Contents Menu Expand Light mode Dark mode Auto light/dark mode
Documentation Portal
  • 25.2
  • 25.1 and earlier
Logo
Mirantis OpenStack for Kubernetes
  • Product Overview
  • Reference Architecture
    • Major components and principles
    • Cluster types
    • Requirements
      • MOSK cluster hardware requirements
      • Management cluster storage
      • System requirements for the seed node
      • Components collocation
      • Infrastructure requirements
      • Network requirements
    • Management cluster
      • Bare-metal provider
      • Release Controller
      • Management console
      • Identity and access management
        • External identity provider integration
        • Authentication and authorization
          • Implementation flow
          • Kubernetes CLI authentication flow
        • Expose Keycloak on an additional MetalLB address pool
    • Cloud services
      • Compute service
        • Resource oversubscription
        • Virtual CPU
        • Instance migration
        • Image storage backend
        • Remote console access to virtual machines
        • GPU virtualization
        • Graceful instance shutdown
      • Networking service
        • Backends
        • General configuration
        • BGP dynamic routing
        • Virtual Private Network
        • DVR incompatibility with ARP announcements and VRRP
        • Single Root I/O Virtualization
      • Block Storage service
        • Backup configuration
        • Volume encryption
        • Volume configuration
      • Identity service
        • Federation
        • Regions
        • Application credentials
        • Domain-specific configuration
      • Image service
      • Object Storage service
      • Dashboard
      • Bare Metal service
      • DNS service
      • Key Manager service
      • Instance High Availability service
        • Instance HA overview
        • Enabling the Instance HA service
        • Enabling introspective instance monitor
      • Shared Filesystems service
      • Dynamic Resource Balancer service
    • OpenStack
      • OpenStack cluster
      • OpenStack lifecycle management
        • OpenStack Controller (Rockoon)
        • OpenStackDeployment Admission Controller
        • OpenStack Exporter
      • OpenStack configuration
        • OpenStackDeployment custom resource
        • OpenStackDeployment spec:services
        • OpenStackDeploymentStatus custom resource
        • OpenStack Controller configuration
        • Custom OpenStack images
      • OpenStack database
        • Overview of the OpenStack database backup and restoration
        • Workflows of the OpenStack database backup and restoration
        • OpenStack database auto-cleanup
        • Periodic OpenStack database backups
        • Remote storage for OpenStack database backups
        • Synchronization of local MariaDB backups with a remote S3 storage
      • OpenStack message bus
    • OpenSDN
      • OpenSDN cluster
        • OpenSDN cluster components
        • OpenSDN traffic flow
      • OpenSDN lifecycle management
        • OpenSDN Operator
        • TFOperator custom resource
      • OpenSDN configuration
        • Cassandra configuration
        • Custom vRouter settings
        • Control plane traffic interface
        • Traffic encapsulation
        • Autonomous System Number (ASN)
        • Access to external DNS
        • Gateway for vRouter data plane network
        • OpenSDN image precaching
        • Graceful restart and long-lived graceful restart
        • Configuring the protocol for connecting to Cassandra clusters
        • SR-IOV Spoof Check control for OpenSDN
        • Availability zones
      • OpenSDN database
        • Periodic OpenSDN database backups
        • Remote storage for OpenSDN database backups
      • OpenSDN services
        • OpenSDN load balancing (HAProxy)
        • Octavia Amphora load balancing
      • OpenSDN known limitations
      • OpenSDN integration with OpenStack
      • OpenSDN IPv6 support
    • Networking
      • Networking overview
      • Management cluster networking
      • MOSK cluster networking
      • IP Address Management
      • Multi-rack architecture
      • Physical networks layout
      • Underlay networking: routing configuration
      • Performance optimization
      • Built-in load balancing
      • Proxy support and cache of artifacts
