b78c5e54ab
Currently neutron-ns-metadata-proxy runs with root permissions when namespaces are enabled on the l3 agent because root permissions are required to "enter" in the namespace. But neutron-ns-metadata-proxy permissions should be reduced as much as possible because it is reachable from vms. This change allows to change neutron-ns-metadata-proxy permissions after its startup through the 2 new options metadata_proxy_user and metadata_proxy_group which allow to define user/group running metadata proxy after its initialization. Their default values are neutron-l3-agent effective user and group. Permissions drop is done after metadata proxy daemon writes its pid in its pidfile (it could be disallowed after permissions drop). Using nobody as metadata_proxy_user/group (more secure) is currently not supported because: * nobody has not the permission to connect the metadata socket, * nobody has not the permission to log to file because neutron uses WatchedFileHandler (which requires read/write permissions after permissions drop). This limitation will be addressed in a daughter change. DocImpact Partial-Bug: #1187107 Change-Id: I55c8c3fb14ed91ae8570f98f19c2cdbaf89d42fc
111 lines
4.2 KiB
INI
111 lines
4.2 KiB
INI
[DEFAULT]
|
|
# Show debugging output in log (sets DEBUG log level output)
|
|
# debug = False
|
|
|
|
# L3 requires that an interface driver be set. Choose the one that best
|
|
# matches your plugin.
|
|
# interface_driver =
|
|
|
|
# Example of interface_driver option for OVS based plugins (OVS, Ryu, NEC)
|
|
# that supports L3 agent
|
|
# interface_driver = neutron.agent.linux.interface.OVSInterfaceDriver
|
|
|
|
# Use veth for an OVS interface or not.
|
|
# Support kernels with limited namespace support
|
|
# (e.g. RHEL 6.5) so long as ovs_use_veth is set to True.
|
|
# ovs_use_veth = False
|
|
|
|
# Example of interface_driver option for LinuxBridge
|
|
# interface_driver = neutron.agent.linux.interface.BridgeInterfaceDriver
|
|
|
|
# Allow overlapping IP (Must have kernel build with CONFIG_NET_NS=y and
|
|
# iproute2 package that supports namespaces).
|
|
# use_namespaces = True
|
|
|
|
# If use_namespaces is set as False then the agent can only configure one router.
|
|
|
|
# This is done by setting the specific router_id.
|
|
# router_id =
|
|
|
|
# When external_network_bridge is set, each L3 agent can be associated
|
|
# with no more than one external network. This value should be set to the UUID
|
|
# of that external network. To allow L3 agent support multiple external
|
|
# networks, both the external_network_bridge and gateway_external_network_id
|
|
# must be left empty.
|
|
# gateway_external_network_id =
|
|
|
|
# Indicates that this L3 agent should also handle routers that do not have
|
|
# an external network gateway configured. This option should be True only
|
|
# for a single agent in a Neutron deployment, and may be False for all agents
|
|
# if all routers must have an external network gateway
|
|
# handle_internal_only_routers = True
|
|
|
|
# Name of bridge used for external network traffic. This should be set to
|
|
# empty value for the linux bridge. when this parameter is set, each L3 agent
|
|
# can be associated with no more than one external network.
|
|
# external_network_bridge = br-ex
|
|
|
|
# TCP Port used by Neutron metadata server
|
|
# metadata_port = 9697
|
|
|
|
# User (uid or name) running metadata proxy after its initialization
|
|
# (if empty: L3 agent effective user)
|
|
# metadata_proxy_user =
|
|
|
|
# Group (gid or name) running metadata proxy after its initialization
|
|
# (if empty: L3 agent effective group)
|
|
# metadata_proxy_group =
|
|
|
|
# Send this many gratuitous ARPs for HA setup. Set it below or equal to 0
|
|
# to disable this feature.
|
|
# send_arp_for_ha = 3
|
|
|
|
# seconds between re-sync routers' data if needed
|
|
# periodic_interval = 40
|
|
|
|
# seconds to start to sync routers' data after
|
|
# starting agent
|
|
# periodic_fuzzy_delay = 5
|
|
|
|
# enable_metadata_proxy, which is true by default, can be set to False
|
|
# if the Nova metadata server is not available
|
|
# enable_metadata_proxy = True
|
|
|
|
# Location of Metadata Proxy UNIX domain socket
|
|
# metadata_proxy_socket = $state_path/metadata_proxy
|
|
|
|
# router_delete_namespaces, which is false by default, can be set to True if
|
|
# namespaces can be deleted cleanly on the host running the L3 agent.
|
|
# Do not enable this until you understand the problem with the Linux iproute
|
|
# utility mentioned in https://bugs.launchpad.net/neutron/+bug/1052535 and
|
|
# you are sure that your version of iproute does not suffer from the problem.
|
|
# If True, namespaces will be deleted when a router is destroyed.
|
|
# router_delete_namespaces = False
|
|
|
|
# Timeout for ovs-vsctl commands.
|
|
# If the timeout expires, ovs commands will fail with ALARMCLOCK error.
|
|
# ovs_vsctl_timeout = 10
|
|
|
|
# The working mode for the agent. Allowed values are:
|
|
# - legacy: this preserves the existing behavior where the L3 agent is
|
|
# deployed on a centralized networking node to provide L3 services
|
|
# like DNAT, and SNAT. Use this mode if you do not want to adopt DVR.
|
|
# - dvr: this mode enables DVR functionality, and must be used for an L3
|
|
# agent that runs on a compute host.
|
|
# - dvr_snat: this enables centralized SNAT support in conjunction with
|
|
# DVR. This mode must be used for an L3 agent running on a centralized
|
|
# node (or in single-host deployments, e.g. devstack).
|
|
# agent_mode = legacy
|
|
|
|
# Location to store keepalived and all HA configurations
|
|
# ha_confs_path = $state_path/ha_confs
|
|
|
|
# VRRP authentication type AH/PASS
|
|
# ha_vrrp_auth_type = PASS
|
|
|
|
# VRRP authentication password
|
|
# ha_vrrp_auth_password =
|
|
|
|
# The advertisement interval in seconds
|
|
# ha_vrrp_advert_int = 2
|