# create image from iso
openstack image create --file /tmp/ubuntu-24.04.1-live-server-amd64.iso --disk-format iso --progress ubuntu-24.04.1-live-server-amd64.iso

# create volume for the final VM
openstack volume create test-vm1-vol1 --size 10 --bootable

# create temporary installation VM
openstack server create test-vm1-inst --image ubuntu-24.04.1-live-server-amd64.iso --flavor m1.small --key-name test-keypair --network test-network

# attach volume to temporary VM
openstack server add volume test-vm1-inst test-vm1-vol1

# show console url from temporary VM
openstack console url show -c url -f value test-vm1-inst

# install OS in console

# delete temporary VM
openstack server stop test-vm1-inst
openstack server delete test-vm1-inst

# create final VM
openstack server create test-vm1 --volume test-vm1-vol1 --flavor m1.small --key-name test-keypair --network test-network
openstack console url show -c url -f value test-vm1

# remove iso imagge
openstack image delete ubuntu-24.04.1-live-server-amd64.iso

Links
https://openmetal.io/docs/manuals/tutorials/understanding-iso-images

Prerequisites
- Terraform instalation
- Ansible instalation
- OpenStack application credentials (~/.config/openstack/clouds.yaml)
- OpenStack security group with allow ingress traffic to TCP 22 (SSH) from terraform node

main.tf

terraform {
  required_providers {
    openstack = {
      source = "terraform-provider-openstack/openstack"
    }

    ansible = {
      source = "ansible/ansible"
    }
  }
}

provider "openstack" {
  cloud = "test-application-credentials"
}

data "openstack_compute_keypair_v2" "keypair_1" {
  name = "test-keypair"
}

data "openstack_networking_network_v2" "network_1" {
  name = "test-network"
}

data "openstack_networking_secgroup_v2" "secgroup_1" {
  # Ensure that the security group allow ingress to TCP 22 (SSH) from terraform node
  name = "test-secgroup" 
}

data "openstack_networking_port_v2" "port_1" {
  device_id  = openstack_compute_instance_v2.instance_1.id
  network_id = openstack_compute_instance_v2.instance_1.network.0.uuid
}

# data "template_file" "user_data" {
#   template = <

<strong>test-playbook.yml</strong>
<code>
---
- name: Deploy webserver(s)
  hosts: www
  # remote_user: ubuntu
  gather_facts: no
  become: true
  pre_tasks:
    - name: Wait util host is reachable by SSH
      wait_for_connection:
        timeout: 300

    - name: Gether facts
      setup:
  tasks:
    - name: Install nginx
      apt:
        update_cache: yes
        name:
          - nginx

Deploy

terraform init
terraform apply -auto-approve

Ansible Provider
https://github.com/ansible/terraform-provider-ansible
https://registry.terraform.io/providers/ansible/ansible/latest/docs

Links
https://www.redhat.com/en/blog/providing-terraform-with-that-ansible-magic

Prerequisites
Install OpenStack CLI client (OSC)
http://www.panticz.de/osc

OpenStack Application credentials
~/.config/openstack/clouds.yaml

Generate Lets Encrypt certificate

sudo apt install -y certbot

pyenv activate osc
pip install python-designateclient certbot-dns-openstack zope

# list available zones
openstack zone list

# Create letsencrypt directory
mkdir ~/letsencrypt

# Request wildcard certificate
DOMAIN=example.com
certbot -a dns-openstack certonly \
    --agree-tos \
    --register-unsafely-without-email \
    --work-dir ~/letsencrypt/work \
    --config-dir ~/letsencrypt/etc \
    --logs-dir ~/letsencrypt/log \
    --dns-openstack-propagation-seconds 60 \
    -d *.${DOMAIN}
#    -d *.example.com,example.com

# List certificates
ls -l ~/letsencrypt/etc/archive/*/*

DEBUG (second terminal)

watch -n1 openstack recordset list example.com

Links
https://docs.binero.com/guides/designate-as-authenticator-for-lets-encrypt.html
https://letsencrypt.org/docs/challenge-types/

# Create router
openstack router create test-router1 \
  --centralized \
  --ha \
  --external-gateway public

# Show available tenant IPv6 subnet
openstack subnet pool list --share | grep tenant-subnet-pool-v6

# Create network
openstack network create test-network1

# DUAL-STACK: Create IPv4 subnet (skip for IPv6 only)
openstack subnet create test-subnet1-ipv4 \
  --network test-network1 \
  --subnet-range 10.11.12.0/24

# DUAL-STACK: Attach IPv4 subnet to router (skip for IPv6 only)
openstack router add subnet test-router1 test-subnet1-ipv4

# Create IPv6 subnet
openstack subnet create test-subnet1-ipv6 \
  --network test-network1 \
  --ip-version 6 \
  --subnet-pool tenant-subnet-pool-v6 \
  --prefix-length 64 \
  --ipv6-ra-mode dhcpv6-stateless \
  --ipv6-address-mode dhcpv6-stateless

