Skip to content

Commit

Permalink
fix linting issues
Browse files Browse the repository at this point in the history
  • Loading branch information
muertos committed Oct 12, 2023
1 parent 5afdb86 commit 7ee9168
Show file tree
Hide file tree
Showing 3 changed files with 40 additions and 8 deletions.
26 changes: 21 additions & 5 deletions docs/tutorials/https-loadbalancer.md
Original file line number Diff line number Diff line change
@@ -1,37 +1,45 @@
---
sidebar_position: 8
---

# Create an HTTPS-Terminated Load Balancer

This guide covers the steps needed to create an HTTPS-terminated load balancer
using the command line.

This guide applies to OpenMetal clouds running OpenStack Yoga with Barbican enabled.

Before starting there are few things to prepare:
* A Python [virtual environment with OpenStackClient installed](docs/operators-manual/day-1/command-line/openstackclient.md)
* Obtain a TLS certificate from an external certficate authority
* Create 2 VMs, ensuring they are on the same network.

- A Python [virtual environment with OpenStackClient installed](docs/operators-manual/day-1/command-line/openstackclient.md)
- Obtain a TLS certificate from an external certficate authority
- Create 2 VMs, ensuring they are on the same network.

Two VMs have been created on a network called `private_net_1`, reachable by
`10.0.0.57` and `10.0.0.250`. NGINX has been installed to each and is listening
on port 80. Security groups for ICMP and HTTP have been added to each VM. A TLS
certificate from an external certificate authority has been acquired.

## Initial Preparation

In your virtual environment, install the `stable/yoga` branch of `python-octaviaclient`:

```sh
pip install git+https://github.com/openstack/python-octaviaclient@stable/yoga
```

The CA certificate chain, TLS certificate, and private key are layed out in a
directory like so:

```sh
$ ls cert
ca-certs.pem server.crt server.key
```

## Procedure

Create a copy of the certificate in PKCS#12 format using `openssl`:

```sh
openssl \
pkcs12 -export \
Expand All @@ -43,6 +51,7 @@ openssl \
```

Store the SSL certificate as a secret using Barbican:

```sh
openstack secret store \
--name='tls_secret1' \
Expand All @@ -52,6 +61,7 @@ openstack secret store \
```

Create the load balancer and ensure it is on the same network as your VMs:

```sh
openstack loadbalancer create \
--name lb1 \
Expand All @@ -60,6 +70,7 @@ openstack loadbalancer create \

Create a listener with protocol `TERMINATED_HTTPS`, listening on port `443`,
using the certificate secret uploaded earlier:

```sh
openstack loadbalancer listener create \
lb1 \
Expand All @@ -70,6 +81,7 @@ openstack loadbalancer listener create \
```

Create a `ROUND_ROBIN` pool using the `HTTP` protocol:

```sh
openstack loadbalancer pool create \
--name pool1 \
Expand All @@ -79,6 +91,7 @@ openstack loadbalancer pool create \
```

Create 2 members using the appropriate IPs for your VMs:

```sh
openstack loadbalancer member create \
--subnet-id private_net_1 \
Expand All @@ -93,11 +106,13 @@ openstack loadbalancer member create \
```

Associate a floating IP to the VIP address of the load balancer:

```sh
$ openstack floating ip set --port d77f97aa-9d33-40c1-b191-1ca549a95075 173.231.202.91
openstack floating ip set --port d77f97aa-9d33-40c1-b191-1ca549a95075 173.231.202.91
```

Show the details of the load balancer:

```sh
$ openstack loadbalancer show lb1
+---------------------+--------------------------------------+
Expand Down Expand Up @@ -127,5 +142,6 @@ $ openstack loadbalancer show lb1
```

## Conclusion

Update the DNS for your FQDN to point to the floating IP address and verify the
load balancer works as expected.
load balancer works as expected.
2 changes: 1 addition & 1 deletion docs/tutorials/install-barbican.md
Original file line number Diff line number Diff line change
Expand Up @@ -87,4 +87,4 @@ first test secret.
| Mode | cbc |
| Expiration | None |
+---------------+--------------------------------------------------------------------------+
```
```
20 changes: 18 additions & 2 deletions docs/tutorials/intro-to-barbican.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@
sidebar_position: 6
---
# Working with OpenStack Barbican

Barbican is the OpenStack Key Manager service. It provides secure storage,
provisioning and management of secret data. This includes keying material such
as Symmetric Keys, Asymmetric Keys, Certificates and raw binary data. In our default Cloud
Expand All @@ -21,17 +22,19 @@ for additional information.

:::info

If Barbican is not installed to your cloud, see our [guide](docs/tutorials/install-barbican.md) or
If Barbican is not installed to your cloud, see our [guide](docs/tutorials/install-barbican.md) or
[submit a support ticket](operators-manual/day-1/intro-to-openmetal-private-cloud.md#how-to-submit-a-support-ticket)
for installation.
:::

## Creator Keystone Role

The `creator` Keystone role is required by non-admin users who wish to use
Barbican to manage secrets. The `admin` role is required to modify the roles of
a user.

Set the creator role using:

```sh
openstack role add creator --user nick --project 966582d3de534089a36cc39a2e5d0ff9
```
Expand All @@ -40,11 +43,15 @@ Alternatively, in Horizon, you can adjust the role for a user by navigating to *
![image](images/manage-members.jpg)

## Encrypted Volume Type

You can create encrypted volumes with Cinder. Before creating an encrypted volume, a new volume type in Cinder must be created. Create a new Encrypted Volume type using:

```sh
openstack volume type create --encryption-provider luks --encryption-cipher aes-xts-plain64 --encryption-key-size 256 --encryption-control-location front-end encrypted
```

Output:

```sh
+-------------+-----------------------------------------------------------------------------------------------------------------------------------------------+
| Field | Value |
Expand All @@ -56,12 +63,17 @@ Output:
| name | encrypted |
+-------------+-----------------------------------------------------------------------------------------------------------------------------------------------+
```

### Encrypted Volume

Create an encrypted volume using:

```sh
openstack volume create --size 10 --type encrypted --image 'Ubuntu 22.04 (Jammy)' --bootable ubuntu22
```

Output:

```sh
+---------------------+--------------------------------------+
| Field | Value |
Expand Down Expand Up @@ -90,12 +102,16 @@ Output:
```

## Spin up a VM with Encrypted Volume

Using the encrypted volume created in the previous step, spin up a VM with it using:

```sh
vol=dd4fc56c-d1f1-4700-add2-d06c0183dbe3
openstack server create --flavor gen.small --volume $vol --network External --security-group "SSH ingress" --key-name key ubuntu22_encrypted
```

Output:

```sh
+-------------------------------------+---------------------------------------------+
| Field | Value |
Expand Down Expand Up @@ -131,4 +147,4 @@ Output:
| user_id | 2d1fd7d55b4f49f3b5bde488b6bc949f |
| volumes_attached | |
+-------------------------------------+---------------------------------------------+
```
```

0 comments on commit 7ee9168

Please sign in to comment.