Chapter 5. Networking
This chapter explains the OpenStack Networking configuration options.
5.1. Networking Configuration Options
5.1.1. Description of Configuration Options
The following tables provide a comprehensive list of the Networking configuration options.
|
Configuration option = Default value
|
Description
|
|---|---|
|
[DEFAULT]
| |
external_pids = $state_path/external/pids
|
(String) Location to store child pid files
|
|
[AGENT]
| |
agent_type = Open vSwitch agent
|
(String) DEPRECATED: Selects the Agent Type reported
|
availability_zone = nova
|
(String) Availability zone of this node
|
|
Configuration option = Default value
|
Description
|
|---|---|
|
[DEFAULT]
| |
allow_bulk = True
|
(Boolean) Allow the usage of the bulk API
|
allow_pagination = True
|
(Boolean) DEPRECATED: Allow the usage of the pagination. This option has been deprecated and will now be enabled unconditionally.
|
allow_sorting = True
|
(Boolean) DEPRECATED: Allow the usage of the sorting. This option has been deprecated and will now be enabled unconditionally.
|
api_extensions_path =
|
(String) The path for API extensions. Note that this can be a colon-separated list of paths. For example: api_extensions_path = extensions:/path/to/more/exts:/even/more/exts. The __path__ of neutron.extensions is appended to this, so if your extensions are in there you don't need to specify them here.
|
api_paste_config = api-paste.ini
|
(String) File name for the paste.deploy config for api service
|
backlog = 4096
|
(Integer) Number of backlog requests to configure the socket with
|
client_socket_timeout = 900
|
(Integer) Timeout for client connections' socket operations. If an incoming connection is idle for this number of seconds it will be closed. A value of '0' means wait forever.
|
max_header_line = 16384
|
(Integer) Maximum line size of message headers to be accepted. max_header_line may need to be increased when using large tokens (typically those generated when keystone is configured to use PKI tokens with big service catalogs).
|
pagination_max_limit = -1
|
(String) The maximum number of items returned in a single response, value was 'infinite' or negative integer means no limit
|
retry_until_window = 30
|
(Integer) Number of seconds to keep retrying to listen
|
service_plugins =
|
(List) The service plugins Neutron will use
|
tcp_keepidle = 600
|
(Integer) Sets the value of TCP_KEEPIDLE in seconds for each server socket. Not supported on OS X.
|
use_ssl = False
|
(Boolean) Enable SSL on the API server
|
wsgi_default_pool_size = 100
|
(Integer) Size of the pool of greenthreads used by wsgi
|
wsgi_keep_alive = True
|
(Boolean) If False, closes the client socket connection explicitly.
|
wsgi_log_format = %(client_ip)s "%(request_line)s" status: %(status_code)s len: %(body_length)s time: %(wall_seconds).7f
|
(String) A python format string that is used as the template to generate log lines. The following values can beformatted into it: client_ip, date_time, request_line, status_code, body_length, wall_seconds.
|
|
[oslo_middleware]
| |
enable_proxy_headers_parsing = False
|
(Boolean) Whether the application is behind a proxy or not. This determines if the middleware should parse the headers or not.
|
max_request_body_size = 114688
|
(Integer) The maximum body size for each request, in bytes.
|
secure_proxy_ssl_header = X-Forwarded-Proto
|
(String) DEPRECATED: The HTTP Header that will be used to determine what the original request protocol scheme was, even if it was hidden by a SSL termination proxy.
|
|
[oslo_versionedobjects]
| |
fatal_exception_format_errors = False
|
(Boolean) Make exception message format errors fatal
|
|
Configuration option = Default value
|
Description
|
|---|---|
|
[DEFAULT]
| |
agent_down_time = 75
|
(Integer) Seconds to regard the agent is down; should be at least twice report_interval, to be sure the agent is down for good.
|
allow_automatic_dhcp_failover = True
|
(Boolean) Automatically remove networks from offline DHCP agents.
|
allow_automatic_l3agent_failover = False
|
(Boolean) Automatically reschedule routers from offline L3 agents to online L3 agents.
|
api_workers = None
|
(Integer) Number of separate API worker processes for service. If not specified, the default is equal to the number of CPUs available for best performance.
|
auth_ca_cert = None
|
(String) Certificate Authority public key (CA cert) file for ssl
|
auth_strategy = keystone
|
(String) The type of authentication to use
|
base_mac = fa:16:3e:00:00:00
|
(String) The base MAC address Neutron will use for VIFs. The first 3 octets will remain unchanged. If the 4th octet is not 00, it will also be used. The others will be randomly generated.
|
bind_host = 0.0.0.0
|
(String) The host IP to bind to
|
bind_port = 9696
|
(Port number) The port to bind to
|
cache_url =
|
(String) DEPRECATED: URL to connect to the cache back end. This option is deprecated in the Newton release and will be removed. Please add a [cache] group for oslo.cache in your neutron.conf and add "enable" and "backend" options in this section.
|
core_plugin = None
|
(String) The core plugin Neutron will use
|
default_availability_zones =
|
(List) Default value of availability zone hints. The availability zone aware schedulers use this when the resources availability_zone_hints is empty. Multiple availability zones can be specified by a comma separated string. This value can be empty. In this case, even if availability_zone_hints for a resource is empty, availability zone is considered for high availability while scheduling the resource.
|
dhcp_agent_notification = True
|
(Boolean) Allow sending resource operation notification to DHCP agent
|
dhcp_agents_per_network = 1
|
(Integer) Number of DHCP agents scheduled to host a tenant network. If this number is greater than 1, the scheduler automatically assigns multiple DHCP agents for a given tenant network, providing high availability for DHCP service.
|
dhcp_broadcast_reply = False
|
(Boolean) Use broadcast in DHCP replies.
|
dhcp_confs = $state_path/dhcp
|
(String) Location to store DHCP server config files.
|
dhcp_domain = openstacklocal
|
(String) DEPRECATED: Domain to use for building the hostnames. This option is deprecated. It has been moved to neutron.conf as dns_domain. It will be removed in a future release.
|
dhcp_lease_duration = 86400
|
(Integer) DHCP lease duration (in seconds). Use -1 to tell dnsmasq to use infinite lease times.
