
|
||||||
|
|
||||||
Ironic drivers usually use Image service during node provisioning. By default,
|
The `Enabling HTTPS in Image service`_ section has been moved to the Bare Metal
|
||||||
image service does not use HTTPS, but it is required for secure communication.
|
service Install Guide.
|
||||||
It can be enabled by making the following changes to ``/etc/glance/glance-api.conf``:
|
|
||||||
|
|
||||||
#. `Configuring SSL support
|
.. _`Enabling HTTPS in Image service`: http://docs.openstack.org/project-install-guide/baremetal/draft/enabling-https.html#enabling-https-in-image-service
|
||||||
<http://docs.openstack.org/developer/glance/configuring.html#configuring-ssl-support>`_
|
|
||||||
|
|
||||||
#. Restart the glance-api service::
|
|
||||||
|
|
||||||
Fedora/RHEL7/CentOS7:
|
|
||||||
sudo systemctl restart openstack-glance-api
|
|
||||||
|
|
||||||
Debian/Ubuntu:
|
|
||||||
sudo service glance-api restart
|
|
||||||
|
|
||||||
See the `Glance <http://docs.openstack.org/developer/glance/>`_ documentation,
|
|
||||||
for more details on the Image service.
|
|
||||||
|
|
||||||
Enabling HTTPS communication between Image service and Object storage
|
Enabling HTTPS communication between Image service and Object storage
|
||||||
=====================================================================
|
=====================================================================
|
||||||
|
|
||||||
This section describes the steps needed to enable secure HTTPS communication between
|
The `Enabling HTTPS communication between Image service and Object storage`_
|
||||||
Image service and Object storage when Object storage is used as the Backend.
|
section has been moved to the Bare Metal service Install Guide.
|
||||||
|
|
||||||
To enable secure HTTPS communication between Image service and Object storage follow these steps:
|
.. _`Enabling HTTPS communication between Image service and Object storage`: http://docs.openstack.org/project-install-guide/baremetal/draft/enabling-https.html#enabling-https-communication-between-image-service-and-object-storage
|
||||||
|
|
||||||
#. :ref:`EnableHTTPSinSwift`.
|
|
||||||
|
|
||||||
#. `Configure Swift Storage Backend
|
|
||||||
<http://docs.openstack.org/developer/glance/configuring.html#configuring-the-swift-storage-backend>`_
|
|
||||||
|
|
||||||
#. :ref:`EnableHTTPSinGlance`
|
|
||||||
|
|
||||||
Enabling HTTPS communication between Image service and Bare Metal service
|
Enabling HTTPS communication between Image service and Bare Metal service
|
||||||
=========================================================================
|
=========================================================================
|
||||||
|
|
||||||
This section describes the steps needed to enable secure HTTPS communication between
|
The `Enabling HTTPS communication between Image service and Bare Metal
|
||||||
Image service and Bare Metal service.
|
service`_ section has been moved to the Bare Metal service Install Guide.
|
||||||
|
|
||||||
To enable secure HTTPS communication between Bare Metal service and Image service follow these steps:
|
.. _`Enabling HTTPS communication between Image service and Bare Metal service`: http://docs.openstack.org/project-install-guide/baremetal/draft/enabling-https.html#enabling-https-communication-between-image-service-and-bare-metal-service
|
||||||
|
|
||||||
#. Edit ``/etc/ironic/ironic.conf``::
|
|
||||||
|
|
||||||
[glance]
|
|
||||||
...
|
|
||||||
glance_cafile=/path/to/certfile
|
|
||||||
glance_protocol=https
|
|
||||||
glance_api_insecure=False
|
|
||||||
|
|
||||||
.. note::
|
|
||||||
'glance_cafile' is a optional path to a CA certificate bundle to be used to validate the SSL certificate
|
|
||||||
served by Image service.
|
|
||||||
|
|
||||||
#. Restart ironic-conductor service::
|
|
||||||
|
|
||||||
Fedora/RHEL7/CentOS7:
|
|
||||||
sudo systemctl restart openstack-ironic-conductor
|
|
||||||
|
|
||||||
Debian/Ubuntu:
|
|
||||||
sudo service ironic-conductor restart
|
|
||||||
|
|
||||||
Using Bare Metal service as a standalone service
|
Using Bare Metal service as a standalone service
|
||||||
================================================
|
================================================
|
||||||
|
|
||||||
Starting with the Kilo release, it's possible to use Bare Metal service without
|
|
||||||
other OpenStack services.
