1 .. This work is licensed under a Creative Commons Attribution 4.0 International License.
2 .. http://creativecommons.org/licenses/by/4.0
3 .. Copyright 2018 Amdocs, Bell Canada
7 .. _Curated applications for Kubernetes: https://github.com/kubernetes/charts
8 .. _Services: https://kubernetes.io/docs/concepts/services-networking/service/
9 .. _ReplicaSet: https://kubernetes.io/docs/concepts/workloads/controllers/replicaset/
10 .. _StatefulSet: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/
11 .. _Helm Documentation: https://docs.helm.sh/helm/
12 .. _Helm: https://docs.helm.sh/
13 .. _Kubernetes: https://Kubernetes.io/
14 .. _Kubernetes LoadBalancer: https://kubernetes.io/docs/concepts/services-networking/service/#type-loadbalancer
20 The ONAP Operations Manager (OOM) provide the ability to manage the entire
21 life-cycle of an ONAP installation, from the initial deployment to final
22 decommissioning. This guide provides instructions for users of ONAP to
23 use the Kubernetes_/Helm_ system as a complete ONAP management system.
25 This guide provides many examples of Helm command line operations. For a
26 complete description of these commands please refer to the `Helm
29 .. figure:: oomLogoV2-medium.png
32 The following sections describe the life-cycle operations:
34 - Deploy_ - with built-in component dependency management
35 - Configure_ - unified configuration across all ONAP components
36 - Monitor_ - real-time health monitoring feeding to a Consul UI and Kubernetes
37 - Heal_- failed ONAP containers are recreated automatically
38 - Scale_ - cluster ONAP services to enable seamless scaling
39 - Upgrade_ - change-out containers or configuration with little or no service impact
40 - Delete_ - cleanup individual containers or entire deployments
42 .. figure:: oomLogoV2-Deploy.png
48 The OOM team with assistance from the ONAP project teams, have built a
49 comprehensive set of Helm charts, yaml files very similar to TOSCA files, that
50 describe the composition of each of the ONAP components and the relationship
51 within and between components. Using this model Helm is able to deploy all of
52 ONAP with a few simple commands.
56 Your environment must have both the Kubernetes `kubectl` and Helm setup as a
61 Enter the following to install kubectl (on Ubuntu, there are slight differences
62 on other O/Ss), the Kubernetes command line interface used to manage a
65 > curl -LO https://storage.googleapis.com/kubernetes-release/release/v1.8.10/bin/linux/amd64/kubectl
67 > sudo mv ./kubectl /usr/local/bin/kubectl
70 Paste kubectl config from Rancher (see the :ref:`cloud-setup-guide-label` for
71 alternative Kubernetes environment setups) into the `~/.kube/config` file.
73 Verify that the Kubernetes config is correct::
75 > kubectl get pods --all-namespaces
77 At this point you should see six Kubernetes pods running.
81 Helm is used by OOM for package and configuration management. To install Helm,
84 > wget http://storage.googleapis.com/kubernetes-helm/helm-v2.9.1-linux-amd64.tar.gz
85 > tar -zxvf helm-v2.9.1-linux-amd64.tar.gz
86 > sudo mv linux-amd64/helm /usr/local/bin/helm
88 Verify the Helm version with::
92 Install the Helm Tiller application and initialize with::
98 Once kubectl and Helm are setup, one needs to setup a local Helm server to
99 server up the ONAP charts::
101 > helm install osn/onap
104 The osn repo is not currently available so creation of a local repository is
107 Helm is able to use charts served up from a repository and comes setup with a
108 default CNCF provided `Curated applications for Kubernetes`_ repository called
109 stable which should be removed to avoid confusion::
111 > helm repo remove stable
113 .. To setup the Open Source Networking Nexus repository for helm enter::
114 .. > helm repo add osn 'https://nexus3.onap.org:10001/helm/helm-repo-in-nexus/master/'
116 To prepare your system for an installation of ONAP, you'll need to::
118 > git clone -b frankfurt http://gerrit.onap.org/r/oom
122 To setup a local Helm server to server up the ONAP charts::
127 Note the port number that is listed and use it in the Helm repo add as
130 > helm repo add local http://127.0.0.1:8879
132 To get a list of all of the available Helm chart repositories::
136 local http://127.0.0.1:8879
138 Then build your local Helm repository::
142 The Helm search command reads through all of the repositories configured on the
143 system, and looks for matches::
146 NAME VERSION DESCRIPTION
147 local/appc 2.0.0 Application Controller
148 local/clamp 2.0.0 ONAP Clamp
149 local/common 2.0.0 Common templates for inclusion in other charts
150 local/onap 2.0.0 Open Network Automation Platform (ONAP)