      • Infrastructure connectivity monitoring
    • Bare metal
      • Bare-metal components
      • Extended hardware configuration
    • Kubernetes underlay
      • LCM custom resources
      • LCM Controller
      • LCM Agent
      • Helm Controller
      • MKE API limitations
      • MKE configuration management
      • MKE backup
    • Storage
      • Pelagia overview
      • Pelagia limitations
      • Pelagia integration with Rockoon
      • Addressing Ceph storage devices
    • Logging, monitoring, and alerting
      • Deployment architecture
      • Supported features
      • Authentication flow
      • Monitored components
      • Storage-based log retention strategy
      • OpenSearch and Prometheus storage sizing
      • StackLight integration with OpenStack
      • Workload monitoring
      • Outbound telemetry
      • StackLight logging indices
      • StackLight proxy
    • Blueprints
      • Remote compute nodes
        • Introduction to edge computing
        • Overview of the remote compute nodes approach
        • Design considerations for a remote site
        • Remote compute nodes with Tungsten Fabric
      • Large clusters
      • Cephless cloud
      • Air-gapped clusters
        • Directory and URL structure
        • Limitations on Logging, Monitoring, and Alerting
        • Requirements for air-gapped clusters
        • Configure and deploy an air-gapped cluster
          • Prepare an offline copy for an air-gapped cluster
          • Create a local mirror
          • Deploy an air-gapped management cluster
          • Monitor the airgapped tool status in JSON format
        • Update a cluster in an air-gapped environment
      • Integration with Enterprise Identity Directory (LDAP/AD)
        • Architecture overview
        • Configuration
        • Workflows
    • Node maintenance API
      • Node maintenance API objects
      • OpenStack Controller maintenance API
      • OpenSDN Kubernetes Controller maintenance API
      • Cluster update flow
      • Parallelizing node update operations
  • Deployment Guide
    • Plan the deployment
    • Provision and deploy a management cluster
      • Deploy a management cluster
        • Introduction
        • Overview of the deployment workflow
        • Controlled bare-metal provisioning workflows
        • Set up a bootstrap cluster
        • Deploy a management cluster
        • Configure bare-metal settings
          • Configure BIOS on a bare-metal host
          • Customize the default bare-metal host profile
          • Configure NIC bonding
          • Separate PXE and management (LCM) networks
          • Configure multiple DHCP address ranges
          • Enable dynamic IP allocation
          • Set a custom external IP address for the DHCP service
        • Configure optional settings
        • Post-deployment steps
      • Create initial users after a management cluster bootstrap
      • Requirements for a MITM proxy
      • Configure external identity provider for IAM
        • Configure LDAP for IAM
        • Configure Google OAuth IdP for IAM
    • Create a MOSK cluster
      • Create a project for MOSK clusters
      • Add a bare-metal host
        • Add a bare-metal host using MOSK management console
        • Add a bare-metal host using CLI
      • Create a custom bare-metal host profile
        • Default configuration of the host system storage
        • Wipe a device or partition
        • Create MOSK host profiles
        • Configure Ceph disks in a host profile
        • Enable huge pages in a host profile
        • Configure RAID support
          • Create an LVM software RAID (raid1)
          • Create LVM volume groups on top of RAID devices
          • Create an mdadm software RAID (raid0, raid1, raid10)
          • Create an mdadm software RAID level 10 (raid10)
      • Create a MOSK cluster
        • Create a MOSK cluster
        • Configure MetalLB
          • Configure and verify MetalLB
          • Configure node selectors for MetalLB speakers
        • Configure BGP announcement for cluster API LB address
        • Obtain and use details about network interfaces
        • Create subnets
          • Service labels and their life cycle
          • Create subnets for a cluster using MOSK management console
          • Create subnets for a cluster using CLI
        • Create L2 templates
          • Create an L2 template for a new cluster
