openstack/openstack-ansible-os_nova
Code Issues Proposed changes
b78e8a68ea
openstack-ansible-os_nova/defaults/main.yml
Dmitriy Rabotyagov b78e8a68ea Evaluate my_ip address once 
Instead of evaluating same condition of my_ip in multiple places across
the role this patch suggests doing this once in vars and using the
resulting variable afterwards.

This not only reduce amount of evaluations made throughout the role runtime,
but also solves possible corner cases where some syntax may go off.

Closes-Bug: #2052884
Change-Id: I454b53713ecacf844ac14f77b6d1e1adc1322c0e
2024-02-11 17:36:15 +01:00

855 lines
36 KiB
YAML
Raw Blame History

---
# Copyright 2014, Rackspace US, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# Enable/Disable barbican configurations
nova_barbican_enabled: "{{ (groups['barbican_all'] is defined) and (groups['barbican_all'] | length > 0) }}"
# Enable/Disable blazar configurations
nova_blazar_enabled: "{{ (groups['blazar_all'] is defined) and (groups['blazar_all'] | length > 0) }}"
# Enable/Disable designate configurations
nova_designate_enabled: "{{ (groups['designate_all'] is defined) and (groups['designate_all'] | length > 0) }}"
# Notification topics for designate.
nova_notifications_designate: notifications_designate
# Enable/Disable ceilometer configurations
nova_ceilometer_enabled: "{{ (groups['ceilometer_all'] is defined) and (groups['ceilometer_all'] | length > 0) }}"
# Enable/Disable nova versioned notification
nova_versioned_notification_enabled: False
# Caching
nova_cache_servers: "{{ nova_memcached_servers | default(memcached_servers) }}"
nova_cache_backend: "{{ openstack_cache_backend | default('oslo_cache.memcache_pool') }}"
nova_cache_backend_map: "{{ openstack_cache_backend_map | default(_nova_cache_backend_map) }}"
## Verbosity Options
debug: False
# Set the host which will execute the shade modules
# for the service setup. The host must already have
# clouds.yaml properly configured.
nova_service_setup_host: "{{ openstack_service_setup_host | default('localhost') }}"
nova_service_setup_host_python_interpreter: >-
{{
openstack_service_setup_host_python_interpreter | default(
(nova_service_setup_host == 'localhost') | ternary(ansible_playbook_python, ansible_facts['python']['executable']))
}}
# Set the host which will run compute initialization tasks such as checking
# for a compute node to be up and running cell discovery.
nova_conductor_setup_host: "{{ groups[nova_services['nova-conductor']['group']][0] }}"
# Set the package install state for distribution packages
# Options are 'present' and 'latest'
nova_package_state: "{{ package_state | default('latest') }}"
# Set installation method.
nova_install_method: "{{ service_install_method | default('source') }}"
nova_venv_python_executable: "{{ openstack_venv_python_executable | default('python3') }}"
nova_git_repo: https://opendev.org/openstack/nova
nova_git_install_branch: master
nova_upper_constraints_url: >-
{{ requirements_git_url | default('https://releases.openstack.org/constraints/upper/' ~ requirements_git_install_branch | default('master')) }}
nova_git_constraints:
- "--constraint {{ nova_upper_constraints_url }}"
nova_pip_install_args: "{{ pip_install_options | default('') }}"
# Name of the virtual env to deploy into
nova_venv_tag: "{{ venv_tag | default('untagged') }}"
nova_bin: "{{ _nova_bin }}"
## Nova user information
nova_system_user_name: nova
nova_system_group_name: nova
nova_system_shell: /bin/bash
nova_system_comment: nova system user
nova_system_home_folder: "/var/lib/{{ nova_system_user_name }}"
nova_system_slice_name: nova
nova_libvirt_save_path: "{{ nova_system_home_folder }}/save"
nova_lock_dir: "{{ openstack_lock_dir | default('/run/lock') }}"
nova_management_address: "127.0.0.1"
