Enable FWaaS

Enable the Firewall-as-a-Service service plugin so that you can create firewall rules and policies to secure router ports and networks.

Before you begin

  • You are running RHOSO 18.0.21 (Feature Release 6) or later.
  • You have the oc command line tool installed on your workstation.
  • You are logged on to a workstation that has access to the RHOSO control plane as a user with cluster-admin privileges.
  • Your OpenStackControlPlane custom resource (CR) file, for example, openstack_control_plane.yaml, exists on your workstation.

Procedure

  1. Edit your OpenStackControlPlane CR. Open your OpenStackControlPlane custom resource (CR) file (for example, openstack_control_plane.yaml) and add the FWaaS configuration using the customServiceConfig parameter under the neutron service template: 
    apiVersion: core.openstack.org/v1beta1
kind: OpenStackControlPlane
metadata:
  name: controlplane
  namespace: openstack
spec:
  neutron:
    template:
      customServiceConfig: |
        [DEFAULT]
        service_plugins = qos,ovn-router,trunk,segments,port_forwarding,log,firewall_v2
        [service_providers]
        service_provider = FIREWALL_V2:fwaas_ovn:neutron_fwaas.services.firewall.service_drivers.ovn.firewall_l3_driver.OVNFwaasDriver:default
  2. Apply the changes to the control plane. Run the following command to apply the updated configuration to your deployment: 
    $ oc apply -f openstack_control_plane.yaml
  3. Monitor the deployment. Wait until the Red Hat OpenShift Container Platform (RHOCP) applies the updates. You can check the status to ensure the control plane reaches the "Setup complete" state: 
    $ oc get openstackcontrolplane -w

    Sample output:

    NAME           STATUS   MESSAGE
controlplane   False    NeutronAPI: Deployment in progress
controlplane   True     Setup complete