| 2024-02-22 14:55:25 |
Sven Kieske |
description |
Hi,
a user reported issues in #openstack-ironic deploying kolla-ansible with ironic-inspector in HA fashion on three controllers.
in the discussion it was brought to light, that we always configure a rabbitmq transport, even if ironic-inspector is not deployed HA, which is not necessary (instead we should use "transport_url=fake://").
back in the day the rabbitmq support was conditional on the fact if TLS was enabled, but this was changed in: https://review.opendev.org/c/openstack/kolla-ansible/+/868305/5/ansible/roles/ironic/templates/ironic-inspector.conf.j2
I thus suggest that we therefore implement a precheck if ironic-conductor is deployed HA, and if it is not, we set the transport url accordingly.
relevant ironic specs (unfortunately there seem to be no more detailed docs about this):
https://specs.openstack.org/openstack/ironic-inspector-specs/specs/splitting-service-on-API-and-worker.html
https://specs.openstack.org/openstack/ironic-specs/specs/approved/merge-inspector.html (this is for future work)
I was also told that running ironic-inspector in HA mode is still considered experimental. I have no personal experience myself if there are any known bugs or if we should disallow HA deployments for this component (I guess we can't do the latter, because it was already possible in the past to do so).
Notice, this is only about ironic-inspector, not about ironic itself or other sub components of ironic.
Going forward, if we reach consensus, I would go on implementing the above mentioned solution.
Thanks. |
Hi,
a user reported issues in #openstack-ironic deploying kolla-ansible with ironic-inspector in HA fashion on three controllers.
in the discussion it was brought to light, that we always configure a rabbitmq transport, even if ironic-inspector is not deployed HA, which is not necessary (instead we should use "transport_url=fake://").
back in the day the rabbitmq support was conditional on the fact if TLS was enabled, but this was changed in: https://review.opendev.org/c/openstack/kolla-ansible/+/868305/5/ansible/roles/ironic/templates/ironic-inspector.conf.j2
I thus suggest that we therefore implement a precheck if ironic-inspector is deployed HA, and if it is not, we set the transport url accordingly.
relevant ironic specs (unfortunately there seem to be no more detailed docs about this):
https://specs.openstack.org/openstack/ironic-inspector-specs/specs/splitting-service-on-API-and-worker.html
https://specs.openstack.org/openstack/ironic-specs/specs/approved/merge-inspector.html (this is for future work)
I was also told that running ironic-inspector in HA mode is still considered experimental. I have no personal experience myself if there are any known bugs or if we should disallow HA deployments for this component (I guess we can't do the latter, because it was already possible in the past to do so).
Notice, this is only about ironic-inspector, not about ironic itself or other sub components of ironic.
Going forward, if we reach consensus, I would go on implementing the above mentioned solution.
Thanks. |
|