          • Create L2 templates for a multi-rack MOSK cluster
          • Create an L2 template for a Kubernetes manager node
          • Create an L2 template for a MOSK controller node
          • Create an L2 template for a MOSK compute node
          • Create an L2 template for a MOSK storage node
          • L2 template example with bonds and bridges
        • Example of a complete template configuration for cluster creation
      • Add a machine
        • Create a machine using CLI
        • Create a machine using MOSK management console
        • Assign L2 templates to machines
        • Deploy a machine to a specific bare-metal host
        • Override network interfaces naming and order
        • Manually allocate IP addresses for bare-metal hosts
      • Add a Ceph cluster using CephDeployment
    • Deploy OpenStack
      • Deploy an OpenStack cluster
      • Advanced OpenStack configuration (optional)
        • Enable LVM ephemeral storage
        • Enable LVM block storage
        • Enable SR-IOV with OVS/OVN
        • Encrypt the east-west traffic
        • Enable Cinder backend for Glance
        • Enable Cinder volume encryption
        • Advanced configuration for OpenStack compute nodes
          • Configuration recommendations for compute node types
          • Configure the CPU model
          • Enable huge pages for OpenStack
          • Configure CPU isolation for a compute node
          • Configure custom CPU topologies
          • Configure PCI passthrough for guests
          • Configure initial resource oversubscription
          • Limit HW resources for hyperconverged OpenStack compute nodes
          • Configure GPU virtualization
        • Enable image signature verification
        • Configure LoadBalancer for PowerDNS
      • Access OpenStack after deployment
        • Configure DNS to access OpenStack
        • Access your OpenStack environment
      • Troubleshoot an OpenStack deployment
        • Debugging the Helm releases
        • Debugging the OpenStack Controller
        • Debugging the OsDpl CR
        • Support dump
    • Deploy OpenSDN
      • OpenSDN deployment prerequisites
      • Deploy OpenSDN
      • Advanced OpenSDN configuration
        • Enable huge pages for OpenStack with Tungsten Fabric
        • Enable SR-IOV for OpenSDN
        • Configure multiple Contrail API workers
      • Troubleshoot the OpenSDN deployment
        • Enable debug logs for the Tungsten Fabric services
        • Troubleshoot access to the OpenSDN web UI
        • Disable TX offloading on NICs used by vRouter
  • Operations Guide
    • Cluster update
      • Update to a major version
      • Update to a patch version
      • Verify the management cluster status before MOSK update
      • Change the upgrade order of a machine
      • Configure the parallel update of worker nodes
      • Create update groups for worker machines
      • Granularly update MOSK using the ClusterUpdatePlan object
      • Configure update auto-pause
    • Configure backups of Mirantis Kubernetes Engine
      • Create backups of Mirantis Kubernetes Engine
      • Restore Mirantis Kubernetes Engine from a backup
    • Getting access
      • Generate a kubeconfig for a MOSK cluster using API
      • Connect to a MOSK cluster
      • Access the Keycloak Admin Console
      • Access the OpenSDN web UI
    • OpenStack operations
      • Migrate networking from Open vSwitch to Open Virtual Network
        • Migration limitations and impact
        • Prepare environment for migration
        • Perform pre-migration verification
        • Adjust security groups to allow access to DHCP and Metadata
        • Adjust MTU for VXLAN tenant networks
        • Adjust DNS servers for subnets
        • Perform migration
        • Verification and cleanup
      • Upgrade OpenStack
      • Backup and restore OpenStack databases
        • Enable OpenStack database remote backups
        • Restore OpenStack databases from a backup
        • Verify the periodic backup jobs for the OpenStack database
      • Add a controller node
      • Replace a failed controller node
      • Add a compute node
      • Change oversubscription settings for existing compute nodes
      • Delete a compute node
      • Run Tempest tests
      • Remove an OpenStack cluster
      • Remove an OpenStack service
      • Enable uploading of an image through Horizon with untrusted SSL certificates
