openstack | panticz.de

Debug VPN script

#!/bin/bash

export DEBUG=@option.debug@
export VPN_CONNECTION_ID=$(echo @option.vpn_connection_id@ | sed -e 's/^[[:space:]]*//')

[ "${DEBUG}" == "yes" ] && set -x

source /etc/kolla/admin-openrc.sh
source /usr/local/pyenv/versions/osc/bin/activate

# check parameter
if [[ ! ${VPN_CONNECTION_ID//-/} =~ ^[[:xdigit:]]{32}$ ]]; then
#if [ -z "${VPN_CONNECTION_ID}" ]; then
    echo -e "\e[34mPlease specify the VPN ipsec site connection ID"
    openstack vpn ipsec site connection list --long

    exit
fi 


VPN_CONNECTION_JSON=$(openstack vpn ipsec site connection show ${VPN_CONNECTION_ID} -f json)

echo -e "\e[34mVPN Connection:"
openstack vpn ipsec site connection show "${VPN_CONNECTION_ID}" | grep -v "Pre-shared Key"

VPN_SERVICE_ID=$(echo ${VPN_CONNECTION_JSON} | jq -r '."VPN Service"')
echo -e "\n\e[34mVPN Service:"
openstack vpn service show ${VPN_SERVICE_ID}

LOCAL_ENDPOINT_GROUP_ID=$(echo ${VPN_CONNECTION_JSON} | jq -r '."Local Endpoint Group ID"')
echo -e "\n\e[34mLocal Endpoint:"
openstack vpn endpoint group show ${LOCAL_ENDPOINT_GROUP_ID}

LOCAL_ENDPOINT_TYPE=$(openstack vpn endpoint group show ${LOCAL_ENDPOINT_GROUP_ID} -f json | jq -r '.Type')
if [ "${LOCAL_ENDPOINT_TYPE}" == "subnet" ]; then
    echo -e "\n\e[34mLocal Endpoint subnets:"
    LOCAL_ENDPOINT_SUBNETS=$(openstack vpn endpoint group show ${LOCAL_ENDPOINT_GROUP_ID} -f json | jq -r '.Endpoints[]')
    for SUBNET in ${LOCAL_ENDPOINT_SUBNETS}; do
        openstack subnet show ${SUBNET}
    done
fi

PEER_ENDPOINT_GROUP_ID=$(echo ${VPN_CONNECTION_JSON} | jq -r '."Peer Endpoint Group ID"')
echo -e "\n\e[34mPeer Endpoint:"
openstack vpn endpoint group show ${PEER_ENDPOINT_GROUP_ID}

PEER_ENDPOINT_TYPE=$(openstack vpn endpoint group show ${PEER_ENDPOINT_GROUP_ID} -f json | jq -r '.Type')
if [ "${PEER_ENDPOINT_TYPE}" == "subnet" ]; then
    echo -e "\n\e[34mPeer Endpoint subnets:"
    PEER_ENDPOINT_SUBNETS=$(openstack vpn endpoint group show ${PEER_ENDPOINT_GROUP_ID} -f json | jq -r '.Endpoints[]')
    for SUBNET in ${PEER_ENDPOINT_SUBNETS}; do
        openstack subnet show ${SUBNET}
    done
fi

Export server volume as image

SERVER_IDS="
dd799bc6-ded0-4f20-8f24-3e5af5250fd3
46562d71-ba00-47b7-872a-cd759abd014c
5e517453-c87f-4426-b705-96ffc9afe4ce
"

function save_image() {
    IMAGE_ID="${1}"
    IMAGE_NAME="${2}"

    echo "IMAGE_ID: ${IMAGE_ID}"
    openstack image set --private ${IMAGE_ID}    

    echo "Save image as ${IMAGE_NAME}.qcow2 ..."
    openstack image save ${IMAGE_ID} --file ${IMAGE_NAME}.qcow2

    openstack image show ${IMAGE_ID} -c size -f value
    ls -l ${IMAGE_NAME}.qcow2
    md5sum ${IMAGE_NAME}.qcow2 > ${IMAGE_NAME}.qcow2.md5sum

    openstack image show ${IMAGE_ID} -f json > ${IMAGE_NAME}.json

    echo "Delete image ${IMAGE_NAME}"
    openstack image delete ${IMAGE_ID}
}


for SERVER_ID in ${SERVER_IDS}; do
    echo "SERVER_ID: ${SERVER_ID}"
    SERVER_JSON=$(openstack server show ${SERVER_ID} -f json)