151 local/robot 2.0.0 A helm Chart for kubernetes-ONAP Robot
152 local/so 2.0.0 ONAP Service Orchestrator
154 In any case, setup of the Helm repository is a one time activity.
156 Next, install Helm Plugins required to deploy the ONAP Casablanca release::
158 > cp -R helm/plugins/ ~/.helm
160 Once the repo is setup, installation of ONAP can be done with a single
163 > helm deploy development local/onap --namespace onap
165 This will install ONAP from a local repository in a 'development' Helm release.
166 As described below, to override the default configuration values provided by
167 OOM, an environment file can be provided on the command line as follows::
169 > helm deploy development local/onap --namespace onap -f overrides.yaml
171 To get a summary of the status of all of the pods (containers) running in your
174 > kubectl get pods --all-namespaces -o=wide
177 The Kubernetes namespace concept allows for multiple instances of a component
178 (such as all of ONAP) to co-exist with other components in the same
179 Kubernetes cluster by isolating them entirely. Namespaces share only the
180 hosts that form the cluster thus providing isolation between production and
181 development systems as an example. The OOM deployment of ONAP in Beijing is
182 now done within a single Kubernetes namespace where in Amsterdam a namespace
183 was created for each of the ONAP components.
186 The Helm `--name` option refers to a release name and not a Kubernetes namespace.
189 To install a specific version of a single ONAP component (`so` in this example)
190 with the given release name enter::
192 > helm deploy so onap/so --version 3.0.1
194 To display details of a specific resource or group of resources type::
196 > kubectl describe pod so-1071802958-6twbl
198 where the pod identifier refers to the auto-generated pod identifier.
200 .. figure:: oomLogoV2-Configure.png
206 Each project within ONAP has its own configuration data generally consisting
207 of: environment variables, configuration files, and database initial values.
208 Many technologies are used across the projects resulting in significant
209 operational complexity and an inability to apply global parameters across the
210 entire ONAP deployment. OOM solves this problem by introducing a common
211 configuration technology, Helm charts, that provide a hierarchical
212 configuration with the ability to override values with higher
213 level charts or command line options.
215 The structure of the configuration of ONAP is shown in the following diagram.
216 Note that key/value pairs of a parent will always take precedence over those
217 of a child. Also note that values set on the command line have the highest
225 oValues [label="values.yaml"]
226 demo [label="onap-demo.yaml"]
227 prod [label="onap-production.yaml"]
228 oReq [label="requirements.yaml"]
229 soValues [label="values.yaml"]
230 soReq [label="requirements.yaml"]
231 mdValues [label="values.yaml"]
234 oResources [label="resources"]
238 oResources -> environments
251 The top level onap/values.yaml file contains the values required to be set
252 before deploying ONAP. Here is the contents of this file:
254 .. include:: ../kubernetes/onap/values.yaml
257 One may wish to create a value file that is specific to a given deployment such
258 that it can be differentiated from other deployments. For example, a
259 onap-development.yaml file may create a minimal environment for development
260 while onap-production.yaml might describe a production deployment that operates
261 independently of the developer version.
263 For example, if the production OpenStack instance was different from a
264 developer's instance, the onap-production.yaml file may contain a different
265 value for the vnfDeployment/openstack/oam_network_cidr key as shown below.
