58a4c980bb
We're enabling the audit middleware for the following API services:
* cinder
* nova
* neutron
* glance
* heat
* barbican
* octavia
* gnocchi
* config.verbose was deprecated a long time ago and Gnocchi doesn't
support a separate "logging.conf" file
* as such, Gnocchi can't be configured to use "info" level logging
* the audit logs will only be emitted in debug mode
* cf001e8428/gnocchi/service.py (L72-L79)
* newly defined audit map (the other services had already existing
definitions, which were updated):
* aodh
* designate
* magnum
* masakari
* updated wsgi log configuration
The following services do not support the audit middleware,
the support for api paste was dropped:
* placement
* watcher
* keystone (has its own pycadf audit implementation)
* emits notifications using oslo.notifications
* configurable driver, possible options include "messagingv2" and "log"
* we can't just use the log driver since the user may request amqp
notifications using:
"juju config keystone enable-telemetry-notifications=True"
* we'll listen for amqp notifications using a separate service
Reference:
* audit middleware configuration: https://docs.openstack.org/keystonemiddleware/latest/audit.html
* api map samples: https://opendev.org/openstack/pycadf/src/tag/3.1.1/etc/pycadf
Change-Id: I28a261b85067704221d6ab3d949c5d2a27a4a9d7
224 lines
5.6 KiB
Django/Jinja
224 lines
5.6 KiB
Django/Jinja
bundle: kubernetes
|
|
|
|
applications:
|
|
traefik:
|
|
charm: ch:traefik-k8s
|
|
channel: latest/candidate
|
|
base: ubuntu@20.04
|
|
scale: 1
|
|
trust: true
|
|
options:
|
|
kubernetes-service-annotations: metallb.universe.tf/address-pool=public
|
|
mysql:
|
|
charm: ch:mysql-k8s
|
|
channel: 8.0/stable
|
|
base: ubuntu@22.04
|
|
scale: 1
|
|
trust: true
|
|
options:
|
|
profile-limit-memory: 2560
|
|
experimental-max-connections: 150
|
|
tls-operator:
|
|
charm: self-signed-certificates
|
|
channel: latest/beta
|
|
base: ubuntu@22.04
|
|
scale: 1
|
|
options:
|
|
ca-common-name: internal-ca
|
|
rabbitmq:
|
|
charm: ch:rabbitmq-k8s
|
|
channel: 3.12/edge
|
|
base: ubuntu@24.04
|
|
scale: 1
|
|
trust: true
|
|
options:
|
|
minimum-replicas: 1
|
|
ovn-central:
|
|
{% if ovn_central_k8s is defined and ovn_central_k8s is sameas true -%}
|
|
charm: ../../../ovn-central-k8s.charm
|
|
{% else -%}
|
|
charm: ch:ovn-central-k8s
|
|
channel: 25.03/edge
|
|
{% endif -%}
|
|
base: ubuntu@24.04
|
|
scale: 1
|
|
trust: true
|
|
resources:
|
|
ovn-sb-db-server-image: ghcr.io/canonical/ovn-consolidated:25.03
|
|
ovn-nb-db-server-image: ghcr.io/canonical/ovn-consolidated:25.03
|
|
ovn-northd-image: ghcr.io/canonical/ovn-consolidated:25.03
|
|
ovn-relay:
|
|
{% if ovn_relay_k8s is defined and ovn_relay_k8s is sameas true -%}
|
|
charm: ../../../ovn-relay-k8s.charm
|
|
{% else -%}
|
|
charm: ch:ovn-relay-k8s
|
|
channel: 25.03/edge
|
|
{% endif -%}
|
|
base: ubuntu@24.04
|
|
scale: 1
|
|
trust: true
|
|
resources:
|
|
ovn-sb-db-server-image: ghcr.io/canonical/ovn-consolidated:25.03
|
|
keystone:
|
|
{% if keystone_k8s is defined and keystone_k8s is sameas true -%}
|
|
charm: ../../../keystone-k8s.charm
|
|
{% else -%}
|
|
charm: ch:keystone-k8s
|
|
channel: 2025.1/edge
|
|
{% endif -%}
|
|
base: ubuntu@24.04
|
|
scale: 1
|
|
trust: true
|
|
storage:
|
|
fernet-keys: 5M
|
|
credential-keys: 5M
|
|
resources:
|
|
keystone-image: ghcr.io/canonical/keystone:2025.1
|
|
glance:
|
|
{% if glance_k8s is defined and glance_k8s is sameas true -%}
|
|
charm: ../../../glance-k8s.charm
|
|
{% else -%}
|
|
charm: ch:glance-k8s
|
|
channel: 2025.1/edge
|
|
{% endif -%}
|
|
base: ubuntu@24.04
|
|
scale: 1
|
|
trust: true
|
|
storage:
|
|
local-repository: 10G
|
|
resources:
