c2037885e7
Recently a patch [1] was merged to stop adding the octavia user to the admin project, and remove it on upgrade. However, the octavia configuration was not updated to use the service project, causing load balancer creation to fail. There is also an issue for existing deployments in simply switching to the service project. While existing load balancers appear to continue to work, creating new load balancers fails due to the security group belonging to the admin project. At a minimum, the deployer needs to create a security group in the service project, and update 'octavia_amp_secgroup_list' to match its ID. Ideally the flavor and network would also be recreated in the service project, although this does not seem to impact operation and will result in downtime for existing Amphorae. This change adds a new variable, 'octavia_service_auth_project', that can be used to set the project. The default in Ussuri is 'service', switching to the new behaviour. For backports of this patch it should be switched to 'admin' to maintain compatibility. If a deployer sets 'octavia_service_auth_project' to 'admin', the octavia user will be assigned the admin role in the admin project, as was done previously. Closes-Bug: #1882643 Related-Bug: #1873176 [1] https://review.opendev.org/720243/ Co-Authored-By: Mark Goddard <mark@stackhpc.com> Change-Id: I1efd0154ebaee69373ae5bccd391ee9c68d09b30
105 lines
3.6 KiB
Django/Jinja
105 lines
3.6 KiB
Django/Jinja
[DEFAULT]
|
|
debug = {{ octavia_logging_debug }}
|
|
|
|
log_dir = /var/log/kolla/octavia
|
|
|
|
transport_url = {{ rpc_transport_url }}
|
|
|
|
[api_settings]
|
|
bind_host = {{ api_interface_address }}
|
|
bind_port = {{ octavia_api_listen_port }}
|
|
|
|
[certificates]
|
|
ca_private_key_passphrase = {{ octavia_ca_password }}
|
|
ca_private_key = /etc/octavia/certs/server_ca.key.pem
|
|
ca_certificate = /etc/octavia/certs/server_ca.cert.pem
|
|
{% if enable_barbican | bool %}
|
|
region_name = {{ openstack_region_name }}
|
|
endpoint_type = internal
|
|
ca_certificates_file = {{ openstack_cacert }}
|
|
{% endif %}
|
|
|
|
[haproxy_amphora]
|
|
server_ca = /etc/octavia/certs/server_ca.cert.pem
|
|
client_cert = /etc/octavia/certs/client.cert-and-key.pem
|
|
|
|
[database]
|
|
connection = mysql+pymysql://{{ octavia_database_user }}:{{ octavia_database_password }}@{{ octavia_database_address }}/{{ octavia_database_name }}
|
|
max_retries = -1
|
|
|
|
[service_auth]
|
|
auth_url = {{ keystone_admin_url }}
|
|
auth_type = password
|
|
username = {{ octavia_keystone_user }}
|
|
password = {{ octavia_keystone_password }}
|
|
user_domain_name = {{ default_user_domain_name }}
|
|
project_name = {{ octavia_service_auth_project }}
|
|
project_domain_name = {{ default_project_domain_name }}
|
|
cafile = {{ openstack_cacert }}
|
|
|
|
memcache_security_strategy = ENCRYPT
|
|
memcache_secret_key = {{ memcache_secret_key }}
|
|
memcached_servers = {% for host in groups['memcached'] %}{{ 'api' | kolla_address(host) | put_address_in_context('memcache') }}:{{ memcached_port }}{% if not loop.last %},{% endif %}{% endfor %}
|
|
|
|
[keystone_authtoken]
|
|
www_authenticate_uri = {{ keystone_internal_url }}
|
|
auth_url = {{ keystone_admin_url }}
|
|
auth_type = password
|
|
project_domain_id = {{ default_project_domain_id }}
|
|
user_domain_id = {{ default_user_domain_id }}
|
|
project_name = service
|
|
username = {{ octavia_keystone_user }}
|
|
password = {{ octavia_keystone_password }}
|
|
cafile = {{ openstack_cacert }}
|
|
|
|
memcache_security_strategy = ENCRYPT
|
|
memcache_secret_key = {{ memcache_secret_key }}
|
|
memcached_servers = {% for host in groups['memcached'] %}{{ 'api' | kolla_address(host) | put_address_in_context('memcache') }}:{{ memcached_port }}{% if not loop.last %},{% endif %}{% endfor %}
|
|
|
|
[health_manager]
|
|
bind_port = {{ octavia_health_manager_port }}
|
|
bind_ip = {{ octavia_network_interface_address }}
|
|
heartbeat_key = insecure
|
|
controller_ip_port_list = {% for host in groups['octavia-health-manager'] %}{{ 'octavia_network' | kolla_address(host) | put_address_in_context('url') }}:{{ octavia_health_manager_port }}{% if not loop.last %},{% endif %}{% endfor %}
|
|
|
|
[controller_worker]
|
|
amp_boot_network_list = {{ octavia_amp_boot_network_list }}
|
|
amp_image_tag = amphora
|
|
amp_secgroup_list = {{ octavia_amp_secgroup_list }}
|
|
amp_flavor_id = {{ octavia_amp_flavor_id }}
|
|
amp_ssh_key_name = octavia_ssh_key
|
|
client_ca = /etc/octavia/certs/client_ca.cert.pem
|
|
network_driver = allowed_address_pairs_driver
|
|
compute_driver = compute_nova_driver
|
|
amphora_driver = amphora_haproxy_rest_driver
|
|
amp_active_retries = 100
|
|
amp_active_wait_sec = 2
|
|
loadbalancer_topology = {{ octavia_loadbalancer_topology }}
|
|
|
|
[oslo_messaging]
|
|
topic = octavia_prov
|
|
rpc_thread_pool_size = 2
|
|
|
|
[oslo_messaging_notifications]
|
|
transport_url = {{ notify_transport_url }}
|
|
|
|
{% if octavia_policy_file is defined %}
|
|
[oslo_policy]
|
|
policy_file = {{ octavia_policy_file }}
|
|
{% endif %}
|
|
|
|
[glance]
|
|
region_name = {{ openstack_region_name }}
|
|
endpoint_type = internal
|
|
ca_certificates_file = {{ openstack_cacert }}
|
|
|
|
[neutron]
|
|
region_name = {{ openstack_region_name }}
|
|
endpoint_type = internal
|
|
ca_certificates_file = {{ openstack_cacert }}
|
|
|
|
[nova]
|
|
region_name = {{ openstack_region_name }}
|
|
endpoint_type = internal
|
|
ca_certificates_file = {{ openstack_cacert }}
|