Contents Menu Expand Light mode Dark mode Auto light/dark mode
Documentation Portal
  • 26.1
  • 25.2
  • 25.1 and earlier
Logo
Mirantis OpenStack for Kubernetes
  • Product Overview
  • Reference Architecture
    • Cluster types
    • Components overview
    • Requirements
      • MOSK cluster hardware requirements
      • Management cluster storage
      • System requirements for the seed node
      • Components collocation
      • Infrastructure requirements
      • Network requirements
    • Management cluster
      • Bare-metal provider
      • Release Controller
      • Management console
      • Identity and access management
        • External identity provider integration
        • Authentication and authorization
          • Implementation flow
          • Kubernetes CLI authentication flow
    • Cloud services
      • Compute service
        • Resource oversubscription
        • Virtual CPU
        • Instance migration
        • Image storage backend
        • Remote console access to virtual machines
        • GPU virtualization
        • Graceful instance shutdown
      • Networking service
        • Backends
        • General configuration
        • BGP dynamic routing
        • DVR incompatibility with ARP announcements and VRRP
      • Block Storage service
        • Backup configuration
        • Volume encryption
        • Volume configuration
      • Identity service
        • Federation
        • Regions
        • Application credentials
        • Domain-specific configuration
      • Image service
      • Object Storage service
      • Dashboard
      • Bare Metal service
      • DNS service
      • Key Manager service
      • Instance High Availability service
        • Enabling the Instance HA service
        • Enabling introspective instance monitor
      • Shared Filesystems service
      • Dynamic Resource Balancer service
    • OpenStack
      • OpenStack cluster
      • OpenStack lifecycle management
        • OpenStack Controller (Rockoon)
        • OpenStackDeployment Admission Controller
        • OpenStack Exporter
      • OpenStack configuration
        • OpenStackDeployment custom resource
        • OpenStackDeployment spec:services
        • OpenStackDeploymentStatus custom resource
        • OpenStack Controller configuration
        • Custom OpenStack images
      • OpenStack database
        • Overview of the OpenStack database backup and restoration
        • Workflows of the OpenStack database backup and restoration
        • OpenStack database auto-cleanup
        • Periodic OpenStack database backups
        • Remote storage for OpenStack database backups
        • Synchronization of local MariaDB backups with a remote S3 storage
      • OpenStack message bus
    • Tungsten Fabric
      • Tungsten Fabric cluster
        • Tungsten Fabric cluster components
        • Tungsten Fabric traffic flow
      • Tungsten Fabric lifecycle management
        • Tungsten Fabric Operator
        • TFOperator custom resource
      • Tungsten Fabric configuration
        • Cassandra configuration
        • Custom vRouter settings
        • Control plane traffic interface
        • Traffic encapsulation
        • Autonomous System Number (ASN)
        • Access to external DNS
        • Gateway for vRouter data plane network
        • Tungsten Fabric image precaching
        • Graceful restart and long-lived graceful restart
        • Configuring the protocol for connecting to Cassandra clusters
        • SR-IOV Spoof Check control for Tungsten Fabric
        • Availability zones
      • Tungsten Fabric database
        • Periodic Tungsten Fabric database backups
        • Remote storage for Tungsten Fabric database backups
      • Tungsten Fabric services
        • Tungsten Fabric load balancing (HAProxy)
        • Octavia Amphora load balancing
      • Tungsten Fabric known limitations
      • Tungsten Fabric integration with OpenStack
      • Tungsten Fabric IPv6 support
    • Networking
      • Networking overview
      • Management cluster networking
      • MOSK cluster networking
      • IP Address Management
      • Multi-rack architecture
      • Physical networks layout
      • Underlay networking: routing configuration
      • Performance optimization
      • Built-in load balancing
      • Proxy support and cache of artifacts
      • Infrastructure connectivity monitoring
    • Bare metal
      • Bare-metal components