|
dhcp_load_type = networks
|
(String) Representing the resource type whose load is being reported by the agent. This can be "networks", "subnets" or "ports". When specified (Default is networks), the server will extract particular load sent as part of its agent configuration object from the agent report state, which is the number of resources being consumed, at every report_interval.dhcp_load_type can be used in combination with network_scheduler_driver = neutron.scheduler.dhcp_agent_scheduler.WeightScheduler When the network_scheduler_driver is WeightScheduler, dhcp_load_type can be configured to represent the choice for the resource being balanced. Example: dhcp_load_type=networks
|
dns_domain = openstacklocal
|
(String) Domain to use for building the hostnames
|
enable_new_agents = True
|
(Boolean) Agent starts with admin_state_up=False when enable_new_agents=False. In the case, user's resources will not be scheduled automatically to the agent until admin changes admin_state_up to True.
|
enable_services_on_agents_with_admin_state_down = False
|
(Boolean) Enable services on an agent with admin_state_up False. If this option is False, when admin_state_up of an agent is turned False, services on it will be disabled. Agents with admin_state_up False are not selected for automatic scheduling regardless of this option. But manual scheduling to such agents is available if this option is True.
|
executor_thread_pool_size = 64
|
(Integer) Size of executor thread pool.
|
external_dns_driver = None
|
(String) Driver for external DNS integration.
|
global_physnet_mtu = 1500
|
(Integer) MTU of the underlying physical network. Neutron uses this value to calculate MTU for all virtual network components. For flat and VLAN networks, neutron uses this value without modification. For overlay networks such as VXLAN, neutron automatically subtracts the overlay protocol overhead from this value. Defaults to 1500, the standard value for Ethernet.
|
ip_lib_force_root = False
|
(Boolean) Force ip_lib calls to use the root helper
|
ipam_driver = internal
|
(String) Neutron IPAM (IP address management) driver to use. By default, the reference implementation of the Neutron IPAM driver is used.
|
mac_generation_retries = 16
|
(Integer) DEPRECATED: How many times Neutron will retry MAC generation. This option is now obsolete and so is deprecated to be removed in the Ocata release.
|
max_allowed_address_pair = 10
|
(Integer) Maximum number of allowed address pairs
|
max_dns_nameservers = 5
|
(Integer) Maximum number of DNS nameservers per subnet
|
max_fixed_ips_per_port = 5
|
(Integer) DEPRECATED: Maximum number of fixed ips per port. This option is deprecated and will be removed in the Ocata release.
|
max_rtr_adv_interval = 100
|
(Integer) MaxRtrAdvInterval setting for radvd.conf
|
max_subnet_host_routes = 20
|
(Integer) Maximum number of host routes per subnet
|
min_rtr_adv_interval = 30
|
(Integer) MinRtrAdvInterval setting for radvd.conf
|
periodic_fuzzy_delay = 5
|
(Integer) Range of seconds to randomly delay when starting the periodic task scheduler to reduce stampeding. (Disable by setting to 0)
|
periodic_interval = 40
|
(Integer) Seconds between running periodic tasks.
|
report_interval = 300
|
(Integer) Interval between two metering reports
|
state_path = /var/lib/neutron
|
(String) Where to store Neutron state files. This directory must be writable by the agent.
|
vlan_transparent = False
|
(Boolean) If True, then allow plugins that support it to create VLAN transparent networks.
|
web_framework = legacy
|
(String) This will choose the web framework in which to run the Neutron API server. 'pecan' is a new experimental rewrite of the API server.
|
|
[AGENT]
| |
check_child_processes_action = respawn
|
(String) Action to be executed when a child process dies
|
check_child_processes_interval = 60
|
(Integer) Interval between checks of child process liveness (seconds), use 0 to disable
|
debug_iptables_rules = False
|
(Boolean) Duplicate every iptables difference calculation to ensure the format being generated matches the format of iptables-save. This option should not be turned on for production systems because it imposes a performance penalty.
|
log_agent_heartbeats = False
|
(Boolean) Log agent heartbeats
|
polling_interval = 2
|
(Integer) The number of seconds the agent will wait between polling for local device changes.
|
root_helper = sudo
|
(String) Root helper application. Use 'sudo neutron-rootwrap /etc/neutron/rootwrap.conf' to use the real root filter facility. Change to 'sudo' to skip the filtering and just run the command directly.
|
root_helper_daemon = None
|
(String) Root helper daemon application to use when possible.
|
|
[profiler]
| |
connection_string = messaging://
|
(String) Connection string for a notifier backend. Default value is messaging:// which sets the notifier to oslo_messaging.
Examples of possible values:
|
enabled = False
|
(Boolean) Enables the profiling for all services on this node. Default value is False (fully disable the profiling feature).
Possible values:
|
hmac_keys = SECRET_KEY
|
(String) Secret key(s) to use for encrypting context data for performance profiling. This string value should have the following format: <key1>[,<key2>,...<keyn>], where each key is some random string. A user who triggers the profiling via the REST API has to set one of these keys in the headers of the REST API call to include profiling results of this node for this particular project.
Both "enabled" flag and "hmac_keys" config options should be set to enable profiling. Also, to generate correct profiling information across all services at least one key needs to be consistent between OpenStack projects. This ensures it can be used from client side to generate the trace, containing information from all possible resources.
|
trace_sqlalchemy = False
|
(Boolean) Enables SQL requests profiling in services. Default value is False (SQL requests won't be traced).
