openstack/openstack-ansible
Code Issues Proposed changes

Merge "docs: minor fixes with Geneve and HAProxy"

Browse Source
This commit is contained in:
Zuul
2025-04-16 12:58:57 +00:00
committed by Gerrit Code Review
parent d48e3406fc 8c31b09635
commit 351885902b
5 changed files with 16 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
doc/source/user/ceph/full-deploy.rst
View File

@@ -187,9 +187,9 @@ The ``/etc/openstack_deploy/user_variables.yml`` file defines the global
overrides for the default variables. overrides for the default variables.
For this example environment, we configure a HA load balancer. For this example environment, we configure a HA load balancer.
We implement the load balancer (HAProxy) with an HA layer (keepalived) We implement the load balancer (HAProxy) with an HA layer (Keepalived)
on the infrastructure hosts. on the infrastructure hosts.
Your ``/etc/openstack_deploy/user_variables.yml`` must have the Your ``/etc/openstack_deploy/user_variables.yml`` must have the
following content to configure haproxy, keepalived and ceph: following content to configure HAProxy, Keepalived and Ceph:
.. literalinclude:: ../../../../etc/openstack_deploy/user_variables.yml.prod-ceph.example .. literalinclude:: ../../../../etc/openstack_deploy/user_variables.yml.prod-ceph.example

2
doc/source/user/network-arch/example.rst
View File

@@ -32,7 +32,7 @@ to interact with the server via SSH.
The ``Overlay Network``, also referred to as the ``tunnel network``, The ``Overlay Network``, also referred to as the ``tunnel network``,
provides connectivity between hosts for the purpose of tunnelling provides connectivity between hosts for the purpose of tunnelling
encapsulated traffic using VXLAN, GENEVE, or other protocols. The encapsulated traffic using VXLAN, Geneve, or other protocols. The
``overlay network`` uses a dedicated VLAN typically connected to the ``overlay network`` uses a dedicated VLAN typically connected to the
``br-vxlan`` bridge. ``br-vxlan`` bridge.

6
doc/source/user/prod/haproxy_in_lxc.rst
View File

@@ -14,7 +14,7 @@ Inventory overrides
~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~
In order to tell dynamic_inventory to generate a set of containers In order to tell dynamic_inventory to generate a set of containers
for haproxy, you need to create a file for HAProxy, you need to create a file
``/etc/openstack_deploy/env.d/haproxy.yml`` with the following content: ``/etc/openstack_deploy/env.d/haproxy.yml`` with the following content:
.. code:: yaml .. code:: yaml
@@ -215,7 +215,7 @@ Example bellow shows a possible content in ``user_variables.yml``:
haproxy_keepalived_internal_interface: "{{ haproxy_bind_internal_lb_vip_interface }}" haproxy_keepalived_internal_interface: "{{ haproxy_bind_internal_lb_vip_interface }}"
Alternatively, you can detect IPs used inside your containers to configure Alternatively, you can detect IPs used inside your containers to configure
haproxy binds. This can be done by reffering to ``container_networks`` mapping: HAProxy binds. This can be done by reffering to ``container_networks`` mapping:
.. code:: yaml .. code:: yaml
@@ -226,7 +226,7 @@ haproxy binds. This can be done by reffering to ``container_networks`` mapping:
Creating containers Creating containers
~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~
Once all steps above are accomplished, it's time to create our new haproxy Once all steps above are accomplished, it's time to create our new HAProxy
containers. For that run the following command: containers. For that run the following command:
.. code:: shell .. code:: shell

8
doc/source/user/security/security-headers.rst
View File

@@ -4,12 +4,12 @@ Security Headers
Security headers are HTTP headers that can be used to increase the security of Security headers are HTTP headers that can be used to increase the security of
a web application by restricting what modern browsers are able to run. a web application by restricting what modern browsers are able to run.
In OpenStack-Ansible, security headers are implemented in haproxy as all the In OpenStack-Ansible, security headers are implemented in HAProxy as all the
public endpoints reside behind it. public endpoints reside behind it.
The following headers are enabled by default on all the haproxy interfaces The following headers are enabled by default on all the HAProxy interfaces
that implement TLS, but only for the Horizon service. The security headers can that implement TLS, but only for the Horizon service. The security headers can
be implemented on other haproxy services, but only services used by be implemented on other HAProxy services, but only services used by
browsers will make use of the headers. browsers will make use of the headers.
HTTP Strict Transport Security HTTP Strict Transport Security
@@ -136,7 +136,7 @@ Security Policy to allow access to your authorisation server by overriding the
frame-src 'self' {{ external_lb_vip_address }}:{{ nova_spice_html5proxy_base_port }} {{ external_lb_vip_address }}:{{ nova_novncproxy_port }} {{ external_lb_vip_address }}:{{ nova_serialconsoleproxy_port }}; frame-src 'self' {{ external_lb_vip_address }}:{{ nova_spice_html5proxy_base_port }} {{ external_lb_vip_address }}:{{ nova_novncproxy_port }} {{ external_lb_vip_address }}:{{ nova_serialconsoleproxy_port }};
" "
It is also possible to set specific security headers for skyline. It is also possible to set specific security headers for Skyline.
.. code-block:: yaml .. code-block:: yaml

12
doc/source/user/security/security-txt.rst
View File

@@ -1,4 +1,4 @@
Security.txt security.txt
============ ============
security.txt is a proposed `IETF standard`_ to allow independent security security.txt is a proposed `IETF standard`_ to allow independent security
@@ -8,9 +8,9 @@ legacy compatibility reasons the file might also be placed at "/security.txt".
.. _IETF standard: https://datatracker.ietf.org/doc/html/draft-foudil-securitytxt .. _IETF standard: https://datatracker.ietf.org/doc/html/draft-foudil-securitytxt
In OpenStack-Ansible, ``security.txt`` is implemented in haproxy as all public In OpenStack-Ansible, ``security.txt`` is implemented in HAProxy as all public
endpoints reside behind it. It defaults to directing any request paths that endpoints reside behind it. It defaults to directing any request paths that
end with ``/security.txt`` to the text file using an ACL rule in haproxy. end with ``/security.txt`` to the text file using an ACL rule in HAProxy.
Enabling security.txt Enabling security.txt
~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~
@@ -30,7 +30,7 @@ using OpenStack-Ansible:
# This is my example security.txt file # This is my example security.txt file
# Please see https://securitytxt.org/ for details of the specification of this file # Please see https://securitytxt.org/ for details of the specification of this file
#. Update haproxy #. Update HAProxy
.. code-block:: shell-session .. code-block:: shell-session
@@ -39,8 +39,8 @@ using OpenStack-Ansible:
Advanced security.txt ACL Advanced security.txt ACL
~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~
In some cases you may need to change the haproxy ACL used to redirect requests In some cases you may need to change the HAProxy ACL used to redirect requests
to the ``security.txt`` file, such as adding extra domains. to the ``security.txt`` file, such as adding extra domains.
The haproxy ACL is updated by overriding the variable The HAProxy ACL is updated by overriding the variable
``haproxy_map_entries`` inside ``haproxy_security_txt_service``. ``haproxy_map_entries`` inside ``haproxy_security_txt_service``.