|
|
||||||
|
|
||||||
You should make the following changes to ``/etc/ironic/ironic.conf``:
|
The `Using Bare Metal service as a standalone service`_ section has been moved
|
||||||
|
to the Bare Metal service Install Guide.
|
||||||
|
|
||||||
#. To disable usage of Identity service tokens::
|
.. _`Using Bare Metal service as a standalone service`: http://docs.openstack.org/project-install-guide/baremetal/draft/standalone.html
|
||||||
|
|
||||||
[DEFAULT]
|
|
||||||
...
|
|
||||||
auth_strategy=none
|
|
||||||
|
|
||||||
#. If you want to disable the Networking service, you should have your network
|
|
||||||
pre-configured to serve DHCP and TFTP for machines that you're deploying.
|
|
||||||
To disable it, change the following lines::
|
|
||||||
|
|
||||||
[dhcp]
|
|
||||||
...
|
|
||||||
dhcp_provider=none
|
|
||||||
|
|
||||||
.. note::
|
|
||||||
If you disabled the Networking service and the driver that you use is
|
|
||||||
supported by at most one conductor, PXE boot will still work for your
|
|
||||||
nodes without any manual config editing. This is because you know all
|
|
||||||
the DHCP options that will be used for deployment and can set up your
|
|
||||||
DHCP server appropriately.
|
|
||||||
|
|
||||||
If you have multiple conductors per driver, it would be better to use
|
|
||||||
Networking since it will do all the dynamically changing configurations
|
|
||||||
for you.
|
|
||||||
|
|
||||||
If you don't use Image service, it's possible to provide images to Bare Metal
|
|
||||||
service via hrefs.
|
|
||||||
|
|
||||||
.. note::
|
|
||||||
At the moment, only two types of hrefs are acceptable instead of Image
|
|
||||||
service UUIDs: HTTP(S) hrefs (for example, "http://my.server.net/images/img")
|
|
||||||
and file hrefs (file:///images/img).
|
|
||||||
|
|
||||||
There are however some limitations for different drivers:
|
|
||||||
|
|
||||||
* If you're using one of the drivers that use agent deploy method (namely,
|
|
||||||
``agent_ilo``, ``agent_ipmitool``, ``agent_pyghmi``, ``agent_ssh`` or
|
|
||||||
``agent_vbox``) you have to know MD5 checksum for your instance image. To
|
|
||||||
compute it, you can use the following command::
|
|
||||||
|
|
||||||
md5sum image.qcow2
|
|
||||||
ed82def8730f394fb85aef8a208635f6 image.qcow2
|
|
||||||
|
|
||||||
Apart from that, because of the way the agent deploy method works, image
|
|
||||||
hrefs can use only HTTP(S) protocol.
|
|
||||||
|
|
||||||
* If you're using ``iscsi_ilo`` or ``agent_ilo`` driver, Object Storage service
|
|
||||||
is required, as these drivers need to store floppy image that is used to pass
|
|
||||||
parameters to deployment iso. For this method also only HTTP(S) hrefs are
|
|
||||||
acceptable, as HP iLO servers cannot attach other types of hrefs as virtual
|
|
||||||
media.
|
|
||||||
|
|
||||||
* Other drivers use PXE deploy method and there are no special requirements
|
|
||||||
in this case.
|
|
||||||
|
|
||||||
Steps to start a deployment are pretty similar to those when using Compute:
|
|
||||||
|
|
||||||
#. To use the `ironic CLI <http://docs.openstack.org/developer/python-ironicclient/cli.html>`_,
|
|
||||||
set up these environment variables. Since no authentication strategy is
|
|
||||||
being used, the value can be any string for OS_AUTH_TOKEN. IRONIC_URL is
|
|
||||||
the URL of the ironic-api process.