Possible values:
|
|
[qos]
| |
notification_drivers = message_queue
|
(List) Drivers list to use to send the update notification
|
|
[service_providers]
| |
service_provider = []
|
(Multi-valued) Defines providers for advanced services using the format: <service_type>:<name>:<driver>[:default]
|
|
Configuration option = Default value
|
Description
|
|---|---|
|
[DEFAULT]
| |
notify_nova_on_port_data_changes = True
|
(Boolean) Send notification to nova when port data (fixed_ips/floatingip) changes so nova can update its cache.
|
notify_nova_on_port_status_changes = True
|
(Boolean) Send notification to nova when port status changes
|
nova_client_cert =
|
(String) Client certificate for nova metadata api server.
|
nova_client_priv_key =
|
(String) Private key of client certificate.
|
send_events_interval = 2
|
(Integer) Number of seconds between sending events to nova if there are any events to send.
|
|
Configuration option = Default value
|
Description
|
|---|---|
|
[DEFAULT]
| |
advertise_mtu = True
|
(Boolean) DEPRECATED: If True, advertise network MTU values if core plugin calculates them. MTU is advertised to running instances via DHCP and RA MTU options.
|
dhcp_driver = neutron.agent.linux.dhcp.Dnsmasq
|
(String) The driver used to manage the DHCP server.
|
dnsmasq_base_log_dir = None
|
(String) Base log dir for dnsmasq logging. The log contains DHCP and DNS log information and is useful for debugging issues with either DHCP or DNS. If this section is null, disable dnsmasq log.
|
dnsmasq_config_file =
|
(String) Override the default dnsmasq settings with this file.
|
dnsmasq_dns_servers =
|
(List) Comma-separated list of the DNS servers which will be used as forwarders.
|
dnsmasq_lease_max = 16777216
|
(Integer) Limit number of leases to prevent a denial-of-service.
|
dnsmasq_local_resolv = False
|
(Boolean) Enables the dnsmasq service to provide name resolution for instances via DNS resolvers on the host running the DHCP agent. Effectively removes the '--no-resolv' option from the dnsmasq process arguments. Adding custom DNS resolvers to the 'dnsmasq_dns_servers' option disables this feature.
|
enable_isolated_metadata = False
|
(Boolean) The DHCP server can assist with providing metadata support on isolated networks. Setting this value to True will cause the DHCP server to append specific host routes to the DHCP request. The metadata service will only be activated when the subnet does not contain any router port. The guest instance must be configured to request host routes via DHCP (Option 121). This option doesn't have any effect when force_metadata is set to True.
|
enable_metadata_network = False
|
(Boolean) Allows for serving metadata requests coming from a dedicated metadata access network whose CIDR is 169.254.169.254/16 (or larger prefix), and is connected to a Neutron router from which the VMs send metadata:1 request. In this case DHCP Option 121 will not be injected in VMs, as they will be able to reach 169.254.169.254 through a router. This option requires enable_isolated_metadata = True.
|
force_metadata = False
|
(Boolean) In some cases the Neutron router is not present to provide the metadata IP but the DHCP server can be used to provide this info. Setting this value will force the DHCP server to append specific host routes to the DHCP request. If this option is set, then the metadata service will be activated for all the networks.
|
host = example.domain
|
(String) Hostname to be used by the Neutron server, agents and services running on this machine. All the agents and services running on this machine must use the same host value.
|
interface_driver = None
|
(String) The driver used to manage the virtual interface.
|
num_sync_threads = 4
|
(Integer) Number of threads to use during sync process. Should not exceed connection pool size configured on server.
|
resync_interval = 5
|
(Integer) The DHCP agent will resync its state with Neutron to recover from any transient notification or RPC errors. The interval is number of seconds between attempts.
|
|
Configuration option = Default value
|
Description
|
|---|---|
|
[DEFAULT]
| |
dvr_base_mac = fa:16:3f:00:00:00
|
(String) The base mac address used for unique DVR instances by Neutron. The first 3 octets will remain unchanged. If the 4th octet is not 00, it will also be used. The others will be randomly generated. The 'dvr_base_mac' must be different from 'base_mac' to avoid mixing them up with MAC's allocated for tenant ports. A 4 octet example would be dvr_base_mac = fa:16:3f:4f:00:00. The default is 3 octet
|
router_distributed = False
|
(Boolean) System-wide flag to determine the type of router that tenants can create. Only admin can override.
|
|
Configuration option = Default value
|
Description
|
|---|---|
|
[FDB]
| |
shared_physical_device_mappings =
|
(List) Comma-separated list of <physical_network>:<network_device> tuples mapping physical network names to the agent's node-specific shared physical network device between SR-IOV and OVS or SR-IOV and linux bridge
|
|
Configuration option = Default value
|
Description
|
|---|---|
|
[DEFAULT]
| |
ra_confs = $state_path/ra
|
(String) Location to store IPv6 RA config files
|
|
Configuration option = Default value
|
Description
|
|---|---|
|
[agent]
| |
extensions =
|
(List) Extensions list to use
|
|
Configuration option = Default value
|
Description
|
|---|---|
|
[DEFAULT]
| |
enable_snat_by_default = True
|
(Boolean) Define the default value of enable_snat if not provided in external_gateway_info.
|
external_network_bridge =
|
(String) DEPRECATED: Name of bridge used for external network traffic. When this parameter is set, the L3 agent will plug an interface directly into an external bridge which will not allow any wiring by the L2 agent. Using this will result in incorrect port statuses. This option is deprecated and will be removed in Ocata.
|
ha_confs_path = $state_path/ha_confs
|
(String) Location to store keepalived/conntrackd config files
|
ha_vrrp_advert_int = 2
|
(Integer) The advertisement interval in seconds
|
ha_vrrp_auth_password = None
|
(String) VRRP authentication password
|
ha_vrrp_auth_type = PASS
|
(String) VRRP authentication type
|
host = example.domain
|
(String) Hostname to be used by the Neutron server, agents and services running on this machine. All the agents and services running on this machine must use the same host value.
|
interface_driver = None
|
(String) The driver used to manage the virtual interface.
|
ipv6_pd_enabled = False
|
(Boolean) Enables IPv6 Prefix Delegation for automatic subnet CIDR allocation. Set to True to enable IPv6 Prefix Delegation for subnet allocation in a PD-capable environment. Users making subnet creation requests for IPv6 subnets without providing a CIDR or subnetpool ID will be given a CIDR via the Prefix Delegation mechanism. Note that enabling PD will override the behavior of the default IPv6 subnetpool.
|
l3_ha = False
|
(Boolean) Enable HA mode for virtual routers.
|
l3_ha_net_cidr = 169.254.192.0/18
|
(String) Subnet used for the l3 HA admin network.
|
l3_ha_network_physical_name =
|
(String) The physical network name with which the HA network can be created.
|
l3_ha_network_type =
|
(String) The network type to use when creating the HA network for an HA router. By default or if empty, the first 'tenant_network_types' is used. This is helpful when the VRRP traffic should use a specific network which is not the default one.
|
max_l3_agents_per_router = 3
|
(Integer) Maximum number of L3 agents which a HA router will be scheduled on. If it is set to 0 then the router will be scheduled on every agent.