      • Extended hardware configuration
    • Kubernetes underlay
      • LCM custom resources
      • LCM Controller
      • LCM Agent
      • Helm Controller
      • MKE API limitations
      • MKE configuration management
    • Storage
      • Ceph overview
      • Ceph limitations
      • Ceph integration with OpenStack
      • Addressing storage devices using MiraCeph (current)
      • Addressing storage devices using KaaSCephCluster (deprecated)
    • Logging, monitoring, and alerting
      • Deployment architecture
      • Supported features
      • Authentication flow
      • Monitored components
      • Storage-based log retention strategy
      • OpenSearch and Prometheus storage sizing
      • StackLight integration with OpenStack
      • Workload monitoring
      • Outbound telemetry
      • StackLight logging indices
      • StackLight proxy
    • Blueprints
      • Remote compute nodes
        • Introduction to edge computing
        • Overview of the remote compute nodes approach
        • Design considerations for a remote site
        • Remote compute nodes with Tungsten Fabric
      • Large clusters
      • Cephless cloud
      • Air-gapped clusters
        • Directory and URL structure
        • Limitations on Logging, Monitoring, and Alerting
        • Requirements for air-gapped clusters
        • Configure and deploy an air-gapped cluster
          • Prepare an offline copy for an air-gapped cluster
          • Create a local mirror
          • Deploy an air-gapped management cluster
          • Monitor the airgapped tool status in JSON format
        • Update a cluster in an air-gapped environment
      • Integration with Enterprise Identity Directory (LDAP/AD)
        • Architecture overview
        • Configuration
        • Workflows
    • Node maintenance API
      • Node maintenance API objects
      • OpenStack Controller maintenance API
      • Tungsten Fabric Controller maintenance API
      • Cluster update flow
      • Parallelizing node update operations
  • Deployment Guide
    • Plan the deployment
    • Provision and deploy a management cluster
      • Deploy a management cluster
        • Introduction
        • Overview of the deployment workflow
        • Controlled bare-metal provisioning workflows
        • Set up a bootstrap cluster
        • Deploy a management cluster
        • Configure bare-metal settings
          • Configure BIOS on a bare-metal host
          • Customize the default bare-metal host profile
          • Configure NIC bonding
          • Separate PXE and management (LCM) networks
          • Configure multiple DHCP address ranges
          • Enable dynamic IP allocation
          • Set a custom external IP address for the DHCP service
        • Configure optional settings
        • Post-deployment steps
      • Create initial users after a management cluster bootstrap
      • Requirements for a MITM proxy
      • Configure external identity provider for IAM
        • Configure LDAP for IAM
        • Configure Google OAuth IdP for IAM
    • Create a MOSK cluster
      • Create a project for MOSK clusters
      • Add a bare-metal host
        • Add a bare-metal host using MOSK management console
        • Add a bare-metal host using CLI
      • Create a custom bare-metal host profile
        • Default configuration of the host system storage
        • Wipe a device or partition
        • Create MOSK host profiles
        • Configure Ceph disks in a host profile
        • Enable huge pages in a host profile
        • Configure RAID support
          • Create an LVM software RAID (raid1)
          • Create LVM volume groups on top of RAID devices
          • Create an mdadm software RAID (raid0, raid1, raid10)
          • Create an mdadm software RAID level 10 (raid10)
      • Create a MOSK cluster
        • Create a MOSK cluster
        • Configure MetalLB
          • Configure and verify MetalLB
          • Configure node selectors for MetalLB speakers
        • Configure BGP announcement for cluster API LB address
        • Obtain and use details about network interfaces
        • Create subnets
          • Service labels and their life cycle
          • Create subnets for a cluster using MOSK management console
          • Create subnets for a cluster using CLI
        • Create L2 templates
          • Create an L2 template for a new cluster
          • Create L2 templates for a multi-rack MOSK cluster
