Added missing articles from 0.3
* RabbitMQ additional instance * Specify SecurityGroups quotas * Reconfigure rate-limits for Nova * Configuring Neutron Change-Id: I694c7e1b95bc1f4fd5424e4190e1dc3ced063b3d
This commit is contained in:
Serg Melikyan
parent
e06d7b4eae
commit
81e377f23e
|
|
@ -362,4 +362,210 @@ LOGFILE=$SCREEN_LOGDIR/stack.sh.log
|
|||
</para>
|
||||
</formalpara>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<title>RabbitMQ additional instance</title>
|
||||
<para>
|
||||
RabbitMQ is used for services interconnection in the OpenStack. Murano also uses RabbitMQ as "message queue" service but the separate instance. In the OpenStack normal installation "message queue" service resides in the management network segment and should not be reachable from any tenant networks to prevent of security breach.
|
||||
Murano uses its own agent service running on deploying instance directly. Agent should have the ability to communicate with "message queue" service. Create one more "message queue" service instance in the external network, reachable from tenant networks through the OpenStack network router service (Qunatum/Neutron).
|
||||
</para>
|
||||
<para>
|
||||
<emphasis role="strong">Configuration steps</emphasis>
|
||||
</para>
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>
|
||||
Create file <filename>/etc/default/rabbitmq-murano</filename> with options listed below
|
||||
</para>
|
||||
<screen>
|
||||
#!/bin/sh
|
||||
#
|
||||
#
|
||||
export RABBITMQ_NODENAME=murano@$(hostname)
|
||||
export RABBITMQ_CONFIG_FILE=/etc/rabbitmq/rabbitmq-murano
|
||||
export RABBITMQ_ENABLED_PLUGINS_FILE=/etc/rabbitmq/enabled_plugins.murano
|
||||
CONTROL="${CONTROL} -n ${RABBITMQ_NODENAME}"
|
||||
PID_FILE=/var/run/rabbitmq/murano.pid
|
||||
</screen>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
Make copy of the original rabbitmq-server init script:
|
||||
</para>
|
||||
<screen>
|
||||
cd /etc/init.d
|
||||
cp rabbitmq-server rabbitmq-server-murano
|
||||
</screen>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
Make changes inside new file <filename>rabbitmq-server-murano</filename>, after test calls:
|
||||
</para>
|
||||
<screen>
|
||||
...
|
||||
test -x $DAEMON || exit 0
|
||||
test -x $CONTROL || exit 0
|
||||
. /etc/default/rabbitmq-murano
|
||||
RETVAL=0
|
||||
...
|
||||
</screen>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
<para>
|
||||
<emphasis role="strong">Fill in configuration files for new RabbitMQ instance.</emphasis>
|
||||
</para>
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>
|
||||
Modify <filename>/etc/rabbitmq/enabled_plugins.murano</filename>
|
||||
</para>
|
||||
<screen>
|
||||
[rabbitmq_management]
|
||||
</screen>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
Modify <filename>/etc/rabbitmq/rabbitmq-murano.config</filename>
|
||||
</para>
|
||||
<screen>
|
||||
[
|
||||
{rabbit, [
|
||||
{tcp_listeners, [5674]},
|
||||
{log_levels,[
|
||||
{connection, error}
|
||||
]}
|
||||
]},
|
||||
{rabbitmq_management, [
|
||||
{listener, [{port, 15673}]}
|
||||
]},
|
||||
{rabbitmq_mochiweb, [
|
||||
{listeners, [{mgmt, [{port, 55673}]}]}
|
||||
]}
|
||||
].
|
||||
</screen>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
Check service works fine:
|
||||
</para>
|
||||
<screen>
|
||||
service rabbitmq-server-murano start
|
||||
service rabbitmq-server-murano status
|
||||
service rabbitmq-server-murano stop
|
||||
</screen>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
Enable OS boot time service start:
|
||||
</para>
|
||||
<screen>
|
||||
update-rc.d rabbitmq-server-murano defaults
|
||||
</screen>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
<warning><para>Don't forget about firewall rules for new RabbitMQ service!</para></warning>
|
||||
</section>
|
||||
<section>
|
||||
<title>Specify SecurityGroups quotas</title>
|
||||
<para>
|
||||
Default quotas driver used by Neutron is - <filename>neutron.quota.ConfDriver</filename>, all limits set in <filename>/etc/neutron/
|
||||
neutron.conf</filename> - non flexible. To extend functionality and flexibility, default quota driver should be
|
||||
changed to - <filename>neutron.db.quota_db.DbQuotaDrive</filename>.
