Skip to content

Commit 97c2a38

Browse files
klgillklgill
committed
new post-adoption procedure
1 parent 15eb56b commit 97c2a38

3 files changed

Lines changed: 113 additions & 2 deletions

File tree

docs_user/modules/con_post-adoption-tasks.adoc renamed to docs_user/assemblies/assembly_post-adoption-tasks.adoc

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,10 @@
1-
:_mod-docs-content-type: CONCEPT
1+
:_mod-docs-content-type: ASSEMBLY
22
[id="post-adoption-tasks_{context}"]
33

44
= Post-adoption tasks
55

6+
:context: post-adoption
7+
68
[role="_abstract"]
79
Perform the following post-adoption tasks to ensure that your {rhos_long} environment is functioning optimally.
810

@@ -21,3 +23,5 @@ Perform the following post-adoption tasks to ensure that your {rhos_long} enviro
2123
* xref:enabling-high-availability-for-instances_data-plane[Enabling the high availability for Compute instances service]
2224
* link:https://docs.redhat.com/en/documentation/red_hat_openstack_services_on_openshift/18.0/html-single/configuring_security_services/index#assembly_enabling-TLS-on-a-deployed-RHOSO-environment[Enabling TLS on a deployed RHOSO environment]
2325
* link:https://docs.redhat.com/en/documentation/red_hat_openstack_services_on_openshift/18.0/html/validating_and_troubleshooting_the_deployed_cloud/index[Validating and troubleshooting the deployed cloud]
26+
27+
include::../modules/proc_updating-shiftstack-credentials.adoc[leveloffset=+1]

‎docs_user/main.adoc‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,4 +32,5 @@ include::assemblies/assembly_migrating-the-object-storage-service.adoc[leveloffs
3232

3333
include::assemblies/assembly_migrating-ceph-cluster.adoc[leveloffset=+1]
3434

35-
include::modules/con_post-adoption-tasks.adoc[leveloffset=+1]
35+
include::assemblies/assembly_post-adoption-tasks.adoc[leveloffset=+1]
36+