          • Create an L2 template for a Kubernetes manager node
          • Create an L2 template for a MOSK controller node
          • Create an L2 template for a MOSK compute node
          • Create an L2 template for a MOSK storage node
          • L2 template example with bonds and bridges
        • Example of a complete template configuration for cluster creation
      • Add a machine
        • Create a machine using CLI
        • Create a machine using MOSK management console
        • Assign L2 templates to machines
        • Deploy a machine to a specific bare-metal host
        • Override network interfaces naming and order
        • Manually allocate IP addresses for bare-metal hosts
      • Add a Ceph cluster using MiraCeph (current)
      • Add a Ceph cluster using KaaSCephCluster (deprecated)
    • Deploy OpenStack
      • Deploy an OpenStack cluster
      • Advanced OpenStack configuration (optional)
        • Enable LVM ephemeral storage
        • Enable LVM block storage
        • Enable DPDK with OVS
        • Enable SR-IOV with OVS
        • Enable BGP VPN
        • Encrypt the east-west traffic
        • Enable Cinder backend for Glance
        • Enable Cinder volume encryption
        • Advanced configuration for OpenStack compute nodes
          • Configuration recommendations for compute node types
          • Configure the CPU model
          • Enable huge pages for OpenStack
          • Configure CPU isolation for a compute node
          • Configure custom CPU topologies
          • Configure PCI passthrough for guests
          • Configure initial resource oversubscription
          • Limit HW resources for hyperconverged OpenStack compute nodes
          • Configure GPU virtualization
        • Enable image signature verification
        • Configure LoadBalancer for PowerDNS
      • Access OpenStack after deployment
        • Configure DNS to access OpenStack
        • Access your OpenStack environment
      • Troubleshoot an OpenStack deployment
        • Debugging the Helm releases
        • Debugging the OpenStack Controller
        • Debugging the OsDpl CR
        • Support dump
    • Deploy Tungsten Fabric
      • Tungsten Fabric deployment prerequisites
      • Deploy Tungsten Fabric
      • Advanced Tungsten Fabric configuration (optional)
        • Enable huge pages for OpenStack with Tungsten Fabric
        • Enable DPDK for Tungsten Fabric
        • Enable SR-IOV for Tungsten Fabric
        • Configure multiple Contrail API workers
        • Disable Tungsten Fabric analytics services
      • Troubleshoot the Tungsten Fabric deployment
        • Enable debug logs for the Tungsten Fabric services
        • Troubleshoot access to the Tungsten Fabric web UI
        • Disable TX offloading on NICs used by vRouter
  • Operations Guide
    • Cluster update
      • Update to a major version
      • Update to a patch version
      • Verify the management cluster status before MOSK update
      • Change the upgrade order of a machine
      • Configure the parallel update of worker nodes
      • Create update groups for worker machines
      • Granularly update MOSK using the ClusterUpdatePlan object
      • Configure update auto-pause
    • Getting access
      • Generate a kubeconfig for a MOSK cluster using API
      • Connect to a MOSK cluster
      • Access the Keycloak Admin Console
      • Access the Tungsten Fabric web UI
    • OpenStack operations
      • Migrate networking from Open vSwitch to Open Virtual Network
        • Migration limitations and impact
        • Prepare environment for migration
        • Perform pre-migration verification
        • Adjust security groups to allow access to DHCP and Metadata
        • Adjust MTU for VXLAN tenant networks
        • Adjust DNS servers for subnets
        • Perform migration
        • Verification and cleanup
      • Upgrade OpenStack
      • Backup and restore OpenStack databases
        • Enable OpenStack database remote backups
        • Restore OpenStack databases from a backup
        • Verify the periodic backup jobs for the OpenStack database
      • Add a controller node
      • Replace a failed controller node
      • Add a compute node
      • Change oversubscription settings for existing compute nodes
      • Delete a compute node
      • Run Tempest tests
      • Remove an OpenStack cluster
      • Remove an OpenStack service