      • Rotate OpenStack credentials
      • Customize OpenStack container images
      • Troubleshoot orphaned resource allocations
      • Start monitoring IP address capacity
      • Rotate Octavia Amphora (LBaaS) certificates
      • Enroll a bare-metal node with Redfish Virtual Media
    • OpenStack services configuration
      • Configure high availability with Masakari
      • Verify the Instance HA service
      • Configure monitoring of cloud workload availability
    • Ceph operations
      • Comparison of KaaSCephCluster, MiraCeph, and CephDeployment specifications
      • CephDeployment operations
        • Ceph resources management
          • Enable management of Ceph tolerations and resources
          • Verify Ceph tolerations and resources
        • Ceph user credentials
          • Manage Ceph RBD or CephFS clients
          • Manage Ceph Object Storage users
        • Configure Ceph Shared File System (CephFS)
        • Ceph default configuration
        • Share Ceph across two clusters
        • Migrate Ceph pools from one failure domain to another
        • Move a Ceph Monitor daemon to another node
        • Move Ceph Monitor before node replacement
        • Enable Ceph multinetwork
        • Ceph Object Storage
          • Enable Ceph RADOS Gateway Object Storage
          • Enable Multisite for Ceph Object Storage
          • Configure Ceph Object Storage server-side encryption
          • Configure Ceph Object Gateway TLS
          • RADOS Gateway bucket policy
            • Create Ceph Object Storage users
            • Set a bucket policy for a Ceph Object Storage user
            • Set a bucket policy for OpenStack users
        • Enable Ceph RBD mirroring
        • Specify Rook daemons placement
      • Ceph cluster lifecycle management
        • Automated lifecycle management
          • Create a Ceph OSD remove task
          • Add, remove, or reconfigure Ceph nodes
          • Add, remove, or reconfigure Ceph OSDs
          • Add, remove, or reconfigure Ceph OSDs with metadata devices
          • Replace a failed Ceph node
          • Replace a failed Ceph OSD
          • Replace a failed metadata device
          • Replace a failed Ceph OSD disk with a metadata device as a device name
          • Replace a failed Ceph OSD with a metadata device as a logical volume path
        • Increase Ceph cluster storage size
        • Remove Ceph OSD manually
      • Rockoon integration
        • Integrate Pelagia with Rockoon
        • Configure Ceph pools for Cinder multiple backends
        • Calculate target ratios for Ceph pools for Rockoon
      • Verify Ceph
        • Verify the Ceph core services
        • Verify Ceph cluster state
        • Verify Pelagia Controllers and Rook Ceph Operator
        • Verify rook-discover
    • StackLight operations
      • Configure StackLight
        • StackLight configuration procedure
        • StackLight configuration parameters
        • Verify StackLight after configuration
      • Tune OpenSearch performance
      • Export logs from OpenSearch Dashboards to CSV
      • OpenSearch Dashboards
        • View OpenSearch Dashboards
        • Search in OpenSearch Dashboards
      • View Grafana dashboards
      • Create custom dashboards in Grafana
      • Export data from Table panels of Grafana dashboards to CSV
      • StackLight alerts
        • OpenStack
          • OpenStack system services
            • Libvirt
            • MariaDB
            • Memcached
            • SSL certificates
            • RabbitMQ
          • OpenStack core services
            • OpenStack services API
            • Cinder
            • Horizon
            • Ironic
            • Neutron
            • Nova
            • Cloudprober
            • Portprober
            • PowerDNS
            • Credential rotation
          • OpenStack Controller (Rockoon)
        • OpenSDN
          • Cassandra
          • Redis
          • Tungsten Fabric Operator
          • OpenSDN
          • ZooKeeper
        • StackLight
          • Alertmanager
          • cAdvisor
          • Elasticsearch Exporter
          • Fluentd
          • General
          • Grafana
          • Monitoring of external endpoints
          • OpenSearch
          • PostgreSQL and Patroni
          • Prometheus
          • Prometheus MS Teams
          • Prometheus Relay
