From d0505893de692f5b260ebdb4c9a73c1087842e38 Mon Sep 17 00:00:00 2001 From: Michal Nasiadka Date: Wed, 24 Sep 2025 18:21:03 +0200 Subject: group_vars: Reorganize huge all.yml into smaller files This will help us to trigger scenario jobs on changes in given group_vars files. Changes to Zuul config to trigger given scenarios will be posted as a follow-up. Change-Id: I3f17adf655d2d0c1fc2969153dddb0c72b11397a Signed-off-by: Michal Nasiadka --- ansible/group_vars/all.yml | 1413 -------------------- ansible/group_vars/all/aodh.yml | 11 + ansible/group_vars/all/barbican.yml | 17 + ansible/group_vars/all/bifrost.yml | 3 + ansible/group_vars/all/blazar.yml | 11 + ansible/group_vars/all/ceilometer.yml | 4 + ansible/group_vars/all/ceph-rgw.yml | 10 + ansible/group_vars/all/ceph.yml | 21 + ansible/group_vars/all/cinder.yml | 40 + ansible/group_vars/all/cloudkitty.yml | 20 + ansible/group_vars/all/collectd.yml | 4 + ansible/group_vars/all/common.yml | 366 +++++ ansible/group_vars/all/cyborg.yml | 8 + ansible/group_vars/all/database.yml | 11 + ansible/group_vars/all/designate.yml | 33 + ansible/group_vars/all/etcd.yml | 7 + ansible/group_vars/all/fluentd.yml | 6 + ansible/group_vars/all/glance.yml | 28 + ansible/group_vars/all/gnocchi.yml | 21 + ansible/group_vars/all/grafana.yml | 11 + ansible/group_vars/all/hacluster.yml | 9 + ansible/group_vars/all/haproxy.yml | 48 + ansible/group_vars/all/heat.yml | 17 + ansible/group_vars/all/horizon.yml | 49 + ansible/group_vars/all/influxdb.yml | 12 + ansible/group_vars/all/ironic.yml | 33 + ansible/group_vars/all/iscsi.yml | 4 + ansible/group_vars/all/keepalived.yml | 8 + ansible/group_vars/all/keystone.yml | 86 ++ ansible/group_vars/all/kuryr.yml | 4 + ansible/group_vars/all/letsencrypt.yml | 13 + ansible/group_vars/all/loadbalancer.yml | 2 + ansible/group_vars/all/magnum.yml | 10 + ansible/group_vars/all/manila.yml | 18 + ansible/group_vars/all/mariadb.yml | 37 + ansible/group_vars/all/masakari.yml | 13 + ansible/group_vars/all/memcached.yml | 10 + ansible/group_vars/all/mistral.yml | 10 + ansible/group_vars/all/multipathd.yml | 2 + ansible/group_vars/all/neutron.yml | 75 ++ ansible/group_vars/all/nova.yml | 69 + ansible/group_vars/all/octavia.yml | 33 + ansible/group_vars/all/opensearch.yml | 33 + ansible/group_vars/all/openvswitch.yml | 14 + ansible/group_vars/all/ovn.yml | 16 + ansible/group_vars/all/placement.yml | 13 + ansible/group_vars/all/prometheus.yml | 78 ++ ansible/group_vars/all/proxysql.yml | 4 + ansible/group_vars/all/rabbitmq.yml | 19 + ansible/group_vars/all/redis.yml | 11 + ansible/group_vars/all/s3.yml | 7 + ansible/group_vars/all/skyline.yml | 18 + ansible/group_vars/all/tacker.yml | 10 + ansible/group_vars/all/telegraf.yml | 9 + ansible/group_vars/all/trove.yml | 11 + ansible/group_vars/all/venus.yml | 10 + ansible/group_vars/all/watcher.yml | 10 + ansible/group_vars/all/zun.yml | 31 + ansible/group_vars/baremetal.yml | 15 - .../baremetal/ansible-python-interpreter.yml | 15 + ansible/module_utils/kolla_podman_worker.py | 2 +- doc/source/reference/containers/kuryr-guide.rst | 3 +- doc/source/reference/databases/mariadb-guide.rst | 6 +- .../orchestration-and-nfv/tacker-guide.rst | 2 +- doc/source/user/multinode.rst | 2 +- doc/source/user/troubleshooting.rst | 16 +- etc/kolla/globals.yml | 2 +- zuul.d/base.yaml | 2 +- 68 files changed, 1521 insertions(+), 1445 deletions(-) delete mode 100644 ansible/group_vars/all.yml create mode 100644 ansible/group_vars/all/aodh.yml create mode 100644 ansible/group_vars/all/barbican.yml create mode 100644 ansible/group_vars/all/bifrost.yml create mode 100644 ansible/group_vars/all/blazar.yml create mode 100644 ansible/group_vars/all/ceilometer.yml create mode 100644 ansible/group_vars/all/ceph-rgw.yml create mode 100644 ansible/group_vars/all/ceph.yml create mode 100644 ansible/group_vars/all/cinder.yml create mode 100644 ansible/group_vars/all/cloudkitty.yml create mode 100644 ansible/group_vars/all/collectd.yml create mode 100644 ansible/group_vars/all/common.yml create mode 100644 ansible/group_vars/all/cyborg.yml create mode 100644 ansible/group_vars/all/database.yml create mode 100644 ansible/group_vars/all/designate.yml create mode 100644 ansible/group_vars/all/etcd.yml create mode 100644 ansible/group_vars/all/fluentd.yml create mode 100644 ansible/group_vars/all/glance.yml create mode 100644 ansible/group_vars/all/gnocchi.yml create mode 100644 ansible/group_vars/all/grafana.yml create mode 100644 ansible/group_vars/all/hacluster.yml create mode 100644 ansible/group_vars/all/haproxy.yml create mode 100644 ansible/group_vars/all/heat.yml create mode 100644 ansible/group_vars/all/horizon.yml create mode 100644 ansible/group_vars/all/influxdb.yml create mode 100644 ansible/group_vars/all/ironic.yml create mode 100644 ansible/group_vars/all/iscsi.yml create mode 100644 ansible/group_vars/all/keepalived.yml create mode 100644 ansible/group_vars/all/keystone.yml create mode 100644 ansible/group_vars/all/kuryr.yml create mode 100644 ansible/group_vars/all/letsencrypt.yml create mode 100644 ansible/group_vars/all/loadbalancer.yml create mode 100644 ansible/group_vars/all/magnum.yml create mode 100644 ansible/group_vars/all/manila.yml create mode 100644 ansible/group_vars/all/mariadb.yml create mode 100644 ansible/group_vars/all/masakari.yml create mode 100644 ansible/group_vars/all/memcached.yml create mode 100644 ansible/group_vars/all/mistral.yml create mode 100644 ansible/group_vars/all/multipathd.yml create mode 100644 ansible/group_vars/all/neutron.yml create mode 100644 ansible/group_vars/all/nova.yml create mode 100644 ansible/group_vars/all/octavia.yml create mode 100644 ansible/group_vars/all/opensearch.yml create mode 100644 ansible/group_vars/all/openvswitch.yml create mode 100644 ansible/group_vars/all/ovn.yml create mode 100644 ansible/group_vars/all/placement.yml create mode 100644 ansible/group_vars/all/prometheus.yml create mode 100644 ansible/group_vars/all/proxysql.yml create mode 100644 ansible/group_vars/all/rabbitmq.yml create mode 100644 ansible/group_vars/all/redis.yml create mode 100644 ansible/group_vars/all/s3.yml create mode 100644 ansible/group_vars/all/skyline.yml create mode 100644 ansible/group_vars/all/tacker.yml create mode 100644 ansible/group_vars/all/telegraf.yml create mode 100644 ansible/group_vars/all/trove.yml create mode 100644 ansible/group_vars/all/venus.yml create mode 100644 ansible/group_vars/all/watcher.yml create mode 100644 ansible/group_vars/all/zun.yml delete mode 100644 ansible/group_vars/baremetal.yml create mode 100644 ansible/group_vars/baremetal/ansible-python-interpreter.yml diff --git a/ansible/group_vars/all.yml b/ansible/group_vars/all.yml deleted file mode 100644 index 435937c58..000000000 --- a/ansible/group_vars/all.yml +++ /dev/null @@ -1,1413 +0,0 @@ ---- -# The options in this file can be overridden in 'globals.yml' - -# The "temp" files that are created before merge need to stay persistent due -# to the fact that ansible will register a "change" if it has to create them -# again. Persistent files allow for idempotency -container_config_directory: "/var/lib/kolla/config_files" - -# The directory on the deploy host containing globals.yml. -node_config: "{{ CONFIG_DIR | default('/etc/kolla') }}" - -# The directory to merge custom config files the kolla's config files -node_custom_config: "{{ node_config }}/config" - -# The directory to store the config files on the destination node -node_config_directory: "/etc/kolla" - -# The group which own node_config_directory, you can use a non-root -# user to deploy kolla -config_owner_user: "root" -config_owner_group: "root" - -################### -# Ansible options -################### - -# This variable is used as the "filter" argument for the setup module. For -# instance, if one wants to remove/ignore all Neutron interface facts: -# kolla_ansible_setup_filter: "ansible_[!qt]*" -# By default, we do not provide a filter. -kolla_ansible_setup_filter: "{{ omit }}" - -# This variable is used as the "gather_subset" argument for the setup module. -# For instance, if one wants to avoid collecting facts via facter: -# kolla_ansible_setup_gather_subset: "all,!facter" -# By default, we do not provide a gather subset. -kolla_ansible_setup_gather_subset: "{{ omit }}" - -# This variable determines which hosts require facts when using --limit. Facts -# will be gathered using delegation for hosts in this list that are not -# included in the limit. -# By default, this list includes all hosts. -kolla_ansible_delegate_facts_hosts: "{{ groups['all'] }}" - -################### -# Kolla options -################### -# Valid options are [ COPY_ONCE, COPY_ALWAYS ] -config_strategy: "COPY_ALWAYS" - -# Valid options are ['centos', 'debian', 'rocky', 'ubuntu'] -kolla_base_distro: "rocky" - -kolla_internal_vip_address: "{{ kolla_internal_address | default('') }}" -kolla_internal_fqdn: "{{ kolla_internal_vip_address }}" -kolla_external_vip_address: "{{ kolla_internal_vip_address }}" -kolla_same_external_internal_vip: "{{ kolla_external_vip_address | ansible.utils.ipaddr('address') == kolla_internal_vip_address | ansible.utils.ipaddr('address') }}" -kolla_external_fqdn: "{{ kolla_internal_fqdn if kolla_same_external_internal_vip | bool else kolla_external_vip_address }}" - -kolla_dev_repos_directory: "/opt/stack/" -kolla_dev_repos_git: "https://opendev.org/openstack" -kolla_dev_repos_pull: "no" -kolla_dev_mode: "no" -kolla_source_version: "{% if openstack_release == 'master' %}master{% else %}stable/{{ openstack_release }}{% endif %}" - -# Proxy settings for containers such as magnum that need internet access -container_http_proxy: "" -container_https_proxy: "" -container_no_proxy: "localhost,127.0.0.1" - -container_proxy_no_proxy_entries: - - "{{ container_no_proxy }}" - - "{{ api_interface_address }}" - - "{{ kolla_internal_vip_address | default('') }}" - -container_proxy: - http_proxy: "{{ container_http_proxy }}" - https_proxy: "{{ container_https_proxy }}" - no_proxy: "{{ container_proxy_no_proxy_entries | select | join(',') }}" - -# By default, Kolla API services bind to the network address assigned -# to the api_interface. Allow the bind address to be an override. -api_interface_address: "{{ 'api' | kolla_address }}" - - -#################### -# Database options -#################### -database_address: "{{ kolla_internal_fqdn }}" -database_user: "root" -database_port: "3306" -database_connection_recycle_time: 10 -database_max_pool_size: 1 -database_enable_tls_backend: "{{ 'yes' if ((kolla_enable_tls_backend | bool ) and ( enable_proxysql | bool)) else 'no' }}" -database_enable_tls_internal: "{{ 'yes' if ((kolla_enable_tls_internal | bool ) and ( enable_proxysql | bool)) else 'no' }}" - -#################### -# Container engine options -#################### -kolla_container_engine: "docker" - -#################### -# Docker options -#################### -docker_registry_email: -docker_registry: "quay.io" -docker_namespace: "openstack.kolla" -docker_image_name_prefix: "" -docker_image_url: "{{ docker_registry ~ '/' if docker_registry else '' }}{{ docker_namespace }}/{{ docker_image_name_prefix }}" -docker_registry_username: -# Please read the docs carefully before applying docker_registry_insecure. -docker_registry_insecure: "no" -docker_runtime_directory: "" -# Docker client timeout in seconds. -docker_client_timeout: 120 - -# Docker networking options -docker_disable_default_iptables_rules: "yes" -docker_disable_default_network: "{{ docker_disable_default_iptables_rules }}" -docker_disable_ip_forward: "{{ docker_disable_default_iptables_rules }}" - -# Retention settings for Docker logs -docker_log_max_file: "5" -docker_log_max_size: "50m" - -# Valid options are [ no, on-failure, always, unless-stopped ] -docker_restart_policy: "unless-stopped" - -# '0' means unlimited retries (applies only to 'on-failure' policy) -docker_restart_policy_retry: "10" - -# Extra docker options for Zun -docker_configure_for_zun: "no" -docker_zun_options: -H tcp://{{ api_interface_address | put_address_in_context('url') }}:2375 -docker_zun_config: {} - -# Extra containerd options for Zun -containerd_configure_for_zun: "no" - -# Enable Ceph backed Cinder Volumes for zun -zun_configure_for_cinder_ceph: "no" - -# 42463 is the static group id of the zun user in the Zun image. -# If users customize this value on building the Zun images, -# they need to change this config accordingly. -containerd_grpc_gid: 42463 - -# Timeout after Docker sends SIGTERM before sending SIGKILL. -docker_graceful_timeout: 60 - -# Common options used throughout Docker -docker_common_options: - auth_email: "{{ docker_registry_email }}" - auth_password: "{{ docker_registry_password }}" - auth_registry: "{{ docker_registry }}" - auth_username: "{{ docker_registry_username }}" - environment: - KOLLA_CONFIG_STRATEGY: "{{ config_strategy }}" - restart_policy: "{{ docker_restart_policy }}" - restart_retries: "{{ docker_restart_policy_retry }}" - graceful_timeout: "{{ docker_graceful_timeout }}" - client_timeout: "{{ docker_client_timeout }}" - container_engine: "{{ kolla_container_engine }}" - -# Container engine specific volume paths -docker_volumes_path: "{{ docker_runtime_directory or '/var/lib/docker' }}/volumes" -podman_volumes_path: "{{ docker_runtime_directory or '/var/lib/containers' }}/storage/volumes" -container_engine_volumes_path: "{{ docker_volumes_path if kolla_container_engine == 'docker' else podman_volumes_path }}" - -##################### -# Volumes under /run -##################### -# Podman has problem with mounting whole /run directory -# described here: https://github.com/containers/podman/issues/16305 -run_default_volumes_podman: - - '/run/netns:/run/netns:shared' - - '/run/lock/nova:/run/lock/nova:shared' - - "/run/libvirt:/run/libvirt:shared" - - "/run/nova:/run/nova:shared" - - "/run/openvswitch:/run/openvswitch:shared" - -run_default_volumes_docker: [] - -run_default_subdirectories: - - '/run/netns' - - '/run/lock/nova' - - "/run/libvirt" - - "/run/nova" - - "/run/openvswitch" - -#################### -# Dimensions options -#################### -# Dimension options for Docker Containers -# NOTE(mnasiadka): Lower 1073741816 nofile limit on EL9 (RHEL9/CentOS Stream 9/Rocky Linux 9) -# fixes at least rabbitmq and mariadb -default_container_dimensions: "{{ default_container_dimensions_el9 if ansible_facts.os_family == 'RedHat' else '{}' }}" -default_container_dimensions_el9: "{{ default_docker_dimensions_el9 if kolla_container_engine == 'docker' else default_podman_dimensions_el9 }}" -default_docker_dimensions_el9: - ulimits: - nofile: - soft: 1048576 - hard: 1048576 -default_podman_dimensions_el9: - ulimits: - RLIMIT_NOFILE: - soft: 1048576 - hard: 1048576 - RLIMIT_NPROC: - soft: 1048576 - hard: 1048576 - -##################### -# Healthcheck options -##################### -enable_container_healthchecks: "yes" -# Healthcheck options for Docker containers -# interval/timeout/start_period are in seconds -default_container_healthcheck_interval: 30 -default_container_healthcheck_timeout: 30 -default_container_healthcheck_retries: 3 -default_container_healthcheck_start_period: 5 - -####################### -# Extra volumes options -####################### -# Extra volumes for Docker Containers -default_extra_volumes: [] - -#################### -# keepalived options -#################### -# Arbitrary unique number from 0..255 -keepalived_virtual_router_id: "51" - - -####################### -## Opensearch Options -######################## -opensearch_datadir_volume: "opensearch" - -opensearch_internal_endpoint: "{{ opensearch_address | kolla_url(internal_protocol, opensearch_port) }}" -opensearch_dashboards_internal_fqdn: "{{ kolla_internal_fqdn }}" -opensearch_dashboards_external_fqdn: "{{ kolla_external_fqdn }}" -opensearch_dashboards_internal_endpoint: "{{ opensearch_dashboards_internal_fqdn | kolla_url(internal_protocol, opensearch_dashboards_port) }}" -opensearch_dashboards_external_endpoint: "{{ opensearch_dashboards_external_fqdn | kolla_url(public_protocol, opensearch_dashboards_port_external) }}" -opensearch_dashboards_user: "opensearch" -opensearch_log_index_prefix: "{{ kibana_log_prefix if kibana_log_prefix is defined else 'flog' }}" - -################### -# Messaging options -################### -# oslo.messaging rpc transport valid options are [ rabbit, amqp ] -om_rpc_transport: "rabbit" -om_rpc_user: "{{ rabbitmq_user }}" -om_rpc_password: "{{ rabbitmq_password }}" -om_rpc_port: "{{ rabbitmq_port }}" -om_rpc_group: "rabbitmq" -om_rpc_vhost: "/" - -rpc_transport_url: "{{ om_rpc_transport }}://{% for host in groups[om_rpc_group] %}{{ om_rpc_user }}:{{ om_rpc_password }}@{{ 'api' | kolla_address(host) | put_address_in_context('url') }}:{{ om_rpc_port }}{% if not loop.last %},{% endif %}{% endfor %}/{{ om_rpc_vhost }}" - -# oslo.messaging notify transport valid options are [ rabbit ] -om_notify_transport: "rabbit" -om_notify_user: "{{ rabbitmq_user }}" -om_notify_password: "{{ rabbitmq_password }}" -om_notify_port: "{{ rabbitmq_port }}" -om_notify_group: "rabbitmq" -om_notify_vhost: "/" - -notify_transport_url: "{{ om_notify_transport }}://{% for host in groups[om_notify_group] %}{{ om_notify_user }}:{{ om_notify_password }}@{{ 'api' | kolla_address(host) | put_address_in_context('url') }}:{{ om_notify_port }}{% if not loop.last %},{% endif %}{% endfor %}/{{ om_notify_vhost }}" - -# Whether to enable TLS for oslo.messaging communication with RabbitMQ. -om_enable_rabbitmq_tls: "{{ rabbitmq_enable_tls | bool }}" -# CA certificate bundle in containers using oslo.messaging with RabbitMQ TLS. -om_rabbitmq_cacert: "{{ rabbitmq_cacert }}" -om_rabbitmq_qos_prefetch_count: "1" - -om_enable_rabbitmq_stream_fanout: true - -#################### -# Networking options -#################### -network_interface: "eth0" -neutron_external_interface: "eth1" -kolla_external_vip_interface: "{{ network_interface }}" -api_interface: "{{ network_interface }}" -migration_interface: "{{ api_interface }}" -tunnel_interface: "{{ network_interface }}" -octavia_network_interface: "{{ 'o-hm0' if octavia_network_type == 'tenant' else api_interface }}" -bifrost_network_interface: "{{ network_interface }}" -dns_interface: "{{ network_interface }}" -dpdk_tunnel_interface: "{{ neutron_external_interface }}" -ironic_http_interface: "{{ api_interface }}" -ironic_tftp_interface: "{{ api_interface }}" - -# Configure the address family (AF) per network. -# Valid options are [ ipv4, ipv6 ] -network_address_family: "ipv4" -api_address_family: "{{ network_address_family }}" -storage_address_family: "{{ network_address_family }}" -migration_address_family: "{{ api_address_family }}" -tunnel_address_family: "{{ network_address_family }}" -octavia_network_address_family: "{{ api_address_family }}" -bifrost_network_address_family: "{{ network_address_family }}" -dns_address_family: "{{ network_address_family }}" -dpdk_tunnel_address_family: "{{ network_address_family }}" -ironic_http_address_family: "{{ api_address_family }}" -ironic_tftp_address_family: "{{ api_address_family }}" - -migration_interface_address: "{{ 'migration' | kolla_address }}" -tunnel_interface_address: "{{ 'tunnel' | kolla_address }}" -octavia_network_interface_address: "{{ 'octavia_network' | kolla_address }}" -dpdk_tunnel_interface_address: "{{ 'dpdk_tunnel' | kolla_address }}" -ironic_http_interface_address: "{{ 'ironic_http' | kolla_address }}" -ironic_tftp_interface_address: "{{ 'ironic_tftp' | kolla_address }}" - -# Valid options are [ openvswitch, ovn, linuxbridge ] -# Do note linuxbridge is *EXPERIMENTAL* in Neutron since Zed and it requires extra