      • Enable uploading of an image through Horizon with untrusted SSL certificates
      • Rotate OpenStack credentials
      • Customize OpenStack container images
      • Troubleshoot orphaned resource allocations
      • Start monitoring IP address capacity
      • Rotate Octavia Amphora (LBaaS) certificates
    • OpenStack services configuration
      • Configure high availability with Masakari
      • Configure monitoring of cloud workload availability
    • Ceph operations for MiraCeph
      • Ceph default configuration options
      • Ceph advanced configuration
      • Configure Ceph Object Gateway TLS
      • Use object storage server-side encryption
      • Set an Amazon S3 bucket policy
        • Create Ceph Object Storage users
        • Set a bucket policy for a Ceph Object Storage user
        • Set a bucket policy for OpenStack users
      • Calculate target ratio for Ceph pools
      • Ceph pools for Cinder multi-backend
      • Automated Ceph LCM
        • High-level workflow of Ceph OSD or node removal
          • Creating a Ceph OSD removal request
          • CephOsdRemoveRequest OSD removal specification
          • CephOsdRemoveRequest OSD removal status
        • Add, remove, or reconfigure Ceph nodes
        • Add, remove, or reconfigure Ceph OSDs
        • Add, remove, or reconfigure Ceph OSDs with metadata devices
        • Replace a failed Ceph OSD
        • Replace a failed Ceph OSD with a metadata device
          • Replace a failed Ceph OSD with a metadata device as a logical volume path
          • Replace a failed Ceph OSD disk with a metadata device as a device name
        • Replace a failed metadata device
        • Replace a failed Ceph node
      • Remove Ceph OSD manually
      • Migrate Ceph cluster to address storage devices using by-id
      • Obtain a by-id symlink of a storage device
      • Increase Ceph cluster storage size
      • Move a Ceph Monitor daemon to another node
      • Migrate a Ceph Monitor before machine replacement
      • Enable Ceph RGW Object Storage
      • Enable multisite for Ceph RGW Object Storage
      • Manage Ceph RBD or CephFS clients and RGW users
        • Manage Ceph RBD or CephFS clients
        • Manage Ceph Object Storage users
      • Verify Ceph
        • Verify the Ceph core services
        • Verify rook-discover
        • Verify Ceph cluster state
          • Verify Ceph cluster state
          • MiraCephHealth and MiraCephSecret status descriptions
        • Verify Ceph Controller and Rook
      • Enable management of Ceph tolerations and resources
        • Enable management of Ceph tolerations and resources
        • Verify Ceph tolerations and resources
      • Enable Ceph multinetwork
      • Enable Ceph RBD mirroring
      • Configure Ceph Shared File System (CephFS)
      • Share Ceph across two MOSK clusters
      • Specify placement of Ceph cluster daemons
      • Migrate Ceph pools from one failure domain to another
      • Enable periodic Ceph performance testing
        • Create a Ceph performance test request
        • CephPerfTestRequest CR perftest specification
        • CephPerfTestRequest perftest status
    • Ceph operations for KaaSCephCluster (deprecated)
      • Ceph default configuration options
      • Ceph advanced configuration
      • Configure Ceph Object Gateway TLS
      • Use object storage server-side encryption
      • Set an Amazon S3 bucket policy
        • Create Ceph Object Storage users
        • Set a bucket policy for a Ceph Object Storage user
        • Set a bucket policy for OpenStack users
      • Calculate target ratio for Ceph pools
      • Ceph pools for Cinder multi-backend
      • Comparison of KaaSCephCluster and MiraCeph-related specifications
      • Automated Ceph LCM
        • High-level workflow of Ceph OSD or node removal
          • Creating a Ceph OSD removal request
          • KaaSCephOperationRequest OSD removal specification
          • KaaSCephOperationRequest OSD removal status
        • Add, remove, or reconfigure Ceph nodes
        • Add, remove, or reconfigure Ceph OSDs
        • Add, remove, or reconfigure Ceph OSDs with metadata devices
        • Replace a failed Ceph OSD
        • Replace a failed Ceph OSD with a metadata device
          • Replace a failed Ceph OSD with a metadata device as a logical volume path
          • Replace a failed Ceph OSD disk with a metadata device as a device name
        • Replace a failed metadata device