## Manually specified nova UID/GID
# Deployers can specify a UID for the nova user as well as the GID for the
# nova group if needed. This is commonly used in environments where shared
# storage is used, such as NFS or GlusterFS, and nova UID/GID values must be
# in sync between multiple servers.
#
# WARNING: Changing these values on an existing deployment can lead to
# failures, errors, and instability.
#
# nova_system_user_uid = <UID>
# nova_system_group_gid = <GID>
## Database info
nova_db_setup_host: "{{ openstack_db_setup_host | default('localhost') }}"
nova_db_setup_python_interpreter: >-
{{
openstack_db_setup_python_interpreter | default(
(nova_db_setup_host == 'localhost') | ternary(ansible_playbook_python, ansible_facts['python']['executable']))
}}
nova_galera_address: "{{ galera_address | default('127.0.0.1') }}"
nova_galera_user: nova
nova_galera_database: nova
nova_db_max_overflow: "{{ openstack_db_max_overflow | default('50') }}"
nova_db_max_pool_size: "{{ openstack_db_max_pool_size | default('5') }}"
nova_db_pool_timeout: "{{ openstack_db_pool_timeout | default('30') }}"
nova_db_connection_recycle_time: "{{ openstack_db_connection_recycle_time | default('600') }}"
nova_galera_port: "{{ galera_port | default('3306') }}"
# Toggle whether nova connects via an encrypted connection
nova_galera_use_ssl: "{{ galera_use_ssl | default(False) }}"
# The path where to store the database server CA certificate
nova_galera_ssl_ca_cert: "{{ galera_ssl_ca_cert | default('') }}"
## DB API
nova_api_galera_address: "{{ nova_galera_address }}"
nova_api_galera_user: nova_api
nova_api_galera_database: nova_api
nova_api_galera_port: "{{ galera_port | default('3306') }}"
nova_api_db_max_overflow: "{{ openstack_db_max_overflow | default('50') }}"
nova_api_db_max_pool_size: "{{ openstack_db_max_pool_size | default('5') }}"
nova_api_db_pool_timeout: "{{ openstack_db_pool_timeout | default('30') }}"
nova_api_db_connection_recycle_time: "{{ openstack_db_connection_recycle_time | default('600') }}"
## DB Cells
nova_cell0_database: "nova_cell0"
nova_cell1_name: "cell1"
## Oslo Messaging
# RabbitMQ
nova_oslomsg_heartbeat_in_pthread: "{{ oslomsg_heartbeat_in_pthread | default(_nova_oslomsg_heartbeat_in_pthread) }}"
# RPC
nova_oslomsg_rpc_host_group: "{{ oslomsg_rpc_host_group | default('rabbitmq_all') }}"
nova_oslomsg_rpc_setup_host: "{{ (nova_oslomsg_rpc_host_group in groups) | ternary(groups[nova_oslomsg_rpc_host_group][0], 'localhost') }}"
nova_oslomsg_rpc_transport: "{{ oslomsg_rpc_transport | default('rabbit') }}"
nova_oslomsg_rpc_servers: "{{ oslomsg_rpc_servers | default('127.0.0.1') }}"
nova_oslomsg_rpc_port: "{{ oslomsg_rpc_port | default('5672') }}"
nova_oslomsg_rpc_use_ssl: "{{ oslomsg_rpc_use_ssl | default(False) }}"
nova_oslomsg_rpc_userid: nova
nova_oslomsg_rpc_vhost:
- name: /nova
state: "{{ (nova_oslomsg_rabbit_quorum_queues | bool) | ternary('absent', 'present') }}"
- name: nova
state: "{{ (nova_oslomsg_rabbit_quorum_queues | bool) | ternary('present', 'absent') }}"
nova_oslomsg_rpc_ssl_version: "{{ oslomsg_rpc_ssl_version | default('TLSv1_2') }}"
nova_oslomsg_rpc_ssl_ca_file: "{{ oslomsg_rpc_ssl_ca_file | default('') }}"
# Notify
nova_oslomsg_notify_host_group: "{{ oslomsg_notify_host_group | default('rabbitmq_all') }}"
nova_oslomsg_notify_setup_host: "{{ (nova_oslomsg_notify_host_group in groups) | ternary(groups[nova_oslomsg_notify_host_group][0], 'localhost') }}"
nova_oslomsg_notify_transport: "{{ oslomsg_notify_transport | default('rabbit') }}"
nova_oslomsg_notify_servers: "{{ oslomsg_notify_servers | default('127.0.0.1') }}"
nova_oslomsg_notify_port: "{{ oslomsg_notify_port | default('5672') }}"
nova_oslomsg_notify_use_ssl: "{{ oslomsg_notify_use_ssl | default(False) }}"
nova_oslomsg_notify_userid: "{{ nova_oslomsg_rpc_userid }}"
nova_oslomsg_notify_password: "{{ nova_oslomsg_rpc_password }}"
nova_oslomsg_notify_vhost: "{{ nova_oslomsg_rpc_vhost }}"
nova_oslomsg_notify_ssl_version: "{{ oslomsg_notify_ssl_version | default('TLSv1_2') }}"
nova_oslomsg_notify_ssl_ca_file: "{{ oslomsg_notify_ssl_ca_file | default('') }}"
## Qdrouterd info
# TODO(ansmith): Change structure when more backends will be supported
nova_oslomsg_amqp1_enabled: "{{ nova_oslomsg_rpc_transport == 'amqp' }}"
###
### RabbitMQ info
###
nova_oslomsg_rabbit_quorum_queues: "{{ oslomsg_rabbit_quorum_queues | default(True) }}"
nova_oslomsg_rabbit_quorum_delivery_limit: "{{ oslomsg_rabbit_quorum_delivery_limit | default(0) }}"
nova_oslomsg_rabbit_quorum_max_memory_bytes: "{{ oslomsg_rabbit_quorum_max_memory_bytes | default(0) }}"
## Nova virtualization Types
# The nova_virt_types dictionary contains global overrides used for
# specific compute types. Every variable inside of this dictionary
# will become an ansible fact. This gives the user the option to set
# or customize things based on their needs without having to redefine
# this entire data structure. Every supported compute type will be
# have its specific variable requirements set under its short name.
nova_virt_types:
ironic:
nova_compute_driver: ironic.IronicDriver
nova_reserved_host_memory_mb: 0
nova_scheduler_tracks_instance_changes: False
kvm:
nova_compute_driver: libvirt.LibvirtDriver
nova_reserved_host_memory_mb: 2048
nova_scheduler_tracks_instance_changes: True
qemu:
nova_compute_driver: libvirt.LibvirtDriver
nova_reserved_host_memory_mb: 2048
nova_scheduler_tracks_instance_changes: True
nova_cpu_mode: "none"