271 apps: consul msb mso message-router sdnc vid robot portal policy appc aai
272 sdc dcaegen2 log cli multicloud clamp vnfsdk aaf kube2msb
273 dataRootDir: /dockerdata-nfs
275 # docker repositories
277 onap: nexus3.onap.org:10001
280 filebeat: docker.elastic.co
285 # vnf deployment environment
288 ubuntu_14_image: "Ubuntu_14.04.5_LTS"
289 public_net_id: "e8f51956-00dd-4425-af36-045716781ffc"
290 oam_network_id: "d4769dfb-c9e4-4f72-b3d6-1d18f4ac4ee6"
291 oam_subnet_id: "191f7580-acf6-4c2b-8ec0-ba7d99b3bc4e"
292 oam_network_cidr: "192.168.30.0/24"
296 To deploy ONAP with this environment file, enter::
298 > helm deploy local/onap -n onap -f environments/onap-production.yaml
300 .. include:: environments_onap_demo.yaml
303 When deploying all of ONAP a requirements.yaml file control which and what
304 version of the ONAP components are included. Here is an excerpt of this
309 # Referencing a named repo called 'local'.
310 # Can add this repo by running commands like:
312 # > helm repo add local http://127.0.0.1:8879
318 condition: so.enabled
321 The ~ operator in the `so` version value indicates that the latest "2.X.X"
322 version of `so` shall be used thus allowing the chart to allow for minor
323 upgrades that don't impact the so API; hence, version 2.0.1 will be installed
326 The onap/resources/environment/onap-dev.yaml (see the excerpt below) enables
327 for fine grained control on what components are included as part of this
328 deployment. By changing this `so` line to `enabled: false` the `so` component
329 will not be deployed. If this change is part of an upgrade the existing `so`
330 component will be shut down. Other `so` parameters and even `so` child values
331 can be modified, for example the `so`'s `liveness` probe could be disabled
332 (which is not recommended as this change would disable auto-healing of `so`).
336 #################################################################
337 # Global configuration overrides.
339 # These overrides will affect all helm charts (ie. applications)
340 # that are listed below and are 'enabled'.
341 #################################################################
345 #################################################################
346 # Enable/disable and configure helm charts (ie. applications)
347 # to customize the ONAP deployment.
348 #################################################################
352 so: # Service Orchestrator
358 # necessary to disable liveness probe when setting breakpoints
359 # in debugger so K8s doesn't restart unresponsive container
364 Accessing the ONAP Portal using OOM and a Kubernetes Cluster
365 ------------------------------------------------------------
367 The ONAP deployment created by OOM operates in a private IP network that isn't
368 publicly accessible (i.e. Openstack VMs with private internal network) which
369 blocks access to the ONAP Portal. To enable direct access to this Portal from a
370 user's own environment (a laptop etc.) the portal application's port 8989 is
371 exposed through a `Kubernetes LoadBalancer`_ object.
373 Typically, to be able to access the Kubernetes nodes publicly a public address
374 is assigned. In Openstack this is a floating IP address.
376 When the `portal-app` chart is deployed a Kubernetes service is created that
377 instantiates a load balancer. The LB chooses the private interface of one of
378 the nodes as in the example below (10.0.0.4 is private to the K8s cluster only).
379 Then to be able to access the portal on port 8989 from outside the K8s &
380 Openstack environment, the user needs to assign/get the floating IP address that
381 corresponds to the private IP as follows::
383 > kubectl -n onap get services|grep "portal-app"
384 portal-app LoadBalancer 10.43.142.201 10.0.0.4 8989:30215/TCP,8006:30213/TCP,8010:30214/TCP 1d app=portal-app,release=dev
387 In this example, use the 10.0.0.4 private address as a key find the
388 corresponding public address which in this example is 10.12.6.155. If you're
389 using OpenStack you'll do the lookup with the horizon GUI or the Openstack CLI
390 for your tenant (openstack server list). That IP is then used in your
391 `/etc/hosts` to map the fixed DNS aliases required by the ONAP Portal as shown
394 10.12.6.155 portal.api.simpledemo.onap.org
395 10.12.6.155 vid.api.simpledemo.onap.org
396 10.12.6.155 sdc.api.fe.simpledemo.onap.org
397 10.12.6.155 sdc.workflow.plugin.simpledemo.onap.org
398 10.12.6.155 sdc.dcae.plugin.simpledemo.onap.org
399 10.12.6.155 portal-sdk.simpledemo.onap.org
400 10.12.6.155 policy.api.simpledemo.onap.org
401 10.12.6.155 aai.api.sparky.simpledemo.onap.org
402 10.12.6.155 cli.api.simpledemo.onap.org
403 10.12.6.155 msb.api.discovery.simpledemo.onap.org
404 10.12.6.155 msb.api.simpledemo.onap.org
405 10.12.6.155 clamp.api.simpledemo.onap.org
406 10.12.6.155 so.api.simpledemo.onap.org
407 10.12.6.155 sdc.workflow.plugin.simpledemo.onap.org
409 Ensure you've disabled any proxy settings the browser you are using to access
410 the portal and then simply access now the new ssl-encrypted URL:
411 https://portal.api.simpledemo.onap.org:30225/ONAPPORTAL/login.htm
414 Using the HTTPS based Portal URL the Browser needs to be configured to accept
415 unsecure credentials.
