Skip to content

Commit 1652a10

Browse files
openshift-merge-bot[bot]openshift-merge-bot[bot]
authored
Merge pull request #1378 from klgill/updating-shiftstack-credentials-procedure
new post-adoption procedure
2 parents ba2b031 + 72358b7 commit 1652a10

4 files changed

Lines changed: 113 additions & 3 deletions

File tree

docs_user/modules/con_post-adoption-tasks.adoc renamed to docs_user/assemblies/assembly_post-adoption-tasks.adoc

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,10 @@
1-
:_mod-docs-content-type: CONCEPT
1+
:_mod-docs-content-type: ASSEMBLY
22
[id="post-adoption-tasks_{context}"]
33

44
= Post-adoption tasks
55

6+
:context: post-adoption
7+
68
[role="_abstract"]
79
Perform the following post-adoption tasks to ensure that your {rhos_long} environment is functioning optimally.
810

@@ -21,3 +23,5 @@ Perform the following post-adoption tasks to ensure that your {rhos_long} enviro
2123
* xref:enabling-high-availability-for-instances_data-plane[Enabling the high availability for Compute instances service]
2224
* link:https://docs.redhat.com/en/documentation/red_hat_openstack_services_on_openshift/18.0/html-single/configuring_security_services/index#assembly_enabling-TLS-on-a-deployed-RHOSO-environment[Enabling TLS on a deployed RHOSO environment]
2325
* link:https://docs.redhat.com/en/documentation/red_hat_openstack_services_on_openshift/18.0/html/validating_and_troubleshooting_the_deployed_cloud/index[Validating and troubleshooting the deployed cloud]
26+
27+
include::../modules/proc_updating-shiftstack-credentials.adoc[leveloffset=+1]

‎docs_user/main.adoc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,4 +32,4 @@ include::assemblies/assembly_migrating-the-object-storage-service.adoc[leveloffs
3232

3333
include::assemblies/assembly_migrating-ceph-cluster.adoc[leveloffset=+1]
3434

35-
include::modules/con_post-adoption-tasks.adoc[leveloffset=+1]
35+
include::assemblies/assembly_post-adoption-tasks.adoc[leveloffset=+1]