|
|
||||||
For example::
|
|
||||||
|
|
||||||
export OS_AUTH_TOKEN=fake-token
|
|
||||||
export IRONIC_URL=http://localhost:6385/
|
|
||||||
|
|
||||||
#. Create a node in Bare Metal service. At minimum, you must specify the driver
|
|
||||||
name (for example, "pxe_ipmitool"). You can also specify all the required
|
|
||||||
driver parameters in one command. This will return the node UUID::
|
|
||||||
|
|
||||||
ironic node-create -d pxe_ipmitool -i ipmi_address=ipmi.server.net \
|
|
||||||
-i ipmi_username=user -i ipmi_password=pass \
|
|
||||||
-i deploy_kernel=file:///images/deploy.vmlinuz \
|
|
||||||
-i deploy_ramdisk=http://my.server.net/images/deploy.ramdisk
|
|
||||||
|
|
||||||
+--------------+--------------------------------------------------------------------------+
|
|
||||||
| Property | Value |
|
|
||||||
+--------------+--------------------------------------------------------------------------+
|
|
||||||
| uuid | be94df40-b80a-4f63-b92b-e9368ee8d14c |
|
|
||||||
| driver_info | {u'deploy_ramdisk': u'http://my.server.net/images/deploy.ramdisk', |
|
|
||||||
| | u'deploy_kernel': u'file:///images/deploy.vmlinuz', u'ipmi_address': |
|
|
||||||
| | u'ipmi.server.net', u'ipmi_username': u'user', u'ipmi_password': |
|
|
||||||
| | u'******'} |
|
|
||||||
| extra | {} |
|
|
||||||
| driver | pxe_ipmitool |
|
|
||||||
| chassis_uuid | |
|
|
||||||
| properties | {} |
|
|
||||||
+--------------+--------------------------------------------------------------------------+
|
|
||||||
|
|
||||||
Note that here deploy_kernel and deploy_ramdisk contain links to
|
|
||||||
images instead of Image service UUIDs.
|
|
||||||
|
|
||||||
#. As in case of Compute service, you can also provide ``capabilities`` to node
|
|
||||||
properties, but they will be used only by Bare Metal service (for example,
|
|
||||||
boot mode). Although you don't need to add properties like ``memory_mb``,
|
|
||||||
``cpus`` etc. as Bare Metal service will require UUID of a node you're
|
|
||||||
going to deploy.
|
|
||||||
|
|
||||||
#. Then create a port to inform Bare Metal service of the network interface
|
|
||||||
cards which are part of the node by creating a port with each NIC's MAC
|
|
||||||
address. In this case, they're used for naming of PXE configs for a node::
|
|
||||||
|
|
||||||
ironic port-create -n $NODE_UUID -a $MAC_ADDRESS
|
|
||||||
|
|
||||||
#. As there is no Compute service flavor and instance image is not provided with
|
|
||||||
nova boot command, you also need to specify some fields in ``instance_info``.
|
|
||||||
For PXE deployment, they are ``image_source``, ``kernel``, ``ramdisk``,
|
|
||||||
``root_gb``::
|
|
||||||
|
|
||||||
ironic node-update $NODE_UUID add instance_info/image_source=$IMG \
|
|
||||||
instance_info/kernel=$KERNEL instance_info/ramdisk=$RAMDISK \
|
|
||||||
instance_info/root_gb=10
|
|
||||||
|
|
||||||
Here $IMG, $KERNEL, $RAMDISK can also be HTTP(S) or file hrefs. For agent
|
|
||||||
drivers, you don't need to specify kernel and ramdisk, but MD5 checksum of
|
|
||||||
instance image is required::
|
|
||||||
|
|
||||||
ironic node-update $NODE_UUID add instance_info/image_checksum=$MD5HASH
|
|
||||||
|
|
||||||
#. Validate that all parameters are correct::
|
|
||||||
|
|
||||||
ironic node-validate $NODE_UUID
|
|
||||||
|
|
||||||
+------------+--------+----------------------------------------------------------------+
|
|
||||||
| Interface | Result | Reason |
|
|
||||||
+------------+--------+----------------------------------------------------------------+
|
|
||||||
| console | False | Missing 'ipmi_terminal_port' parameter in node's driver_info. |
|
|
||||||
| deploy | True | |
|
|
||||||
| management | True | |
|
|
||||||
| power | True | |
|
|
||||||
+------------+--------+----------------------------------------------------------------+
|
|
||||||
|
|
||||||
#. Now you can start the deployment, run::
|
|
||||||
|
|
||||||
ironic node-set-provision-state $NODE_UUID active
|
|
||||||
|
|
||||||
You can manage provisioning by issuing this command. Valid provision states
|
|
||||||
are ``active``, ``rebuild`` and ``deleted``.