          • ServiceNow
          • Salesforce notifier
          • Telegraf
          • Telemeter
        • Ceph
        • Bare metal
          • Bond interface
          • Ironic
          • Kernel
          • Host Operating System Modules Controller
          • IPMI
        • Generic
          • Calico
          • Etcd
        • Kubernetes
          • Kubernetes applications
          • Kubernetes resources
          • Kubernetes storage
          • Kubernetes system
        • Keycloak
        • MOSK management
          • Helm Controller
          • MOSK management
          • MOSK management cache
          • MOSK management controllers
          • MOSK management providers
          • MOSK and MOSK management SSL
          • Release Controller
        • Mirantis Kubernetes Engine
        • Node
          • General
          • Node network
          • Node time
          • mdadm RAID
          • NUMA
        • Cross-node connectivity
      • Alert dependencies
      • Silence alerts
      • StackLight rules for Kubernetes network policies
      • Tune StackLight for long-term log retention
      • Enable log forwarding to external destinations
      • Enable remote logging to syslog
      • Create log-based metrics
      • Enable generic metric scraping
      • Manage metrics filtering
      • Use S.M.A.R.T. metrics for creating alert rules
      • Deschedule StackLight Pods from a worker machine
      • Tune Prometheus IPMI exporter
    • OpenSDN operations
      • Update OpenSDN
      • Back up OpenSDN data
      • Restore OpenSDN data
      • Track OpenSDN node maintenance progress
      • Replace a failed OpenSDN controller node
      • Delete a vRouter node
      • Verify the OpenSDN deployment
      • Configure load balancing
      • Enable OpenSDN Cassandra repairs
      • Enable contrail-tools
      • Enable tf-api-cli
    • Bare-metal operations
      • Upgrade an operating system distribution
      • Automatic upgrade of a host operating system
      • Remove old Ubuntu kernel packages
      • Host operating system configuration
        • Host OS configuration management workflow
        • Global recommendations for implementation of custom modules
        • Format and structure of a module package
        • Modules provided by MOSK
        • HostOSConfiguration and HostOSConfigurationModules concepts
        • Internal API for host OS configuration management
        • Add a custom module to a MOSK deployment
        • Test a custom or MOSK module after creation
        • Retrigger a module configuration
        • Troubleshooting
      • Migrate auditd settings from the Cluster object to the auditd module
      • Change a user name and password for a bare-metal host
      • Restart the inspection of a bare-metal host
      • Restart a bare-metal host
      • Replace a failed manager node
      • Modify network configuration on an existing machine
      • Add more racks to an existing MOSK cluster
      • Expand IP addresses capacity in an existing cluster
      • Enable network infrastructure monitoring
      • Run cluster self-diagnostics
        • Trigger self-diagnostics for a cluster
        • Self-upgrades of the Diagnostic Controller
        • Diagnostic checks for the bare-metal provider
    • IAM operations
      • Manage user roles through the MOSK management API
        • Available IAM roles and use cases
        • Mapping of Keycloak roles to IAM*RoleBinding objects
      • Manage user roles through the MOSK management console
      • Manage user roles through Keycloak
        • MOSK roles and scopes
        • Use cases
      • Change the password for Keycloak master user
      • Change passwords for IAM users
      • Obtain MariaDB credentials for IAM
      • Manage Keycloak truststore using the MOSK management console
    • Management cluster operations
      • MOSK management CLI
      • Workflow and configuration of management cluster upgrade
      • Schedule MOSK management updates
      • Renew the MOSK and MKE licenses
      • Configure NTP server
      • Automatically propagate Salesforce configuration to all clusters
      • Update the Keycloak IP address on bare-metal clusters
      • Configure host names for cluster machines
      • Back up MariaDB on a management cluster
        • Configure periodic backups of MariaDB
        • Verify operability of the MariaDB backup jobs