416 Additionally when opening an Application inside the Portal, the Browser
417 might block the content, which requires to disable the blocking and reloading
421 Besides the ONAP Portal the Components can deliver additional user interfaces,
422 please check the Component specific documentation.
426 | Alternatives Considered:
428 - Kubernetes port forwarding was considered but discarded as it would require
429 the end user to run a script that opens up port forwarding tunnels to each of
430 the pods that provides a portal application widget.
432 - Reverting to a VNC server similar to what was deployed in the Amsterdam
433 release was also considered but there were many issues with resolution, lack
434 of volume mount, /etc/hosts dynamic update, file upload that were a tall order
435 to solve in time for the Beijing release.
439 - If you are not using floating IPs in your Kubernetes deployment and directly attaching
440 a public IP address (i.e. by using your public provider network) to your K8S Node
441 VMs' network interface, then the output of 'kubectl -n onap get services | grep "portal-app"'
442 will show your public IP instead of the private network's IP. Therefore,
443 you can grab this public IP directly (as compared to trying to find the floating
444 IP first) and map this IP in /etc/hosts.
446 .. figure:: oomLogoV2-Monitor.png
452 All highly available systems include at least one facility to monitor the
453 health of components within the system. Such health monitors are often used as
454 inputs to distributed coordination systems (such as etcd, zookeeper, or consul)
455 and monitoring systems (such as nagios or zabbix). OOM provides two mechanisms
456 to monitor the real-time health of an ONAP deployment:
458 - a Consul GUI for a human operator or downstream monitoring systems and
459 Kubernetes liveness probes that enable automatic healing of failed
461 - a set of liveness probes which feed into the Kubernetes manager which
462 are described in the Heal section.
464 Within ONAP, Consul is the monitoring system of choice and deployed by OOM in
467 - a three-way, centralized Consul server cluster is deployed as a highly
468 available monitor of all of the ONAP components, and
469 - a number of Consul agents.
471 The Consul server provides a user interface that allows a user to graphically
472 view the current health status of all of the ONAP components for which agents
473 have been created - a sample from the ONAP Integration labs follows:
475 .. figure:: consulHealth.png
478 To see the real-time health of a deployment go to: http://<kubernetes IP>:30270/ui/
479 where a GUI much like the following will be found:
482 .. figure:: oomLogoV2-Heal.png
488 The ONAP deployment is defined by Helm charts as mentioned earlier. These Helm
489 charts are also used to implement automatic recoverability of ONAP components
490 when individual components fail. Once ONAP is deployed, a "liveness" probe
491 starts checking the health of the components after a specified startup time.
493 Should a liveness probe indicate a failed container it will be terminated and a
494 replacement will be started in its place - containers are ephemeral. Should the
495 deployment specification indicate that there are one or more dependencies to
496 this container or component (for example a dependency on a database) the
497 dependency will be satisfied before the replacement container/component is
498 started. This mechanism ensures that, after a failure, all of the ONAP
499 components restart successfully.