|
|
||||||
|
|
||||||
For iLO drivers, fields that should be provided are:
|
|
||||||
|
|
||||||
* ``ilo_deploy_iso`` under ``driver_info``;
|
|
||||||
|
|
||||||
* ``ilo_boot_iso``, ``image_source``, ``root_gb`` under ``instance_info``.
|
|
||||||
|
|
||||||
.. note::
|
|
||||||
Before Liberty release Ironic was not able to track non-Glance images'
|
|
||||||
content changes. Starting with Liberty, it is possible to do so using image
|
|
||||||
modification date. For example, for HTTP image, if 'Last-Modified' header
|
|
||||||
value from response to a HEAD request to
|
|
||||||
"http://my.server.net/images/deploy.ramdisk" is greater than cached image
|
|
||||||
modification time, Ironic will re-download the content. For "file://"
|
|
||||||
images, the file system modification time is used.
|
|
||||||
|
|
||||||
|
|
||||||
Other references
|
|
||||||
----------------
|
|
||||||
|
|
||||||
* `Enabling local boot without Compute`_
|
|
||||||
|
|
||||||
.. _`Enabling local boot without Compute`: http://docs.openstack.org/project-install-guide/baremetal/draft/local-boot-partition-images.html#enabling-local-boot-without-compute
|
.. _`Enabling local boot without Compute`: http://docs.openstack.org/project-install-guide/baremetal/draft/local-boot-partition-images.html#enabling-local-boot-without-compute
|
||||||
|
|
||||||
|
|||||||
@ -4,3 +4,5 @@ Advanced features
|
|||||||
~~~~~~~~~~~~~~~~~
|
~~~~~~~~~~~~~~~~~
|
||||||
|
|
||||||
.. include:: include/local-boot-partition-images.rst
|
.. include:: include/local-boot-partition-images.rst
|
||||||
|
|
||||||
|
.. include:: include/root-device-hints.rst
|
||||||
|
|||||||
89
install-guide/source/enabling-https.rst
Normal file
89
install-guide/source/enabling-https.rst
Normal file
@ -0,0 +1,89 @@
|
|||||||
|
.. _enabling-https:
|
||||||
|
|
||||||
|
Enabling HTTPS
|
||||||
|
--------------
|
||||||
|
|
||||||
|
.. _EnableHTTPSinSwift:
|
||||||
|
|
||||||
|
Enabling HTTPS in Swift
|
||||||
|
=======================
|
||||||
|
|
||||||
|
The drivers using virtual media use swift for storing boot images
|
||||||
|
and node configuration information (contains sensitive information for Ironic
|
||||||
|
conductor to provision bare metal hardware). By default, HTTPS is not enabled
|
||||||
|
in swift. HTTPS is required to encrypt all communication between swift and Ironic
|
||||||
|
conductor and swift and bare metal (via virtual media). It can be enabled in one
|
||||||
|
of the following ways:
|
||||||
|
|
||||||
|
* `Using an SSL termination proxy
|
||||||
|
<http://docs.openstack.org/security-guide/secure-communication/tls-proxies-and-http-services.html>`_
|
||||||
|
|
||||||
|
* `Using native SSL support in swift
|
||||||
|
<http://docs.openstack.org/developer/swift/deployment_guide.html>`_
|
||||||
|
(recommended only for testing purpose by swift).
|
||||||
|
|
||||||
|
.. _EnableHTTPSinGlance:
|
||||||
|
|
||||||
|
Enabling HTTPS in Image service
|
||||||
|
===============================
|
||||||
|
|
||||||
|
Ironic drivers usually use Image service during node provisioning. By default,
|
||||||
|
image service does not use HTTPS, but it is required for secure communication.
