Deploying and managing Red Hat OpenStack Services on OpenShift with GitOps

This repository contains an implementation of Red Hat GitOps (GitOps, ArgoCD) for managing the deployment of Red Hat OpenStack Services on OpenShift (RHOSO).

WARNING: This repository is provided as a Developer Preview for testing environments only, before all features have been implemented and tested. Therefore, some functionality may be absent, incomplete, or not work as expected, and is subject to change until the official release. Red Hat encourages customers to use the Developer Preview release to provide feedback.

Prerequisites: Use pinned resources

In your kustomization.yaml and related resources, make sure to use a fixed reference ?ref=VALUE, where VALUE is a hash or a tag.

Deploy the OpenShift GitOps Operator

Option 1: Deploy automatically with the included helper playbook

We provide a light playbook to facilitate the operator deployment and subsequent ArgoCD instance configuration.

Read the playbook documentation.

Option 2: Deploy manually with oc apply commands

1. Create the namespace, operatorgroup and subscription:

   oc apply -k openshift-gitops.deploy/subscribe

2. Ensure that the namespace is present:

   oc get namespace openshift-gitops

3. Configure the RBAC and ArgoCD instance:

   oc apply -k openshift-gitops.deploy/enable

4. Ensure that the ArgoCD instance is running:

   oc -n openshift-gitops get argocd/openshift-gitops

Deploy the Vault Secrets Operator (VSO)

HashiCorp Vault is used to store secrets, and VaultStaticSecret are used to pull those secrets into OCP.

Procedure

1. Create the subscription using ArgoCD:

   oc apply -f applications/vault-secrets-operator.yaml

Links

• Learn more about VSO.
• VSO on catalog.redhat.com

ArgoCD orchestration principles

Sync-waves

We’re using sync-waves annotations for specific jobs and actions.

The range -20;20 is reserved.

Healthchecks

TBD

Application responsibilities and content

openstack-operator

Purpose

Installs the foundational OpenStack operators required for the deployment. Covers Installation Documentation Chapter 1 and part of Installation Documentation Chapter 2

Key resources

• Namespaces: openstack, openstack-operators
• Operator Subscription: OpenStack operator from Red Hat CDN
• RBAC: Install plan approver service account and roles
• Job: approve-openstack-installplan to "imperatively" accept the install_plan created by OLM and wait for its completion.

openstack-operator-cr

Purpose

Creates the main OpenStack custom resource that defines the overall OpenStack deployment configuration. Covers Installation Documentation Chapter 1.

Key resources

• OpenStack CR: Primary configuration object in openstack-operators namespace

openstack-networks

Purpose

Create underlying networks for controlplane and dataplane. Covers Installation Documentation Chapter 3.

Key resources

• 3.2.1. Preparing RHOCP with isolated network interfaces: for NodeNetworkConfigurationPolicies resources
• 3.2.2. Attaching service pods to the isolated networks: for NetworkAttachmentDefinitions resources
• 3.2.3. Preparing RHOCP for RHOSO network VIPS for L2Advertisements and IPAdrressPool resources
• 3.3. CREATING THE DATA PLANE NETWORK: for NetConfig resources

openstack-controlplane

Purpose

Deploys and configures OpenStackControlPlane resource. Covers Installation Documentation Chapter 4

Key resources

• OpenStackControlPlane

openstack-dataplane

Purpose

Deploys and configures the OpenStack data plane nodes. Covers Installation Documentation Chapter 5

Key resources

• OpenStackDataPlaneNodeSet
• OpenStackDataPlaneDeployment

What’s NOT covered by ArgoCD applications yet

Dependencies installation

Dependencies such as MetalLB, NMState and Cert-Manager are not deployed nor managed using ArgoCD Application yet.

Secret management and creation

Secrets are to be stored within a secure service, such as HashiCorp Vault, and never in Git. Our main focus for now is on the RHOSO application slicing, we will provide an ArgoCD Application definition later.

Consume proposed components

Base controlplane

Provides the base for IPAddressPool, L2Advertisement, NetworkAttachementDefinition, NetConfig NodeNetworkConfigurationPolicy and OpenStackControlPlane on a 3-master OCP cluster.

The CR are extracted from the RHOSO official documentation

Base dataplane

Provides the base for the OpenStackDataplaneNodeSet and OpenStackDataPlaneDeployment.

The CRs are extracted from the RHOSO official documentation

ArgoCD sync-wave annotation

These annotations enable ArgoCD to determine the order that resources are created for the whole RHOSO cloud. Learn more about sync-waves

Example usage

1. Directly within the Application definition:

   apiVersion: argoproj.io/v1alpha1
   kind: Application
   metadata:
   # [...]
   spec:
     project: "default"
     source:
       repoURL: "..."
       targetRevision: "..."
       path: "..."
       kustomize:
         components:
           -  https://github.com/openstack-k8s-operators/gitops/components/argocd/annotations?ref=TAG

2. From within an overlay or base:

   apiVersion: kustomize.config.k8s.io/v1beta1
   kind: Kustomization
   components:
     - https://github.com/openstack-k8s-operators/gitops/components/argocd/annotations?ref=TAG
   # [...]

External resources

1. Official RHOSO documentation
2. Official openshift-gitops documentation
3. Official ArgoCD documentation