How to manage the OPCP configuration with opcp-cli

Ver como Markdown

Find out how to edit the deployment and hardware configuration of your OPCP with opcp-cli, then apply your changes to the control plane

Warning

If your OPCP is managed by OVHcloud, contact OVHcloud before you apply a change to the control plane.

Objective

On an OVHcloud On-Prem Cloud Platform (OPCP), the opcp-cli tool installed on your controllers manages the configuration of the control plane.

This guide explains how to edit the configuration of your OPCP with opcp-cli and apply your changes.

Requirements

An active OPCP service.
SSH access to your OPCP controller with your opcp-admin account, which can run opcp-cli with sudo whether your OPCP is managed by OVHcloud or not (see IAM rights management).

Instructions

Run each opcp-cli command with sudo. All the commands and options are described in opcp-cli --help.

The configuration is stored on the controller in two files, which you edit only with opcp-cli:

File	Content	Command
`/opt/opcp/config/opcp-deployment-config.yaml`	Platform settings: environment, OPCP version, backups, NTP servers, etc.	`opcp-cli config edit`
`/opt/opcp/config/opcp-hardware-config.yaml`	Hardware: controllers, OOB virtual IP, racks and devices declared in NetBox	`opcp-cli config edit --hardware`

A change has no effect until you apply it (step 2).

1. Editing the configuration

sudo opcp-cli config edit

The file opens in vi. Write only the keys you change: the other settings keep their default values. A list that replaces its default is the exception: write all its entries, not only the ones you change. If a key already exists in the file, modify it rather than adding it a second time.

When you save and close it, opcp-cli checks that the YAML is valid and that the mandatory fields are filled in. If the check fails, your changes are saved anyway: run the command again to fix the file before you apply it.

Warning

A YAML syntax error blocks every opcp-cli command, including config edit. If your OPCP is not managed by OVHcloud, fix the file with sudo vi or restore a previous copy from /opt/opcp/backup/opcp-cli/config/. Otherwise, contact OVHcloud support.

Warning

Some settings cannot be modified after installation, such as env, region, stage, org, site, location or base_dns_name. Before you change a value, check the Summary section of the guide Technical prerequisites for deployment.

To change the OPCP version, follow the guide How to upgrade OPCP.

2. Applying your changes

Check that the configured and deployed versions of your OPCP match. If they differ, follow the guide How to upgrade OPCP instead.

sudo opcp-cli version

Then apply your changes:

sudo opcp-cli deploy --system

The deployment can take more than 10 minutes. It copies the configuration to the other controllers and saves a dated copy of it in /opt/opcp/backup/opcp-cli/config/. The detailed logs are in /var/log/opcp-cli/opcp-cli.log. Do not delete the installation files from /opt/opcp/artifacts: the deployment needs them.

The platform then takes a few more minutes to converge. Check that it is healthy with opcp-diag:

sudo opcp-diag run

If the output contains the warning Following kustomizations are unready, followed by the list of the components concerned, a deployment is still in progress. If so, wait a few minutes, then run opcp-diag again.

Configuration examples

Unless stated otherwise, make the changes below in the deployment configuration with sudo opcp-cli config edit (step 1). Then apply each of them with sudo opcp-cli deploy --system (step 2). The network flows to open are listed in the guide Technical prerequisites for deployment.

Hardware configuration

Warning

Never modify the hardware configuration, except to extend your platform to several racks or to add network devices.

sudo opcp-cli config edit --hardware

Trusted certificate authority

If the platform must connect to a service whose certificate is signed by your own certificate authority (CA), for example an LDAP directory over LDAPS, copy the CA certificate (PEM format, .crt extension) to the controller, then run:

sudo opcp-cli secrets certificates trust-ca --ca-crt-path <path-to-your-ca>.crt --name <ca-name>

The name accepts only lowercase letters, digits and hyphens. The controller trusts the CA immediately, Keycloak within a few minutes, and the other platform components the next time they restart. Apply the change (step 2) to add the CA to the other controllers.

S3 backups

Follow the guide How to update the backup S3¹ buckets.

NTP servers

ntp:
  servers:
    - "<your-ntp-server-1>"
    - "<your-ntp-server-2>"

Give IP addresses or DNS names. For a DNS name that points to several servers, use the pools key instead of servers.

DNS resolvers

public_forward_resolvers:
  - "<your-dns-resolver-ip-1>"
  - "<your-dns-resolver-ip-2>"

This list replaces the default resolver: list all the resolvers to use.

Log forwarding to a syslog server

monitoring:
  logs:
    forwarder:
      enabled: true
      syslog:
        enabled: true
        endpoints:
          - host: "<your-syslog-server>"
            port: "514"
            mode: tcp

Write the port in quotes. The mode is tcp (default), tls or udp. Add one entry per syslog server.

Keycloak allowed endpoints

Keycloak can only reach the external services listed in keycloak.allowedEndpoints, such as your LDAP directory.

keycloak:
  allowedEndpoints:
    - host: "<your-ldap-server>"
      port: 636

Add one entry per host and TCP port. Network ranges are not supported.

Go further

For training or technical assistance implementing our solutions, contact your sales representative or visit our Professional Services page to request a quote and have your project analysed by our experts.

Join our community of users.

¹: S3 is a trademark of Amazon Technologies, Inc. OVHcloud's service is not sponsored by, endorsed by, or otherwise affiliated with Amazon Technologies, Inc.

¿Le ha resultado útil esta página?