|
||||||
|
It can be enabled by making the following changes to ``/etc/glance/glance-api.conf``:
|
||||||
|
|
||||||
|
#. `Configuring SSL support
|
||||||
|
<http://docs.openstack.org/developer/glance/configuring.html#configuring-ssl-support>`_
|
||||||
|
|
||||||
|
#. Restart the glance-api service::
|
||||||
|
|
||||||
|
Fedora/RHEL7/CentOS7:
|
||||||
|
sudo systemctl restart openstack-glance-api
|
||||||
|
|
||||||
|
Debian/Ubuntu:
|
||||||
|
sudo service glance-api restart
|
||||||
|
|
||||||
|
See the `Glance <http://docs.openstack.org/developer/glance/>`_ documentation,
|
||||||
|
for more details on the Image service.
|
||||||
|
|
||||||
|
Enabling HTTPS communication between Image service and Object storage
|
||||||
|
=====================================================================
|
||||||
|
|
||||||
|
This section describes the steps needed to enable secure HTTPS communication between
|
||||||
|
Image service and Object storage when Object storage is used as the Backend.
|
||||||
|
|
||||||
|
To enable secure HTTPS communication between Image service and Object storage follow these steps:
|
||||||
|
|
||||||
|
#. :ref:`EnableHTTPSinSwift`
|
||||||
|
|
||||||
|
#. `Configure Swift Storage Backend
|
||||||
|
<http://docs.openstack.org/developer/glance/configuring.html#configuring-the-swift-storage-backend>`_
|
||||||
|
|
||||||
|
#. :ref:`EnableHTTPSinGlance`
|
||||||
|
|
||||||
|
Enabling HTTPS communication between Image service and Bare Metal service
|
||||||
|
=========================================================================
|
||||||
|
|
||||||
|
This section describes the steps needed to enable secure HTTPS communication between
|
||||||
|
Image service and Bare Metal service.
|
||||||
|
|
||||||
|
To enable secure HTTPS communication between Bare Metal service and Image service follow these steps:
|
||||||
|
|
||||||
|
#. Edit ``/etc/ironic/ironic.conf``::
|
||||||
|
|
||||||
|
[glance]
|
||||||
|
...
|
||||||
|
glance_cafile=/path/to/certfile
|
||||||
|
glance_protocol=https
|
||||||
|
glance_api_insecure=False
|
||||||
|
|
||||||
|
.. note::
|
||||||
|
'glance_cafile' is a optional path to a CA certificate bundle to be used to validate the SSL certificate
|
||||||
|
served by Image service.
|
||||||
|
|
||||||
|
#. Restart ironic-conductor service::
|
||||||
|
|
||||||
|
Fedora/RHEL7/CentOS7:
|
||||||
|
sudo systemctl restart openstack-ironic-conductor
|
||||||
|
|
||||||
|
Debian/Ubuntu:
|
||||||
|
sudo service ironic-conductor restart
|
||||||
@ -45,6 +45,7 @@ an ``extra_spec`` to the Compute service flavor, for example::
|
|||||||
``gpt``. The ``EFI partition`` will be used later by the boot loader
|
``gpt``. The ``EFI partition`` will be used later by the boot loader
|
||||||
(which is installed from the deploy ramdisk).
|
(which is installed from the deploy ramdisk).
|
||||||
|
|
||||||
|
.. _local-boot-without-compute:
|
||||||
|
|
||||||
Enabling local boot without Compute
|
Enabling local boot without Compute
|
||||||
===================================
|
===================================
|
||||||
|
|||||||
51
install-guide/source/include/root-device-hints.rst
Normal file
51
install-guide/source/include/root-device-hints.rst
Normal file
@ -0,0 +1,51 @@
|
|||||||
|
.. _root-device-hints:
|
||||||
|
|
||||||
|
Specifying the disk for deployment (root device hints)
|
||||||
|
------------------------------------------------------
|
||||||
|
|
||||||
|
Starting with the Kilo release, Bare Metal service supports passing
|
||||||
|
hints to the deploy ramdisk about which disk it should pick for the
|
||||||
|
deployment. The list of support hints is:
|
||||||
|
|
||||||
|
* model (STRING): device identifier
|
||||||
|
* vendor (STRING): device vendor
|
||||||
|
* serial (STRING): disk serial number
|
||||||
|
* size (INT): size of the device in GiB
|
||||||
|
|
||||||
|
.. note::
|
||||||
|
A node's 'local_gb' property is often set to a value 1 GiB less than the
|
||||||
|
actual disk size to account for partitioning (this is how DevStack, TripleO
|
||||||
|
and Ironic Inspector work, to name a few). However, in this case ``size``
|
||||||
|
should be the actual size. For example, for a 128 GiB disk ``local_gb``
|
||||||
|
will be 127, but size hint will be 128.