    SERVER_NAME=$(echo ${SERVER_JSON} | jq -r .name | tr " " "_")
    echo "SERVER_NAME: ${SERVER_NAME}"
    SERVER_STATUS=$(echo ${SERVER_JSON} | jq -r .status)
    echo "SERVER_STATUS: ${SERVER_STATUS}"
    SERVER_IMAGE=$(echo ${SERVER_JSON} | jq -r .image)
    echo "SERVER_IMAGE: ${SERVER_IMAGE}"

    openstack server show ${SERVER_ID} -f json > ${SERVER_ID}.json

    if [ "${SERVER_IMAGE}" != "N/A (booted from volume)" ]; then
        FLAVOR_ID=$(echo ${SERVER_JSON} | jq -r .flavor | cut -d "(" -f2 | cut -d")" -f1)
        FLAVOR_DISK=$(openstack flavor show ${FLAVOR_ID} -c disk -f value)
        echo "FLAVOR_DISK: ${FLAVOR_DISK}"

        IMAGE_NAME="${SERVER_ID}_image_$(date -I)"

        echo "Create image ${IMAGE_NAME} ..."
        IMAGE_ID=$(openstack server image create --wait --name ${IMAGE_NAME} ${SERVER_ID} -c id -f value)

        save_image "${IMAGE_ID}" "${IMAGE_NAME}"
    fi

Migrate OpenStack VM with encrypted volume

SERVER_ID=xxxx-xxxx-xxxx-xxxx-xxxx

# VOLUME_ID=$(openstack server show ${SERVER_ID} -c volumes_attached -f value | cut -d "'" -f4)
# VOLUME_TYPE=$(openstack volume show ${VOLUME_ID} -c type -f value)
# openstack volume type show ${VOLUME_TYPE}

# add admin to project
PROJECT_ID=$(openstack server show ${SERVER_ID} -c project_id -f value)
openstack role add --user admin --project ${PROJECT_ID} admin
unset OS_PROJECT_DOMAIN_NAME
unset OS_PROJECT_NAME
export OS_PROJECT_ID=${PROJECT_ID}

# Live migrate VM
openstack server migrate --os-compute-api-version 2.56 --live-migration --wait --host com10-prod ${SERVER_ID}
openstack server show ${SERVER_ID} -c name -c OS-EXT-SRV-ATTR:host

# remove admin from project
unset OS_PROJECT_ID
source /etc/kolla/admin-openrc.sh
openstack role remove --user admin --project ${PROJECT_ID} admin

Allow project to use encrypted volume

openstack volume type set --project ${PROJECT_ID} ${VOLUME_TYPE_ID}

Create application credentials as Openstack admin for federated user(s)

Single user

# user OS_TOKEN
export OS_TOKEN=gAAAAABjtUl_4LZr3iNqI7dOoBYMw-...

# cat ~/.config/openstack/clouds.yaml
clouds:
  dev-admin-token:
    auth:
      auth_url: https://keystone.service.examle.com/v3
    region_name: "eu-south"
    interface: "public"
    identity_api_version: 3
    project_domain_name: "my-foo"
    project_name: "foo"
    auth_type: "v3token"

OS_AC=$(openstack application credential create ${OS_AC_NAME} --unrestricted --os-cloud dev-admin-token -f json)

Multiple user

OpenStack: Authentificaton (Token, Application credendials)

Token authentificaton

unset $(compgen -v | grep OS_)

export OS_TOKEN=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

export OS_AUTH_TYPE=v3token
export OS_AUTH_URL=https://keystone.service.example.com/v3
export OS_IDENTITY_API_VERSION=3
export OS_INTERFACE=public
export OS_REGION_NAME=de-b1
export OS_PROJECT_DOMAIN_NAME=test-domain
export OS_PROJECT_NAME=test-project
#export OS_PROJECT_ID=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

OpenStack multi cloud / user configurattion
http://www.panticz.de/openstack-clouds-config

OpenStack: Neutron L3 router

Recreate / move qrouter namespace

ROUTER_ID=74490819-028e-424e-b8f9-c7e48cf672af

# list router NS
openstack network agent list --router ${ROUTER_ID} --long

# list available l3 agents
openstack network agent list --agent-type l3

# recreate L3 agent
SOURCE_NODE=ctl1-dev
TARGET_NODE=ctl2-dev

SOURCE_L3_ID=$(openstack network agent list --host ${SOURCE_NODE} --agent-type l3 -f value -c ID)
TARGET_L3_ID=$(openstack network agent list --host ${TARGET_NODE} --agent-type l3 -f value -c ID)

openstack network agent add router --l3 ${TARGET_L3_ID} ${ROUTER_ID}
openstack network agent remove router --l3 ${SOURCE_L3_ID} ${ROUTER_ID}

