Overcloud parameters

AddVipsToEtcHosts

Set to true to append per network VIPs to /etc/hosts on each node. The default value is True.

AdminPassword

The password for the keystone admin account, used for monitoring, querying OpenStack Networking (neutron) etc.

CloudDomain

The DNS domain used for the hosts. This must match the overcloud_domain_name configured on the undercloud. The default value is localdomain.

CloudName

The DNS name of this cloud. The default value is overcloud.localdomain.

CloudNameCtlplane

The DNS name of this cloud’s control plane endpoint. The default value is overcloud.ctlplane.localdomain.

CloudNameInternal

The DNS name of this cloud’s internal API endpoint. The default value is overcloud.internalapi.localdomain.

CloudNameStorage

The DNS name of this cloud’s storage endpoint. For example, ci-overcloud.storage.tripleo.org. The default value is overcloud.storage.localdomain.

CloudNameStorageManagement

The DNS name of this cloud’s storage management endpoint. The default value is overcloud.storagemgmt.localdomain.

ControlFixedIPs

Defines a fixed VIP for the Control Plane. Value uses the following format: [{ip_address:'1.2.3.4'}]

ControlPlaneSubnet

The name of the undercloud OpenStack Networking (neutron) control plane subnet. The default value is ctlplane-subnet.

ControlPlaneSubnetCidr

The subnet CIDR of the control plane network. The parameter is automatically resolved from the ctlplane subnet’s cidr attribute.

DeployedServerPortMap

Used to assign fixed IPs from either the ctlplane network or the IP address range for the overcloud.

DeployIdentifier

Setting this to a unique value will re-run any deployment tasks that perform configuration on a OpenStack Orchestration (heat) stack-update.

DeploymentServerBlacklist

List of server hostnames to blocklist from any triggered deployments.

EndpointMapOverride

Can be used to override the calcluated EndpointMap.

ExternalVirtualFixedIPs

Control the IP allocation for the ExternalVirtualInterface port. For example, [{ip_address:'1.2.3.4'}].

ExtraConfig

Additional hiera configuration to inject into the cluster.

ExtraHostFileEntries

List of extra hosts entries to be appended to /etc/hosts.

GlobalConfigExtraMapData

Map of extra global_config_settings data to set on each node.

HypervisorNeutronPhysicalBridge

An Open vSwitch bridge to create on each hypervisor. This defaults to br-ex, which is the same as the control plane nodes. This ensures uniform configuration of the Open vSwitch agent. Typically should not need to be changed. The default value is br-ex.

HypervisorNeutronPublicInterface

What interface to add to the HypervisorNeutronPhysicalBridge. The default value is nic1.

InternalApiVirtualFixedIPs

Control the IP allocation for the InternalApiVirtualInterface port. Value uses the following format: [{ip_address:'1.2.3.4'}]

KeystoneRegion

OpenStack Identity (keystone) region for endpoint. The default value is regionOne.

NetConfigDataLookup

Configures os-net-config mappings for specific nodes if you are using pre-provisioned nodes. The configuration of the NetConfigDataLookup heat parameter is equivalent to the net_config_data_lookup property in your node definition file, overcloud-baremetal-deploy.yaml. If you are not using pre-provisioned nodes, you must configure the NIC mappings in your node definition file.

NetworkConfigWithAnsible

NetworkConfig with ansible flag. The default value is True.

NeutronControlPlaneID

ID or name for Control Plane ctlplane network. The default value is ctlplane.

NeutronPhysicalBridge

An OVS bridge to create for accessing external networks. The default value is br-ex.

NeutronPublicInterface

The interface to attach to the external bridge. The default value is nic1.

NodeCreateBatchSize

Maximum batch size for creating nodes. It is recommended to not exceed a batch size of 32 nodes. The default value is 30.

NovaAdditionalCell

Whether this is an cell additional to the default cell. The default value is false.

