Home | panticz.de

OpenStack: placement (resource provider)

Install CLI client
https://docs.openstack.org/releasenotes/osc-placement/

pip install openstack-placement

echo 3.5.6 > .python-version

resource provider allocation

RESOURCE_PROVIDER_ID=$(openstack resource provider list --name ${NODE_NAME}.$(hostname -d) -c uuid -f value)
openstack resource provider show --allocations ${RESOURCE_PROVIDER_ID} -c allocations -f json


# list hypervisor
openstack resource provider list --sort-column name

# sow usage
openstack resource provider usage show ${RESOURCE_PROVIDER_ID}

# show
openstack resource provider allocation show ${SERVER_ID}



NODE_NAME=com1-prod.example.com
RESOURCE_PROVIDER_UUID=$(openstack resource provider list --name ${NODE_NAME} -c uuid -f value)
openstack resource provider inventory list ${RESOURCE_PROVIDER_UUID}
openstack resource provider usage show ${RESOURCE_PROVIDER_UUID}


openstack allocation candidate list --resource VCPU=32  --resource DISK_GB=120 --resource MEMORY_MB=4096 --member-of 3f0d0e40-6cf4-422d-a245-ceaffb0ac037

Add resource provider to aggregate

#Add compute node to AZ
openstack aggregate add host az1-aggregate comX-prod

# get resource provider ID
RESOURCE_PROVIDER_ID=$(openstack --os-placement-api-version=1.2 resource provider show XXXXXX-XXXX-XXXX-XXXX-XXXXXX -c uuid -f value)
echo ${RESOURCE_PROVIDER_ID}

# get aggregate ID
AGGREGATE_ID=$(openstack --os-compute-api-version=2.53 aggregate show XXX -c uuid -f value)
echo ${AGGREGATE_ID}

# Add resource provider to that aggregate
openstack --os-placement-api-version=1.2 resource provider aggregate set --aggregate ${AGGREGATE_ID} ${RESOURCE_PROVIDER_ID}

Check multiple / broken resource provider allocation

qemu guest agent

OpenStack admin

openstack image set --property hw_qemu_guest_agent=yes ${IMAGE_ID}

Within the VM

# check whather hw_qemu_guest_agent is enabled
ls -l /dev/virtio-ports/org.qemu.guest_agent.0

# install qemu-guest-agent
sudo apt-get install -y qemu-guest-agent

supported_commands

docker exec -ti nova_libvirt virsh qemu-agent-command instance-000069d9 '{"execute":"guest-info"}'

Execute command

openstack server show d82ca1de-1fcd-4ca6-84db-84891ec37796 -c OS-EXT-SRV-ATTR:hypervisor_hostname -c OS-EXT-SRV-ATTR:instance_name
docker exec -ti nova_libvirt virsh qemu-agent-command instance-000069d9 '{"execute":"guest-network-get-interfaces"}'

Links
https://www.sebastien-han.fr/blog/2015/02/09/openstack-perform-consistent-snapshots-with-qemu-guest-agent/
https://www.ovh.com/blog/create-and-use-openstack-snapshots/
http://wiki.stoney-cloud.org/wiki/Qemu_Guest_Agent_Integration

Create neutron probe

Install crudini

docker exec -ti -u root neutron_l3_agent apt update
docker exec -ti -u root neutron_l3_agent apt install -y crudini

Create configuration

docker exec -ti neutron_l3_agent bash
umask 077
cat /etc/neutron/neutron.conf > /etc/neutron/debug.ini
crudini --merge /etc/neutron/debug.ini < /etc/neutron/l3_agent.ini

Export credentials

unset HISTFILE
# cat /etc/kolla/admin-openrc.sh
# paste export OS_XXX

Get network ID

SERVER_ID=074e2a72-9bd7-488f-af3d-f45f3bc0b6e7

PORT_ID=$(openstack port list --server ${SERVER_ID} -c id -f value)
openstack port show ${PORT_ID} -c network_id -f value

Create probe

neutron-debug --config-file /etc/neutron/debug.ini probe-create ${NETWORK_ID}

Get probe port ID

openstack port list --device-owner network:probe -c id -c binding_host_id -c fixed_ips -c network_id

Test probe (optional)

neutron-debug --config-file /etc/neutron/debug.ini probe-exec ${PROBE_PORT_ID} "ip -br a"

Connect to IP namespace on control node

# list probe namespaces
ip netns | grep qprobe

# connect into IP namespace
ip netns exec qprobe-${PROBE_PORT_ID} bash

Test

neutron-debug probe-exec  dhcping  -s

Delete probe

# delete specific probe
neutron-debug --config-file /etc/neutron/debug.ini probe-delete ${PROBE_PORT_ID}

# deldete all probes
neutron-debug --config-file /etc/neutron/debug.ini probe-clear

Links
https://docs.openstack.org/ocata/cli-reference/neutron-debug.html

Barbican (Secret)