|
||||||
|
|
||||||
|
* wwn (STRING): unique storage identifier
|
||||||
|
* wwn_with_extension (STRING): unique storage identifier with the vendor extension appended
|
||||||
|
* wwn_vendor_extension (STRING): unique vendor storage identifier
|
||||||
|
* rotational (BOOLEAN): whether it's a rotational device or not. This
|
||||||
|
hint makes it easier to distinguish HDDs (rotational) and SSDs (not
|
||||||
|
rotational) when choosing which disk Ironic should deploy the image onto.
|
||||||
|
* name (STRING): the device name, e.g /dev/md0
|
||||||
|
|
||||||
|
|
||||||
|
.. warning::
|
||||||
|
The root device hint name should only be used for devices with
|
||||||
|
constant names (e.g RAID volumes). For SATA, SCSI and IDE disk
|
||||||
|
controllers this hint is not recommended because the order in which
|
||||||
|
the device nodes are added in Linux is arbitrary, resulting in
|
||||||
|
devices like /dev/sda and /dev/sdb `switching around at boot time
|
||||||
|
<https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Storage_Administration_Guide/persistent_naming.html>`_.
|
||||||
|
|
||||||
|
|
||||||
|
To associate one or more hints with a node, update the node's properties
|
||||||
|
with a ``root_device`` key, for example::
|
||||||
|
|
||||||
|
ironic node-update <node-uuid> add properties/root_device='{"wwn": "0x4000cca77fc4dba1"}'
|
||||||
|
|
||||||
|
|
||||||
|
That will guarantee that Bare Metal service will pick the disk device that
|
||||||
|
has the ``wwn`` equal to the specified wwn value, or fail the deployment if it
|
||||||
|
can not be found.
|
||||||
|
|
||||||
|
.. note::
|
||||||
|
If multiple hints are specified, a device must satisfy all the hints.
|
||||||
@ -11,6 +11,8 @@ Bare Metal service
|
|||||||
configure-cleaning.rst
|
configure-cleaning.rst
|
||||||
configure-tenant-networks.rst
|
configure-tenant-networks.rst
|
||||||
enrollment.rst
|
enrollment.rst
|
||||||
|
enabling-https.rst
|
||||||
|
standalone.rst
|
||||||
advanced.rst
|
advanced.rst
|
||||||
troubleshooting.rst
|
troubleshooting.rst
|
||||||
next-steps.rst
|
next-steps.rst
|
||||||
|
|||||||
169
install-guide/source/standalone.rst
Normal file
169
install-guide/source/standalone.rst
Normal file
@ -0,0 +1,169 @@
|
|||||||
|
|
||||||
|
Using Bare Metal service as a standalone service
|
||||||
|
================================================
|
||||||
|
|
||||||
|
Starting with the Kilo release, it's possible to use Bare Metal service without
|
||||||
|
other OpenStack services.
|
||||||
|
|
||||||
|
You should make the following changes to ``/etc/ironic/ironic.conf``:
|
||||||
|
|
||||||
|
#. To disable usage of Identity service tokens::
|
||||||
|
|
||||||
|
[DEFAULT]
|
||||||
|
...
|
||||||
|
auth_strategy=none
|
||||||
|
|
||||||
|
#. If you want to disable the Networking service, you should have your network
|
||||||
|
pre-configured to serve DHCP and TFTP for machines that you're deploying.
|
||||||
|
To disable it, change the following lines::
|
||||||
|
|
||||||
|
[dhcp]
|
||||||
|
...
|
||||||
|
dhcp_provider=none
|
||||||
|
|
||||||
|
.. note::
|
||||||
|
If you disabled the Networking service and the driver that you use is
|
||||||
|
supported by at most one conductor, PXE boot will still work for your
|
||||||
|
nodes without any manual config editing. This is because you know all
|
||||||
|
the DHCP options that will be used for deployment and can set up your
|
||||||
|
DHCP server appropriately.
