openstack/charm-neutron-openvswitch
Code Issues Proposed changes
c0f53c5e26
charm-neutron-openvswitch/config.yaml
Edward Hope-Morley 9b094b8ef8 Fixup commit 00ca87f 
Add net.netfilter.nf_conntrack_buckets as per [1].

[1] https://bugs.launchpad.net/charm-neutron-gateway/+bug/1780348/comments/8

Change-Id: I6c143230943668c31378349d2f4f92de537ced64
Related-Bug: #1780348
2019-03-18 09:22:39 +00:00

313 lines
13 KiB
YAML
Raw Blame History

options:
debug:
type: boolean
default: False
description: Enable debug logging.
verbose:
type: boolean
default: False
description: Enable verbose logging.
use-syslog:
type: boolean
default: False
description: |
Setting this to True will allow supporting services to log to syslog.
rabbit-user:
type: string
default: neutron
description: Username used to access RabbitMQ queue
rabbit-vhost:
type: string
default: openstack
description: RabbitMQ vhost
data-port:
type: string
default:
description: |
Space-delimited list of bridge:port mappings. Ports will be added to
their corresponding bridge. The bridges will allow usage of flat or
VLAN network types with Neutron and should match this defined in
bridge-mappings.
.
Ports provided can be the name or MAC address of the interface to be
added to the bridge. If MAC addresses are used, you may provide multiple
bridge:mac for the same bridge so as to be able to configure multiple
units. In this case the charm will run through the provided MAC addresses
for each bridge until it finds one it can resolve to an interface name.
Port can also be a linuxbridge bridge. In this case a veth pair will be
created, the ovs bridge and the linuxbridge bridge will be connected. It
can be useful to connect the ovs bridge to juju bridge.
dpdk-bond-mappings:
type: string
default:
description: |
Space-delimited list of bond:port mappings. The DPDK assigned ports will
be added to their corresponding bond, which in turn will be put into the
bridge as specified in data-port.
.
This option is supported only when enable-dpdk is true.
dpdk-bond-config:
type: string
default: ":balance-tcp:active:fast"
description: |
Space delimited list of bond:mode:lacp:lacp-time, where the arguments meaning is:
.
* bond - the bond name. If not specified the configuration applies to all bonds
* mode - the bond mode of operation. Possible values are:
- active-backup - No load balancing is offered in this mode and only one of
the member ports is active/used at a time.
- balance-slb - Considered as a static load-balancing mode. Traffic is load
balanced between member ports based on the source MAC and VLAN.
- balance-tcp - This is the preferred bonding mode. It offers traffic load
balancing based on 5-tuple header fields. LACP must be enabled
at both endpoints to use this mode. The aggregate link will
fall back to default mode (active-passive) in the event of LACP
negotiation failure.
* lacp - active, passive or off
* lacp-time - fast or slow. LACP negotiation time interval - 30 ms or 1 second
disable-security-groups:
type: boolean
default: false
description: |
Disable neutron based security groups - setting this configuration option
will override any settings configured via the neutron-api charm.
.
BE CAREFUL - this option allows you to disable all port level security
within an OpenStack cloud.
bridge-mappings:
type: string
default: 'physnet1:br-data'
description: |
Space-delimited list of ML2 data bridge mappings with format
<provider>:<bridge>.
flat-network-providers:
type: string
default:
description: |
Space-delimited list of Neutron flat network providers.
vlan-ranges:
type: string
default: "physnet1:1000:2000"
description: |
Space-delimited list of <physical_network>:<vlan_min>:<vlan_max> or
<physical_network> specifying physical_network names usable for VLAN
provider and tenant networks, as well as ranges of VLAN tags on each
available for allocation to tenant networks.
firewall-driver:
type: string
default:
description: |
Firewall driver to use to support use of security groups with
instances; valid values include iptables_hybrid (default) and
openvswitch (>= Mitaka on Ubuntu 16.04 or later).
ext-port:
type: string
default:
description: |
Deprecated: Use bridge-mappings and data-port to create a network
which can be used for external connectivity. You can call the network
external and the bridge br-ex by convention, but neither is required
A space-separated list of external ports to use for routing of instance
traffic to the external public network. Valid values are either MAC
addresses (in which case only MAC addresses for interfaces without an IP
address already assigned will be used), or interfaces (eth0)
enable-local-dhcp-and-metadata:
type: boolean
default: false
description: |
Enable local Neutron DHCP and Metadata Agents. This is useful for
deployments which do not include a neutron-gateway (do not require l3,
lbaas or vpnaas services) and should only be used in-conjunction with
flat or VLAN provider networks configurations.
dnsmasq-flags:
type: string
default:
description: |
Comma-separated list of key=value config flags with the additional dhcp
options for neutron dnsmasq. Note, this option is only valid when
enable-local-dhcp-and-metadata option is set to True.
instance-mtu:
type: int
default:
description: |
Configure DHCP services to provide MTU configuration to instances
within the cloud. This is useful in deployments where its not
possible to increase MTU on switches and physical servers to
accommodate the packet overhead of using GRE tunnels.
dns-servers:
type: string
default:
description: |
A comma-separated list of DNS servers which will be used by dnsmasq as
forwarders. This option only applies when the enable-local-dhcp-and-metadata
options is set to True.
prevent-arp-spoofing:
type: boolean
default: true
description: |
Enable suppression of ARP responses that don't match an IP address that
