1c68ae389b
This addresses the ansible aspects of fernet key bootstrapping as well as distributed key rotation. - Bootstrapping is handled in the same way as keystone bootstrap. - A new keystone-fernet and keystone-ssh container is created to allow the nodes to communicate with each other (taken from nova-ssh). - The keystone-fernet is a keystone container with crontab installed. This will handle key rotations through keystone-manage and trigger an rsync to push new tokens to other nodes. - Key rotation is setup to be balanced across the keystone nodes using a round-robbin style. This ensures that any node failures will not stop the keys from rotating. This is configured by a desired token expiration time which then determines the cron scheduling for each node as well as the number of fernet tokens in rotation. - Ability for recovered node to resync with the cluster. When a node starts it will run sanity checks to ensure that its fernet tokens are not stale. If they are it will rsync with other nodes to ensure its tokens are up to date. The Docker component is implemented in: https://review.openstack.org/#/c/349366 Change-Id: I15052c25a1d1149d364236f10ced2e2346119738 Implements: blueprint keystone-fernet-token
347 lines
9.6 KiB
YAML
347 lines
9.6 KiB
YAML
---
|
|
# The options in this file can be overridden in 'globals.yml'
|
|
|
|
# The "temp" files that are created before merge need to stay persistent due
|
|
# to the fact that ansible will register a "change" if it has to create them
|
|
# again. Persistent files allow for idempotency
|
|
container_config_directory: "/var/lib/kolla/config_files"
|
|
|
|
# The directory to merge custom config files the kolla's config files
|
|
node_custom_config: "/etc/kolla/config"
|
|
|
|
# The project to generate configuration files for
|
|
project: ""
|
|
|
|
# The directory to store the config files on the destination node
|
|
node_config_directory: "/etc/kolla/{{ project }}"
|
|
|
|
|
|
###################
|
|
# Kolla options
|
|
###################
|
|
|
|
# Which orchestration engine to use. Valid options are [ ANSIBLE, KUBERNETES ]
|
|
orchestration_engine: "ANSIBLE"
|
|
|
|
# Valid options are [ COPY_ONCE, COPY_ALWAYS ]
|
|
config_strategy: "COPY_ALWAYS"
|
|
|
|
# Valid options are [ centos, fedora, oraclelinux, ubuntu ]
|
|
kolla_base_distro: "centos"
|
|
# Valid options are [ binary, source ]
|
|
kolla_install_type: "binary"
|
|
|
|
kolla_internal_vip_address: "{{ kolla_internal_address }}"
|
|
kolla_internal_fqdn: "{{ kolla_internal_vip_address }}"
|
|
kolla_external_vip_address: "{{ kolla_internal_vip_address }}"
|
|
kolla_external_fqdn: "{{ kolla_internal_fqdn if kolla_external_vip_address == kolla_internal_vip_address else kolla_external_vip_address }}"
|
|
|
|
kolla_enable_sanity_checks: "no"
|
|
|
|
kolla_enable_sanity_keystone: "{{ kolla_enable_sanity_checks }}"
|
|
kolla_enable_sanity_glance: "{{ kolla_enable_sanity_checks }}"
|
|
kolla_enable_sanity_cinder: "{{ kolla_enable_sanity_checks }}"
|
|
kolla_enable_sanity_swift: "{{ kolla_enable_sanity_checks }}"
|
|
|
|
|
|
####################
|
|
# kolla-kubernetes
|
|
####################
|
|
# By default, Kolla API services bind to the network address assigned
|
|
# to the api_interface. Allow the bind address to be an override. In
|
|
# some cases (Kubernetes), the api_interface address is not known
|
|
# until container runtime, and thus it is necessary to bind to all
|
|
# interfaces "0.0.0.0". When used outside of Kubernetes, binding to
|
|
# all interfaces may present a security issue, and thus is not
|
|
# recommended.
|
|
api_interface_address: "{{ hostvars[inventory_hostname]['ansible_' + api_interface]['ipv4']['address'] if orchestration_engine == 'ANSIBLE' else '0.0.0.0' }}"
|
|
|
|
####################
|
|
# Database options
|
|
####################
|
|
database_address: "{{ kolla_internal_fqdn }}"
|
|
database_user: "root"
|
|
database_port: "3306"
|
|
|
|
|
|
####################
|
|
# Docker options
|
|
####################
|
|
docker_registry_email:
|
|
docker_registry:
|
|
docker_namespace: "kolla"
|
|
docker_registry_username:
|
|
|
|
# Valid options are [ never, on-failure, always ]
|
|
docker_restart_policy: "always"
|
|
|
|
# '0' means unlimited retries
|
|
docker_restart_policy_retry: "10"
|
|
|
|
# Common options used throughout docker
|
|
docker_common_options:
|
|
auth_email: "{{ docker_registry_email }}"
|
|
auth_password: "{{ docker_registry_password }}"
|
|
auth_registry: "{{ docker_registry }}"
|
|
auth_username: "{{ docker_registry_username }}"
|
|
environment:
|
|
KOLLA_CONFIG_STRATEGY: "{{ config_strategy }}"
|
|
restart_policy: "{{ docker_restart_policy }}"
|
|
restart_retries: "{{ docker_restart_policy_retry }}"
|
|
|
|
|
|
####################
|
|
# keepalived options
|
|
####################
|
|
# Arbitrary unique number from 0..255
|
|
keepalived_virtual_router_id: "51"
|
|
|
|
|
|
####################
|
|
# Networking options
|
|
####################
|
|
kolla_external_vip_interface: "{{ network_interface }}"
|
|
api_interface: "{{ network_interface }}"
|
|
storage_interface: "{{ network_interface }}"
|
|
cluster_interface: "{{ network_interface }}"
|
|
tunnel_interface: "{{ network_interface }}"
|
|
|
|
# Valid options are [ openvswitch, linuxbridge ]
|
|
neutron_plugin_agent: "openvswitch"