|
min_l3_agents_per_router = 2
|
(Integer) DEPRECATED: Minimum number of L3 agents that have to be available in order to allow a new HA router to be scheduled. This option is deprecated in the Newton release and will be removed for the Ocata release where the scheduling of new HA routers will always be allowed.
|
|
[AGENT]
| |
comment_iptables_rules = True
|
(Boolean) Add comments to iptables rules. Set to false to disallow the addition of comments to generated iptables rules that describe each rule's purpose. System must support the iptables comments module for addition of comments.
|
use_helper_for_ns_read = True
|
(Boolean) Use the root helper when listing the namespaces on a system. This may not be required depending on the security configuration. If the root helper is not required, set this to False for a performance improvement.
|
|
Configuration option = Default value
|
Description
|
|---|---|
|
[DEFAULT]
| |
debug = False
|
(Boolean) If set to true, the logging level will be set to DEBUG instead of the default INFO level. Mutable This option can be changed without restarting.
|
device_driver = ['neutron_lbaas.drivers.haproxy.namespace_driver.HaproxyNSDriver']
|
(Multi-valued) Drivers used to manage loadbalancing devices
|
interface_driver = None
|
(String) The driver used to manage the virtual interface.
|
periodic_interval = 40
|
(Integer) Seconds between running periodic tasks.
|
|
[haproxy]
| |
loadbalancer_state_path = $state_path/lbaas
|
(String) Location to store config and state files
|
send_gratuitous_arp = 3
|
(Integer) When delete and re-add the same vip, send this many gratuitous ARPs to flush the ARP cache in the Router. Set it below or equal to 0 to disable this feature.
|
user_group = nogroup
|
(String) The user group
|
|
Configuration option = Default value
|
Description
|
|---|---|
|
[DEFAULT]
| |
loadbalancer_scheduler_driver = neutron_lbaas.agent_scheduler.ChanceScheduler
|
(String) Driver to use for scheduling to a default loadbalancer agent
|
|
[haproxy]
| |
jinja_config_template = /usr/lib/python/site-packages/neutron-lbaas/neutron_lbaas/drivers/haproxy/templates/haproxy.loadbalancer.j2
|
(String) Jinja template file for haproxy configuration
|
|
[radwarev2]
| |
child_workflow_template_names = manage_l3
|
(List) Name of child workflow templates used.Default: manage_l3
|
ha_secondary_address = None
|
(String) IP address of secondary vDirect server.
|
service_adc_type = VA
|
(String) Service ADC type. Default: VA.
|
service_adc_version =
|
(String) Service ADC version.
|
service_cache = 20
|
(Integer) Size of service cache. Default: 20.
|
service_compression_throughput = 100
|
(Integer) Service compression throughput. Default: 100.
|
service_ha_pair = False
|
(Boolean) Enables or disables the Service HA pair. Default: False.
|
service_isl_vlan = -1
|
(Integer) A required VLAN for the interswitch link to use.
|
service_resource_pool_ids =
|
(List) Resource pool IDs.
|
service_session_mirroring_enabled = False
|
(Boolean) Enable or disable Alteon interswitch link for stateful session failover. Default: False.
|
service_ssl_throughput = 100
|
(Integer) Service SSL throughput. Default: 100.
|
service_throughput = 1000
|
(Integer) Service throughput. Default: 1000.
|
stats_action_name = stats
|
(String) Name of the workflow action for statistics. Default: stats.
|
vdirect_address = None
|
(String) IP address of vDirect server.
|
vdirect_password = radware
|
(String) vDirect user password.
|
vdirect_user = vDirect
|
(String) vDirect user name.
|
workflow_action_name = apply
|
(String) Name of the workflow action. Default: apply.
|
workflow_params = {'data_ip_address': '192.168.200.99', 'ha_network_name': 'HA-Network', 'ha_port': 2, 'allocate_ha_ips': True, 'ha_ip_pool_name': 'default', 'allocate_ha_vrrp': True, 'data_port': 1, 'gateway': '192.168.200.1', 'twoleg_enabled': '_REPLACE_', 'data_ip_mask': '255.255.255.0'}
|
(Dict) Parameter for l2_l3 workflow constructor.
|
workflow_template_name = os_lb_v2
|
(String) Name of the workflow template. Default: os_lb_v2.
|
|
[radwarev2_debug]
| |
configure_l3 = True
|
(Boolean) Configule ADC with L3 parameters?
|
configure_l4 = True
|
(Boolean) Configule ADC with L4 parameters?
|
provision_service = True
|
(Boolean) Provision ADC service?
|
|
Configuration option = Default value
|
Description
|
|---|---|
|
[certificates]
| |
barbican_auth = barbican_acl_auth
|
(String) Name of the Barbican authentication method to use
|
cert_manager_type = barbican
|
(String) Certificate Manager plugin. Defaults to barbican.
|
storage_path = /var/lib/neutron-lbaas/certificates/
|
(String) Absolute path to the certificate storage directory. Defaults to env[OS_LBAAS_TLS_STORAGE].
|
|
Configuration option = Default value
|
Description
|
|---|---|
|
[DEFAULT]
| |
metadata_backlog = 4096
|
(Integer) Number of backlog requests to configure the metadata server socket with
|
metadata_proxy_group =
|
(String) Group (gid or name) running metadata proxy after its initialization (if empty: agent effective group).
|
metadata_proxy_shared_secret =
|
(String) When proxying metadata requests, Neutron signs the Instance-ID header with a shared secret to prevent spoofing. You may select any string for a secret, but it must match here and in the configuration used by the Nova Metadata Server. NOTE: Nova uses the same config key, but in [neutron] section.
|
metadata_proxy_socket = $state_path/metadata_proxy
|
(String) Location of Metadata Proxy UNIX domain socket
|
metadata_proxy_socket_mode = deduce
|
(String) Metadata Proxy UNIX domain socket mode, 4 values allowed: 'deduce': deduce mode from metadata_proxy_user/group values, 'user': set metadata proxy socket mode to 0o644, to use when metadata_proxy_user is agent effective user or root, 'group': set metadata proxy socket mode to 0o664, to use when metadata_proxy_group is agent effective group or root, 'all': set metadata proxy socket mode to 0o666, to use otherwise.
