From e9794721abb7796cdcd3efa4a0aea98188fd6a23 Mon Sep 17 00:00:00 2001 From: howardlee Date: Tue, 2 Apr 2024 16:55:53 +0800 Subject: Re-add the neutron-fwaas neutron-fwaas has become active again Depends-On: https://review.opendev.org/c/openstack/kolla/+/914855 Change-Id: Ie5a7b2da9a351e8f47a1ae830bb2fee0a8e35e38 --- ansible/group_vars/all.yml | 2 ++ ansible/roles/horizon/defaults/main.yml | 1 + ansible/roles/neutron/defaults/main.yml | 6 ++++++ ansible/roles/neutron/tasks/config.yml | 22 ++++++++++++++++++++++ .../roles/neutron/templates/fwaas_driver.ini.j2 | 11 +++++++++++ .../templates/neutron-l3-agent-wrapper.sh.j2 | 6 +++++- .../neutron/templates/neutron-l3-agent.json.j2 | 8 +++++++- .../roles/neutron/templates/neutron-server.json.j2 | 10 +++++++++- 8 files changed, 63 insertions(+), 3 deletions(-) create mode 100644 ansible/roles/neutron/templates/fwaas_driver.ini.j2 (limited to 'ansible') diff --git a/ansible/group_vars/all.yml b/ansible/group_vars/all.yml index c9196ad91..e8cdca9f8 100644 --- a/ansible/group_vars/all.yml +++ b/ansible/group_vars/all.yml @@ -770,6 +770,7 @@ enable_horizon: "{{ enable_openstack_core | bool }}" enable_horizon_blazar: "{{ enable_blazar | bool }}" enable_horizon_cloudkitty: "{{ enable_cloudkitty | bool }}" enable_horizon_designate: "{{ enable_designate | bool }}" +enable_horizon_fwaas: "{{ enable_neutron_fwaas | bool }}" enable_horizon_heat: "{{ enable_heat | bool }}" enable_horizon_ironic: "{{ enable_ironic | bool }}" enable_horizon_magnum: "{{ enable_magnum | bool }}" @@ -806,6 +807,7 @@ enable_neutron_vpnaas: "no" enable_neutron_sriov: "no" enable_neutron_mlnx: "no" enable_neutron_dvr: "no" +enable_neutron_fwaas: "no" enable_neutron_qos: "no" enable_neutron_agent_ha: "no" enable_neutron_bgp_dragent: "no" diff --git a/ansible/roles/horizon/defaults/main.yml b/ansible/roles/horizon/defaults/main.yml index dcf4b5263..04bf1763a 100644 --- a/ansible/roles/horizon/defaults/main.yml +++ b/ansible/roles/horizon/defaults/main.yml @@ -9,6 +9,7 @@ horizon_services: ENABLE_BLAZAR: "{{ 'yes' if enable_horizon_blazar | bool else 'no' }}" ENABLE_CLOUDKITTY: "{{ 'yes' if enable_horizon_cloudkitty | bool else 'no' }}" ENABLE_DESIGNATE: "{{ 'yes' if enable_horizon_designate | bool else 'no' }}" + ENABLE_FWAAS: "{{ 'yes' if enable_horizon_fwaas | bool else 'no' }}" ENABLE_HEAT: "{{ 'yes' if enable_horizon_heat | bool else 'no' }}" ENABLE_IRONIC: "{{ 'yes' if enable_horizon_ironic | bool else 'no' }}" ENABLE_MAGNUM: "{{ 'yes' if enable_horizon_magnum | bool else 'no' }}" diff --git a/ansible/roles/neutron/defaults/main.yml b/ansible/roles/neutron/defaults/main.yml index fe01a5fc8..4dd8213b3 100644 --- a/ansible/roles/neutron/defaults/main.yml +++ b/ansible/roles/neutron/defaults/main.yml @@ -656,6 +656,8 @@ neutron_metadata_workers: "{{ openstack_service_workers }}" # Subprojects #################### neutron_subprojects: + - name: "neutron-fwaas" + enabled: "{{ enable_neutron_fwaas | bool }}" - name: "networking-sfc" enabled: "{{ enable_neutron_sfc | bool }}" - name: "neutron-dynamic-routing" @@ -725,6 +727,8 @@ neutron_modules_extra: [] # Service Plugins #################### service_plugins: + - name: "firewall_v2" + enabled: "{{ enable_neutron_fwaas | bool }}" - name: "flow_classifier" enabled: "{{ enable_neutron_sfc | bool }}" - name: "metering" @@ -783,6 +787,8 @@ agent_extensions: neutron_agent_extensions: "{{ agent_extensions | selectattr('enabled', 'equalto', true) | list }}" l3_agent_extensions: + - name: "fwaas_v2" + enabled: "{{ enable_neutron_fwaas | bool }}" - name: "vpnaas" enabled: "{{ enable_neutron_vpnaas | bool }}" - name: "port_forwarding" diff --git a/ansible/roles/neutron/tasks/config.yml b/ansible/roles/neutron/tasks/config.yml index 707f30072..ef5055e37 100644 --- a/ansible/roles/neutron/tasks/config.yml +++ b/ansible/roles/neutron/tasks/config.yml @@ -323,6 +323,28 @@ notify: - "Restart {{ item.key }} container" +- name: Copying over fwaas_driver.ini + become: true + vars: + service_name: "{{ item.key }}" + services_need_fwaas_driver_ini: + - "neutron-server" + - "neutron-l3-agent" + merge_configs: + sources: + - "{{ role_path }}/templates/fwaas_driver.ini.j2" + - "{{ node_custom_config }}/neutron/fwaas_driver.ini" + dest: "{{ node_config_directory }}/{{ service_name }}/fwaas_driver.ini" + mode: "0660" + when: + - enable_neutron_fwaas | bool + - item.key in services_need_fwaas_driver_ini + - item.value.enabled | bool + - item.value.host_in_groups | bool + with_dict: "{{ neutron_services }}" + notify: + - "Restart {{ item.key }} container" + - name: Copying over metadata_agent.ini become: true vars: diff --git a/ansible/roles/neutron/templates/fwaas_driver.ini.j2 b/ansible/roles/neutron/templates/fwaas_driver.ini.j2 new file mode 100644 index 000000000..b0df0858f --- /dev/null +++ b/ansible/roles/neutron/templates/fwaas_driver.ini.j2 @@ -0,0 +1,11 @@ +[fwaas] +enabled = True +{% if neutron_plugin_agent == 'vmware_nsxv' %} +driver = vmware_nsxv_edge +{% else %} +agent_version = v2 +driver = iptables_v2 + +[service_providers] +service_provider = FIREWALL_V2:fwaas_db:neutron_fwaas.services.firewall.service_drivers.agents.agents.FirewallAgentDriver:default +{% endif %} diff --git a/ansible/roles/neutron/templates/neutron-l3-agent-wrapper.sh.j2 b/ansible/roles/neutron/templates/neutron-l3-agent-wrapper.sh.j2 index 6960ae4bb..028988e93 100644 --- a/ansible/roles/neutron/templates/neutron-l3-agent-wrapper.sh.j2 +++ b/ansible/roles/neutron/templates/neutron-l3-agent-wrapper.sh.j2 @@ -7,10 +7,14 @@ set -o errexit neutron-netns-cleanup \ --config-file /etc/neutron/neutron.conf \ --config-file /etc/neutron/l3_agent.ini \ +{% if enable_neutron_fwaas | bool %} + --config-file /etc/neutron/fwaas_driver.ini \ +{% endif %} --force --agent-type l3 {% endif %} neutron-l3-agent \ --config-file /etc/neutron/neutron.conf \ --config-file /etc/neutron/neutron_vpnaas.conf \ - --config-file /etc/neutron/l3_agent.ini \ + --config-file /etc/neutron/l3_agent.ini{% if enable_neutron_fwaas | bool %} \ + --config-file /etc/neutron/fwaas_driver.ini{% endif %} diff --git a/ansible/roles/neutron/templates/neutron-l3-agent.json.j2 b/ansible/roles/neutron/templates/neutron-l3-agent.json.j2 index 5c1d79c33..cd3654841 100644 --- a/ansible/roles/neutron/templates/neutron-l3-agent.json.j2 +++ b/ansible/roles/neutron/templates/neutron-l3-agent.json.j2 @@ -18,7 +18,13 @@ "dest": "/etc/neutron/neutron_vpnaas.conf", "owner": "neutron", "perm": "0600" - }, + }{% if enable_neutron_fwaas | bool %}, + { + "source": "{{ container_config_directory }}/fwaas_driver.ini", + "dest": "/etc/neutron/fwaas_driver.ini", + "owner": "neutron", + "perm": "0600" + }{% endif %}, { "source": "{{ container_config_directory }}/l3_agent.ini", "dest": "/etc/neutron/l3_agent.ini", diff --git a/ansible/roles/neutron/templates/neutron-server.json.j2 b/ansible/roles/neutron/templates/neutron-server.json.j2 index 8d6904eac..1fe3b349f 100644 --- a/ansible/roles/neutron/templates/neutron-server.json.j2 +++ b/ansible/roles/neutron/templates/neutron-server.json.j2 @@ -1,5 +1,5 @@ { - "command": "neutron-server --config-file /etc/neutron/neutron.conf {% if neutron_plugin_agent in ['openvswitch', 'linuxbridge', 'ovn'] %} --config-file /etc/neutron/plugins/ml2/ml2_conf.ini --config-file /etc/neutron/neutron_vpnaas.conf {% elif neutron_plugin_agent in ['vmware_nsxv', 'vmware_nsxv3', 'vmware_nsxp', 'vmware_dvs'] %} --config-file /etc/neutron/plugins/vmware/nsx.ini {% endif %}", + "command": "neutron-server --config-file /etc/neutron/neutron.conf {% if neutron_plugin_agent in ['openvswitch', 'linuxbridge', 'ovn'] %} --config-file /etc/neutron/plugins/ml2/ml2_conf.ini --config-file /etc/neutron/neutron_vpnaas.conf {% elif neutron_plugin_agent in ['vmware_nsxv', 'vmware_nsxv3', 'vmware_nsxp', 'vmware_dvs'] %} --config-file /etc/neutron/plugins/vmware/nsx.ini {% endif %}{% if enable_neutron_fwaas | bool %}--config-file /etc/neutron/fwaas_driver.ini{% endif %}", "config_files": [ { "source": "{{ container_config_directory }}/neutron.conf", @@ -7,6 +7,14 @@ "owner": "neutron", "perm": "0600" }, +{% if enable_neutron_fwaas | bool %} + { + "source": "{{ container_config_directory }}/fwaas_driver.ini", + "dest": "/etc/neutron/fwaas_driver.ini", + "owner": "neutron", + "perm": "0600" + }, +{% endif %} { "source": "{{ container_config_directory }}/neutron_vpnaas.conf", "dest": "/etc/neutron/neutron_vpnaas.conf", -- cgit v1.2.3