        • Replace a failed Ceph node
      • Remove Ceph OSD manually
      • Migrate Ceph cluster to address storage devices using by-id
      • Obtain a by-id symlink of a storage device
      • Increase Ceph cluster storage size
      • Move a Ceph Monitor daemon to another node
      • Migrate a Ceph Monitor before machine replacement
      • Enable Ceph RGW Object Storage
      • Enable multisite for Ceph RGW Object Storage
      • Manage Ceph RBD or CephFS clients and RGW users
        • Manage Ceph RBD or CephFS clients
        • Manage Ceph Object Storage users
      • Verify Ceph
        • Verify the Ceph core services
        • Verify rook-discover
        • Verify Ceph cluster state through CLI
          • Verify Ceph cluster state
          • KaaSCephCluster.status description
        • View Ceph cluster summary through the management console
        • Verify Ceph Controller and Rook
      • Enable Ceph tolerations and resources management
        • Enable Ceph tolerations and resources management
        • Verify Ceph tolerations and resources management
      • Enable Ceph multinetwork
      • Enable Ceph RBD mirroring
      • Configure Ceph Shared File System (CephFS)
      • Share Ceph across two MOSK clusters
      • Specify placement of Ceph cluster daemons
      • Migrate Ceph pools from one failure domain to another
      • Enable periodic Ceph performance testing
        • Create a Ceph performance test request
        • KaaSCephOperationRequest CR perftest specification
        • KaaSCephOperationRequest perftest status
    • StackLight operations
      • Configure StackLight
        • StackLight configuration procedure
        • StackLight configuration parameters
        • Verify StackLight after configuration
      • Tune OpenSearch performance
      • Export logs from OpenSearch Dashboards to CSV
      • OpenSearch Dashboards
        • View OpenSearch Dashboards
        • Search in OpenSearch Dashboards
      • View Grafana dashboards
      • Create custom dashboards in Grafana
      • Export data from Table panels of Grafana dashboards to CSV
      • StackLight alerts
        • OpenStack
          • OpenStack system services
            • Libvirt
            • MariaDB
            • Memcached
            • SSL certificates
            • RabbitMQ
          • OpenStack core services
            • OpenStack services API
            • Cinder
            • Horizon
            • Ironic
            • Neutron
            • Nova
            • Cloudprober
            • Portprober
            • PowerDNS
            • Credential rotation
          • OpenStack Controller (Rockoon)
        • Tungsten Fabric
          • Cassandra
          • Kafka
          • Redis
          • Tungsten Fabric Operator
          • Tungsten Fabric
          • ZooKeeper
        • StackLight
          • Alertmanager
          • cAdvisor
          • Elasticsearch Exporter
          • Fluentd
          • General
          • Grafana
          • Monitoring of external endpoints
          • OpenSearch
          • PostgreSQL and Patroni
          • Prometheus
          • Prometheus MS Teams
          • Prometheus Relay
          • ServiceNow
          • Salesforce notifier
          • Telegraf
          • Telemeter
        • Ceph
        • Bare metal
          • Bond interface
          • Ironic
          • Kernel
          • Host Operating System Modules Controller
        • Generic
          • Calico
          • Etcd
        • Kubernetes
          • Kubernetes applications
          • Kubernetes resources
          • Kubernetes storage
          • Kubernetes system
        • Keycloak
        • MOSK management
          • Helm Controller
          • MOSK management
          • MOSK management cache
          • MOSK management controllers
          • MOSK management providers
          • MOSK and MOSK management SSL
          • Release Controller
        • Mirantis Kubernetes Engine
        • Node
          • General
          • Node network
          • Node time
        • Cross-node connectivity
      • Alert dependencies
      • Silence alerts
      • StackLight rules for Kubernetes network policies
      • Tune StackLight for long-term log retention
      • Enable log forwarding to external destinations
      • Enable remote logging to syslog
      • Create log-based metrics
      • Enable generic metric scraping
      • Manage metrics filtering