NovaLocalMetadataPerCell

Indicates that the nova-metadata API service has been deployed per-cell, so that we can have better performance and data isolation in a multi-cell deployment. Users should consider the use of this configuration depending on how OpenStack Networking (neutron) is setup. If networks span cells, you might need to run nova-metadata API service globally. If your networks are segmented along cell boundaries, then you can run nova-metadata API service per cell. When running nova-metadata API service per cell, you should also configure each OpenStack Networking (neutron) metadata-agent to point to the corresponding nova-metadata API service. The default value is false.

PublicVirtualFixedIPs

Control the IP allocation for the PublicVirtualInterface port. Value uses the following format: [{ip_address:'1.2.3.4'}]

RabbitCookieSalt

Salt for the RabbitMQ cookie. Change to force the randomly generated RabbitMQ cookie to change. The default value is unset.

RootStackName

The name of the stack/plan.

ServerMetadata

Extra properties or metadata passed to OpenStack Compute (nova) for the created nodes in the overcloud. Accessible through the OpenStack Compute (nova) metadata API.

StorageMgmtVirtualFixedIPs

Control the IP allocation for the StorageMgmgVirtualInterface port. Value uses the following format: [{ip_address:'1.2.3.4'}]

StorageVirtualFixedIPs

Control the IP allocation for the StorageVirtualInterface port. Value uses the following format: [{ip_address:'1.2.3.4'}]

UndercloudHostsEntries

List of undercloud hosts entries to be appended to /etc/hosts. The value is populated with the HEAT_HOSTS entries on the undercloud by tripleoclient when running deploy.

UpdateIdentifier

Set to a previously unused value during stack-update triggers package update on all nodes.

_ROLE_AnyErrorsFatal

Sets the any_errors_fatal value when running config-download Ansible playbooks. The default value is yes.

_ROLE_ControlPlaneSubnet

Name of the subnet on ctlplane network for this role. The default value is ctlplane-subnet.

_ROLE_Count

The number of nodes to deploy in a role. The default value is 1.

_ROLE_ExtraConfig

Role specific additional hiera configuration to inject into the cluster.

_ROLE_ExtraGroupVars

Optional extra Ansible group vars.

_ROLE_HostnameFormat

Format for node hostnames. Note that %index% is translated into the index of the node (e.g 0/1/2) and %stackname% is replaced with the stack name (e.g overcloud). The default value is %stackname%-_role_-%index%.

_ROLE_LocalMtu

MTU to use for the Undercloud local_interface. The default value is 1500.

_ROLE_MaxFailPercentage

Sets the max_fail_percentage value when running config-download Ansible playbooks. The default value is 0.

_ROLE_NetConfigOverride

Custom JSON data to be used to override the os-net-config config. This is meant to be used by net_config_override parameter in tripleoclient to provide an easy means to pass in custom net configs for the Undercloud.

_ROLE_NetworkConfigTemplate

ROLE NetworkConfig Template.

_ROLE_NetworkConfigUpdate

When set to "True", existing networks will be updated on the overcloud. This parameter replaces the functionality previously provided by NetworkDeploymentActions. Defaults to "False" so that only new nodes will have their networks configured. This is a role based parameter. The default value is False.

_ROLE_Parameters

Optional Role Specific parameters to be provided to service.

_ROLE_RemovalPolicies

List of resources to be removed from the role’s ResourceGroup when doing an update that requires removal of specific resources.

_ROLE_RemovalPoliciesMode

How to handle change to RemovalPolicies for ROLE ResourceGroup when doing an update. Default mode append will append to the existing blocklist and update would replace the blocklist. The default value is append.

_ROLE_SchedulerHints

Optional scheduler hints to pass to OpenStack Compute (nova).

_ROLE_ServiceNetMap

Role specific ServiceNetMap overrides, the map provided will be merged with the global ServiceNetMap when passing the ServiceNetMap to the ROLE_ServiceChain resource and the _ROLE resource group. For example: _ROLE_ServiceNetMap: NovaLibvirtNetwork: internal_api_leaf2.

