--- title: "Red Hat Enterprise Linux" description: "Install Calico Open Source on an OpenStack deployment running Red Hat Enterprise Linux compute nodes." product: "Calico Open Source" version: "3.32 (latest)" section: "Installing and upgrading" canonical_url: "https://docs.tigera.io/calico/latest/getting-started/openstack/installation/redhat" --- # Red Hat Enterprise Linux > **SECONDARY:** The OpenStack RHEL installation path is no longer actively tested and may not work; these instructions are kept only in the hope they may be useful. These instructions will take you through a first-time install of Calico. If you are upgrading an existing system, please see [Upgrading Calico on OpenStack](https://docs.tigera.io/calico/latest/operations/upgrading/openstack-upgrade.md) instead. There are two sections to the install: adding Calico to OpenStack control nodes, and adding Calico to OpenStack compute nodes. Follow the [Common steps](#common-steps) on each node before moving on to the specific instructions in the control and compute sections. If you want to create a combined control and compute node, work through all three sections. ## Before you begin - Ensure that you meet the [requirements](https://docs.tigera.io/calico/latest/getting-started/openstack/requirements.md). - Confirm that you have SSH access to and root privileges on one or more Red Hat Enterprise Linux (RHEL) hosts. - Make sure you have working DNS between the RHEL hosts (use `/etc/hosts` if you don't have DNS on your network). - [Install OpenStack](http://docs.openstack.org) on the RHEL hosts. ## Common steps Some steps need to be taken on all machines being installed with Calico. These steps are detailed in this section. 1. [Add the EPEL repository](https://fedoraproject.org/wiki/EPEL). You may have already added this to install OpenStack. 2. Configure the Calico repository: ```bash cat > /etc/yum.repos.d/calico.repo <` is the IP address of the etcd server. ```text [calico] etcd_host = ``` ## Control node install On each control node, perform the following steps: 1. Delete all configured OpenStack state, in particular any instances, routers, subnets and networks (in that order) created by the install process referenced above. You can do this using the web dashboard or at the command line. > **SUCCESS:** The Admin and Project sections of the web dashboard both have subsections for networks and routers. Some networks may need to be deleted from the Admin section. > **WARNING:** The Calico install will fail if incompatible state is left around. 2. Edit `/etc/neutron/neutron.conf`. In the `[DEFAULT]` section, find the line beginning with `core_plugin`, and change it to read `core_plugin = calico`. Also find the setting for `service_plugins` and change it to read `service_plugins = qos`. 3. Install the `calico-control` package: ```text yum install -y calico-control ``` 4. Restart the neutron server process: ```text service neutron-server restart ``` ## Compute node install On each compute node, perform the following steps: 1. Open `/etc/nova/nova.conf` and remove the line from the `[DEFAULT]` section that reads: ```conf linuxnet_interface_driver = nova.network.linux_net.LinuxOVSInterfaceDriver ``` Remove the lines from the `[neutron]` section setting `service_neutron_metadata_proxy` or `service_metadata_proxy` to `True`, if there are any. Additionally, if there is a line setting `metadata_proxy_shared_secret`, comment that line out as well. Restart nova compute. ```bash service openstack-nova-compute restart ``` If this node is also a controller, additionally restart nova-api. ```bash service openstack-nova-api restart ``` 2. If they're running, stop the Open vSwitch services. ```bash service neutron-openvswitch-agent stop service openvswitch stop ``` Then, prevent the services running if you reboot. ```bash chkconfig openvswitch off chkconfig neutron-openvswitch-agent off ``` Then, on your control node, run the following command to find the agents that you just stopped. ```text neutron agent-list ``` For each agent, delete them with the following command on your control node, replacing `` with the ID of the agent. ```text neutron agent-delete ``` 3. Install Neutron infrastructure code on the compute host. ```text yum install -y openstack-neutron ``` 4. Edit `/etc/neutron/neutron.conf`. In the `[oslo_concurrency]` section, ensure that the `lock_path` variable is uncommented and set as follows. ```text # Directory to use for lock files. For security, the specified