How To Install OpenStack on AlmaLinux 10
OpenStack represents the leading open-source cloud computing platform, powering thousands of private and public clouds worldwide. AlmaLinux 10, as a production-ready enterprise Linux distribution, provides the perfect foundation for deploying robust OpenStack environments. This comprehensive guide covers three proven installation methods: Packstack for quick deployments, DevStack for development environments, and Kolla-Ansible for production-ready implementations.
Understanding OpenStack and AlmaLinux 10
What is OpenStack
OpenStack functions as a modular cloud operating system controlling large pools of compute, storage, and networking resources throughout a datacenter. The platform consists of essential core services including Nova (Compute) for virtual machine management, Neutron (Networking) for network-as-a-service, Keystone (Identity) for authentication and authorization, Glance (Image Service) for virtual machine image management, Cinder (Block Storage) for persistent volume management, and Horizon (Dashboard) providing a web-based user interface. These interconnected services work together to deliver Infrastructure-as-a-Service (IaaS) capabilities, enabling organizations to build scalable private and hybrid cloud environments.
AlmaLinux 10 Features and Benefits
AlmaLinux 10 brings significant enhancements as a community-driven, enterprise-grade Linux distribution. Built from Red Hat Enterprise Linux sources, it offers binary compatibility with RHEL while maintaining complete freedom from commercial restrictions. The distribution features enhanced security through SELinux policies, comprehensive package management via DNF, and long-term support spanning eight years. For OpenStack deployments, AlmaLinux 10 provides optimized kernel performance, robust container support, and streamlined system management tools that ensure reliable cloud infrastructure operations.
System Prerequisites and Planning
Hardware Requirements
Successful OpenStack deployment demands careful hardware planning based on intended usage scenarios. Minimum system requirements include 8GB RAM, 40GB available disk space, and at least 2 CPU cores for basic proof-of-concept installations. Production environments require substantially more resources: 16GB RAM minimum (32GB recommended), 100GB+ disk space with separate storage for Cinder volumes, and 4+ CPU cores with hardware virtualization support. Storage considerations involve implementing LVM for flexible volume management and utilizing SSD storage for improved I/O performance, particularly for database and messaging services.
Multi-node deployments necessitate dedicated network interfaces for management traffic, tenant networks, and external connectivity. Controller nodes handling API services require less compute power but benefit from faster storage for database operations. Compute nodes need substantial RAM and CPU resources for hosting virtual machine workloads.
Network Configuration Planning
OpenStack networking requires meticulous planning across multiple network types serving different purposes. Management networks handle inter-service communication and administrative access, typically using private IP ranges like 192.168.1.0/24. Provider networks connect virtual machines to external networks and require careful VLAN configuration when using tagged traffic. Tenant networks provide isolated communication paths between virtual machines within specific projects, often implemented using VXLAN overlays for scalability.
Network interface planning involves dedicating specific interfaces for different traffic types. A typical configuration includes one interface for management traffic, another for provider/external networks, and potentially a third for storage traffic in larger deployments. Proper MTU sizing becomes critical, especially with overlay networks requiring additional header space.
Software Prerequisites
AlmaLinux 10 systems require specific software components before OpenStack installation. Essential packages include Python 3.8 or later, git for source code management, and NetworkManager for network configuration. The system needs updated package repositories, particularly EPEL (Extra Packages for Enterprise Linux) and OpenStack-specific repositories like RDO.
SELinux configuration demands attention, as OpenStack services require specific security contexts and policies. While some administrators disable SELinux during initial testing, production environments should maintain SELinux in enforcing mode with appropriate policy customizations. Firewall configuration using firewalld requires opening specific ports for OpenStack services: 80/443 for Horizon dashboard, 5000/35357 for Keystone, 8774/8776 for Nova API, and numerous others depending on enabled services.