_ROLE_Services

A list of service resources (configured in the OpenStack Orchestration (heat) resource_registry) which represent nested stacks for each service that should get installed on the ROLE role.

BarbicanDebug

Set to True to enable debugging OpenStack Key Manager (barbican) service. The default value is false.

CinderDebug

Set to True to enable debugging on OpenStack Block Storage (cinder) services. The default value is false.

ConfigDebug

Whether to run configuration management (e.g. Puppet) in debug mode. The default value is false.

Debug

Set to True to enable debugging on all services. The default value is false.

DesignateDebug

Set to True to enable debugging Designate services. The default value is false.

GlanceDebug

Set to True to enable debugging OpenStack Image Storage (glance) service. The default value is false.

HeatDebug

Set to True to enable debugging OpenStack Orchestration (heat) services. The default value is false.

HorizonDebug

Set to True to enable debugging OpenStack Dashboard (horizon) service. The default value is false.

IronicDebug

Set to True to enable debugging OpenStack Bare Metal (ironic) services. The default value is false.

KeystoneDebug

Set to True to enable debugging OpenStack Identity (keystone) service. The default value is false.

ManilaDebug

Set to True to enable debugging OpenStack Shared File Systems (manila) services. The default value is false.

MemcachedDebug

Set to True to enable debugging Memcached service. The default value is false.

NeutronDebug

Set to True to enable debugging OpenStack Networking (neutron) services. The default value is false.

NovaDebug

Set to True to enable debugging OpenStack Compute (nova) services. The default value is false.

OctaviaDebug

Set to True to enable debugging OpenStack Load Balancing-as-a-Service (octavia) services. The default value is false.

BridgeNfCallArpTables

Configures sysctl net.bridge.bridge-nf-call-arptables key. The default value is 1.

BridgeNfCallIp6Tables

Configures sysctl net.bridge.bridge-nf-call-ip6tables key. The default value is 1.

BridgeNfCallIpTables

Configures sysctl net.bridge.bridge-nf-call-iptables key. The default value is 1.

ExtraKernelModules

Hash of extra kernel modules to load.

ExtraKernelPackages

List of extra kernel related packages to install.

ExtraSysctlSettings

Hash of extra sysctl settings to apply.

FsAioMaxNumber

The kernel allocates aio memory on demand, and this number limits the number of parallel aio requests; the only drawback of a larger limit is that a malicious guest could issue parallel requests to cause the kernel to set aside memory. Set this number at least as large as 128 * (number of virtual disks on the host) Libvirt uses a default of 1M requests to allow 8k disks, with at most 64M of kernel memory if all disks hit an aio request at the same time. The default value is 0.

InotifyInstancesMax

Configures sysctl fs.inotify.max_user_instances key. The default value is 1024.

InotifyIntancesMax

Configures sysctl fs.inotify.max_user_instances key. The default value is 1024.

KernelDisableIPv6

Configures sysctl net.ipv6.{default/all}.disable_ipv6 keys. The default value is 0.

KernelIpForward

Configures net.ipv4.ip_forward key. The default value is 1.

KernelIpNonLocalBind

Configures net.ipv{4,6}.ip_nonlocal_bind key. The default value is 1.

KernelIpv4ConfAllRpFilter

Configures the net.ipv4.conf.all.rp_filter key. The default value is 1.

KernelIpv6ConfAllForwarding

Configures the net.ipv6.conf.all.forwarding key. The default value is 0.

KernelPidMax

Configures sysctl kernel.pid_max key. The default value is 1048576.

NeighbourGcThreshold1

Configures sysctl net.ipv4.neigh.default.gc_thresh1 value. This is the minimum number of entries to keep in the ARP cache. The garbage collector will not run if there are fewer than this number of entries in the cache. The default value is 1024.

NeighbourGcThreshold2

Configures sysctl net.ipv4.neigh.default.gc_thresh2 value. This is the soft maximum number of entries to keep in the ARP cache. The garbage collector will allow the number of entries to exceed this for 5 seconds before collection will be performed. The default value is 2048.

