2adb2b6f57
Currently when deploying with TLS for internal API traffic, Neutron is not configured to securely communicate with OVSDB. In regular OVS agent deployments OVS listens on ptcp and accepts any incoming connection. In ODL deployments OVS is configured to only listen for pssl connections. To allow Neutron agents to communicate with OVSDB in pssl, Neutron needs to be configured with SSL key/certificate in order to connect to OVS. This patch adds key/certificate generation for NeutronBase service to be consumed by any agent. The only agent required with ODL is DHCP, so this patch only addresses configuring SSL there. However, a future patch could enable SSL for default ML2/OVS agent deployments as well by building off of this change. Note, by default OVSDB listens on port 6640. This does not work in ODL deployments when ODL is on the control node because ODL also listens on port 6640. Therefore from the ODL service, the ovsdb_connection setting for DHCP agent is modified when ODL is deployed. Depends-On: I82281eefa1aa81207ccd8ea565cffc6ca0ec48de Depends-On: I4bbaf00f0776cab0be34d814a541fb2fd1e64326 Closes-Bug: 1746762 Change-Id: I97352027d7f750d0820610fb9e06f82b47e77056 Signed-off-by: Tim Rozet <trozet@redhat.com>
184 lines
6.5 KiB
YAML
184 lines
6.5 KiB
YAML
heat_template_version: queens
|
|
|
|
description: >
|
|
OpenStack Neutron base service. Shared for all Neutron agents.
|
|
|
|
parameters:
|
|
RabbitPassword:
|
|
description: The password for RabbitMQ
|
|
type: string
|
|
hidden: true
|
|
RabbitUserName:
|
|
default: guest
|
|
description: The username for RabbitMQ
|
|
type: string
|
|
RabbitClientUseSSL:
|
|
default: false
|
|
description: >
|
|
Rabbit client subscriber parameter to specify
|
|
an SSL connection to the RabbitMQ host.
|
|
type: string
|
|
RabbitClientPort:
|
|
default: 5672
|
|
description: Set rabbit subscriber port, change this if using SSL
|
|
type: number
|
|
DatabaseSyncTimeout:
|
|
default: 300
|
|
description: DB Sync Timeout default
|
|
type: number
|
|
NeutronDhcpAgentsPerNetwork:
|
|
type: number
|
|
default: 0
|
|
description: The number of neutron dhcp agents to schedule per network
|
|
DhcpAgentNotification:
|
|
default: true
|
|
description: Whether or not to enable DHCP agent notifications.
|
|
type: boolean
|
|
NeutronDnsDomain:
|
|
type: string
|
|
default: openstacklocal
|
|
description: Domain to use for building the hostnames.
|
|
NeutronCorePlugin:
|
|
default: 'ml2'
|
|
description: |
|
|
The core plugin for Neutron. The value should be the entrypoint to be loaded
|
|
from neutron.core_plugins namespace.
|
|
type: string
|
|
NeutronServicePlugins:
|
|
default: "router,qos,trunk"
|
|
description: |
|
|
Comma-separated list of service plugin entrypoints to be loaded from the
|
|
neutron.service_plugins namespace.
|
|
type: comma_delimited_list
|
|
Debug:
|
|
type: boolean
|
|
default: false
|
|
description: Set to True to enable debugging on all services.
|
|
NeutronDebug:
|
|
default: ''
|
|
description: Set to True to enable debugging Neutron services.
|
|
type: string
|
|
constraints:
|
|
- allowed_values: [ '', 'true', 'True', 'TRUE', 'false', 'False', 'FALSE']
|
|
EnableConfigPurge:
|
|
type: boolean
|
|
default: false
|
|
description: >
|
|
Remove configuration that is not generated by TripleO. Used to avoid
|
|
configuration remnants after upgrades.
|
|
NeutronGlobalPhysnetMtu:
|
|
type: number
|
|
default: 1500
|
|
description: |
|
|
MTU of the underlying physical network. Neutron uses this value to
|
|
calculate MTU for all virtual network components. For flat and VLAN
|
|
networks, neutron uses this value without modification. For overlay
|
|
networks such as VXLAN, neutron automatically subtracts the overlay
|
|
protocol overhead from this value.
|
|
NeutronDBSyncExtraParams:
|
|
default: ''
|
|
description: |
|
|
String of extra command line parameters to append to the neutron-db-manage
|
|
upgrade head command.
