Merge pull request #1098 from eduolivares/bgp-xl-adoption

Add support for bgp-l3-xl-adoption

Author: openshift-merge-bot[bot]

docs_user/modules/proc_adopting-compute-services-to-the-data-plane.adoc

@@ -637,8 +637,24 @@ done
 ----
 +
 [NOTE]
+====
 Ensure that you use the same list of services from the original `OpenStackDataPlaneNodeSet` CR, except for the `ceph-client` and `ceph-hci-pre` services.
 
+For environments that are enabled with border gateway protocol (BGP), you must add the following services to the list in the order shown:
+
+* After `configure-network` and before `validate-network`: Add `frr` service for FRRouting BGP support
+* After `neutron-metadata` and before `libvirt`: Add `ovn-bgp-agent` service for OVN BGP agent
+
+You must also configure the following additional Ansible variables in the `nodeTemplate.ansible.ansibleVars` section:
+
+* `edpm_frr_image`: The FRRouting container image
+* `edpm_ovn_bgp_agent_image`: The OVN BGP agent container image
+* `edpm_frr_bgp_ipv4_src_network`: The network name for BGP IPv4 source (for example, `bgpmainnet`)
+* `edpm_frr_bgp_ipv6_src_network`: The network name for BGP IPv6 source (for example, `bgpmainnetv6`)
+* `edpm_frr_bgp_neighbor_password`: The BGP neighbor password
+* `edpm_ovn_encap_ip`: Set to the BGP main network IP (for example, `{{ lookup("vars", "bgpmainnet_ip") }}`)
+====
+
 . Optional: Enable `neutron-sriov-nic-agent` in the `OpenStackDataPlaneNodeSet` CR:
 +
 ----

docs_user/modules/proc_adopting-networker-services-to-the-data-plane.adoc

@@ -258,6 +258,23 @@ EOF
 * `spec.tlsEnabled` specifies whether TLS Everywhere is enabled. If TLS is enabled, change `spec:tlsEnabled` to `true`.
 * `edpm_ovn_bridge_mappings: <bridge_mappings>` specifies the bridge mapping values that you used in your {rhos_prev_long} {rhos_prev_ver} deployment.
 * `edpm_enable_chassis_gw` specifies whether to run `ovn-controller` in gateway mode.
++
+[NOTE]
+====
+For environments that are enabled with border gateway protocol (BGP), you must add the following services to the `services` list in the order shown:
+
+* After `configure-network` and before `validate-network`: Add `frr` service for FRRouting BGP support
+* After `ovn` and `neutron-metadata` services: Add `ovn-bgp-agent` service
+
+You must also configure the following additional Ansible variables in the `nodeTemplate.ansible.ansibleVars` section:
+
+* `edpm_frr_image`: The FRRouting container image
+* `edpm_ovn_bgp_agent_image`: The OVN BGP agent container image
+* `edpm_frr_bgp_ipv4_src_network`: The network name for BGP IPv4 source (for example, `bgpmainnet`)
+* `edpm_frr_bgp_ipv6_src_network`: The network name for BGP IPv6 source (for example, `bgpmainnetv6`)
+* `edpm_frr_bgp_neighbor_password`: The BGP neighbor password
+* `edpm_ovn_encap_ip`: Set to the BGP main network IP (for example, `{{ lookup("vars", "bgpmainnet_ip") }}`)
+====
 
 . Ensure that you use the same `ovn-controller` settings in the `OpenStackDataPlaneNodeSet` CR that you used in the Networker nodes before adoption. This configuration is stored in the `external_ids` column in the `Open_vSwitch` table in the Open vSwitch database:
 +

docs_user/modules/proc_migrating-databases-to-mariadb-instances.adoc

@@ -227,8 +227,7 @@ test -z "$PULL_OPENSTACK_CONFIGURATION_MYSQLCHECK_NOK"  || [ "x$PULL_OPENSTACK_C
 +
 ----
 for CELL in $(echo "super $RENAMED_CELLS"); do
-  oc run mariadb-client --image $MARIADB_IMAGE -i --rm --restart=Never -- \
-    mysql -rsh "${PODIFIED_MARIADB_IP[$CELL]}" -uroot -p"${PODIFIED_DB_ROOT_PASSWORD[$CELL]}" -e 'SHOW databases;'
+  oc rsh mariadb-copy-data mysql -rsh "${PODIFIED_MARIADB_IP[$CELL]}" -uroot -p"${PODIFIED_DB_ROOT_PASSWORD[$CELL]}" -e 'SHOW databases;'
 done
 ----
 +