|
metadata_proxy_user =
|
(String) User (uid or name) running metadata proxy after its initialization (if empty: agent effective user).
|
metadata_proxy_watch_log = None
|
(Boolean) Enable/Disable log watch by metadata proxy. It should be disabled when metadata_proxy_user/group is not allowed to read/write its log file and copytruncate logrotate option must be used if logrotate is enabled on metadata proxy log files. Option default value is deduced from metadata_proxy_user: watch log is enabled if metadata_proxy_user is agent effective user id/name.
|
metadata_workers = 0
|
(Integer) Number of separate worker processes for metadata server (defaults to half of the number of CPUs)
|
nova_metadata_insecure = False
|
(Boolean) Allow to perform insecure SSL (https) requests to nova metadata
|
nova_metadata_ip = 127.0.0.1
|
(String) IP address used by Nova metadata server.
|
nova_metadata_port = 8775
|
(Port number) TCP Port used by Nova metadata server.
|
nova_metadata_protocol = http
|
(String) Protocol to access nova metadata, http or https
|
|
Configuration option = Default value
|
Description
|
|---|---|
|
[ml2_type_flat]
| |
flat_networks = *
|
(List) List of physical_network names with which flat networks can be created. Use default '*' to allow flat networks with arbitrary physical_network names. Use an empty list to disable flat networks.
|
|
Configuration option = Default value
|
Description
|
|---|---|
|
[ml2_type_geneve]
| |
max_header_size = 30
|
(Integer) Geneve encapsulation header size is dynamic, this value is used to calculate the maximum MTU for the driver. This is the sum of the sizes of the outer ETH + IP + UDP + GENEVE header sizes. The default size for this field is 50, which is the size of the Geneve header without any additional option headers.
|
vni_ranges =
|
(List) Comma-separated list of <vni_min>:<vni_max> tuples enumerating ranges of Geneve VNI IDs that are available for tenant network allocation
|
|
Configuration option = Default value
|
Description
|
|---|---|
|
[ml2_type_gre]
| |
tunnel_id_ranges =
|
(List) Comma-separated list of <tun_min>:<tun_max> tuples enumerating ranges of GRE tunnel IDs that are available for tenant network allocation
|
|
Configuration option = Default value
|
Description
|
|---|---|
|
[l2pop]
| |
agent_boot_time = 180
|
(Integer) Delay within which agent is expected to update existing ports whent it restarts
|
|
Configuration option = Default value
|
Description
|
|---|---|
|
[ml2_sriov]
| |
supported_pci_vendor_devs = None
|
(List) DEPRECATED: Comma-separated list of supported PCI vendor devices, as defined by vendor_id:product_id according to the PCI ID Repository. Default None accept all PCI vendor devicesDEPRECATED: This option is deprecated in the Newton release and will be removed in the Ocata release. Starting from Ocata the mechanism driver will accept all PCI vendor devices.
|
|
Configuration option = Default value
|
Description
|
|---|---|
|
[ml2_type_vlan]
| |
network_vlan_ranges =
|
(List) List of <physical_network>:<vlan_min>:<vlan_max> or <physical_network> specifying physical_network names usable for VLAN provider and tenant networks, as well as ranges of VLAN tags on each available for allocation to tenant networks.
|
|
Configuration option = Default value
|
Description
|
|---|---|
|
[ml2_type_vxlan]
| |
vni_ranges =
|
(List) Comma-separated list of <vni_min>:<vni_max> tuples enumerating ranges of VXLAN VNI IDs that are available for tenant network allocation
|
vxlan_group = None
|
(String) Multicast group for VXLAN. When configured, will enable sending all broadcast traffic to this multicast group. When left unconfigured, will disable multicast VXLAN mode.
|
|
Configuration option = Default value
|
Description
|
|---|---|
|
[ml2]
| |
extension_drivers =
|
(List) An ordered list of extension driver entrypoints to be loaded from the neutron.ml2.extension_drivers namespace. For example: extension_drivers = port_security,qos
|
external_network_type = None
|
(String) Default network type for external networks when no provider attributes are specified. By default it is None, which means that if provider attributes are not specified while creating external networks then they will have the same type as tenant networks. Allowed values for external_network_type config option depend on the network type values configured in type_drivers config option.
|
mechanism_drivers =
|
(List) An ordered list of networking mechanism driver entrypoints to be loaded from the neutron.ml2.mechanism_drivers namespace.
|
overlay_ip_version = 4
|
(Integer) IP version of all overlay (tunnel) network endpoints. Use a value of 4 for IPv4 or 6 for IPv6.
|
path_mtu = 0
|
(Integer) Maximum size of an IP packet (MTU) that can traverse the underlying physical network infrastructure without fragmentation when using an overlay/tunnel protocol. This option allows specifying a physical network MTU value that differs from the default global_physnet_mtu value.
|
physical_network_mtus =
|
(List) A list of mappings of physical networks to MTU values. The format of the mapping is <physnet>:<mtu val>. This mapping allows specifying a physical network MTU value that differs from the default global_physnet_mtu value.
|
tenant_network_types = local
|
(List) Ordered list of network_types to allocate as tenant networks. The default value 'local' is useful for single-box testing but provides no connectivity between hosts.
|
type_drivers = local, flat, vlan, gre, vxlan, geneve
|
(List) List of network type driver entrypoints to be loaded from the neutron.ml2.type_drivers namespace.
|
|
Configuration option = Default value
|
Description
|
|---|---|
|
[nova]
| |
auth_section = None
|
(Unknown) Config Section from which to load plugin specific options
|
auth_type = None
|
(Unknown) Authentication type to load
|
cafile = None
|
(String) PEM encoded Certificate Authority to use when verifying HTTPs connections.
|
certfile = None
|
(String) PEM encoded client certificate cert file
|
endpoint_type = public
|
(String) Type of the nova endpoint to use. This endpoint will be looked up in the keystone catalog and should be one of public, internal or admin.
|
insecure = False
|
(Boolean) Verify HTTPS connections.
|
keyfile = None
|
(String) PEM encoded client certificate key file
|
region_name = None
|
(String) Name of nova region to use. Useful if keystone manages more than one region.
