283fa242ca
As per the RBAC new direction in Zed cycle, we have dropped the system scope from API policies and all the policies are hardcoded to project scoped so that any user accessing APIs using system scope will get 403 error. It is dropped from all the OpenStack services except for the Ironic service which will have system scope and to support ironic only deployment, we are keeping system as well as project scope in Keystone. Complete discussion and direction can be found in the below gerrit change and TC goal direction: - https://review.opendev.org/c/openstack/governance/+/847418 - https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rbac.html#the-issues-we-are-facing-with-scope-concept As phase-2 of RBAC goal, services will start enabling the new defaults and project scope by default. For example: Nova did in - https://review.opendev.org/c/openstack/nova/+/866218 Kolla who start accessing the services using system scope token - https://review.opendev.org/c/openstack/kolla-ansible/+/692179 This commit partially revert the above change except keeping system scope usage for Keystone and Ironic. Rest all services are changed to use the project scope token. And enable the scope and new defaults for Nova which was disabled by https://review.opendev.org/c/openstack/kolla-ansible/+/870804 Change-Id: I0adbe0a6c39e11d7c9542569085fc5d580f26c9d
207 lines
6.5 KiB
Django/Jinja
207 lines
6.5 KiB
Django/Jinja
# nova.conf
|
|
[DEFAULT]
|
|
debug = {{ nova_logging_debug }}
|
|
|
|
{% if service_name == "nova-super-conductor" %}
|
|
log_file = /var/log/kolla/nova/nova-super-conductor.log
|
|
{% elif service_name == "nova-api" %}
|
|
log_file = /var/log/kolla/nova/nova-api.log
|
|
{% else %}
|
|
log_dir = /var/log/kolla/nova
|
|
{% endif %}
|
|
|
|
state_path = /var/lib/nova
|
|
allow_resize_to_same_host = true
|
|
|
|
# Though my_ip is not used directly, lots of other variables use $my_ip
|
|
my_ip = {{ api_interface_address }}
|
|
|
|
{% if enable_ceilometer | bool or enable_designate | bool %}
|
|
instance_usage_audit = True
|
|
instance_usage_audit_period = hour
|
|
{% endif %}
|
|
|
|
transport_url = {{ rpc_transport_url }}
|
|
|
|
[filter_scheduler]
|
|
{% if enable_blazar | bool %}
|
|
available_filters = nova.scheduler.filters.all_filters
|
|
available_filters = blazarnova.scheduler.filters.blazar_filter.BlazarFilter
|
|
enabled_filters = ComputeFilter,ComputeCapabilitiesFilter,ImagePropertiesFilter,ServerGroupAntiAffinityFilter,ServerGroupAffinityFilter,BlazarFilter
|
|
{% endif %}
|
|
{% if enable_nova_fake | bool %}
|
|
enabled_filters = ComputeFilter,ComputeCapabilitiesFilter,ImagePropertiesFilter
|
|
{% endif %}
|
|
{% if enable_cells | bool %}
|
|
# When in superconductor mode, nova-compute can't send instance
|
|
# info updates to the scheduler, so just disable it.
|
|
track_instance_changes = False
|
|
{% endif %}
|
|
|
|
[api]
|
|
use_forwarded_for = true
|
|
|
|
{% if vendordata_file_path is defined %}
|
|
vendordata_jsonfile_path = /etc/nova/vendordata.json
|
|
{% endif %}
|
|
|
|
# Super conductor
|
|
[conductor]
|
|
workers = {{ nova_superconductor_workers }}
|
|
|
|
[oslo_middleware]
|
|
enable_proxy_headers_parsing = True
|
|
|
|
[oslo_concurrency]
|
|
lock_path = /var/lib/nova/tmp
|
|
|
|
[glance]
|
|
cafile = {{ openstack_cacert }}
|
|
api_servers = {{ glance_internal_endpoint }}
|
|
|
|
num_retries = {{ groups['glance-api'] | length }}
|
|
debug = {{ nova_logging_debug }}
|
|
|
|
{% if enable_cinder | bool %}
|
|
[cinder]
|
|
catalog_info = volumev3:cinderv3:internalURL
|
|
os_region_name = {{ openstack_region_name }}
|
|
auth_url = {{ keystone_internal_url }}
|
|
auth_type = password
|
|
project_domain_name = {{ default_project_domain_name }}
|
|
user_domain_id = {{ default_user_domain_id }}
|
|
project_name = service
|
|
username = {{ cinder_keystone_user }}
|
|
password = {{ cinder_keystone_password }}
|
|
cafile = {{ openstack_cacert }}
|
|
{% endif %}
|
|
|
|
[neutron]
|
|
metadata_proxy_shared_secret = {{ metadata_secret }}
|
|
service_metadata_proxy = true
|
|
auth_url = {{ keystone_internal_url }}
|
|
auth_type = password
|
|
project_domain_name = {{ default_project_domain_name }}
|
|
user_domain_id = {{ default_user_domain_id }}
|
|
project_name = service
|
|
username = {{ neutron_keystone_user }}
|
|
password = {{ neutron_keystone_password }}
|
|
region_name = {{ openstack_region_name }}
|
|
valid_interfaces = internal