|
|
type: string
|
|
ServiceData:
|
|
default: {}
|
|
description: Dictionary packing service data
|
|
type: json
|
|
ServiceNetMap:
|
|
default: {}
|
|
description: Mapping of service_name -> network name. Typically set
|
|
via parameter_defaults in the resource registry. This
|
|
mapping overrides those in ServiceNetMapDefaults.
|
|
type: json
|
|
DefaultPasswords:
|
|
default: {}
|
|
type: json
|
|
RoleName:
|
|
default: ''
|
|
description: Role name on which the service is applied
|
|
type: string
|
|
RoleParameters:
|
|
default: {}
|
|
description: Parameters specific to the role
|
|
type: json
|
|
EndpointMap:
|
|
default: {}
|
|
description: Mapping of service endpoint -> protocol. Typically set
|
|
via parameter_defaults in the resource registry.
|
|
type: json
|
|
NotificationDriver:
|
|
type: string
|
|
default: 'messagingv2'
|
|
description: Driver or drivers to handle sending notifications.
|
|
constraints:
|
|
- allowed_values: [ 'messagingv2', 'noop' ]
|
|
EnableInternalTLS:
|
|
type: boolean
|
|
default: false
|
|
|
|
conditions:
|
|
dhcp_agents_zero: {equals : [{get_param: NeutronDhcpAgentsPerNetwork}, 0]}
|
|
service_debug_unset: {equals : [{get_param: NeutronDebug}, '']}
|
|
internal_tls_enabled: {equals: [{get_param: EnableInternalTLS}, true]}
|
|
|
|
outputs:
|
|
role_data:
|
|
description: Role data for the Neutron base service.
|
|
value:
|
|
service_name: neutron_base
|
|
config_settings:
|
|
map_merge:
|
|
- neutron::rabbit_password: {get_param: RabbitPassword}
|
|
neutron::rabbit_user: {get_param: RabbitUserName}
|
|
neutron::rabbit_use_ssl: {get_param: RabbitClientUseSSL}
|
|
neutron::rabbit_port: {get_param: RabbitClientPort}
|
|
neutron::notification_driver: {get_param: NotificationDriver}
|
|
neutron::core_plugin: {get_param: NeutronCorePlugin}
|
|
neutron::service_plugins: {get_param: NeutronServicePlugins}
|
|
neutron::debug:
|
|
if:
|
|
- service_debug_unset
|
|
- {get_param: Debug }
|
|
- {get_param: NeutronDebug }
|
|
neutron::purge_config: {get_param: EnableConfigPurge}
|
|
neutron::allow_overlapping_ips: true
|
|
neutron::dhcp_agent_notification: {get_param: DhcpAgentNotification}
|
|
neutron::dns_domain: {get_param: NeutronDnsDomain}
|
|
neutron::rabbit_heartbeat_timeout_threshold: 60
|
|
neutron::host: '%{::fqdn}'
|
|
neutron::db::database_db_max_retries: -1
|
|
neutron::db::database_max_retries: -1
|
|
neutron::db::sync::db_sync_timeout: {get_param: DatabaseSyncTimeout}
|
|
neutron::global_physnet_mtu: {get_param: NeutronGlobalPhysnetMtu}
|
|
neutron::db::sync::extra_params: {get_param: NeutronDBSyncExtraParams}
|
|
- if:
|
|
- dhcp_agents_zero
|
|
- {}
|
|
- tripleo::profile::base::neutron::dhcp_agents_per_network: {get_param: NeutronDhcpAgentsPerNetwork}
|
|
- if:
|
|
- internal_tls_enabled
|
|
- generate_service_certificates: true
|
|
tripleo::profile::base::neutron::certificate_specs:
|
|
service_certificate: '/etc/pki/tls/certs/neutron.crt'
|
|
service_key: '/etc/pki/tls/private/neutron.key'
|
|
hostname:
|
|
str_replace:
|
|
template: "%{hiera('fqdn_NETWORK')}"
|
|
params:
|
|
NETWORK: {get_param: [ServiceNetMap, NeutronApiNetwork]}
|
|
principal:
|
|
str_replace:
|
|
template: "neutron/%{hiera('fqdn_NETWORK')}"
|
|
params:
|
|
NETWORK: {get_param: [ServiceNetMap, NeutronApiNetwork]}
|
|
- null
|
|
metadata_settings:
|
|
if:
|
|
- internal_tls_enabled
|
|
-
|
|
- service: neutron
|
|
network: {get_param: [ServiceNetMap, NeutronApiNetwork]}
|
|
type: node
|
|
- null
|