Install Contrail Service Orchestration
Deploy CSO
Note:
Before you start the deployment, ensure that there is Internet connectivity on all the VMs. Internet connectivity is needed to verify the ESM license.
After you have provisioned the VMs, to deploy CSO:
-
Copy the installer package file from the central CSO server to the
startupserver1 VM.
scp cso<version>.tar.gz root@<startupserver1 IP>:/root/ -
Log in to the startupserver1 VM as root user.
Run the
get_vm_details.shscript to find the IP address of the startupserver1 VM. Use SSH to access the VM. -
Expand the installer package.
root@host:~/# tar –xvzf cso<version>.tar.gz
The expanded package is a directory that has the same name as the installer package and contains the installation files.
-
-
For KVM hypervisors:
Run the
deploy.shscript.1. Deploy CSO 2. Replace VM 0. Exit #Your choice: [1 --> CSO Infra Deployment; 2 --> Replace existing VM, currently supports only k8-master, k8-infra and k8-microservices node for replacement in KVM]
-
For ESXi hypervisor:
Run the
deploy.shscript. Use the interactive script to create configuration files for the environment specific topology. Select option 1 (Deploy CSO) to deploy the CSO infrastructure, Option 2 (Replace VM) is not applicable for ESXi hypervisors.Example output for CSO deployment on ESXi hypervisor—
root@host:~/Contrail_Service_Orchestration_6.3.0./ deploy.sh Enter the number for operation to be performed: 1. Deploy CSO 2. Replace VM 0. Exit Your choice: 1 ********************************************* Generic Questions ********************************************* Do you need a Standalone/HA deployment (1/2) [2]: Would you like to install streaming feature? (y/n) [y]:y ********************************************* Server Details ********************************************* Please select hypervisor (kvm/esxi) [kvm]:esxi Enter the number of cluster groups []:3 Do all your VMs have same password for root(y/n) []:y Enter the password common for all the VMs: Confirm Password: Provide the list/comma separated VM IPs for cluster group 1(except VRR) []:192.168.x.2-192.168.x.7,192.168.x.9 Provide the list/comma separated VM IPs for cluster group 2(except VRR) []:192.168.x.10-192.168.x.15,192.168.x.17 Provide the list/comma separated VM IPs for cluster group 3(except VRR) []:192.168.x.22-192.168.x.29,192.168.x.30 Provide VIP (for admin portal and SBLB usage) for VMs []:10.x.x.183 Please provide the CSO reachable subnet for device communication []:10.x.0.0/20 Provide password for VRR VMs: Confirm Password: Number of VRR instances : 2 Redundancy group for VRR0 : 0 Provide routable IP for VRR1 []:10.x.x.234 Provide private IP for VRR1 []:192.168.x.8 Redundancy group for VRR1 : 1 Provide routable IP for VRR2 []:10.x.x.235 Provide private IP for VRR2 []:192.168.x.16 ********************************************* Authentication and Other Questions ********************************************* Provide list/comma separated 10 IPs to be used for load balancers []:192.168.x.42-192.168.x.53 Provide Email Address for cspadmin user []:nutans@juniper.net The Autonomous System Number for BGP [64512]: Do you have a signed certificate for CSO? (y/n) [n]: Please provide commonname for CSO certificate (FQDN) []: CSO certificate validity (in days): [365]: DNS name of CSO Customer Portal []:jcs.juniper.net DNS name of CSO Admin Portal (can be same as Customer Portal) []:jcs.juniper.net Timezone for the servers in topology [America/Los_Angeles]: List of ntp servers (comma separated) []: Do you use IPV6 (y/n) [n]:n Specify additional disk for Swift storage [/dev/vdc]:/dev/sdb
-
-
Confirm if you have the Ubuntu ESM license. This license is required to obtain
the security updates. If you do not have the license, contact Juniper
support.
Do you have Ubuntu ESM (Extended Security Maintenance) license? (y/n): y #recommended
-
Deploy microservices.
./python.sh micro_services/deploy_micro_services.py -
Apply NAT rules. To review the details of the ports, see Minimum Requirements for Servers and VMs.
-
Run
./get_vm_details.shscript to find the IP addresses of each component.root@startupserver1:~/Contrail_Service_Orchestration_6.3.0# ./get_vm_details.sh Load Balancer IP: nginx : 192.168.10.16 keystone : 192.168.10.20 haproxy_confd : 192.168.10.48 etcd : 192.168.10.19 haproxy_confd_sblb : 192.168.10.49 mariadb : 192.168.10.17 nginx_nsd : 192.168.10.18
-
Configure next hop at the gateway for VRR public IP addresses (for example—10.x.x.3 and 10.x.x.4) to point to the SRX IP address (for example—10.x.x.2).