|
|
cafile = {{ openstack_cacert }}
|
|
|
|
[database]
|
|
connection = mysql+pymysql://{{ nova_cell0_database_user }}:{{ nova_cell0_database_password }}@{{ nova_cell0_database_address }}/{{ nova_cell0_database_name }}
|
|
connection_recycle_time = {{ database_connection_recycle_time }}
|
|
max_overflow = 1000
|
|
max_pool_size = {{ database_max_pool_size }}
|
|
max_retries = -1
|
|
|
|
[api_database]
|
|
connection = mysql+pymysql://{{ nova_api_database_user }}:{{ nova_api_database_password }}@{{ nova_api_database_address }}/{{ nova_api_database_name }}
|
|
connection_recycle_time = {{ database_connection_recycle_time }}
|
|
max_pool_size = {{ database_max_pool_size }}
|
|
max_retries = -1
|
|
|
|
[cache]
|
|
backend = oslo_cache.memcache_pool
|
|
enabled = True
|
|
memcache_servers = {% for host in groups['memcached'] %}{{ 'api' | kolla_address(host) | put_address_in_context('memcache') }}:{{ memcached_port }}{% if not loop.last %},{% endif %}{% endfor %}
|
|
|
|
|
|
[keystone_authtoken]
|
|
service_type = compute
|
|
www_authenticate_uri = {{ keystone_internal_url }}
|
|
auth_url = {{ keystone_internal_url }}
|
|
auth_type = password
|
|
project_domain_id = {{ default_project_domain_id }}
|
|
user_domain_id = {{ default_user_domain_id }}
|
|
project_name = service
|
|
username = {{ nova_keystone_user }}
|
|
password = {{ nova_keystone_password }}
|
|
cafile = {{ openstack_cacert }}
|
|
region_name = {{ openstack_region_name }}
|
|
|
|
memcache_security_strategy = ENCRYPT
|
|
memcache_secret_key = {{ memcache_secret_key }}
|
|
memcached_servers = {% for host in groups['memcached'] %}{{ 'api' | kolla_address(host) | put_address_in_context('memcache') }}:{{ memcached_port }}{% if not loop.last %},{% endif %}{% endfor %}
|
|
|
|
[upgrade_levels]
|
|
compute = auto
|
|
|
|
[oslo_messaging_notifications]
|
|
transport_url = {{ notify_transport_url }}
|
|
{% if nova_enabled_notification_topics %}
|
|
driver = messagingv2
|
|
topics = {{ nova_enabled_notification_topics | map(attribute='name') | join(',') }}
|
|
{% else %}
|
|
driver = noop
|
|
{% endif %}
|
|
|
|
[oslo_messaging_rabbit]
|
|
heartbeat_in_pthread = {{ service_name == 'nova-api' }}
|
|
{% if om_enable_rabbitmq_tls | bool %}
|
|
ssl = true
|
|
ssl_ca_file = {{ om_rabbitmq_cacert }}
|
|
{% endif %}
|
|
{% if om_enable_rabbitmq_high_availability | bool %}
|
|
amqp_durable_queues = true
|
|
{% endif %}
|
|
|
|
[oslo_policy]
|
|
{% if service_name in nova_services_require_policy_json and nova_policy_file is defined %}
|
|
policy_file = {{ nova_policy_file }}
|
|
{% endif %}
|
|
|
|
[privsep_entrypoint]
|
|
helper_command=sudo nova-rootwrap /etc/nova/rootwrap.conf privsep-helper --config-file /etc/nova/nova.conf
|
|
|
|
[guestfs]
|
|
debug = {{ nova_logging_debug }}
|
|
|
|
[wsgi]
|
|
api_paste_config = /etc/nova/api-paste.ini
|
|
{% if kolla_enable_tls_external | bool or kolla_enable_tls_internal | bool %}
|
|
secure_proxy_ssl_header = HTTP_X_FORWARDED_PROTO
|
|
{% endif %}
|
|
|
|
[scheduler]
|
|
max_attempts = 10
|
|
# NOTE(yoctozepto): kolla-ansible handles cell mapping by itself on each deploy
|
|
# periodic run must be disabled to avoid random failures (where both try to map)
|
|
# -1 is default and means periodic discovery is disabled
|
|
discover_hosts_in_cells_interval = -1
|
|
workers = {{ nova_scheduler_workers }}
|
|
|
|
[placement]
|
|
auth_type = password
|
|
auth_url = {{ keystone_internal_url }}
|
|
username = {{ placement_keystone_user }}
|
|
password = {{ placement_keystone_password }}
|
|
user_domain_name = {{ default_user_domain_name }}
|
|
project_name = service
|
|
project_domain_name = {{ default_project_domain_name }}
|
|
region_name = {{ openstack_region_name }}
|
|
cafile = {{ openstack_cacert }}
|
|
valid_interfaces = internal
|
|
|
|
[notifications]
|
|
{% if enable_ceilometer | bool or enable_designate | bool or enable_neutron_infoblox_ipam_agent | bool %}
|
|
notify_on_state_change = vm_and_task_state
|
|
{% endif %}
|
|
|
|
{% if enable_osprofiler | bool %}
|
|
[profiler]
|
|
enabled = true
|
|
trace_sqlalchemy = true
|
|
hmac_keys = {{ osprofiler_secret }}
|
|
connection_string = {{ osprofiler_backend_connection_string }}
|
|
{% endif %}
|
|
|
|
{% if enable_barbican | bool %}
|
|
[barbican]
|
|
auth_endpoint = {{ keystone_internal_url }}
|
|
barbican_endpoint_type = internal
|
|
verify_ssl_path = {{ openstack_cacert }}
|
|
{% endif %}
|