        • Restore MariaDB databases
        • Change the storage node for MariaDB
      • Remove a management cluster
      • Warm up the MOSK management cache
    • General operations
      • Change a cluster configuration
      • Enable cluster and machine maintenance mode
        • Enable maintenance mode on a cluster and machine using management console
        • Enable maintenance mode on a cluster and machine using CLI
      • Disable a machine
      • Perform a graceful reboot of a cluster
      • Delete a cluster machine
        • Precautions for a cluster machine deletion
        • Delete a cluster machine using the management console
        • Delete a cluster machine using CLI
      • Delete a MOSK cluster
      • Verify cluster status
      • Verify machine status
    • Underlay Kubernetes operations
      • Set the MTU size for Calico
      • Add or update a CA certificate for a MITM proxy using API
      • Configure TLS certificates for cluster applications
      • Define a custom CA certificate for a private Docker registry
      • Increase memory limits for cluster components
      • Increase storage quota for etcd
      • Configure Kubernetes auditing and profiling
    • Limitations
  • Troubleshooting Guide
    • Collect cluster logs
    • Inspect the history of a cluster and machine deployment or update
    • Cluster deletion freezes
    • Keycloak admin console becomes inaccessible after changing the theme
    • Unresponsive OpenSDN API due to excessive Cassandra tombstone records
    • The ‘database space exceeded’ error on large clusters
    • The auditd events cause ‘backlog limit exceeded’ messages
    • Troubleshoot a management cluster bootstrap
      • Troubleshoot the bootstrap node configuration
        • DNS settings
        • Default network addresses
      • Troubleshoot the bootstrap region creation
      • Troubleshoot machine creation
      • Troubleshoot deployment stages
      • Collect the bootstrap logs
    • Troubleshoot bare metal
      • Log in to the IPA virtual console for hardware troubleshooting
      • Inspection error on bare-metal hosts after dnsmasq restart
      • Troubleshoot an operating system upgrade with host restart
      • Troubleshoot iPXE boot issues
      • Provisioning failure due to device naming issues in a bare-metal host profile
    • Troubleshoot Ceph
      • Ceph disaster recovery
      • The ceph-exporter pods are present in the Ceph crash list
      • Ceph Monitors recovery
      • Ceph Monitors store.db size rapidly growing
      • Replaced Ceph OSD fails to start on authorization
      • Ceph health reports PG_DAMAGED after a failed disk or node replacement
      • CephOsdRemoveTask failure with a timeout during rebalance
      • Maintenance stuck on a compact Ceph cluster
    • Troubleshoot StackLight
      • Patroni replication lag
      • Alertmanager does not send resolve notifications for custom alerts
      • Troubleshoot alerts
        • Troubleshoot cAdvisor alerts
        • Troubleshoot Helm Controller alerts
        • Troubleshoot Host Operating System Modules Controller alerts
        • Troubleshoot Ubuntu kernel alerts
        • Troubleshoot Kubernetes applications alerts
        • Troubleshoot Kubernetes resources alerts
        • Troubleshoot Kubernetes storage alerts
        • Troubleshoot Kubernetes system alerts
        • Troubleshoot MOSK management Exporter alerts
        • Troubleshoot Mirantis Kubernetes Engine alerts
        • Troubleshoot OpenSearch alerts
        • Troubleshoot Release Controller alerts
        • Troubleshoot Ceph alerts
        • Troubleshoot Telemeter client alerts
      • OpenSearchPVCMismatch alert raises due to the OpenSearch PVC size mismatch
      • OpenSearch cluster deadlock due to the corrupted index
      • Failure of shard relocation in the OpenSearch cluster
      • StackLight pods get stuck with the ‘NodeAffinity failed’ error
      • No logs are forwarded to Splunk
      • Troubleshoot high OpenSearch indexing pressure
  • API Reference
    • Management resources
      • General resources
        • PublicKey resource
        • License resource
        • TLSConfig resource
        • ContainerRegistry resource
        • MCCUpgrade resource
        • CacheWarmupRequest resource
      • IAM resources
        • IAMUser resource
        • IAMRole resource
        • IAMGlobalRoleBinding resource