|
||||||
|
|
||||||
|
If you have multiple conductors per driver, it would be better to use
|
||||||
|
Networking since it will do all the dynamically changing configurations
|
||||||
|
for you.
|
||||||
|
|
||||||
|
If you don't use Image service, it's possible to provide images to Bare Metal
|
||||||
|
service via hrefs.
|
||||||
|
|
||||||
|
.. note::
|
||||||
|
At the moment, only two types of hrefs are acceptable instead of Image
|
||||||
|
service UUIDs: HTTP(S) hrefs (for example, "http://my.server.net/images/img")
|
||||||
|
and file hrefs (file:///images/img).
|
||||||
|
|
||||||
|
There are however some limitations for different drivers:
|
||||||
|
|
||||||
|
* If you're using one of the drivers that use agent deploy method (namely,
|
||||||
|
``agent_ilo``, ``agent_ipmitool``, ``agent_pyghmi``, ``agent_ssh`` or
|
||||||
|
``agent_vbox``) you have to know MD5 checksum for your instance image. To
|
||||||
|
compute it, you can use the following command::
|
||||||
|
|
||||||
|
md5sum image.qcow2
|
||||||
|
ed82def8730f394fb85aef8a208635f6 image.qcow2
|
||||||
|
|
||||||
|
Apart from that, because of the way the agent deploy method works, image
|
||||||
|
hrefs can use only HTTP(S) protocol.
|
||||||
|
|
||||||
|
* If you're using ``iscsi_ilo`` or ``agent_ilo`` driver, Object Storage service
|
||||||
|
is required, as these drivers need to store floppy image that is used to pass
|
||||||
|
parameters to deployment iso. For this method also only HTTP(S) hrefs are
|
||||||
|
acceptable, as HP iLO servers cannot attach other types of hrefs as virtual
|
||||||
|
media.
|
||||||
|
|
||||||
|
* Other drivers use PXE deploy method and there are no special requirements
|
||||||
|
in this case.
|
||||||
|
|
||||||
|
Steps to start a deployment are pretty similar to those when using Compute:
|
||||||
|
|
||||||
|
#. To use the `ironic CLI <http://docs.openstack.org/developer/python-ironicclient/cli.html>`_,
|
||||||
|
set up these environment variables. Since no authentication strategy is
|
||||||
|
being used, the value can be any string for OS_AUTH_TOKEN. IRONIC_URL is
|
||||||
|
the URL of the ironic-api process.
|
||||||
|
For example::
|
||||||
|
|
||||||
|
export OS_AUTH_TOKEN=fake-token
|
||||||
|
export IRONIC_URL=http://localhost:6385/
|
||||||
|
|
||||||
|
#. Create a node in Bare Metal service. At minimum, you must specify the driver
|
||||||
|
name (for example, "pxe_ipmitool"). You can also specify all the required
|
||||||
|
driver parameters in one command. This will return the node UUID::
|
||||||
|
|
||||||
|
ironic node-create -d pxe_ipmitool -i ipmi_address=ipmi.server.net \
|
||||||
|
-i ipmi_username=user -i ipmi_password=pass \
|
||||||
|
-i deploy_kernel=file:///images/deploy.vmlinuz \
|
||||||
|
-i deploy_ramdisk=http://my.server.net/images/deploy.ramdisk
|
||||||
|
|
||||||
|
+--------------+--------------------------------------------------------------------------+
|
||||||
|
| Property | Value |
|
||||||
|
+--------------+--------------------------------------------------------------------------+
|
||||||
|
| uuid | be94df40-b80a-4f63-b92b-e9368ee8d14c |
|
||||||
|
| driver_info | {u'deploy_ramdisk': u'http://my.server.net/images/deploy.ramdisk', |
|
||||||
|
| | u'deploy_kernel': u'file:///images/deploy.vmlinuz', u'ipmi_address': |
|
||||||
|
| | u'ipmi.server.net', u'ipmi_username': u'user', u'ipmi_password': |
|
||||||
|
| | u'******'} |
|
||||||
|
| extra | {} |
|
||||||
|
| driver | pxe_ipmitool |
|
||||||
|
| chassis_uuid | |
|
||||||
|
| properties | {} |
|
||||||
|
+--------------+--------------------------------------------------------------------------+
|
||||||
|
|
||||||
|
Note that here deploy_kernel and deploy_ramdisk contain links to
|
||||||
|
images instead of Image service UUIDs.