|
timeout = None
|
(Integer) Timeout value for http requests
|
|
Configuration option = Default value
|
Description
|
|---|---|
|
[DEFAULT]
| |
ovs_integration_bridge = br-int
|
(String) Name of Open vSwitch bridge to use
|
ovs_use_veth = False
|
(Boolean) Uses veth for an OVS interface or not. Support kernels with limited namespace support (e.g. RHEL 6.5) so long as ovs_use_veth is set to True.
|
ovs_vsctl_timeout = 10
|
(Integer) Timeout in seconds for ovs-vsctl commands. If the timeout expires, ovs commands will fail with ALARMCLOCK error.
|
|
[AGENT]
| |
arp_responder = False
|
(Boolean) Enable local ARP responder if it is supported. Requires OVS 2.1 and ML2 l2population driver. Allows the switch (when supporting an overlay) to respond to an ARP request locally without performing a costly ARP broadcast into the overlay.
|
dont_fragment = True
|
(Boolean) Set or un-set the don't fragment (DF) bit on outgoing IP packet carrying GRE/VXLAN tunnel.
|
drop_flows_on_start = False
|
(Boolean) Reset flow table on start. Setting this to True will cause brief traffic interruption.
|
enable_distributed_routing = False
|
(Boolean) Make the l2 agent run in DVR mode.
|
l2_population = False
|
(Boolean) Use ML2 l2population mechanism driver to learn remote MAC and IPs and improve tunnel scalability.
|
minimize_polling = True
|
(Boolean) Minimize polling by monitoring ovsdb for interface changes.
|
ovsdb_monitor_respawn_interval = 30
|
(Integer) The number of seconds to wait before respawning the ovsdb monitor after losing communication with it.
|
prevent_arp_spoofing = True
|
(Boolean) DEPRECATED: Enable suppression of ARP responses that don't match an IP address that belongs to the port from which they originate. Note: This prevents the VMs attached to this agent from spoofing, it doesn't protect them from other devices which have the capability to spoof (e.g. bare metal or VMs attached to agents without this flag set to True). Spoofing rules will not be added to any ports that have port security disabled. For LinuxBridge, this requires ebtables. For OVS, it requires a version that supports matching ARP headers. This option will be removed in Ocata so the only way to disable protection will be via the port security extension.
|
quitting_rpc_timeout = 10
|
(Integer) Set new timeout in seconds for new rpc calls after agent receives SIGTERM. If value is set to 0, rpc timeout won't be changed
|
tunnel_csum = False
|
(Boolean) Set or un-set the tunnel header checksum on outgoing IP packet carrying GRE/VXLAN tunnel.
|
tunnel_types =
|
(List) Network types supported by the agent (gre and/or vxlan).
|
veth_mtu = 9000
|
(Integer) MTU size of veth interfaces
|
vxlan_udp_port = 4789
|
(Port number) The UDP port to use for VXLAN tunnels.
|
|
[OVS]
| |
bridge_mappings =
|
(List) Comma-separated list of <physical_network>:<bridge> tuples mapping physical network names to the agent's node-specific Open vSwitch bridge names to be used for flat and VLAN networks. The length of bridge names should be no more than 11. Each bridge must exist, and should have a physical network interface configured as a port. All physical networks configured on the server should have mappings to appropriate bridges on each agent. Note: If you remove a bridge from this mapping, make sure to disconnect it from the integration bridge as it won't be managed by the agent anymore.
|
datapath_type = system
|
(String) OVS datapath to use. 'system' is the default value and corresponds to the kernel datapath. To enable the userspace datapath set this value to 'netdev'.
|
int_peer_patch_port = patch-tun
|
(String) Peer patch port in integration bridge for tunnel bridge.
|
integration_bridge = br-int
|
(String) Integration bridge to use. Do not change this parameter unless you have a good reason to. This is the name of the OVS integration bridge. There is one per hypervisor. The integration bridge acts as a virtual 'patch bay'. All VM VIFs are attached to this bridge and then 'patched' according to their network connectivity.
|
local_ip = None
|
(IP) IP address of local overlay (tunnel) network endpoint. Use either an IPv4 or IPv6 address that resides on one of the host network interfaces. The IP version of this value must match the value of the 'overlay_ip_version' option in the ML2 plug-in configuration file on the neutron server node(s).
|
of_connect_timeout = 30
|
(Integer) Timeout in seconds to wait for the local switch connecting the controller. Used only for 'native' driver.
|
of_interface = native
|
(String) OpenFlow interface to use.
|
of_listen_address = 127.0.0.1
|
(IP) Address to listen on for OpenFlow connections. Used only for 'native' driver.
|
of_listen_port = 6633
|
(Port number) Port to listen on for OpenFlow connections. Used only for 'native' driver.
|
of_request_timeout = 10
|
(Integer) Timeout in seconds to wait for a single OpenFlow request. Used only for 'native' driver.
|
ovsdb_connection = tcp:127.0.0.1:6640
|
(String) The connection string for the native OVSDB backend. Requires the native ovsdb_interface to be enabled.
|
ovsdb_interface = native
|
(String) The interface for interacting with the OVSDB
|
tun_peer_patch_port = patch-int
|
(String) Peer patch port in tunnel bridge for integration bridge.
|
tunnel_bridge = br-tun
|
(String) Tunnel bridge to use.
|
use_veth_interconnection = False
|
(Boolean) Use veths instead of patch ports to interconnect the integration bridge to physical networks. Support kernel without Open vSwitch patch port support so long as it is set to True.
|
vhostuser_socket_dir = /var/run/openvswitch
|
(String) OVS vhost-user socket directory.
|
|
Configuration option = Default value
|
Description
|
|---|---|
|
[DEFAULT]
| |
pd_confs = $state_path/pd
|
(String) Location to store IPv6 PD files.
|
pd_dhcp_driver = dibbler
|
(String) Service to handle DHCPv6 Prefix delegation.
|
vendor_pen = 8888
|
(String) A decimal value as Vendor's Registered Private Enterprise Number as required by RFC3315 DUID-EN.
|
|
Configuration option = Default value
|
Description
|
|---|---|
|
[DEFAULT]
| |
allow_overlapping_ips = False
|
(Boolean) Allow overlapping IP support in Neutron. Attention: the following parameter MUST be set to False if Neutron is being used in conjunction with Nova security groups.