# If this is not set, then the playbook will try to guess it.
# nova_virt_type: kvm
# Enable Kernel Shared Memory (KSM)
nova_compute_ksm_enabled: False
# if set, nova_virt_type must be one of these:
nova_supported_virt_types:
- qemu
- kvm
- ironic
## Nova Auth
nova_service_region: "{{ service_region | default('RegionOne') }}"
nova_service_project_name: "service"
nova_service_project_domain_id: default
nova_service_user_domain_id: default
nova_service_user_name: "nova"
nova_service_role_names:
- admin
- service
nova_service_token_roles:
- service
nova_service_token_roles_required: "{{ openstack_service_token_roles_required | default(True) }}"
## Keystone authentication middleware
nova_keystone_auth_plugin: password
## Nova enabled apis
nova_enabled_apis: "osapi_compute,metadata"
## Domain name used to configure FQDN for instances. When empty, only the hostname without
## a domain will be configured.
nova_dhcp_domain: "{{ dhcp_domain | default('') }}"
## Nova v2.1
nova_service_name: nova
nova_service_type: compute
nova_service_proto: http
nova_service_publicuri_proto: "{{ openstack_service_publicuri_proto | default(nova_service_proto) }}"
nova_service_adminuri_proto: "{{ openstack_service_adminuri_proto | default(nova_service_proto) }}"
nova_service_internaluri_proto: "{{ openstack_service_internaluri_proto | default(nova_service_proto) }}"
nova_service_bind_address: "{{ openstack_service_bind_address | default('0.0.0.0') }}"
nova_service_port: 8774
nova_service_description: "Nova Compute Service"
nova_service_publicuri: "{{ nova_service_publicuri_proto }}://{{ external_lb_vip_address }}:{{ nova_service_port }}"
nova_service_publicurl: "{{ nova_service_publicuri }}/v2.1"
nova_service_adminuri: "{{ nova_service_adminuri_proto }}://{{ internal_lb_vip_address }}:{{ nova_service_port }}"
nova_service_adminurl: "{{ nova_service_adminuri }}/v2.1"
nova_service_internaluri: "{{ nova_service_internaluri_proto }}://{{ internal_lb_vip_address }}:{{ nova_service_port }}"
nova_service_internalurl: "{{ nova_service_internaluri }}/v2.1"
## Nova spice
nova_spice_html5proxy_base_proto: "{{ openstack_service_publicuri_proto | default('http') }}"
nova_spice_html5proxy_base_port: 6082
nova_spice_html5proxy_base_uri: "{{ nova_spice_html5proxy_base_proto }}://{{ external_lb_vip_address }}:{{ nova_spice_html5proxy_base_port }}"
nova_spice_html5proxy_base_url: "{{ nova_spice_html5proxy_base_uri }}/spice_auto.html"
nova_spice_console_agent_enabled: True
nova_spicehtml5_git_repo: "{{ spicehtml5_git_repo | default('https://gitlab.freedesktop.org/spice/spice-html5.git') }}"
nova_spicehtml5_git_install_branch: "{{ spicehtml5_git_install_branch | default('master') }}"
## Nova novnc
nova_novncproxy_proto: "{{ openstack_service_publicuri_proto | default('http') }}"
nova_novncproxy_port: 6080
nova_novncproxy_host: "{{ openstack_service_bind_address | default('0.0.0.0') }}"
nova_novncproxy_base_uri: "{{ nova_novncproxy_proto }}://{{ external_lb_vip_address }}:{{ nova_novncproxy_port }}"
nova_novncproxy_base_url: "{{ nova_novncproxy_base_uri }}/vnc_lite.html"
nova_novncproxy_vncserver_proxyclient_address: "{{ _nova_my_ip }}"
nova_novncproxy_vncserver_listen: "{{ _nova_my_ip }}"
nova_novncproxy_git_repo: "{{ novncproxy_git_repo | default('https://github.com/novnc/noVNC') }}"
nova_novncproxy_git_install_branch: "{{ novncproxy_git_install_branch | default('master') }}"
## Nova serialconsole
nova_serialconsoleproxy_proto: "ws"
nova_serialconsoleproxy_port: 6083
nova_serialconsoleproxy_port_range: 10000:20000
nova_serialconsoleproxy_base_uri: "{{ nova_serialconsoleproxy_proto }}://{{ external_lb_vip_address }}:{{ nova_serialconsoleproxy_port }}"
nova_serialconsoleproxy_base_url: "{{ nova_serialconsoleproxy_base_uri }}"
nova_serialconsoleproxy_serialconsole_proxyserver_proxyclient_address: "{{ nova_management_address }}"
## Nova metadata
nova_metadata_proxy_enabled: True
nova_metadata_bind_address: "{{ openstack_service_bind_address | default('0.0.0.0') }}"
nova_metadata_port: 8775
## Nova compute
nova_nested_virt_enabled: False
# Uwsgi settings
nova_wsgi_processes_max: 16
nova_wsgi_processes: "{{ [[ansible_facts['processor_vcpus'] | default(1), 1] | max * 2, nova_wsgi_processes_max] | min }}"
nova_wsgi_threads: 1
nova_uwsgi_tls:
crt: "{{ nova_ssl_cert }}"
key: "{{ nova_ssl_key }}"
