diff options
| author | Dave McCowan <dmccowan@cisco.com> | 2016-02-18 13:50:39 -0500 |
|---|---|---|
| committer | Dave McCowan <dmccowan@cisco.com> | 2016-02-24 09:18:06 -0500 |
| commit | 34c2cb8e64c4758ec9e834dc3fabc9f5835fe9ac (patch) | |
| tree | fb5fea1f267fb85abf994bdfd5de015fe1d6b2dc /etc | |
| parent | 3f8bc072706dc7dfb064ea37813dc2ccc3d87e31 (diff) | |
| download | kolla-34c2cb8e64c4758ec9e834dc3fabc9f5835fe9ac.tar.gz kolla-34c2cb8e64c4758ec9e834dc3fabc9f5835fe9ac.zip | |
Implement Option for Two VIPs to separate API traffic
To improve security, operators have asked for two VIPs for
their cloud.
VIP 1 is the internal VIP that can reach internal and admin endpoints.
In addition, the internal VIP can also reach other internal services,
such as the database and message services.
VIP 2 is the external VIP that can only reach public endpoints.
With one VIP only, all services are reached at the same address.
To add a second VIP, this patch adds two new configuration parameters.
kolla_external_vip_address: is an IPv4 address to use for created VIP
kolla_external_vip_interface: is the network interface to use for VIP
In this scenario, the first VIP (the internal VIP), is defined by
the original parameters (kolla_internal address and network_interface).
When using two VIPs, the existing kolla_external_address parameter
should be/point to/resolve to the kolla_external_vip_address.
Closes-bug: 1535333
Change-Id: I5bfcefaf7899298455cdade8209c34324aebfecb
Diffstat (limited to 'etc')
| -rw-r--r-- | etc/kolla/globals.yml | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/etc/kolla/globals.yml b/etc/kolla/globals.yml index 3de40c4e8..885c80bc8 100644 --- a/etc/kolla/globals.yml +++ b/etc/kolla/globals.yml @@ -15,7 +15,7 @@ #kolla_install_type: "binary" # This should be a VIP, an unused IP on your network that will float between -# the hosts running keepalived for high-availibility. When running an All-In-One +# the hosts running keepalived for high-availability. When running an All-In-One # without haproxy and keepalived, this should be the first IP on your # 'network_interface' as set in the Networking section below. kolla_internal_address: "10.10.10.254" @@ -27,6 +27,12 @@ kolla_internal_address: "10.10.10.254" # It is recommended to use a DNS name as well, but not required. #kolla_external_address: "{{ kolla_internal_address }}" +# This should be a VIP, an unused IP on your network that will float between +# the hosts running keepalived for high-availability. It defaults to the +# kolla_internal_address, allowing internal and external communication to +# share the same address. Specify a kolla_external_vip_address to +# separate internal and external requests between two VIPs. +#kolla_external_vip_address: "{{ kolla_internal_address }}" #################### # Docker options @@ -49,6 +55,7 @@ network_interface: "eth0" # These can be adjusted for even more customization. The default is the same as # the 'network_interface'. These interfaces must container an IPv4 address. +#kolla_external_vip_interface: "{{ network_interface }}" #api_interface: "{{ network_interface }}" #storage_interface: "{{ network_interface }}" #tunnel_interface: "{{ network_interface }}" |