-
Apply the following NAT configuration for any public-facing device:
NAT configuration
## Public address space set security address-book global address public 10.x.x.2/32 set security address-book global address vrr-1-public 10.x.x.3/32 set security address-book global address vrr-2-public 10.x.x.4/32 ### Private CSO address space (192.168.10.0/24) set security address-book global address monitoring1 192.168.10.31/32 set security address-book global address keystone 192.168.10.20/32 set security address-book global address nginx 192.168.10.16/32 set security address-book global address nginx_nsd 192.168.10.18/32 set security address-book global address haproxy_confd 192.168.10.46/32 set security address-book global address haproxy_confd_sblb 192.168.10.47/32 set security address-book global address vrr-1 192.168.10.29/32 set security address-book global address vrr-2 192.168.10.30/32 set security address-book global address startupserver1 192.168.10.45/32 set security nat source rule-set inetAccess from zone trust set security nat source rule-set inetAccess to zone untrust set security nat source rule-set inetAccess rule inet match source-address 192.168.10.0/24 set security nat source rule-set inetAccess rule inet match destination-address 0.0.0.0/0 set security nat source rule-set inetAccess rule inet match application any set security nat source rule-set inetAccess rule inet then source-nat interface set security nat static rule-set cso from zone untrust set security nat static rule-set cso rule adminportal-443 match destination-address-name public set security nat static rule-set cso rule adminportal-443 match destination-port 443 set security nat static rule-set cso rule adminportal-443 then static-nat prefix-name nginx set security nat static rule-set cso rule adminportal-443 then static-nat prefix-name mapped-port 443 set security nat static rule-set cso rule designtools-83 match destination-address-name public set security nat static rule-set cso rule designtools-83 match destination-port 83 set security nat static rule-set cso rule designtools-83 then static-nat prefix-name nginx_nsd set security nat static rule-set cso rule designtools-83 then static-nat prefix-name mapped-port 443 set security nat static rule-set cso rule outbound-ssh-7804 match destination-address-name public set security nat static rule-set cso rule outbound-ssh-7804 match destination-port 7804 set security nat static rule-set cso rule outbound-ssh-7804 then static-nat prefix-name haproxy_confd set security nat static rule-set cso rule outbound-ssh-7804 then static-nat prefix-name mapped-port 7804 set security nat static rule-set cso rule rsyslog-514 match destination-address-name public set security nat static rule-set cso rule rsyslog-514 match destination-port 514 set security nat static rule-set cso rule rsyslog-514 then static-nat prefix-name haproxy_confd_sblb set security nat static rule-set cso rule rsyslog-514 then static-nat prefix-name mapped-port 514 set security nat static rule-set cso rule syslog-3514 match destination-address-name public set security nat static rule-set cso rule syslog-3514 match destination-port 3514 set security nat static rule-set cso rule syslog-3514 then static-nat prefix-name haproxy_confd_sblb set security nat static rule-set cso rule syslog-3514 then static-nat prefix-name mapped-port 3514 set security nat static rule-set cso rule syslog-6514 match destination-address-name public set security nat static rule-set cso rule syslog-6514 match destination-port 6514 set security nat static rule-set cso rule syslog-6514 then static-nat prefix-name haproxy_confd_sblb set security nat static rule-set cso rule syslog-6514 then static-nat prefix-name mapped-port 6514 set security nat static rule-set cso rule syslog-2216 match destination-address-name public set security nat static rule-set cso rule syslog-2216 match destination-port 2216 set security nat static rule-set cso rule syslog-2216 then static-nat prefix-name haproxy_confd_sblb set security nat static rule-set cso rule syslog-2216 then static-nat prefix-name mapped-port 2216 set security nat static rule-set cso rule CRL-8060 match destination-address-name public set security nat static rule-set cso rule CRL-8060 match destination-port 8060 set security nat static rule-set cso rule CRL-8060 then static-nat prefix-name haproxy_confd set security nat static rule-set cso rule CRL-8060 then static-nat prefix-name mapped-port 8060 set security nat static rule-set cso rule vrr-1 match destination-address-name vrr-1-public set security nat static rule-set cso rule vrr-1 then static-nat prefix-name vrr-1 set security nat static rule-set cso rule vrr-2 match destination-address-name vrr-2-public set security nat static rule-set cso rule vrr-2 then static-nat prefix-name vrr-2 set security nat static rule-set cso rule kibana-5601 match destination-address-name public set security nat static rule-set cso rule kibana-5601 match destination-port 5601 set security nat static rule-set cso rule kibana-5601 then