directory should # only be writable by the user running the processes that need locking. # Defaults to environment variable OSLO_LOCK_PATH. If external locks are used, # a lock path must be set. lock_path = $state_path/lock ``` 5. Stop and disable the Neutron DHCP agent, and install the Calico DHCP agent (which uses etcd, allowing it to scale to higher numbers of hosts). ```text service neutron-dhcp-agent stop chkconfig neutron-dhcp-agent off yum install -y calico-dhcp-agent ``` 6. Stop and disable any other routing/bridging agents such as the L3 routing agent or the Linux bridging agent. These conflict with Calico. ```bash service neutron-l3-agent stop chkconfig neutron-l3-agent off ``` Repeat for bridging agent and any others. 7. If this node is not a controller, install and start the Nova Metadata API. This step is not required on combined compute and controller nodes. ```bash yum install -y openstack-nova-api service openstack-nova-metadata-api restart chkconfig openstack-nova-metadata-api on ``` 8. Install the BIRD BGP client. ```bash yum install -y bird bird6 ``` 9. Install the `calico-compute` package. ```bash yum install -y calico-compute ``` 10. Configure BIRD. By default Calico assumes that you will deploy a route reflector to avoid the need for a full BGP mesh. To this end, it includes configuration scripts to prepare a BIRD config file with a single peering to the route reflector. If that's correct for your network, you can run either or both of the following commands. For IPv4 connectivity between compute hosts: ```bash calico-gen-bird-conf.sh ``` And/or for IPv6 connectivity between compute hosts: ```bash calico-gen-bird6-conf.sh ``` You will also need to [configure your route reflector to allow connections from the compute node as a route reflector client](https://docs.tigera.io/calico/latest/networking/configuring/bgp.md) . If you *are* configuring a full BGP mesh you need to handle the BGP configuration appropriately on each compute host. The scripts above can be used to generate a sample configuration for BIRD, by replacing the `` with the IP of one other compute host—this will generate the configuration for a single peer connection, which you can duplicate and update for each compute host in your mesh. To maintain connectivity between VMs if BIRD crashes or is upgraded, configure BIRD graceful restart. Edit the systemd unit file /usr/lib/systemd/system/bird.service (and bird6.service for IPv6): - Add `-R` to the end of the `ExecStart` line. - Add `KillSignal=SIGKILL` as a new line in the `[Service]` section. - Run `systemctl daemon-reload` to tell systemd to reread that file. Ensure that BIRD (and/or BIRD 6 for IPv6) is running and starts on reboot. ```bash service bird restart service bird6 restart chkconfig bird on chkconfig bird6 on ``` 11. Create `/etc/calico/felix.cfg` with the following content, where `` is the IP address of the etcd server. ```conf [global] DatastoreType = etcdv3 EtcdAddr = :2379 EndpointStatusPathPrefix = none ``` 12. Restart the Felix service. ```text service calico-felix restart ``` ## Configuration for etcd authentication If your etcd cluster has authentication enabled, you must also configure the relevant Calico components with an etcd user name and password. You can create a single etcd user for Calico that has permission to read and write any key beginning with `/calico/`, or you can create specific etcd users for each component, with more precise permissions. This table sets out where to configure each component of Calico for OpenStack, and the detailed access permissions that each component needs: | Component | Configuration | Access | | -------------- | -------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------- | | Felix | `CALICO_ETCD_USERNAME` and `CALICO_ETCD_PASSWORD` variables in Felix's environment on each compute node. | [See here](https://docs.tigera.io/calico/latest/reference/etcd-rbac/calico-etcdv3-paths.md#felix-as-a-stand-alone-process) | | Neutron driver | `etcd_username` and `etcd_password` in `[calico]` section of `/etc/neutron/neutron.conf` on each control node. | [See here](https://docs.tigera.io/calico/latest/reference/etcd-rbac/calico-etcdv3-paths.md#openstack-calico-driver-for-neutron) | | DHCP agent | `etcd_username` and `etcd_password` in `[calico]` section of `/etc/neutron/neutron.conf` on each compute node. | [See here](https://docs.tigera.io/calico/latest/reference/etcd-rbac/calico-etcdv3-paths.md#openstack-calico-dhcp-agent) |