## Nova libvirt
# Warning: If nova_libvirt_inject_key or nova_libvirt_inject_password are enabled for Ubuntu compute hosts
# then the kernel will be made readable to nova user (a requirement for libguestfs).
# See Launchpad bugs 1507915 (Nova), 759725 (Ubuntu), and http://libguestfs.org/guestfs-faq.1.html
nova_libvirt_inject_key: False
# inject partition options:
# -2 => disable, -1 => inspect (libguestfs only), 0 => not partitioned, >0 => partition number
nova_libvirt_inject_partition: -2
nova_libvirt_inject_password: False
nova_libvirt_disk_cachemodes: '{{ (nova_libvirt_images_rbd_pool | length > 0) | ternary("network=writeback", "") }}'
nova_libvirt_hw_disk_discard: '{{ (nova_libvirt_images_rbd_pool | length > 0) | ternary("unmap", "ignore") }}'
nova_libvirt_live_migration_inbound_addr: '{{ _nova_my_ip }}'
## Nova console
# Set the console type for the compute host. Presently the only options are ["spice", "novnc", "serialconsole", "disabled"].
nova_console_type: "{{ (ansible_facts['architecture'] == 'aarch64') | ternary('serialconsole', 'novnc') }}"
## Nova ironic console
# Set the console type. Presently the only options are ["serialconsole", "disabled"].
nova_ironic_console_type: "disabled"
nova_ironic_used: "{{ _nova_ironic_used }}"
## Nova console proxies
# Set the console proxy types.
nova_console_proxy_types:
- "{{ nova_console_type }}"
- "{{ nova_ironic_console_type }}"
# Nova console ssl info, presently only used by novnc console type
nova_console_ssl_dir: "/etc/nova/ssl"
nova_console_ssl_cert: "{{ nova_console_ssl_dir }}/nova-console.pem"
nova_console_ssl_key: "{{ nova_console_ssl_dir }}/nova-console.key"
# Enable TLS on VNC connection from novnc to compute hosts
nova_qemu_vnc_tls: 1
nova_vencrypt_client_key: "/etc/pki/nova-novncproxy/client-key.pem"
nova_vencrypt_client_cert: "/etc/pki/nova-novncproxy/client-cert.pem"
nova_vencrypt_ca_certs: "/etc/pki/nova-novncproxy/ca-cert.pem"
# The auth_schemes values should be listed in order of preference.
# If enabling VeNCrypt on an existing deployment which already has instances running,
# the noVNC proxy server must initially be allowed to use vencrypt and none.
# Once it is confirmed that all Compute nodes have VeNCrypt enabled for VNC,
# it is possible to remove the none option from the list
nova_vencrypt_auth_scheme: "vencrypt,none"
## Nova global config
nova_image_cache_manager_interval: 0
# Nova Scheduler
nova_cpu_allocation_ratio: 2.0
nova_disk_allocation_ratio: 1.0
nova_max_io_ops_per_host: 10
nova_ram_allocation_ratio: 1.0
nova_reserved_host_disk_mb: 2048
nova_scheduler_host_subset_size: "{{ ((((groups['compute_hosts'] | default([]) | length) * 0.3) | round | int, 10) | min, 1) | max }}"
nova_scheduler_max_attempts: 5
nova_scheduler_default_filters:
- ComputeFilter
- AggregateNumInstancesFilter
- AggregateIoOpsFilter
- ComputeCapabilitiesFilter
- ImagePropertiesFilter
- ServerGroupAntiAffinityFilter
- ServerGroupAffinityFilter
- NUMATopologyFilter
nova_blazar_scheduler_filters:
- BlazarFilter
nova_scheduler_extra_filters: []
# This should be tuned depending on the number of compute hosts present in the
# deployment. Large clouds may wish to disable automatic discovery by setting
# this value to -1.
nova_discover_hosts_in_cells_interval: "{{ 300 if groups['nova_compute'] | length > 10 else 60 }}"
# Define nfs information to enable nfs shares as mounted directories for
# nova. The ``nova_nfs_client`` value is a list of dictionaries that must
# be filled out completely to enable the persistent NFS mounts.
#
# Example of the expected dict structure:
# nova_nfs_client:
# - server: "127.0.0.1" ## Hostname or IP address of NFS Server
# remote_path: "/instances" ## Remote path from the NFS server's export
# local_path: "/var/lib/nova/instances" ## Local path on machine
# type: "nfs" ## This can be nfs or nfs4
# options: "_netdev,auto" ## Mount options
# config_overrides: "{}" ## Override dictionary for unit file
nova_nfs_client: []
# Nova Ceph rbd
# Enble and define nova_libvirt_images_rbd_pool to use rbd as nova backend
# nova_libvirt_images_rbd_pool: vms
nova_libvirt_images_rbd_pool: ''
nova_ceph_client: "{{ cinder_ceph_client }}"
# Enabled upstream if RBD is in use on cinder backends, which requires that
# ceph be deployed on the nova compute hosts to enable volume backed instances.
nova_cinder_rbd_inuse: False
# Enable compute nodes to retrieve images from RBD directly rather then through
# HTTP if images_type is NOT set to RBD. Must be False if nova images stored in RBD.
nova_glance_rbd_inuse: False
nova_glance_images_rbd_pool: "{{ glance_rbd_store_pool | default('images') }}"
# Used to determine if we need a Ceph client
nova_rbd_inuse: "{{ (nova_libvirt_images_rbd_pool | length > 0) or (nova_cinder_rbd_inuse | bool) }}"
