In this lab, you will configure a project and resources.
Outcomes
You should be able to:
Create a project and add users to it.
Create an image, a network, a key pair, and a security group.
Launch a web instance.
Create a volume, attach it to the instance and mount it.
Set up shared storage.
Test the instance connection and application.
As the student user on the workstation machine, use the lab to prepare your system for this exercise.
This command ensures that all resources required for the exercise are present.
[student@workstation ~]$ lab comprehensive-lab1 start
Procedure 10.1. Instructions
Before starting this exercise, save any work you want to keep from earlier exercises. Reset your classroom environment.
In this comprehensive review, you will deploy resources necessary to create an HTTP server in your environment. You will create both a volume and shared storage. You will test the instance connection and its application.
The substeps in this comprehensive review use the CLI to create the necessary resources.
On workstation as the admin-rc user, create the accounts project in the Example domain. Add developer6 to the accounts project as a member. Add operator6 to the accounts project as a member and admin.
On workstation, open a terminal and source the /home/student/admin-rc credentials file.
[student@workstation ~]$ source admin-rc
[student@workstation ~(admin)]$Use the openstack project create command to create the accounts project in the Example domain.
[student@workstation ~(admin)]$openstack project create \>--domain Example accounts+-------------+----------------------------------+ | Field | Value | +-------------+----------------------------------+ | description | | | domain_id | f0bd72d8acfe4cd9842b476caa7bf269 | | enabled | True | | id | 7e0593f515524c628a6719f39a280b4a | | is_domain | False | | name | accounts | | options | {} | | parent_id | f0bd72d8acfe4cd9842b476caa7bf269 | | tags | [] | +-------------+----------------------------------+
Assign the member role to developer6 in the accounts project.
[student@workstation ~(admin)]$openstack role add \>--user-domain Example \>--user developer6 \>--project-domain Example \>--project accounts \>member
Verify that the member role has been applied to developer6.
[student@workstation ~(admin)]$openstack role assignment list \>--effective \>--names \>--user-domain Example \>--user developer6 \>-c Role -c User -c Project+---------------+--------------------+--------------------+ | Role | User | Project | +---------------+--------------------+--------------------+ | member | developer6@Example | accounts@Example | | swiftoperator | developer6@Example | finance@Example | | member | developer6@Example | finance@Example | | member | developer6@Example | production@Example | +---------------+--------------------+--------------------+
Assign the member and admin roles to operator6 in the accounts project.
[student@workstation ~(admin)]$openstack role add \>--user-domain Example \>--user operator6 \>--project-domain Example \>--project accounts \>member[student@workstation ~(admin)]$openstack role add \>--user-domain Example \>--user operator6 \>--project-domain Example \>--project accounts \>admin
Verify that the member and admin roles have been applied to operator6.
[student@workstation ~(admin)]$openstack role assignment list \>--effective \>--names \>--user-domain Example \>--user operator6 \>-c Role -c User -c Project+----------+-------------------+------------------+ | Role | User | Project | +----------+-------------------+------------------+ | admin | operator6@Example | accounts@Example | | member | operator6@Example | accounts@Example | ...output omitted... | member | operator6@Example | accounts@Example | | reader | operator6@Example | accounts@Example | ...output omitted... +----------+-------------------+------------------+
Prepare the environment files for developer6 and operator6 in the accounts project.
Use the cp command to copy developer6-finance-rc to developer6-accounts-rc. Copy operator6-finance-rc to operator6-accounts-rc.
[student@workstation ~(admin)]$cp developer6-finance-rc developer6-accounts-rc[student@workstation ~(admin)]$cp operator6-finance-rc operator6-accounts-rc
Edit developer6-accounts-rc and operator6-accounts-rc. Change the project name from finance to accounts. Change the prompt from finance to accounts.
[student@workstation ~(admin)]$ vim developer6-accounts-rc
...output omitted...
export OS_PROJECT_NAME=accounts
...output omitted...
export PS1='[\u@\h \W(developer6-accounts)]\$ 'As the domain operator, operator6, create a flavor named web-flavor. Configure this flavor with two VCPUs, 2048 MB of RAM, a 2 GB ephemeral disk, 1 GB swap disk, and a 10 GB root disk.
Source the /home/student/operator6-accounts-rc environment file to export the operator6 user credentials.
[student@workstation ~(admin)]$ source operator6-accounts-rc
[student@workstation ~(operator6-accounts)]$Use the openstack flavor create command to create the flavor.
