Enable firewalling by default on compute nodes
- Move VXLAN and VRRP rules from Neutron Server to the right services. - Enable Firewall by default on Compute nodes. Change-Id: I99d172dcedaf6be297aad184cc51fe9f292a57e1
This commit is contained in:
parent
ddd4d3cd9f
commit
7322d60610
|
@ -41,5 +41,8 @@ outputs:
|
|||
config_settings:
|
||||
tripleo::keepalived::control_virtual_interface: {get_param: ControlVirtualInterface}
|
||||
tripleo::keepalived::public_virtual_interface: {get_param: PublicVirtualInterface}
|
||||
tripleo.keepalived.firewall_rules:
|
||||
'106 keepalived vrrp':
|
||||
proto: vrrp
|
||||
step_config: |
|
||||
include ::tripleo::profile::base::keepalived
|
||||
|
|
|
@ -150,11 +150,6 @@ outputs:
|
|||
dport:
|
||||
- 9696
|
||||
- 13696
|
||||
'118 neutron vxlan networks':
|
||||
proto: 'udp'
|
||||
dport: 4789
|
||||
'106 vrrp':
|
||||
proto: vrrp
|
||||
neutron::server::router_distributed: {get_param: NeutronEnableDVR}
|
||||
# NOTE: bind IP is found in Heat replacing the network name with the local node IP
|
||||
# for the given network; replacement examples (eg. for internal_api):
|
||||
|
|
|
@ -67,5 +67,8 @@ outputs:
|
|||
- neutron::agents::l3::external_network_bridge: {get_param: NeutronExternalNetworkBridge}
|
||||
neutron::agents::l3::router_delete_namespaces: True
|
||||
neutron::agents::l3::agent_mode : {get_param: NeutronL3AgentMode}
|
||||
tripleo.neutron_l3.firewall_rules:
|
||||
'106 neutron_l3 vrrp':
|
||||
proto: vrrp
|
||||
step_config: |
|
||||
include tripleo::profile::base::neutron::l3
|
||||
|
|
|
@ -117,5 +117,11 @@ outputs:
|
|||
# internal_api_subnet - > IP/CIDR
|
||||
neutron::agents::ml2::ovs::local_ip: {get_param: [ServiceNetMap, NeutronTenantNetwork]}
|
||||
neutron::agents::ml2::ovs::firewall_driver: {get_param: NeutronOVSFirewallDriver}
|
||||
tripleo.neutron_ovs_agent.firewall_rules:
|
||||
'118 neutron vxlan networks':
|
||||
proto: 'udp'
|
||||
dport: 4789
|
||||
'136 neutron gre networks':
|
||||
proto: 'gre'
|
||||
step_config: |
|
||||
include ::tripleo::profile::base::neutron::ovs
|
||||
|
|
|
@ -114,9 +114,7 @@
|
|||
- OS::TripleO::Services::ComputeNeutronL3Agent
|
||||
- OS::TripleO::Services::ComputeNeutronMetadataAgent
|
||||
- OS::TripleO::Services::TripleoPackages
|
||||
# FIXME: This doesn't appear to have been enabled before
|
||||
# so disabling it here until we can support it
|
||||
#- OS::TripleO::Services::TripleoFirewall
|
||||
- OS::TripleO::Services::TripleoFirewall
|
||||
- OS::TripleO::Services::NeutronSriovAgent
|
||||
- OS::TripleO::Services::OpenDaylightOvs
|
||||
- OS::TripleO::Services::SensuClient
|
||||
|
|
Loading…
Reference in New Issue