static-nat prefix-name haproxy_confd set security nat static rule-set cso rule kibana-5601 then static-nat prefix-name mapped-port 5601 set security nat static rule-set cso rule rabbitmq-15672 match destination-address-name public set security nat static rule-set cso rule rabbitmq-15672 match destination-port 15672 set security nat static rule-set cso rule rabbitmq-15672 then static-nat prefix-name nginx set security nat static rule-set cso rule rabbitmq-15672 then static-nat prefix-name mapped-port 15672 set security nat static rule-set cso rule es-9210 match destination-address-name public set security nat static rule-set cso rule es-9210 match destination-port 9210 set security nat static rule-set cso rule es-9210 then static-nat prefix-name monitoring1 set security nat static rule-set cso rule es-9210 then static-nat prefix-name mapped-port 9210 set security nat static rule-set cso rule keystone-port-5000 match destination-address-name public set security nat static rule-set cso rule keystone-port-5000 match destination-port 5000 set security nat static rule-set cso rule keystone-port-5000 then static-nat prefix-name keystone set security nat static rule-set cso rule keystone-port-5000 then static-nat prefix-name mapped-port 5000 set security nat static rule-set cso rule can-8081 match destination-address-name public set security nat static rule-set cso rule can-8081 match destination-port 8081 set security nat static rule-set cso rule can-8081 then static-nat prefix-name haproxy_confd_sblb set security nat static rule-set cso rule can-8081 then static-nat prefix-name mapped-port 8081 set security nat static rule-set cso rule can-8082 match destination-address-name public set security nat static rule-set cso rule can-8082 match destination-port 8082 set security nat static rule-set cso rule can-8082 then static-nat prefix-name haproxy_confd_sblb set security nat static rule-set cso rule can-8082 then static-nat prefix-name mapped-port 8082 set security nat static rule-set cso rule grafana-3000 match destination-address-name public set security nat static rule-set cso rule grafana-3000 match destination-port 3000 set security nat static rule-set cso rule grafana-3000 then static-nat prefix-name monitoring1 set security nat static rule-set cso rule grafana-3000 then static-nat prefix-name mapped-port 3000 set security nat static rule-set cso rule icinga-1947 match destination-address-name public set security nat static rule-set cso rule icinga-1947 match destination-port 1947 set security nat static rule-set cso rule icinga-1947 then static-nat prefix-name nginx set security nat static rule-set cso rule icinga-1947 then static-nat prefix-name mapped-port 1947
-
The following configuration is applicable only if you have as SRX Series device as your firewall. Apply similar rules if you have a third-party firewall.
Sample SRX config
set system host-name example.net set system root-authentication encrypted-password "$5$.eexxxTzK$KpQKybUds3P89Y9N5ol2FubLREaliyh9see.hCBJo5" set system services ssh root-login allow set system services netconf ssh set system services dhcp-local-server group jdhcp-group interface fxp0.0 set system services dhcp-local-server group jdhcp-group interface irb.0 set system services web-management https system-generated-certificate set system name-server 8.8.8.8 set system name-server 8.8.4.4 set system syslog archive size 100k set system syslog archive files 3 set system syslog user * any emergency set system syslog file messages any notice set system syslog file messages authorization info set system syslog file interactive-commands interactive-commands any set system max-configurations-on-flash 5 set system max-configuration-rollbacks 5 set security address-book global address public 10.x.x.2/32 set security address-book global address vrr-1-public 10.x.x.3/32 set security address-book global address vrr-2-public 10.x.x.4/32 set security address-book global address monitoring1 192.168.10.31/32 set security address-book global address keystone 192.168.10.20/32 set security address-book global address nginx 192.168.10.16/32 set security address-book global address nginx_nsd 192.168.10.18/32 set security address-book global address haproxy_confd 192.168.10.46/32 set security address-book global address haproxy_confd_sblb 192.168.10.47/32 set security address-book global address vrr-1 192.168.10.29/32 set security address-book global address vrr-2 192.168.10.30/32 set security address-book global address startupserver1 192.168.10.45/32 set security screen ids-option untrust-screen icmp ping-death set security screen ids-option untrust-screen ip source-route-option set security screen ids-option untrust-screen ip tear-drop set security screen ids-option untrust-screen tcp syn-flood alarm-threshold 1024 set security screen ids-option untrust-screen tcp syn-flood attack-threshold 200 set security screen ids-option untrust-screen tcp syn-flood source-threshold 1024 set security screen ids-option untrust-screen tcp syn-flood destination-threshold 