tweaks to config to be usable. -# For details, see: https://docs.openstack.org/neutron/latest/admin/config-experimental-framework.html -neutron_plugin_agent: "openvswitch" - -# Valid options are [ internal, infoblox ] -neutron_ipam_driver: "internal" - -# The default ports used by each service. -# The list should be in alphabetical order -aodh_internal_fqdn: "{{ kolla_internal_fqdn }}" -aodh_external_fqdn: "{{ kolla_external_fqdn }}" -aodh_internal_endpoint: "{{ aodh_internal_fqdn | kolla_url(internal_protocol, aodh_api_port) }}" -aodh_public_endpoint: "{{ aodh_external_fqdn | kolla_url(public_protocol, aodh_api_public_port) }}" -aodh_api_port: "8042" -aodh_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else aodh_api_port }}" -aodh_api_listen_port: "{{ aodh_api_port }}" - -barbican_internal_fqdn: "{{ kolla_internal_fqdn }}" -barbican_external_fqdn: "{{ kolla_external_fqdn }}" -barbican_internal_endpoint: "{{ barbican_internal_fqdn | kolla_url(internal_protocol, barbican_api_port) }}" -barbican_public_endpoint: "{{ barbican_external_fqdn | kolla_url(public_protocol, barbican_api_public_port) }}" -barbican_api_port: "9311" -barbican_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else barbican_api_port }}" -barbican_api_listen_port: "{{ barbican_api_port }}" - -blazar_internal_fqdn: "{{ kolla_internal_fqdn }}" -blazar_external_fqdn: "{{ kolla_external_fqdn }}" -blazar_internal_base_endpoint: "{{ blazar_internal_fqdn | kolla_url(internal_protocol, blazar_api_port) }}" -blazar_public_base_endpoint: "{{ blazar_external_fqdn | kolla_url(public_protocol, blazar_api_public_port) }}" -blazar_api_port: "1234" -blazar_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else blazar_api_port }}" -blazar_api_listen_port: "{{ blazar_api_port }}" - -ceph_rgw_internal_fqdn: "{{ kolla_internal_fqdn }}" -ceph_rgw_external_fqdn: "{{ kolla_external_fqdn }}" -ceph_rgw_internal_base_endpoint: "{{ ceph_rgw_internal_fqdn | kolla_url(internal_protocol, ceph_rgw_port) }}" -ceph_rgw_public_base_endpoint: "{{ ceph_rgw_external_fqdn | kolla_url(public_protocol, ceph_rgw_public_port) }}" -ceph_rgw_port: "6780" -ceph_rgw_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else ceph_rgw_port }}" - -cinder_internal_fqdn: "{{ kolla_internal_fqdn }}" -cinder_external_fqdn: "{{ kolla_external_fqdn }}" -cinder_internal_base_endpoint: "{{ cinder_internal_fqdn | kolla_url(internal_protocol, cinder_api_port) }}" -cinder_public_base_endpoint: "{{ cinder_external_fqdn | kolla_url(public_protocol, cinder_api_public_port) }}" -cinder_api_port: "8776" -cinder_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else cinder_api_port }}" -cinder_api_listen_port: "{{ cinder_api_port }}" - -cloudkitty_internal_fqdn: "{{ kolla_internal_fqdn }}" -cloudkitty_external_fqdn: "{{ kolla_external_fqdn }}" -cloudkitty_internal_endpoint: "{{ cloudkitty_internal_fqdn | kolla_url(internal_protocol, cloudkitty_api_port) }}" -cloudkitty_public_endpoint: "{{ cloudkitty_external_fqdn | kolla_url(public_protocol, cloudkitty_api_public_port) }}" -cloudkitty_api_port: "8889" -cloudkitty_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else cloudkitty_api_port }}" -cloudkitty_api_listen_port: "{{ cloudkitty_api_port }}" - -collectd_udp_port: "25826" - -cyborg_internal_fqdn: "{{ kolla_internal_fqdn }}" -cyborg_external_fqdn: "{{ kolla_external_fqdn }}" -cyborg_api_port: "6666" -cyborg_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else cyborg_api_port }}" -cyborg_api_listen_port: "{{ cyborg_api_port }}" - -designate_internal_fqdn: "{{ kolla_internal_fqdn }}" -designate_external_fqdn: "{{ kolla_external_fqdn }}" -designate_internal_endpoint: "{{ designate_internal_fqdn | kolla_url(internal_protocol, designate_api_port) }}" -designate_public_endpoint: "{{ designate_external_fqdn | kolla_url(public_protocol, designate_api_public_port) }}" -designate_api_port: "9001" -designate_api_listen_port: "{{ designate_api_port }}" -designate_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else designate_api_port }}" -designate_bind_port: "53" -designate_mdns_port: "{{ '53' if designate_backend == 'infoblox' else '5354' }}" -designate_rndc_port: "953" - -etcd_client_port: "2379" -etcd_peer_port: "2380" -etcd_enable_tls: "{{ kolla_enable_tls_backend }}" -etcd_protocol: "{{ 'https' if etcd_enable_tls | bool else 'http' }}" - -fluentd_syslog_port: "5140" - -glance_internal_fqdn: "{{ kolla_internal_fqdn }}" -glance_external_fqdn: "{{ kolla_external_fqdn }}" -glance_internal_endpoint: "{{ glance_internal_fqdn | kolla_url(internal_protocol, glance_api_port) }}" -glance_public_endpoint: "{{ glance_external_fqdn | kolla_url(public_protocol, glance_api_public_port) }}" -glance_api_port: "9292" -glance_api_listen_port: "{{ glance_api_port }}" -glance_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else glance_api_port }}" -glance_tls_proxy_stats_port: "9293" - -gnocchi_internal_fqdn: "{{ kolla_internal_fqdn }}" -gnocchi_external_fqdn: "{{ kolla_external_fqdn }}" -gnocchi_internal_endpoint: "{{ gnocchi_internal_fqdn | kolla_url(internal_protocol, gnocchi_api_port) }}" -gnocchi_public_endpoint: "{{ gnocchi_external_fqdn | kolla_url(public_protocol, gnocchi_api_public_port) }}" -gnocchi_api_port: "8041" -gnocchi_api_listen_port: "{{ gnocchi_api_port }}" -gnocchi_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else gnocchi_api_port }}" - -grafana_internal_fqdn: "{{ kolla_internal_fqdn }}" -grafana_external_fqdn: "{{ kolla_external_fqdn }}" -grafana_internal_endpoint: "{{ grafana_internal_fqdn | kolla_url(internal_protocol, grafana_server_port) }}" -grafana_public_endpoint: "{{ grafana_external_fqdn | kolla_url(public_protocol, grafana_server_public_port) }}" -grafana_server_port: "3000" -grafana_server_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else grafana_server_port }}" -grafana_server_listen_port: "{{ grafana_server_port }}" - -haproxy_stats_port: "1984" -haproxy_monitor_port: "61313" -haproxy_ssh_port: "2985" -# configure SSL/TLS settings for haproxy config, one of [modern, intermediate, legacy]: -kolla_haproxy_ssl_settings: "modern" - -haproxy_ssl_settings: "{{ ssl_legacy_settings if kolla_haproxy_ssl_settings == 'legacy' else ssl_intermediate_settings if kolla_haproxy_ssl_settings == 'intermediate' else ssl_modern_settings | default(ssl_modern_settings) }}" - -ssl_legacy_settings: | - ssl-default-bind-ciphers DEFAULT:!MEDIUM:!3DES - ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11 - -ssl_intermediate_settings: | - ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305 - ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256 - ssl-default-bind-options prefer-client-ciphers no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets - ssl-default-server-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305 - ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256 - ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets - -ssl_modern_settings: | - ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256 - ssl-default-bind-options prefer-client-ciphers no-sslv3 no-tlsv10 no-tlsv11 no-tlsv12 no-tls-tickets - ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256 - ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tlsv12 no-tls-tickets - -heat_internal_fqdn: "{{ kolla_internal_fqdn }}" -heat_external_fqdn: "{{ kolla_external_fqdn }}" -heat_internal_base_endpoint: "{{ heat_internal_fqdn | kolla_url(internal_protocol, heat_api_port) }}" -heat_public_base_endpoint: "{{ heat_external_fqdn | kolla_url(public_protocol, heat_api_public_port) }}" -heat_api_port: "8004" -heat_api_listen_port: "{{ heat_api_port }}" -heat_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else heat_api_port }}" -heat_cfn_internal_fqdn: "{{ kolla_internal_fqdn }}" -heat_cfn_external_fqdn: "{{ kolla_external_fqdn }}" -heat_cfn_internal_base_endpoint: "{{ heat_cfn_internal_fqdn | kolla_url(internal_protocol, heat_api_cfn_port) }}" -heat_cfn_public_base_endpoint: "{{ heat_cfn_external_fqdn | kolla_url(public_protocol, heat_api_cfn_public_port) }}" -heat_api_cfn_port: "8000" -heat_api_cfn_listen_port: "{{ heat_api_cfn_port }}" -heat_api_cfn_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else heat_api_cfn_port }}" - -horizon_internal_fqdn: "{{ kolla_internal_fqdn }}" -horizon_external_fqdn: "{{ kolla_external_fqdn }}" -horizon_internal_endpoint: "{{ kolla_internal_fqdn | kolla_url(internal_protocol, horizon_tls_port if kolla_enable_tls_internal | bool else horizon_port) }}" -horizon_public_endpoint: "{{ kolla_external_fqdn | kolla_url(public_protocol, horizon_tls_port if kolla_enable_tls_external | bool else horizon_port) }}" -horizon_port: "80" -horizon_tls_port: "443" -horizon_listen_port: "{{ horizon_tls_port if horizon_enable_tls_backend | bool else horizon_port }}" - -influxdb_http_port: "8086" - -ironic_internal_fqdn: "{{ kolla_internal_fqdn }}" -ironic_external_fqdn: "{{ kolla_external_fqdn }}" -ironic_internal_endpoint: "{{ ironic_internal_fqdn | kolla_url(internal_protocol, ironic_api_port) }}" -ironic_public_endpoint: "{{ ironic_external_fqdn | kolla_url(public_protocol, ironic_api_public_port) }}" -ironic_api_port: "6385" -ironic_api_listen_port: "{{ ironic_api_port }}" -ironic_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else ironic_api_port }}" -ironic_http_port: "8089" -ironic_prometheus_exporter_port: "9608" - -iscsi_port: "3260" - -keystone_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else keystone_public_listen_port }}" -keystone_public_listen_port: "5000" -keystone_internal_port: "5000" -keystone_internal_listen_port: "{{ keystone_internal_port }}" -keystone_listen_port: "{{ keystone_internal_listen_port }}" - -keystone_ssh_port: "8023" - -kuryr_port: "23750" - -letsencrypt_webserver_port: "8081" -letsencrypt_managed_certs: "{{ '' if not enable_letsencrypt | bool else ('internal' if letsencrypt_internal_cert_server != '' and kolla_same_external_internal_vip | bool else ('internal,external' if letsencrypt_internal_cert_server != '' and letsencrypt_external_cert_server != '' else ('internal' if letsencrypt_internal_cert_server != '' else ('external' if letsencrypt_external_cert_server != '' and not kolla_same_external_internal_vip | bool else '')))) }}" -letsencrypt_external_cert_server: "https://acme-v02.api.letsencrypt.org/directory" -letsencrypt_internal_cert_server: "" - -magnum_internal_fqdn: "{{ kolla_internal_fqdn }}" -magnum_external_fqdn: "{{ kolla_external_fqdn }}" -magnum_internal_base_endpoint: "{{ magnum_internal_fqdn | kolla_url(internal_protocol, magnum_api_port) }}" -magnum_public_base_endpoint: "{{ magnum_external_fqdn | kolla_url(public_protocol, magnum_api_public_port) }}" -magnum_api_port: "9511" -magnum_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else magnum_api_port }}" -magnum_api_listen_port: "{{ magnum_api_port }}" - -manila_internal_fqdn: "{{ kolla_internal_fqdn }}" -manila_external_fqdn: "{{ kolla_external_fqdn }}" -manila_internal_base_endpoint: "{{ manila_internal_fqdn | kolla_url(internal_protocol, manila_api_port) }}" -manila_public_base_endpoint: "{{ manila_external_fqdn | kolla_url(public_protocol, manila_api_public_port) }}" -manila_api_port: "8786" -manila_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else manila_api_port }}" -manila_api_listen_port: "{{ manila_api_port }}" - -mariadb_port: "{{ database_port }}" -mariadb_wsrep_port: "4567" -mariadb_ist_port: "4568" -mariadb_sst_port: "4444" -mariadb_clustercheck_port: "4569" -mariadb_enable_tls_backend: "{{ database_enable_tls_backend }}" - -mariadb_monitor_user: "{{ 'monitor' if enable_proxysql | bool else 'haproxy' }}" - -mariadb_datadir_volume: "mariadb" - -mariadb_default_database_shard_id: 0 -mariadb_default_database_shard_hosts: "{% set default_shard = [] %}{% for host in groups['mariadb'] %}{% if hostvars[host]['mariadb_shard_id'] is not defined or hostvars[host]['mariadb_shard_id'] == mariadb_default_database_shard_id %}{{ default_shard.append(host) }}{% endif %}{% endfor %}{{ default_shard }}" -mariadb_shard_id: "{{ mariadb_default_database_shard_id }}" -mariadb_shard_name: "shard_{{ mariadb_shard_id }}" -mariadb_shard_group: "mariadb_{{ mariadb_shard_name }}" -mariadb_loadbalancer: "{{ 'proxysql' if enable_proxysql | bool else 'haproxy' }}" -mariadb_backup_target: "{{ 'active' if mariadb_loadbalancer == 'haproxy' else 'replica' }}" -mariadb_shard_root_user_prefix: "root_shard_" -mariadb_shard_backup_user_prefix: "backup_shard_" -mariadb_shards_info: "{{ groups['mariadb'] | database_shards_info() }}" - -masakari_internal_fqdn: "{{ kolla_internal_fqdn }}" -masakari_external_fqdn: "{{ kolla_external_fqdn }}" -masakari_internal_endpoint: "{{ masakari_internal_fqdn | kolla_url(internal_protocol, masakari_api_port) }}" -masakari_public_endpoint: "{{ masakari_external_fqdn | kolla_url(public_protocol, masakari_api_public_port) }}" -masakari_api_port: "15868" -masakari_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else masakari_api_port }}" -masakari_api_listen_port: "{{ masakari_api_port }}" -masakari_coordination_backend: "{{ 'redis' if enable_redis | bool else 'etcd' if enable_etcd | bool else '' }}" - -memcached_port: "11211" -memcache_security_strategy: "ENCRYPT" - -mistral_internal_fqdn: "{{ kolla_internal_fqdn }}" -mistral_external_fqdn: "{{ kolla_external_fqdn }}" -mistral_internal_base_endpoint: "{{ mistral_internal_fqdn | kolla_url(internal_protocol, mistral_api_port) }}" -mistral_public_base_endpoint: "{{ mistral_external_fqdn | kolla_url(public_protocol, mistral_api_public_port) }}" -mistral_api_port: "8989" -mistral_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else mistral_api_port }}" -mistral_api_listen_port: "{{ mistral_api_port }}" - -neutron_internal_fqdn: "{{ kolla_internal_fqdn }}" -neutron_external_fqdn: "{{ kolla_external_fqdn }}" -neutron_internal_endpoint: "{{ neutron_internal_fqdn | kolla_url(internal_protocol, neutron_server_port) }}" -neutron_public_endpoint: "{{ neutron_external_fqdn | kolla_url(public_protocol, neutron_server_public_port) }}" -neutron_server_port: "9696" -neutron_server_listen_port: "{{ neutron_server_port }}" -neutron_server_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else neutron_server_port }}" - -nova_internal_fqdn: "{{ kolla_internal_fqdn }}" -nova_external_fqdn: "{{ kolla_external_fqdn }}" -nova_internal_base_endpoint: "{{ nova_internal_fqdn | kolla_url(internal_protocol, nova_api_port) }}" -nova_public_base_endpoint: "{{ nova_external_fqdn | kolla_url(public_protocol, nova_api_public_port) }}" -nova_api_port: "8774" -nova_api_listen_port: "{{ nova_api_port }}" -nova_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else nova_api_port }}" -nova_metadata_internal_fqdn: "{{ kolla_internal_fqdn }}" -nova_metadata_external_fqdn: "{{ kolla_external_fqdn }}" -nova_metadata_port: "8775" -nova_metadata_listen_port: "{{ nova_metadata_port }}" -nova_novncproxy_fqdn: "{{ kolla_external_fqdn }}" -nova_novncproxy_port: "6080" -nova_novncproxy_listen_port: "{{ nova_novncproxy_port }}" -nova_novncproxy_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else nova_novncproxy_port }}" -nova_spicehtml5proxy_fqdn: "{{ kolla_external_fqdn }}" -nova_spicehtml5proxy_port: "6082" -nova_spicehtml5proxy_listen_port: "{{ nova_spicehtml5proxy_port }}" -nova_spicehtml5proxy_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else nova_spicehtml5proxy_port }}" -nova_serialproxy_fqdn: "{{ kolla_external_fqdn }}" -nova_serialproxy_port: "6083" -nova_serialproxy_listen_port: "{{ nova_serialproxy_port }}" -nova_serialproxy_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else nova_serialproxy_port }}" -nova_serialproxy_protocol: "{{ 'wss' if kolla_enable_tls_external | bool else 'ws' }}" - -octavia_internal_fqdn: "{{ kolla_internal_fqdn }}" -octavia_external_fqdn: "{{ kolla_external_fqdn }}" -octavia_internal_endpoint: "{{ octavia_internal_fqdn | kolla_url(internal_protocol, octavia_api_port) }}" -octavia_public_endpoint: "{{ octavia_external_fqdn | kolla_url(public_protocol, octavia_api_public_port) }}" -octavia_api_port: "9876" -octavia_api_listen_port: "{{ octavia_api_port }}" -octavia_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else octavia_api_port }}" -octavia_health_manager_port: "5555" - -# NOTE: If an external ElasticSearch cluster port is specified, -# we default to using that port in services with ElasticSearch -# endpoints. This is for backwards compatibility. -opensearch_port: "{{ elasticsearch_port | default('9200') }}" -opensearch_dashboards_port: "5601" -opensearch_dashboards_port_external: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else opensearch_dashboards_port }}" -opensearch_dashboards_listen_port: "{{ opensearch_dashboards_port }}" - -ovn_nb_db_port: "6641" -ovn_sb_db_port: "6642" -# OVN SB Relay related variables -ovn_sb_db_relay_count: "{{ ((groups['ovn-controller'] | length) / ovn_sb_db_relay_compute_per_relay | int) | round(0, 'ceil') | int }}" -ovn_sb_db_relay_compute_per_relay: "50" -ovn_sb_db_relay_port_prefix: "1664" -ovn_sb_db_relay_port: "{{ ovn_sb_db_relay_port_prefix ~ ovn_sb_db_relay_client_group_id }}" -ovn_sb_db_relay_client_group_id: "{{ range(1, ovn_sb_db_relay_count | int + 1) | random(seed=inventory_hostname) }}" -ovn_nb_connection: "{% for host in groups['ovn-nb-db'] %}tcp:{{ 'api' | kolla_address(host) | put_address_in_context('url') }}:{{ ovn_nb_db_port }}{% if not loop.last %},{% endif %}{% endfor %}" -ovn_sb_connection: "{{ ovn_sb_connection_relay if enable_ovn_sb_db_relay | bool else ovn_sb_connection_no_relay }}" -ovn_sb_connection_no_relay: "{% for host in groups['ovn-sb-db'] %}tcp:{{ 'api' | kolla_address(host) | put_address_in_context('url') }}:{{ ovn_sb_db_port }}{% if not loop.last %},{% endif %}{% endfor %}" -ovn_sb_connection_relay: "{% for host in groups['ovn-sb-db-relay'] %}tcp:{{ 'api' | kolla_address(host) | put_address_in_context('url') }}:{{ ovn_sb_db_relay_port }}{% if not loop.last %},{% endif %}{% endfor %}" - -ovsdb_port: "6640" - -placement_internal_fqdn: "{{ kolla_internal_fqdn }}" -placement_external_fqdn: "{{ kolla_external_fqdn }}" -placement_internal_endpoint: "{{ placement_internal_fqdn | kolla_url(internal_protocol, placement_api_port) }}" -placement_public_endpoint: "{{ placement_external_fqdn | kolla_url(public_protocol, placement_api_public_port) }}" -# Default Placement API port of 8778 already in use -placement_api_port: "8780" -placement_api_listen_port: "{{ placement_api_port }}" -placement_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else placement_api_port }}" - -prometheus_internal_fqdn: "{{ kolla_internal_fqdn }}" -prometheus_external_fqdn: "{{ kolla_external_fqdn }}" -prometheus_internal_endpoint: "{{ prometheus_internal_fqdn | kolla_url(internal_protocol, prometheus_port) }}" -prometheus_public_endpoint: "{{ prometheus_external_fqdn | kolla_url(public_protocol, prometheus_public_port) }}" -prometheus_port: "9091" -prometheus_listen_port: "{{ prometheus_port }}" -prometheus_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else prometheus_port }}" -prometheus_node_exporter_port: "9100" -prometheus_mysqld_exporter_port: "9104" -prometheus_haproxy_exporter_port: "9101" -prometheus_memcached_exporter_port: "9150" -prometheus_rabbitmq_exporter_port: "{{ rabbitmq_prometheus_port }}" -# Default cadvisor port of 8080 already in use -prometheus_cadvisor_port: "18080" -prometheus_fluentd_integration_port: "24231" -prometheus_libvirt_exporter_port: "9177" -prometheus_etcd_integration_port: "{{ etcd_client_port }}" -proxysql_prometheus_exporter_port: "6070" - -# Prometheus alertmanager ports -prometheus_alertmanager_internal_fqdn: "{{ kolla_internal_fqdn }}" -prometheus_alertmanager_external_fqdn: "{{ kolla_external_fqdn }}" -prometheus_alertmanager_internal_endpoint: "{{ prometheus_alertmanager_internal_fqdn | kolla_url(internal_protocol, prometheus_alertmanager_port) }}" -prometheus_alertmanager_public_endpoint: "{{ prometheus_alertmanager_external_fqdn | kolla_url(public_protocol, prometheus_alertmanager_public_port) }}" -prometheus_alertmanager_port: "9093" -prometheus_alertmanager_cluster_port: "9094" -prometheus_alertmanager_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else prometheus_alertmanager_port }}" -prometheus_alertmanager_listen_port: "{{ prometheus_alertmanager_port }}" - -# Prometheus openstack-exporter ports -prometheus_openstack_exporter_port: "9198" -prometheus_elasticsearch_exporter_port: "9108" - -# Prometheus blackbox-exporter ports -prometheus_blackbox_exporter_port: "9115" - -# Prometheus instance label to use for metrics -prometheus_instance_label: - -proxysql_admin_port: "6032" - -rabbitmq_port: "{{ '5671' if rabbitmq_enable_tls | bool else '5672' }}" -rabbitmq_management_port: "15672" -rabbitmq_cluster_port: "25672" -rabbitmq_epmd_port: "4369" -rabbitmq_prometheus_port: "15692" - -redis_port: "6379" -redis_sentinel_port: "26379" - -skyline_apiserver_internal_fqdn: "{{ kolla_internal_fqdn }}" -skyline_apiserver_external_fqdn: "{{ kolla_external_fqdn }}" -skyline_apiserver_internal_endpoint: "{{ skyline_apiserver_internal_fqdn | kolla_url(internal_protocol, skyline_apiserver_port) }}" -skyline_apiserver_public_endpoint: "{{ skyline_apiserver_external_fqdn | kolla_url(public_protocol, skyline_apiserver_public_port) }}" -skyline_console_internal_fqdn: "{{ kolla_internal_fqdn }}" -skyline_console_external_fqdn: "{{ kolla_external_fqdn }}" -skyline_console_internal_endpoint: "{{ skyline_console_internal_fqdn | kolla_url(internal_protocol, skyline_console_port) }}" -skyline_console_public_endpoint: "{{ skyline_console_external_fqdn | kolla_url(public_protocol, skyline_console_public_port) }}" -skyline_apiserver_port: "9998" -skyline_apiserver_listen_port: "{{ skyline_apiserver_port }}" -skyline_apiserver_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else skyline_apiserver_port }}" -skyline_console_port: "9999" -skyline_console_listen_port: "{{ skyline_console_port }}" -skyline_console_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else skyline_console_port }}" -skyline_enable_sso: "{{ enable_keystone_federation | bool and keystone_identity_providers | selectattr('protocol', 'equalto', 'openid') | list | count > 0 }}" - -syslog_udp_port: "{{ fluentd_syslog_port }}" - -tacker_internal_fqdn: "{{ kolla_internal_fqdn }}" -tacker_external_fqdn: "{{ kolla_external_fqdn }}" -tacker_internal_endpoint: "{{ tacker_internal_fqdn | kolla_url(internal_protocol, tacker_server_port) }}" -tacker_public_endpoint: "{{ tacker_external_fqdn | kolla_url(public_protocol, tacker_server_public_port) }}" -tacker_server_port: "9890" -tacker_server_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else tacker_server_port }}" -tacker_server_listen_port: "{{ tacker_server_port }}" - -trove_internal_fqdn: "{{ kolla_internal_fqdn }}" -trove_external_fqdn: "{{ kolla_external_fqdn }}" -trove_internal_base_endpoint: "{{ trove_internal_fqdn | kolla_url(internal_protocol, trove_api_port) }}" -trove_public_base_endpoint: "{{ trove_external_fqdn | kolla_url(public_protocol, trove_api_public_port) }}" -trove_api_port: "8779" -trove_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else trove_api_port }}" -trove_api_listen_port: "{{ trove_api_port }}" - -venus_internal_fqdn: "{{ kolla_internal_fqdn }}" -venus_external_fqdn: "{{ kolla_external_fqdn }}" -venus_internal_endpoint: "{{ venus_internal_fqdn | kolla_url(internal_protocol, venus_api_port) }}" -venus_public_endpoint: "{{ venus_external_fqdn | kolla_url(public_protocol, venus_api_public_port) }}" -venus_api_port: "10010" -venus_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else venus_api_port }}" -venus_api_listen_port: "{{ venus_api_port }}" - -watcher_internal_fqdn: "{{ kolla_internal_fqdn }}" -watcher_external_fqdn: "{{ kolla_external_fqdn }}" -watcher_internal_endpoint: "{{ watcher_internal_fqdn | kolla_url(internal_protocol, watcher_api_port) }}" -watcher_public_endpoint: "{{ watcher_external_fqdn | kolla_url(public_protocol, watcher_api_public_port) }}" -watcher_api_port: "9322" -watcher_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else watcher_api_port }}" -watcher_api_listen_port: "{{ watcher_api_port }}" - -zun_api_port: "9517" -zun_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else zun_api_port }}" -zun_api_listen_port: "{{ zun_api_port }}" -zun_wsproxy_internal_fqdn: "{{ kolla_internal_fqdn }}" -zun_wsproxy_external_fqdn: "{{ kolla_external_fqdn }}" -zun_wsproxy_port: "6784" -zun_wsproxy_protocol: "{{ 'wss' if kolla_enable_tls_external | bool else 'ws' }}" -zun_cni_daemon_port: "9036" -zun_internal_fqdn: "{{ kolla_internal_fqdn }}" -zun_external_fqdn: "{{ kolla_external_fqdn }}" -zun_internal_base_endpoint: "{{ zun_internal_fqdn | kolla_url(internal_protocol, zun_api_port) }}" -zun_public_base_endpoint: "{{ zun_external_fqdn | kolla_url(public_protocol, zun_api_public_port) }}" - -public_protocol: "{{ 'https' if kolla_enable_tls_external | bool else 'http' }}" -internal_protocol: "{{ 'https' if kolla_enable_tls_internal | bool else 'http' }}" - -################## -# Firewall options -################## -enable_external_api_firewalld: "false" -external_api_firewalld_zone: "public" - -#################### -# OpenStack options -#################### -openstack_release: "master" -# Docker image tag used by default. -openstack_tag: "{{ openstack_release }}-{{ kolla_base_distro }}-{{ kolla_base_distro_version }}{{ openstack_tag_suffix }}" -openstack_tag_suffix: "" -openstack_logging_debug: "False" - -openstack_region_name: "RegionOne" - -# A list of policy file formats that are supported by Oslo.policy -supported_policy_format_list: - - policy.yaml - - policy.json - -# In the context of multi-regions, list here the name of all your regions. -multiple_regions_names: - - "{{ openstack_region_name }}" - -openstack_service_workers: "{{ [ansible_facts.processor_vcpus, 5] | min }}" -openstack_service_rpc_workers: "{{ [ansible_facts.processor_vcpus, 3] | min }}" - -# Optionally allow Kolla to set sysctl values -set_sysctl: "yes" - -# Optionally change the path to sysctl.conf modified by Kolla Ansible plays. -kolla_sysctl_conf_path: /etc/sysctl.conf - -# Endpoint type used to connect with OpenStack services with ansible modules. -# Valid options are [ public, internal ] -openstack_interface: "internal" - -# Openstack CA certificate bundle file -# CA bundle file must be added to both the Horizon and Kolla Toolbox containers -openstack_cacert: "" - -# Enable core OpenStack services. This includes: -# glance, keystone, neutron, nova, heat, and horizon. -enable_openstack_core: "yes" - -# These roles are required for Kolla to be operation, however a savvy deployer -# could disable some of these required roles and run their own services. -enable_glance: "{{ enable_openstack_core | bool }}" -enable_haproxy: "yes" -enable_keepalived: "{{ enable_haproxy | bool }}" -enable_loadbalancer: "{{ enable_haproxy | bool or enable_keepalived | bool or enable_proxysql | bool }}" -enable_keystone: "{{ enable_openstack_core | bool }}" -enable_keystone_federation: "{{ (keystone_identity_providers | length > 0) and (keystone_identity_mappings | length > 0) }}" -enable_mariadb: "yes" -enable_memcached: "yes" -enable_neutron: "{{ enable_openstack_core | bool }}" -enable_nova: "{{ enable_openstack_core | bool }}" -enable_rabbitmq: "{{ 'yes' if om_rpc_transport == 'rabbit' or om_notify_transport == 'rabbit' else 'no' }}" - -# NOTE: Most memcached clients handle load-balancing via client side -# hashing (consistent or not) logic, so going under the covers and messing -# with things that the clients are not aware of is generally wrong -enable_haproxy_memcached: "no" - -# Additional optional OpenStack features and services are specified here -enable_aodh: "no" -enable_barbican: "no" -enable_blazar: "no" -enable_ceilometer: "no" -enable_ceilometer_ipmi: "no" -enable_ceilometer_prometheus_pushgateway: "no" -enable_cells: "no" -enable_central_logging: "no" -enable_ceph_rgw: "no" -enable_ceph_rgw_loadbalancer: "{{ enable_ceph_rgw | bool }}" -enable_cinder: "no" -enable_cinder_backup: "yes" -enable_cinder_backend_iscsi: "{{ enable_cinder_backend_lvm | bool }}" -enable_cinder_backend_lvm: "no" -enable_cinder_backend_nfs: "no" -enable_cinder_backend_quobyte: "no" -enable_cinder_backend_pure_iscsi: "no" -enable_cinder_backend_pure_fc: "no" -enable_cinder_backend_pure_roce: "no" -enable_cinder_backend_pure_nvme_tcp: "no" -enable_cinder_backend_lightbits: "no" -enable_cloudkitty: "no" -enable_collectd: "no" -enable_cyborg: "no" -enable_designate: "no" -enable_etcd: "no" -enable_fluentd: "yes" -enable_fluentd_systemd: "{{ (enable_fluentd | bool) and (enable_central_logging | bool) }}" -enable_gnocchi: "no" -enable_gnocchi_statsd: "no" -enable_grafana: "no" -enable_grafana_external: "{{ enable_grafana | bool }}" -enable_hacluster: "{{ enable_masakari_hostmonitor | bool }}" -enable_heat: "{{ enable_openstack_core | bool }}" -enable_horizon: "{{ enable_openstack_core | bool }}" -enable_horizon_blazar: "{{ enable_blazar | bool }}" -enable_horizon_cloudkitty: "{{ enable_cloudkitty | bool }}" -enable_horizon_designate: "{{ enable_designate | bool }}" -enable_horizon_fwaas: "{{ enable_neutron_fwaas | bool }}" -enable_horizon_heat: "{{ enable_heat | bool }}" -enable_horizon_ironic: "{{ enable_ironic | bool }}" -enable_horizon_magnum: "{{ enable_magnum | bool }}" -enable_horizon_manila: "{{ enable_manila | bool }}" -enable_horizon_masakari: "{{ enable_masakari | bool }}" -enable_horizon_mistral: "{{ enable_mistral | bool }}" -enable_horizon_neutron_vpnaas: "{{ enable_neutron_vpnaas | bool }}" -enable_horizon_octavia: "{{ enable_octavia | bool }}" -enable_horizon_tacker: "{{ enable_tacker | bool }}" -enable_horizon_trove: "{{ enable_trove | bool }}" -enable_horizon_venus: "{{ enable_venus | bool }}" -enable_horizon_watcher: "{{ enable_watcher | bool }}" -enable_horizon_zun: "{{ enable_zun | bool }}" -enable_influxdb: "{{ enable_cloudkitty | bool and cloudkitty_storage_backend == 'influxdb' }}" -enable_ironic: "no" -enable_ironic_dnsmasq: "{{ enable_ironic | bool }}" -enable_ironic_neutron_agent: "no" -enable_ironic_prometheus_exporter: "{{ enable_ironic | bool and enable_prometheus | bool }}" -enable_iscsid: "{{ enable_cinder | bool and enable_cinder_backend_iscsi | bool }}" -enable_kuryr: "no" -enable_letsencrypt: "no" -enable_magnum: "no" -enable_manila: "no" -enable_manila_backend_generic: "no" -enable_manila_backend_hnas: "no" -enable_manila_backend_cephfs_native: "no" -enable_manila_backend_cephfs_nfs: "no" -enable_manila_backend_glusterfs_nfs: "no" -enable_manila_backend_flashblade: "no" -enable_mariabackup: "no" -enable_masakari: "no" -enable_masakari_instancemonitor: "{{ enable_masakari | bool }}" -enable_masakari_hostmonitor: "{{ enable_masakari | bool }}" -enable_mistral: "no" -enable_multipathd: "no" -enable_neutron_vpnaas: "no" -enable_neutron_sriov: "no" -enable_neutron_mlnx: "no" -enable_neutron_dvr: "no" -enable_neutron_fwaas: "no" -enable_neutron_qos: "no" -enable_neutron_agent_ha: "no" -enable_neutron_bgp_dragent: "no" -enable_neutron_provider_networks: "no" -enable_neutron_segments: "no" -enable_neutron_packet_logging: "no" -enable_neutron_sfc: "no" -enable_neutron_taas: "no" -enable_neutron_trunk: "no" -enable_neutron_metering: "no" -enable_neutron_infoblox_ipam_agent: "no" -enable_neutron_port_forwarding: "no" -enable_nova_libvirt_container: "{{ nova_compute_virt_type in ['kvm', 'qemu'] }}" -enable_nova_serialconsole_proxy: "no" -enable_nova_ssh: "yes" -enable_octavia: "no" -enable_octavia_driver_agent: "{{ enable_octavia | bool and neutron_plugin_agent == 'ovn' }}" -enable_octavia_jobboard: "{{ enable_octavia | bool and 'amphora' in octavia_provider_drivers }}" -enable_openvswitch: "{{ enable_neutron | bool and neutron_plugin_agent != 'linuxbridge' }}" -enable_ovn: "{{ enable_neutron | bool and neutron_plugin_agent == 'ovn' }}" -enable_ovn_sb_db_relay: "{{ enable_ovn | bool }}" -enable_ovs_dpdk: "no" -enable_osprofiler: "no" -enable_placement: "{{ enable_nova | bool or enable_zun | bool }}" -enable_prometheus: "no" -enable_proxysql: "yes" -enable_redis: "no" -enable_skyline: "no" -enable_tacker: "no" -enable_telegraf: "no" -enable_trove: "no" -enable_trove_singletenant: "no" -enable_venus: "no" -enable_watcher: "no" -enable_zun: "no" - -ovs_datapath: "{{ 'netdev' if enable_ovs_dpdk | bool else 'system' }}" -designate_keystone_user: "designate" -ironic_keystone_user: "ironic" -neutron_keystone_user: "neutron" -nova_keystone_user: "nova" -placement_keystone_user: "placement" -cinder_keystone_user: "cinder" -glance_keystone_user: "glance" - -# Nova fake driver and the number of fake driver per compute node -enable_nova_fake: "no" -num_nova_fake_per_node: 5 - -# Clean images options are specified here -enable_destroy_images: "no" - -#################### -# Global Options -#################### -# List of containers to skip during stop command in YAML list format -# skip_stop_containers: -# - container1 -# - container2 -skip_stop_containers: [] - -#################### -# Logging options -#################### - -# NOTE: If an external ElasticSearch cluster address is configured, all -# services with ElasticSearch endpoints should be configured to log -# to the external cluster by default. This is for backwards compatibility. -opensearch_address: "{{ elasticsearch_address if elasticsearch_address is defined else kolla_internal_fqdn }}" -enable_opensearch: "{{ enable_central_logging | bool or enable_osprofiler | bool or (enable_cloudkitty | bool and cloudkitty_storage_backend == 'opensearch') }}" -enable_opensearch_dashboards: "{{ enable_opensearch | bool }}" -enable_opensearch_dashboards_external: "{{ enable_opensearch_dashboards | bool }}" - -#################### -# Redis options -#################### -redis_connection_string: "redis://{% for host in groups['redis'] %}{% if host == groups['redis'][0] %}default:{{ redis_master_password }}@{{ 'api' | kolla_address(host) | put_address_in_context('url') }}:{{ redis_sentinel_port }}?sentinel=kolla{% else %}&sentinel_fallback={{ 'api' | kolla_address(host) | put_address_in_context('url') }}:{{ redis_sentinel_port }}{% endif %}{% endfor %}{{ redis_connection_string_extras }}" -redis_connection_string_extras: "&db=0&socket_timeout=60&retry_on_timeout=yes" - -#################### -# Osprofiler options -#################### -# valid values: ["elasticsearch", "redis"] -osprofiler_backend: "elasticsearch" -opensearch_connection_string: "elasticsearch://{{ opensearch_address | put_address_in_context('url') }}:{{ opensearch_port }}" -osprofiler_backend_connection_string: "{{ redis_connection_string if osprofiler_backend == 'redis' else opensearch_connection_string }}" - -#################### -# RabbitMQ options -#################### -rabbitmq_user: "openstack" -rabbitmq_monitoring_user: "" -# Whether to enable TLS encryption for RabbitMQ client-server communication. -rabbitmq_enable_tls: "no" -# CA certificate bundle in RabbitMQ container. -rabbitmq_cacert: "/etc/ssl/certs/{{ 'ca-certificates.crt' if kolla_base_distro in ['debian', 'ubuntu'] else 'ca-bundle.crt' }}" -rabbitmq_datadir_volume: "rabbitmq" - -#################### -# HAProxy options -#################### -haproxy_user: "openstack" -haproxy_enable_external_vip: "{{ 'no' if kolla_same_external_internal_vip | bool else 'yes' }}" -haproxy_enable_http2: "yes" -haproxy_http2_protocol: "alpn h2,http/1.1" -kolla_enable_tls_internal: "no" -kolla_enable_tls_external: "{{ kolla_enable_tls_internal if kolla_same_external_internal_vip | bool else 'no' }}" -kolla_certificates_dir: "{{ node_config }}/certificates" -kolla_external_fqdn_cert: "{{ kolla_certificates_dir }}/haproxy.pem" -kolla_internal_fqdn_cert: "{{ kolla_certificates_dir }}/haproxy-internal.pem" -kolla_admin_openrc_cacert: "" -kolla_copy_ca_into_containers: "no" -haproxy_backend_cacert: "{{ 'ca-certificates.crt' if kolla_base_distro in ['debian', 'ubuntu'] else 'ca-bundle.crt' }}" -haproxy_backend_cacert_dir: "/etc/ssl/certs" -haproxy_single_external_frontend: false -haproxy_single_external_frontend_public_port: "{{ '443' if kolla_enable_tls_external | bool else '80' }}" - -################## -# Backend options -################## -kolla_httpd_keep_alive: "60" -kolla_httpd_timeout: "60" - -###################### -# Backend TLS options -###################### -kolla_enable_tls_backend: "no" -kolla_verify_tls_backend: "yes" -kolla_tls_backend_cert: "{{ kolla_certificates_dir }}/backend-cert.pem" -kolla_tls_backend_key: "{{ kolla_certificates_dir }}/backend-key.pem" - -##################### -# ACME client options -##################### -acme_client_lego: "server lego {{ api_interface_address }}:{{ letsencrypt_webserver_port }}" -acme_client_servers: "{% set arr = [] %}{% if enable_letsencrypt | bool %}{{ arr.append(acme_client_lego) }}{% endif %}{{ arr }}" - -#################### -# Keystone options -#################### -keystone_internal_fqdn: "{{ kolla_internal_fqdn }}" -keystone_external_fqdn: "{{ kolla_external_fqdn }}" - -keystone_internal_url: "{{ keystone_internal_fqdn | kolla_url(internal_protocol, keystone_internal_port) }}" -keystone_public_url: "{{ keystone_external_fqdn | kolla_url(public_protocol, keystone_public_port) }}" - -keystone_admin_user: "admin" -keystone_admin_project: "admin" - -# Whether or not to apply changes to service user passwords when services are -# reconfigured -update_keystone_service_user_passwords: true - -default_project_domain_name: "Default" -default_project_domain_id: "default" - -default_user_domain_name: "Default" -default_user_domain_id: "default" - -# Keystone fernet token expiry in seconds. Default is 1 day. -fernet_token_expiry: 86400 -# Keystone window to allow expired fernet tokens. Default is 2 days. -fernet_token_allow_expired_window: 172800 -# Keystone fernet key rotation interval in seconds. Default is sum of token -# expiry and allow expired window, 3 days. This ensures the minimum number -# of keys are active. If this interval is lower than the sum of the token -# expiry and allow expired window, multiple active keys will be necessary. -fernet_key_rotation_interval: "{{ fernet_token_expiry + fernet_token_allow_expired_window }}" - -keystone_default_user_role: "member" - -# OpenStack authentication string. You should only need to override these if you -# are changing the admin tenant/project or user. -openstack_auth: - auth_url: "{{ keystone_internal_url }}" - username: "{{ keystone_admin_user }}" - password: "{{ keystone_admin_password }}" - project_name: "{{ keystone_admin_project }}" - domain_name: "default" - user_domain_name: "default" - -####################### -# Glance options -####################### -glance_backend_file: "{{ not (glance_backend_ceph | bool or glance_backend_s3 | bool) }}" -glance_backend_ceph: "no" -glance_backend_s3: "no" -enable_glance_image_cache: "no" -glance_file_datadir_volume: "glance" -glance_enable_rolling_upgrade: "no" -glance_enable_property_protection: "no" -glance_enable_interoperable_image_import: "no" -glance_api_hosts: "{{ [groups['glance-api'] | first] if glance_backend_file | bool and glance_file_datadir_volume == 'glance' else groups['glance-api'] }}" -# NOTE(mnasiadka): For use in common role -glance_enable_tls_backend: "{{ kolla_enable_tls_backend }}" - -####################### -# Barbican options -####################### -# Valid options are [ simple_crypto, p11_crypto ] -barbican_crypto_plugin: "simple_crypto" -barbican_library_path: "/usr/lib/libCryptoki2_64.so" - -################# -# Gnocchi options -################# -# Valid options are [ file, ceph ] -gnocchi_backend_storage: "file" - -# Valid options are [redis, ''] -gnocchi_incoming_storage: "{{ 'redis' if enable_redis | bool else '' }}" -gnocchi_metric_datadir_volume: "gnocchi" - -################################# -# Cinder options -################################# -cinder_backend_ceph: "no" -cinder_backend_huawei: "no" -cinder_backend_huawei_xml_files: [] -cinder_volume_group: "cinder-volumes" -cinder_target_helper: "{{ 'lioadm' if ansible_facts.os_family == 'RedHat' else 'tgtadm' }}" -# Valid options are [ '', redis, etcd ] -cinder_coordination_backend: "{{ 'redis' if enable_redis | bool else 'etcd' if enable_etcd | bool else '' }}" - -# Valid options are [ nfs, ceph, s3 ] -cinder_backup_driver: "ceph" -cinder_backup_share: "" -cinder_backup_mount_options_nfs: "" - -####################### -# Cloudkitty options -####################### -# Valid options are 'sqlalchemy' or 'influxdb'. The default value is -# 'influxdb', which matches the default in Cloudkitty since the Stein release. -# When the backend is "influxdb", we also enable Influxdb. -# Also, when using 'influxdb' as the backend, we trigger the configuration/use -# of Cloudkitty storage backend version 2. -cloudkitty_storage_backend: "influxdb" - -####################### -# Designate options -####################### -# Valid options are [ bind9, infoblox ] -designate_backend: "bind9" -designate_ns_record: - - "ns1.example.org" -designate_backend_external: "no" -designate_backend_external_bind9_nameservers: "" -# Valid options are [ '', redis ] -designate_coordination_backend: "{{ 'redis' if enable_redis | bool else '' }}" - -designate_enable_notifications_sink: "no" -designate_notifications_topic_name: "notifications_designate" - -####################### -# Neutron options -####################### -neutron_bgp_router_id: "1.1.1.1" -neutron_bridge_name: "{{ 'br_dpdk' if enable_ovs_dpdk | bool else 'br-ex' }}" -neutron_physical_networks: "{% for bridge in neutron_bridge_name.split(',') %}physnet{{ loop.index }}{% if not loop.last %},{% endif %}{% endfor %}" -# Comma-separated type of enabled ml2 type drivers -neutron_type_drivers: "flat,vlan,vxlan{% if neutron_plugin_agent == 'ovn' %},geneve{% endif %}" -# Comma-separated types of tenant networks (should be listed in 'neutron_type_drivers') -# NOTE: for ironic this list should also contain 'flat' -neutron_tenant_network_types: "{% if neutron_plugin_agent == 'ovn' %}geneve{% else %}vxlan{% endif %}" - -# valid values: ["dvr", "dvr_no_external"] -neutron_compute_dvr_mode: "dvr" -computes_need_external_bridge: "{{ (enable_neutron_dvr | bool and neutron_compute_dvr_mode == 'dvr') or enable_neutron_provider_networks | bool or neutron_ovn_distributed_fip | bool }}" - -# Default DNS resolvers for virtual networks -neutron_dnsmasq_dns_servers: "1.1.1.1,8.8.8.8,8.8.4.4" - -# Set legacy iptables to allow kernels not supporting iptables-nft -neutron_legacy_iptables: "no" - -# Enable distributed floating ip for OVN deployments -neutron_ovn_distributed_fip: "no" - -# SRIOV physnet:interface mappings when SRIOV is enabled -# "sriovnet1" and tunnel_interface used here as placeholders -neutron_sriov_physnet_mappings: - sriovnet1: "{{ tunnel_interface }}" -neutron_enable_tls_backend: "{{ kolla_enable_tls_backend }}" - -# Set OVN network availability zones -neutron_ovn_availability_zones: [] - -# Enable OVN agent -neutron_enable_ovn_agent: "no" - -####################### -# Nova options -####################### -nova_backend_ceph: "no" -nova_backend: "{{ 'rbd' if nova_backend_ceph | bool else 'default' }}" -# Valid options are [ kvm, qemu ] -nova_compute_virt_type: "kvm" -nova_instance_datadir_volume: "{{ 'nova_compute' if enable_nova_libvirt_container | bool else '/var/lib/nova' }}" -nova_safety_upgrade: "no" -# Valid options are [ none, novnc, spice ] -nova_console: "novnc" - -####################### -# Nova Database -####################### -nova_database_shard_id: "{{ mariadb_default_database_shard_id | int }}" -nova_cell0_database_shard_id: "{{ nova_database_shard_id | int }}" - -# These are kept for backwards compatibility, as cell0 references them. -nova_database_name: "nova" -nova_database_user: "{% if use_preconfigured_databases | bool and use_common_mariadb_user | bool %}{{ database_user }}{% else %}nova{% endif %}" -nova_database_address: "{{ database_address | put_address_in_context('url') }}:{{ database_port }}" - -nova_cell0_database_name: "{{ nova_database_name }}_cell0" -nova_cell0_database_user: "{{ nova_database_user }}" -nova_cell0_database_address: "{{ nova_database_address }}" -nova_cell0_database_password: "{{ nova_database_password }}" - -####################### -# Horizon options -####################### -horizon_backend_database: false -horizon_keystone_multidomain: False - -# Enable deploying custom horizon policy files for services that don't have a -# horizon plugin but have a policy file. Override these when you have services -# not deployed by kolla-ansible but want custom policy files deployed for them -# in horizon. -enable_ceilometer_horizon_policy_file: "{{ enable_ceilometer }}" -enable_cinder_horizon_policy_file: "{{ enable_cinder }}" -enable_glance_horizon_policy_file: "{{ enable_glance }}" -enable_heat_horizon_policy_file: "{{ enable_heat }}" -enable_keystone_horizon_policy_file: "{{ enable_keystone }}" -enable_neutron_horizon_policy_file: "{{ enable_neutron }}" -enable_nova_horizon_policy_file: "{{ enable_nova }}" - -horizon_enable_tls_backend: "{{ kolla_enable_tls_backend }}" - -################### -# External Ceph options -################### -# External Ceph - cephx auth enabled (this is the standard nowadays, defaults to yes) -external_ceph_cephx_enabled: "yes" - -ceph_cluster: "ceph" - -# External Ceph pool names -ceph_cinder_pool_name: "volumes" -ceph_cinder_backup_pool_name: "backups" -ceph_glance_pool_name: "images" -ceph_gnocchi_pool_name: "gnocchi" -ceph_nova_pool_name: "vms" - -ceph_cinder_backup_user: "cinder-backup" -ceph_cinder_user: "cinder" -ceph_glance_user: "glance" -ceph_gnocchi_user: "gnocchi" -ceph_manila_user: "manila" -ceph_nova_user: "{{ ceph_cinder_user }}" - -############################################# -# MariaDB component-specific database details -############################################# -# Whether to configure haproxy to load balance -# the external MariaDB server(s) -enable_external_mariadb_load_balancer: "no" -# Whether to use pre-configured databases / users -use_preconfigured_databases: "no" -# whether to use a common, preconfigured user -# for all component databases -use_common_mariadb_user: "no" - -############ -# Prometheus -############ -enable_prometheus_server: "{{ enable_prometheus | bool }}" -enable_prometheus_haproxy_exporter: "{{ enable_haproxy | bool }}" -enable_prometheus_mysqld_exporter: "{{ enable_mariadb | bool }}" -enable_prometheus_node_exporter: "{{ enable_prometheus | bool }}" -enable_prometheus_memcached_exporter: "{{ enable_memcached | bool }}" -enable_prometheus_cadvisor: "{{ enable_prometheus | bool }}" -enable_prometheus_fluentd_integration: "{{ enable_prometheus | bool and enable_fluentd | bool }}" -enable_prometheus_alertmanager: "{{ enable_prometheus | bool }}" -enable_prometheus_alertmanager_external: "{{ enable_prometheus_alertmanager | bool }}" -enable_prometheus_ceph_mgr_exporter: "no" -enable_prometheus_openstack_exporter: "{{ enable_prometheus | bool }}" -enable_prometheus_openstack_exporter_external: "no" -enable_prometheus_elasticsearch_exporter: "{{ enable_prometheus | bool and enable_opensearch | bool }}" -enable_prometheus_blackbox_exporter: "{{ enable_prometheus | bool }}" -enable_prometheus_rabbitmq_exporter: "{{ enable_prometheus | bool and enable_rabbitmq | bool }}" -enable_prometheus_libvirt_exporter: "{{ enable_prometheus | bool and enable_nova | bool and nova_compute_virt_type in ['kvm', 'qemu'] }}" -enable_prometheus_etcd_integration: "{{ enable_prometheus | bool and enable_etcd | bool }}" -enable_prometheus_proxysql_exporter: "{{ enable_prometheus | bool and enable_proxysql | bool }}" - -prometheus_alertmanager_user: "admin" -prometheus_ceph_exporter_interval: "{{ prometheus_scrape_interval }}" -prometheus_grafana_user: "grafana" -prometheus_haproxy_user: "haproxy" -prometheus_skyline_user: "skyline" -prometheus_scrape_interval: "60s" -prometheus_openstack_exporter_interval: "{{ prometheus_scrape_interval }}" -prometheus_openstack_exporter_timeout: "45s" -prometheus_elasticsearch_exporter_interval: "{{ prometheus_scrape_interval }}" -prometheus_cmdline_extras: -prometheus_ceph_mgr_exporter_endpoints: [] -prometheus_openstack_exporter_endpoint_type: "internal" -prometheus_openstack_exporter_compute_api_version: "latest" -prometheus_libvirt_exporter_interval: "60s" - - -#################### -# InfluxDB options -#################### -influxdb_address: "{{ kolla_internal_fqdn }}" -influxdb_datadir_volume: "influxdb" - -influxdb_internal_endpoint: "{{ kolla_internal_fqdn | kolla_url(internal_protocol, influxdb_http_port) }}" - -######################### -# Internal Image options -######################### -kolla_base_distro_version_default_map: { - "centos": "stream9", - "debian": "bookworm", - "rocky": "9", - "ubuntu": "noble", -} - -distro_python_version: "3" - -kolla_base_distro_version: "{{ kolla_base_distro_version_default_map[kolla_base_distro] }}" - -############# -# S3 options -############# -# Common options for S3 Cinder Backup and Glance S3 backend. -s3_url: -s3_bucket: -s3_access_key: -s3_secret_key: - -########## -# Telegraf -########## -# Configure telegraf to use the docker daemon itself as an input for -# telemetry data. -telegraf_enable_docker_input: "no" - -# Valid options are [ '', redis, etcd ] -ironic_coordination_backend: "{{ 'redis' if enable_redis | bool else 'etcd' if enable_etcd | bool else '' }}" - -########## -# Octavia -########## -# Whether to run Kolla-Ansible's automatic configuration for Octavia. -# NOTE: if you upgrade from Ussuri, you must set `octavia_auto_configure` to `no` -# and keep your other Octavia config like before. -octavia_auto_configure: "{{ 'amphora' in octavia_provider_drivers }}" - -# Octavia network type options are [ tenant, provider ] -# * tenant indicates that we will create a tenant network and a network -# interface on the Octavia worker nodes for communication with amphorae. -# * provider indicates that we will create a flat or vlan provider network. -# In this case octavia_network_interface should be set to a network interface -# on the Octavia worker nodes on the same provider network. -octavia_network_type: "provider" - -################################### -# Identity federation configuration -################################### -# Here we configure all of the IdPs meta information that will be required to implement identity federation with OpenStack Keystone. -# We require the administrator to enter the following metadata: -# * name (internal name of the IdP in Keystone); -# * openstack_domain (the domain in Keystone that the IdP belongs to) -# * protocol (the federated protocol used by the IdP; e.g. openid or saml); -# * identifier (the IdP identifier; e.g. https://accounts.google.com); -# * public_name (the public name that will be shown for users in Horizon); -# * attribute_mapping (the attribute mapping to be used for this IdP. This mapping is configured in the "keystone_identity_mappings" configuration); -# * metadata_folder (folder containing all the identity provider metadata as jsons named as the identifier without the protocol -# and with '/' escaped as %2F followed with '.provider' or '.client' or '.conf'; e.g. accounts.google.com.provider; PS, all .conf, -# .provider and .client jsons must be in the folder, even if you dont override any conf in the .conf json, you must leave it as an empty json '{}'); -# * certificate_file (the path to the Identity Provider certificate file, the file must be named as 'certificate-key-id.pem'; -# e.g. LRVweuT51StjMdsna59jKfB3xw0r8Iz1d1J1HeAbmlw.pem; You can find the key-id in the Identity provider '.well-known/openid-configuration' jwks_uri as kid); -# -# The IdPs meta information are to be presented to Kolla-Ansible as the following example: -# keystone_identity_providers: -# - name: "myidp1" -# openstack_domain: "my-domain" -# protocol: "openid" -# identifier: "https://accounts.google.com" -# public_name: "Authenticate via myidp1" -# attribute_mapping: "mappingId1" -# metadata_folder: "path/to/metadata/folder" -# certificate_file: "path/to/certificate/file.pem" -# -# We also need to configure the attribute mapping that is used by IdPs. -# The configuration of attribute mappings is a list of objects, where each -# object must have a 'name' (that mapps to the 'attribute_mapping' to the IdP -# object in the IdPs set), and the 'file' with a full qualified path to a mapping file. -# keystone_identity_mappings: -# - name: "mappingId1" -# file: "/full/qualified/path/to/mapping/json/file/to/mappingId1" -# - name: "mappingId2" -# file: "/full/qualified/path/to/mapping/json/file/to/mappingId2" -# - name: "mappingId3" -# file: "/full/qualified/path/to/mapping/json/file/to/mappingId3" -keystone_identity_providers: [] -keystone_identity_mappings: [] - -#################### -# Corosync options -#################### - -# this is UDP port -hacluster_corosync_port: 5405 diff --git a/ansible/group_vars/all/aodh.yml b/ansible/group_vars/all/aodh.yml new file mode 100644 index 000000000..2e431e11e --- /dev/null +++ b/ansible/group_vars/all/aodh.yml @@ -0,0 +1,11 @@ +--- +enable_aodh: "no" + +# Ports +aodh_internal_fqdn: "{{ kolla_internal_fqdn }}" +aodh_external_fqdn: "{{ kolla_external_fqdn }}" +aodh_internal_endpoint: "{{ aodh_internal_fqdn | kolla_url(internal_protocol, aodh_api_port) }}" +aodh_public_endpoint: "{{ aodh_external_fqdn | kolla_url(public_protocol, aodh_api_public_port) }}" +aodh_api_port: "8042" +aodh_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else aodh_api_port }}" +aodh_api_listen_port: "{{ aodh_api_port }}" diff --git a/ansible/group_vars/all/barbican.yml b/ansible/group_vars/all/barbican.yml new file mode 100644 index 000000000..36e256a01 --- /dev/null +++ b/ansible/group_vars/all/barbican.yml @@ -0,0 +1,17 @@ +--- +enable_barbican: "no" + +####################### +# Barbican options +####################### +# Valid options are [ simple_crypto, p11_crypto ] +barbican_crypto_plugin: "simple_crypto" +barbican_library_path: "/usr/lib/libCryptoki2_64.so" + +barbican_internal_fqdn: "{{ kolla_internal_fqdn }}" +barbican_external_fqdn: "{{ kolla_external_fqdn }}" +barbican_internal_endpoint: "{{ barbican_internal_fqdn | kolla_url(internal_protocol, barbican_api_port) }}" +barbican_public_endpoint: "{{ barbican_external_fqdn | kolla_url(public_protocol, barbican_api_public_port) }}" +barbican_api_port: "9311" +barbican_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else barbican_api_port }}" +barbican_api_listen_port: "{{ barbican_api_port }}" diff --git a/ansible/group_vars/all/bifrost.yml b/ansible/group_vars/all/bifrost.yml new file mode 100644 index 000000000..a42e6c9ea --- /dev/null +++ b/ansible/group_vars/all/bifrost.yml @@ -0,0 +1,3 @@ +--- +bifrost_network_interface: "{{ network_interface }}" +bifrost_network_address_family: "{{ network_address_family }}" diff --git a/ansible/group_vars/all/blazar.yml b/ansible/group_vars/all/blazar.yml new file mode 100644 index 000000000..10122ffdc --- /dev/null +++ b/ansible/group_vars/all/blazar.yml @@ -0,0 +1,11 @@ +--- +enable_blazar: "no" + +# Ports +blazar_internal_fqdn: "{{ kolla_internal_fqdn }}" +blazar_external_fqdn: "{{ kolla_external_fqdn }}" +blazar_internal_base_endpoint: "{{ blazar_internal_fqdn | kolla_url(internal_protocol, blazar_api_port) }}" +blazar_public_base_endpoint: "{{ blazar_external_fqdn | kolla_url(public_protocol, blazar_api_public_port) }}" +blazar_api_port: "1234" +blazar_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else blazar_api_port }}" +blazar_api_listen_port: "{{ blazar_api_port }}" diff --git a/ansible/group_vars/all/ceilometer.yml b/ansible/group_vars/all/ceilometer.yml new file mode 100644 index 000000000..19e99eee0 --- /dev/null +++ b/ansible/group_vars/all/ceilometer.yml @@ -0,0 +1,4 @@ +--- +enable_ceilometer: "no" +enable_ceilometer_ipmi: "no" +enable_ceilometer_prometheus_pushgateway: "no" diff --git a/ansible/group_vars/all/ceph-rgw.yml b/ansible/group_vars/all/ceph-rgw.yml new file mode 100644 index 000000000..3d3d4802b --- /dev/null +++ b/ansible/group_vars/all/ceph-rgw.yml @@ -0,0 +1,10 @@ +--- +enable_ceph_rgw: "no" +enable_ceph_rgw_loadbalancer: "{{ enable_ceph_rgw | bool }}" + +ceph_rgw_internal_fqdn: "{{ kolla_internal_fqdn }}" +ceph_rgw_external_fqdn: "{{ kolla_external_fqdn }}" +ceph_rgw_internal_base_endpoint: "{{ ceph_rgw_internal_fqdn | kolla_url(internal_protocol, ceph_rgw_port) }}" +ceph_rgw_public_base_endpoint: "{{ ceph_rgw_external_fqdn | kolla_url(public_protocol, ceph_rgw_public_port) }}" +ceph_rgw_port: "6780" +ceph_rgw_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else ceph_rgw_port }}" diff --git a/ansible/group_vars/all/ceph.yml b/ansible/group_vars/all/ceph.yml new file mode 100644 index 000000000..987717a65 --- /dev/null +++ b/ansible/group_vars/all/ceph.yml @@ -0,0 +1,21 @@ +--- +################### +# External Ceph options +################### +# External Ceph - cephx auth enabled (this is the standard nowadays, defaults to yes) +external_ceph_cephx_enabled: "yes" + +ceph_cluster: "ceph" + +# External Ceph pool names +ceph_cinder_pool_name: "volumes" +ceph_cinder_backup_pool_name: "backups" +ceph_glance_pool_name: "images" +ceph_gnocchi_pool_name: "gnocchi" +ceph_nova_pool_name: "vms" + +ceph_cinder_backup_user: "cinder-backup" +ceph_cinder_user: "cinder" +ceph_glance_user: "glance" +ceph_gnocchi_user: "gnocchi" +ceph_nova_user: "{{ ceph_cinder_user }}" diff --git a/ansible/group_vars/all/cinder.yml b/ansible/group_vars/all/cinder.yml new file mode 100644 index 000000000..e4659674e --- /dev/null +++ b/ansible/group_vars/all/cinder.yml @@ -0,0 +1,40 @@ +--- +enable_cinder: "no" +enable_cinder_backup: "yes" +enable_cinder_backend_iscsi: "{{ enable_cinder_backend_lvm | bool }}" +enable_cinder_backend_lvm: "no" +enable_cinder_backend_nfs: "no" +enable_cinder_backend_quobyte: "no" +enable_cinder_backend_pure_iscsi: "no" +enable_cinder_backend_pure_fc: "no" +enable_cinder_backend_pure_roce: "no" +enable_cinder_backend_pure_nvme_tcp: "no" +enable_cinder_backend_lightbits: "no" + +################################# +# Cinder options +################################# +cinder_backend_ceph: "no" +cinder_backend_huawei: "no" +cinder_backend_huawei_xml_files: [] +cinder_volume_group: "cinder-volumes" +cinder_target_helper: "{{ 'lioadm' if ansible_facts.os_family == 'RedHat' else 'tgtadm' }}" +# Valid options are [ '', redis, etcd ] +cinder_coordination_backend: "{{ 'redis' if enable_redis | bool else 'etcd' if enable_etcd | bool else '' }}" + +# Valid options are [ nfs, ceph, s3 ] +cinder_backup_driver: "ceph" +cinder_backup_share: "" +cinder_backup_mount_options_nfs: "" + +storage_address_family: "{{ network_address_family }}" + +cinder_keystone_user: "cinder" + +cinder_internal_fqdn: "{{ kolla_internal_fqdn }}" +cinder_external_fqdn: "{{ kolla_external_fqdn }}" +cinder_internal_base_endpoint: "{{ cinder_internal_fqdn | kolla_url(internal_protocol, cinder_api_port) }}" +cinder_public_base_endpoint: "{{ cinder_external_fqdn | kolla_url(public_protocol, cinder_api_public_port) }}" +cinder_api_port: "8776" +cinder_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else cinder_api_port }}" +cinder_api_listen_port: "{{ cinder_api_port }}" diff --git a/ansible/group_vars/all/cloudkitty.yml b/ansible/group_vars/all/cloudkitty.yml new file mode 100644 index 000000000..a657c3bd0 --- /dev/null +++ b/ansible/group_vars/all/cloudkitty.yml @@ -0,0 +1,20 @@ +--- +enable_cloudkitty: "no" + +####################### +# Cloudkitty options +####################### +# Valid options are 'sqlalchemy' or 'influxdb'. The default value is +# 'influxdb', which matches the default in Cloudkitty since the Stein release. +# When the backend is "influxdb", we also enable Influxdb. +# Also, when using 'influxdb' as the backend, we trigger the configuration/use +# of Cloudkitty storage backend version 2. +cloudkitty_storage_backend: "influxdb" + +cloudkitty_internal_fqdn: "{{ kolla_internal_fqdn }}" +cloudkitty_external_fqdn: "{{ kolla_external_fqdn }}" +cloudkitty_internal_endpoint: "{{ cloudkitty_internal_fqdn | kolla_url(internal_protocol, cloudkitty_api_port) }}" +cloudkitty_public_endpoint: "{{ cloudkitty_external_fqdn | kolla_url(public_protocol, cloudkitty_api_public_port) }}" +cloudkitty_api_port: "8889" +cloudkitty_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else cloudkitty_api_port }}" +cloudkitty_api_listen_port: "{{ cloudkitty_api_port }}" diff --git a/ansible/group_vars/all/collectd.yml b/ansible/group_vars/all/collectd.yml new file mode 100644 index 000000000..8e6232716 --- /dev/null +++ b/ansible/group_vars/all/collectd.yml @@ -0,0 +1,4 @@ +--- +enable_collectd: "no" + +collectd_udp_port: "25826" diff --git a/ansible/group_vars/all/common.yml b/ansible/group_vars/all/common.yml new file mode 100644 index 000000000..a08a3ce3c --- /dev/null +++ b/ansible/group_vars/all/common.yml @@ -0,0 +1,366 @@ +--- +################### +# Ansible options +################### + +# This variable is used as the "filter" argument for the setup module. For +# instance, if one wants to remove/ignore all Neutron interface facts: +# kolla_ansible_setup_filter: "ansible_[!qt]*" +# By default, we do not provide a filter. +kolla_ansible_setup_filter: "{{ omit }}" + +# This variable is used as the "gather_subset" argument for the setup module. +# For instance, if one wants to avoid collecting facts via facter: +# kolla_ansible_setup_gather_subset: "all,!facter" +# By default, we do not provide a gather subset. +kolla_ansible_setup_gather_subset: "{{ omit }}" + +# This variable determines which hosts require facts when using --limit. Facts +# will be gathered using delegation for hosts in this list that are not +# included in the limit. +# By default, this list includes all hosts. +kolla_ansible_delegate_facts_hosts: "{{ groups['all'] }}" + +#################### +# Docker options +#################### +docker_registry_email: +docker_registry: "quay.io" +docker_namespace: "openstack.kolla" +docker_image_name_prefix: "" +docker_image_url: "{{ docker_registry ~ '/' if docker_registry else '' }}{{ docker_namespace }}/{{ docker_image_name_prefix }}" +docker_registry_username: +# Please read the docs carefully before applying docker_registry_insecure. +docker_registry_insecure: "no" +docker_runtime_directory: "" +# Docker client timeout in seconds. +docker_client_timeout: 120 + +# Docker networking options +docker_disable_default_iptables_rules: "yes" +docker_disable_default_network: "{{ docker_disable_default_iptables_rules }}" +docker_disable_ip_forward: "{{ docker_disable_default_iptables_rules }}" + +# Retention settings for Docker logs +docker_log_max_file: "5" +docker_log_max_size: "50m" + +# Valid options are [ no, on-failure, always, unless-stopped ] +docker_restart_policy: "unless-stopped" + +# '0' means unlimited retries (applies only to 'on-failure' policy) +docker_restart_policy_retry: "10" + +# Timeout after Docker sends SIGTERM before sending SIGKILL. +docker_graceful_timeout: 60 + +# Common options used throughout Docker +docker_common_options: + auth_email: "{{ docker_registry_email }}" + auth_password: "{{ docker_registry_password }}" + auth_registry: "{{ docker_registry }}" + auth_username: "{{ docker_registry_username }}" + environment: + KOLLA_CONFIG_STRATEGY: "{{ config_strategy }}" + restart_policy: "{{ docker_restart_policy }}" + restart_retries: "{{ docker_restart_policy_retry }}" + graceful_timeout: "{{ docker_graceful_timeout }}" + client_timeout: "{{ docker_client_timeout }}" + container_engine: "{{ kolla_container_engine }}" + +# Container engine specific volume paths +docker_volumes_path: "{{ docker_runtime_directory or '/var/lib/docker' }}/volumes" +podman_volumes_path: "{{ docker_runtime_directory or '/var/lib/containers' }}/storage/volumes" +container_engine_volumes_path: "{{ docker_volumes_path if kolla_container_engine == 'docker' else podman_volumes_path }}" + +##################### +# Volumes under /run +##################### +# Podman has problem with mounting whole /run directory +# described here: https://github.com/containers/podman/issues/16305 +run_default_volumes_podman: + - '/run/netns:/run/netns:shared' + - '/run/lock/nova:/run/lock/nova:shared' + - "/run/libvirt:/run/libvirt:shared" + - "/run/nova:/run/nova:shared" + - "/run/openvswitch:/run/openvswitch:shared" + +run_default_volumes_docker: [] + +run_default_subdirectories: + - '/run/netns' + - '/run/lock/nova' + - "/run/libvirt" + - "/run/nova" + - "/run/openvswitch" + +#################### +# Dimensions options +#################### +# Dimension options for Docker Containers +# NOTE(mnasiadka): Lower 1073741816 nofile limit on EL9 (RHEL9/CentOS Stream 9/Rocky Linux 9) +# fixes at least rabbitmq and mariadb +default_container_dimensions: "{{ default_container_dimensions_el9 if ansible_facts.os_family == 'RedHat' else '{}' }}" +default_container_dimensions_el9: "{{ default_docker_dimensions_el9 if kolla_container_engine == 'docker' else default_podman_dimensions_el9 }}" +default_docker_dimensions_el9: + ulimits: + nofile: + soft: 1048576 + hard: 1048576 +default_podman_dimensions_el9: + ulimits: + RLIMIT_NOFILE: + soft: 1048576 + hard: 1048576 + RLIMIT_NPROC: + soft: 1048576 + hard: 1048576 + +##################### +# Healthcheck options +##################### +enable_container_healthchecks: "yes" +# Healthcheck options for Docker containers +# interval/timeout/start_period are in seconds +default_container_healthcheck_interval: 30 +default_container_healthcheck_timeout: 30 +default_container_healthcheck_retries: 3 +default_container_healthcheck_start_period: 5 + +####################### +# Extra volumes options +####################### +# Extra volumes for Docker Containers +default_extra_volumes: [] + +################## +# Firewall options +################## +enable_external_api_firewalld: "false" +external_api_firewalld_zone: "public" + +################## +# Backend options +################## +kolla_httpd_keep_alive: "60" +kolla_httpd_timeout: "60" + +# The "temp" files that are created before merge need to stay persistent due +# to the fact that ansible will register a "change" if it has to create them +# again. Persistent files allow for idempotency +container_config_directory: "/var/lib/kolla/config_files" + +# The directory on the deploy host containing globals.yml. +node_config: "{{ CONFIG_DIR | default('/etc/kolla') }}" + +# The directory to merge custom config files the kolla's config files +node_custom_config: "{{ node_config }}/config" + +# The directory to store the config files on the destination node +node_config_directory: "/etc/kolla" + +# The group which own node_config_directory, you can use a non-root +# user to deploy kolla +config_owner_user: "root" +config_owner_group: "root" + +################### +# Kolla options +################### +# Valid options are [ COPY_ONCE, COPY_ALWAYS ] +config_strategy: "COPY_ALWAYS" + +# Valid options are ['centos', 'debian', 'rocky', 'ubuntu'] +kolla_base_distro: "rocky" + +kolla_internal_vip_address: "{{ kolla_internal_address | default('') }}" +kolla_internal_fqdn: "{{ kolla_internal_vip_address }}" +kolla_external_vip_address: "{{ kolla_internal_vip_address }}" +kolla_same_external_internal_vip: "{{ kolla_external_vip_address | ansible.utils.ipaddr('address') == kolla_internal_vip_address | ansible.utils.ipaddr('address') }}" +kolla_external_fqdn: "{{ kolla_internal_fqdn if kolla_same_external_internal_vip | bool else kolla_external_vip_address }}" + +kolla_dev_repos_directory: "/opt/stack/" +kolla_dev_repos_git: "https://opendev.org/openstack" +kolla_dev_repos_pull: "no" +kolla_dev_mode: "no" +kolla_source_version: "{% if openstack_release == 'master' %}master{% else %}stable/{{ openstack_release }}{% endif %}" + +# Proxy settings for containers such as magnum that need internet access +container_http_proxy: "" +container_https_proxy: "" +container_no_proxy: "localhost,127.0.0.1" + +container_proxy_no_proxy_entries: + - "{{ container_no_proxy }}" + - "{{ api_interface_address }}" + - "{{ kolla_internal_vip_address | default('') }}" + +container_proxy: + http_proxy: "{{ container_http_proxy }}" + https_proxy: "{{ container_https_proxy }}" + no_proxy: "{{ container_proxy_no_proxy_entries | select | join(',') }}" + +# By default, Kolla API services bind to the network address assigned +# to the api_interface. Allow the bind address to be an override. +api_interface_address: "{{ 'api' | kolla_address }}" + +#################### +# Container engine options +#################### +kolla_container_engine: "docker" + + +######################### +# Internal Image options +######################### +kolla_base_distro_version_default_map: { + "centos": "stream9", + "debian": "bookworm", + "rocky": "9", + "ubuntu": "noble", +} + +distro_python_version: "3" + +kolla_base_distro_version: "{{ kolla_base_distro_version_default_map[kolla_base_distro] }}" + +#################### +# Networking options +#################### +network_interface: "eth0" +kolla_external_vip_interface: "{{ network_interface }}" +api_interface: "{{ network_interface }}" + +# Configure the address family (AF) per network. +# Valid options are [ ipv4, ipv6 ] +network_address_family: "ipv4" +api_address_family: "{{ network_address_family }}" + +public_protocol: "{{ 'https' if kolla_enable_tls_external | bool else 'http' }}" +internal_protocol: "{{ 'https' if kolla_enable_tls_internal | bool else 'http' }}" + +# Additional optional OpenStack features and services are specified here +enable_central_logging: "no" + +# Clean images options are specified here +enable_destroy_images: "no" + +#################### +# Global Options +#################### +# List of containers to skip during stop command in YAML list format +# skip_stop_containers: +# - container1 +# - container2 +skip_stop_containers: [] + +################### +# Messaging options +################### +# oslo.messaging rpc transport valid options are [ rabbit, amqp ] +om_rpc_transport: "rabbit" +om_rpc_user: "{{ rabbitmq_user }}" +om_rpc_password: "{{ rabbitmq_password }}" +om_rpc_port: "{{ rabbitmq_port }}" +om_rpc_group: "rabbitmq" +om_rpc_vhost: "/" + +rpc_transport_url: "{{ om_rpc_transport }}://{% for host in groups[om_rpc_group] %}{{ om_rpc_user }}:{{ om_rpc_password }}@{{ 'api' | kolla_address(host) | put_address_in_context('url') }}:{{ om_rpc_port }}{% if not loop.last %},{% endif %}{% endfor %}/{{ om_rpc_vhost }}" + +# oslo.messaging notify transport valid options are [ rabbit ] +om_notify_transport: "rabbit" +om_notify_user: "{{ rabbitmq_user }}" +om_notify_password: "{{ rabbitmq_password }}" +om_notify_port: "{{ rabbitmq_port }}" +om_notify_group: "rabbitmq" +om_notify_vhost: "/" + +notify_transport_url: "{{ om_notify_transport }}://{% for host in groups[om_notify_group] %}{{ om_notify_user }}:{{ om_notify_password }}@{{ 'api' | kolla_address(host) | put_address_in_context('url') }}:{{ om_notify_port }}{% if not loop.last %},{% endif %}{% endfor %}/{{ om_notify_vhost }}" + +# Whether to enable TLS for oslo.messaging communication with RabbitMQ. +om_enable_rabbitmq_tls: "{{ rabbitmq_enable_tls | bool }}" +# CA certificate bundle in containers using oslo.messaging with RabbitMQ TLS. +om_rabbitmq_cacert: "{{ rabbitmq_cacert }}" +om_rabbitmq_qos_prefetch_count: "1" + +om_enable_rabbitmq_stream_fanout: true + +# OpenStack authentication string. You should only need to override these if you +# are changing the admin tenant/project or user. +openstack_auth: + auth_url: "{{ keystone_internal_url }}" + username: "{{ keystone_admin_user }}" + password: "{{ keystone_admin_password }}" + project_name: "{{ keystone_admin_project }}" + domain_name: "default" + user_domain_name: "default" + +#################### +# OpenStack options +#################### +openstack_release: "master" +# Docker image tag used by default. +openstack_tag: "{{ openstack_release }}-{{ kolla_base_distro }}-{{ kolla_base_distro_version }}{{ openstack_tag_suffix }}" +openstack_tag_suffix: "" +openstack_logging_debug: "False" + +openstack_region_name: "RegionOne" + +# A list of policy file formats that are supported by Oslo.policy +supported_policy_format_list: + - policy.yaml + - policy.json + +# In the context of multi-regions, list here the name of all your regions. +multiple_regions_names: + - "{{ openstack_region_name }}" + +openstack_service_workers: "{{ [ansible_facts.processor_vcpus, 5] | min }}" +openstack_service_rpc_workers: "{{ [ansible_facts.processor_vcpus, 3] | min }}" + +# Endpoint type used to connect with OpenStack services with ansible modules. +# Valid options are [ public, internal ] +openstack_interface: "internal" + +# Openstack CA certificate bundle file +# CA bundle file must be added to both the Horizon and Kolla Toolbox containers +openstack_cacert: "" + +# Enable core OpenStack services. This includes: +# glance, keystone, neutron, nova, heat, and horizon. +enable_openstack_core: "yes" + +enable_osprofiler: "no" + +#################### +# Osprofiler options +#################### +# valid values: ["elasticsearch", "redis"] +osprofiler_backend: "elasticsearch" +opensearch_connection_string: "elasticsearch://{{ opensearch_address | put_address_in_context('url') }}:{{ opensearch_port }}" +osprofiler_backend_connection_string: "{{ redis_connection_string if osprofiler_backend == 'redis' else opensearch_connection_string }}" + +###################### +# Backend TLS options +###################### +kolla_enable_tls_backend: "no" +kolla_verify_tls_backend: "yes" +kolla_tls_backend_cert: "{{ kolla_certificates_dir }}/backend-cert.pem" +kolla_tls_backend_key: "{{ kolla_certificates_dir }}/backend-key.pem" + +#################### +# Database options +#################### +database_address: "{{ kolla_internal_fqdn }}" +database_user: "root" +database_port: "3306" +database_connection_recycle_time: 10 +database_max_pool_size: 1 +database_enable_tls_backend: "{{ 'yes' if ((kolla_enable_tls_backend | bool ) and ( enable_proxysql | bool)) else 'no' }}" +database_enable_tls_internal: "{{ 'yes' if ((kolla_enable_tls_internal | bool ) and ( enable_proxysql | bool)) else 'no' }}" + +# Optionally allow Kolla to set sysctl values +set_sysctl: "yes" + +# Optionally change the path to sysctl.conf modified by Kolla Ansible plays. +kolla_sysctl_conf_path: /etc/sysctl.conf diff --git a/ansible/group_vars/all/cyborg.yml b/ansible/group_vars/all/cyborg.yml new file mode 100644 index 000000000..f8346b5ef --- /dev/null +++ b/ansible/group_vars/all/cyborg.yml @@ -0,0 +1,8 @@ +--- +enable_cyborg: "no" + +cyborg_internal_fqdn: "{{ kolla_internal_fqdn }}" +cyborg_external_fqdn: "{{ kolla_external_fqdn }}" +cyborg_api_port: "6666" +cyborg_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else cyborg_api_port }}" +cyborg_api_listen_port: "{{ cyborg_api_port }}" diff --git a/ansible/group_vars/all/database.yml b/ansible/group_vars/all/database.yml new file mode 100644 index 000000000..7e0e1bd03 --- /dev/null +++ b/ansible/group_vars/all/database.yml @@ -0,0 +1,11 @@ +--- +#################### +# Database options +#################### +database_address: "{{ kolla_internal_fqdn }}" +database_user: "root" +database_port: "3306" +database_connection_recycle_time: 10 +database_max_pool_size: 1 +database_enable_tls_backend: "{{ 'yes' if ((kolla_enable_tls_backend | bool ) and ( enable_proxysql | bool)) else 'no' }}" +database_enable_tls_internal: "{{ 'yes' if ((kolla_enable_tls_internal | bool ) and ( enable_proxysql | bool)) else 'no' }}" diff --git a/ansible/group_vars/all/designate.yml b/ansible/group_vars/all/designate.yml new file mode 100644 index 000000000..e9916c542 --- /dev/null +++ b/ansible/group_vars/all/designate.yml @@ -0,0 +1,33 @@ +--- +enable_designate: "no" + +designate_keystone_user: "designate" + +####################### +# Designate options +####################### +# Valid options are [ bind9, infoblox ] +designate_backend: "bind9" +designate_ns_record: + - "ns1.example.org" +designate_backend_external: "no" +designate_backend_external_bind9_nameservers: "" +# Valid options are [ '', redis ] +designate_coordination_backend: "{{ 'redis' if enable_redis | bool else '' }}" + +designate_enable_notifications_sink: "no" +designate_notifications_topic_name: "notifications_designate" + +dns_interface: "{{ network_interface }}" +dns_address_family: "{{ network_address_family }}" + +designate_internal_fqdn: "{{ kolla_internal_fqdn }}" +designate_external_fqdn: "{{ kolla_external_fqdn }}" +designate_internal_endpoint: "{{ designate_internal_fqdn | kolla_url(internal_protocol, designate_api_port) }}" +designate_public_endpoint: "{{ designate_external_fqdn | kolla_url(public_protocol, designate_api_public_port) }}" +designate_api_port: "9001" +designate_api_listen_port: "{{ designate_api_port }}" +designate_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else designate_api_port }}" +designate_bind_port: "53" +designate_mdns_port: "{{ '53' if designate_backend == 'infoblox' else '5354' }}" +designate_rndc_port: "953" diff --git a/ansible/group_vars/all/etcd.yml b/ansible/group_vars/all/etcd.yml new file mode 100644 index 000000000..a6b160119 --- /dev/null +++ b/ansible/group_vars/all/etcd.yml @@ -0,0 +1,7 @@ +--- +enable_etcd: "no" + +etcd_client_port: "2379" +etcd_peer_port: "2380" +etcd_enable_tls: "{{ kolla_enable_tls_backend }}" +etcd_protocol: "{{ 'https' if etcd_enable_tls | bool else 'http' }}" diff --git a/ansible/group_vars/all/fluentd.yml b/ansible/group_vars/all/fluentd.yml new file mode 100644 index 000000000..13f41522d --- /dev/null +++ b/ansible/group_vars/all/fluentd.yml @@ -0,0 +1,6 @@ +--- +enable_fluentd: "yes" +enable_fluentd_systemd: "{{ (enable_fluentd | bool) and (enable_central_logging | bool) }}" + +fluentd_syslog_port: "5140" +syslog_udp_port: "{{ fluentd_syslog_port }}" diff --git a/ansible/group_vars/all/glance.yml b/ansible/group_vars/all/glance.yml new file mode 100644 index 000000000..baf705736 --- /dev/null +++ b/ansible/group_vars/all/glance.yml @@ -0,0 +1,28 @@ +--- +enable_glance: "{{ enable_openstack_core | bool }}" + +glance_keystone_user: "glance" + +####################### +# Glance options +####################### +glance_backend_file: "{{ not (glance_backend_ceph | bool or glance_backend_s3 | bool) }}" +glance_backend_ceph: "no" +glance_backend_s3: "no" +enable_glance_image_cache: "no" +glance_file_datadir_volume: "glance" +glance_enable_rolling_upgrade: "no" +glance_enable_property_protection: "no" +glance_enable_interoperable_image_import: "no" +glance_api_hosts: "{{ [groups['glance-api'] | first] if glance_backend_file | bool and glance_file_datadir_volume == 'glance' else