[student@workstation ~(operator6-accounts)]$openstack flavor create \>--vcpus 2 \>--ram 2048 \>--disk 10 \>--ephemeral 2 \>--swap 1024 \>web-flavor+----------------------------+--------------------------------------+ | Field | Value | +----------------------------+--------------------------------------+ | OS-FLV-DISABLED:disabled | False | | OS-FLV-EXT-DATA:ephemeral |2| | disk |10| | id | 08f168a0-ef0b-43e0-b11a-7af3330f3e56 | | name |web-flavor| | os-flavor-access:is_public | True | | properties | | | ram |2048| | rxtx_factor | 1.0 | | swap |1024| | vcpus |2| +----------------------------+--------------------------------------+
As the cloud user, developer6, create a new image named accounts-web. Create this image from the osp-web.qcow2 image file and use the QCOW2 format. The osp-web.qcow2 image file is located in /home/student/Downloads. Set the accounts-web image status to protected, set the minimum RAM to 2048, and set the minimum disk size to 10 GB.
Source the /home/student/developer6-accounts-rc environment file.
[student@workstation ~(operator6-accounts)]$ source developer6-accounts-rc
[student@workstation ~(developer6-accounts)]$Create the accounts-web image using the osp-web.qcow2 image file and the QCOW2 format.
[student@workstation ~(developer6-accounts)]$openstack image create \>--disk-format qcow2 \>--file /home/student/Downloads/osp-web.qcow2 \>accounts-web -f json{ ...output omitted... "disk_format": "qcow2", "id": "868fca2c-...-4d1f8e39b42d", "min_disk": 0, "min_ram": 0, "name": "accounts-web", "owner": "7e0593...19f39a280b4a", "properties": { "os_hidden": false, "os_hash_algo": "sha512", ...output omitted... }, "protected": false, "schema": "/v2/schemas/image", "size": 1412235264, "status": "active", "tags": [], "updated_at": "2020-07-22T12:27:00Z", "virtual_size": null, "visibility": "shared" }
Use the openstack image set to protect the image and set the minimum disk to 10 GB.
[student@workstation ~(developer6-accounts)]$openstack image set \>--protected \>--min-disk 10 \>--min-ram 2048 \>accounts-web
Use the openstack image show command to inspect the details of accounts-web. Confirm that the image has a min_disk size of 10 GB, and the protected status is set to True.
[student@workstation ~(developer6-accounts)]$openstack image show \>accounts-web --max-width 80+------------------+-----------------------------------------------------------+ | Field | Value | +------------------+-----------------------------------------------------------+ | checksum | 01962f25c1a09cab786ab77fe143f523 | | container_format | bare | | created_at | 2020-07-22T12:26:45Z | | disk_format | qcow2 | | file | /v2/images/868fca2c-4bdb-4027-a820-4d1f8e39b42d/file | | id | 868fca2c-4bdb-4027-a820-4d1f8e39b42d | | min_disk |10| | min_ram |2048| | name | accounts-web | | owner | 7e0593f515524c628a6719f39a280b4a | | properties | direct_url='rbd://63e5c992-81fb-11ea-bc11-52540001fac8/im | | | ages/868fca2c-4bdb-4027-a820-4d1f8e39b42d/snap', | | | locations='[{'url': 'rbd://63e5c992-81fb-11ea-bc11-525400 | | | 01fac8/images/868fca2c-4bdb-4027-a820-4d1f8e39b42d/snap', | | | 'metadata': { }}]', os_hash_algo='sha512', os_hash_value='| | | 51bad92d5265db82e71f7917ecb69c598dfb7cc95c7b05876971686ad | | | dc91396dc900c050bc41ffc69799167d38efa2ec179dcaf6b4e5fe1f7 | | | 9c07c1b4781d03', os_hidden='False' | | protected |True| | schema | /v2/schemas/image | | size | 1412235264 | | status | active | | tags | | | updated_at | 2020-07-22T12:53:11Z | | virtual_size | None | | visibility | shared | +------------------+-----------------------------------------------------------+
Create a VLAN provider network named provider1-104 with a matching subnet named subnet1-104. Use the details from the following table. The OpenStack user creating the network requires administrative privileges.
| Option | Value |
|---|---|
External
| |
Shared
| |
Provider Network Type
|
vlan
|
Physical Network
|
vlanprovider2
|
Segmentation ID
|
104
|
Enable DHCP
| |
Network Address
|
10.0.104.0/24
|
Allocation Pools
|
start=10.0.104.100,end=10.0.104.149
|
Source the /home/student/operator6-accounts-rc environment file.