Recreate all network agents

openstack router list --agent $SOURCE_L3_ID -f value -c ID | while read ROUTER_ID; do
    openstack network agent add router --l3 ${TARGET_L3_ID} ${ROUTER_ID}
    openstack network agent remove router --l3 ${SOURCE_L3_ID} ${ROUTER_ID}
done

openstack network agent set $SOURCE_L3_ID --disable

List floating IP in qrouter namespace

for ROUTER_NETNS in $(ip netns | grep qrouter | cut -d" " -f1); do
    echo ${ROUTER_NETNS}
    ip netns exec ${ROUTER_NETNS} ip a | grep "scope global qg-"
    echo
done

Manual failover all active router

OpenStack: submit changes to OpenDev with Gerrit

sudo apt-get install git-review

git clone https://opendev.org/openstack/diskimage-builder.git
# add changes
git config --global gitreview.username panticz
git review -s
checkout -b patch_x
git commit -a
git review

Links
https://docs.opendev.org/opendev/infra-manual/latest/gettingstarted.html

OpenStack: Debug / cleanup DHCP

Restart DHCP namespaces

openstack subnet set --no-dhcp ${SUBNET_ID}
openstack subnet set --dhcp ${SUBNET_ID}

Find unnecessary DHCP namespaces

MAX_DHCP_NS=3
SUBNET_IDS=$(openstack subnet list --dhcp -c ID -f value)
for SUBNET_ID in ${SUBNET_IDS}; do
    NETWORK_ID=$(openstack subnet show ${SUBNET_ID} -c network_id -f value)
    DHCP_PORTS="$(openstack port list --device-owner network:dhcp --network ${NETWORK_ID} -c ID -c binding_host_id -c fixed_ips -c status -f value)"

    if [ $(echo "${DHCP_PORTS}" | wc -l) -ne ${MAX_DHCP_NS} ]; then
        echo "NETWORK_ID: ${NETWORK_ID}"
        echo "${DHCP_PORTS}"

        echo
    fi
done

Add / remove DHCP ports

NETWORK_ID=xxxxxx-xxxxxx-xxxxxx-xxxxxx-xxxxxx
CONTROL_NODE=az3-ctl3-prod

DHCP_AGENT_ID=$(openstack network agent list --host ${CONTROL_NODE} --agent-type dhcp -f value -c ID)
echo "DHCP_AGENT_ID: ${DHCP_AGENT_ID}"

# Add DHCP namespace
openstack network agent add network ${DHCP_AGENT_ID} ${NETWORK_ID} --dhcp

# Remove DHCP namespace
openstack network agent remove network ${DHCP_AGENT_ID} ${NETWORK_ID} --dhcp

# List DHCP namespaces for network
openstack port list --device-owner network:dhcp --network ${NETWORK_ID} -c id -c mac_address -c fixed_ips -c status -c binding_host_id

Remove unnecessary DHCP port

OpenStack: RBAC shared network

# allow access to RBAC net for project 
openstack network rbac create --target-project foo-project1 --action access_as_shared --type network foo-net-01

# show rbac quota
neutron quota-show --tenant_id  | grep rbac_policy

# set rbac quota to unlimited
openstack quota set --rbac-policies -1 

openstack network rbac list

openstack network rbac show ${RBAC_ID}

Links
https://docs.openstack.org/python-openstackclient/latest/cli/command-objects/network-rbac.html
https://docs.openstack.org/mitaka/networking-guide/config-rbac.html
https://docs.openstack.org/python-openstackclient/pike/cli/command-objects/quota.html
https://docs.openstack.org/ocata/admin-guide/cli-networking-advanced-quotas.html

DevStack

DevStack XENA

sudo apt -y install git jq vim
sudo apt purge -y python3-distro-info

git clone --branch "stable/xena" https://opendev.org/openstack/devstack

HOST_IP=$(ip -o -4 -j a | jq -r '.[].addr_info[] | select(.dev == "ens3") .local')
echo ${HOST_IP}

DevStack XENA
https://openstack.goffinet.org/03-02-openstack-lab-devstack.html
http://lia.deis.unibo.it/Courses/CompNetworksM/1718/slides/NetworksM_Cloud180518_v1.pdf
https://opnfvblog.wordpress.com/2016/10/27/devstack-localconf/
https://01.org/sites/default/files/page/accelerating_openstack_networking_with_intel_architecture_rev008.pdf

openstack