|
||||||
|
|
||||||
|
#. As in case of Compute service, you can also provide ``capabilities`` to node
|
||||||
|
properties, but they will be used only by Bare Metal service (for example,
|
||||||
|
boot mode). Although you don't need to add properties like ``memory_mb``,
|
||||||
|
``cpus`` etc. as Bare Metal service will require UUID of a node you're
|
||||||
|
going to deploy.
|
||||||
|
|
||||||
|
#. Then create a port to inform Bare Metal service of the network interface
|
||||||
|
cards which are part of the node by creating a port with each NIC's MAC
|
||||||
|
address. In this case, they're used for naming of PXE configs for a node::
|
||||||
|
|
||||||
|
ironic port-create -n $NODE_UUID -a $MAC_ADDRESS
|
||||||
|
|
||||||
|
#. As there is no Compute service flavor and instance image is not provided with
|
||||||
|
nova boot command, you also need to specify some fields in ``instance_info``.
|
||||||
|
For PXE deployment, they are ``image_source``, ``kernel``, ``ramdisk``,
|
||||||
|
``root_gb``::
|
||||||
|
|
||||||
|
ironic node-update $NODE_UUID add instance_info/image_source=$IMG \
|
||||||
|
instance_info/kernel=$KERNEL instance_info/ramdisk=$RAMDISK \
|
||||||
|
instance_info/root_gb=10
|
||||||
|
|
||||||
|
Here $IMG, $KERNEL, $RAMDISK can also be HTTP(S) or file hrefs. For agent
|
||||||
|
drivers, you don't need to specify kernel and ramdisk, but MD5 checksum of
|
||||||
|
instance image is required::
|
||||||
|
|
||||||
|
ironic node-update $NODE_UUID add instance_info/image_checksum=$MD5HASH
|
||||||
|
|
||||||
|
#. Validate that all parameters are correct::
|
||||||
|
|
||||||
|
ironic node-validate $NODE_UUID
|
||||||
|
|
||||||
|
+------------+--------+----------------------------------------------------------------+
|
||||||
|
| Interface | Result | Reason |
|
||||||
|
+------------+--------+----------------------------------------------------------------+
|
||||||
|
| console | False | Missing 'ipmi_terminal_port' parameter in node's driver_info. |
|
||||||
|
| deploy | True | |
|
||||||
|
| management | True | |
|
||||||
|
| power | True | |
|
||||||
|
+------------+--------+----------------------------------------------------------------+
|
||||||
|
|
||||||
|
#. Now you can start the deployment, run::
|
||||||
|
|
||||||
|
ironic node-set-provision-state $NODE_UUID active
|
||||||
|
|
||||||
|
You can manage provisioning by issuing this command. Valid provision states
|
||||||
|
are ``active``, ``rebuild`` and ``deleted``.
|
||||||
|
|
||||||
|
For iLO drivers, fields that should be provided are:
|
||||||
|
|
||||||
|
* ``ilo_deploy_iso`` under ``driver_info``;
|
||||||
|
|
||||||
|
* ``ilo_boot_iso``, ``image_source``, ``root_gb`` under ``instance_info``.
|
||||||
|
|
||||||
|
.. note::
|
||||||
|
Before Liberty release Ironic was not able to track non-Glance images'
|
||||||
|
content changes. Starting with Liberty, it is possible to do so using image
|
||||||
|
modification date. For example, for HTTP image, if 'Last-Modified' header
|
||||||
|
value from response to a HEAD request to
|
||||||
|
"http://my.server.net/images/deploy.ramdisk" is greater than cached image
|
||||||
|
modification time, Ironic will re-download the content. For "file://"
|
||||||
|
images, the file system modification time is used.
|
||||||
|
|
||||||
|
|
||||||
|
Other references
|
||||||
|
----------------
|
||||||
|
|
||||||
|
* :ref:`local-boot-without-compute`
|
||||||
|
|
||||||
Loading…
Reference in New Issue
Block a user