# list all secrets
openstack secret list

# download
openstack secret get https://barbican.service.example.com/v1/secrets/d5794ec0-a86f-420f-8d03-b1b11b4251bd
  --payload_content_type application/octet-stream \
  --file /tmp/file1.out 

# Crate secret / certificate
openstack secret store --name=cert1 -t "application/octet-stream" -e base64 --payload="$(base64 < cert1.p12)"

ACL
https://docs.openstack.org/python-barbicanclient/latest/cli/cli_usage.html

# list allowed user
openstack acl get https://barbican.service.example.com/v1/secrets/1111111-2222-3333-4444-5555555555555

# allow access for user to secret
openstack acl user add -u ${USER_ID} https://barbican.service.example.com/v1/secrets/1111111-2222-3333-4444-5555555555555

Test
https://docs.citrix.com/en-us/citrix-application-delivery-management-software/13/orchestration/integrate-with-openstack-platform/openstack-configuring-lbaasv2-using-command-line.html

barbican secret container create \
    --name="certificate1" \
    --type="certificate" \
    --secret="certificate=https://barbican.service.stage.example.com/v1/secrets/713293b2-e210-43ea-b965-b06351703ff4" \
    --secret="private\_key=http://localhost:9311/v1/secrets/1b9e1a93-2aeb-4101-8002-e52acab987b0"

# allow access
openstack acl user add --user ${USER_ID} --project-access --operation-type read ${SECRET_ID}
openstack acl get ${SECRET_ID}

Links
https://access.redhat.com/documentation/en-us/red_hat_openstack_platform/13/html/manage_secrets_with_openstack_key_manager/managing_secrets_in_barbican
https://docs.openstack.org/api-guide/key-manager/containers.html#retrieve-container

OpenStack: Debug VM

export OS_ENV=dev
export SERVER_ID=$1

# search for VM by name
if [ ${#SERVER_ID} -ne 36 ]; then
    RESULT="$(openstack server list --all --name ${SERVER_ID})"
    if [ $(echo "${RESULT}" | wc -l) -eq 5 ]; then
        SERVER_ID=$(echo "${RESULT}" | tail -2 | head -1 | cut -d " " -f2)
    else
        echo "No VM with name ${SERVER_ID}) found, similar VMs:"
        echo "${RESULT}"
        exit 0
    fi
fi

RESULT=$(openstack server show ${SERVER_ID} -f value -c id)
if [ -z "${RESULT}" ]; then
    echo "Server UUID ${SERVER_ID} not found"
    exit 0
fi

echo -e "\e[34mVM:"
openstack server show -c name -c id -c addresses -c OS-EXT-SRV-ATTR:host -c status ${SERVER_ID}

echo -e "\n\e[34mProject:"
PROJECT_ID=$(openstack server show -c project_id -f value ${SERVER_ID})
openstack project show -c id -c name -c description ${PROJECT_ID}

echo -e "\n\e[34mDomain:"
DOMAIN_ID=$(openstack project show -c domain_id -f value ${PROJECT_ID})
openstack domain show -c id -c name -c description ${DOMAIN_ID}

echo -e "\n\e[34mServer:"
openstack server show ${SERVER_ID}

echo -e "\n\e[34mConsole:"
openstack console url show ${SERVER_ID}

echo -e "\n\e[34mEvents:"
openstack server event list ${SERVER_ID}

echo -e "\n\e[34mMigrations:"
openstack server migration list --server ${SERVER_ID} --sort-column 'Updated At'

echo -e "\n\e[34mVM Port(s):"
#nova interface-list ${SERVER_ID}
openstack port list --server ${SERVER_ID} --long
PORT_IDS=$(openstack port list --server ${SERVER_ID} -c id -f value)

for PORT_ID in ${PORT_IDS}; do
    NETWORK_ID=$(openstack port show ${PORT_ID} -c network_id -f value)

Allow (temprary) incomming ping to VM (icmp traffic)

SERVER_ID=51f8bbe2-4a89-4065-a24f-4a6fa47fadd0

PORT_ID=$(openstack port list --server ${SERVER_ID} -c id -f value)
echo ${PORT_ID}

#DEP: SECURITY_GROUP_ID=$(openstack port show ${PORT_ID} -c security_group_ids -f json | jq -r .security_group_ids |  tr ',' '\n' | head -1)
SECURITY_GROUP_ID=$(openstack port show ${PORT_ID} -c security_group_ids -f json | jq -r 'first(.security_group_ids[])')
echo ${SECURITY_GROUP_ID}
# openstack security group show ${SECURITY_GROUP_ID}

