82c5027814
When the VNC server is set to bind to 0.0.0.0, unauthenticated console access is possible to any VM via any of the compute host's interfaces. This access should be restricted to an internal network. Change-Id: Ibbc12ae282320f966eec90e9116388233e65eb9a Closes-Bug: #1843004
218 lines
5.9 KiB
Plaintext
218 lines
5.9 KiB
Plaintext
# liberty
|
|
###############################################################################
|
|
# [ WARNING ]
|
|
# Configuration file maintained by Juju. Local changes may be overwritten.
|
|
{% if restart_trigger -%}
|
|
# restart trigger: {{ restart_trigger }}
|
|
{% endif -%}
|
|
###############################################################################
|
|
[DEFAULT]
|
|
verbose={{ verbose }}
|
|
debug={{ debug }}
|
|
dhcpbridge_flagfile=/etc/nova/nova.conf
|
|
dhcpbridge=/usr/bin/nova-dhcpbridge
|
|
logdir=/var/log/nova
|
|
state_path=/var/lib/nova
|
|
force_dhcp_release=True
|
|
use_syslog = {{ use_syslog }}
|
|
ec2_private_dns_show_ip=True
|
|
api_paste_config=/etc/nova/api-paste.ini
|
|
enabled_apis=osapi_compute,metadata
|
|
auth_strategy=keystone
|
|
my_ip = {{ host_ip }}
|
|
|
|
{% if arch == 'aarch64' -%}
|
|
libvirt_use_virtio_for_bridges=False
|
|
libvirt_disk_prefix=vd
|
|
{% endif -%}
|
|
|
|
{% if console_vnc_type -%}
|
|
vnc_enabled = True
|
|
novnc_enabled = True
|
|
vnc_keymap = {{ console_keymap }}
|
|
vncserver_listen = {{ console_listen_addr }}
|
|
vncserver_proxyclient_address = {{ console_listen_addr }}
|
|
{% if console_access_protocol == 'novnc' or console_access_protocol == 'vnc' -%}
|
|
novncproxy_base_url = {{ novnc_proxy_address }}
|
|
{% endif -%}
|
|
{% if console_access_protocol == 'xvpvnc' or console_access_protocol == 'vnc' -%}
|
|
xvpvncproxy_port = {{ xvpvnc_proxy_port }}
|
|
xvpvncproxy_host = {{ xvpvnc_proxy_host }}
|
|
xvpvncproxy_base_url = {{ xvpvnc_proxy_address }}
|
|
{% endif -%}
|
|
{% else -%}
|
|
vnc_enabled = False
|
|
novnc_enabled = False
|
|
{% endif -%}
|
|
|
|
{% if neutron_plugin and neutron_plugin in ('ovs', 'midonet') -%}
|
|
libvirt_vif_driver = nova.virt.libvirt.vif.LibvirtGenericVIFDriver
|
|
{% if neutron_security_groups -%}
|
|
security_group_api = neutron
|
|
firewall_driver = nova.virt.firewall.NoopFirewallDriver
|
|
{% endif -%}
|
|
{% endif -%}
|
|
|
|
{% if neutron_plugin and neutron_plugin == 'vsp' -%}
|
|
network_api_class=nova.network.neutronv2.api.API
|
|
libvirt_vif_driver=nova.virt.libvirt.vif.LibvirtGenericVIFDriver
|
|
neutron_ovs_bridge=alubr0
|
|
security_group_api=neutron
|
|
firewall_driver = nova.virt.firewall.NoopFirewallDriver
|
|
{% endif -%}
|
|
|
|
{% if neutron_plugin and (neutron_plugin == 'nvp' or neutron_plugin == 'nsx') -%}
|
|
libvirt_vif_driver = nova.virt.libvirt.vif.LibvirtOpenVswitchVirtualPortDriver
|
|
security_group_api = neutron
|
|
firewall_driver = nova.virt.firewall.NoopFirewallDriver
|
|
{% endif -%}
|
|
|
|
{% if neutron_plugin and neutron_plugin == 'Calico' -%}
|
|
security_group_api = neutron
|
|
firewall_driver = nova.virt.firewall.NoopFirewallDriver
|
|
{% endif -%}
|
|
|
|
{% if neutron_plugin and neutron_plugin == 'plumgrid' -%}
|
|
security_group_api=neutron
|
|
firewall_driver = nova.virt.firewall.NoopFirewallDriver
|
|
{% endif -%}
|
|
|
|
{% if network_manager != 'neutron' and network_manager_config -%}
|
|
{% for key, value in network_manager_config.items() -%}
|
|
{{ key }} = {{ value }}
|
|
{% endfor -%}
|
|
{% endif -%}
|
|
|
|
{% if network_manager == 'neutron' -%}
|
|
network_api_class = nova.network.neutronv2.api.API
|
|
{% else -%}
|
|
network_manager = nova.network.manager.FlatDHCPManager