NeighbourGcThreshold3

Configures sysctl net.ipv4.neigh.default.gc_thresh3 value. This is the hard maximum number of entries to keep in the ARP cache. The garbage collector will always run if there are more than this number of entries in the cache. The default value is 4096.

DesignateBindQueryLogging

Set to true to enable logging of queries on BIND. The default value is false.

DesignateManagedResourceEmail

Configure email address to be set in zone SOAs. Leaving unset results in service defaults being used.

DesignateMdnsProxyBasePort

Configure the base port for the MiniDNS proxy endpoints on the external/public access network. The default value is 16000.

DesignateMinTTL

Configure the minimum allowable TTL in seconds. The default value is 0 which leaves the parameter unset. The default value is 0.

DesignateWorkers

Number of workers for Designate services. The default value is 0.

UnboundAllowedCIDRs

A list of CIDRs allowed to make queries through Unbound. Example, [192.0.2.0/24, 198.51.100.0/24].

UnboundAllowRecursion

When false, Unbound will not attempt to recursively resolve the request. It will only answer for queries using local information. The default value is true.

UnboundDesignateIntegration

Set to false to disable configuring neutron using the deployed unbound server as the default resolver. The default value is true.

UnboundForwardFallback

When true, if the forwarded query receives a SERVFAIL, Unbound will process the request as a standard recursive resolution. The default value is true.

UnboundForwardResolvers

A list of DNS resolver IP addresses, with optional port, that Unbound will forward resolution requests to if Unbound does not have the answer. Example, [192.0.2.10, 192.0.2.20@53].

UnboundLogQueries

If true, Unbound will log the query requests. The default value is false.

UnboundSecurityHarden

When true, Unbound will block certain queries that could have security implications to the Unbound service. The default value is true.

AdditionalArchitectures

List of additional architectures to enable.

ApacheCertificateKeySize

Override the private key size used when creating the certificate for this service.

ApacheTimeout

The timeout in seconds for Apache, which defines duration Apache waits for I/O operations. The default value is 90.

CertificateKeySize

Specifies the private key size used when creating the certificate. The default value is 2048.

EnableSQLAlchemyCollectd

Set to true to enable the SQLAlchemy-collectd server plugin. The default value is false.

IPAImageURLs

IPA image URLs, the format should be ["http://path/to/kernel", "http://path/to/ramdisk"].

IronicAutomatedClean

Enables or disables automated cleaning. Disabling automated cleaning might result in security problems and deployment failures on rebuilds. Do not set to False unless you understand the consequences of disabling this feature. The default value is true.

IronicCleaningDiskErase

Type of disk cleaning before and between deployments. full for full cleaning. metadata to clean only disk metadata (partition table). The default value is full.

IronicCleaningNetwork

Name or UUID of the overcloud network used for cleaning bare metal nodes. Set to provisioning during the initial deployment (when no networks are created yet) and change to an actual UUID in a post-deployment stack update. The default value is provisioning.

IronicConductorGroup

The name of an OpenStack Bare Metal (ironic) Conductor Group.

IronicConfigureSwiftTempUrlKey

Whether to configure Swift temporary URLs for use with the "direct" and "ansible" deploy interfaces. The default value is true.

IronicCorsAllowedOrigin

Indicate whether this resource may be shared with the domain received in the request "origin" header.

IronicDefaultBootInterface

Boot interface implementation to use by default. Leave empty to set none. This may not work if a hardware type does not support the set boot interface. This overrides create-time defaults. The ordered union of the enabled boot interfaces and hardware type determines, under normal circumstances, what the default will be.

IronicDefaultBootMode

Default boot mode to use when no boot mode is explicitly requested in node’s driver_info, capabilities or in the "instance_info" configuration. One of bios or uefi. The default value is uefi.

