Merge "docs: minor fixes with Geneve and HAProxy"
This commit is contained in:
@@ -187,9 +187,9 @@ The ``/etc/openstack_deploy/user_variables.yml`` file defines the global
|
||||
overrides for the default variables.
|
||||
|
||||
For this example environment, we configure a HA load balancer.
|
||||
We implement the load balancer (HAProxy) with an HA layer (keepalived)
|
||||
We implement the load balancer (HAProxy) with an HA layer (Keepalived)
|
||||
on the infrastructure hosts.
|
||||
Your ``/etc/openstack_deploy/user_variables.yml`` must have the
|
||||
following content to configure haproxy, keepalived and ceph:
|
||||
following content to configure HAProxy, Keepalived and Ceph:
|
||||
|
||||
.. literalinclude:: ../../../../etc/openstack_deploy/user_variables.yml.prod-ceph.example
|
||||
|
@@ -32,7 +32,7 @@ to interact with the server via SSH.
|
||||
|
||||
The ``Overlay Network``, also referred to as the ``tunnel network``,
|
||||
provides connectivity between hosts for the purpose of tunnelling
|
||||
encapsulated traffic using VXLAN, GENEVE, or other protocols. The
|
||||
encapsulated traffic using VXLAN, Geneve, or other protocols. The
|
||||
``overlay network`` uses a dedicated VLAN typically connected to the
|
||||
``br-vxlan`` bridge.
|
||||
|
||||
|
@@ -14,7 +14,7 @@ Inventory overrides
|
||||
~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
In order to tell dynamic_inventory to generate a set of containers
|
||||
for haproxy, you need to create a file
|
||||
for HAProxy, you need to create a file
|
||||
``/etc/openstack_deploy/env.d/haproxy.yml`` with the following content:
|
||||
|
||||
.. code:: yaml
|
||||
@@ -215,7 +215,7 @@ Example bellow shows a possible content in ``user_variables.yml``:
|
||||
haproxy_keepalived_internal_interface: "{{ haproxy_bind_internal_lb_vip_interface }}"
|
||||
|
||||
Alternatively, you can detect IPs used inside your containers to configure
|
||||
haproxy binds. This can be done by reffering to ``container_networks`` mapping:
|
||||
HAProxy binds. This can be done by reffering to ``container_networks`` mapping:
|
||||
|
||||
.. code:: yaml
|
||||
|
||||
@@ -226,7 +226,7 @@ haproxy binds. This can be done by reffering to ``container_networks`` mapping:
|
||||
Creating containers
|
||||
~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Once all steps above are accomplished, it's time to create our new haproxy
|
||||
Once all steps above are accomplished, it's time to create our new HAProxy
|
||||
containers. For that run the following command:
|
||||
|
||||
.. code:: shell
|
||||
|
@@ -4,12 +4,12 @@ Security Headers
|
||||
Security headers are HTTP headers that can be used to increase the security of
|
||||
a web application by restricting what modern browsers are able to run.
|
||||
|
||||
In OpenStack-Ansible, security headers are implemented in haproxy as all the
|
||||
In OpenStack-Ansible, security headers are implemented in HAProxy as all the
|
||||
public endpoints reside behind it.
|
||||
|
||||
The following headers are enabled by default on all the haproxy interfaces
|
||||
The following headers are enabled by default on all the HAProxy interfaces
|
||||
that implement TLS, but only for the Horizon service. The security headers can
|
||||
be implemented on other haproxy services, but only services used by
|
||||
be implemented on other HAProxy services, but only services used by
|
||||
browsers will make use of the headers.
|
||||
|
||||
HTTP Strict Transport Security
|
||||
@@ -136,7 +136,7 @@ Security Policy to allow access to your authorisation server by overriding the
|
||||
frame-src 'self' {{ external_lb_vip_address }}:{{ nova_spice_html5proxy_base_port }} {{ external_lb_vip_address }}:{{ nova_novncproxy_port }} {{ external_lb_vip_address }}:{{ nova_serialconsoleproxy_port }};
|
||||
"
|
||||
|
||||
It is also possible to set specific security headers for skyline.
|
||||
It is also possible to set specific security headers for Skyline.
|
||||
|
||||
.. code-block:: yaml
|
||||
|
||||
|
@@ -1,4 +1,4 @@
|
||||
Security.txt
|
||||
security.txt
|
||||
============
|
||||
|
||||
security.txt is a proposed `IETF standard`_ to allow independent security
|
||||
@@ -8,9 +8,9 @@ legacy compatibility reasons the file might also be placed at "/security.txt".
|
||||
|
||||
.. _IETF standard: https://datatracker.ietf.org/doc/html/draft-foudil-securitytxt
|
||||
|
||||
In OpenStack-Ansible, ``security.txt`` is implemented in haproxy as all public
|
||||
In OpenStack-Ansible, ``security.txt`` is implemented in HAProxy as all public
|
||||
endpoints reside behind it. It defaults to directing any request paths that
|
||||
end with ``/security.txt`` to the text file using an ACL rule in haproxy.
|
||||
end with ``/security.txt`` to the text file using an ACL rule in HAProxy.
|
||||
|
||||
Enabling security.txt
|
||||
~~~~~~~~~~~~~~~~~~~~~
|
||||
@@ -30,7 +30,7 @@ using OpenStack-Ansible:
|
||||
# This is my example security.txt file
|
||||
# Please see https://securitytxt.org/ for details of the specification of this file
|
||||
|
||||
#. Update haproxy
|
||||
#. Update HAProxy
|
||||
|
||||
.. code-block:: shell-session
|
||||
|
||||
@@ -39,8 +39,8 @@ using OpenStack-Ansible:
|
||||
Advanced security.txt ACL
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
In some cases you may need to change the haproxy ACL used to redirect requests
|
||||
In some cases you may need to change the HAProxy ACL used to redirect requests
|
||||
to the ``security.txt`` file, such as adding extra domains.
|
||||
|
||||
The haproxy ACL is updated by overriding the variable
|
||||
The HAProxy ACL is updated by overriding the variable
|
||||
``haproxy_map_entries`` inside ``haproxy_security_txt_service``.
|
||||
|
Reference in New Issue
Block a user