      • Use S.M.A.R.T. metrics for creating alert rules
      • Deschedule StackLight Pods from a worker machine
    • Tungsten Fabric operations
      • Update Tungsten Fabric
      • Back up TF data
      • Restore Tungsten Fabric data
      • Replace a failed TF controller node
      • Delete a vRouter node
      • Verify the Tungsten Fabric deployment
      • Configure load balancing
      • Enable Tungsten Fabric Cassandra repairs
      • Enable contrail-tools
      • Enable tf-api-cli
    • Bare-metal operations
      • Upgrade an operating system distribution
      • Automatic upgrade of a host operating system
      • Remove old Ubuntu kernel packages
      • Host operating system configuration
        • Host OS configuration management workflow
        • Global recommendations for implementation of custom modules
        • Format and structure of a module package
        • Modules provided by MOSK
        • HostOSConfiguration and HostOSConfigurationModules concepts
        • Internal API for host OS configuration management
        • Add a custom module to a MOSK deployment
        • Test a custom or MOSK module after creation
        • Retrigger a module configuration
        • Troubleshooting
      • Change a user name and password for a bare-metal host
      • Restart the inspection of a bare-metal host
      • Restart a bare-metal host
      • Replace a failed manager node
      • Modify network configuration on an existing machine
      • Add more racks to an existing MOSK cluster
      • Expand IP addresses capacity in an existing cluster
      • Enable network infrastructure monitoring
      • Run cluster self-diagnostics
        • Trigger self-diagnostics for a cluster
        • Self-upgrades of the Diagnostic Controller
        • Diagnostic checks for the bare-metal provider
    • IAM operations
      • Manage user roles through the MOSK management API
        • Available IAM roles and use cases
        • Mapping of Keycloak roles to IAM*RoleBinding objects
      • Manage user roles through the MOSK management console
      • Manage user roles through Keycloak
        • MOSK roles and scopes
        • Use cases
      • Change the password for Keycloak master user
      • Change passwords for IAM users
      • Obtain MariaDB credentials for IAM
      • Manage Keycloak truststore using the MOSK management console
    • Management cluster operations
      • MOSK management CLI
      • Workflow and configuration of management cluster upgrade
      • Schedule MOSK management updates
      • Renew the MOSK and MKE licenses
      • Configure NTP server
      • Automatically propagate Salesforce configuration to all clusters
      • Update the Keycloak IP address on bare-metal clusters
      • Configure host names for cluster machines
      • Back up MariaDB on a management cluster
        • Configure periodic backups of MariaDB
        • Verify operability of the MariaDB backup jobs
        • Restore MariaDB databases
        • Change the storage node for MariaDB
      • Remove a management cluster
      • Warm up the MOSK management cache
    • General operations
      • Change a cluster configuration
      • Enable cluster and machine maintenance mode
        • Enable maintenance mode on a cluster and machine using management console
        • Enable maintenance mode on a cluster and machine using CLI
      • Disable a machine
      • Perform a graceful reboot of a cluster
      • Delete a cluster machine
        • Precautions for a cluster machine deletion
        • Delete a cluster machine using the management console
        • Delete a cluster machine using CLI
      • Delete a MOSK cluster
      • Verify cluster status
      • Verify machine status
    • Underlay Kubernetes operations
      • Set the MTU size for Calico
      • Add or update a CA certificate for a MITM proxy using API
      • Configure TLS certificates for cluster applications
      • Define a custom CA certificate for a private Docker registry
      • Increase memory limits for cluster components
      • Increase storage quota for etcd
      • Configure Kubernetes auditing and profiling
    • Limitations
  • Troubleshooting Guide
    • Collect cluster logs
    • Inspect the history of a cluster and machine deployment or update
    • Cluster deletion freezes
    • Keycloak admin console becomes inaccessible after changing the theme
    • Unresponsive OpenSDN API due to excessive Cassandra tombstone records
