Preparing to install on OpenStack

You can install OKD on OpenStack. OKD version 4.14 supports OpenStack Train.

Prerequisites

Choosing a method to install OKD on OpenStack

You can install OKD on installer-provisioned or user-provisioned infrastructure. The default installation type uses installer-provisioned infrastructure, where the installation program provisions the underlying infrastructure for the cluster. You can also install OKD on infrastructure that you provision. If you do not use infrastructure that the installation program provisions, you must manage and maintain the cluster resources yourself.

See Installation process for more information about installer-provisioned and user-provisioned installation processes.

Installing a cluster on installer-provisioned infrastructure

You can install a cluster on OpenStack infrastructure that is provisioned by the OKD installation program, by using one of the following methods:

  • Installing a cluster on OpenStack with customizations: You can install a customized cluster on OpenStack. The installation program allows for some customization to be applied at the installation stage. Many other customization options are available post-installation.

  • Installing a cluster on OpenStack with Kuryr: You can install a customized OKD cluster on OpenStack that uses Kuryr SDN. Kuryr and OKD integration is primarily designed for OKD clusters running on OpenStack VMs. Kuryr improves the network performance by plugging OKD pods into OpenStack SDN. In addition, it provides interconnectivity between pods and OpenStack virtual instances.

  • Installing a cluster on OpenStack in a restricted network: You can install OKD on OpenStack in a restricted or disconnected network by creating an internal mirror of the installation release content. You can use this method to install a cluster that does not require an active internet connection to obtain the software components. You can also use this installation method to ensure that your clusters only use container images that satisfy your organizational controls on external content.

Installing a cluster on user-provisioned infrastructure

You can install a cluster on OpenStack infrastructure that you provision, by using one of the following methods:

Scanning OpenStack endpoints for legacy HTTPS certificates

Beginning with OKD 4.10, HTTPS certificates must contain subject alternative name (SAN) fields. Run the following script to scan each HTTPS endpoint in a OpenStack catalog for legacy certificates that only contain the CommonName field.

OKD does not check the underlying OpenStack infrastructure for legacy certificates prior to installation or updates. Use the provided script to check for these certificates yourself. Failing to update legacy certificates prior to installing or updating a cluster will result in cluster dysfunction.

Prerequisites

Procedure

  1. Save the following script to your machine:

    Details

    1. #!/usr/bin/env bash
    2. set -Eeuo pipefail
    3. declare catalog san
    4. catalog="$(mktemp)"
    5. san="$(mktemp)"
    6. readonly catalog san
    7. declare invalid=0
    8. openstack catalog list --format json --column Name --column Endpoints \
    9. | jq -r '.[] | .Name as $name | .Endpoints[] | select(.interface=="public") | [$name, .interface, .url] | join(" ")' \
    10. | sort \
    11. > "$catalog"
    12. while read -r name interface url; do
    13. # Ignore HTTP
    14. if [[ ${url#"http://"} != "$url" ]]; then
    15. continue
    16. fi
    17. # Remove the schema from the URL
    18. noschema=${url#"https://"}
    19. # If the schema was not HTTPS, error
    20. if [[ "$noschema" == "$url" ]]; then
    21. echo "ERROR (unknown schema): $name $interface $url"
    22. exit 2
    23. fi
    24. # Remove the path and only keep host and port
    25. noschema="${noschema%%/*}"
    26. host="${noschema%%:*}"
    27. port="${noschema##*:}"
    28. # Add the port if was implicit
    29. if [[ "$port" == "$host" ]]; then
    30. port='443'
    31. fi
    32. # Get the SAN fields
    33. openssl s_client -showcerts -servername "$host" -connect "$host:$port" </dev/null 2>/dev/null \
    34. | openssl x509 -noout -ext subjectAltName \
    35. > "$san"
    36. # openssl returns the empty string if no SAN is found.
    37. # If a SAN is found, openssl is expected to return something like:
    38. #
    39. # X509v3 Subject Alternative Name:
    40. # DNS:standalone, DNS:osp1, IP Address:192.168.2.1, IP Address:10.254.1.2
    41. if [[ "$(grep -c "Subject Alternative Name" "$san" || true)" -gt 0 ]]; then
    42. echo "PASS: $name $interface $url"
    43. else
    44. invalid=$((invalid+1))
    45. echo "INVALID: $name $interface $url"
    46. fi
    47. done < "$catalog"
    48. # clean up temporary files
    49. rm "$catalog" "$san"
    50. if [[ $invalid -gt 0 ]]; then
    51. echo "${invalid} legacy certificates were detected. Update your certificates to include a SAN field."
    52. exit 1
    53. else
    54. echo "All HTTPS certificates for this cloud are valid."
    55. fi
  2. Run the script.

  3. Replace any certificates that the script reports as INVALID with certificates that contain SAN fields.

You must replace all legacy HTTPS certificates before you install OKD 4.10 or update a cluster to that version. Legacy certificates will be rejected with the following message:

  1. x509: certificate relies on legacy Common Name field, use SANs instead

Scanning OpenStack endpoints for legacy HTTPS certificates manually

Beginning with OKD 4.10, HTTPS certificates must contain subject alternative name (SAN) fields. If you do not have access to the prerequisite tools that are listed in “Scanning OpenStack endpoints for legacy HTTPS certificates”, perform the following steps to scan each HTTPS endpoint in a OpenStack catalog for legacy certificates that only contain the CommonName field.

OKD does not check the underlying OpenStack infrastructure for legacy certificates prior to installation or updates. Use the following steps to check for these certificates yourself. Failing to update legacy certificates prior to installing or updating a cluster will result in cluster dysfunction.

Procedure

  1. On a command line, run the following command to view the URL of OpenStack public endpoints:

    1. $ openstack catalog list

    Record the URL for each HTTPS endpoint that the command returns.

  2. For each public endpoint, note the host and the port.

    Determine the host of an endpoint by removing the scheme, the port, and the path.

  3. For each endpoint, run the following commands to extract the SAN field of the certificate:

    1. Set a host variable:

      1. $ host=<host_name>
    2. Set a port variable:

      1. $ port=<port_number>

      If the URL of the endpoint does not have a port, use the value 443.

    3. Retrieve the SAN field of the certificate:

      1. $ openssl s_client -showcerts -servername "$host" -connect "$host:$port" </dev/null 2>/dev/null \
      2. | openssl x509 -noout -ext subjectAltName

      Example output

      1. X509v3 Subject Alternative Name:
      2. DNS:your.host.example.net

      For each endpoint, look for output that resembles the previous example. If there is no output for an endpoint, the certificate of that endpoint is invalid and must be re-issued.

You must replace all legacy HTTPS certificates before you install OKD 4.10 or update a cluster to that version. Legacy certificates are rejected with the following message:

  1. x509: certificate relies on legacy Common Name field, use SANs instead