|
|
Configuration option = Default value
|
Description
|
|---|---|
|
[QOS]
| |
kernel_hz = 250
|
(Integer) Value of host kernel tick rate (hz) for calculating minimum burst value in bandwidth limit rules for a port with QoS. See kernel configuration file for HZ value and tc-tbf manual for more information.
|
tbf_latency = 50
|
(Integer) Value of latency (ms) for calculating size of queue for a port with QoS. See tc-tbf manual for more information.
|
|
Configuration option = Default value
|
Description
|
|---|---|
|
[DEFAULT]
| |
max_routes = 30
|
(Integer) Maximum number of routes per router
|
|
[QUOTAS]
| |
default_quota = -1
|
(Integer) Default number of resource allowed per tenant. A negative value means unlimited.
|
quota_driver = neutron.db.quota.driver.DbQuotaDriver
|
(String) Default driver to use for quota checks.
|
quota_firewall = 10
|
(Integer) Number of firewalls allowed per tenant. A negative value means unlimited.
|
quota_firewall_policy = 10
|
(Integer) Number of firewall policies allowed per tenant. A negative value means unlimited.
|
quota_firewall_rule = 100
|
(Integer) Number of firewall rules allowed per tenant. A negative value means unlimited.
|
quota_floatingip = 50
|
(Integer) Number of floating IPs allowed per tenant. A negative value means unlimited.
|
quota_healthmonitor = -1
|
(Integer) Number of health monitors allowed per tenant. A negative value means unlimited.
|
quota_listener = -1
|
(Integer) Number of Loadbalancer Listeners allowed per tenant. A negative value means unlimited.
|
quota_loadbalancer = 10
|
(Integer) Number of LoadBalancers allowed per tenant. A negative value means unlimited.
|
quota_member = -1
|
(Integer) Number of pool members allowed per tenant. A negative value means unlimited.
|
quota_network = 10
|
(Integer) Number of networks allowed per tenant. A negative value means unlimited.
|
quota_pool = 10
|
(Integer) Number of pools allowed per tenant. A negative value means unlimited.
|
quota_port = 50
|
(Integer) Number of ports allowed per tenant. A negative value means unlimited.
|
quota_rbac_policy = 10
|
(Integer) Default number of RBAC entries allowed per tenant. A negative value means unlimited.
|
quota_router = 10
|
(Integer) Number of routers allowed per tenant. A negative value means unlimited.
|
quota_security_group = 10
|
(Integer) Number of security groups allowed per tenant. A negative value means unlimited.
|
quota_security_group_rule = 100
|
(Integer) Number of security rules allowed per tenant. A negative value means unlimited.
|
quota_subnet = 10
|
(Integer) Number of subnets allowed per tenant, A negative value means unlimited.
|
track_quota_usage = True
|
(Boolean) Keep in track in the database of current resource quota usage. Plugins which do not leverage the neutron database should set this flag to False.
|
|
Configuration option = Default value
|
Description
|
|---|---|
|
[matchmaker_redis]
| |
check_timeout = 20000
|
(Integer) Time in ms to wait before the transaction is killed.
|
host = 127.0.0.1
|
(String) DEPRECATED: Host to locate redis. Replaced by [DEFAULT]/transport_url
|
password =
|
(String) DEPRECATED: Password for Redis server (optional). Replaced by [DEFAULT]/transport_url
|
port = 6379
|
(Port number) DEPRECATED: Use this port to connect to redis host. Replaced by [DEFAULT]/transport_url
|
sentinel_hosts =
|
(List) DEPRECATED: List of Redis Sentinel hosts (fault tolerance mode) e.g. [host:port, host1:port ... ] Replaced by [DEFAULT]/transport_url
|
socket_timeout = 10000
|
(Integer) Timeout in ms on blocking socket operations
|
wait_timeout = 2000
|
(Integer) Time in ms to wait between connection attempts.
|
|
Configuration option = Default value
|
Description
|
|---|---|
|
[DEFAULT]
| |
network_auto_schedule = True
|
(Boolean) Allow auto scheduling networks to DHCP agent.
|
network_scheduler_driver = neutron.scheduler.dhcp_agent_scheduler.WeightScheduler
|
(String) Driver to use for scheduling network to DHCP agent
|
router_auto_schedule = True
|
(Boolean) Allow auto scheduling of routers to L3 agent.
|
router_scheduler_driver = neutron.scheduler.l3_agent_scheduler.LeastRoutersScheduler
|
(String) Driver to use for scheduling router to a default L3 agent
|
|
Configuration option = Default value
|
Description
|
|---|---|
|
[SECURITYGROUP]
| |
enable_ipset = True
|
(Boolean) Use ipset to speed-up the iptables based security groups. Enabling ipset support requires that ipset is installed on L2 agent node.
|
enable_security_group = True
|
(Boolean) Controls whether the neutron security group API is enabled in the server. It should be false when using no security groups or using the nova security group API.
|
firewall_driver = None
|
(String) Driver for security groups firewall in the L2 agent
|
|
Configuration option = Default value
|
Description
|
|---|---|
|
[service_auth]
| |
admin_password = password
|
(String) The service admin password
|
admin_project_domain = admin
|
(String) The admin project domain name
|
admin_tenant_name = admin
|
(String) The service admin tenant name
|
admin_user = admin
|
(String) The service admin user name
|
admin_user_domain = admin
|
(String) The admin user domain name
|
auth_url = http://127.0.0.1:5000/v2.0
|
(String) Authentication endpoint
|
auth_version = 2
|
(String) The auth version used to authenticate
|
endpoint_type = public
|
(String) The endpoint_type to be used
|
insecure = False
|
(Boolean) Disable server certificate verification
|
region = RegionOne
|
(String) The deployment region
|
service_name = lbaas
|
(String) The name of the service
|
|
Configuration option = Default value
|
Description
|
|---|---|
|
[SRIOV_NIC]
| |
exclude_devices =
|
(List) Comma-separated list of <network_device>:<vfs_to_exclude> tuples, mapping network_device to the agent's node-specific list of virtual functions that should not be used for virtual networking. vfs_to_exclude is a semicolon-separated list of virtual functions to exclude from network_device. The network_device in the mapping should appear in the physical_device_mappings list.
|
physical_device_mappings =
|
(List) Comma-separated list of <physical_network>:<network_device> tuples mapping physical network names to the agent's node-specific physical network device interfaces of SR-IOV physical function to be used for VLAN networks. All physical networks listed in network_vlan_ranges on the server should have mappings to appropriate interfaces on each agent.