Preparing AlmaLinux 10 Environment
Initial System Setup
Begin OpenStack preparation by ensuring AlmaLinux 10 installation completeness and system currency. Execute comprehensive system updates using DNF package manager to obtain latest security patches and bug fixes. Configure proper hostname resolution by editing /etc/hosts to include fully qualified domain names for all nodes in multi-node deployments. Time synchronization proves critical for OpenStack services, requiring chronyd or ntpd configuration with reliable time sources.
sudo dnf update -y
sudo hostnamectl set-hostname openstack.example.com
sudo systemctl enable chronyd
sudo systemctl start chronydNetwork interface configuration requires attention to ensure consistent naming and proper connectivity. Verify network manager configuration and disable any conflicting network management tools that might interfere with OpenStack networking components.
User Account Configuration
OpenStack installation, particularly DevStack deployments, requires dedicated user accounts with appropriate privileges. Create a “stack” user for DevStack installations, ensuring proper home directory creation and shell assignment. This user needs sudo privileges without password prompts to facilitate automated installation procedures.
sudo useradd -s /bin/bash -d /opt/stack -m stack
sudo chmod +x /opt/stack
echo "stack ALL=(ALL) NOPASSWD: ALL" | sudo tee /etc/sudoers.d/stackProduction deployments using Packstack or Kolla-Ansible benefit from dedicated service accounts for each OpenStack component. These accounts should follow security best practices including minimal privilege assignment and secure authentication methods.
Security Configuration
SELinux configuration for OpenStack environments requires careful balance between security and functionality. Modern OpenStack releases include comprehensive SELinux policies, but custom configurations may require policy modifications. Verify SELinux status and configure appropriate boolean settings for OpenStack services:
sudo setsebool -P httpd_can_network_connect on
sudo setsebool -P httpd_execmem on
sudo setsebool -P httpd_unified onFirewall configuration using firewalld necessitates opening ports for OpenStack services while maintaining security. Create custom firewall zones for OpenStack traffic and configure appropriate port access. Essential ports include HTTP/HTTPS (80/443), Keystone (5000), Nova (8774), Neutron (9696), and Glance (9292).
Repository Setup
OpenStack installation requires adding specialized package repositories containing OpenStack components and dependencies. Install EPEL repository first, providing additional packages not available in base AlmaLinux repositories. Configure RDO repository for official OpenStack packages compatible with Red Hat-based distributions:
sudo dnf install -y epel-release
sudo dnf install -y centos-release-openstack-caracal
sudo dnf config-manager --enable crbVerify repository configuration and update package metadata to ensure access to latest OpenStack packages. Import GPG keys for package signature verification, maintaining security throughout the installation process.
Installation Method 1: Packstack (All-in-One)
Overview and Use Cases
Packstack provides the simplest OpenStack deployment method, ideal for proof-of-concept installations, development environments, and educational purposes. This Red Hat-developed tool uses Puppet modules to automate OpenStack component installation and configuration on single or multiple nodes. Packstack excels in rapid deployment scenarios where comprehensive customization isn’t required, typically completing installation within 30-60 minutes depending on system specifications.
The tool supports various deployment scenarios including all-in-one installations for testing, multi-node deployments for distributed architectures, and selective service installation for specific use cases. However, Packstack limitations include reduced customization options compared to other methods and potential challenges in production environments requiring extensive configuration modifications.
Installation Process
Packstack installation begins with ensuring proper repository configuration and package availability. Install the openstack-packstack package along with required dependencies:
sudo dnf install -y openstack-packstack python3-netaddrGenerate answer files containing deployment parameters using Packstack’s built-in generator. Answer files provide extensive customization options including network configuration, service selection, and authentication settings:
packstack --gen-answer-file=packstack-answers.txtEdit the answer file to customize deployment parameters. Key configurations include admin password settings, network interface specifications, and service enablement flags. Critical parameters include:
- CONFIG_DEFAULT_PASSWORD: Sets default password for all services
- CONFIG_KEYSTONE_ADMIN_PW: Specifies Keystone admin password
- CONFIG_COMPUTE_HOSTS: Defines compute node IP addresses
- CONFIG_NETWORK_HOSTS: Specifies network node locations
- CONFIG_NEUTRON_OVS_BRIDGE_IFACES: Maps bridge interfaces for networking
Execute Packstack installation using the customized answer file:
sudo packstack --answer-file=packstack-answers.txtMonitor installation progress through detailed logging output. Packstack provides comprehensive status updates including service configuration steps and potential error messages.
