1bfed045cf
To prevent a security issue. More details in the reno. Change-Id: I8bb398e299aa68147004723a18d3a1ec459011e5 Closes-Bug: #1945453
40 lines
1.8 KiB
YAML
40 lines
1.8 KiB
YAML
---
|
|
- name: Load and persist ip6_tables module
|
|
include_role:
|
|
name: module-load
|
|
vars:
|
|
modules:
|
|
- {'name': ip6_tables}
|
|
when: >-
|
|
neutron_services |
|
|
select_services_enabled_and_mapped_to_host |
|
|
list |
|
|
intersect([ "neutron-l3-agent", "neutron-linuxbridge-agent", "neutron-openvswitch-agent" ]) |
|
|
list |
|
|
length > 0
|
|
|
|
- name: Setting sysctl values
|
|
become: true
|
|
vars:
|
|
neutron_l3_agent: "{{ neutron_services['neutron-l3-agent'] }}"
|
|
should_set: "{{ item.value != 'KOLLA_UNSET' }}"
|
|
sysctl:
|
|
name: "{{ item.name }}"
|
|
state: "{{ should_set | ternary('present', 'absent') }}"
|
|
value: "{{ should_set | ternary(item.value, omit) }}"
|
|
sysctl_set: "{{ should_set }}"
|
|
sysctl_file: "{{ kolla_sysctl_conf_path }}"
|
|
with_items:
|
|
- { name: "net.ipv4.conf.all.rp_filter", value: "{{ neutron_l3_agent_host_rp_filter_mode }}"}
|
|
- { name: "net.ipv4.conf.default.rp_filter", value: "{{ neutron_l3_agent_host_rp_filter_mode }}"}
|
|
- { name: "net.ipv4.neigh.default.gc_thresh1", value: "{{ neutron_l3_agent_host_ipv4_neigh_gc_thresh1 }}"}
|
|
- { name: "net.ipv4.neigh.default.gc_thresh2", value: "{{ neutron_l3_agent_host_ipv4_neigh_gc_thresh2 }}"}
|
|
- { name: "net.ipv4.neigh.default.gc_thresh3", value: "{{ neutron_l3_agent_host_ipv4_neigh_gc_thresh3 }}"}
|
|
- { name: "net.ipv6.neigh.default.gc_thresh1", value: "{{ neutron_l3_agent_host_ipv6_neigh_gc_thresh1 }}"}
|
|
- { name: "net.ipv6.neigh.default.gc_thresh2", value: "{{ neutron_l3_agent_host_ipv6_neigh_gc_thresh2 }}"}
|
|
- { name: "net.ipv6.neigh.default.gc_thresh3", value: "{{ neutron_l3_agent_host_ipv6_neigh_gc_thresh3 }}"}
|
|
when:
|
|
- set_sysctl | bool
|
|
- item.value != 'KOLLA_SKIP'
|
|
- (neutron_l3_agent.enabled | bool and neutron_l3_agent.host_in_groups | bool)
|