docs_user/modules/proc_retrieving-topology-specific-service-configuration.adoc

@@ -93,6 +93,23 @@ endif::[]
 ifeval::["{build_variant}" != "ospdo"]
 $ MARIADB_CLIENT_ANNOTATIONS='--annotations=k8s.v1.cni.cncf.io/networks=internalapi'
 $ MARIADB_RUN_OVERRIDES="$MARIADB_CLIENT_ANNOTATIONS"
+----
++
+[NOTE]
+====
+For environments that are enabled with border gateway protocol (BGP), the network annotation must include a default route to enable proper routing. Use the following instead:
+
+----
+$ MARIADB_CLIENT_ANNOTATIONS='--annotations=k8s.v1.cni.cncf.io/networks=[{"name":"internalapi","namespace":"openstack","default-route":["<172.17.0.1>"]}]'
+$ MARIADB_RUN_OVERRIDES="$MARIADB_CLIENT_ANNOTATIONS"
+----
+where:
+
+<172.17.0.1>::
+Replace with the gateway IP address of your `internalapi` network.
+====
++
+----
 
 ifeval::["{build}" != "downstream"]
 $ CONTROLLER1_SSH="ssh -i ~/install_yamls/out/edpm/ansibleee-ssh-key-id_rsa root@192.168.122.100"
@@ -136,13 +153,52 @@ The source cloud always uses the same password for cells databases. For that rea
 