## General Nova configuration
# If ``nova_conductor_workers`` is unset the system will use half the number of available VCPUS to
# compute the number of api workers to use.
# nova_conductor_workers: 16
# If ``nova_scheduler_workers`` is unset the system will use half the number of available VCPUS to
# compute the number of api workers to use.
# nova_scheduler_workers: 16
## Cap the maximun number of threads / workers when a user value is unspecified.
nova_api_threads_max: 16
nova_api_threads: >-
{{ [[(ansible_facts['processor_vcpus'] // ansible_facts['processor_threads_per_core']) | default(1), 1] | max * 2, nova_api_threads_max] | min }}
## Policy vars
# Provide a list of access controls to update the default policy.json with. These changes will be merged
# with the access controls in the default policy.json. E.g.
# nova_policy_overrides:
# "compute:create": ""
# "compute:create:attach_network": ""
## Resource provider vars
# Optionally specify a set of resource providers that a particular compute node exposes
# See https://docs.openstack.org/nova/latest/admin/managing-resource-providers.html
nova_provider_overrides: []
# nova_provider_overrides:
# - name: my_provider
# content:
# meta:
# schema_version: '1.0'
# providers:
# - identification:
# name: 'EXAMPLE_RESOURCE_PROVIDER'
# inventories:
# additional:
# - CUSTOM_EXAMPLE_RESOURCE_CLASS:
# total: 100
# reserved: 0
# min_unit: 1
# max_unit: 10
# step_size: 1
# allocation_ratio: 1.0
# traits:
# additional:
# - 'CUSTOM_EXAMPLE_TRAIT'
nova_service_in_ldap: "{{ service_ldap_backend_enabled | default(False) }}"
## libvirtd config options
nova_libvirtd_listen_tls: 1
nova_libvirtd_listen_tcp: 0
nova_libvirtd_auth_tcp: sasl
nova_libvirtd_debug_log_filters: "3:remote 4:event 3:json 3:rpc"
nova_api_metadata_init_overrides: {}
nova_api_os_compute_init_overrides: {}
nova_compute_init_overrides: {}
nova_conductor_init_overrides: {}
nova_novncproxy_init_overrides: {}
nova_scheduler_init_overrides: {}
nova_spicehtml5proxy_init_overrides: {}
nova_serialproxy_init_overrides: {}
## Service Name-Group Mapping
nova_services:
nova-api-metadata:
group: nova_api_metadata
service_name: nova-api-metadata
init_config_overrides: "{{ nova_api_metadata_init_overrides }}"
start_order: 5
wsgi_app: True
uwsgi_overrides: "{{ nova_api_metadata_uwsgi_ini_overrides }}"
uwsgi_bind_address: "{{ nova_metadata_bind_address }}"
uwsgi_port: "{{ nova_metadata_port }}"
uwsgi_tls: "{{ nova_backend_ssl | ternary(nova_uwsgi_tls, {}) }}"
wsgi_name: nova-metadata-wsgi
nova-api-os-compute:
group: nova_api_os_compute
service_name: nova-api-os-compute
init_config_overrides: "{{ {'Install': {'Alias': 'nova-api.service'}} | combine(nova_api_os_compute_init_overrides, recursive=True) }}"
start_order: 4
wsgi_app: True
uwsgi_overrides: "{{ nova_api_os_compute_uwsgi_ini_overrides }}"
uwsgi_bind_address: "{{ nova_service_bind_address }}"
uwsgi_port: "{{ nova_service_port }}"
uwsgi_tls: "{{ nova_backend_ssl | ternary(nova_uwsgi_tls, {}) }}"
wsgi_name: nova-api-wsgi
nova-compute:
group: nova_compute
service_name: nova-compute
init_config_overrides: "{{ nova_compute_init_overrides }}"
start_order: 6
execstarts: "{{ nova_bin }}/nova-compute"
execreloads: "/bin/kill -HUP $MAINPID"
after_targets:
- libvirtd.service
- syslog.target
- network.target
nova-conductor:
group: nova_conductor
service_name: nova-conductor
init_config_overrides: "{{ nova_conductor_init_overrides }}"
start_order: 2
execstarts: "{{ nova_bin }}/nova-conductor"
execreloads: "/bin/kill -HUP $MAINPID"
nova-novncproxy:
group: nova_console
service_name: nova-novncproxy
init_config_overrides: "{{ nova_novncproxy_init_overrides }}"
condition: "{{ 'novnc' in nova_console_proxy_types }}"
start_order: 5
execstarts: "{{ nova_bin }}/nova-novncproxy {{ nova_backend_ssl | ternary('--ssl_only --cert ' ~ nova_ssl_cert ~ ' --key ' ~ nova_ssl_key, '') }}"
nova-scheduler:
group: nova_scheduler
service_name: nova-scheduler
init_config_overrides: "{{ nova_scheduler_init_overrides }}"
start_order: 3
execstarts: "{{ nova_bin }}/nova-scheduler"
execreloads: "/bin/kill -HUP $MAINPID"
nova-spicehtml5proxy:
group: nova_console
service_name: nova-spicehtml5proxy
init_config_overrides: "{{ {'Install': {'Alias': 'nova-spiceproxy.service'}} | combine(nova_spicehtml5proxy_init_overrides, recursive=True) }}"