groups['glance-api'] }}" +# NOTE(mnasiadka): For use in common role +glance_enable_tls_backend: "{{ kolla_enable_tls_backend }}" + +glance_internal_fqdn: "{{ kolla_internal_fqdn }}" +glance_external_fqdn: "{{ kolla_external_fqdn }}" +glance_internal_endpoint: "{{ glance_internal_fqdn | kolla_url(internal_protocol, glance_api_port) }}" +glance_public_endpoint: "{{ glance_external_fqdn | kolla_url(public_protocol, glance_api_public_port) }}" +glance_api_port: "9292" +glance_api_listen_port: "{{ glance_api_port }}" +glance_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else glance_api_port }}" +glance_tls_proxy_stats_port: "9293" diff --git a/ansible/group_vars/all/gnocchi.yml b/ansible/group_vars/all/gnocchi.yml new file mode 100644 index 000000000..f103736b4 --- /dev/null +++ b/ansible/group_vars/all/gnocchi.yml @@ -0,0 +1,21 @@ +--- +enable_gnocchi: "no" +enable_gnocchi_statsd: "no" + +################# +# Gnocchi options +################# +# Valid options are [ file, ceph ] +gnocchi_backend_storage: "file" + +# Valid options are [redis, ''] +gnocchi_incoming_storage: "{{ 'redis' if enable_redis | bool else '' }}" +gnocchi_metric_datadir_volume: "gnocchi" + +gnocchi_internal_fqdn: "{{ kolla_internal_fqdn }}" +gnocchi_external_fqdn: "{{ kolla_external_fqdn }}" +gnocchi_internal_endpoint: "{{ gnocchi_internal_fqdn | kolla_url(internal_protocol, gnocchi_api_port) }}" +gnocchi_public_endpoint: "{{ gnocchi_external_fqdn | kolla_url(public_protocol, gnocchi_api_public_port) }}" +gnocchi_api_port: "8041" +gnocchi_api_listen_port: "{{ gnocchi_api_port }}" +gnocchi_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else gnocchi_api_port }}" diff --git a/ansible/group_vars/all/grafana.yml b/ansible/group_vars/all/grafana.yml new file mode 100644 index 000000000..97c7d1294 --- /dev/null +++ b/ansible/group_vars/all/grafana.yml @@ -0,0 +1,11 @@ +--- +enable_grafana: "no" +enable_grafana_external: "{{ enable_grafana | bool }}" + +grafana_internal_fqdn: "{{ kolla_internal_fqdn }}" +grafana_external_fqdn: "{{ kolla_external_fqdn }}" +grafana_internal_endpoint: "{{ grafana_internal_fqdn | kolla_url(internal_protocol, grafana_server_port) }}" +grafana_public_endpoint: "{{ grafana_external_fqdn | kolla_url(public_protocol, grafana_server_public_port) }}" +grafana_server_port: "3000" +grafana_server_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else grafana_server_port }}" +grafana_server_listen_port: "{{ grafana_server_port }}" diff --git a/ansible/group_vars/all/hacluster.yml b/ansible/group_vars/all/hacluster.yml new file mode 100644 index 000000000..15a92447c --- /dev/null +++ b/ansible/group_vars/all/hacluster.yml @@ -0,0 +1,9 @@ +--- +enable_hacluster: "{{ enable_masakari_hostmonitor | bool }}" + +#################### +# Corosync options +#################### + +# this is UDP port +hacluster_corosync_port: 5405 diff --git a/ansible/group_vars/all/haproxy.yml b/ansible/group_vars/all/haproxy.yml new file mode 100644 index 000000000..d2e5a14a2 --- /dev/null +++ b/ansible/group_vars/all/haproxy.yml @@ -0,0 +1,48 @@ +--- +enable_haproxy: "yes" + +#################### +# HAProxy options +#################### +haproxy_user: "openstack" +haproxy_enable_external_vip: "{{ 'no' if kolla_same_external_internal_vip | bool else 'yes' }}" +haproxy_enable_http2: "yes" +haproxy_http2_protocol: "alpn h2,http/1.1" +kolla_enable_tls_internal: "no" +kolla_enable_tls_external: "{{ kolla_enable_tls_internal if kolla_same_external_internal_vip | bool else 'no' }}" +kolla_certificates_dir: "{{ node_config }}/certificates" +kolla_external_fqdn_cert: "{{ kolla_certificates_dir }}/haproxy.pem" +kolla_internal_fqdn_cert: "{{ kolla_certificates_dir }}/haproxy-internal.pem" +kolla_admin_openrc_cacert: "" +kolla_copy_ca_into_containers: "no" +haproxy_backend_cacert: "{{ 'ca-certificates.crt' if kolla_base_distro in ['debian', 'ubuntu'] else 'ca-bundle.crt' }}" +haproxy_backend_cacert_dir: "/etc/ssl/certs" +haproxy_single_external_frontend: false +haproxy_single_external_frontend_public_port: "{{ '443' if kolla_enable_tls_external | bool else '80' }}" + +# configure SSL/TLS settings for haproxy config, one of [modern, intermediate, legacy]: +kolla_haproxy_ssl_settings: "modern" + +haproxy_ssl_settings: "{{ ssl_legacy_settings if kolla_haproxy_ssl_settings == 'legacy' else ssl_intermediate_settings if kolla_haproxy_ssl_settings == 'intermediate' else ssl_modern_settings | default(ssl_modern_settings) }}" + +ssl_legacy_settings: | + ssl-default-bind-ciphers DEFAULT:!MEDIUM:!3DES + ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11 + +ssl_intermediate_settings: | + ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305 + ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256 + ssl-default-bind-options prefer-client-ciphers no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets + ssl-default-server-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305 + ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256 + ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets + +ssl_modern_settings: | + ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256 + ssl-default-bind-options prefer-client-ciphers no-sslv3 no-tlsv10 no-tlsv11 no-tlsv12 no-tls-tickets + ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256 + ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tlsv12 no-tls-tickets + +haproxy_stats_port: "1984" +haproxy_monitor_port: "61313" +haproxy_ssh_port: "2985" diff --git a/ansible/group_vars/all/heat.yml b/ansible/group_vars/all/heat.yml new file mode 100644 index 000000000..8a8768226 --- /dev/null +++ b/ansible/group_vars/all/heat.yml @@ -0,0 +1,17 @@ +--- +enable_heat: "{{ enable_openstack_core | bool }}" + +heat_internal_fqdn: "{{ kolla_internal_fqdn }}" +heat_external_fqdn: "{{ kolla_external_fqdn }}" +heat_internal_base_endpoint: "{{ heat_internal_fqdn | kolla_url(internal_protocol, heat_api_port) }}" +heat_public_base_endpoint: "{{ heat_external_fqdn | kolla_url(public_protocol, heat_api_public_port) }}" +heat_api_port: "8004" +heat_api_listen_port: "{{ heat_api_port }}" +heat_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else heat_api_port }}" +heat_cfn_internal_fqdn: "{{ kolla_internal_fqdn }}" +heat_cfn_external_fqdn: "{{ kolla_external_fqdn }}" +heat_cfn_internal_base_endpoint: "{{ heat_cfn_internal_fqdn | kolla_url(internal_protocol, heat_api_cfn_port) }}" +heat_cfn_public_base_endpoint: "{{ heat_cfn_external_fqdn | kolla_url(public_protocol, heat_api_cfn_public_port) }}" +heat_api_cfn_port: "8000" +heat_api_cfn_listen_port: "{{ heat_api_cfn_port }}" +heat_api_cfn_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else heat_api_cfn_port }}" diff --git a/ansible/group_vars/all/horizon.yml b/ansible/group_vars/all/horizon.yml new file mode 100644 index 000000000..f01082827 --- /dev/null +++ b/ansible/group_vars/all/horizon.yml @@ -0,0 +1,49 @@ +--- +enable_horizon: "{{ enable_openstack_core | bool }}" +enable_horizon_blazar: "{{ enable_blazar | bool }}" +enable_horizon_cloudkitty: "{{ enable_cloudkitty | bool }}" +enable_horizon_designate: "{{ enable_designate | bool }}" +enable_horizon_fwaas: "{{ enable_neutron_fwaas | bool }}" +enable_horizon_heat: "{{ enable_heat | bool }}" +enable_horizon_ironic: "{{ enable_ironic | bool }}" +enable_horizon_magnum: "{{ enable_magnum | bool }}" +enable_horizon_manila: "{{ enable_manila | bool }}" +enable_horizon_masakari: "{{ enable_masakari | bool }}" +enable_horizon_mistral: "{{ enable_mistral | bool }}" +enable_horizon_neutron_vpnaas: "{{ enable_neutron_vpnaas | bool }}" +enable_horizon_octavia: "{{ enable_octavia | bool }}" +enable_horizon_tacker: "{{ enable_tacker | bool }}" +enable_horizon_trove: "{{ enable_trove | bool }}" +enable_horizon_venus: "{{ enable_venus | bool }}" +enable_horizon_watcher: "{{ enable_watcher | bool }}" +enable_horizon_zun: "{{ enable_zun | bool }}" + +####################### +# Horizon options +####################### +horizon_backend_database: false +horizon_keystone_multidomain: false + +# Enable deploying custom horizon policy files for services that don't have a +# horizon plugin but have a policy file. Override these when you have services +# not deployed by kolla-ansible but want custom policy files deployed for them +# in horizon. +enable_ceilometer_horizon_policy_file: "{{ enable_ceilometer }}" +enable_cinder_horizon_policy_file: "{{ enable_cinder }}" +enable_glance_horizon_policy_file: "{{ enable_glance }}" +enable_heat_horizon_policy_file: "{{ enable_heat }}" +enable_keystone_horizon_policy_file: "{{ enable_keystone }}" +enable_neutron_horizon_policy_file: "{{ enable_neutron }}" +enable_nova_horizon_policy_file: "{{ enable_nova }}" + +# TLS +horizon_enable_tls_backend: "{{ kolla_enable_tls_backend }}" + +# Ports +horizon_internal_fqdn: "{{ kolla_internal_fqdn }}" +horizon_external_fqdn: "{{ kolla_external_fqdn }}" +horizon_internal_endpoint: "{{ kolla_internal_fqdn | kolla_url(internal_protocol, horizon_tls_port if kolla_enable_tls_internal | bool else horizon_port) }}" +horizon_public_endpoint: "{{ kolla_external_fqdn | kolla_url(public_protocol, horizon_tls_port if kolla_enable_tls_external | bool else horizon_port) }}" +horizon_port: "80" +horizon_tls_port: "443" +horizon_listen_port: "{{ horizon_tls_port if horizon_enable_tls_backend | bool else horizon_port }}" diff --git a/ansible/group_vars/all/influxdb.yml b/ansible/group_vars/all/influxdb.yml new file mode 100644 index 000000000..c6ddb3c99 --- /dev/null +++ b/ansible/group_vars/all/influxdb.yml @@ -0,0 +1,12 @@ +--- +enable_influxdb: "{{ enable_cloudkitty | bool and cloudkitty_storage_backend == 'influxdb' }}" + +#################### +# InfluxDB options +#################### +influxdb_address: "{{ kolla_internal_fqdn }}" +influxdb_datadir_volume: "influxdb" + +influxdb_internal_endpoint: "{{ kolla_internal_fqdn | kolla_url(internal_protocol, influxdb_http_port) }}" + +influxdb_http_port: "8086" diff --git a/ansible/group_vars/all/ironic.yml b/ansible/group_vars/all/ironic.yml new file mode 100644 index 000000000..48e017975 --- /dev/null +++ b/ansible/group_vars/all/ironic.yml @@ -0,0 +1,33 @@ +--- +enable_ironic: "no" +enable_ironic_dnsmasq: "{{ enable_ironic | bool }}" +enable_ironic_neutron_agent: "no" +enable_ironic_prometheus_exporter: "{{ enable_ironic | bool and enable_prometheus | bool }}" + +# Keystone user +ironic_keystone_user: "ironic" + +# Coordination backend +ironic_coordination_backend: "{{ 'redis' if enable_redis | bool else 'etcd' if enable_etcd | bool else '' }}" + +# Network interfaces +ironic_http_interface: "{{ api_interface }}" +ironic_tftp_interface: "{{ api_interface }}" + +# Address family +ironic_http_address_family: "{{ api_address_family }}" +ironic_tftp_address_family: "{{ api_address_family }}" + +# Addresses +ironic_http_interface_address: "{{ 'ironic_http' | kolla_address }}" +ironic_tftp_interface_address: "{{ 'ironic_tftp' | kolla_address }}" + +ironic_internal_fqdn: "{{ kolla_internal_fqdn }}" +ironic_external_fqdn: "{{ kolla_external_fqdn }}" +ironic_internal_endpoint: "{{ ironic_internal_fqdn | kolla_url(internal_protocol, ironic_api_port) }}" +ironic_public_endpoint: "{{ ironic_external_fqdn | kolla_url(public_protocol, ironic_api_public_port) }}" +ironic_api_port: "6385" +ironic_api_listen_port: "{{ ironic_api_port }}" +ironic_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else ironic_api_port }}" +ironic_http_port: "8089" +ironic_prometheus_exporter_port: "9608" diff --git a/ansible/group_vars/all/iscsi.yml b/ansible/group_vars/all/iscsi.yml new file mode 100644 index 000000000..20773bf86 --- /dev/null +++ b/ansible/group_vars/all/iscsi.yml @@ -0,0 +1,4 @@ +--- +enable_iscsid: "{{ enable_cinder | bool and enable_cinder_backend_iscsi | bool }}" + +iscsi_port: "3260" diff --git a/ansible/group_vars/all/keepalived.yml b/ansible/group_vars/all/keepalived.yml new file mode 100644 index 000000000..b32dcdd4f --- /dev/null +++ b/ansible/group_vars/all/keepalived.yml @@ -0,0 +1,8 @@ +--- +enable_keepalived: "{{ enable_haproxy | bool }}" + +#################### +# keepalived options +#################### +# Arbitrary unique number from 0..255 +keepalived_virtual_router_id: "51" diff --git a/ansible/group_vars/all/keystone.yml b/ansible/group_vars/all/keystone.yml new file mode 100644 index 000000000..8a644bd82 --- /dev/null +++ b/ansible/group_vars/all/keystone.yml @@ -0,0 +1,86 @@ +--- +enable_keystone: "{{ enable_openstack_core | bool }}" +enable_keystone_federation: "{{ (keystone_identity_providers | length > 0) and (keystone_identity_mappings | length > 0) }}" + +#################### +# Keystone options +#################### +keystone_internal_fqdn: "{{ kolla_internal_fqdn }}" +keystone_external_fqdn: "{{ kolla_external_fqdn }}" + +keystone_internal_url: "{{ keystone_internal_fqdn | kolla_url(internal_protocol, keystone_internal_port) }}" +keystone_public_url: "{{ keystone_external_fqdn | kolla_url(public_protocol, keystone_public_port) }}" + +keystone_admin_user: "admin" +keystone_admin_project: "admin" + +# Whether or not to apply changes to service user passwords when services are +# reconfigured +update_keystone_service_user_passwords: true + +default_project_domain_name: "Default" +default_project_domain_id: "default" + +default_user_domain_name: "Default" +default_user_domain_id: "default" + +# Keystone fernet token expiry in seconds. Default is 1 day. +fernet_token_expiry: 86400 +# Keystone window to allow expired fernet tokens. Default is 2 days. +fernet_token_allow_expired_window: 172800 +# Keystone fernet key rotation interval in seconds. Default is sum of token +# expiry and allow expired window, 3 days. This ensures the minimum number +# of keys are active. If this interval is lower than the sum of the token +# expiry and allow expired window, multiple active keys will be necessary. +fernet_key_rotation_interval: "{{ fernet_token_expiry + fernet_token_allow_expired_window }}" + +keystone_default_user_role: "member" + +################################### +# Identity federation configuration +################################### +# Here we configure all of the IdPs meta information that will be required to implement identity federation with OpenStack Keystone. +# We require the administrator to enter the following metadata: +# * name (internal name of the IdP in Keystone); +# * openstack_domain (the domain in Keystone that the IdP belongs to) +# * protocol (the federated protocol used by the IdP; e.g. openid or saml); +# * identifier (the IdP identifier; e.g. https://accounts.google.com); +# * public_name (the public name that will be shown for users in Horizon); +# * attribute_mapping (the attribute mapping to be used for this IdP. This mapping is configured in the "keystone_identity_mappings" configuration); +# * metadata_folder (folder containing all the identity provider metadata as jsons named as the identifier without the protocol +# and with '/' escaped as %2F followed with '.provider' or '.client' or '.conf'; e.g. accounts.google.com.provider; PS, all .conf, +# .provider and .client jsons must be in the folder, even if you dont override any conf in the .conf json, you must leave it as an empty json '{}'); +# * certificate_file (the path to the Identity Provider certificate file, the file must be named as 'certificate-key-id.pem'; +# e.g. LRVweuT51StjMdsna59jKfB3xw0r8Iz1d1J1HeAbmlw.pem; You can find the key-id in the Identity provider '.well-known/openid-configuration' jwks_uri as kid); +# +# The IdPs meta information are to be presented to Kolla-Ansible as the following example: +# keystone_identity_providers: +# - name: "myidp1" +# openstack_domain: "my-domain" +# protocol: "openid" +# identifier: "https://accounts.google.com" +# public_name: "Authenticate via myidp1" +# attribute_mapping: "mappingId1" +# metadata_folder: "path/to/metadata/folder" +# certificate_file: "path/to/certificate/file.pem" +# +# We also need to configure the attribute mapping that is used by IdPs. +# The configuration of attribute mappings is a list of objects, where each +# object must have a 'name' (that mapps to the 'attribute_mapping' to the IdP +# object in the IdPs set), and the 'file' with a full qualified path to a mapping file. +# keystone_identity_mappings: +# - name: "mappingId1" +# file: "/full/qualified/path/to/mapping/json/file/to/mappingId1" +# - name: "mappingId2" +# file: "/full/qualified/path/to/mapping/json/file/to/mappingId2" +# - name: "mappingId3" +# file: "/full/qualified/path/to/mapping/json/file/to/mappingId3" +keystone_identity_providers: [] +keystone_identity_mappings: [] + +keystone_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else keystone_public_listen_port }}" +keystone_public_listen_port: "5000" +keystone_internal_port: "5000" +keystone_internal_listen_port: "{{ keystone_internal_port }}" +keystone_listen_port: "{{ keystone_internal_listen_port }}" +keystone_ssh_port: "8023" diff --git a/ansible/group_vars/all/kuryr.yml b/ansible/group_vars/all/kuryr.yml new file mode 100644 index 000000000..69464a031 --- /dev/null +++ b/ansible/group_vars/all/kuryr.yml @@ -0,0 +1,4 @@ +--- +enable_kuryr: "no" + +kuryr_port: "23750" diff --git a/ansible/group_vars/all/letsencrypt.yml b/ansible/group_vars/all/letsencrypt.yml new file mode 100644 index 000000000..50007e885 --- /dev/null +++ b/ansible/group_vars/all/letsencrypt.yml @@ -0,0 +1,13 @@ +--- +enable_letsencrypt: "no" + +##################### +# ACME client options +##################### +acme_client_lego: "server lego {{ api_interface_address }}:{{ letsencrypt_webserver_port }}" +acme_client_servers: "{% set arr = [] %}{% if enable_letsencrypt | bool %}{{ arr.append(acme_client_lego) }}{% endif %}{{ arr }}" + +letsencrypt_webserver_port: "8081" +letsencrypt_managed_certs: "{{ '' if not enable_letsencrypt | bool else ('internal' if letsencrypt_internal_cert_server != '' and kolla_same_external_internal_vip | bool else ('internal,external' if letsencrypt_internal_cert_server != '' and letsencrypt_external_cert_server != '' else ('internal' if letsencrypt_internal_cert_server != '' else ('external' if letsencrypt_external_cert_server != '' and not kolla_same_external_internal_vip | bool else '')))) }}" +letsencrypt_external_cert_server: "https://acme-v02.api.letsencrypt.org/directory" +letsencrypt_internal_cert_server: "" diff --git a/ansible/group_vars/all/loadbalancer.yml b/ansible/group_vars/all/loadbalancer.yml new file mode 100644 index 000000000..ef47f2555 --- /dev/null +++ b/ansible/group_vars/all/loadbalancer.yml @@ -0,0 +1,2 @@ +--- +enable_loadbalancer: "{{ enable_haproxy | bool or enable_keepalived | bool or enable_proxysql | bool }}" diff --git a/ansible/group_vars/all/magnum.yml b/ansible/group_vars/all/magnum.yml new file mode 100644 index 000000000..279e17d98 --- /dev/null +++ b/ansible/group_vars/all/magnum.yml @@ -0,0 +1,10 @@ +--- +enable_magnum: "no" + +magnum_internal_fqdn: "{{ kolla_internal_fqdn }}" +magnum_external_fqdn: "{{ kolla_external_fqdn }}" +magnum_internal_base_endpoint: "{{ magnum_internal_fqdn | kolla_url(internal_protocol, magnum_api_port) }}" +magnum_public_base_endpoint: "{{ magnum_external_fqdn | kolla_url(public_protocol, magnum_api_public_port) }}" +magnum_api_port: "9511" +magnum_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else magnum_api_port }}" +magnum_api_listen_port: "{{ magnum_api_port }}" diff --git a/ansible/group_vars/all/manila.yml b/ansible/group_vars/all/manila.yml new file mode 100644 index 000000000..526707331 --- /dev/null +++ b/ansible/group_vars/all/manila.yml @@ -0,0 +1,18 @@ +--- +enable_manila: "no" +enable_manila_backend_generic: "no" +enable_manila_backend_hnas: "no" +enable_manila_backend_cephfs_native: "no" +enable_manila_backend_cephfs_nfs: "no" +enable_manila_backend_glusterfs_nfs: "no" +enable_manila_backend_flashblade: "no" + +ceph_manila_user: "manila" + +manila_internal_fqdn: "{{ kolla_internal_fqdn }}" +manila_external_fqdn: "{{ kolla_external_fqdn }}" +manila_internal_base_endpoint: "{{ manila_internal_fqdn | kolla_url(internal_protocol, manila_api_port) }}" +manila_public_base_endpoint: "{{ manila_external_fqdn | kolla_url(public_protocol, manila_api_public_port) }}" +manila_api_port: "8786" +manila_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else manila_api_port }}" +manila_api_listen_port: "{{ manila_api_port }}" diff --git a/ansible/group_vars/all/mariadb.yml b/ansible/group_vars/all/mariadb.yml new file mode 100644 index 000000000..ea6c9fda9 --- /dev/null +++ b/ansible/group_vars/all/mariadb.yml @@ -0,0 +1,37 @@ +--- +enable_mariadb: "yes" +enable_mariabackup: "no" + +############################################# +# MariaDB component-specific database details +############################################# +# Whether to configure haproxy to load balance +# the external MariaDB server(s) +enable_external_mariadb_load_balancer: "no" +# Whether to use pre-configured databases / users +use_preconfigured_databases: "no" +# whether to use a common, preconfigured user +# for all component databases +use_common_mariadb_user: "no" + +mariadb_port: "{{ database_port }}" +mariadb_wsrep_port: "4567" +mariadb_ist_port: "4568" +mariadb_sst_port: "4444" +mariadb_clustercheck_port: "4569" +mariadb_enable_tls_backend: "{{ database_enable_tls_backend }}" + +mariadb_monitor_user: "{{ 'monitor' if enable_proxysql | bool else 'haproxy' }}" + +mariadb_datadir_volume: "mariadb" + +mariadb_default_database_shard_id: 0 +mariadb_default_database_shard_hosts: "{% set default_shard = [] %}{% for host in groups['mariadb'] %}{% if hostvars[host]['mariadb_shard_id'] is not defined or hostvars[host]['mariadb_shard_id'] == mariadb_default_database_shard_id %}{{ default_shard.append(host) }}{% endif %}{% endfor %}{{ default_shard }}" +mariadb_shard_id: "{{ mariadb_default_database_shard_id }}" +mariadb_shard_name: "shard_{{ mariadb_shard_id }}" +mariadb_shard_group: "mariadb_{{ mariadb_shard_name }}" +mariadb_loadbalancer: "{{ 'proxysql' if enable_proxysql | bool else 'haproxy' }}" +mariadb_backup_target: "{{ 'active' if mariadb_loadbalancer == 'haproxy' else 'replica' }}" +mariadb_shard_root_user_prefix: "root_shard_" +mariadb_shard_backup_user_prefix: "backup_shard_" +mariadb_shards_info: "{{ groups['mariadb'] | database_shards_info() }}" diff --git a/ansible/group_vars/all/masakari.yml b/ansible/group_vars/all/masakari.yml new file mode 100644 index 000000000..bef390e71 --- /dev/null +++ b/ansible/group_vars/all/masakari.yml @@ -0,0 +1,13 @@ +--- +enable_masakari: "no" +enable_masakari_instancemonitor: "{{ enable_masakari | bool }}" +enable_masakari_hostmonitor: "{{ enable_masakari | bool }}" + +masakari_internal_fqdn: "{{ kolla_internal_fqdn }}" +masakari_external_fqdn: "{{ kolla_external_fqdn }}" +masakari_internal_endpoint: "{{ masakari_internal_fqdn | kolla_url(internal_protocol, masakari_api_port) }}" +masakari_public_endpoint: "{{ masakari_external_fqdn | kolla_url(public_protocol, masakari_api_public_port) }}" +masakari_api_port: "15868" +masakari_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else masakari_api_port }}" +masakari_api_listen_port: "{{ masakari_api_port }}" +masakari_coordination_backend: "{{ 'redis' if enable_redis | bool else 'etcd' if enable_etcd | bool else '' }}" diff --git a/ansible/group_vars/all/memcached.yml b/ansible/group_vars/all/memcached.yml new file mode 100644 index 000000000..282138b41 --- /dev/null +++ b/ansible/group_vars/all/memcached.yml @@ -0,0 +1,10 @@ +--- +enable_memcached: "yes" + +# NOTE: Most memcached clients handle load-balancing via client side +# hashing (consistent or not) logic, so going under the covers and messing +# with things that the clients are not aware of is generally wrong +enable_haproxy_memcached: "no" + +memcached_port: "11211" +memcache_security_strategy: "ENCRYPT" diff --git a/ansible/group_vars/all/mistral.yml b/ansible/group_vars/all/mistral.yml new file mode 100644 index 000000000..2e72f3cc6 --- /dev/null +++ b/ansible/group_vars/all/mistral.yml @@ -0,0 +1,10 @@ +--- +enable_mistral: "no" + +mistral_internal_fqdn: "{{ kolla_internal_fqdn }}" +mistral_external_fqdn: "{{ kolla_external_fqdn }}" +mistral_internal_base_endpoint: "{{ mistral_internal_fqdn | kolla_url(internal_protocol, mistral_api_port) }}" +mistral_public_base_endpoint: "{{ mistral_external_fqdn | kolla_url(public_protocol, mistral_api_public_port) }}" +mistral_api_port: "8989" +mistral_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else mistral_api_port }}" +mistral_api_listen_port: "{{ mistral_api_port }}" diff --git a/ansible/group_vars/all/multipathd.yml b/ansible/group_vars/all/multipathd.yml new file mode 100644 index 000000000..bae55e51c --- /dev/null +++ b/ansible/group_vars/all/multipathd.yml @@ -0,0 +1,2 @@ +--- +enable_multipathd: "no" diff --git a/ansible/group_vars/all/neutron.yml b/ansible/group_vars/all/neutron.yml new file mode 100644 index 000000000..0ef47e2ed --- /dev/null +++ b/ansible/group_vars/all/neutron.yml @@ -0,0 +1,75 @@ +--- +enable_neutron: "{{ enable_openstack_core | bool }}" + +enable_neutron_vpnaas: "no" +enable_neutron_sriov: "no" +enable_neutron_mlnx: "no" +enable_neutron_dvr: "no" +enable_neutron_fwaas: "no" +enable_neutron_qos: "no" +enable_neutron_agent_ha: "no" +enable_neutron_bgp_dragent: "no" +enable_neutron_provider_networks: "no" +enable_neutron_segments: "no" +enable_neutron_packet_logging: "no" +enable_neutron_sfc: "no" +enable_neutron_taas: "no" +enable_neutron_trunk: "no" +enable_neutron_metering: "no" +enable_neutron_infoblox_ipam_agent: "no" +enable_neutron_port_forwarding: "no" +neutron_enable_ovn_agent: "no" + +neutron_keystone_user: "neutron" + +# Valid options are [ openvswitch, ovn, linuxbridge ] +# Do note linuxbridge is *EXPERIMENTAL* in Neutron since Zed and it requires extra tweaks to config to be usable. +# For details, see: https://docs.openstack.org/neutron/latest/admin/config-experimental-framework.html +neutron_plugin_agent: "openvswitch" + +# Valid options are [ internal, infoblox ] +neutron_ipam_driver: "internal" + +eutron_external_interface: "eth1" + +####################### +# Neutron options +####################### +neutron_bgp_router_id: "1.1.1.1" +neutron_bridge_name: "{{ 'br_dpdk' if enable_ovs_dpdk | bool else 'br-ex' }}" +neutron_physical_networks: "{% for bridge in neutron_bridge_name.split(',') %}physnet{{ loop.index }}{% if not loop.last %},{% endif %}{% endfor %}" +# Comma-separated type of enabled ml2 type drivers +neutron_type_drivers: "flat,vlan,vxlan{% if neutron_plugin_agent == 'ovn' %},geneve{% endif %}" +# Comma-separated types of tenant networks (should be listed in 'neutron_type_drivers') +# NOTE: for ironic this list should also contain 'flat' +neutron_tenant_network_types: "{% if neutron_plugin_agent == 'ovn' %}geneve{% else %}vxlan{% endif %}" + +# valid values: ["dvr", "dvr_no_external"] +neutron_compute_dvr_mode: "dvr" +computes_need_external_bridge: "{{ (enable_neutron_dvr | bool and neutron_compute_dvr_mode == 'dvr') or enable_neutron_provider_networks | bool or neutron_ovn_distributed_fip | bool }}" + +# Default DNS resolvers for virtual networks +neutron_dnsmasq_dns_servers: "1.1.1.1,8.8.8.8,8.8.4.4" + +# Set legacy iptables to allow kernels not supporting iptables-nft +neutron_legacy_iptables: "no" + +# Enable distributed floating ip for OVN deployments +neutron_ovn_distributed_fip: "no" + +# SRIOV physnet:interface mappings when SRIOV is enabled +# "sriovnet1" and tunnel_interface used here as placeholders +neutron_sriov_physnet_mappings: + sriovnet1: "{{ tunnel_interface }}" +neutron_enable_tls_backend: "{{ kolla_enable_tls_backend }}" + +# Set OVN network availability zones +neutron_ovn_availability_zones: [] + +neutron_internal_fqdn: "{{ kolla_internal_fqdn }}" +neutron_external_fqdn: "{{ kolla_external_fqdn }}" +neutron_internal_endpoint: "{{ neutron_internal_fqdn | kolla_url(internal_protocol, neutron_server_port) }}" +neutron_public_endpoint: "{{ neutron_external_fqdn | kolla_url(public_protocol, neutron_server_public_port) }}" +neutron_server_port: "9696" +neutron_server_listen_port: "{{ neutron_server_port }}" +neutron_server_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else neutron_server_port }}" diff --git a/ansible/group_vars/all/nova.yml b/ansible/group_vars/all/nova.yml new file mode 100644 index 000000000..48811be62 --- /dev/null +++ b/ansible/group_vars/all/nova.yml @@ -0,0 +1,69 @@ +--- +enable_cells: "no" +enable_nova: "{{ enable_openstack_core | bool }}" +enable_nova_libvirt_container: "{{ nova_compute_virt_type in ['kvm', 'qemu'] }}" +enable_nova_serialconsole_proxy: "no" +enable_nova_ssh: "yes" + +####################### +# Nova options +####################### +nova_backend_ceph: "no" +nova_backend: "{{ 'rbd' if nova_backend_ceph | bool else 'default' }}" +# Valid options are [ kvm, qemu ] +nova_compute_virt_type: "kvm" +nova_instance_datadir_volume: "{{ 'nova_compute' if enable_nova_libvirt_container | bool else '/var/lib/nova' }}" +nova_safety_upgrade: "no" +# Valid options are [ none, novnc, spice ] +nova_console: "novnc" + +####################### +# Nova Database +####################### +nova_database_shard_id: "{{ mariadb_default_database_shard_id | int }}" +nova_cell0_database_shard_id: "{{ nova_database_shard_id | int }}" + +# These are kept for backwards compatibility, as cell0 references them. +nova_database_name: "nova" +nova_database_user: "{% if use_preconfigured_databases | bool and use_common_mariadb_user | bool %}{{ database_user }}{% else %}nova{% endif %}" +nova_database_address: "{{ database_address | put_address_in_context('url') }}:{{ database_port }}" + +nova_cell0_database_name: "{{ nova_database_name }}_cell0" +nova_cell0_database_user: "{{ nova_database_user }}" +nova_cell0_database_address: "{{ nova_database_address }}" +nova_cell0_database_password: "{{ nova_database_password }}" + +# Nova fake driver and the number of fake driver per compute node +enable_nova_fake: "no" +num_nova_fake_per_node: 5 + +migration_interface: "{{ api_interface }}" +migration_interface_address: "{{ 'migration' | kolla_address }}" +migration_address_family: "{{ api_address_family }}" + +nova_keystone_user: "nova" + +nova_internal_fqdn: "{{ kolla_internal_fqdn }}" +nova_external_fqdn: "{{ kolla_external_fqdn }}" +nova_internal_base_endpoint: "{{ nova_internal_fqdn | kolla_url(internal_protocol, nova_api_port) }}" +nova_public_base_endpoint: "{{ nova_external_fqdn | kolla_url(public_protocol, nova_api_public_port) }}" +nova_api_port: "8774" +nova_api_listen_port: "{{ nova_api_port }}" +nova_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else nova_api_port }}" +nova_metadata_internal_fqdn: "{{ kolla_internal_fqdn }}" +nova_metadata_external_fqdn: "{{ kolla_external_fqdn }}" +nova_metadata_port: "8775" +nova_metadata_listen_port: "{{ nova_metadata_port }}" +nova_novncproxy_fqdn: "{{ kolla_external_fqdn }}" +nova_novncproxy_port: "6080" +nova_novncproxy_listen_port: "{{ nova_novncproxy_port }}" +nova_novncproxy_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else nova_novncproxy_port }}" +nova_spicehtml5proxy_fqdn: "{{ kolla_external_fqdn }}" +nova_spicehtml5proxy_port: "6082" +nova_spicehtml5proxy_listen_port: "{{ nova_spicehtml5proxy_port }}" +nova_spicehtml5proxy_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else nova_spicehtml5proxy_port }}" +nova_serialproxy_fqdn: "{{ kolla_external_fqdn }}" +nova_serialproxy_port: "6083" +nova_serialproxy_listen_port: "{{ nova_serialproxy_port }}" +nova_serialproxy_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else nova_serialproxy_port }}" +nova_serialproxy_protocol: "{{ 'wss' if kolla_enable_tls_external | bool else 'ws' }}" diff --git a/ansible/group_vars/all/octavia.yml b/ansible/group_vars/all/octavia.yml new file mode 100644 index 000000000..c0a152cf4 --- /dev/null +++ b/ansible/group_vars/all/octavia.yml @@ -0,0 +1,33 @@ +--- +enable_octavia: "no" +enable_octavia_driver_agent: "{{ enable_octavia | bool and neutron_plugin_agent == 'ovn' }}" +enable_octavia_jobboard: "{{ enable_octavia | bool and 'amphora' in octavia_provider_drivers }}" + +########## +# Octavia +########## +# Whether to run Kolla-Ansible's automatic configuration for Octavia. +# NOTE: if you upgrade from Ussuri, you must set `octavia_auto_configure` to `no` +# and keep your other Octavia config like before. +octavia_auto_configure: "{{ 'amphora' in octavia_provider_drivers }}" + +# Octavia network type options are [ tenant, provider ] +# * tenant indicates that we will create a tenant network and a network +# interface on the Octavia worker nodes for communication with amphorae. +# * provider indicates that we will create a flat or vlan provider network. +# In this case octavia_network_interface should be set to a network interface +# on the Octavia worker nodes on the same provider network. +octavia_network_type: "provider" + +octavia_network_interface: "{{ 'o-hm0' if octavia_network_type == 'tenant' else api_interface }}" +octavia_network_address_family: "{{ api_address_family }}" +octavia_network_interface_address: "{{ 'octavia_network' | kolla_address }}" + +octavia_internal_fqdn: "{{ kolla_internal_fqdn }}" +octavia_external_fqdn: "{{ kolla_external_fqdn }}" +octavia_internal_endpoint: "{{ octavia_internal_fqdn | kolla_url(internal_protocol, octavia_api_port) }}" +octavia_public_endpoint: "{{ octavia_external_fqdn | kolla_url(public_protocol, octavia_api_public_port) }}" +octavia_api_port: "9876" +octavia_api_listen_port: "{{ octavia_api_port }}" +octavia_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else octavia_api_port }}" +octavia_health_manager_port: "5555" diff --git a/ansible/group_vars/all/opensearch.yml b/ansible/group_vars/all/opensearch.yml new file mode 100644 index 000000000..21c208c67 --- /dev/null +++ b/ansible/group_vars/all/opensearch.yml @@ -0,0 +1,33 @@ +--- +#################### +# Logging options +#################### + +# NOTE: If an external ElasticSearch cluster address is configured, all +# services with ElasticSearch endpoints should be configured to log +# to the external cluster by default. This is for backwards compatibility. +opensearch_address: "{{ elasticsearch_address if elasticsearch_address is defined else kolla_internal_fqdn }}" +enable_opensearch: "{{ enable_central_logging | bool or enable_osprofiler | bool or (enable_cloudkitty | bool and cloudkitty_storage_backend == 'opensearch') }}" +enable_opensearch_dashboards: "{{ enable_opensearch | bool }}" +enable_opensearch_dashboards_external: "{{ enable_opensearch_dashboards | bool }}" + +####################### +## Opensearch Options +######################## +opensearch_datadir_volume: "opensearch" + +opensearch_internal_endpoint: "{{ opensearch_address | kolla_url(internal_protocol, opensearch_port) }}" +opensearch_dashboards_internal_fqdn: "{{ kolla_internal_fqdn }}" +opensearch_dashboards_external_fqdn: "{{ kolla_external_fqdn }}" +opensearch_dashboards_internal_endpoint: "{{ opensearch_dashboards_internal_fqdn | kolla_url(internal_protocol, opensearch_dashboards_port) }}" +opensearch_dashboards_external_endpoint: "{{ opensearch_dashboards_external_fqdn | kolla_url(public_protocol, opensearch_dashboards_port_external) }}" +opensearch_dashboards_user: "opensearch" +opensearch_log_index_prefix: "{{ kibana_log_prefix if kibana_log_prefix is defined else 'flog' }}" + +# NOTE: If an external ElasticSearch cluster port is specified, +# we default to using that port in services with ElasticSearch +# endpoints. This is for backwards compatibility. +opensearch_port: "{{ elasticsearch_port | default('9200') }}" +opensearch_dashboards_port: "5601" +opensearch_dashboards_port_external: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else opensearch_dashboards_port }}" +opensearch_dashboards_listen_port: "{{ opensearch_dashboards_port }}" diff --git a/ansible/group_vars/all/openvswitch.yml b/ansible/group_vars/all/openvswitch.yml new file mode 100644 index 000000000..68a813b43 --- /dev/null +++ b/ansible/group_vars/all/openvswitch.yml @@ -0,0 +1,14 @@ +--- +enable_openvswitch: "{{ enable_neutron | bool and neutron_plugin_agent != 'linuxbridge' }}" +enable_ovs_dpdk: "no" + +ovs_datapath: "{{ 'netdev' if enable_ovs_dpdk | bool else 'system' }}" + +tunnel_address_family: "{{ network_address_family }}" +dpdk_tunnel_address_family: "{{ network_address_family }}" +tunnel_interface: "{{ network_interface }}" +dpdk_tunnel_interface: "{{ neutron_external_interface }}" +tunnel_interface_address: "{{ 'tunnel' | kolla_address }}" +dpdk_tunnel_interface_address: "{{ 'dpdk_tunnel' | kolla_address }}" + +ovsdb_port: "6640" diff --git a/ansible/group_vars/all/ovn.yml b/ansible/group_vars/all/ovn.yml new file mode 100644 index 000000000..dc9b4b6e8 --- /dev/null +++ b/ansible/group_vars/all/ovn.yml @@ -0,0 +1,16 @@ +--- +enable_ovn: "{{ enable_neutron | bool and neutron_plugin_agent == 'ovn' }}" +enable_ovn_sb_db_relay: "{{ enable_ovn | bool }}" + +ovn_nb_db_port: "6641" +ovn_sb_db_port: "6642" +# OVN SB Relay related variables +ovn_sb_db_relay_count: "{{ ((groups['ovn-controller'] | length) / ovn_sb_db_relay_compute_per_relay | int) | round(0, 'ceil') | int }}" +ovn_sb_db_relay_compute_per_relay: "50" +ovn_sb_db_relay_port_prefix: "1664" +ovn_sb_db_relay_port: "{{ ovn_sb_db_relay_port_prefix ~ ovn_sb_db_relay_client_group_id }}" +ovn_sb_db_relay_client_group_id: "{{ range(1, ovn_sb_db_relay_count | int + 1) | random(seed=inventory_hostname) }}" +ovn_nb_connection: "{% for host in groups['ovn-nb-db'] %}tcp:{{ 'api' | kolla_address(host) | put_address_in_context('url') }}:{{ ovn_nb_db_port }}{% if not loop.last %},{% endif %}{% endfor %}" +ovn_sb_connection: "{{ ovn_sb_connection_relay if enable_ovn_sb_db_relay | bool else ovn_sb_connection_no_relay }}" +ovn_sb_connection_no_relay: "{% for host in groups['ovn-sb-db'] %}tcp:{{ 'api' | kolla_address(host) | put_address_in_context('url') }}:{{ ovn_sb_db_port }}{% if not loop.last %},{% endif %}{% endfor %}" +ovn_sb_connection_relay: "{% for host in groups['ovn-sb-db-relay'] %}tcp:{{ 'api' | kolla_address(host) | put_address_in_context('url') }}:{{ ovn_sb_db_relay_port }}{% if not loop.last %},{% endif %}{% endfor %}" diff --git a/ansible/group_vars/all/placement.yml b/ansible/group_vars/all/placement.yml new file mode 100644 index 000000000..4949393ea --- /dev/null +++ b/ansible/group_vars/all/placement.yml @@ -0,0 +1,13 @@ +--- +enable_placement: "{{ enable_nova | bool or enable_zun | bool }}" + +placement_keystone_user: "placement" + +placement_internal_fqdn: "{{ kolla_internal_fqdn }}" +placement_external_fqdn: "{{ kolla_external_fqdn }}" +placement_internal_endpoint: "{{ placement_internal_fqdn | kolla_url(internal_protocol, placement_api_port) }}" +placement_public_endpoint: "{{ placement_external_fqdn | kolla_url(public_protocol, placement_api_public_port) }}" +# Default Placement API port of 8778 already in use +placement_api_port: "8780" +placement_api_listen_port: "{{ placement_api_port }}" +placement_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else placement_api_port }}" diff --git a/ansible/group_vars/all/prometheus.yml b/ansible/group_vars/all/prometheus.yml new file mode 100644 index 000000000..e372bf642 --- /dev/null +++ b/ansible/group_vars/all/prometheus.yml @@ -0,0 +1,78 @@ +--- +enable_prometheus: "no" + +############ +# Prometheus +############ +enable_prometheus_server: "{{ enable_prometheus | bool }}" +enable_prometheus_haproxy_exporter: "{{ enable_haproxy | bool }}" +enable_prometheus_mysqld_exporter: "{{ enable_mariadb | bool }}" +enable_prometheus_node_exporter: "{{ enable_prometheus | bool }}" +enable_prometheus_memcached_exporter: "{{ enable_memcached | bool }}" +enable_prometheus_cadvisor: "{{ enable_prometheus | bool }}" +enable_prometheus_fluentd_integration: "{{ enable_prometheus | bool and enable_fluentd | bool }}" +enable_prometheus_alertmanager: "{{ enable_prometheus | bool }}" +enable_prometheus_alertmanager_external: "{{ enable_prometheus_alertmanager | bool }}" +enable_prometheus_ceph_mgr_exporter: "no" +enable_prometheus_openstack_exporter: "{{ enable_prometheus | bool }}" +enable_prometheus_openstack_exporter_external: "no" +enable_prometheus_elasticsearch_exporter: "{{ enable_prometheus | bool and enable_opensearch | bool }}" +enable_prometheus_blackbox_exporter: "{{ enable_prometheus | bool }}" +enable_prometheus_rabbitmq_exporter: "{{ enable_prometheus | bool and enable_rabbitmq | bool }}" +enable_prometheus_libvirt_exporter: "{{ enable_prometheus | bool and enable_nova | bool and nova_compute_virt_type in ['kvm', 'qemu'] }}" +enable_prometheus_etcd_integration: "{{ enable_prometheus | bool and enable_etcd | bool }}" +enable_prometheus_proxysql_exporter: "{{ enable_prometheus | bool and enable_proxysql | bool }}" + +prometheus_alertmanager_user: "admin" +prometheus_ceph_exporter_interval: "{{ prometheus_scrape_interval }}" +prometheus_grafana_user: "grafana" +prometheus_haproxy_user: "haproxy" +prometheus_skyline_user: "skyline" +prometheus_scrape_interval: "60s" +prometheus_openstack_exporter_interval: "{{ prometheus_scrape_interval }}" +prometheus_openstack_exporter_timeout: "45s" +prometheus_elasticsearch_exporter_interval: "{{ prometheus_scrape_interval }}" +prometheus_cmdline_extras: +prometheus_ceph_mgr_exporter_endpoints: [] +prometheus_openstack_exporter_endpoint_type: "internal" +prometheus_openstack_exporter_compute_api_version: "latest" +prometheus_libvirt_exporter_interval: "60s" + +prometheus_internal_fqdn: "{{ kolla_internal_fqdn }}" +prometheus_external_fqdn: "{{ kolla_external_fqdn }}" +prometheus_internal_endpoint: "{{ prometheus_internal_fqdn | kolla_url(internal_protocol, prometheus_port) }}" +prometheus_public_endpoint: "{{ prometheus_external_fqdn | kolla_url(public_protocol, prometheus_public_port) }}" +prometheus_port: "9091" +prometheus_listen_port: "{{ prometheus_port }}" +prometheus_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else prometheus_port }}" +prometheus_node_exporter_port: "9100" +prometheus_mysqld_exporter_port: "9104" +prometheus_haproxy_exporter_port: "9101" +prometheus_memcached_exporter_port: "9150" +prometheus_rabbitmq_exporter_port: "{{ rabbitmq_prometheus_port }}" +# Default cadvisor port of 8080 already in use +prometheus_cadvisor_port: "18080" +prometheus_fluentd_integration_port: "24231" +prometheus_libvirt_exporter_port: "9177" +prometheus_etcd_integration_port: "{{ etcd_client_port }}" +proxysql_prometheus_exporter_port: "6070" + +# Prometheus alertmanager ports +prometheus_alertmanager_internal_fqdn: "{{ kolla_internal_fqdn }}" +prometheus_alertmanager_external_fqdn: "{{ kolla_external_fqdn }}" +prometheus_alertmanager_internal_endpoint: "{{ prometheus_alertmanager_internal_fqdn | kolla_url(internal_protocol, prometheus_alertmanager_port) }}" +prometheus_alertmanager_public_endpoint: "{{ prometheus_alertmanager_external_fqdn | kolla_url(public_protocol, prometheus_alertmanager_public_port) }}" +prometheus_alertmanager_port: "9093" +prometheus_alertmanager_cluster_port: "9094" +prometheus_alertmanager_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else prometheus_alertmanager_port }}" +prometheus_alertmanager_listen_port: "{{ prometheus_alertmanager_port }}" + +# Prometheus openstack-exporter ports +prometheus_openstack_exporter_port: "9198" +prometheus_elasticsearch_exporter_port: "9108" + +# Prometheus blackbox-exporter ports +prometheus_blackbox_exporter_port: "9115" + +# Prometheus instance label to use for metrics +prometheus_instance_label: diff --git a/ansible/group_vars/all/proxysql.yml b/ansible/group_vars/all/proxysql.yml new file mode 100644 index 000000000..822483d09 --- /dev/null +++ b/ansible/group_vars/all/proxysql.yml @@ -0,0 +1,4 @@ +--- +enable_proxysql: "yes" + +proxysql_admin_port: "6032" diff --git a/ansible/group_vars/all/rabbitmq.yml b/ansible/group_vars/all/rabbitmq.yml new file mode 100644 index 000000000..4773c1444 --- /dev/null +++ b/ansible/group_vars/all/rabbitmq.yml @@ -0,0 +1,19 @@ +--- +enable_rabbitmq: "{{ 'yes' if om_rpc_transport == 'rabbit' or om_notify_transport == 'rabbit' else 'no' }}" + +#################### +# RabbitMQ options +#################### +rabbitmq_user: "openstack" +rabbitmq_monitoring_user: "" +# Whether to enable TLS encryption for RabbitMQ client-server communication. +rabbitmq_enable_tls: "no" +# CA certificate bundle in RabbitMQ container. +rabbitmq_cacert: "/etc/ssl/certs/{{ 'ca-certificates.crt' if kolla_base_distro in ['debian', 'ubuntu'] else 'ca-bundle.crt' }}" +rabbitmq_datadir_volume: "rabbitmq" + +rabbitmq_port: "{{ '5671' if rabbitmq_enable_tls | bool else '5672' }}" +rabbitmq_management_port: "15672" +rabbitmq_cluster_port: "25672" +rabbitmq_epmd_port: "4369" +rabbitmq_prometheus_port: "15692" diff --git a/ansible/group_vars/all/redis.yml b/ansible/group_vars/all/redis.yml new file mode 100644 index 000000000..bea98be6e --- /dev/null +++ b/ansible/group_vars/all/redis.yml @@ -0,0 +1,11 @@ +--- +enable_redis: "no" + +#################### +# Redis options +#################### +redis_connection_string: "redis://{% for host in groups['redis'] %}{% if host == groups['redis'][0] %}default:{{ redis_master_password }}@{{ 'api' | kolla_address(host) | put_address_in_context('url') }}:{{ redis_sentinel_port }}?sentinel=kolla{% else %}&sentinel_fallback={{ 'api' | kolla_address(host) | put_address_in_context('url') }}:{{ redis_sentinel_port }}{% endif %}{% endfor %}{{ redis_connection_string_extras }}" +redis_connection_string_extras: "&db=0&socket_timeout=60&retry_on_timeout=yes" + +redis_port: "6379" +redis_sentinel_port: "26379" diff --git a/ansible/group_vars/all/s3.yml b/ansible/group_vars/all/s3.yml new file mode 100644 index 000000000..c42e45931 --- /dev/null +++ b/ansible/group_vars/all/s3.yml @@ -0,0 +1,7 @@ +--- +############# +# Common options for S3 Cinder Backup and Glance S3 backend. +s3_url: +s3_bucket: +s3_access_key: +s3_secret_key: diff --git a/ansible/group_vars/all/skyline.yml b/ansible/group_vars/all/skyline.yml new file mode 100644 index 000000000..56225268a --- /dev/null +++ b/ansible/group_vars/all/skyline.yml @@ -0,0 +1,18 @@ +--- +enable_skyline: "no" + +skyline_apiserver_internal_fqdn: "{{ kolla_internal_fqdn }}" +skyline_apiserver_external_fqdn: "{{ kolla_external_fqdn }}" +skyline_apiserver_internal_endpoint: "{{ skyline_apiserver_internal_fqdn | kolla_url(internal_protocol, skyline_apiserver_port) }}" +skyline_apiserver_public_endpoint: "{{ skyline_apiserver_external_fqdn | kolla_url(public_protocol, skyline_apiserver_public_port) }}" +skyline_console_internal_fqdn: "{{ kolla_internal_fqdn }}" +skyline_console_external_fqdn: "{{ kolla_external_fqdn }}" +skyline_console_internal_endpoint: "{{ skyline_console_internal_fqdn | kolla_url(internal_protocol, skyline_console_port) }}" +skyline_console_public_endpoint: "{{ skyline_console_external_fqdn | kolla_url(public_protocol, skyline_console_public_port) }}" +skyline_apiserver_port: "9998" +skyline_apiserver_listen_port: "{{ skyline_apiserver_port }}" +skyline_apiserver_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else skyline_apiserver_port }}" +skyline_console_port: "9999" +skyline_console_listen_port: "{{ skyline_console_port }}" +skyline_console_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else skyline_console_port }}" +skyline_enable_sso: "{{ enable_keystone_federation | bool and keystone_identity_providers | selectattr('protocol', 'equalto', 'openid') | list | count > 0 }}" diff --git a/ansible/group_vars/all/tacker.yml b/ansible/group_vars/all/tacker.yml new file mode 100644 index 000000000..936f5fbea --- /dev/null +++ b/ansible/group_vars/all/tacker.yml @@ -0,0 +1,10 @@ +--- +enable_tacker: "no" + +tacker_internal_fqdn: "{{ kolla_internal_fqdn }}" +tacker_external_fqdn: "{{ kolla_external_fqdn }}" +tacker_internal_endpoint: "{{ tacker_internal_fqdn | kolla_url(internal_protocol, tacker_server_port) }}" +tacker_public_endpoint: "{{ tacker_external_fqdn | kolla_url(public_protocol, tacker_server_public_port) }}" +tacker_server_port: "9890" +tacker_server_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else tacker_server_port }}" +tacker_server_listen_port: "{{ tacker_server_port }}" diff --git a/ansible/group_vars/all/telegraf.yml b/ansible/group_vars/all/telegraf.yml new file mode 100644 index 000000000..1ad350fd9 --- /dev/null +++ b/ansible/group_vars/all/telegraf.yml @@ -0,0 +1,9 @@ +--- +enable_telegraf: "no" + +########## +# Telegraf +########## +# Configure telegraf to use the docker daemon itself as an input for +# telemetry data. +telegraf_enable_docker_input: "no" diff --git a/ansible/group_vars/all/trove.yml b/ansible/group_vars/all/trove.yml new file mode 100644 index 000000000..420efad5e --- /dev/null +++ b/ansible/group_vars/all/trove.yml @@ -0,0 +1,11 @@ +--- +enable_trove: "no" +enable_trove_singletenant: "no" + +trove_internal_fqdn: "{{ kolla_internal_fqdn }}" +trove_external_fqdn: "{{ kolla_external_fqdn }}" +trove_internal_base_endpoint: "{{ trove_internal_fqdn | kolla_url(internal_protocol, trove_api_port) }}" +trove_public_base_endpoint: "{{ trove_external_fqdn | kolla_url(public_protocol, trove_api_public_port) }}" +trove_api_port: "8779" +trove_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else trove_api_port }}" +trove_api_listen_port: "{{ trove_api_port }}" diff --git a/ansible/group_vars/all/venus.yml b/ansible/group_vars/all/venus.yml new file mode 100644 index 000000000..85908647b --- /dev/null +++ b/ansible/group_vars/all/venus.yml @@ -0,0 +1,10 @@ +--- +enable_venus: "no" + +venus_internal_fqdn: "{{ kolla_internal_fqdn }}" +venus_external_fqdn: "{{ kolla_external_fqdn }}" +venus_internal_endpoint: "{{ venus_internal_fqdn | kolla_url(internal_protocol, venus_api_port) }}" +venus_public_endpoint: "{{ venus_external_fqdn | kolla_url(public_protocol, venus_api_public_port) }}" +venus_api_port: "10010" +venus_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else venus_api_port }}" +venus_api_listen_port: "{{ venus_api_port }}" diff --git a/ansible/group_vars/all/watcher.yml b/ansible/group_vars/all/watcher.yml new file mode 100644 index 000000000..87d919c8f --- /dev/null +++ b/ansible/group_vars/all/watcher.yml @@ -0,0 +1,10 @@ +--- +enable_watcher: "no" + +watcher_internal_fqdn: "{{ kolla_internal_fqdn }}" +watcher_external_fqdn: "{{ kolla_external_fqdn }}" +watcher_internal_endpoint: "{{ watcher_internal_fqdn | kolla_url(internal_protocol, watcher_api_port) }}" +watcher_public_endpoint: "{{ watcher_external_fqdn | kolla_url(public_protocol, watcher_api_public_port) }}" +watcher_api_port: "9322" +watcher_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else watcher_api_port }}" +watcher_api_listen_port: "{{ watcher_api_port }}" diff --git a/ansible/group_vars/all/zun.yml b/ansible/group_vars/all/zun.yml new file mode 100644 index 000000000..ed10ea546 --- /dev/null +++ b/ansible/group_vars/all/zun.yml @@ -0,0 +1,31 @@ +--- +enable_zun: "no" + +# Extra docker options for Zun +docker_configure_for_zun: "no" +docker_zun_options: -H tcp://{{ api_interface_address | put_address_in_context('url') }}:2375 +docker_zun_config: {} + +# Extra containerd options for Zun +containerd_configure_for_zun: "no" + +# Enable Ceph backed Cinder Volumes for zun +zun_configure_for_cinder_ceph: "no" + +# 42463 is the static group id of the zun user in the Zun image. +# If users customize this value on building the Zun images, +# they need to change this config accordingly. +containerd_grpc_gid: 42463 + +zun_api_port: "9517" +zun_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else zun_api_port }}" +zun_api_listen_port: "{{ zun_api_port }}" +zun_wsproxy_internal_fqdn: "{{ kolla_internal_fqdn }}" +zun_wsproxy_external_fqdn: "{{ kolla_external_fqdn }}" +zun_wsproxy_port: "6784" +zun_wsproxy_protocol: "{{ 'wss' if kolla_enable_tls_external | bool else 'ws' }}" +zun_cni_daemon_port: "9036" +zun_internal_fqdn: "{{ kolla_internal_fqdn }}" +zun_external_fqdn: "{{ kolla_external_fqdn }}" +zun_internal_base_endpoint: "{{ zun_internal_fqdn | kolla_url(internal_protocol, zun_api_port) }}" +zun_public_base_endpoint: "{{ zun_external_fqdn | kolla_url(public_protocol, zun_api_public_port) }}" diff --git a/ansible/group_vars/baremetal.yml b/ansible/group_vars/baremetal.yml deleted file mode 100644 index 00d4ef5ba..000000000 --- a/ansible/group_vars/baremetal.yml +++ /dev/null @@ -1,15 +0,0 @@ ---- -ansible_python_interpreter: >- - {{ - virtualenv ~ '/bin/python' - if virtualenv is defined - and virtualenv is not none - and virtualenv | length > 0 - else ( - ansible_facts.python.executable - if ansible_facts.python.executable is defined - and ansible_facts.python.executable is not none - and ansible_facts.python.executable | length > 0 - else 'auto_silent' - ) - }} diff --git a/ansible/group_vars/baremetal/ansible-python-interpreter.yml b/ansible/group_vars/baremetal/ansible-python-interpreter.yml new file mode 100644 index 000000000..00d4ef5ba --- /dev/null +++ b/ansible/group_vars/baremetal/ansible-python-interpreter.yml @@ -0,0 +1,15 @@ +--- +ansible_python_interpreter: >- + {{ + virtualenv ~ '/bin/python' + if virtualenv is defined + and virtualenv is not none + and virtualenv | length > 0 + else ( + ansible_facts.python.executable + if ansible_facts.python.executable is defined + and ansible_facts.python.executable is not none + and ansible_facts.python.executable | length > 0 + else 'auto_silent' + ) + }} diff --git a/ansible/module_utils/kolla_podman_worker.py b/ansible/module_utils/kolla_podman_worker.py index 2f323eff2..f26846ded 100644 --- a/ansible/module_utils/kolla_podman_worker.py +++ b/ansible/module_utils/kolla_podman_worker.py @@ -220,7 +220,7 @@ class PodmanWorker(ContainerWorker): # NOTE(m.hiner): default ulimits have to be filtered out because # Podman would treat them as new ulimits and break the container # as a result. Names are a copy of - # default_podman_dimensions_el9 in /ansible/group_vars/all.yml + # default_podman_dimensions_el9 in group_vars for name in ['RLIMIT_NOFILE', 'RLIMIT_NPROC']: ulimits.pop(name, None) diff --git a/doc/source/reference/containers/kuryr-guide.rst b/doc/source/reference/containers/kuryr-guide.rst index fbcbfd419..f748d16c5 100644 --- a/doc/source/reference/containers/kuryr-guide.rst +++ b/doc/source/reference/containers/kuryr-guide.rst @@ -26,7 +26,8 @@ The IP address is host running the etcd service. ```2375``` is port that allows Docker daemon to be accessed remotely. ```2379``` is the etcd listening port. -By default etcd and kuryr are disabled in the ``group_vars/all.yml``. +By default etcd and kuryr are disabled in the ``group_vars/all/etcd.yml`` and +``group_vars/all/kuryr.yml`` files. In order to enable them, you need to edit the file globals.yml and set the following variables diff --git a/doc/source/reference/databases/mariadb-guide.rst b/doc/source/reference/databases/mariadb-guide.rst index 71b51f77c..e34e4bf0a 100644 --- a/doc/source/reference/databases/mariadb-guide.rst +++ b/doc/source/reference/databases/mariadb-guide.rst @@ -52,9 +52,9 @@ inventory file in the way described below: .. note:: If ``mariadb_shard_id`` is not defined for host in inventory file it will be set automatically - to ``mariadb_default_database_shard_id`` (default 0) from ``group_vars/all.yml`` and can be - overwritten in ``/etc/kolla/globals.yml``. Shard which is marked as default is special in case - of backup or loadbalance, as it is described below. + to ``mariadb_default_database_shard_id`` (default 0) from ``group_vars/all/mariadb.yml`` and + can be overwritten in ``/etc/kolla/globals.yml``. Shard which is marked as default is + special in case of backup or loadbalance, as it is described below. Loadbalancer ------------ diff --git a/doc/source/reference/orchestration-and-nfv/tacker-guide.rst b/doc/source/reference/orchestration-and-nfv/tacker-guide.rst index 78fdf4821..4c99e72e1 100644 --- a/doc/source/reference/orchestration-and-nfv/tacker-guide.rst +++ b/doc/source/reference/orchestration-and-nfv/tacker-guide.rst @@ -30,7 +30,7 @@ Preparation and Deployment ~~~~~~~~~~~~~~~~~~~~~~~~~~ By default tacker and required services are disabled in -the ``group_vars/all.yml`` file. +the ``group_vars/all/tacker.yml`` file. In order to enable them, you need to edit the file ``/etc/kolla/globals.yml`` and set the following variables: diff --git a/doc/source/user/multinode.rst b/doc/source/user/multinode.rst index 21bf67fa4..5a0db7cf2 100644 --- a/doc/source/user/multinode.rst +++ b/doc/source/user/multinode.rst @@ -136,7 +136,7 @@ host or group variables: `__ are quite complex, but it is worth becoming familiar with them if using host and group variables. The playbook group variables in -``ansible/group_vars/all.yml`` define global defaults, and these take +``ansible/group_vars/all/`` define global defaults, and these take precedence over variables defined in an inventory file and inventory ``group_vars/all``, but not over inventory ``group_vars/*``. Variables in 'extra' files (``globals.yml``) have the highest precedence, so any variables diff --git a/doc/source/user/troubleshooting.rst b/doc/source/user/troubleshooting.rst index d00a94ca7..76a9ac604 100644 --- a/doc/source/user/troubleshooting.rst +++ b/doc/source/user/troubleshooting.rst @@ -88,13 +88,13 @@ You can find all kolla logs in there. /var/lib/docker/volumes/kolla_logs/_data When ``enable_central_logging`` is enabled, to view the logs in a web browser -using Kibana, go to -``http://:`` or -``http://:``. Authenticate -using ```` and ````. +using OpenSearch Dashboards, go to +``http://:`` or +``http://:``. Authenticate +using ``opensearch`` and ````. The values ````, ```` -```` and ```` can be found in -``/kolla/ansible/group_vars/all.yml`` or if the default -values are overridden, in ``/etc/kolla/globals.yml``. The value of -```` can be found in ``/etc/kolla/passwords.yml``. +```` can be found in +``/kolla/ansible/group_vars/all/opensearch.yml``. The value +of ```` can be found in +``/etc/kolla/passwords.yml``. diff --git a/etc/kolla/globals.yml b/etc/kolla/globals.yml index cb0e651d5..9d4f00a0a 100644 --- a/etc/kolla/globals.yml +++ b/etc/kolla/globals.yml @@ -1,7 +1,7 @@ --- # You can use this file to override _any_ variable throughout Kolla. # Additional options can be found in the -# 'kolla-ansible/ansible/group_vars/all.yml' file. Default value of all the +# 'kolla-ansible/ansible/group_vars/all' directory. Default value of all the # commented parameters are shown here, To override the default value uncomment # the parameter and change its value. diff --git a/zuul.d/base.yaml b/zuul.d/base.yaml index 4d9d263dd..13db98ca6 100644 --- a/zuul.d/base.yaml +++ b/zuul.d/base.yaml @@ -91,7 +91,7 @@ parent: kolla-ansible-base name: kolla-ansible-scenario-base files: - - ^ansible/group_vars/all.yml + - ^ansible/group_vars/all/(baremetal|common|fluentd|glance|heat|horizon|keepalived|keystone|loadbalancer|neutron|nova|openvswitch|placement|proxysql|rabbitmq).yml - ^ansible/roles/common/ - ^requirements-core.yml - ^tests/check-logs.sh -- cgit v1.2.3