Configuration Options
Packstack answer files contain hundreds of configuration parameters enabling deployment customization. Network configuration options include provider network setup, VLAN ranges, and external network bridges. Service selection allows enabling or disabling specific OpenStack components like Ceilometer for telemetry, Heat for orchestration, or Swift for object storage.
Demo environment configurations automatically create sample networks, images, and instances for immediate testing. Production-oriented configurations disable demo resources and implement security-focused settings including SSL/TLS encryption and restrictive network policies.
Advanced options include database backend selection (MySQL/MariaDB vs PostgreSQL), message queue configuration (RabbitMQ vs Apache Qpid), and storage backend selection for various services. These choices significantly impact performance and operational characteristics.
Post-Installation Tasks
Successful Packstack deployment creates keystonerc_admin file containing administrative credentials and API endpoints. Source this file to establish environment variables for OpenStack CLI operations:
source keystonerc_admin
openstack service listAccess Horizon dashboard using the server IP address and admin credentials specified during installation. Default access URL follows the pattern http://SERVER_IP/dashboard with admin username and configured password.
Verify service functionality by creating basic resources including networks, subnets, security groups, and test instances. Upload cloud images to Glance and launch instances to validate complete stack functionality.
Installation Method 2: DevStack (Development Environment)
DevStack Overview
DevStack serves as the premier development-focused OpenStack installation method, designed for rapid deployment in testing and development scenarios. Originally created by OpenStack developers for continuous integration testing, DevStack provides automated installation scripts that download, configure, and start OpenStack services from source code repositories. This approach enables developers to work with cutting-edge OpenStack features and contribute to upstream development efforts.
DevStack’s primary advantages include rapid deployment completing within 15-30 minutes, extensive service coverage including experimental components, and easy customization through configuration files. However, DevStack installations are ephemeral by design, requiring complete reinstallation after system reboots, making them unsuitable for persistent development environments.
Environment Preparation
DevStack requires dedicated user account creation with sudo privileges and proper directory structure. Switch to the stack user created earlier and establish the development environment:
sudo -u stack -i
git clone https://opendev.org/openstack/devstack
cd devstackDevStack installation demands specific directory permissions and git repository access. Ensure internet connectivity for downloading OpenStack source code and dependencies. The installation process downloads gigabytes of data, requiring adequate disk space and network bandwidth.
Verify system compatibility by checking Python version, git installation, and available system resources. DevStack automatically handles most dependency installation but requires a clean starting environment to avoid conflicts with existing services.
Configuration Setup
DevStack configuration centers on the local.conf file containing deployment parameters and service specifications. Create this file in the devstack directory with essential configuration options:
cat << EOF > local.conf
[[local|localrc]]
ADMIN_PASSWORD=secret
DATABASE_PASSWORD=\$ADMIN_PASSWORD
RABBIT_PASSWORD=\$ADMIN_PASSWORD
SERVICE_PASSWORD=\$ADMIN_PASSWORD
# Enable key services
enable_service rabbit mysql key
# Enable Nova services
enable_service n-api n-cpu n-cond n-sch n-novnc n-cauth
# Enable Neutron
enable_service neutron q-svc q-agt q-dhcp q-l3 q-meta
# Enable Horizon
enable_service horizon
# Set the host IP address
HOST_IP=192.168.1.100
EOFAdvanced configuration options include service selection, networking parameters, and integration settings. DevStack supports extensive plugin architecture enabling additional service installation like Heat for orchestration, Ceilometer for telemetry, or experimental services under development.
Deployment Process
Execute DevStack installation using the stack.sh script, which performs comprehensive system configuration including package installation, database setup, service configuration, and startup:
./stack.shMonitor installation progress through detailed console output showing each configuration step. DevStack provides extensive logging information including service startup status, database initialization, and potential error messages. Installation typically requires 15-45 minutes depending on internet connection speed and system performance.
The script creates various OpenStack service accounts, databases, and configuration files while starting all services in screen sessions for easy monitoring. Upon completion, DevStack displays access credentials and service endpoints for immediate use.
Development Features
DevStack installations include comprehensive development tools including source code directories for all OpenStack services, enabling real-time code modification and testing. Services run in screen sessions allowing individual service restart and log monitoring without affecting other components.
