diff --git a/docs/tutorials/https-loadbalancer.md b/docs/tutorials/https-loadbalancer.md index e3560410..a5d1dd24 100644 --- a/docs/tutorials/https-loadbalancer.md +++ b/docs/tutorials/https-loadbalancer.md @@ -1,16 +1,19 @@ --- sidebar_position: 8 --- + # Create an HTTPS-Terminated Load Balancer + This guide covers the steps needed to create an HTTPS-terminated load balancer using the command line. This guide applies to OpenMetal clouds running OpenStack Yoga with Barbican enabled. Before starting there are few things to prepare: -* A Python [virtual environment with OpenStackClient installed](docs/operators-manual/day-1/command-line/openstackclient.md) -* Obtain a TLS certificate from an external certficate authority -* Create 2 VMs, ensuring they are on the same network. + +- A Python [virtual environment with OpenStackClient installed](docs/operators-manual/day-1/command-line/openstackclient.md) +- Obtain a TLS certificate from an external certficate authority +- Create 2 VMs, ensuring they are on the same network. Two VMs have been created on a network called `private_net_1`, reachable by `10.0.0.57` and `10.0.0.250`. NGINX has been installed to each and is listening @@ -18,20 +21,25 @@ on port 80. Security groups for ICMP and HTTP have been added to each VM. A TLS certificate from an external certificate authority has been acquired. ## Initial Preparation + In your virtual environment, install the `stable/yoga` branch of `python-octaviaclient`: + ```sh pip install git+https://github.com/openstack/python-octaviaclient@stable/yoga ``` The CA certificate chain, TLS certificate, and private key are layed out in a directory like so: + ```sh $ ls cert ca-certs.pem server.crt server.key ``` ## Procedure + Create a copy of the certificate in PKCS#12 format using `openssl`: + ```sh openssl \ pkcs12 -export \ @@ -43,6 +51,7 @@ openssl \ ``` Store the SSL certificate as a secret using Barbican: + ```sh openstack secret store \ --name='tls_secret1' \ @@ -52,6 +61,7 @@ openstack secret store \ ``` Create the load balancer and ensure it is on the same network as your VMs: + ```sh openstack loadbalancer create \ --name lb1 \ @@ -60,6 +70,7 @@ openstack loadbalancer create \ Create a listener with protocol `TERMINATED_HTTPS`, listening on port `443`, using the certificate secret uploaded earlier: + ```sh openstack loadbalancer listener create \ lb1 \ @@ -70,6 +81,7 @@ openstack loadbalancer listener create \ ``` Create a `ROUND_ROBIN` pool using the `HTTP` protocol: + ```sh openstack loadbalancer pool create \ --name pool1 \ @@ -79,6 +91,7 @@ openstack loadbalancer pool create \ ``` Create 2 members using the appropriate IPs for your VMs: + ```sh openstack loadbalancer member create \ --subnet-id private_net_1 \ @@ -93,11 +106,13 @@ openstack loadbalancer member create \ ``` Associate a floating IP to the VIP address of the load balancer: + ```sh -$ openstack floating ip set --port d77f97aa-9d33-40c1-b191-1ca549a95075 173.231.202.91 +openstack floating ip set --port d77f97aa-9d33-40c1-b191-1ca549a95075 173.231.202.91 ``` Show the details of the load balancer: + ```sh $ openstack loadbalancer show lb1 +---------------------+--------------------------------------+ @@ -127,5 +142,6 @@ $ openstack loadbalancer show lb1 ``` ## Conclusion + Update the DNS for your FQDN to point to the floating IP address and verify the -load balancer works as expected. \ No newline at end of file +load balancer works as expected. diff --git a/docs/tutorials/install-barbican.md b/docs/tutorials/install-barbican.md index 6e0b370a..b7c912e9 100644 --- a/docs/tutorials/install-barbican.md +++ b/docs/tutorials/install-barbican.md @@ -87,4 +87,4 @@ first test secret. | Mode | cbc | | Expiration | None | +---------------+--------------------------------------------------------------------------+ -``` \ No newline at end of file +``` diff --git a/docs/tutorials/intro-to-barbican.md b/docs/tutorials/intro-to-barbican.md index c2efcd3b..607ce788 100644 --- a/docs/tutorials/intro-to-barbican.md +++ b/docs/tutorials/intro-to-barbican.md @@ -2,6 +2,7 @@ sidebar_position: 6 --- # Working with OpenStack Barbican + Barbican is the OpenStack Key Manager service. It provides secure storage, provisioning and management of secret data. This includes keying material such as Symmetric Keys, Asymmetric Keys, Certificates and raw binary data. In our default Cloud @@ -21,17 +22,19 @@ for additional information. :::info -If Barbican is not installed to your cloud, see our [guide](docs/tutorials/install-barbican.md) or +If Barbican is not installed to your cloud, see our [guide](docs/tutorials/install-barbican.md) or [submit a support ticket](operators-manual/day-1/intro-to-openmetal-private-cloud.md#how-to-submit-a-support-ticket) for installation. ::: ## Creator Keystone Role + The `creator` Keystone role is required by non-admin users who wish to use Barbican to manage secrets. The `admin` role is required to modify the roles of a user. Set the creator role using: + ```sh openstack role add creator --user nick --project 966582d3de534089a36cc39a2e5d0ff9 ``` @@ -40,11 +43,15 @@ Alternatively, in Horizon, you can adjust the role for a user by navigating to * ![image](images/manage-members.jpg) ## Encrypted Volume Type + You can create encrypted volumes with Cinder. Before creating an encrypted volume, a new volume type in Cinder must be created. Create a new Encrypted Volume type using: + ```sh openstack volume type create --encryption-provider luks --encryption-cipher aes-xts-plain64 --encryption-key-size 256 --encryption-control-location front-end encrypted ``` + Output: + ```sh +-------------+-----------------------------------------------------------------------------------------------------------------------------------------------+ | Field | Value | @@ -56,12 +63,17 @@ Output: | name | encrypted | +-------------+-----------------------------------------------------------------------------------------------------------------------------------------------+ ``` + ### Encrypted Volume + Create an encrypted volume using: + ```sh openstack volume create --size 10 --type encrypted --image 'Ubuntu 22.04 (Jammy)' --bootable ubuntu22 ``` + Output: + ```sh +---------------------+--------------------------------------+ | Field | Value | @@ -90,12 +102,16 @@ Output: ``` ## Spin up a VM with Encrypted Volume + Using the encrypted volume created in the previous step, spin up a VM with it using: + ```sh vol=dd4fc56c-d1f1-4700-add2-d06c0183dbe3 openstack server create --flavor gen.small --volume $vol --network External --security-group "SSH ingress" --key-name key ubuntu22_encrypted ``` + Output: + ```sh +-------------------------------------+---------------------------------------------+ | Field | Value | @@ -131,4 +147,4 @@ Output: | user_id | 2d1fd7d55b4f49f3b5bde488b6bc949f | | volumes_attached | | +-------------------------------------+---------------------------------------------+ -``` \ No newline at end of file +```