Install with Helm

Use the Helm chart to deploy Ferry alongside an OpenStack control plane on Kubernetes. Chart values specify database access, Keystone admin credentials, Ceph configuration and libvirt paths. Start with the preset for your distribution:

Preset	Distribution	Database	Tested
openstack-helm.yaml	OpenStack-Helm	the platform's MariaDB	OpenStack-Helm 2025.1
rhoso.yaml	Red Hat OpenStack Services on OpenShift	its own MariaDB 11.4, because the platform's Galera is 10.5	RHOSO 18.0
atmosphere.yaml	Atmosphere	Percona XtraDB 8.0	not yet
genestack.yaml	Genestack	mariadb-operator	not yet
starlingx.yaml	StarlingX	the platform's MariaDB	not yet
mosk.yaml	Mirantis MOSK	the platform's MariaDB	not yet
yaook.yaml	Yaook	its own MariaDB	not yet

Untested presets are based on the distribution's source configuration. Verify their resource names and settings against your deployment before installing.

Before you install

• Install into the namespace OpenStack runs in (openstack on OpenStack-Helm). The chart reads the platform's own Secrets and ConfigMaps: the database admin password, the Keystone admin credentials and ceph.conf. Kubernetes does not share those across namespaces.
• cert-manager must be installed. The chart creates a private certificate authority for the mTLS between movers, managers and compute agents. It is separate from the platform's CA, so no other component's certificate can act as one of the service's. Set pki.certManager.issuerRef to use an issuer of your own, or pki.provider: existing to supply every certificate yourself.
• The database must be MariaDB 10.6+ or MySQL 8.0.16+. Enable database.embedded to run a MariaDB for the service alone where the platform's is older.

Install

helm upgrade --install ferry deploy/helm/ferry -n openstack \
  -f deploy/helm/ferry/presets/openstack-helm.yaml \
  --set cloud.name=<cloud-name>

cloud.name is required and is recorded in every backup. With the release named ferry, the chart deploys:

Workload	Kind	Role
ferry-manager	Deployment, 2 replicas	API, console, scheduling. Owns the database and the Keystone credential.
ferry-mover	StatefulSet, 2 replicas	Reads disks, writes the repository.
ferry-compute	DaemonSet on every hypervisor	Freezes guests. Optionally reads local disks.
ferry-mariadb	StatefulSet	Only with database.embedded.enabled.

On each rollout, the manager's init container creates any missing database, database account and Keystone service user. It assigns the service user admin and reader roles in the service project and creates the manager's application credential. The admin credentials reach only that init container. The manager then registers itself in the catalog under the service type backup and keeps that entry in place.

With ceph.keyrings.bootstrap.enabled, a Job creates the three cephx users from the Ceph admin key. They are the manager's, the movers' read-only one and the restore one. Without it, put the three keyrings in a Secret yourself (keys ceph.client.<user>.keyring) and name it in ceph.keyrings.existingSecret.

The rhoso.yaml preset creates the Keystone service user through a KeystoneService resource. All three Ceph identities use the cloud's existing openstack user, so movers inherit its write permissions on production pools.

Configure deployment values

Value	Default	Meaning
cloud.name	required	This deployment's name.
cloud.site	cloud.name	The site movers take work from. Repositories are registered against it.
kms.driver	none	none, barbican or vault. See Encryption.
ceph.enabled	true	Read Ceph RBD directly.
ceph.pools.volumes / vms / images	volumes, vms, images	Cinder's, Nova's and Glance's pools.
compute.localDiskBackup	false	Back up and restore Nova's local disks through the compute agent. OpenStack-Helm's default instance disks are local qcow2 files.
api.ingress.* / api.route.*	off	Expose the API and the console. The catalog's public URL follows.
manager.extraConfig	{}	Merged over the manager's configuration, for anything without a value of its own.
credentials.existingSecret	empty	A Secret holding the generated passwords, for renderers that cannot read the cluster (Argo CD, Flux).

The API listens on plain HTTP inside the cluster. Terminate TLS at the ingress or route.

Deploy compute agents on EDPM nodes

On Red Hat OpenStack Services on OpenShift the hypervisors are EDPM nodes. The rhoso.yaml preset sets compute.daemonset: false and compute.edpm.enabled: true. The chart then renders an OpenStackDataPlaneService. It runs the compute agent under podman and systemd on the nodes of compute.edpm.nodeSets, opens its port in EDPM's firewall, and labels its files for SELinux.

Send the metrics to Prometheus

With the Prometheus Operator in the cluster, three values connect the service to it. All three are off by default:

helm upgrade --install ferry deploy/helm/ferry -n openstack --reuse-values \
  --set metrics.enabled=true \
  --set metrics.serviceMonitor.enabled=true \
  --set metrics.prometheusRule.enabled=true

metrics.enabled opens each manager's admin port on its pod's address, and each compute agent's on its node's address. It also adds a headless <release>-manager-admin Service. The movers' admin port is already on their Service. Keep these ports inside the cluster, with a NetworkPolicy where the namespace is shared. They carry every project's figures. metrics.serviceMonitor.enabled adds monitors for the managers, the movers and the compute agents. metrics.prometheusRule.enabled adds the alert rules. kube-prometheus-stack picks up only monitors and rules that carry its release label. Set it in metrics.serviceMonitor.labels and metrics.prometheusRule.labels.

Compute agents on EDPM nodes keep their admin port on loopback, and are not scraped.

Deployment limitations

File-level browsing, movers in the storage fabric, and protection of object storage buckets are available on kolla-ansible deployments and not yet in the chart.

Upgrade

helm upgrade with the new chart version rolls every workload together. Each mover and each compute agent waits until every manager runs its release or a newer one before starting. This keeps the order the service needs. compute.awaitManagers: false lets the agents start without waiting. See Upgrades.