 .Procedure
 
+. If your source {OpenStackShort} environment uses border gateway protocol (BGP) for Layer 3 networking, create a `BGPConfiguration` custom resource to enable BGP routing:
++
+----
+$ cat << EOF > bgp.yaml
+apiVersion: network.openstack.org/v1beta1
+kind: BGPConfiguration
+metadata:
+  name: bgpconfiguration
+  namespace: openstack
+spec: {}
+EOF
+
+$ oc apply -f bgp.yaml
+----
++
+The `BGPConfiguration` resource enables BGP route advertisement between the {rhocp_long} cluster and the source cloud, which is necessary for the `mariadb-client` pod to reach the source MariaDB cluster.
+
+. Create a persistent `mariadb-client` pod for database operations:
++
+----
+$ oc delete pod mariadb-client || true
+$ oc run mariadb-client ${MARIADB_RUN_OVERRIDES} -q --image ${MARIADB_IMAGE} --restart=Never -- /usr/bin/sleep infinity
+----
++
+This creates a long-running pod that is used for all subsequent database operations, avoiding the need to create temporary pods for each command.
+
+. Wait for the `mariadb-client` pod to be able to reach the source MariaDB:
++
+----
+$ oc rsh mariadb-client mysql -rsh "${SOURCE_MARIADB_IP[default]}" -uroot -p"${SOURCE_DB_ROOT_PASSWORD[default]}" -e 'select 1;'
+----
++
+[NOTE]
+====
+For BGP-enabled environments, this command might take a few moments to succeed while BGP routes are advertised and propagated through the network. The `mariadb-client` pod needs to receive the route to the source MariaDB IP address through BGP before it can establish a connection. If the command fails, wait a few seconds and retry. The connection should succeed once the BGP route advertisement is complete.
+
+For standard (non-BGP) deployments, this command should succeed immediately.
+====
+
 . Export the shell variables for the following outputs and test the connection to the {OpenStackShort} database:
 +
 ----
 $ unset PULL_OPENSTACK_CONFIGURATION_DATABASES
 $ declare -xA PULL_OPENSTACK_CONFIGURATION_DATABASES
 $ for CELL in $(echo $CELLS); do
->     PULL_OPENSTACK_CONFIGURATION_DATABASES[$CELL]=$(oc run mariadb-client-1-$CELL ${MARIADB_RUN_OVERRIDES} -q --image ${MARIADB_IMAGE} -i --rm --restart=Never -- \
+>     PULL_OPENSTACK_CONFIGURATION_DATABASES[$CELL]=$(oc rsh mariadb-client \
 >         mysql -rsh "${SOURCE_MARIADB_IP[$CELL]}" -uroot -p"${SOURCE_DB_ROOT_PASSWORD[$CELL]}" -e 'SHOW databases;')
 > done
 ----
@@ -161,16 +217,16 @@ endif::[]
 $ unset PULL_OPENSTACK_CONFIGURATION_MYSQLCHECK_NOK
 $ declare -xA PULL_OPENSTACK_CONFIGURATION_MYSQLCHECK_NOK
 $ run_mysqlcheck() {
->     PULL_OPENSTACK_CONFIGURATION_MYSQLCHECK_NOK=$(oc run mariadb-client-2-$1 ${MARIADB_RUN_OVERRIDES} -q --image ${MARIADB_IMAGE} -i --rm --restart=Never -- \
+>     PULL_OPENSTACK_CONFIGURATION_MYSQLCHECK_NOK=$(oc rsh mariadb-client \
 >         mysqlcheck --all-databases -h ${SOURCE_MARIADB_IP[$CELL]} -u root -p"${SOURCE_DB_ROOT_PASSWORD[$CELL]}" | grep -v OK)
 > }
 $ for CELL in $(echo $CELLS); do
 >     run_mysqlcheck $CELL
 > done
 $ if [ "$PULL_OPENSTACK_CONFIGURATION_MYSQLCHECK_NOK" != "" ]; then
 >     for CELL in $(echo $CELLS); do
->         MYSQL_UPGRADE=$(oc run mariadb-client-3 ${MARIADB_RUN_OVERRIDES} -q --image ${MARIADB_IMAGE} -i --rm --restart=Never -- \
->             mysql_upgrade -v -h ${SOURCE_MARIADB_IP[$CELL]} -u root -p"${SOURCE_DB_ROOT_PASSWORD[$CELL]}")
+>         MYSQL_UPGRADE=$(oc rsh mariadb-client \
+>             mysql_upgrade --skip-version-check -v -h ${SOURCE_MARIADB_IP[$CELL]} -u root -p"${SOURCE_DB_ROOT_PASSWORD[$CELL]}")
 >         # rerun mysqlcheck to check if problem is resolved
 >         run_mysqlcheck
 >     done
@@ -180,8 +236,8 @@ $ if [ "$PULL_OPENSTACK_CONFIGURATION_MYSQLCHECK_NOK" != "" ]; then
 . Get the {compute_service_first_ref} cell mappings:
 +
 ----
-export PULL_OPENSTACK_CONFIGURATION_NOVADB_MAPPED_CELLS=$(oc run mariadb-client-1 ${MARIADB_RUN_OVERRIDES} -q --image ${MARIADB_IMAGE} -i --rm --restart=Never -- \
-    mysql -rsh "${SOURCE_MARIADB_IP['default']}" -uroot -p"${SOURCE_DB_ROOT_PASSWORD['default']}" nova_api -e \
+export PULL_OPENSTACK_CONFIGURATION_NOVADB_MAPPED_CELLS=$(oc rsh mariadb-client \
+    mysql -rsh "${SOURCE_MARIADB_IP[default]}" -uroot -p"${SOURCE_DB_ROOT_PASSWORD[default]}" nova_api -e \
     'select uuid,name,transport_url,database_connection,disabled from cell_mappings;')
 ----
 