The environment includes pre-configured CLI tools, sample images, and demo networks facilitating immediate development work. Integration with git repositories enables easy code updates and testing of patches or new features under development.
Installation Method 3: Kolla-Ansible (Production-Ready)
Kolla-Ansible Introduction
Kolla-Ansible represents the leading production-ready OpenStack deployment method, utilizing containerized architecture for enhanced reliability, scalability, and operational efficiency. This deployment tool packages OpenStack services in Docker containers, providing consistent environments across different deployment scenarios while simplifying upgrades and maintenance operations.
The containerized approach offers significant advantages including service isolation, simplified dependency management, and rolling upgrade capabilities. Kolla-Ansible supports complex multi-node architectures with high availability configurations, making it suitable for enterprise production environments requiring 99.9% uptime guarantees.
Prerequisites and Planning
Kolla-Ansible deployment requires comprehensive planning across multiple system layers. Multi-node architecture planning involves designating controller nodes for API services and databases, compute nodes for virtual machine hosting, and optionally dedicated network and storage nodes.
Network planning becomes critical with four distinct network types: management network for inter-service communication, tunnel network for tenant traffic, external network for floating IP connectivity, and optionally storage network for high-throughput backend operations. Each network requires dedicated interfaces or proper VLAN configuration.
Docker installation and configuration prerequisite setup:
sudo dnf config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
sudo dnf install -y docker-ce docker-ce-cli containerd.io
sudo systemctl enable docker
sudo systemctl start docker
sudo usermod -aG docker $USERInstallation and Configuration
Begin Kolla-Ansible installation by creating Python virtual environment and installing required packages:
python3 -m venv kolla-venv
source kolla-venv/bin/activate
pip install -U pip
pip install ansible kolla-ansibleConfigure Ansible inventory file defining node roles and network assignments. Multi-node inventory requires careful host assignment for different service categories:
cp kolla-ansible/ansible/inventory/multinode .
# Edit multinode file to assign hosts to rolesGlobal configuration through globals.yml file specification of deployment parameters including network interfaces, OpenStack release version, and service enablement flags. Critical configurations include:
- kolla_base_distro: Container base distribution
- network_interface: Management network interface
- neutron_external_interface: External network interface
- enable_haproxy: High availability proxy enablement
Deployment Execution
Kolla-Ansible deployment follows structured workflow beginning with node preparation and dependency installation:
kolla-ansible -i multinode bootstrap-servers
kolla-ansible -i multinode prechecksPre-deployment checks verify system configuration, network connectivity, and resource availability. Address any reported issues before proceeding with actual deployment to ensure successful installation.
Execute deployment using the deploy playbook:
kolla-ansible -i multinode deployPost-deployment configuration includes generating admin credentials and performing initial system setup:
kolla-ansible -i multinode post-deployThe process creates /etc/kolla/admin-openrc.sh file containing administrative credentials for CLI access.
Production Considerations
Production Kolla-Ansible deployments require additional considerations including backup strategy implementation, monitoring system integration, and maintenance procedure development. High availability configurations demand multiple controller nodes with load balancing and database clustering.
Security hardening involves implementing SSL/TLS encryption for all API communications, configuring proper firewall rules, and establishing logging and auditing procedures. Regular backup procedures for databases and configuration files ensure disaster recovery capabilities.
Post-Installation Configuration and Verification
Service Verification
Comprehensive OpenStack service verification ensures proper installation and functionality across all components. Begin verification by testing Identity service (Keystone) authentication and authorization mechanisms:
source admin-openrc
openstack token issue
openstack project list
openstack user listVerify Compute service (Nova) functionality by checking service status and available hypervisors:
openstack compute service list
openstack hypervisor list
openstack flavor listNetwork service (Neutron) verification includes agent status checking and network connectivity testing:
openstack network agent list
openstack network list
openstack subnet listImage service (Glance) verification involves uploading test images and confirming proper storage:
wget http://download.cirros-cloud.net/0.5.2/cirros-0.5.2-x86_64-disk.img
openstack image create "cirros" --file cirros-0.5.2-x86_64-disk.img --disk-format qcow2 --container-format bare --publicDashboard Access and Configuration
Horizon dashboard provides web-based OpenStack management interface accessible through configured IP address and port 80 or 443 for SSL deployments. Default access credentials depend on installation method: Packstack creates keystonerc_admin file, DevStack displays credentials upon completion, and Kolla-Ansible generates admin-openrc.sh file.