belongs to the port from which they originate.
.
Only supported in OpenStack Liberty or newer, which has the required
minimum version of Open vSwitch.
.
NOTE: this feature is deprecated and removed in Openstack >= Ocata. As of
that point the only way to disable protection will be via the port
security extension (see LP 1691080 for info).
enable-dpdk:
type: boolean
default: false
description: |
Enable DPDK fast userspace networking; this requires use of DPDK
supported network interface drivers and must be used in conjunction with
the data-port configuration option to configure each bridge with an
appropriate DPDK enabled network device.
dpdk-socket-memory:
type: int
default: 1024
description: |
Amount of hugepage memory in MB to allocate per NUMA socket in deployed
systems.
.
Only used when DPDK is enabled.
dpdk-socket-cores:
type: int
default: 1
description: |
Number of cores to allocate to DPDK per NUMA socket in deployed systems.
.
Only used when DPDK is enabled.
dpdk-driver:
type: string
default:
description: |
Kernel userspace device driver to use for DPDK devices, valid values
include:
.
vfio-pci
uio_pci_generic
.
Only used when DPDK is enabled.
enable-sriov:
type: boolean
default: false
description: |
Enable SR-IOV NIC agent on deployed units; use with sriov-device-mappings
to map SR-IOV devices to underlying provider networks. Enabling this
option allows instances to be plugged into directly into SR-IOV VF
devices connected to underlying provider networks alongside the default
Open vSwitch networking options.
sriov-device-mappings:
type: string
default:
description: |
Space-delimited list of SR-IOV device mappings with format
.
<provider>:<interface>
.
Multiple mappings can be provided, delimited by spaces.
sriov-numvfs:
type: string
default: auto
description: |
Number of VF's to configure each PF with; by default, each SR-IOV PF will
be configured with the maximum number of VF's it can support. Either use
a single integer to apply the same VF configuration to all detected
SR-IOV devices or use a per-device configuration in the following format
.
<device>:<numvfs>
.
Multiple devices can be configured by providing multi values delimited by
spaces.
.
NOTE: Changing this value will disrupt networking on all SR-IOV capable
interfaces for blanket configuration or listed interfaces when per-device
configuration is used.
worker-multiplier:
type: float
default:
description: |
The CPU core multiplier to use when configuring worker processes for
this services e.g. metadata-agent. By default, the number of workers for
each daemon is set to twice the number of CPU cores a service unit has.
When deployed in a LXD container, this default value will be capped to 4
workers unless this configuration option is set.
# Network config (by default all access is over 'private-address')
os-data-network:
type: string
default: ""
description: |
The IP address and netmask of the OpenStack Data network (e.g.,
192.168.0.0/24)
.
This network will be used for tenant network traffic in overlay
networks.
.
In order to support service zones spanning multiple network
segments, a space-delimited list of a.b.c.d/x can be provided
The address of the first network found to have an address
configured will be used.
ipfix-target:
type: string
default:
description: |
IPFIX target wit the format "IP_Address:Port". This will enable IPFIX
exporting on all OVS bridges to the target, including br-int and br-ext.
security-group-log-output-base:
type: string
default:
description: |
This option allows setting a path for Network Security Group logs.
A valid file system path must be provided. If this option is not
provided Neutron will use syslog as a destination.
(Available from Queens)
security-group-log-rate-limit:
type: int
default:
description: |
Log entries are queued for writing to a log file when a packet rate
exceeds the limit set by this option.
Possible values: null (no rate limitation), integer values greater than 100.
WARNING: Should be NOT LESS than 100, if set
(or, if null, logging will log unlimited.)
security-group-log-burst-limit:
type: int
default: 25
description: |
This option sets the maximum queue size for log entries.
Can be used to avoid excessive memory consumption.
WARNING: Should be NOT LESS than 25.
use-dvr-snat:
type: boolean
default: False
description: |
This option controls a mode of the l3 agent when DVR is used. There are
2 modes 'dvr' (default) and dvr_snat (gateway mode). Neutron server
(deployed by neutron-api charm) will schedule a network:router_centralized_snat port
and a (centralized) snat namespace to dvr_snat mode agents only. If this option
is enabled, all neutron-openvswitch nodes become candidates for being centralized
snat nodes. If l3ha is enabled on neutron-api, relevant packages are also installed
on every unit making them capable of hosting parts of an L3HA router. The min and max
numbers of L3 agents per router need to be taken into account in this case
(see max_l3_agents_per_router and min_l3_agents_per_router Neutron options).
Practically, this option can be used to allow DVR routers (L3HA or not) to
be scheduled without a requirement for a dedicated network node to host
centralized SNAT. This is especially important if only floating IPs are
used in the network design and SNAT traffic is minimal or non-existent.
sysctl:
type: string
default: |
{ net.ipv4.neigh.default.gc_thresh1 : 128,
net.ipv4.neigh.default.gc_thresh2 : 28672,
net.ipv4.neigh.default.gc_thresh3 : 32768,
net.ipv6.neigh.default.gc_thresh1 : 128,
net.ipv6.neigh.default.gc_thresh2 : 28672,
net.ipv6.neigh.default.gc_thresh3 : 32768,
net.nf_conntrack_max : 1000000,
net.netfilter.nf_conntrack_buckets : 204800,
net.netfilter.nf_conntrack_max : 1000000 }
description: |
YAML-formatted associative array of sysctl key/value pairs to be set
persistently e.g. '{ kernel.pid_max : 4194303 }'.
View Git Blame Copy Permalink