|
|
|
|
# The default ports used by each service.
|
|
ceilometer_api_port: "8777"
|
|
|
|
iscsi_port: "3260"
|
|
|
|
mariadb_port: "{{ database_port }}"
|
|
mariadb_wsrep_port: "4567"
|
|
mariadb_ist_port: "4568"
|
|
mariadb_sst_port: "4444"
|
|
|
|
rabbitmq_port: "5672"
|
|
rabbitmq_management_port: "15672"
|
|
rabbitmq_cluster_port: "25672"
|
|
rabbitmq_epmd_port: "4369"
|
|
|
|
mongodb_port: "27017"
|
|
mongodb_web_port: "28017"
|
|
|
|
haproxy_stats_port: "1984"
|
|
|
|
keystone_public_port: "5000"
|
|
keystone_admin_port: "35357"
|
|
keystone_ssh_port: "8023"
|
|
|
|
glance_api_port: "9292"
|
|
glance_registry_port: "9191"
|
|
|
|
nova_api_port: "8774"
|
|
nova_metadata_port: "8775"
|
|
nova_novncproxy_port: "6080"
|
|
nova_spicehtml5proxy_port: "6082"
|
|
|
|
neutron_server_port: "9696"
|
|
|
|
cinder_api_port: "8776"
|
|
|
|
memcached_port: "11211"
|
|
|
|
swift_proxy_server_port: "8080"
|
|
swift_object_server_port: "6000"
|
|
swift_account_server_port: "6001"
|
|
swift_container_server_port: "6002"
|
|
swift_rsync_port: "10873"
|
|
|
|
heat_api_port: "8004"
|
|
heat_api_cfn_port: "8000"
|
|
|
|
murano_api_port: "8082"
|
|
|
|
ironic_api_port: "6385"
|
|
|
|
magnum_api_port: "9511"
|
|
|
|
rgw_port: "6780"
|
|
|
|
mistral_api_port: "8989"
|
|
|
|
kibana_server_port: "5601"
|
|
|
|
elasticsearch_port: "9200"
|
|
|
|
manila_api_port: "8786"
|
|
|
|
watcher_api_port: "9322"
|
|
|
|
public_protocol: "{{ 'https' if kolla_enable_tls_external | bool else 'http' }}"
|
|
internal_protocol: "http"
|
|
admin_protocol: "http"
|
|
|
|
####################
|
|
# OpenStack options
|
|
####################
|
|
openstack_release: "3.0.0"
|
|
openstack_logging_debug: "False"
|
|
|
|
openstack_region_name: "RegionOne"
|
|
|
|
openstack_service_workers: "{{ [ansible_processor_vcpus, 5]|min if orchestration_engine == 'ANSIBLE' else '1'}}"
|
|
|
|
# Optionally allow Kolla to set sysctl values
|
|
set_sysctl: "yes"
|
|
|
|
# Valid options are [ novnc, spice ]
|
|
nova_console: "novnc"
|
|
|
|
# OpenStack authentication string. You should only need to override these if you
|
|
# are changing the admin tenant/project or user.
|
|
openstack_auth:
|
|
auth_url: "{{ admin_protocol }}://{{ kolla_internal_fqdn }}:{{ keystone_admin_port }}"
|
|
username: "admin"
|
|
password: "{{ keystone_admin_password }}"
|
|
project_name: "admin"