‎docs_user/modules/proc_updating-shiftstack-credentials.adoc‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
:_mod-docs-content-type: PROCEDURE
2+
[id="updating-shiftstack-credentials_{context}"]
3+
4+
= Updating shiftstack credentials and recovering the image-registry operator
5+
6+
[role="_abstract"]
7+
After {rhos_long} adoption, any {rhocp_long} clusters that were deployed on {rhos_prev_long} ({OpenStackShort}) 17.1 with installer-provisioned infrastructure (Shift on Stack) still reference the {OpenStackPreviousInstaller} keystone endpoint in their cloud credentials. To authenticate with keystone and avoid timeouts, update the credentials and image-registry operator.
8+
9+
[IMPORTANT]
10+
Run all commands against the guest {OpenShiftShort} cluster (Shiftstack) that is running on {OpenStackShort} VMs, not the underlying {rhos_acro} host cluster.
11+
12+
.Procedure
13+
14+
. Verify the stale secret on the shiftstack cluster:
15+
+
16+
----
17+
$ oc get secret openstack-credentials -n kube-system \
18+
-o jsonpath='{.data.clouds\.yaml}' | base64 -d | grep auth_url
19+
----
20+
+
21+
The output shows the {OpenStackPreviousInstaller} endpoint that can no longer be used after adoption. For example, https://overcloud.redhat.local:13000 or http://<tripleo-vip>:5000.
22+
23+
. Check if the new {rhos_acro} keystone is reachable from the shiftstack cluster nodes:
24+
+
25+
----
26+
$ RHOSO_AUTH_URL="http://keystone-public-openstack.apps.<host-cluster-domain>"
27+
$ oc debug node/$(oc get nodes -o jsonpath='{.items[0].metadata.name}') \
28+
-- chroot /host curl -sk -m 10 "${RHOSO_AUTH_URL}/v3/"
29+
----
30+
+
31+
[IMPORTANT]
32+
If the command returns a JSON response with keystone version information, proceed to step 3. If the command times out, the {rhos_acro} endpoint is not reachable from the shiftstack cluster's network. You can still proceed with steps 3-5 because the credential update and image-registry fix will work regardless of {OpenStackShort} reachability. However, operators such as OCCM and CSI will continue logging timeout errors until the {rhos_acro} endpoint becomes reachable from the guest nodes.
33+
34+
. Update the source secret with the {rhos_acro} endpoint:
35+
+
36+
[NOTE]
37+
The shiftstack user, password, and project are preserved after adoption. Adoption uses the same keystone database as the one used in {rhos_prev_long} ({OpenStackShort}) 17.1. Only the `auth_url` needs to change. If {rhos_acro} uses HTTPS with a different certificate authority, update the `cacert` path too.
38+
+
39+
----
40+
$ oc get secret openstack-credentials -n kube-system \
41+
-o jsonpath='{.data.clouds\.yaml}' | base64 -d > /tmp/clouds.yaml
42+
# Edit /tmp/clouds.yaml: change auth_url to the RHOSO keystone endpoint
43+
$ B64=$(base64 < /tmp/clouds.yaml | tr -d '\n')
44+
$ oc patch secret openstack-credentials -n kube-system \
45+
-p "{\"data\":{\"clouds.yaml\":\"${B64}\"}}"
46+
----
47+
48+
. Wait for Cloud Credential Operator (CCO) to propagate the source secret to all namespace-specific secrets, and then verify that the new {rhos_acro} endpoint is reachable:
49+
+
50+
----
51+
$ oc get secret installer-cloud-credentials -n openshift-image-registry \
52+
-o jsonpath='{.data.clouds\.yaml}' | base64 -d | grep auth_url
53+
----
54+
+
55+
[NOTE]
56+
The output should show the new {rhos_acro} endpoint in the `auth_url` field. If the output still shows the previous endpoint after a few minutes, check that the CCO pod is running and that the CCO mode is Passthrough:
57+
+
58+
----
59+
$ oc get pods -n openshift-cloud-credential-operator
60+
$ oc get cloudcredential cluster -o jsonpath='{.spec.credentialsMode}'
61+
----
62+
+
63+
If the CCO is healthy but not propagating, patch each namespace secret directly by using the following command:
64+
+
65+
----
66+
$ oc patch secret openstack-credentials -n kube-system \
67+
-p "{\"data\":{\"clouds.yaml\":\"${B64}\"}}"
68+
----
69+
70+
. Switch the image-registry storage from Swift to emptyDir:
71+
+
72+
----
73+
$ oc patch configs.imageregistry.operator.openshift.io cluster \
74+
--type json -p '[{"op":"replace","path":"/spec/storage","value":{"emptyDir":{}}}]'
75+
----
76+
+
77+
[WARNING]
78+
emptyDir is non-persistent. Registry images are lost when the pod restarts. For production, configure PVC-backed storage instead.
79+
+
80+
emptyDir does not require working {OpenStackShort} credentials. The image-registry operator only calls the {OpenStackShort} API when Swift is the configured back end. This step works regardless of whether the new {rhos_acro} keystone is reachable from the shiftstack cluster node.
81+
82+
.Verification
83+
84+
* Verify that the credentials are pointing to the new {rhos_acro} endpoint:
85+
+
86+
----
87+
$ oc get co image-registry cloud-controller-manager storage machine-api
88+
----
89+
+
90+
Wait about 5 minutes.
91+
+
92+
The following example shows the output if the new {rhos_acro} keystone was not reachable from the shiftstack cluster nodes in step 2:
93+
+
94+
----
95+
NAME VERSION AVAILABLE PROGRESSING DEGRADED SINCE MESSAGE
96+
image-registry 4.22.0-rc.0 True False True 14m ImagePrunerDegraded: Job has reached the specified backoff limit
97+
cloud-controller-manager 4.22.0-rc.0 True False False 3d10h
98+
storage 4.22.0-rc.0 True False False 3d10h
99+
machine-api 4.22.0-rc.0 True False False 3d9h
100+
----
101+
+
102+
[NOTE]
103+
====
104+
* If you completed steps 2-4 with a reachable {rhos_acro} endpoint, the timeout errors should be resolved.
105+
* The output displays an environment that is running {rhocp_long} 4.22. If you are using an earlier version of {rhocp_long}, you might see different operator states.
106+
====

0 commit comments

Comments
 (0)