Small cloud with trusted tenants¶

Control plane network¶

The control plane network is the network where OpenStack control plane services provide their public API.

The Bare Metal API will be served to the operators and to the Compute service through this network.

Public network¶

The public network is used in a typical OpenStack deployment to create floating IPs for outside access to instances. Its role is the same for a bare metal deployment.

Bare metal network¶

The Bare metal network is a dedicated network for bare metal nodes managed by the Bare Metal service.

This architecture uses flat bare metal networking, in which both tenant traffic and technical traffic related to the Bare Metal service operation flow through this one network. Specifically, this network will serve as the provisioning, cleaning and rescuing network. It will also be used for introspection via the Bare Metal Introspection service. See common networking considerations for an in-depth explanation of the networks used by the Bare Metal service.

DHCP and boot parameters will be provided on this network by the Networking service’s DHCP agents.

For booting from volumes this network has to have a route to the storage network.

Management network¶

Management network is an independent network on which BMCs of the bare metal nodes are located.

The ironic-conductor process needs access to this network. The tenants of the bare metal nodes must not have access to it.

Bare Metal services¶

The following components of the Bare Metal service are installed on a controller (see components of the Bare Metal service):

• The Bare Metal API service either as a WSGI application or the ironic-api process. Typically, a load balancer, such as HAProxy, spreads the load between the API instances on the controllers.

  The API has to be served on the control plane network. Additionally, it has to be exposed to the bare metal network for the ramdisk callback API.

• The ironic-conductor process. These processes work in active/active HA mode as explained in HA and Scalability, thus they can be installed on all controllers. Each will handle a subset of bare metal nodes.

  The ironic-conductor processes have to have access to the following networks:

  • control plane for interacting with other services
  • management for contacting node’s BMCs
  • bare metal for contacting deployment, cleaning or rescue ramdisks

• TFTP and HTTP service for booting the nodes. Each ironic-conductor process has to have a matching TFTP and HTTP service. They should be exposed only to the bare metal network and must not be behind a load balancer.

• The nova-compute process (from the Compute service). These processes work in active/active HA mode when dealing with bare metal nodes, thus they can be installed on all controllers. Each will handle a subset of bare metal nodes.

  Note

  There is no 1-1 mapping between ironic-conductor and nova-compute processes, as they communicate only through the Bare Metal API service.

• The networking-baremetal ML2 plugin should be loaded into the Networking service to assist with binding bare metal ports.

  The ironic-neutron-agent service should be started as well.

• If the Bare Metal introspection is used, its ironic-inspector process has to be installed on all controllers. Each such process works as both Bare Metal Introspection API and conductor service. A load balancer should be used to spread the API load between controllers.

  The API has to be served on the control plane network. Additionally, it has to be exposed to the bare metal network for the ramdisk callback API.

Shared services¶

A controller also hosts two services required for the normal operation of OpenStack:

• Database service (MySQL/MariaDB is typically used, but other enterprise-grade database solutions can be used as well).

  All Bare Metal service components need access to the database service.

• Message queue service (RabbitMQ is typically used, but other enterprise-grade message queue brokers can be used as well).

  Both Bare Metal API (WSGI application or ironic-api process) and the ironic-conductor processes need access to the message queue service. The Bare Metal Introspection service does not need it.