|
|
{% endif -%}
|
|
|
|
{% if network_device_mtu -%}
|
|
network_device_mtu = {{ network_device_mtu }}
|
|
{% endif -%}
|
|
|
|
{% if volume_service -%}
|
|
volume_api_class = nova.volume.cinder.API
|
|
{% endif -%}
|
|
|
|
{% if user_config_flags -%}
|
|
{% for key, value in user_config_flags.items() -%}
|
|
{{ key }} = {{ value }}
|
|
{% endfor -%}
|
|
{% endif -%}
|
|
|
|
{% if instances_path -%}
|
|
instances_path = {{ instances_path }}
|
|
{% endif -%}
|
|
|
|
{% if sections and 'DEFAULT' in sections -%}
|
|
{% for key, value in sections['DEFAULT'] -%}
|
|
{{ key }} = {{ value }}
|
|
{% endfor -%}
|
|
{% endif -%}
|
|
|
|
{% if vcpu_pin_set -%}
|
|
vcpu_pin_set = {{ vcpu_pin_set }}
|
|
{% endif -%}
|
|
reserved_host_memory_mb = {{ reserved_host_memory }}
|
|
|
|
{% if pci_passthrough_whitelist -%}
|
|
pci_passthrough_whitelist = {{ pci_passthrough_whitelist }}
|
|
{% endif -%}
|
|
|
|
{% include "section-zeromq" %}
|
|
|
|
{% if default_availability_zone -%}
|
|
default_availability_zone = {{ default_availability_zone }}
|
|
{% endif -%}
|
|
|
|
{% if resume_guests_state_on_host_boot -%}
|
|
resume_guests_state_on_host_boot = {{ resume_guests_state_on_host_boot }}
|
|
{% endif -%}
|
|
|
|
metadata_workers = {{ workers }}
|
|
|
|
{% if network_manager == 'neutron' and network_manager_config -%}
|
|
[neutron]
|
|
url = {{ network_manager_config.neutron_url }}
|
|
{% if network_manager_config.keystone_host -%}
|
|
{% if neutron_plugin and neutron_plugin == 'vsp' -%}
|
|
ovs_bridge = alubr0
|
|
{% endif -%}
|
|
|
|
auth_section = keystone_authtoken
|
|
auth_plugin = password
|
|
{% if metadata_shared_secret -%}
|
|
metadata_proxy_shared_secret = {{ metadata_shared_secret }}
|
|
service_metadata_proxy=True
|
|
{% endif -%}
|
|
{% endif -%}
|
|
{% endif -%}
|
|
|
|
{% include "section-keystone-authtoken" %}
|
|
|
|
{% if glance_api_servers -%}
|
|
[glance]
|
|
api_servers = {{ glance_api_servers }}
|
|
{% endif -%}
|
|
|
|
{% if console_access_protocol == 'spice' -%}
|
|
[spice]
|
|
agent_enabled = True
|
|
enabled = True
|
|
html5proxy_base_url = {{ spice_proxy_address }}
|
|
keymap = {{ console_keymap }}
|
|
server_listen = {{ console_listen_addr }}
|
|
server_proxyclient_address = {{ console_listen_addr }}
|
|
{% endif -%}
|
|
|
|
[libvirt]
|
|
{% if cpu_mode -%}
|
|
cpu_mode = {{ cpu_mode }}
|
|
{% endif -%}
|
|
{% if cpu_model -%}
|
|
cpu_model = {{ cpu_model }}
|
|
{% endif -%}
|
|
{% if libvirt_images_type -%}
|
|
images_type = {{ libvirt_images_type }}
|
|
{% endif -%}
|
|
{% if libvirt_images_type and rbd_pool -%}
|
|
images_rbd_pool = {{ rbd_pool }}
|
|
images_rbd_ceph_conf = {{ libvirt_rbd_images_ceph_conf }}
|
|
inject_password = false
|
|
inject_key = false
|
|
inject_partition = -2
|
|
{% endif -%}
|
|
rbd_user = {{ rbd_user }}
|
|
rbd_secret_uuid = {{ rbd_secret_uuid }}
|
|
{% if live_migration_uri -%}
|
|
live_migration_uri = {{ live_migration_uri }}
|
|
{% endif -%}
|
|
{% if disk_cachemodes -%}
|
|
disk_cachemodes = {{ disk_cachemodes }}
|
|
{% endif %}
|
|
{% if use_multipath -%}
|
|
iscsi_use_multipath = {{ use_multipath }}
|
|
{% endif %}
|
|
{% if default_ephemeral_format -%}
|
|
default_ephemeral_format = {{ default_ephemeral_format }}
|
|
{% endif %}
|
|
|
|
{% include "parts/section-database" %}
|
|
|
|
{% include "section-rabbitmq-oslo" %}
|
|
|
|
{% include "parts/section-cinder" %}
|
|
|
|
[oslo_concurrency]
|
|
lock_path=/var/lock/nova
|
|
|
|
[workarounds]
|
|
disable_libvirt_livesnapshot = False
|
|
|
|
{% include "parts/section-ephemeral" %}
|
|
|
|
{% include "parts/section-serial-console" %}
|