    • The ‘database space exceeded’ error on large clusters
    • The auditd events cause ‘backlog limit exceeded’ messages
    • Troubleshoot a management cluster bootstrap
      • Troubleshoot the bootstrap node configuration
        • DNS settings
        • Default network addresses
      • Troubleshoot the bootstrap region creation
      • Troubleshoot machine creation
      • Troubleshoot deployment stages
      • Collect the bootstrap logs
    • Troubleshoot bare metal
      • Log in to the IPA virtual console for hardware troubleshooting
      • Inspection error on bare-metal hosts after dnsmasq restart
      • Troubleshoot an operating system upgrade with host restart
      • Troubleshoot iPXE boot issues
      • Provisioning failure due to device naming issues in a bare-metal host profile
    • Troubleshoot Ceph based on MiraCeph (current)
      • Ceph disaster recovery
      • Ceph Monitors recovery
      • CephOsdRemoveRequest failure with a timeout during rebalance
      • Ceph Monitors store.db size rapidly growing
      • Replaced Ceph OSD fails to start on authorization
      • The ceph-exporter pods are present in the Ceph crash list
      • Ceph health reports PG_DAMAGED after a failed disk or node replacement
    • Troubleshoot Ceph based on KaaSCephCluster (deprecated)
      • Ceph disaster recovery
      • Ceph Monitors recovery
      • KaaSCephOperationRequest failure with a timeout during rebalance
      • Ceph Monitors store.db size rapidly growing
      • Replaced Ceph OSD fails to start on authorization
      • The ceph-exporter pods are present in the Ceph crash list
      • Ceph health reports PG_DAMAGED after a failed disk or node replacement
    • Troubleshoot StackLight
      • Patroni replication lag
      • Alertmanager does not send resolve notifications for custom alerts
      • Troubleshoot alerts
        • Troubleshoot cAdvisor alerts
        • Troubleshoot Helm Controller alerts
        • Troubleshoot Host Operating System Modules Controller alerts
        • Troubleshoot Ubuntu kernel alerts
        • Troubleshoot Kubernetes applications alerts
        • Troubleshoot Kubernetes resources alerts
        • Troubleshoot Kubernetes storage alerts
        • Troubleshoot Kubernetes system alerts
        • Troubleshoot MOSK management Exporter alerts
        • Troubleshoot Mirantis Kubernetes Engine alerts
        • Troubleshoot OpenSearch alerts
        • Troubleshoot Release Controller alerts
        • Troubleshoot Ceph alerts
        • Troubleshoot Telemeter client alerts
      • OpenSearchPVCMismatch alert raises due to the OpenSearch PVC size mismatch
      • OpenSearch cluster deadlock due to the corrupted index
      • Failure of shard relocation in the OpenSearch cluster
      • StackLight pods get stuck with the ‘NodeAffinity failed’ error
      • No logs are forwarded to Splunk
  • API Reference
    • Management resources
      • General resources
        • PublicKey resource
        • License resource
        • TLSConfig resource
        • ContainerRegistry resource
        • MCCUpgrade resource
        • CacheWarmupRequest resource
      • IAM resources
        • IAMUser resource
        • IAMRole resource
        • IAMGlobalRoleBinding resource
        • IAMRoleBinding resource
        • IAMClusterRoleBinding resource
      • Cluster resources
        • BareMetalHost resource
        • BareMetalHostCredential resource
        • BareMetalHostInventory resource
        • BareMetalHostProfile resource
        • Cluster resource
        • Machine resource
      • Cluster lifecycle resources
        • Diagnostic resource
        • GracefulRebootRequest resource
        • ClusterUpdatePlan resource
        • UpdateGroup resource
        • UpdateAutoPause resource
      • Networking resources
        • IPaddr
        • IpamHost
        • L2Template
        • MetalLBConfig
        • MultiRackCluster
        • Rack
        • Subnet
      • Network infrastructure monitoring resources
        • InfraConnectivityMonitor
        • CheckerInventoryConfig
        • NetCheckerTargetsConfig
      • Host OS configuration resources
        • HostOSConfiguration
        • HostOSConfigurationModules
    • OpenStack Operator resources
    • Tungsten Fabric Operator resources
    • Ceph resources
    • StackLight resources
  • User Guide
    • Use the Instance HA service
    • Configure the introspective instance monitor