501 To test healing, the following command can be used to delete a pod::
503 > kubectl delete pod [pod name] -n [pod namespace]
505 One could then use the following command to monitor the pods and observe the
506 pod being terminated and the service being automatically healed with the
507 creation of a replacement pod::
509 > kubectl get pods --all-namespaces -o=wide
511 .. figure:: oomLogoV2-Scale.png
517 Many of the ONAP components are horizontally scalable which allows them to
518 adapt to expected offered load. During the Beijing release scaling is static,
519 that is during deployment or upgrade a cluster size is defined and this cluster
520 will be maintained even in the presence of faults. The parameter that controls
521 the cluster size of a given component is found in the values.yaml file for that
522 component. Here is an excerpt that shows this parameter:
526 # default number of instances
529 In order to change the size of a cluster, an operator could use a helm upgrade
530 (described in detail in the next section) as follows::
532 > helm upgrade --set replicaCount=3 onap/so/mariadb
534 The ONAP components use Kubernetes provided facilities to build clustered,
535 highly available systems including: Services_ with load-balancers, ReplicaSet_,
536 and StatefulSet_. Some of the open-source projects used by the ONAP components
537 directly support clustered configurations, for example ODL and MariaDB Galera.
539 The Kubernetes Services_ abstraction to provide a consistent access point for
540 each of the ONAP components, independent of the pod or container architecture
541 of that component. For example, SDN-C uses OpenDaylight clustering with a
542 default cluster size of three but uses a Kubernetes service to and change the
543 number of pods in this abstract this cluster from the other ONAP components
544 such that the cluster could change size and this change is isolated from the
545 other ONAP components by the load-balancer implemented in the ODL service
548 A ReplicaSet_ is a construct that is used to describe the desired state of the
549 cluster. For example 'replicas: 3' indicates to Kubernetes that a cluster of 3
550 instances is the desired state. Should one of the members of the cluster fail,
551 a new member will be automatically started to replace it.
553 Some of the ONAP components many need a more deterministic deployment; for
554 example to enable intra-cluster communication. For these applications the
555 component can be deployed as a Kubernetes StatefulSet_ which will maintain a
556 persistent identifier for the pods and thus a stable network id for the pods.
557 For example: the pod names might be web-0, web-1, web-{N-1} for N 'web' pods
558 with corresponding DNS entries such that intra service communication is simple
559 even if the pods are physically distributed across multiple nodes. An example
560 of how these capabilities can be used is described in the Running Consul on
563 .. figure:: oomLogoV2-Upgrade.png
569 Helm has built-in capabilities to enable the upgrade of pods without causing a
570 loss of the service being provided by that pod or pods (if configured as a
571 cluster). As described in the OOM Developer's Guide, ONAP components provide
572 an abstracted 'service' end point with the pods or containers providing this
573 service hidden from other ONAP components by a load balancer. This capability
574 is used during upgrades to allow a pod with a new image to be added to the
575 service before removing the pod with the old image. This 'make before break'
576 capability ensures minimal downtime.
578 Prior to doing an upgrade, determine of the status of the deployed charts::
581 NAME REVISION UPDATED STATUS CHART NAMESPACE
582 so 1 Mon Feb 5 10:05:22 2018 DEPLOYED so-2.0.1 default
584 When upgrading a cluster a parameter controls the minimum size of the cluster
585 during the upgrade while another parameter controls the maximum number of nodes
586 in the cluster. For example, SNDC configured as a 3-way ODL cluster might
587 require that during the upgrade no fewer than 2 pods are available at all times
588 to provide service while no more than 5 pods are ever deployed across the two
589 versions at any one time to avoid depleting the cluster of resources. In this
590 scenario, the SDNC cluster would start with 3 old pods then Kubernetes may add
591 a new pod (3 old, 1 new), delete one old (2 old, 1 new), add two new pods (2
592 old, 3 new) and finally delete the 2 old pods (3 new). During this sequence
593 the constraints of the minimum of two pods and maximum of five would be
594 maintained while providing service the whole time.
596 Initiation of an upgrade is triggered by changes in the Helm charts. For
597 example, if the image specified for one of the pods in the SDNC deployment
598 specification were to change (i.e. point to a new Docker image in the nexus3
599 repository - commonly through the change of a deployment variable), the
600 sequence of events described in the previous paragraph would be initiated.