condition: "{{ 'spice' in nova_console_proxy_types }}"
start_order: 5
execstarts: "{{ nova_bin }}/nova-spicehtml5proxy {{ nova_backend_ssl | ternary('--ssl_only --cert ' ~ nova_ssl_cert ~ ' --key ' ~ nova_ssl_key, '') }}"
nova-serialconsole-proxy:
group: nova_console
service_name: nova-serialproxy
init_config_overrides: "{{ nova_serialproxy_init_overrides }}"
condition: "{{ 'serialconsole' in nova_console_proxy_types }}"
start_order: 5
execstarts: "{{ nova_bin }}/nova-serialproxy {{ nova_backend_ssl | ternary('--ssl_only --cert ' ~ nova_ssl_cert ~ ' --key ' ~ nova_ssl_key, '') }}"
nova_ironic_sericalconsole-proxy:
group: ironic_console
service_name: nova-serialproxy
init_config_overrides: "{{ nova_serialproxy_init_overrides }}"
condition: "{{ 'serialconsole' in nova_console_proxy_types }}"
start_order: 5
execstarts: "{{ nova_bin }}/nova-serialproxy {{ nova_backend_ssl | ternary('--ssl_only --cert ' ~ nova_ssl_cert ~ ' --key ' ~ nova_ssl_key, '') }}"
nova_blazar_pip_packages:
- blazar-nova
nova_novnc_pip_packages:
- websockify
nova_compute_ironic_pip_packages:
- python-ironicclient
# Common pip packages
nova_pip_packages:
- "git+{{ nova_git_repo }}@{{ nova_git_install_branch }}#egg=nova"
- osprofiler
- PyMySQL
- "{{ _nova_cache_backend_package }}"
- systemd-python
# Specific pip packages provided by the user
nova_user_pip_packages: []
nova_optional_oslomsg_amqp1_pip_packages:
- oslo.messaging[amqp1]
nova_qemu_user: libvirt-qemu
nova_qemu_group: kvm
# Define the following variable to drop a replacement
# file for /etc/libvirt/qemu.conf
qemu_conf_dict: {}
## Tunable overrides
nova_nova_conf_overrides: {}
nova_rootwrap_conf_overrides: {}
nova_api_paste_ini_overrides: {}
nova_policy_overrides: {}
nova_vendor_data_overrides: {}
nova_api_metadata_uwsgi_ini_overrides: {}
nova_api_os_compute_uwsgi_ini_overrides: {}
# Enabled vGPU Types - dict defining 'type' and 'address' (optional) of vGPU
# an address is only required when supporting more than one physical GPU on the host
# Example 1:
# nova_enabled_mdev_types:
# - type: nvidia-35
#
# Example 2:
# nova_enabled_mdev_types:
# - type: nvidia-35
# address: "<device address.0>,<device address.1>"
# - type: nvidia-36
# address:
# - "<another device address.0>"
# - "<another device address.1>"
nova_enabled_mdev_types: "{{ nova_enabled_vgpu_types | default({}) }}"
# PCI devices passthrough to nova
# For SR-IOV please use:
# nova_device_spec: '{ "physical_network": "<ml2 network name>", "devname": "<physical nic>" }'
# Example:
# nova_device_spec: '{ "physical_network": "physnet1", "devname": "p1p1" }'
nova_device_spec: "{{ nova_pci_passthrough_whitelist | default({}) }}"
# PCI alias,
# Example:
# nova_pci_alias:
# - '{ "name": "card-alias1", "product_id": "XXXX", "vendor_id": "XXXX" }'
# - '{ "name": "card-alias2", "product_id": "XXXY", "vendor_id": "XXXY" }'
nova_pci_alias: []
# Storage location for SSL certificate authority
nova_pki_dir: "{{ openstack_pki_dir }}"
# Delegated host for operating the certificate authority
nova_pki_setup_host: "{{ openstack_pki_setup_host | default('localhost') }}"
# Nova server certificate
nova_pki_keys_path: "{{ nova_pki_dir ~ '/certs/private/' }}"
nova_pki_certs_path: "{{ nova_pki_dir ~ '/certs/certs/' }}"
nova_pki_intermediate_cert_name: "{{ openstack_pki_service_intermediate_cert_name }}"
nova_pki_intermediate_chain_path: >-
{{ nova_pki_dir ~ '/roots/' ~ nova_pki_intermediate_cert_name ~ '/certs/' ~ nova_pki_intermediate_cert_name ~ '-chain.crt' }}
nova_pki_regen_cert: ''
nova_pki_san: "{{ openstack_pki_san | default('DNS:' ~ ansible_facts['hostname'] ~ ',IP:' ~ management_address) }}"
nova_pki_compute_san: >-
{{
'DNS:' ~ ansible_facts['hostname'] ~ ',DNS:' ~ ansible_facts['nodename'] ~ ',IP:' ~ _nova_my_ip ~ (
nova_libvirt_live_migration_inbound_addr != nova_management_address) |ternary(',IP:' ~ nova_libvirt_live_migration_inbound_addr, '')
}}
# Create client and server cert for compute hosts
# This certiticate is used to secure TLS live migrations and VNC sessions
nova_pki_compute_certificates:
- name: "nova_{{ ansible_facts['hostname'] }}"
provider: ownca
cn: "{{ ansible_facts['nodename'] }}"
san: "{{ nova_pki_compute_san }}"
signed_by: "{{ nova_pki_intermediate_cert_name }}"
key_usage:
- digitalSignature
- keyAgreement
- keyEncipherment
extended_key_usage:
- clientAuth