2048 set security screen ids-option untrust-screen tcp syn-flood timeout 20 set security screen ids-option untrust-screen tcp land set security nat source rule-set inetAccess from zone trust set security nat source rule-set inetAccess to zone untrust set security nat source rule-set inetAccess rule inet match source-address 192.168.10.0/24 set security nat source rule-set inetAccess rule inet match destination-address 0.0.0.0/0 set security nat source rule-set inetAccess rule inet match application any set security nat source rule-set inetAccess rule inet then source-nat interface set security nat static rule-set cso from zone untrust set security nat static rule-set cso rule adminportal-443 match destination-address-name public set security nat static rule-set cso rule adminportal-443 match destination-port 443 set security nat static rule-set cso rule adminportal-443 then static-nat prefix-name nginx set security nat static rule-set cso rule adminportal-443 then static-nat prefix-name mapped-port 443 set security nat static rule-set cso rule rsyslog-514 match destination-address-name public set security nat static rule-set cso rule rsyslog-514 match destination-port 514 set security nat static rule-set cso rule rsyslog-514 then static-nat prefix-name haproxy_confd_sblb set security nat static rule-set cso rule rsyslog-514 then static-nat prefix-name mapped-port 514 set security nat static rule-set cso rule syslog-3514 match destination-address-name public set security nat static rule-set cso rule syslog-3514 match destination-port 3514 set security nat static rule-set cso rule syslog-3514 then static-nat prefix-name haproxy_confd_sblb set security nat static rule-set cso rule syslog-3514 then static-nat prefix-name mapped-port 3514 set security nat static rule-set cso rule syslog-6514 match destination-address-name public set security nat static rule-set cso rule syslog-6514 match destination-port 6514 set security nat static rule-set cso rule syslog-6514 then static-nat prefix-name haproxy_confd_sblb set security nat static rule-set cso rule syslog-6514 then static-nat prefix-name mapped-port 6514 set security nat static rule-set cso rule designtools-83 match destination-address-name public set security nat static rule-set cso rule designtools-83 match destination-port 83 set security nat static rule-set cso rule designtools-83 then static-nat prefix-name nginx_nsd set security nat static rule-set cso rule designtools-83 then static-nat prefix-name mapped-port 443 set security nat static rule-set cso rule outbound-ssh-7804 match destination-address-name public set security nat static rule-set cso rule outbound-ssh-7804 match destination-port 7804 set security nat static rule-set cso rule outbound-ssh-7804 then static-nat prefix-name haproxy_confd set security nat static rule-set cso rule outbound-ssh-7804 then static-nat prefix-name mapped-port 7804 set security nat static rule-set cso rule kibana-5601 match destination-address-name public set security nat static rule-set cso rule kibana-5601 match destination-port 5601 set security nat static rule-set cso rule kibana-5601 then static-nat prefix-name haproxy_confd set security nat static rule-set cso rule kibana-5601 then static-nat prefix-name mapped-port 5601 set security nat static rule-set cso rule syslog-2216 match destination-address-name public set security nat static rule-set cso rule syslog-2216 match destination-port 2216 set security nat static rule-set cso rule syslog-2216 then static-nat prefix-name haproxy_confd_sblb set security nat static rule-set cso rule syslog-2216 then static-nat prefix-name mapped-port 2216 set security nat static rule-set cso rule CRL-8060 match destination-address-name public set security nat static rule-set cso rule CRL-8060 match destination-port 8060 set security nat static rule-set cso rule CRL-8060 then static-nat prefix-name haproxy_confd set security nat static rule-set cso rule CRL-8060 then static-nat prefix-name mapped-port 8060 set security nat static rule-set cso rule rabbitmq-15672 match destination-address-name public set security nat static rule-set cso rule rabbitmq-15672 match destination-port 15672 set security nat static rule-set cso rule rabbitmq-15672 then static-nat prefix-name nginx set security nat static rule-set cso rule rabbitmq-15672 then static-nat prefix-name mapped-port 15672 set security nat static rule-set cso rule es-9210 match destination-address-name public set security nat static rule-set cso rule es-9210 match destination-port 9210 set security nat static rule-set cso rule es-9210 then static-nat prefix-name monitoring1 set security nat static rule-set cso rule es-9210 then static-nat prefix-name mapped-port 9210 set security nat static rule-set cso rule keystone-port-5000 match destination-address-name public set security nat static rule-set cso rule keystone-port-5000 match destination-port 5000 set security nat static rule-set cso rule keystone-port-5000 then static-nat prefix-name keystone set security nat static rule-set cso rule