Initial dashboard configuration includes project creation, user management, and security group setup. Configure default security groups allowing SSH and ICMP traffic for basic instance connectivity. Create dedicated projects for different user groups or applications, implementing proper role-based access control.
CLI Tools Installation
OpenStack command-line interface tools provide comprehensive management capabilities beyond dashboard functionality. Install OpenStack client packages for complete CLI access:
sudo dnf install -y python3-openstackclient python3-novaclient python3-neutronclient python3-glanceclientConfigure authentication by sourcing appropriate credential files and verify CLI connectivity:
source admin-openrc
openstack --version
openstack service listAdvanced CLI usage includes automation scripting, bulk operations, and integration with configuration management tools like Ansible or Terraform.
Performance Optimization
Initial performance optimization involves database tuning, service configuration adjustment, and resource allocation optimization. MariaDB/MySQL configuration for OpenStack workloads requires connection pooling adjustment, query cache sizing, and InnoDB optimization:
[mysqld]
max_connections = 1000
innodb_buffer_pool_size = 512M
query_cache_size = 64MNova compute service optimization includes CPU allocation ratio adjustment, RAM overcommit configuration, and hypervisor-specific tuning. Network performance optimization involves MTU sizing, bridge configuration, and traffic shaping implementation.
Security Hardening and Best Practices
SELinux Configuration
SELinux integration with OpenStack requires careful policy configuration balancing security enforcement with service functionality. Modern OpenStack releases include comprehensive SELinux policies, but custom environments may require additional boolean settings or policy modules.
Verify current SELinux status and configure appropriate boolean settings for OpenStack services:
sudo getenforce
sudo setsebool -P httpd_can_network_connect on
sudo setsebool -P httpd_execmem on
sudo setsebool -P daemons_enable_cluster_mode onCustom SELinux policies may be necessary for specific deployment configurations or third-party integrations. Monitor SELinux logs for denied operations and create appropriate policy exceptions while maintaining security posture.
Firewall Configuration
Comprehensive firewall configuration protects OpenStack services while allowing necessary inter-service communication. Use firewalld to create service-specific zones and rules:
sudo firewall-cmd --permanent --add-port=5000/tcp --add-port=35357/tcp
sudo firewall-cmd --permanent --add-port=8774/tcp --add-port=8776/tcp
sudo firewall-cmd --permanent --add-port=9292/tcp --add-port=9696/tcp
sudo firewall-cmd --reloadNetwork segmentation strategies include isolating management networks, implementing VLAN separation for tenant traffic, and restricting external access to essential services only. Advanced configurations involve intrusion detection integration and automated threat response.
SSL/TLS Implementation
SSL/TLS encryption for OpenStack APIs ensures data protection during transmission and prevents credential interception. Configure SSL certificates for public-facing services including Horizon dashboard and API endpoints.
Generate SSL certificates using internal Certificate Authority or obtain certificates from trusted providers. Configure Apache/nginx reverse proxy for SSL termination and implement HTTP Strict Transport Security (HSTS) headers for enhanced security.
Access Control and Monitoring
Role-based access control (RBAC) implementation involves creating custom roles with specific permission sets, assigning users to appropriate projects, and implementing policy-based resource access controls. Regular access review procedures ensure continued security compliance and appropriate privilege assignment.
Comprehensive logging configuration captures security events, authentication attempts, and administrative actions. Integration with centralized logging systems enables security monitoring, threat detection, and compliance reporting.
Troubleshooting Common Issues
Installation Problems
Common installation failures require systematic troubleshooting approaches beginning with log analysis and dependency verification. Repository configuration issues often manifest as package not found errors or dependency conflicts:
sudo dnf clean all
sudo dnf makecache
sudo dnf repolistNetwork configuration problems include interface naming inconsistencies, MTU mismatches, and routing table issues. Verify network connectivity between nodes and ensure proper DNS resolution for all hostnames.