|
|
|
|
# These roles are required for Kolla to be operation, however a savvy deployer
|
|
# could disable some of these required roles and run their own services.
|
|
enable_glance: "yes"
|
|
enable_haproxy: "yes"
|
|
enable_keystone: "yes"
|
|
enable_mariadb: "yes"
|
|
enable_memcached: "yes"
|
|
enable_neutron: "yes"
|
|
enable_nova: "yes"
|
|
enable_rabbitmq: "yes"
|
|
|
|
# Additional optional OpenStack services are specified here
|
|
enable_ceilometer: "no"
|
|
enable_central_logging: "no"
|
|
enable_ceph: "no"
|
|
enable_ceph_rgw: "no"
|
|
enable_cinder: "no"
|
|
enable_cinder_backend_lvm: "no"
|
|
enable_heat: "yes"
|
|
enable_horizon: "yes"
|
|
enable_ironic: "no"
|
|
enable_magnum: "no"
|
|
enable_manila: "no"
|
|
enable_mistral: "no"
|
|
enable_mongodb: "no"
|
|
enable_multipathd: "no"
|
|
enable_murano: "no"
|
|
enable_neutron_lbaas: "no"
|
|
enable_neutron_qos: "no"
|
|
enable_swift: "no"
|
|
enable_tempest: "no"
|
|
enable_watcher: "no"
|
|
|
|
ironic_keystone_user: "ironic"
|
|
neutron_keystone_user: "neutron"
|
|
nova_keystone_user: "nova"
|
|
|
|
# Nova fake driver and the number of fake driver per compute node
|
|
enable_nova_fake: "no"
|
|
num_nova_fake_per_node: 5
|
|
|
|
|
|
####################
|
|
# Logging options
|
|
####################
|
|
|
|
elasticsearch_address: "{{ kolla_internal_vip_address }}"
|
|
elasticsearch_protocol: "{{ internal_protocol }}"
|
|
|
|
enable_elasticsearch: "{{ 'yes' if enable_central_logging | bool else 'no' }}"
|
|
enable_kibana: "{{ 'yes' if enable_central_logging | bool else 'no' }}"
|
|
|
|
####################
|
|
# RabbitMQ options
|
|
####################
|
|
rabbitmq_user: "openstack"
|
|
rabbitmq_version: "rabbitmq_server-3.5.7/plugins/rabbitmq_clusterer-3.5.x-189b3a81.ez/rabbitmq_clusterer-3.5.x-189b3a81/ebin"
|
|
|
|
####################
|
|
# HAProxy options
|
|
####################
|
|
haproxy_user: "openstack"
|
|
haproxy_enable_external_vip: "{{ 'no' if kolla_external_vip_address == kolla_internal_vip_address else 'yes' }}"
|
|
kolla_enable_tls_external: "no"
|
|
kolla_external_fqdn_cert: "{{ node_config_directory }}/certificates/haproxy.pem"
|
|
|
|
|
|
####################
|
|
# Kibana options
|
|
####################
|
|
kibana_user: "kibana"
|
|
|
|
|
|
####################
|
|
# Keystone Options
|
|
####################
|
|
keystone_admin_url: "{{ admin_protocol }}://{{ kolla_internal_fqdn }}:{{ keystone_admin_port }}/v3"
|
|
keystone_internal_url: "{{ internal_protocol }}://{{ kolla_internal_fqdn }}:{{ keystone_public_port }}/v3"
|
|
keystone_public_url: "{{ public_protocol }}://{{ kolla_external_fqdn }}:{{ keystone_public_port }}/v3"
|
|
|
|
|
|
#####################################
|
|
# Keystone - Identity Service options
|
|
#####################################
|
|
keystone_token_provider: "uuid"
|
|
fernet_token_expiry: 86400
|
|
|
|
|
|
#######################
|
|
# Glance options
|
|
#######################
|
|
glance_backend_file: "{{ not enable_ceph | bool }}"
|
|
glance_backend_ceph: "{{ enable_ceph }}"
|
|
|
|
|
|
#################################
|
|
# Cinder options
|
|
#################################
|
|
cinder_backend_ceph: "{{ enable_ceph }}"
|
|
|
|
|
|
|
|
#######################
|
|
# Nova options
|
|
#######################
|
|
nova_backend_ceph: "{{ enable_ceph }}"
|
|
nova_backend: "{{ 'rbd' if nova_backend_ceph | bool else 'default' }}"
|
|
|
|
###################
|
|
# Ceph options
|
|
###################
|
|
# Ceph can be setup with a caching to improve performance. To use the cache you
|
|
# must provide separate disks than those for the OSDs
|
|
ceph_enable_cache: "no"
|
|
# Valid options are [ forward, none, writeback ]
|
|
ceph_cache_mode: "writeback"
|
|
|
|
# Valid options are [ ext4, btrfs, xfs ]
|
|
ceph_osd_filesystem: "xfs"
|
|
|
|
# These are /etc/fstab options. Comma separated, no spaces (see fstab(8))
|
|
ceph_osd_mount_options: "defaults,noatime"
|
|
|
|
# A requirement for using the erasure-coded pools is you must setup a cache tier
|
|
# Valid options are [ erasure, replicated ]
|
|
ceph_pool_type: "replicated"
|
|
|
|
ceph_cinder_pool_name: "volumes"
|
|
ceph_cinder_backup_pool_name: "backups"
|
|
ceph_glance_pool_name: "images"
|
|
ceph_nova_pool_name: "vms"
|
|
|
|
ceph_erasure_profile: "k=4 m=2 ruleset-failure-domain=host"
|
|
ceph_rule: "default host {{ 'indep' if ceph_pool_type == 'erasure' else 'firstn' }}"
|
|
ceph_cache_rule: "cache host firstn"
|
|
|
|
|
|
#######################################
|
|
# Manila - Shared File Systems Options
|
|
#######################################
|
|
manila_enable_dhss: "yes"
|
|
manila_dhss: "{{ 'True' if manila_enable_dhss | bool else 'False' }}"
|