|
5.1.2. New, Updated, and Deprecated Options in Newton for Networking
|
Option = default value
|
(Type) Help string
|
|---|---|
[DEFAULT] cache_url =
|
(StrOpt) URL to connect to the cache back end. This option is deprecated in the Newton release and will be removed. Please add a [cache] group for oslo.cache in your neutron.conf and add "enable" and "backend" options in this section.
|
[AGENT] debug_iptables_rules = False
|
(BoolOpt) Duplicate every iptables difference calculation to ensure the format being generated matches the format of iptables-save. This option should not be turned on for production systems because it imposes a performance penalty.
|
[FDB] shared_physical_device_mappings =
|
(ListOpt) Comma-separated list of <physical_network>:<network_device> tuples mapping physical network names to the agent's node-specific shared physical network device between SR-IOV and OVS or SR-IOV and linux bridge
|
[cache] backend = dogpile.cache.null
|
(StrOpt) Dogpile.cache backend module. It is recommended that Memcache or Redis (dogpile.cache.redis) be used in production deployments. For eventlet-based or highly threaded servers, Memcache with pooling (oslo_cache.memcache_pool) is recommended. For low thread servers, dogpile.cache.memcached is recommended. Test environments with a single instance of the server can use the dogpile.cache.memory backend.
|
[cache] backend_argument = []
|
(MultiStrOpt) Arguments supplied to the backend module. Specify this option once per argument to be passed to the dogpile.cache backend. Example format: "<argname>:<value>".
|
[cache] config_prefix = cache.oslo
|
(StrOpt) Prefix for building the configuration dictionary for the cache region. This should not need to be changed unless there is another dogpile.cache region with the same configuration name.
|
[cache] debug_cache_backend = False
|
(BoolOpt) Extra debugging from the cache backend (cache keys, get/set/delete/etc calls). This is only really useful if you need to see the specific cache-backend get/set/delete calls with the keys/values. Typically this should be left set to false.
|
[cache] enabled = False
|
(BoolOpt) Global toggle for caching.
|
[cache] expiration_time = 600
|
(IntOpt) Default TTL, in seconds, for any cached item in the dogpile.cache region. This applies to any cached method that doesn't have an explicit cache expiration time defined for it.
|
[cache] memcache_dead_retry = 300
|
(IntOpt) Number of seconds memcached server is considered dead before it is tried again. (dogpile.cache.memcache and oslo_cache.memcache_pool backends only).
|
[cache] memcache_pool_connection_get_timeout = 10
|
(IntOpt) Number of seconds that an operation will wait to get a memcache client connection.
|
[cache] memcache_pool_maxsize = 10
|
(IntOpt) Max total number of open connections to every memcached server. (oslo_cache.memcache_pool backend only).
|
[cache] memcache_pool_unused_timeout = 60
|
(IntOpt) Number of seconds a connection to memcached is held unused in the pool before it is closed. (oslo_cache.memcache_pool backend only).
|
[cache] memcache_servers = localhost:11211
|
(ListOpt) Memcache servers in the format of "host:port". (dogpile.cache.memcache and oslo_cache.memcache_pool backends only).
|
[cache] memcache_socket_timeout = 3
|
(IntOpt) Timeout in seconds for every call to a server. (dogpile.cache.memcache and oslo_cache.memcache_pool backends only).
|
[cache] proxies =
|
(ListOpt) Proxy classes to import that will affect the way the dogpile.cache backend functions. See the dogpile.cache documentation on changing-backend-behavior.
|
[ml2] overlay_ip_version = 4
|
(IntOpt) IP version of all overlay (tunnel) network endpoints. Use a value of 4 for IPv4 or 6 for IPv6.
|
[profiler] connection_string = messaging://
|
(StrOpt) Connection string for a notifier backend. Default value is messaging:// which sets the notifier to oslo_messaging. Examples of possible values: * messaging://: use oslo_messaging driver for sending notifications.
|
[profiler] enabled = False
|
(BoolOpt) Enables the profiling for all services on this node. Default value is False (fully disable the profiling feature). Possible values: * True: Enables the feature * False: Disables the feature. The profiling cannot be started via this project operations. If the profiling is triggered by another project, this project part will be empty.
|
[profiler] hmac_keys = SECRET_KEY
|
(StrOpt) Secret key(s) to use for encrypting context data for performance profiling. This string value should have the following format: <key1>[,<key2>,...<keyn>], where each key is some random string. A user who triggers the profiling via the REST API has to set one of these keys in the headers of the REST API call to include profiling results of this node for this particular project. Both "enabled" flag and "hmac_keys" config options should be set to enable profiling. Also, to generate correct profiling information across all services at least one key needs to be consistent between OpenStack projects. This ensures it can be used from client side to generate the trace, containing information from all possible resources.
|
[profiler] trace_sqlalchemy = False
|
(BoolOpt) Enables SQL requests profiling in services. Default value is False (SQL requests won't be traced). Possible values: * True: Enables SQL requests profiling. Each SQL query will be part of the trace and can the be analyzed by how much time was spent for that. * False: Disables SQL requests profiling. The spent time is only shown on a higher level of operations. Single SQL queries cannot be analyzed this way.
|
|
Option
|
Previous default value
|
New default value
|
|---|---|---|
[DEFAULT] allow_pagination
| False
| True
|
[DEFAULT] allow_sorting
| False
| True
|
[DEFAULT] dnsmasq_dns_servers
| None
| |
[DEFAULT] external_network_bridge
| br-ex
| |
[DEFAULT] ipam_driver
| None
| internal
|
[OVS] of_interface
| ovs-ofctl
| native
|
[OVS] ovsdb_interface
| vsctl
| native
|
[ml2] path_mtu
| 1500
| 0
|
[ml2_sriov] supported_pci_vendor_devs
| 15b3:1004, 8086:10ca
| None
|
[ml2_type_geneve] max_header_size
| 50
| 30
|
|
Deprecated option
|
New Option
|
|---|---|
[DEFAULT] min_l3_agents_per_router
| None
|
[DEFAULT] use_syslog
| None
|
[ml2_sriov] supported_pci_vendor_devs
| None
|