602 For example, to upgrade a container by changing configuration, specifically an
605 > helm deploy onap onap/so --version 2.0.1 --set enableDebug=true
607 Issuing this command will result in the appropriate container being stopped by
608 Kubernetes and replaced with a new container with the new environment value.
610 To upgrade a component to a new version with a new configuration file enter::
612 > helm deploy onbap onap/so --version 2.0.2 -f environments/demo.yaml
614 To fetch release history enter::
617 REVISION UPDATED STATUS CHART DESCRIPTION
618 1 Mon Feb 5 10:05:22 2018 SUPERSEDED so-2.0.1 Install complete
619 2 Mon Feb 5 10:10:55 2018 DEPLOYED so-2.0.2 Upgrade complete
621 Unfortunately, not all upgrades are successful. In recognition of this the
622 lineup of pods within an ONAP deployment is tagged such that an administrator
623 may force the ONAP deployment back to the previously tagged configuration or to
624 a specific configuration, say to jump back two steps if an incompatibility
625 between two ONAP components is discovered after the two individual upgrades
628 This rollback functionality gives the administrator confidence that in the
629 unfortunate circumstance of a failed upgrade the system can be rapidly brought
630 back to a known good state. This process of rolling upgrades while under
631 service is illustrated in this short YouTube video showing a Zero Downtime
632 Upgrade of a web application while under a 10 million transaction per second
635 For example, to roll-back back to previous system revision enter::
640 REVISION UPDATED STATUS CHART DESCRIPTION
641 1 Mon Feb 5 10:05:22 2018 SUPERSEDED so-2.0.1 Install complete
642 2 Mon Feb 5 10:10:55 2018 SUPERSEDED so-2.0.2 Upgrade complete
643 3 Mon Feb 5 10:14:32 2018 DEPLOYED so-2.0.1 Rollback to 1
647 The description field can be overridden to document actions taken or include
650 Many of the ONAP components contain their own databases which are used to
651 record configuration or state information. The schemas of these databases may
652 change from version to version in such a way that data stored within the
653 database needs to be migrated between versions. If such a migration script is
654 available it can be invoked during the upgrade (or rollback) by Container
655 Lifecycle Hooks. Two such hooks are available, PostStart and PreStop, which
656 containers can access by registering a handler against one or both. Note that
657 it is the responsibility of the ONAP component owners to implement the hook
658 handlers - which could be a shell script or a call to a specific container HTTP
659 endpoint - following the guidelines listed on the Kubernetes site. Lifecycle
660 hooks are not restricted to database migration or even upgrades but can be used
661 anywhere specific operations need to be taken during lifecycle operations.
663 OOM uses Helm K8S package manager to deploy ONAP components. Each component is
664 arranged in a packaging format called a chart - a collection of files that
665 describe a set of k8s resources. Helm allows for rolling upgrades of the ONAP
666 component deployed. To upgrade a component Helm release you will need an
667 updated Helm chart. The chart might have modified, deleted or added values,
668 deployment yamls, and more. To get the release name use::
672 To easily upgrade the release use::
674 > helm upgrade [RELEASE] [CHART]
676 To roll back to a previous release version use::
678 > helm rollback [flags] [RELEASE] [REVISION]
680 For example, to upgrade the onap-so helm release to the latest SO container
683 - Edit so values.yaml which is part of the chart
684 - Change "so: nexus3.onap.org:10001/openecomp/so:v1.1.1" to
685 "so: nexus3.onap.org:10001/openecomp/so:v1.1.2"
686 - From the chart location run::
688 > helm upgrade onap-so
690 The previous so pod will be terminated and a new so pod with an updated so
691 container will be created.
693 .. figure:: oomLogoV2-Delete.png
699 Existing deployments can be partially or fully removed once they are no longer
700 needed. To minimize errors it is recommended that before deleting components
701 from a running deployment the operator perform a 'dry-run' to display exactly
702 what will happen with a given command prior to actually deleting anything. For
705 > helm undeploy onap --dry-run
707 will display the outcome of deleting the 'onap' release from the
709 To completely delete a release and remove it from the internal store enter::
711 > helm undeploy onap --purge
713 One can also remove individual components from a deployment by changing the
714 ONAP configuration values. For example, to remove `so` from a running
717 > helm undeploy onap-so --purge
719 will remove `so` as the configuration indicates it's no longer part of the
720 deployment. This might be useful if a one wanted to replace just `so` by
721 installing a custom version.