[student@workstation ~(developer6-accounts)]$ source operator6-accounts-rc
[student@workstation ~(operator6-accounts)]$Use the openstack network create command to create the provider network.
[student@workstation ~(operator6-accounts)]$openstack network create \>--external \>--share \>--provider-network-type vlan \>--provider-physical-network vlanprovider2 \>--provider-segment 104 \>provider1-104...output omitted...
Use the openstack subnet create command to create the provider subnet.
[student@workstation ~(operator6-accounts)]$openstack subnet create \>--dhcp \>--subnet-range=10.0.104.0/24 \>--allocation-pool=start=10.0.104.100,end=10.0.104.149 \>--network provider1-104 \>subnet1-104...output omitted...
As the cloud user, developer6, create a key pair called accounts-keypair. Save the private key in the /home/student/Downloads directory. Create a security group called accounts-http and add rules to allow ICMP, SSH, and HTTP traffic.
Source the environment credentials for developer6.
[student@workstation ~(operator6-accounts)]$ source developer6-accounts-rc
[student@workstation ~(developer6-accounts)]$Create the key pair accounts-keypair and save the private key as /home/student/Downloads/accounts-keypair.pem..
[student@workstation ~(developer6-accounts)]$openstack keypair create \>accounts-keypair > /home/student/Downloads/accounts-keypair.pem
Use the chmod command with a mode of 600 to protect the private key.
[student@workstation ~(developer6-accounts)]$chmod 600 \>/home/student/Downloads/accounts-keypair.pem
Create the accounts-http security group.
[student@workstation ~(developer6-accounts)]$openstack security group create \>accounts-http...output omitted...
Add the security group rules for ICMP, SSH, and HTTP.
[student@workstation ~(developer6-accounts)]$openstack security group \>rule create --protocol icmp accounts-http...output omitted... [student@workstation ~(developer6-accounts)]$openstack security group \>rule create --protocol tcp --dst-port 22 accounts-http...output omitted... [student@workstation ~(developer6-accounts)]$openstack security group \>rule create --protocol tcp --dst-port 80 accounts-http...output omitted...
Launch an instance called accounts-web1. Use the accounts-web image, the web-flavor flavor, the provider1-104 network, the accounts-http security group, and the accounts-keypair key pair. From the utility server, verify that you can ping accounts-web1 and access the HTTP server. The web server will take several minutes to load.
Use the openstack server create command to create accounts-web1.
[student@workstation ~(developer6-accounts)]$openstack server create \>--image accounts-web \>--flavor web-flavor \>--network provider1-104 \>--security-group accounts-http \>--key-name accounts-keypair \>--wait accounts-web1...output omitted...
Use openstack server list commmand to inspect the IP address of accounts-web1. Open a new terminal window then use the ssh command to connect to utility. Use the ping command to ping accounts-web1. Use the curl command to verify that the HTTP server is running and available.
[student@workstation ~(developer6-accounts)]$ssh utility[student@utility ~]$ping -c3PING 10.0.104.134 (10.0.104.134) 56(84) bytes of data. 64 bytes from 10.0.104.134: icmp_seq=1 ttl=64 time=1.99 ms 64 bytes from 10.0.104.134: icmp_seq=2 ttl=64 time=0.720 ms 64 bytes from 10.0.104.134: icmp_seq=3 ttl=64 time=0.447 ms --- 10.0.104.134 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 43ms rtt min/avg/max/mdev = 0.447/1.053/1.992/0.673 ms [student@utility ~]$10.0.104.134curl http://10.0.104.134<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"> <head> <title>Test Page for the Apache HTTP Server on Red Hat Enterprise Linux</title> ...output omitted... [student@utility ~]$exit
Use the rhel8 image to create a 10 GB volume named accounts-vol1. Verify that the volume has a status of available. Attach the volume to accounts-web1 using partition vdd1. Mount the volume.
To use ssh to log in to the instance you will need the accounts-keypair key pair. Copy it to utility and ensure it has the correct permissions.
Use the openstack volume create command to create the volume.
[student@workstation ~(developer6-accounts)]$openstack volume create \>--size 10 \>--image rhel8 \>accounts-vol1+---------------------+--------------------------------------+ | Field | Value | +---------------------+--------------------------------------+ | attachments | [] | | availability_zone | nova | | bootable | false | | consistencygroup_id | None | | created_at | 2020-07-22T12:16:55.000000 | | description | None | | encrypted | False | | id |f0ab8109-7581-4ecd-9da5-108d44c6b24a| | multiattach | False | | name | accounts-vol1 | | properties | | | replication_status | None | | size | 10 | | snapshot_id | None | | source_volid | None | | status | creating | | type | tripleo | | updated_at | None | | user_id | b3b(...) | +---------------------+--------------------------------------+
Verify that the status of accounts-vol1 is available. It might take some time for the status to change to available.