@@ -191,7 +247,7 @@ export PULL_OPENSTACK_CONFIGURATION_NOVADB_MAPPED_CELLS=$(oc run mariadb-client-
 $ unset PULL_OPENSTACK_CONFIGURATION_NOVA_COMPUTE_HOSTNAMES
 $ declare -xA PULL_OPENSTACK_CONFIGURATION_NOVA_COMPUTE_HOSTNAMES
 $ for CELL in $(echo $CELLS); do
->     PULL_OPENSTACK_CONFIGURATION_NOVA_COMPUTE_HOSTNAMES[$CELL]=$(oc run mariadb-client-4-$CELL ${MARIADB_RUN_OVERRIDES} -q --image ${MARIADB_IMAGE} -i --rm --restart=Never -- \
+>     PULL_OPENSTACK_CONFIGURATION_NOVA_COMPUTE_HOSTNAMES[$CELL]=$(oc rsh mariadb-client \
 >         mysql -rsh "${SOURCE_MARIADB_IP[$CELL]}" -uroot -p"${SOURCE_DB_ROOT_PASSWORD[$CELL]}" -e \
 >             "select host from nova.services where services.binary='nova-compute' and deleted=0;")
 > done
@@ -218,15 +274,15 @@ $ for CELL in $(echo $CELLS); do
 > declare -xA PULL_OPENSTACK_CONFIGURATION_DATABASES
 > declare -xA PULL_OPENSTACK_CONFIGURATION_MYSQLCHECK_NOK
 > declare -xA PULL_OPENSTACK_CONFIGURATION_NOVA_COMPUTE_HOSTNAMES
-> PULL_OPENSTACK_CONFIGURATION_DATABASES[$CELL]="$(oc run mariadb-client-5-$CELL ${MARIADB_RUN_OVERRIDES} -q --image ${MARIADB_IMAGE} -i --rm --restart=Never -- \
+> PULL_OPENSTACK_CONFIGURATION_DATABASES[$CELL]="$(oc rsh mariadb-client \
 >     mysql -rsh ${SOURCE_MARIADB_IP[$RCELL]} -uroot -p${SOURCE_DB_ROOT_PASSWORD[$RCELL]} -e 'SHOW databases;')"
-> PULL_OPENSTACK_CONFIGURATION_MYSQLCHECK_NOK[$CELL]="$(oc run mariadb-client-6-$CELL ${MARIADB_RUN_OVERRIDES} -q --image ${MARIADB_IMAGE} -i --rm --restart=Never -- \
+> PULL_OPENSTACK_CONFIGURATION_MYSQLCHECK_NOK[$CELL]="$(oc rsh mariadb-client \
 >     mysqlcheck --all-databases -h ${SOURCE_MARIADB_IP[$RCELL]} -u root -p${SOURCE_DB_ROOT_PASSWORD[$RCELL]} | grep -v OK)"
-> PULL_OPENSTACK_CONFIGURATION_NOVA_COMPUTE_HOSTNAMES[$CELL]="$(oc run mariadb-client-7-$CELL ${MARIADB_RUN_OVERRIDES} -q --image ${MARIADB_IMAGE} -i --rm --restart=Never -- \
+> PULL_OPENSTACK_CONFIGURATION_NOVA_COMPUTE_HOSTNAMES[$CELL]="$(oc rsh mariadb-client \
 >     mysql -rsh ${SOURCE_MARIADB_IP[$RCELL]} -uroot -p${SOURCE_DB_ROOT_PASSWORD[$RCELL]} -e \
 >     "select host from nova.services where services.binary='nova-compute' and deleted=0;")"
 > if [ "$RCELL" = "default" ]; then
->     PULL_OPENSTACK_CONFIGURATION_NOVADB_MAPPED_CELLS="$(oc run mariadb-client-2 ${MARIADB_RUN_OVERRIDES} -q --image ${MARIADB_IMAGE} -i --rm --restart=Never -- \
+>     PULL_OPENSTACK_CONFIGURATION_NOVADB_MAPPED_CELLS="$(oc rsh mariadb-client \
 >         mysql -rsh ${SOURCE_MARIADB_IP[$RCELL]} -uroot -p${SOURCE_DB_ROOT_PASSWORD[$RCELL]} nova_api -e \
 >             'select uuid,name,transport_url,database_connection,disabled from cell_mappings;')"
 >     PULL_OPENSTACK_CONFIGURATION_NOVAMANAGE_CELL_MAPPINGS="$($CONTROLLER1_SSH sudo podman exec -it nova_conductor nova-manage cell_v2 list_cells)"
@@ -238,6 +294,14 @@ $ chmod 0600 ~/.source_cloud_exported_variables*
 +
 * `declare -xA SRIOV_AGENTS` gets the `neutron-sriov-nic-agent` configuration to use for the data plane adoption if `neutron-sriov-nic-agent` agents are running in your {OpenStackShort} deployment.
 
+. Clean up the `mariadb-client` pod:
++
+----
+$ oc delete pod mariadb-client
+----
++
+The `mariadb-client` pod is no longer needed after all the data is exported and stored.
+
 .Next steps
 
 This configuration and the exported values are required later, during the data plane adoption post-checks. After the {OpenStackShort} control plane services are shut down, if any of the exported values are lost, re-running the `export` command fails because the control plane services are no longer running on the source cloud, and the data cannot be retrieved. To avoid data loss, preserve the exported values in an environment file before shutting down the control plane services.