    • Manage application credentials
    • Authenticate in OpenStack API as a federated OIDC user
    • Use the Shared Filesystems service
      • Set up Shared Filesystems service with generic driver
      • Set up Shared Filesystems service with CephFS driver
    • Deploy your first cloud application using automation
    • Deploy your first cloud application using cloud web UI
    • Use Heat to create and manage Tungsten Fabric objects
    • Use S3 API for MOSK Object Storage
    • Run Windows guests
    • Use the Dynamic Resource Balancer service
    • Migrate instances
    • Configure network trunking in projects
    • Configure per-instance migration mode
    • Access the bare-metal node console
  • Security Guide
    • CADF audit notifications in OpenStack services
    • Rotation of credentials in OpenStack
    • Firewall configuration
      • MOSK management
      • Mirantis Kubernetes Engine
      • StackLight
      • Ceph
      • MOSK
      • OpenStack
      • Tungsten Fabric
    • OpenStack API access policies
    • Data protection
      • Data encryption capabilities
      • Encryption of live migration data
      • Encryption of cloud control plane communications
    • Compliance
      • Federal Information Processing Standards (FIPS)
      • Center for Internet Security (CIS) benchmarks for host OS
    • Container images signing and validation
    • LBaaS certificate
  • FAQ

Release and Lifecycle Information

  • Release Notes
    • 25.2 series
      • 25.2
        • New features
        • Known issues
        • Release artifacts
          • MOSK cluster artifacts
          • Management cluster artifacts
        • Addressed issues
        • Update notes
        • Security notes
      • 25.2.1 patch
        • Release artifacts
          • MOSK cluster artifacts
          • Management cluster artifacts
        • Security notes
        • Addressed issues
        • Known issues
        • Update notes
      • 25.2.2 patch
        • Release artifacts
          • MOSK cluster artifacts
          • Management cluster artifacts
        • Security notes
        • Addressed issues
        • Known issues
        • Update notes
      • 25.2.3 patch
        • Release artifacts
          • MOSK cluster artifacts
          • Management cluster artifacts
        • Security notes
        • Addressed issues
        • Known issues
        • Update notes
      • 25.2.4 patch
        • Release artifacts
          • MOSK cluster artifacts
          • Management cluster artifacts
        • Security notes
        • Addressed issues
        • Known issues
        • Update notes
      • 25.2.5 patch
        • Release artifacts
          • MOSK cluster artifacts
          • Management cluster artifacts
        • Security notes
        • Known issues
        • Update notes
      • 25.2.6 patch
        • Release artifacts
          • MOSK cluster artifacts
          • Management cluster artifacts
        • Security notes
        • Addressed issues
        • Known issues
        • Update notes
      • 25.2.7 patch
        • Release artifacts
          • MOSK cluster artifacts
          • Management cluster artifacts
        • Security notes
        • Known issues
        • Addressed issues
        • Update notes
  • Compatibility Matrix
    • MOSK cluster components compatibility
    • Management cluster components compatibility
    • Cluster versions compatibility
    • MOSK cluster update schema
  • Deprecation Notes
    • OpenStack
    • Tungsten Fabric
    • Bare metal
    • MOSK management
    • Ceph
    • StackLight
  • Release cadence and support cycle
Newer documentation is now live.You are currently reading an older version.
Switch to latest

Firewall configuration

This section includes the details about ports and protocols used in a MOSK deployment.

  • MOSK management
  • Mirantis Kubernetes Engine
  • StackLight
    • User interfaces
    • Alertmanager notifications receivers
    • External integrations
    • Metrics exporters
    • MOSK management telemetry
  • Ceph
    • Ceph network policies
  • MOSK
  • OpenStack
  • Tungsten Fabric
Next
MOSK management
Previous
Rotation of credentials in OpenStack

Mirantis Inc. 900 E Hamilton Avenue, Suite 650, Campbell, CA 95008 +1-650-963-9828

© 2005 - 2026 Mirantis, Inc. All rights reserved. "Mirantis" and "FUEL" are registered trademarks of Mirantis, Inc. All other trademarks are the property of their respective owners.