        • IAMRoleBinding resource
        • IAMClusterRoleBinding resource
      • Cluster resources
        • BareMetalHost resource
        • BareMetalHostCredential resource
        • BareMetalHostInventory resource
        • BareMetalHostProfile resource
        • Cluster resource
        • Machine resource
      • Cluster lifecycle resources
        • Diagnostic resource
        • GracefulRebootRequest resource
        • ClusterUpdatePlan resource
        • UpdateGroup resource
        • UpdateAutoPause resource
        • Cluster backup resources
          • ClusterBackup resource
          • ClusterBackupSchedule resource
          • KeyEncryptionKey resource
          • RCloneCredential resource
      • Networking resources
        • IPaddr
        • IpamHost
        • L2Template
        • MetalLBConfig
        • MultiRackCluster
        • Rack
        • Subnet
      • Network infrastructure monitoring resources
        • InfraConnectivityMonitor
        • CheckerInventoryConfig
        • NetCheckerTargetsConfig
      • Host OS configuration resources
        • HostOSConfiguration
        • HostOSConfigurationModules
    • OpenStack Operator resources
    • OpenSDN Operator (TFOperator) resources
    • Ceph resources
      • CephDeployment custom resource
      • CephDeploymentHealth custom resource
      • CephDeploymentSecret custom resource
      • CephOsdRemoveTask custom resource
    • StackLight resources
  • User Guide
    • Use the Instance HA service
    • Configure the introspective instance monitor
    • Manage application credentials
    • Authenticate in OpenStack API as a federated OIDC user
    • Use the Shared Filesystems service
      • Set up Shared Filesystems service with generic driver
      • Set up Shared Filesystems service with CephFS driver
    • Deploy your first cloud application using automation
    • Deploy your first cloud application using cloud web UI
    • Use Heat to create and manage OpenSDN objects
    • Use S3 API for MOSK Object Storage
    • Run Windows guests
    • Use the Dynamic Resource Balancer service
    • Migrate instances
    • Configure network trunking in projects
    • Configure per-instance migration mode
    • Access the bare-metal node console
    • Configure VPN for cloud applications
  • Security Guide
    • CADF audit notifications in OpenStack services
    • Rotation of credentials in OpenStack
    • Firewall configuration
      • MOSK management
      • Mirantis Kubernetes Engine
      • StackLight
      • Ceph
      • MOSK
      • OpenStack
      • Tungsten Fabric
    • Cluster auditing
      • Host operating system
    • OpenStack API access policies
    • Data protection
      • Data encryption capabilities
      • Encryption of live migration data
      • Encryption of cloud control plane communications
    • Compliance
      • Federal Information Processing Standards (FIPS)
      • Center for Internet Security (CIS) benchmarks for host OS
    • Container images signing and validation
    • LBaaS certificate
    • Software Bill of Materials
      • Concepts and objectives
      • Compatible tools and ecosystem
      • Format of SBOM
  • FAQ

Release and Lifecycle Information

  • Release Notes
    • 26.1
      • New features
      • Known issues
      • Release artifacts
        • MOSK cluster artifacts
        • Management cluster artifacts
      • Addressed issues
      • Update notes
      • Security notes
  • Compatibility Matrix
    • MOSK cluster components compatibility
    • Management cluster components compatibility
    • Cluster versions compatibility
    • MOSK cluster update schema
  • Deprecation Notes
    • OpenStack
    • OpenSDN (Tungsten Fabric)
    • Bare metal
    • MOSK management
    • Ceph
    • StackLight
  • Release cadence and support cycle

Configure external identity provider for IAM

This section describes how to configure authentication for management cluster depending on the external identity provider type integrated to your deployment.

  • Configure LDAP for IAM
  • Configure Google OAuth IdP for IAM
Next
Configure LDAP for IAM
Previous
Requirements for a MITM proxy

Mirantis Inc. 900 E Hamilton Avenue, Suite 650, Campbell, CA 95008 +1-650-963-9828

© 2005 - 2026 Mirantis, Inc. All rights reserved. "Mirantis" and "FUEL" are registered trademarks of Mirantis, Inc. All other trademarks are the property of their respective owners.