# create security group rule to allow incomming icmp traffic
SECURITY_GROUP_RULE_ID=$(openstack security group rule create --protocol icmp ${SECURITY_GROUP_ID} -c id -f value)
echo ${SECURITY_GROUP_RULE_ID}
openstack security group rule show ${SECURITY_GROUP_RULE_ID}

# remove rule
openstack security group rule delete ${SECURITY_GROUP_RULE_ID}

RabbitMQ

Connect to control node(s)

# show container state
docker ps -a | grep rabbitmq

# Connect into RabbitMQ Docker container
docker exec -it rabbitmq bash

RabbitMQ state

# Show status
rabbitmqctl status

# Show cluster status
rabbitmqctl cluster_status

# Show list_queues
rabbitmqctl list_queues

CLI

# Start the App
rabbitmqctl start_app 

# Stop the App
rabbitmqctl stop_app

# Reset the App
rabbitmqctl reset

# Force reset
rabbitmqctl force_reset

# Join the cluster
rabbitmqctl join_cluster rabbit@ctl2-stage

# Start the App
rabbitmqctl start_app

# forget node
rabbitmqctl forget_cluster_node rabbit@nodeX
rabbitmqctl join_cluster rabbit@nodeX

# cleanup / remove all data
docker exec -it rabbitmq bash
rm -r /var/lib/rabbitmq/*
docker restart rabbitmq

Statistics

rabbitmq-diagnostics observer

OpenStack: port

Identify port by MAC

MAC=00:11:22:33:44:55
openstack port list --mac-address ${MAC}

SUBNET_ID=b07b6b7a-dfb2-4b58-82cb-1568da8990b3
openstack subnet show ${SUBNET_ID}

PROJECT_ID=701e329e-997d-4dfa-b0d0-27a51670ed2d
openstack project show ${PROJECT_ID}

Add security group to port

SERVER_ID=$(openstack server list --all-projects --name vm1-dev -c ID -f value)
openstack port list --server ${SERVER_ID}
PORT_ID=97006537-07b1-4d37-9e2e-3bb71ad23087
openstack port set --security-group 2060fc87-a1bf-4cf5-a497-f6c4b45cffcd ${PORT_ID}

Disable port security for a specific port

openstack port list --server ${SERVER_ID}

PORT_ID=fab25396-b3ac-477d-bbcd-7668a4e5f59c
openstack port set --no-security-group --disable-port-security ${PORT_ID}

OpenStack: Create certbot VM

Create VM

openstack server create foo-certbot \
    --image "Ubuntu 18.04" \
    --flavor m1.small \
    --key-name foo-key \
    --network foo-net \
    --security-group foo-sec

Add floating IP

FLOATING_IP=$(openstack floating ip create public -c floating_ip_address -f value)
echo ${FLOATING_IP}
openstack server add floating ip foo-certbot ${FLOATING_IP}

Install certbot

ssh ubuntu@${FLOATING_IP} sudo apt update && sudo apt install -y certbot

Create wildcard certificates

export DOMAINS="
dev.example.com
www.example.com
"

for DOMAIN in ${DOMAINS}; do
    sudo certbot certonly \
    --manual \
    --manual-public-ip-logging-ok \
    --register-unsafely-without-email \
    --agree-tos \
    --preferred-challenges dns-01 \
    --server https://acme-v02.api.letsencrypt.org/directory \
    -d \*.${DOMAIN}
done

Debug

watch dig TXT _acme-challenge.dev.example.com

for DOMAIN in ${DOMAINS}; do
    dig TXT _acme-challenge.${DOMAIN}
done | egrep '^_acme-challenge'

Update OpenStack Glance images

Upload new image(s)

IMGDIR=/var/www/images

# Windows Server 2016 Standard
openstack image create "Windows Server 2016 Standard (NEW)" \
    --file ${IMGDIR}/windows-server-2016-standard.raw \
    --disk-format raw \
    --min-disk 20 \
    --min-ram 2048 \
    --community \
    --property hw_scsi_model=virtio-scsi \
    --property hw_disk_bus=scsi \
    --property hw_qemu_guest_agent=yes \
    --property os_distro=windows \
    --property os_admin_user=Administrator \
    --property os_version="2016" \
    --property os_build="14393.3384"
#    --protected \

openstack image set --protected "Windows Server 2016 Standard"


# Windows Server 2019 Standard
openstack image create "Windows Server 2019 Standard (NEW)" \
    --file $IMGDIR/windows-server-2019-standard.raw \
    --disk-format raw \
    --min-disk 20 \
    --min-ram 2048 \
    --community \
    --property hw_scsi_model=virtio-scsi \
    --property hw_disk_bus=scsi \
    --property hw_qemu_guest_agent=yes \
    --property os_distro=windows \
    --property os_admin_user=Administrator \
    --property os_version="2019" \
    --property os_build="17763.914"
#    --protected \

openstack image set --protected "Windows Server 2019 Standard"

Show community images (unprivileged user