tripleo-heat-templates/puppet/services/kernel.yaml
Ihar Hrachyshka 804fd3427e Enable arp_accept for all interfaces
OpenStack heavily relies on gratuitous ARP updates when moving floating
IP addresses between devices. When a floating IP moves, Neutron L3 agent
issues a burst of gratuitous ARP packets that should update any existing
ARP table entries on all nodes that belong to the same network segment.

Due to locktime kernel behavior, some gratuitous ARP packets may be
ignored [1], rendering ARP table entries broken for some time. Due to a
kernel bug [2], the time may be as long as hours, depending on other
traffic flowing to the node.

With the current EL7 kernel, the only way to make sure that nodes honor
all sent gratuitous ARP updates is to set arp_accept to 1; this will
disable locktime mechanism for the packets sent by Neutron L3 agent, and
will make sure ARP tables are always updated.

[1] https://patchwork.ozlabs.org/patch/762732/
[2] https://bugzilla.redhat.com/show_bug.cgi?id=1450203

Related-Bug: #1690165
Change-Id: I863b240e0ab4c4d5bb844f91b607fd0937d5cedf
2017-05-25 13:24:51 -07:00

130 lines
4.5 KiB
YAML

heat_template_version: pike
description: >
Load kernel modules with kmod and configure kernel options with sysctl.
parameters:
ServiceNetMap:
default: {}
description: Mapping of service_name -> network name. Typically set
via parameter_defaults in the resource registry. This
mapping overrides those in ServiceNetMapDefaults.
type: json
DefaultPasswords:
default: {}
type: json
RoleName:
default: ''
description: Role name on which the service is applied
type: string
RoleParameters:
default: {}
description: Parameters specific to the role
type: json
EndpointMap:
default: {}
description: Mapping of service endpoint -> protocol. Typically set
via parameter_defaults in the resource registry.
type: json
KernelPidMax:
default: 1048576
description: Configures sysctl kernel.pid_max key
type: number
KernelDisableIPv6:
default: 0
description: Configures sysctl net.ipv6.{default/all}.disable_ipv6 keys
type: number
NeighbourGcThreshold1:
default: 1024
description: Configures sysctl net.ipv4.neigh.default.gc_thresh1 value.
This is the minimum number of entries to keep in the ARP
cache. The garbage collector will not run if there are
fewer than this number of entries in the cache.
type: number
NeighbourGcThreshold2:
default: 2048
description: Configures sysctl net.ipv4.neigh.default.gc_thresh2 value.
This is the soft maximum number of entries to keep in the
ARP cache. The garbage collector will allow the number of
entries to exceed this for 5 seconds before collection will
be performed.
type: number
NeighbourGcThreshold3:
default: 4096
description: Configures sysctl net.ipv4.neigh.default.gc_thresh3 value.
This is the hard maximum number of entries to keep in the
ARP cache. The garbage collector will always run if there
are more than this number of entries in the cache.
type: number
outputs:
role_data:
description: Role data for the Kernel modules
value:
service_name: kernel
config_settings:
kernel_modules:
nf_conntrack: {}
nf_conntrack_proto_sctp: {}
sysctl_settings:
net.ipv4.tcp_keepalive_intvl:
value: 1
net.ipv4.tcp_keepalive_probes:
value: 5
net.ipv4.tcp_keepalive_time:
value: 5
net.ipv4.conf.default.send_redirects:
value: 0
net.ipv4.conf.all.send_redirects:
value: 0
net.ipv4.conf.all.arp_accept:
value: 1
net.ipv4.conf.default.accept_redirects:
value: 0
net.ipv4.conf.default.secure_redirects:
value: 0
net.ipv4.conf.all.secure_redirects:
value: 0
net.ipv4.conf.default.log_martians:
value: 1
net.ipv4.conf.all.log_martians:
value: 1
net.nf_conntrack_max:
value: 500000
net.netfilter.nf_conntrack_max:
value: 500000
net.ipv6.conf.default.disable_ipv6:
value: {get_param: KernelDisableIPv6}
net.ipv6.conf.all.disable_ipv6:
value: {get_param: KernelDisableIPv6}
# prevent neutron bridges from autoconfiguring ipv6 addresses
net.ipv6.conf.all.accept_ra:
value: 0
net.ipv6.conf.default.accept_ra:
value: 0
net.ipv6.conf.all.autoconf:
value: 0
net.ipv6.conf.default.autoconf:
value: 0
net.ipv6.conf.default.accept_redirects:
value: 0
net.ipv6.conf.all.accept_redirects:
value: 0
net.core.netdev_max_backlog:
value: 10000
kernel.pid_max:
value: {get_param: KernelPidMax}
kernel.dmesg_restrict:
value: 1
fs.suid_dumpable:
value: 0
#avoid neighbour table overflow on large deployments
net.ipv4.neigh.default.gc_thresh1:
value: {get_param: NeighbourGcThreshold1}
net.ipv4.neigh.default.gc_thresh2:
value: {get_param: NeighbourGcThreshold2}
net.ipv4.neigh.default.gc_thresh3:
value: {get_param: NeighbourGcThreshold3}
step_config: |
include ::tripleo::profile::base::kernel