openstack-ansible/inventory/group_vars/all/all.yml
Jonathan Rosser f4510b6baa Bind services to mgmt network addresses
These addresses are given defaults of 0.0.0.0 in the role defaults
but in a deployment we know which address each service should bind to.

The variable container_address should hold the local mgmt network IP
address for either containerised or metal deployments.

This patch defines a new variable management_address which removes
confusion about container_address for metal deployments, and overrides
the role default bind addresses for all roles.

Depends-On: https://review.opendev.org/753638
Change-Id: I7471ff1da9602f67134e217f5427e492fa7a7814
2020-09-24 10:03:22 +01:00

151 lines
5.5 KiB
YAML

---
# Copyright 2016, Rackspace US, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
## OpenStack Source Code Release
openstack_release: "{{ lookup('env', 'OSA_VERSION') | default('undefined', true) }}"
## OpenStack Configuration directory
openstack_config_dir: "{{ lookup('env', 'OSA_CONFIG_DIR') | default('/etc/openstack_deploy', true) }}"
## OpenStack Clone directory
openstack_clone_root: "{{ (lookup('env', 'OSA_CLONE_ROOT') | default('/opt/openstack-ansible', true)) }}"
## OpenStack service python version
openstack_venv_python_executable: "python3"
#uwsgi venv deploys the same python version as OpenStack service venv
uwsgi_python_executable: "{{ openstack_venv_python_executable }}"
## Verbosity Options
debug: False
## SSH connection wait time
ssh_delay: 5
management_address: "{{ container_address }}"
openstack_service_bind_address: "{{ management_address }}"
# Set the package install state for distribution packages
# Options are 'present' and 'latest'.
# NOTE(mhayden): Allowing CentOS 7 and openSUSE to use package_state=present should give
# gate jobs a better chance to finish and expose more issues to fix.
package_state: "{{ (ansible_pkg_mgr in ['dnf', 'yum', 'zypper']) | ternary('present', 'latest') }}"
# Set "/var/log" to be a bind mount to the physical host.
default_bind_mount_logs: true
# Set distro variable
# NOTE(hwoarang): ansible_distribution may return a string with spaces
# such as "openSUSE Leap" so we need to replace the space with underscore
# in order to create a more sensible repo name for the distro.
os_distro_version: "{{ (ansible_distribution | lower) | replace(' ', '_') }}-{{ ansible_distribution_version.split('.')[:2] | join('.') }}-{{ ansible_architecture | lower }}"
# Set the systemd prefix based on the base OS.
systemd_utils_distro_prefix:
apt: "/lib/systemd"
yum: "/lib/systemd"
dnf: "/lib/systemd"
zypper: "/usr/lib/systemd"
systemd_utils_prefix: "{{ systemd_utils_distro_prefix[ansible_pkg_mgr] }}"
# Ensure that the package state matches the global setting
rsyslog_client_package_state: "{{ package_state }}"
# At this time there's no suitable package available for systemd-journal-remote/gateway
# When installing on SUSE 42.x. For now this playbook will omit suse when the package
# manager is "zypper". When a suitable package is available on SUSE this should be removed.
rsyslog_client_enabled: "{{ ansible_pkg_mgr == 'zypper' }}"
rsyslog_server_enabled: "{{ ansible_pkg_mgr == 'zypper' }}"
# URL for the frozen internal openstack repo.
repo_server_port: 8181
## Default installation method for OpenStack services
install_method: "source"
## DNS resolution (resolvconf) options
#Group containing resolvers to configure
resolvconf_resolver_group: unbound
# Disable /etc/hosts management if unbound DNS resolution containers exist
openstack_host_manage_hosts_file: "{{ groups['unbound'] is not defined or groups['unbound'] | length < 1 }}"
## Enable external SSL handling for general OpenStack services
openstack_external_ssl: true
## OpenStack global Endpoint Protos
openstack_service_publicuri_proto: https
openstack_service_adminuri_proto: http
openstack_service_internaluri_proto: http
## Region Name
service_region: RegionOne
## OpenStack Domain
openstack_domain: openstack.local
lxc_container_domain: "{{ container_domain }}"
container_domain: "{{ openstack_domain }}"
## DHCP Domain Name
dhcp_domain: openstacklocal
## LDAP enabled toggle
service_ldap_backend_enabled: "{{ keystone_ldap is defined and keystone_ldap.Default is defined }}"
## Base venv configuration
venv_tag: "{{ openstack_release }}"
## Gnocchi
# Used in both Gnocchi and Swift roles.
gnocchi_service_project_name: "{{ (gnocchi_storage_driver is defined and gnocchi_storage_driver == 'swift') | ternary('gnocchi_swift', 'service') }}"
## OpenStack Openrc
openrc_os_auth_url: "{{ keystone_service_internalurl }}"
openrc_os_password: "{{ keystone_auth_admin_password }}"
openrc_os_domain_name: "Default"
openrc_region_name: "{{ service_region }}"
## Host security hardening
# The ansible-hardening role provides security hardening for hosts
# by applying security configurations from the STIG. Hardening is enabled by
# default, but an option to opt out is available by setting the following
# variable to 'false'.
# Docs: https://docs.openstack.org/ansible-hardening/latest/
apply_security_hardening: true
## Ansible ssh configuration
ansible_ssh_extra_args: >
-o UserKnownHostsFile=/dev/null
-o StrictHostKeyChecking=no
-o ServerAliveInterval=64
-o ServerAliveCountMax=1024
-o Compression=no
-o TCPKeepAlive=yes
-o VerifyHostKeyDNS=no
-o ForwardX11=no
-o ForwardAgent=yes
-T
# Toggle whether the service is deployed in a container or not
is_metal: >-
{{ (properties is defined) and
(properties.is_metal is defined) and
(properties.is_metal | bool) }}
_global_pins_file_path: "{{ openstack_clone_root }}/global-requirement-pins.txt"
venv_build_global_constraints: >-
{{ lookup('file', _global_pins_file_path).splitlines() | reject('match','^#.*$') | reject('equalto', '') | list }}