[student@workstation ~(developer6-accounts)]$openstack volume list \>-c Name -c Status+---------------+-----------+ | Name | Status | +---------------+-----------+ | accounts-vol1 | available | +---------------+-----------+
Use the openstack server add command to attach the volume to accounts-web1.
[student@workstation ~(developer6-accounts)]$openstack server add volume \>accounts-web1 accounts-vol1[student@workstation ~(developer6-accounts)]$
Use the scp command to copy the private key Downloads/accounts-keypair.pem to utility.
[student@workstation ~(developer6-accounts)]$scp Downloads/accounts-keypair.pem \>utility:accounts-keypair.pem 100% 1680 2.7MB/s 00:00
From utility, use the ssh command to log in to accounts-web1 and mount accounts-vol1.
[student@utility ~]$ssh -i accounts-keypair.pem \>cloud-user@[cloud-user@accounts-web1 ~]$10.0.104.134sudo -i[root@accounts-web1 ~]#parted /dev/vdd1 printModel: Virtio Block Device (virtblk) Disk /dev/vdd1: 8389MB Sector size (logical/physical): 512B/512B Partition Table: msdos Disk Flags: Number Start End Size Type File system Flags 1 1049kB 8390MB 8389MB primary xfs [root@accounts-web1 ~]#parted /dev/vdd1 \>mklabel msdos \>mkpart primary xfs 1M 1GWarning: The existing disk label on /dev/vdb will be destroyed and all data on this disk will be lost. Do you want to continue? Yes/No?yes...output omitted... Ignore/Cancel?ignoreInformation: You may need to update /etc/fstab. [root@accounts-web1 ~]#mkfs.xfs -f /dev/vdd1meta-data=/dev/vdb isize=512 agcount=4, agsize=655360 blks = sectsz=512 attr=2, projid32bit=1 = crc=1 finobt=1, sparse=1, rmapbt=0 = reflink=1 data = bsize=4096 blocks=2621440, imaxpct=25 = sunit=0 swidth=0 blks naming =version 2 bsize=4096 ascii-ci=0, ftype=1 log =internal log bsize=4096 blocks=2560, version=2 = sectsz=512 sunit=0 blks, lazy-count=1 realtime =none extsz=4096 blocks=0, rtextents=0 [root@accounts-web1 ~]#mkdir /volume1[root@accounts-web1 ~]#mount -t xfs /dev/vdd1 /volume1[root@accounts-web1 ~]#mount | grep /volume1/dev/vdb on /volume1 type xfs (rw,relatime,seclabel,attr2,inode64,noquota) [root@accounts-web1 ~]#echo test > /volume1/test[root@accounts-web1 ~]#cat /volume1/testtest [student@utility ~]$exit
The flavor used to create accounts-web1 has a disk, an ephemeral disk, and a swap disk. The root disk of the instance is using vda, the ephemeral disk is using vdb, the swap disk is using vdc, and the volume disk is using vdd. Therefore, you must use vdd1. Use the fdisk -l command to view the partitions.
On workstation as the domain operator, operator6, create the cephfstype share type. Set the driver_handles_share_servers to false.
Source the operator6 environment credentials.
[student@workstation ~(developer6-accounts)]$ source operator6-accounts-rc
[student@workstation ~(operator6-accounts)]$Use the manila type-create command to create the share type.
[student@workstation ~(operator6-accounts)]$manila type-create cephfstype false+----------------------+--------------------------------------+ | Property | Value | +----------------------+--------------------------------------+ | ID | 996d0040-2968-407e-b068-fa3e20076d3e | | Name |cephfstype| | Visibility | public | | is_default | - | | required_extra_specs |driver_handles_share_servers : False| | optional_extra_specs | | | Description | None | +----------------------+--------------------------------------+
As the cloud user, developer6, create a new share called accounts-share1. The share should be 1 GB in size. Add the provider-storage network to accounts-web1.
Source the environment file for developer6-accounts-rc.
[student@workstation ~(operator6-accounts)]$ source developer6-accounts-rc
[student@workstation ~(developer6-accounts)]$Use the manila create command to create a share of type cephfs. Confirm that the status changes from creating to available.