# Attach IPv6 subnet to router
openstack router add subnet test-router1 test-subnet1-ipv6

# OPTINAL: allow access from outside
SECURITY_GROUP=test-secgroup
openstack security group create ${SECURITY_GROUP}

# DUAL-STACK: allow access to Floating FIP from outside (skip for IPv6 only)
openstack security group rule create ${SECURITY_GROUP} --ethertype IPv4 --protocol icmp --ingress --remote-ip 0.0.0.0/0
openstack security group rule create ${SECURITY_GROUP} --ethertype IPv4 --protocol icmp --egress --remote-ip 0.0.0.0/0
openstack security group rule create ${SECURITY_GROUP} --ethertype IPv4 --protocol tcp --dst-port 22 --remote-ip 0.0.0.0/0

LEFT (DEV env)

Enable iommu in BIOS

Get MMUI groups

shopt -s nullglob
for g in $(find /sys/kernel/iommu_groups/* -maxdepth 0 -type d | sort -V); do
    echo "IOMMU Group ${g##*/}:"
    for d in $g/devices/*; do
        echo -e "\t$(lspci -nns ${d##*/})"
    done;
done;

Configure compute node

NVIDIA_PCI_ID=$(lspci -nn | grep NVIDIA | cut -d "[" -f3 | cut -d "]" -f1)

echo "blacklist nouveau" >> /etc/modprobe.d/blacklist-nvidia.conf
echo "blacklist nvidiafb" >> /etc/modprobe.d/blacklist-nvidia.conf
echo vfio-pci >> /etc/modules-load.d/vfio-pci.conf
# configure all PCI IDs (also Audio device from same MMUI group as ids=10de:xxxx,10de:xxxx
echo options vfio-pci ids=${NVIDIA_PCI_ID} >> /etc/modprobe.d/gpu-vfio.conf

#sed -i 's/GRUB_CMDLINE_LINUX_DEFAULT=.*/GRUB_CMDLINE_LINUX_DEFAULT="amd_iommu=on iommu=pt"/g' /etc/default/grub

cat < /etc/default/grub.d/gpu.cfg
GRUB_CMDLINE_LINUX_DEFAULT="\$GRUB_CMDLINE_LINUX_DEFAULT amd_iommu=on iommu=pt kvm.ignore_msrs=1 default_hugepagesz=2M hugepagesz=1G hugepages=160 hugepagesz=2M hugepages=2048 transparent_hugepage=never"
EOF


update-grub

reboot

#/etc/modprobe.d/kvm.conf
#options kvm ignore_msrs=Y

#echo "options vfio-pci ids=${NVIDIA_PCI_ID}" >> /etc/modprobe.d/vfio.conf
#echo "softdep drm pre: vfio-pci" >> /etc/modprobe.d/vfio.conf
#echo "options kvm ignore_msrs=1" >> /etc/modprobe.d/kvm.conf
#echo "vfio vfio_iommu_type1 vfio_virqfd vfio_pci ids=${NVIDIA_PCI_ID}" >> /etc/initramfs-tools/modules
#echo GRUB_CMDLINE_LINUX_DEFAULT=\"intel_iommu=on vfio-pci.ids=${NVIDIA_PCI_ID} vfio_iommu_type1.allow_unsafe_interrupts=1 modprobe.blacklist=nvidiafb,nouveau\" >> /etc/default/grub
#echo GRUB_CMDLINE_LINUX_DEFAULT=\"amd_iommu=on vfio-pci.ids=${NVIDIA_PCI_ID} vfio_iommu_type1.allow_unsafe_interrupts=1 modprobe.blacklist=nvidiafb,nouveau\" >> /etc/default/grub
#echo 'GRUB_CMDLINE_LINUX_DEFAULT="amd_iommu=on kvm.ignore_msrs=1 vfio-pci.ids=10de:27b8"' >> /etc/default/grub
#echo 'GRUB_CMDLINE_LINUX_DEFAULT="amd_iommu=on kvm.ignore_msrs=1"' >> /etc/default/grub

# iommu=pt

Test whather vfio driver is loaded

FLOATING_IP=1.2.3.4

# search in floating IP table
ROUTER_ID=$(openstack floating ip list --floating-ip-address ${FLOATING_IP} --long -c Router -f value)
if [ -z ${ROUTER_ID} ]; then
    # search in router
    ROUTER_ID=$(openstack router list --long | grep ${FLOATING_IP} | cut -d" " -f2)
fi