Service startup failures require examining systemd logs and configuration files for errors. Common issues include permission problems, port conflicts, and missing dependencies:
sudo systemctl status openstack-nova-api
sudo journalctl -u openstack-nova-apiRuntime Issues
Operational troubleshooting focuses on service-specific problems impacting OpenStack functionality. Nova compute errors frequently involve “No valid host found” messages indicating resource shortage, scheduler filter failures, or networking problems.
Instance spawning failures require examination of nova-compute logs, hypervisor resource availability, and image compatibility. Common solutions include increasing resource quotas, resolving network connectivity, and updating compute node configurations.
Network connectivity problems often stem from security group misconfigurations, router setup issues, or DHCP service failures. Systematic network troubleshooting includes security group rule verification, namespace inspection, and packet flow analysis.
Storage-related issues involve Cinder volume creation failures, attachment problems, or backend connectivity issues. Troubleshooting requires backend-specific knowledge and storage system health verification.
Log Analysis and Debugging
OpenStack services generate extensive logs providing detailed operational information and error messages. Log file locations vary by installation method but typically reside in /var/log/ directories with service-specific subdirectories.
Effective log analysis involves understanding log levels, correlating timestamps across services, and identifying error patterns. Common tools include grep for pattern matching, awk for structured parsing, and specialized log analysis platforms for complex troubleshooting.
Debug logging enables detailed operational tracing but impacts performance. Enable debug logging temporarily during troubleshooting and disable it in production environments to maintain optimal performance.
Recovery Procedures
Service recovery procedures depend on failure scope and impact severity. Individual service restart often resolves temporary issues without affecting other components:
sudo systemctl restart openstack-nova-api
sudo systemctl restart openstack-neutron-serverDatabase corruption or connectivity issues require more extensive recovery procedures including backup restoration, transaction log analysis, and data consistency verification. Maintain regular database backups and test recovery procedures regularly.
Complete system recovery involves coordinated service startup, database consistency checking, and configuration verification. Document recovery procedures and maintain current system configuration backups for rapid restoration.
Performance Tuning and Optimization
Resource Allocation
OpenStack performance optimization requires careful resource allocation balancing system capacity with workload requirements. CPU allocation ratios determine virtual CPU to physical CPU mapping, with typical ratios ranging from 4:1 to 16:1 depending on workload characteristics.
Memory overcommit ratios affect RAM allocation efficiency but require monitoring to prevent resource exhaustion. Conservative ratios (1.5:1) suit memory-intensive workloads while aggressive ratios (4:1) work for lightweight applications.
Storage performance optimization involves proper volume type configuration, backend-specific tuning, and I/O scheduling optimization. SSD storage significantly improves database performance and instance boot times.
Database Optimization
MariaDB/MySQL optimization for OpenStack workloads requires specific configuration adjustments addressing connection pooling, buffer sizing, and query optimization. Key parameters include:
[mysqld]
max_connections = 2000
innodb_buffer_pool_size = 2G
innodb_flush_log_at_trx_commit = 2
query_cache_size = 128M
tmp_table_size = 128MRegular database maintenance includes index optimization, table analysis, and connection monitoring. Implement database clustering for high availability and load distribution in large deployments.
Network Performance
Network throughput optimization involves MTU sizing, bridge configuration, and traffic shaping implementation. Jumbo frame support (9000 byte MTU) improves performance for storage and migration traffic but requires end-to-end network support.
VXLAN overhead considerations require MTU adjustments preventing packet fragmentation. Calculate appropriate MTU sizes considering overlay header requirements and physical network capabilities.
Monitoring and Alerting
Performance monitoring implementation involves metric collection, trend analysis, and proactive alerting for resource thresholds. Integration with monitoring platforms like Prometheus, Grafana, or proprietary solutions provides comprehensive visibility.
Key metrics include API response times, database connection usage, memory utilization, and network throughput. Establish baseline performance metrics and implement alerting for significant deviations.
Congratulations! You have successfully installed OpenStack. Thanks for using this tutorial for installing OpenStack on AlmaLinux OS 10 system. For additional help or useful information, we recommend you check the official OpenStack website.
