RETIRED, Heat templates for deploying OpenStack
7268d1ae14
* Disable Kernel Parameter for Sending ICMP Redirects:
- net.ipv4.conf.default.send_redirects = 0
- net.ipv4.conf.all.send_redirects = 0
Rationale: An attacker could use a compromised host
to send invalid ICMP redirects to other router devices
in an attempt to corrupt routing and have users access
a system set up by the attacker as opposed to a valid
system.
* Disable Kernel Parameter for Accepting ICMP Redirects:
- net.ipv4.conf.default.accept_redirects = 0
Rationale: Attackers could use bogus ICMP redirect
messages to maliciously alter the system routing tables
and get them to send packets to incorrect networks and
allow your system packets to be captured.
* Disable Kernel Parameter for secure ICMP Redirects:
- net.ipv4.conf.default.secure_redirects = 0
- net.ipv4.conf.all.secure_redirects = 0
Rationale: Secure ICMP redirects are the same as ICMP
redirects, except they come from gateways listed on
the default gateway list. It is assumed that these
gateways are known to your system, and that they are
likely to be secure.
* Enable Kernel Parameter to log suspicious packets:
- net.ipv4.conf.default.log_martians = 1
- net.ipv4.conf.all.log_martians = 1
Rationale: Enabling this feature and logging these packets
allows an administrator to investigate the possibility
that an attacker is sending spoofed packets to their system.
* Ensure IPv6 redirects are not accepted by Default
- net.ipv6.conf.all.accept_redirects = 0
- net.ipv6.conf.default.accept_redirects = 0
Rationale: It is recommended that systems not accept ICMP
redirects as they could be tricked into routing traffic to
compromised machines. Setting hard routes within the system
(usually a single default route to a trusted router) protects
the system from bad routes.
Change-Id: I2e8ab3141ee37ee6dd5a23d23dbb97c93610ea2e
Co-Authored-By: Luke Hinds <lhinds@redhat.com>
Signed-off-by: zshi <zshi@redhat.com>
|
||
|---|---|---|
| ci | ||
| deployed-server | ||
| docker | ||
| environments | ||
| extraconfig | ||
| firstboot | ||
| network | ||
| puppet | ||
| releasenotes | ||
| scripts | ||
| tools | ||
| validation-scripts | ||
| .gitignore | ||
| .gitreview | ||
| all-nodes-validation.yaml | ||
| babel.cfg | ||
| bindep.txt | ||
| bootstrap-config.yaml | ||
| capabilities-map.yaml | ||
| default_passwords.yaml | ||
| hosts-config.yaml | ||
| j2_excludes.yaml | ||
| LICENSE | ||
| MANIFEST.in | ||
| net-config-bond.yaml | ||
| net-config-bridge.yaml | ||
| net-config-linux-bridge.yaml | ||
| net-config-noop.yaml | ||
| net-config-static-bridge-with-external-dhcp.yaml | ||
| net-config-static-bridge.yaml | ||
| net-config-static.yaml | ||
| net-config-undercloud.yaml | ||
| overcloud-resource-registry-puppet.j2.yaml | ||
| overcloud.j2.yaml | ||
| plan-environment.yaml | ||
| README.rst | ||
| requirements.txt | ||
| roles_data_undercloud.yaml | ||
| roles_data.yaml | ||
| setup.cfg | ||
| setup.py | ||
| test-requirements.txt | ||
| tox.ini | ||
Team and repository tags
tripleo-heat-templates
Heat templates to deploy OpenStack using OpenStack.
- Free software: Apache license
- Documentation: http://docs.openstack.org/developer/tripleo-docs
- Source: http://git.openstack.org/cgit/openstack/tripleo-heat-templates
- Bugs: http://bugs.launchpad.net/tripleo
Features
The ability to deploy a multi-node, role based OpenStack deployment using OpenStack Heat. Notable features include:
- Choice of deployment/configuration tooling: puppet, (soon) docker
- Role based deployment: roles for the controller, compute, ceph, swift, and cinder storage
- physical network configuration: support for isolated networks, bonding, and standard ctlplane networking
Directories
A description of the directory layout in TripleO Heat Templates.
- environments: contains heat environment files that can be used with -e
on the command like to enable features, etc.
- extraconfig: templates used to enable 'extra' functionality. Includes
functionality for distro specific registration and upgrades.
- firstboot: example first_boot scripts that can be used when initially
creating instances.
- network: heat templates to help create isolated networks and ports
- puppet: templates mostly driven by configuration with puppet. To use these
templates you can use the overcloud-resource-registry-puppet.yaml.
- validation-scripts: validation scripts useful to all deployment
configurations
Service testing matrix
The configuration for the CI scenarios will be defined in tripleo-heat-templates/ci/ and should be executed according to the following table:
| - | scenario001 | scenario002 | scenario003 | scenario004 | multinode-nonha |
|---|---|---|---|---|---|
| keystone |
|
|
|
|
|
| glance |
|
|
|
swift + rbd |
|
| cinder |
|
|
|
||
| heat |
|
|
|
|
|
| mysql |
|
|
|
|
|
| neutron |
|
|
|
|
|
| rabbitmq |
|
|
|
|
|
| mongodb |
|
|
|||
| redis |
|
||||
| haproxy |
|
|
|
|
|
| keepalived |
|
|
|
|
|
| memcached |
|
|
|
|
|
| pacemaker |
|
|
|
|
|
| nova |
|
|
|
|
|
| ntp |
|
|
|
|
|
| snmp |
|
|
|
|
|
| timezone |
|
|
|
|
|
| sahara |
|
||||
| mistral |
|
||||
| swift |
|
|
|||
| aodh |
|
||||
| ceilometer |
|
||||
| gnocchi |
|
||||
| panko |
|
||||
| barbican |
|
||||
| zaqar |
|
||||
| ec2api |
|
||||
| cephrgw |
|
|
|||
| tacker |
|
||||
| congress |
|
||||
| cephmds |
|
||||
| manila |
|