keystone-port-5000 then static-nat prefix-name mapped-port 5000 set security nat static rule-set cso rule can-8081 match destination-address-name public set security nat static rule-set cso rule can-8081 match destination-port 8081 set security nat static rule-set cso rule can-8081 then static-nat prefix-name haproxy_confd_sblb set security nat static rule-set cso rule can-8081 then static-nat prefix-name mapped-port 8081 set security nat static rule-set cso rule can-8082 match destination-address-name public set security nat static rule-set cso rule can-8082 match destination-port 8082 set security nat static rule-set cso rule can-8082 then static-nat prefix-name haproxy_confd_sblb set security nat static rule-set cso rule can-8082 then static-nat prefix-name mapped-port 8082 set security nat static rule-set cso rule grafana-3000 match destination-address-name public set security nat static rule-set cso rule grafana-3000 match destination-port 3000 set security nat static rule-set cso rule grafana-3000 then static-nat prefix-name monitoring1 set security nat static rule-set cso rule grafana-3000 then static-nat prefix-name mapped-port 3000 set security nat static rule-set cso rule icinga-1947 match destination-address-name public set security nat static rule-set cso rule icinga-1947 match destination-port 1947 set security nat static rule-set cso rule icinga-1947 then static-nat prefix-name nginx set security nat static rule-set cso rule icinga-1947 then static-nat prefix-name mapped-port 1947 set security nat static rule-set cso rule vrr-1 match destination-address-name vrr-1-public set security nat static rule-set cso rule vrr-1 then static-nat prefix-name vrr-1 set security nat static rule-set cso rule vrr-2 match destination-address-name vrr-2-public set security nat static rule-set cso rule vrr-2 then static-nat prefix-name vrr-2 set security policies from-zone trust to-zone trust policy trust-to-trust match source-address any set security policies from-zone trust to-zone trust policy trust-to-trust match destination-address any set security policies from-zone trust to-zone trust policy trust-to-trust match application any set security policies from-zone trust to-zone trust policy trust-to-trust then permit set security policies from-zone trust to-zone untrust policy trust-to-untrust match source-address any set security policies from-zone trust to-zone untrust policy trust-to-untrust match destination-address any set security policies from-zone trust to-zone untrust policy trust-to-untrust match application any set security policies from-zone trust to-zone untrust policy trust-to-untrust then permit set security policies from-zone untrust to-zone untrust policy default-permit match source-address any set security policies from-zone untrust to-zone untrust policy default-permit match destination-address any set security policies from-zone untrust to-zone untrust policy default-permit match application any set security policies from-zone untrust to-zone untrust policy default-permit then permit set security policies from-zone untrust to-zone trust policy default-permit match source-address any set security policies from-zone untrust to-zone trust policy default-permit match destination-address any set security policies from-zone untrust to-zone trust policy default-permit match application any set security policies from-zone untrust to-zone trust policy default-permit then permit set security policies default-policy deny-all set security zones security-zone trust host-inbound-traffic system-services all set security zones security-zone trust host-inbound-traffic protocols all set security zones security-zone trust interfaces irb.0 set security zones security-zone untrust screen untrust-screen set security zones security-zone untrust host-inbound-traffic system-services all set security zones security-zone untrust host-inbound-traffic protocols all set security zones security-zone untrust interfaces ge-0/0/2.0 set interfaces ge-0/0/1 description "Public Facing" set interfaces ge-0/0/1 unit 0 proxy-arp restricted set interfaces ge-0/0/1 unit 0 family inet address 10.x.x.2/24 set interfaces ge-0/0/5 description Host-1 set interfaces ge-0/0/5 unit 0 family ethernet-switching vlan members vlan-trust set interfaces ge-0/0/6 description Host-2 set interfaces ge-0/0/6 unit 0 family ethernet-switching vlan members vlan-trust set interfaces ge-0/0/7 description Host-3 set interfaces ge-0/0/7 unit 0 family ethernet-switching vlan members vlan-trust set interfaces irb unit 0 family inet address 192.168.10.1/24 set vlans vlan-trust vlan-id 3 set vlans vlan-trust l3-interface irb.0 set protocols l2-learning global-mode switching set protocols lldp interface all set protocols rstp interface all set routing-options static route 0.0.0.0/0 next-hop 10.x.x.254
-
-
-
Load the data.
./python.sh micro_services/load_services_data.py
You can run the ./get_vm_details.sh script to find the IP address of each component.
It is recommended to take snapshots of the VMs for ESXi deployment.