[student@workstation ~(developer6-accounts)]$manila create \>--name accounts-share1 --share-type cephfstype cephfs 1...output omitted... [student@workstation ~(developer6-accounts)]$manila list \>--columns Name,'Share Proto',Status,'Share Type Name'+-----------------+-------------+-----------+-----------------+ | Name | Share Proto | Status | Share Type Name | +-----------------+-------------+-----------+-----------------+ | accounts-share1 | CEPHFS |available| cephfstype | +-----------------+-------------+-----------+-----------------+
Add the provider-storage network to the accounts-web1 instance. Use the network topology in dashboard to confirm the network has been attached.
[student@workstation ~(developer6-accounts)]$openstack server add \>network accounts-web1 provider-storage
Create the exclusive cephx user client.cloud-user to access the Ceph backed share accounts-share1. Allow the client.cloud-user cephx user to read from and write to the share. The OpenStack Shared File Systems service uses the client.manila cephx user to authenticate as well as communicating with the Ceph cluster. You are going to use the cephx authentication mechanism to enable access to the Ceph backed share accounts-share1.
Log in to controller0 as the root user.
[student@workstation ~(developer6-accounts)]$ ssh root@controller0
[root@controller0 ~]#Create the cephx user client.cloud-user. Save the key ring to /root/cloud-user.keyring.
[root@controller0 ~]#podman exec -t \>ceph-mon-controller0 ceph --name=client.manila \>--keyring=/etc/ceph/ceph.client.manila.keyring \>auth get-or-create client.cloud-user > /root/cloud-user.keyring
Confirm that the key ring was created correctly and contains the cloud-user key.
[root@controller0 ~]# cat /root/cloud-user.keyring
[client.cloud-user]
key = AQBMnRpf634XKRAAGbwCSOhjvfEhRNdz1qZcoQ==From controller0 copy the ceph.conf and cloud-user.keyring to utility using the scp command. Use the student user name and student as the password. Copy both files to accounts-web1.
Use the scp command to copy the ceph.conf and cloud-user.keyring to utility. Confirm the authenticity.
[root@controller0 ~]#scp \>{cloud-user.keyring,/etc/ceph/ceph.conf} student@utility:
Open a new terminal window and connect to the utility server. Confirm that the two files were copied to the /home/student directory.
[student@workstation ~]$ssh utility[student@utility ~]$ls -ltotal 12 -rw-------. 1 student student 1676 Jul 23 12:55 accounts-keypair.pem -rw-r--r--. 1 student student 941 Jul 24 08:44 ceph.conf -rw-r--r--. 1 student student 70 Jul 24 08:44 cloud-user.keyring
Use the scp command to copy both files to accounts-web1.
[student@utility ~]$scp -i accounts-keypair.pem \>{cloud-user.keyring,ceph.conf} cloud-user@10.0.104.134:cloud-user.keyring 100% 70 58.4KB/s 00:00 ceph.conf 100% 941 730.0KB/s 00:00
As the cloud user, developer6, add and verify the access rights to accounts-share1 for client.cloud-user. Confirm that the state of the share is active.
[student@workstation ~(developer6-accounts)]$manila access-allow \>accounts-share1 cephx cloud-user+--------------+--------------------------------------+ | Property | Value | +--------------+--------------------------------------+ | id | 3b629f47-7b22-44a5-bed0-12bb9599f3d1 | | share_id | 31ec5a0b-b15c-48b1-956b-ceb7c4abb5ae | | access_level | rw | | access_to |cloud-user| | access_type |cephx| | state |queued_to_apply| | access_key | None | | created_at | 2020-07-27T07:54:16.000000 | | updated_at | None | | metadata | {} | +--------------+--------------------------------------+ [student@workstation ~(developer6-accounts)]$manila access-list \>accounts-share1 --columns access_to,access_level,state+------------+--------------+--------+ | Access_To | Access_Level | State | +------------+--------------+--------+ | cloud-user | rw |active| +------------+--------------+--------+
Access accounts-web1 and create a mount point called /mnt/ceph for the ceph share.
From utility, use the ssh command to log in to accounts-web1.
[student@utility ~]$ ssh -i accounts-keypair.pem cloud-user@10.0.104.134
...output omitted...
[cloud-user@accounts-web1 ~]$Create the mount point /mnt/ceph.
[cloud-user@accounts-web1 ~]$sudo -i[cloud-user@accounts-web1 ~]$mkdir /mnt/ceph
This concludes the lab.