|
|
glance-api-image: ghcr.io/canonical/glance-api:2025.1
|
|
nova:
|
|
{% if nova_k8s is defined and nova_k8s is sameas true -%}
|
|
charm: ../../../nova-k8s.charm
|
|
{% else -%}
|
|
charm: ch:nova-k8s
|
|
channel: 2025.1/edge
|
|
{% endif -%}
|
|
base: ubuntu@24.04
|
|
scale: 1
|
|
trust: true
|
|
resources:
|
|
nova-api-image: ghcr.io/canonical/nova-consolidated:2025.1
|
|
nova-scheduler-image: ghcr.io/canonical/nova-consolidated:2025.1
|
|
nova-conductor-image: ghcr.io/canonical/nova-consolidated:2025.1
|
|
nova-spiceproxy-image: ghcr.io/canonical/nova-consolidated:2025.1
|
|
placement:
|
|
{% if placement_k8s is defined and placement_k8s is sameas true -%}
|
|
charm: ../../../placement-k8s.charm
|
|
{% else -%}
|
|
charm: ch:placement-k8s
|
|
channel: 2025.1/edge
|
|
{% endif -%}
|
|
base: ubuntu@24.04
|
|
scale: 1
|
|
trust: true
|
|
resources:
|
|
placement-api-image: ghcr.io/canonical/placement-api:2025.1
|
|
neutron:
|
|
{% if neutron_k8s is defined and neutron_k8s is sameas true -%}
|
|
charm: ../../../neutron-k8s.charm
|
|
{% else -%}
|
|
charm: ch:neutron-k8s
|
|
channel: 2025.1/edge
|
|
{% endif -%}
|
|
base: ubuntu@24.04
|
|
scale: 1
|
|
trust: true
|
|
options:
|
|
debug: true
|
|
resources:
|
|
neutron-server-image: ghcr.io/canonical/neutron-server:2025.1
|
|
openstack-images-sync:
|
|
{% if openstack_images_sync_k8s is defined and openstack_images_sync_k8s is sameas true -%}
|
|
charm: ../../../openstack-images-sync-k8s.charm
|
|
{% else -%}
|
|
charm: ch:openstack-images-sync-k8s
|
|
channel: 2025.1/edge
|
|
{% endif -%}
|
|
base: ubuntu@24.04
|
|
scale: 1
|
|
trust: true
|
|
options:
|
|
frequency: test-do-not-use
|
|
architecture: amd64
|
|
release: jammy
|
|
max-items: 1
|
|
resources:
|
|
openstack-images-sync-image: ghcr.io/canonical/openstack-images-sync:2025.1
|
|
|
|
relations:
|
|
- - tls-operator:certificates
|
|
- ovn-central:certificates
|
|
|
|
- - tls-operator:certificates
|
|
- ovn-relay:certificates
|
|
- - ovn-relay:ovsdb-cms
|
|
- ovn-central:ovsdb-cms
|
|
|
|
- - mysql:database
|
|
- keystone:database
|
|
- - traefik:ingress
|
|
- keystone:ingress-internal
|
|
- - rabbitmq:amqp
|
|
- keystone:amqp
|
|
|
|
- - mysql:database
|
|
- glance:database
|
|
- - keystone:identity-service
|
|
- glance:identity-service
|
|
- - rabbitmq:amqp
|
|
- glance:amqp
|
|
- - traefik:ingress
|
|
- glance:ingress-internal
|
|
- - keystone:send-ca-cert
|
|
- glance:receive-ca-cert
|
|
|
|
- - mysql:database
|
|
- nova:database
|
|
- - mysql:database
|
|
- nova:api-database
|
|
- - mysql:database
|
|
- nova:cell-database
|
|
- - rabbitmq:amqp
|
|
- nova:amqp
|
|
- - keystone:identity-service
|
|
- nova:identity-service
|
|
- - traefik:ingress
|
|
- nova:ingress-internal
|
|
- - traefik:traefik-route
|
|
- nova:traefik-route-internal
|
|
- - keystone:send-ca-cert
|
|
- nova:receive-ca-cert
|
|
- - placement:placement
|
|
- nova:placement
|
|
|
|
- - mysql:database
|
|
- placement:database
|
|
- - keystone:identity-service
|
|
- placement:identity-service
|
|
- - traefik:ingress
|
|
- placement:ingress-internal
|
|
- - keystone:send-ca-cert
|
|
- placement:receive-ca-cert
|
|
|
|
- - mysql:database
|
|
- neutron:database
|
|
- - rabbitmq:amqp
|
|
- neutron:amqp
|
|
- - keystone:identity-service
|
|
- neutron:identity-service
|
|
- - traefik:ingress
|
|
- neutron:ingress-internal
|
|
- - tls-operator:certificates
|
|
- neutron:certificates
|
|
- - neutron:ovsdb-cms
|
|
- ovn-central:ovsdb-cms
|
|
- - keystone:send-ca-cert
|
|
- neutron:receive-ca-cert
|
|
|
|
- - keystone:identity-service
|
|
- openstack-images-sync:identity-service
|
|
- - traefik:ingress
|
|
- openstack-images-sync:ingress-internal
|