- serverAuth
# libvirt default destination files for SSL certificates
nova_libvirt_ssl_dir: /etc/pki/libvirt
# QEMU default destination files for SSL certificates
nova_qemu_ssl_dir: /etc/pki/qemu
# Installation details for SSL certificates for compute hosts TLS live migration
nova_pki_compute_install_certificates:
- src: "{{ nova_user_ssl_cert | default(nova_pki_certs_path ~ 'nova_' ~ ansible_facts['hostname'] ~ '-chain.crt') }}"
dest: "{{ nova_libvirt_ssl_dir }}/servercert.pem"
owner: "root"
group: "root"
mode: "0640"
# Server certificate key used by libvirt for live migrations
- src: "{{ nova_user_ssl_key | default(nova_pki_keys_path ~ 'nova_' ~ ansible_facts['hostname'] ~ '.key.pem') }}"
dest: "{{ nova_libvirt_ssl_dir }}/private/serverkey.pem"
owner: "root"
group: "root"
mode: "0640"
# Client certificate used by libvirt for live migrations
# Defaults to using the server certificate which is signed for both clientAuth and serverAuth
- src: "{{ nova_user_ssl_cert | default(nova_pki_certs_path ~ 'nova_' ~ ansible_facts['hostname'] ~ '-chain.crt') }}"
dest: "{{ nova_libvirt_ssl_dir }}/clientcert.pem"
owner: "root"
group: "root"
mode: "0640"
# Client certificate key used by libvirt for live migrations
- src: "{{ nova_user_ssl_key | default(nova_pki_keys_path ~ 'nova_' ~ ansible_facts['hostname'] ~ '.key.pem') }}"
dest: "{{ nova_libvirt_ssl_dir }}/private/clientkey.pem"
owner: "root"
group: "root"
mode: "0640"
# Server certificate used by QEMU for live migrations
- src: "{{ nova_user_ssl_cert | default(nova_pki_certs_path ~ 'nova_' ~ ansible_facts['hostname'] ~ '-chain.crt') }}"
dest: "{{ nova_qemu_ssl_dir }}/server-cert.pem"
owner: "root"
group: "{{ nova_qemu_group }}"
mode: "0640"
# Server certificate key used by QEMU for live migrations
- src: "{{ nova_user_ssl_key | default(nova_pki_keys_path ~ 'nova_' ~ ansible_facts['hostname'] ~ '.key.pem') }}"
dest: "{{ nova_qemu_ssl_dir }}/server-key.pem"
owner: "root"
group: "{{ nova_qemu_group }}"
mode: "0640"
# Client certificate used by QEMU for live migrations
# Defaults to using the server certificate which is signed for both clientAuth and serverAuth
- src: "{{ nova_user_ssl_cert | default(nova_pki_certs_path ~ 'nova_' ~ ansible_facts['hostname'] ~ '-chain.crt') }}"
dest: "{{ nova_qemu_ssl_dir }}/client-cert.pem"
owner: "root"
group: "{{ nova_qemu_group }}"
mode: "0640"
# Client certificate key used by QEMU for live migrations
- src: "{{ nova_user_ssl_key | default(nova_pki_keys_path ~ 'nova_' ~ ansible_facts['hostname'] ~ '.key.pem') }}"
dest: "{{ nova_qemu_ssl_dir }}/client-key.pem"
owner: "root"
group: "{{ nova_qemu_group }}"
mode: "0640"
# Root CA for libvirt
# libvirt requires that the CA cert file has any intermediate certificates for the server cert,
# so defaults to using the intermediate chain, which contains the intermediate and Root CA
- src: "{{ nova_user_ssl_ca_cert | default(nova_pki_intermediate_chain_path) }}"
dest: "/etc/pki/CA/cacert.pem"
owner: "root"
group: "root"
mode: "0644"
# Root CA for qemu
- src: "{{ nova_user_ssl_ca_cert | default(nova_pki_intermediate_chain_path) }}"
dest: "{{ nova_qemu_ssl_dir }}/ca-cert.pem"
owner: "root"
group: "root"
mode: "0644"
# Define user-provided SSL certificates in:
# /etc/openstack_deploy/user_variables.yml
# nova_user_ssl_cert: <path to cert on ansible deployment host>
# nova_user_ssl_key: <path to cert on ansible deployment host>
# nova_user_ssl_ca_cert: <path to cert on ansible deployment host>
# TLS certficates for console hosts
nova_pki_console_certificates:
# Client certificate used by novnv proxy to authenticate with compute hosts using vencrypt
- name: "nova_{{ ansible_facts['hostname'] }}-client"
provider: ownca
cn: "{{ ansible_facts['nodename'] }}"
san: "{{ nova_pki_compute_san }}"
signed_by: "{{ nova_pki_intermediate_cert_name }}"
key_usage:
- digitalSignature
- keyAgreement
- keyEncipherment
extended_key_usage:
- clientAuth
condition: "{{ nova_qemu_vnc_tls == 1 and 'novnc' in nova_console_proxy_types }}"
# Installation details for SSL certificates for console hosts
nova_pki_console_install_certificates:
- src: "{{ nova_user_ssl_cert | default(nova_pki_certs_path ~ 'nova_' ~ ansible_facts['hostname'] ~ '-client-chain.crt') }}"
dest: "{{ nova_vencrypt_client_cert }}"
owner: "root"
group: "{{ nova_system_group_name }}"
mode: "0640"
