Octavia

The following file is an example on an Octavia deployment:

# NOTE: This file serves as an example only!
# It demonstrates a subset of the API features which are available and
# is NOT FIT FOR PRODUCTIVE USE. You need to adapt them to your
# specific environment, needs and scale.
# DO NOT DEPLOY THIS FILE WITH THE EXPECTATION THAT YOU WILL GET A
# YAOOK DEPLOYMENT FIT FOR ANY USE EXCEPT LOOKING AT IT.
apiVersion: yaook.cloud/v1
kind: OctaviaDeployment
metadata:
  name: octavia
spec:
  keystoneRef:
    name: keystone
  neutronRef:
    name: neutron-ovn
  api:
    replicas: 1
    ingress:
      fqdn: "octavia.yaook.cloud"
      port: 32443
  health_manager: {}
  worker: {}
  housekeeping:
    replicas: 1
  networking:
    # CIDR of the Neutron network to be used to connect Octavia management
    # services and the Amphora VMs. Will be exposed via OVS internal ports
    # on Kubernetes nodes and must not collide with Kubernetes IP ranges!
    managementSubnetCIDR: "172.16.0.0/12"
  database:
    replicas: 1
    timeoutClient: 300
    proxy:
      replicas: 1
    backup:
      schedule: "0 * * * *"
  memcached: {}
  messageQueue:
    replicas: 1
  issuerRef:
    name: ca-issuer
  targetRelease: "2025.1"
  region:
    name: MyRegion
  policy:
    "context_is_admin": "role:load-balancer_admin or role:admin"
  octaviaConfig:
    DEFAULT:
      debug: True
    # (optional) enable audit logging
    audit:
      enabled: True
      audit_map_file: "/usr/local/etc/octavia/octavia_api_audit_map.conf"
    audit_middleware_notifications:
      use_oslo_messaging: True
      driver: "log"
    # controller_worker:
    #   # (optional) value of the 'owner' attribute of the Amphora image in
    #   # Glance, defaults to the ID of the 'service' project.
    #   amp_image_owner_id: "98a3c44385de48ddba045d8c19340451"
    #   # (optional) ID of the flavor in Nova to use for the Amphora VMs,
    #   # defaults to 'octavia-amphora'.
    #   amp_flavor_id: "my-flavor-id"
    #   # (optional) Name of the image tag for Amphora images, defaults to
    #   # 'amphora'.
    #   amp_image_tag: "custom-amphora-images"
    #   # (optional) Name of the keypair to access Amphora VMs
    #   amp_ssh_key_name: "amphora-admin"

In order to deploy the needed resources for Octavia, the openstack-resource-controller can be used.

# NOTE: This file serves as an example only!
# It demonstrates a subset of the API features which are available and
# is NOT FIT FOR PRODUCTIVE USE. You need to adapt them to your
# specific environment, needs and scale.
# DO NOT DEPLOY THIS FILE WITH THE EXPECTATION THAT YOU WILL GET A
# YAOOK DEPLOYMENT FIT FOR ANY USE EXCEPT LOOKING AT IT.
---
apiVersion: openstack.k-orc.cloud/v1alpha1
kind: Role
metadata:
  name: load-balancer-admin
spec:
  cloudCredentialsRef:
    cloudName: yaook-internal
    secretName: admin-clouds
  managementPolicy: managed
  resource:
    name: load-balancer_admin
    description: User has access to load-balancer read and write APIs
---
apiVersion: openstack.k-orc.cloud/v1alpha1
kind: Role
metadata:
  name: load-balancer-member
spec:
  cloudCredentialsRef:
    cloudName: yaook-internal
    secretName: admin-clouds
  managementPolicy: managed
  resource:
    name: load-balancer_member
    description: >-
      User has access to load-balancer read-only APIs including resources owned
      by others
---
apiVersion: openstack.k-orc.cloud/v1alpha1
kind: Role
metadata:
  name: load-balancer-global-observer
spec:
  cloudCredentialsRef:
    cloudName: yaook-internal
    secretName: admin-clouds
  managementPolicy: managed
  resource:
    name: load-balancer_global_observer
    description: User has access to load-balancer read-only APIs
---
apiVersion: openstack.k-orc.cloud/v1alpha1
kind: Role
metadata:
  name: load-balancer-quota-admin
spec:
  cloudCredentialsRef:
    cloudName: yaook-internal
    secretName: admin-clouds
  managementPolicy: managed
  resource:
    name: load-balancer_quota_admin
    description: User is considered an admin for quota APIs only
---
apiVersion: openstack.k-orc.cloud/v1alpha1
kind: Flavor
metadata:
  name: amphora-loadbalancer
spec:
  cloudCredentialsRef:
    cloudName: yaook-internal
    secretName: octavia-clouds
  resource:
    id: octavia-amphora
    description: Flavor for Octavia Amphora
    disk: 2
    isPublic: false
    ram: 1024
    vcpus: 1
---
apiVersion: openstack.k-orc.cloud/v1alpha1
kind: Image
metadata:
  name: octavia-amphora-haproxy-2025.1
spec:
  cloudCredentialsRef:
    cloudName: yaook-internal
    secretName: octavia-clouds
  managementPolicy: managed
  resource:
    content:
      containerFormat: bare
      diskFormat: qcow2
      download:
        url: https://nbg1.your-objectstorage.com/osism/openstack-octavia-amphora-image/octavia-amphora-haproxy-2025.1.qcow2
    name: octavia-amphora-haproxy-2025.1
    properties:
      architecture: x86_64
      hardware:
        diskBus: scsi
        scsiModel: virtio-scsi
      minDiskGB: 2
      minMemoryMB: 1024
      operatingSystem:
        distro: ubuntu
        version: "22.04"
    protected: false
    # Note: The image tag needs to be the same as the ``amp_image_tag`` as in the example Yaook Octavia deployment
    tags:
    - custom-amphora-images
    visibility: private
# Note: This keypair is optional for accessing Amphora VMs
---
apiVersion: openstack.k-orc.cloud/v1alpha1
kind: KeyPair
metadata:
  name: amphora-admin
spec:
  cloudCredentialsRef:
    cloudName: yaook-internal
    secretName: octavia-clouds
  managementPolicy: managed
  resource:
    # Note: An optional defined keypair which needs to have the same name as the ``amp_ssh_key_name`` as in the example Yaook Octavia deployment
    name: amphora-admin
    publicKey: ssh-ed25519 AAAA[...]
    type: ssh
  managedOptions:
    onDelete: detach