‎docs_user/modules/proc_updating-shiftstack-credentials.adoc‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
:_mod-docs-content-type: PROCEDURE
2+
[id="updating-shiftstack-credentials_{context}"]
3+
4+
= Updating {OpenShiftShort} on {OpenStackShort} credentials and recovering the image-registry operator
5+
6+
[role="_abstract"]
7+
After {rhos_long} adoption, any {rhocp_long} clusters that were deployed on {rhos_prev_long} ({OpenStackShort}) 17.1 with installer-provisioned infrastructure still reference the {OpenStackPreviousInstaller} keystone endpoint in their cloud credentials. To authenticate with keystone and avoid timeouts, update the credentials and image-registry operator.
8+
9+
[IMPORTANT]
10+
Run all commands against the guest {OpenShiftShort} cluster that is running on {OpenStackShort} VMs, not the underlying {rhos_acro} host cluster.
11+
12+
.Procedure
13+
14+
. Verify the stale secret on the {OpenShiftShort} on {OpenStackShort} cluster:
15+
+
16+
----
17+
$ oc get secret openstack-credentials -n kube-system \
18+
-o jsonpath='{.data.clouds\.yaml}' | base64 -d | grep auth_url
19+
----
20+
+
21+
The output shows the {OpenStackPreviousInstaller} endpoint that can no longer be used after adoption. For example, https://overcloud.redhat.local:13000 or http://<tripleo-vip>:5000.
22+
23+
. Check if the new {rhos_acro} keystone is reachable from the {OpenShiftShort} on {OpenStackShort} cluster nodes:
24+
+
25+
----
26+
$ RHOSO_AUTH_URL="http://keystone-public-openstack.apps.<host-cluster-domain>"
27+
$ oc debug node/$(oc get nodes -o jsonpath='{.items[0].metadata.name}') \
28+
-- chroot /host curl -sk -m 10 "${RHOSO_AUTH_URL}/v3/"
29+
----
30+
+
31+
[IMPORTANT]
32+
If the command returns a JSON response with keystone version information, proceed to step 3. If the command times out, the {rhos_acro} endpoint is not reachable from the {OpenShiftShort} on {OpenStackShort} cluster's network. You can still proceed with steps 3-5 because the credential update and image-registry fix will work regardless of {OpenStackShort} reachability. However, operators such as OCCM and CSI will continue logging timeout errors until the {rhos_acro} endpoint becomes reachable from the guest nodes.
33+
34+
. Update the source secret with the {rhos_acro} endpoint:
35+
+
36+
[NOTE]
37+
The {OpenShiftShort} on {OpenStackShort} user, password, and project are preserved after adoption. Adoption uses the same keystone database as the one used in {rhos_prev_long} ({OpenStackShort}) 17.1. Only the `auth_url` needs to change. If {rhos_acro} uses HTTPS with a different certificate authority, update the `cacert` path too.
38+
+
39+
----
40+
$ oc get secret openstack-credentials -n kube-system \
41+
-o jsonpath='{.data.clouds\.yaml}' | base64 -d > /tmp/clouds.yaml
42+
# Edit /tmp/clouds.yaml: change auth_url to the RHOSO keystone endpoint
43+
$ B64=$(base64 < /tmp/clouds.yaml | tr -d '\n')
44+
$ oc patch secret openstack-credentials -n kube-system \
45+
-p "{\"data\":{\"clouds.yaml\":\"${B64}\"}}"
46+
----
47+
48+
. Wait for Cloud Credential Operator (CCO) to propagate the source secret to all namespace-specific secrets, and then verify that the new {rhos_acro} endpoint is reachable:
49+
+
50+
----
51+
$ oc get secret installer-cloud-credentials -n openshift-image-registry \
52+
-o jsonpath='{.data.clouds\.yaml}' | base64 -d | grep auth_url
53+
----
54+
+
55+
[NOTE]
56+
The output should show the new {rhos_acro} endpoint in the `auth_url` field. If the output still shows the previous endpoint after a few minutes, check that the CCO pod is running and that the CCO mode is Passthrough:
57+
+
58+
----
59+
$ oc get pods -n openshift-cloud-credential-operator
60+
$ oc get cloudcredential cluster -o jsonpath='{.spec.credentialsMode}'
61+
----
62+
+
63+
If the CCO is healthy but not propagating, patch each namespace secret directly by using the following command:
64+
+
65+
----
66+
$ oc patch secret openstack-credentials -n kube-system \
67+
-p "{\"data\":{\"clouds.yaml\":\"${B64}\"}}"
68+
----
69+
70+
. Switch the image-registry storage from Swift to emptyDir:
71+
+
72+
----
73+
$ oc patch configs.imageregistry.operator.openshift.io cluster \
74+
--type json -p '[{"op":"replace","path":"/spec/storage","value":{"emptyDir":{}}}]'
75+
----
76+
+
77+
[WARNING]
78+
emptyDir is non-persistent. Registry images are lost when the pod restarts. For production, configure PVC-backed storage instead.
79+
+
80+
emptyDir does not require working {OpenStackShort} credentials. The image-registry operator only calls the {OpenStackShort} API when Swift is the configured back end. This step works regardless of whether the new {rhos_acro} keystone is reachable from the {OpenShiftShort} on {OpenStackShort} cluster node.
81+
82+
.Verification
83+
84+
* Verify that the credentials are pointing to the new {rhos_acro} endpoint:
85+
+
86+
----
87+
$ oc get co image-registry cloud-controller-manager storage machine-api
88+
----
89+
+
90+
Wait about 5 minutes.
91+
+
92+
The following example shows the output if the new {rhos_acro} keystone was not reachable from the {OpenShiftShort} on {OpenStackShort} cluster nodes in step 2:
93+
+
94+
----
95+
NAME VERSION AVAILABLE PROGRESSING DEGRADED SINCE MESSAGE
96+
image-registry 4.22.0-rc.0 True False True 14m ImagePrunerDegraded: Job has reached the specified backoff limit
97+
cloud-controller-manager 4.22.0-rc.0 True False False 3d10h
98+
storage 4.22.0-rc.0 True False False 3d10h
99+
machine-api 4.22.0-rc.0 True False False 3d9h
100+
----
101+
+
102+
[NOTE]
103+
====
104+
* If you completed steps 2-4 with a reachable {rhos_acro} endpoint, the timeout errors should be resolved.
105+
* The output displays an environment that is running {rhocp_long} 4.22. If you are using an earlier version of {rhocp_long}, you might see different operator states.
106+
====

‎docs_user/modules/ref_adoption-duration-and-impact.adoc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
= Adoption duration and impact
55

66
[role="_abstract"]
7-
The durations in the following table were recorded in a test environment that consisted of 228 Compute nodes and 3 Networker nodes. To accurately estimate the adoption duration for each task, perform these procedures in a test environment with hardware that is similar to your production environment. Ensure that you set up the {rhocp_long} ({OpenShiftShort}) environment and install the Operators before testing.
7+
The durations in the following table were recorded in a test environment that consisted of 228 Compute nodes and 3 Networker nodes. To accurately estimate the adoption duration for each task, perform these procedures in a test environment with hardware that is similar to your production environment. Ensure that you set up the {rhocp_long} environment and install the Operators before testing.
88

99
[IMPORTANT]
1010
Durations can vary significantly based on the content of your environment, for example, the size of your service databases or the number of services. The durations represent raw execution time. They do not include human operator activity.

0 commit comments

Comments
 (0)