condition: "{{ nova_qemu_vnc_tls == 1 and nova_console_type == 'novnc' }}"
- src: "{{ nova_user_ssl_key | default(nova_pki_keys_path ~ 'nova_' ~ ansible_facts['hostname'] ~ '-client.key.pem') }}"
dest: "{{ nova_vencrypt_client_key }}"
owner: "root"
group: "{{ nova_system_group_name }}"
mode: "0640"
condition: "{{ nova_qemu_vnc_tls == 1 and nova_console_type == 'novnc' }}"
- src: "{{ nova_user_ssl_ca_cert | default(nova_pki_intermediate_chain_path) }}"
dest: "{{ nova_vencrypt_ca_certs }}"
owner: "root"
group: "{{ nova_system_group_name }}"
mode: "0640"
condition: "{{ nova_qemu_vnc_tls == 1 and nova_console_type == 'novnc' }}"
# host which holds the ssh certificate authority
nova_ssh_keypairs_setup_host: "{{ openstack_ssh_keypairs_setup_host | default('localhost') }}"
# directory on the deploy host to create and store SSH keypairs
nova_ssh_keypairs_dir: "{{ openstack_ssh_keypairs_dir | default('/etc/openstack_deploy/ssh_keypairs') }}"
# Each compute host needs a signed ssh certificate to log into the others
nova_ssh_keypairs:
- name: "nova-{{ inventory_hostname }}"
cert:
signed_by: "{{ openstack_ssh_signing_key }}"
principals: "{{ nova_ssh_key_principals | default('nova') }}"
valid_from: "{{ nova_ssh_key_valid_from | default('always') }}"
valid_to: "{{ nova_ssh_key_valid_to | default('forever') }}"
# Each compute host needs the signed ssh certificate installing to the nova user
nova_ssh_keypairs_install_keys:
owner: "{{ nova_system_user_name }}"
group: "{{ nova_system_group_name }}"
keys:
- cert: "nova-{{ inventory_hostname }}"
dest: "{{ nova_system_home_folder }}/.ssh/id_rsa"
# Each compute host must trust the SSHD certificate authoritiy in the sshd configuration
nova_ssh_keypairs_install_ca: "{{ openstack_ssh_keypairs_authorities }}"
# Each compute host must allow SSH certificates with the appropriate principal to log into the nova user
nova_ssh_keypairs_principals:
- user: "{{ nova_system_user_name }}"
principals: "{{ nova_ssh_key_principals | default(['nova']) }}"
###
### Backend TLS
###
# Define if communication between haproxy and service backends should be
# encrypted with TLS.
nova_backend_ssl: "{{ openstack_service_backend_ssl | default(False) }}"
nova_pki_certificates:
# Used to encrypt traffic between haproxy and nova backends
- name: "nova_{{ ansible_facts['hostname'] }}"
provider: ownca
cn: "{{ ansible_facts['hostname'] }}"
san: "{{ nova_pki_san }}"
signed_by: "{{ nova_pki_intermediate_cert_name }}"
condition: "{{ nova_backend_ssl }}"
# nova destination files for SSL certificates
nova_ssl_cert: /etc/nova/nova.pem
nova_ssl_key: /etc/nova/nova.key
# Installation details for SSL certificates
nova_pki_install_certificates:
- src: "{{ nova_user_ssl_cert | default(nova_pki_certs_path ~ 'nova_' ~ ansible_facts['hostname'] ~ '-chain.crt') }}"
dest: "{{ nova_ssl_cert }}"
owner: "{{ nova_system_user_name }}"
group: "{{ nova_system_user_name }}"
mode: "0644"
condition: "{{ nova_backend_ssl }}"
- src: "{{ nova_user_ssl_key | default(nova_pki_keys_path ~ 'nova_' ~ ansible_facts['hostname'] ~ '.key.pem') }}"
dest: "{{ nova_ssl_key }}"
owner: "{{ nova_system_user_name }}"
group: "{{ nova_system_user_name }}"
mode: "0600"
condition: "{{ nova_backend_ssl }}"
# Periodically move records for deleted resources to shadow tables
nova_archive_deleted: False
# When to start archive task. Reffer to Systemd Calendar Events for guidance
# on format:
# https://www.freedesktop.org/software/systemd/man/systemd.time.html#Calendar%20Events
nova_archive_deleted_on_calendar: "*-*-* 00:00:00"
# Archive events that are older then the timeframe below.
# Should be in a format of bash date string
nova_archive_deleted_before: "6 month ago"
# Delete records instead of moving them to shadow tables
nova_archive_deleted_purge: False
# Archive instance task log
nova_archive_task_log: False
# Delay the timer by a randomly selected amount of time.
nova_archive_deleted_randomized_delay_sec: 0
# Periodically purge shadow tables, where archived records are stored
nova_purge_deleted: False
# When to start purge task.
nova_purge_deleted_on_calendar: "*-*-* 01:00:00"
# Purge events that are older then the timeframe below.
nova_purge_deleted_before: "24 month ago"
# Delay the timer by a randomly selected amount of time.
nova_purge_deleted_randomized_delay_sec: 0
View Git Blame Copy Permalink