|
||||
</para>
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>
|
||||
Change <filename>/etc/neutron/neutron.conf</filename> with next values:
|
||||
</para>
|
||||
<screen>
|
||||
[QUOTAS]
|
||||
...
|
||||
#quota_driver = neutron.quota.ConfDriver
|
||||
quota_driver = neutron.db.quota_db.DbQuotaDriver
|
||||
...
|
||||
</screen>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
Restart all neutron services:
|
||||
</para>
|
||||
<screen>
|
||||
cd /etc/init.d/
|
||||
for q in quantum-*; do restart $q; done
|
||||
</screen>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
Update required quota with neutron CLI:
|
||||
</para>
|
||||
<screen>
|
||||
neutron quota-update --security_group 100 --tenant-id <tenant_id>
|
||||
+---------------------+-------+
|
||||
| Field | Value |
|
||||
+---------------------+-------+
|
||||
| floatingip | 50 |
|
||||
| network | 10 |
|
||||
| port | 50 |
|
||||
| router | 10 |
|
||||
| security_group | 100 |
|
||||
| security_group_rule | 100 |
|
||||
| subnet | 10 |
|
||||
+---------------------+-------+
|
||||
</screen>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
</section>
|
||||
<section>
|
||||
<title>Reconfigure rate-limits for Nova</title>
|
||||
<para>
|
||||
Please reconfigure rate-limits to at least 500-1000 hits per minute.
|
||||
</para>
|
||||
<para>
|
||||
API calls rate limits could be configured using <link xlink:href="http://docs.openstack.org/grizzly/openstack-
|
||||
compute/admin/content/configuring-compute-API.html">this manual</link>.
|
||||
Or by disabling ratelimits in the <filename>/etc/nova/api-paste.ini</filename> file.
|
||||
<screen>
|
||||
...
|
||||
[composite:openstack_compute_api_v2]
|
||||
use = call:nova.api.auth:pipeline_factory
|
||||
#noauth = faultwrap sizelimit noauth ratelimit osapi_compute_app_v2
|
||||
#keystone = faultwrap sizelimit authtoken keystonecontext ratelimit osapi_compute
|
||||
noauth = faultwrap sizelimit noauth osapi_compute_app_v2
|
||||
keystone = faultwrap sizelimit authtoken keystonecontext osapi_compute_app_v2
|
||||
keystone_nolimit = faultwrap sizelimit authtoken keystonecontext osapi_compute_ap
|
||||
...
|
||||
</screen>
|
||||
</para>
|
||||
</section>
|
||||
<section>
|
||||
<title>Configuring Neutron</title>
|
||||
<section>
|
||||
<title>Allow subnet ip-range overlapping</title>
|
||||
<para>
|
||||
When deploying environments, Murano will create dedicated network for each of them, and every such network will have a subnet created.
|
||||
All these subnets will have identical ip-ranges. Theoretically this is perfectly fine, as these subnets belong to different isolated Networks
|
||||
(L2 segments) and are connected to different routers.
|
||||
</para>
|
||||
<para>
|
||||
However, by default Neutron does not allow overlapping IPs for different subnets - even in different Networks.
|
||||
To override this restriction, change <filename>/etc/neutron/neutron.conf</filename>: uncomment <filename>allow_overlapping_ips</filename> parameter
|
||||
and change its value to <filename>True</filename>:
|
||||
</para>
|
||||
<programlisting>
|
||||
[DEFAULT]
|
||||
...
|
||||
# Enable or disable overlapping IPs for subnets
|
||||
# Attention: the following parameter MUST be set to False if Neutron is
|
||||
# being used in conjunction with nova security groups
|
||||
allow_overlapping_ips = True
|
||||
</programlisting>
|
||||
<para>
|
||||
Then, restart all neutron services:
|
||||
</para>
|
||||
<screen>
|
||||
cd /etc/init.d/
|
||||
for q in quantum-*; do restart $q; done
|
||||
</screen>
|
||||
</section>
|
||||
</section>
|
||||
</chapter>
|
||||
|
|
|
|||
Loading…
Reference in New Issue