Home OpenStack-Ansible Installation Guide
HAProxy provides load balancing for high availability architectures deployed by OpenStack-Ansible. The default HAProxy configuration provides highly-available load balancing services via keepalived if there are more than one hosts in the haproxy_hosts group.
Important
Ensure you review the services exposed by HAProxy and limit access to these services to trusted users and networks only. For more details, refer to the Securing network access to OpenStack services section.
Note
For a successful installation, you require a load balancer. You may prefer to make use of hardware load balancers instead of HAProxy. If hardware load balancers are in use, then implement the load balancing configuration for services prior to executing the deployment.
To deploy HAProxy within your OpenStack-Ansible environment, define target hosts to run HAProxy:
haproxy_hosts: infra1: ip: 172.29.236.101 infra2: ip: 172.29.236.102 infra3: ip: 172.29.236.103
There is an example configuration file already provided in /etc/openstack_deploy/conf.d/haproxy.yml.example. Rename the file to haproxy.yml and configure it with the correct target hosts to use HAProxy in an OpenStack-Ansible deployment.
If multiple hosts are found in the inventory, deploy HAProxy in a highly-available manner by installing keepalived.
Edit the /etc/openstack_deploy/user_variables.yml to skip the deployment of keepalived along HAProxy when installing HAProxy on multiple hosts. To do this, set the following:
.. code-block:: yaml
haproxy_use_keepalived: False
To make keepalived work, edit at least the following variables in user_variables.yml:
haproxy_keepalived_external_vip_cidr: 192.168.0.4/25
haproxy_keepalived_internal_vip_cidr: 172.29.236.54/16
haproxy_keepalived_external_interface: br-flat
haproxy_keepalived_internal_interface: br-mgmt
To always deploy (or upgrade to) the latest stable version of keepalived. Edit the /etc/openstack_deploy/user_variables.yml:
keepalived_use_latest_stable: True
The HAProxy playbook reads the vars/configs/keepalived_haproxy.yml variable file and provides content to the keepalived role for keepalived master and backup nodes.
Keepalived pings a public IP address to check its status. The default address is 193.0.14.129. To change this default, set the keepalived_ping_address variable in the user_variables.yml file.
Note
The keepalived test works with IPv4 addresses only.
You can define additional variables to adapt keepalived to your deployment. Refer to the user_variables.yml file for more information. Optionally, you can use your own variable file. For example:
haproxy_keepalived_vars_file: /path/to/myvariablefile.yml
OpenStack-Ansible configures keepalived with a check script that pings an external resource and uses that ping to determine if a node has lost network connectivity. If the pings fail, keepalived fails over to another node and HAProxy serves requests there.
The destination address, ping count and ping interval are configurable via Ansible variables in /etc/openstack_deploy/user_variables.yml:
keepalived_ping_address: # IP address to ping
keepalived_ping_count: # ICMP packets to send (per interval)
keepalived_ping_interval: # How often ICMP packets are sent
By default, OpenStack-Ansible configures keepalived to ping one of the root DNS servers operated by RIPE. You can change this IP address to a different external address or another address on your internal network.
The OpenStack-Ansible project provides the ability to secure HAProxy communications with self-signed or user-provided SSL certificates. By default, self-signed certificates are used with HAProxy. However, you can provide your own certificates by using the following Ansible variables:
haproxy_user_ssl_cert: # Path to certificate
haproxy_user_ssl_key: # Path to private key
haproxy_user_ssl_ca_cert: # Path to CA certificate
Refer to Securing services with SSL certificates for more information on these configuration options and how you can provide your own certificates and keys to use with HAProxy.