PROJECT_ID=$(openstack router show ${ROUTER_ID} -c project_id -f value)

echo -e "\e[34m# Project"
openstack router show ${ROUTER_ID} -c id -c name 

echo
echo -e "\e[34m# Router"
openstack project show ${PROJECT_ID} -c id -c name -c description

echo
echo -e "\e[34m# Router namespaces"
openstack network agent list --router ${ROUTER_ID} --long --sort-column 'HA State'
echo

ROUTER_HOSTS=$(openstack network agent list --router ${ROUTER_ID} --long --sort-column 'HA State' -c Host -f value)
for ROUTER_HOST in ${ROUTER_HOSTS}; do
    echo -e "\e[1m\e[32mssh -t ${ROUTER_HOST} sudo ip netns exec qrouter-${ROUTER_ID} bash"
    ssh ${ROUTER_HOST} sudo ip netns exec qrouter-${ROUTER_ID} ip a | sed -n '/BROADCAST/,$p' | egrep -v "inet6|valid_lft"
    echo
done

SERVER_FIXED_IP=$(openstack floating ip list --floating-ip-address ${FLOATING_IP} -c "Fixed IP Address" -f value 2>/dev/null)
if [ ! -z ${SERVER_FIXED_IP} ]; then
    echo -e "\e[34m# Server"
    openstack server list --all-projects --ip ${SERVER_FIXED_IP}
fi

OpenStack Providery
https://registry.terraform.io/providers/terraform-provider-openstack/openstack/latest/docs

# Configure the OpenStack Provider
provider "openstack" {
  user_name   = "admin"
  tenant_name = "admin"
  password    = "pwd"
  auth_url    = "http://myauthurl:5000/v2.0"
  region      = "RegionOne"
}

# cloud.yaml
provider "openstack" {
  cloud      = "dev-foo"
}

Router
https://registry.terraform.io/providers/terraform-provider-openstack/openstack/latest/docs/resources/networking_router_v2

resource "openstack_networking_router_v2" "router_1" {
  name       = "foo-router"
  external_network_id = "88934cac-8d55-40d5-8ff9-bde65011741d"
}

resource "openstack_networking_router_interface_v2" "terraform" {
  router_id = openstack_networking_router_v2.router_1.id
  subnet_id = openstack_networking_subnet_v2.subnet_1.id
}

Compute
https://registry.terraform.io/providers/terraform-provider-openstack/openstack/latest/docs/resources/compute_instance_v2

resource "openstack_compute_instance_v2" "basic" {
  name            = "basic"
  image_id        = "ad091b52-742f-469e-8f3c-fd81cadf0743"
  flavor_id       = "3"
  key_pair        = "my_key_pair_name"
  security_groups = ["default"]

  metadata = {
    this = "that"
  }

  network {
    name = "my_network"
  }
}

Image

data "openstack_images_image_v2" "image_ubuntu_2204" {
  name = "Ubuntu 22.04"
  most_recent = true
}

Floating IP
# network
https://registry.terraform.io/providers/terraform-provider-openstack/openstack/latest/docs/resources/networking_floatingip_v2
# compute
https://registry.terraform.io/providers/terraform-provider-openstack/openstack/latest/docs/resources/compute_floatingip_v2

resource "openstack_networking_floatingip_v2" "fip_1" {
  pool = "public"
}

resource "openstack_compute_floatingip_associate_v2" "fip_1" {
  floating_ip = openstack_networking_floatingip_v2.fip_1.address
  instance_id = openstack_compute_instance_v2.bastion.id
}

openstack-check.tf

ROUTER_ID=f2d3e40f-cea5-4a2b-bac7-eba0700f449c

# DB
openstack port list --device-owner network:router_gateway --router ${ROUTER_ID} -c id -f value | xargs openstack port show -c binding_host_id -f value

# active
openstack network agent list --router ${ROUTER_ID} --long -f json | jq -r '.[] | select(."HA State" == "active").Host'

ROUTER_IDS=$(openstack router list  -c ID -f value)
for ROUTER_ID in ${ROUTER_IDS}; do
    ROUTER_PORT_ID=$(openstack port list --device-owner network:router_gateway --router ${ROUTER_ID} -c id -f value)
    ROUTER_NODE_DB=""
    if [ ! -z ${ROUTER_PORT_ID} ]; then
        ROUTER_NODE_DB=$(openstack port show ${ROUTER_PORT_ID} -c binding_host_id -f value)    
    fi
    ROUTER_NODE_ACTIVE=$(openstack network agent list --router ${ROUTER_ID} --long -f json | jq -r '.[] | select(."HA State" == "active").Host')

    if [ ":${ROUTER_NODE_DB}:" != ":${ROUTER_NODE_ACTIVE}:" ]; then
        echo "ROUTER_ID: ${ROUTER_ID}"
        echo "ROUTER_NODE_DB: ${ROUTER_NODE_DB}"
        echo "ROUTER_NODE_ACTIVE: ${ROUTER_NODE_ACTIVE}"
        echo
    fi
done