Skip to main content

How to deploy TripleO Queens without external network

TripleO Queens has an interesting feature that is called 'composable networks'. It allows to deploy Openstack with the choice of networks that you want, depending on your environment. Please see:

By default, the following networks are defined:
  • Storage
  • Storage Management
  • Internal Api
  • Tenant
  • Management
  • External
The external network allows to reach the endpoints externally, and also to define networks to reach the vms externally as well. But to have that, it is needed to have a network with external access, routable, on your lab. Not all labs have it, specially for CI environments, so it may be useful to deploy without it, and just have internal access to endpoints and vms. In this blogpost i'm just going to explain how to achieve it.

First make a copy of your original tripleo-heat-templates, to another directory /home/stack/working-templates, and edit the following files:


This file will contain the network definitions by default. You will need to edit it and remove all the external definitions from there. Remove that bits:

- name: External
  vip: true
  name_lower: external
  vlan: 10
  ip_subnet: ''
  allocation_pools: [{'start': '', 'end': ''}]
  gateway_ip: ''
  ipv6_subnet: '2001:db8:fd00:1000::/64'
  ipv6_allocation_pools: [{'start': '2001:db8:fd00:1000::10', 'end': '2001:db8:fd00:1000:ffff:ffff:ffff:fffe'}]
  gateway_ipv6: '2001:db8:fd00:1000::1'

 Also edit all the other values, to match the settings of your lab.


This file contains the definitions for each role, including the networks that each role is expecting to contain. You need to edit this file and remove the external network from the Controller:

- name: Controller
    - primary
    - controller
    - External -> remove that

And you also need to edit the default route of the controller, to stop  using the External network as default, and start using the ControlPlane:

default_route_networks: ['External'] -> default_route_networks: ['ControlPlane']


This file contains the mapping of services and networks. It needs to be edited to modify the network assigned to public. Instead of external, it needs to be mapped to internal_api:

PublicNetwork: external -> PublicNetwork: internal_api


This file contains puppet configuration for nodes, and has some values that are referencing External network. They need to be changed to point to Internal api:

tripleo::haproxy::public_virtual_ip: {get_param: [NetVipMap, {get_param: ExternalNetName}]} -> tripleo::haproxy::public_virtual_ip: {get_param: [NetVipMap, {get_param: InternalApiNetName}]}
tripleo::keepalived::public_virtual_ip: {get_param: [NetVipMap, {get_param: ExternalNetName}]} ->
tripleo::keepalived::public_virtual_ip: {get_param: [NetVipMap, {get_param: InternalApiNetName}]}

public_virtual_ip: {get_param: [NetVipMap, {get_param: ExternalNetName}]} -> public_virtual_ip: {get_param: [NetVipMap, {get_param: InternalApiNetName}]}

Generate the templates

Once all these files have been edited, the templates can be generated. To do that, there is  a python helper script to achieve that. Inside your working directory, check tools/ It can accept several parameters like:
  • -p -> specify the base path where to collect the templates from 
  • -r -> roles_data file to consume 
  • -n -> network_data file to consume 
  • -o -> output_dir where to generate the target templates
Execute this commands with those flags and this will generate the final templates for you. Then you can include then in your deploy command. A sample deploy command for that can be:

openstack overcloud deploy --templates ./templates -r ./templates/roles_data.yaml -e ./templates/docker-images.yaml -e ./templates/environments/net-single-nic-with-vlans-no-external.yaml -e ./templates/environments/network-environment.yaml

In this case an extra environment net-single-nic-with-vlans-no-external is included, to be able to deploy with just 1 nic using different vlans, and without having an external network. A sample of the generated templates using that method can be found at: 

Following those steps you will have your OpenStack cloud deployed without external network, just using internal endpoints, that will be useful for testing and CI purposes.


Post a Comment

Popular posts from this blog

Setup an NFS client provisioner in Kubernetes

Setup an NFS client provisioner in Kubernetes One of the most common needs when deploying Kubernetes is the ability to use shared storage. While there are several options available, one of the most commons and easier to setup is to use an NFS server.
This post will explain how to setup a dynamic NFS client provisioner on Kubernetes, relying on an existing NFS server on your systems.
Step 1. Setup an NFS server (sample for CentOS) First thing you will need, of course, is to have an NFS server. This can be easily achieved with some easy steps:

Install nfs package: yum install -y nfs-utils Enable and start nfs service and rpcbind:
systemctl enable rpcbind
systemctl enable nfs-server
systemctl start rpcbind
systemctl start nfs-server
Create the directory that will be shared by NFS, and change the permissions:
mkdir /var/nfsshare
chmod -R 755 /var/nfsshare
chown nfsnobody:nfsnobody /var/nfsshare
 Share the NFS directory over the network, creating the /etc/exports file:
vi /etc/exports
/var/nfsshare …

Build and use security hardened images with TripleO

Starting to apply since Pike Concept of security hardened images Normally the images used for overcloud deployment in TripleO are not security hardened. It means, the images lack all the extra security measures needed to accomplish with ANSSI requirements. These extra measures are needed to deploy TripleO in environments where security is an important feature.
The following recommendations are given to accomplish with security guidelines:
ensure that /tmp is mounted on a separate volume or partition, and that it is mounted with rw,nosuid,nodev,noexec,relatime flagsensure that /var, /var/log and /var/log/audit are mounted on separates volumes or partitions, and that are mounted with rw,relatime flags.ensure that /home is mounted on a separate partition or volume, and that it is mounted with rw,nodev,relatime flags.include extra kernel boot flag to enable auditing: add audit=1 to GRUB_CMDLINE_LINUX settingdisable kernel support for USB via bootloader configuration: add nousb to GRUB_CMD…