IronicDefaultBootOption

How to boot the bare metal instances. Set to local to use local bootloader (requires grub2 for partition images). Set to netboot to make the instances boot from controllers using PXE/iPXE. The default value is local.

IronicDefaultDeployInterface

Deploy interface implementation to use by default. Leave empty to use the hardware type default.

IronicDefaultInspectInterface

Inspect interface implementation to use by default. Leave empty to use the hardware type default.

IronicDefaultNetworkInterface

Network interface implementation to use by default. Set to flat to use one flat provider network. Set to neutron to make OpenStack Bare Metal (ironic) interact with the OpenStack Networking (neutron) ML2 driver to enable other network types and certain advanced networking features. Requires IronicProvisioningNetwork to be correctly set. The default value is flat.

IronicDefaultRescueInterface

Default rescue implementation to use. The "agent" rescue requires a compatible ramdisk to be used. The default value is agent.

IronicDefaultResourceClass

Default resource class to use for new nodes.

IronicDeployLogsStorageBackend

Backend to use to store ramdisk logs, either "local" or "swift". The default value is local.

IronicDhcpv6StatefulAddressCount

Number of IPv6 addresses to allocate for ports created for provisioning, cleaning, rescue or inspection on DHCPv6-stateful networks. Different stages of the chain-loading process will request addresses with different CLID/IAID. Due to non- identical identifiers multiple addresses must be reserved for the host to ensure each step of the boot process can successfully lease addresses. The default value is 4.

IronicEnabledBiosInterfaces

Enabled BIOS interface implementations. Each hardware type must have at least one valid implementation enabled. The default value is ['no-bios'].

IronicEnabledBootInterfaces

Enabled boot interface implementations. Each hardware type must have at least one valid implementation enabled. The default value is ['ipxe', 'pxe'].

IronicEnabledConsoleInterfaces

Enabled console interface implementations. Each hardware type must have at least one valid implementation enabled. The default value is ['ipmitool-socat', 'no-console'].

IronicEnabledDeployInterfaces

Enabled deploy interface implementations. Each hardware type must have at least one valid implementation enabled. The default value is ['direct'].

IronicEnabledHardwareTypes

Enabled OpenStack Bare Metal (ironic) hardware types. The default value is ['ipmi', 'redfish'].

IronicEnabledInspectInterfaces

Enabled inspect interface implementations. Each hardware type must have at least one valid implementation enabled. The default value is ['no-inspect'].

IronicEnabledManagementInterfaces

Enabled management interface implementations. Each hardware type must have at least one valid implementation enabled. The default value is ['ipmitool', 'noop', 'redfish'].

IronicEnabledNetworkInterfaces

Enabled network interface implementations. Each hardware type must have at least one valid implementation enabled. The default value is ['flat', 'neutron'].

IronicEnabledPowerInterfaces

Enabled power interface implementations. Each hardware type must have at least one valid implementation enabled. The default value is ['ipmitool', 'redfish'].

IronicEnabledRaidInterfaces

Enabled RAID interface implementations. Each hardware type must have at least one valid implementation enabled. The default value is ['no-raid', 'agent'].

IronicEnabledRescueInterfaces

Enabled rescue interface implementations. Each hardware type must have at least one valid implementation enabled. The default value is ['no-rescue', 'agent'].

IronicEnabledStorageInterfaces

Enabled storage interface implementations. Each hardware type must have at least one valid implementation enabled. The default value is ['cinder', 'noop'].

IronicEnabledVendorInterfaces

Enabled vendor interface implementations. Each hardware type must have at least one valid implementation enabled. The default value is ['ipmitool', 'no-vendor'].

IronicEnableNovaPowerNotifications

Enable/Disable the support for power state change callbacks to nova. The default value is true.

IronicEnableStagingDrivers

Whether to enable use of staging drivers. The default value is false.

IronicForcePowerStateDuringSync

Whether to force power state during sync. The default value is true.

IronicImageDownloadSource

Image delivery method for the "direct" deploy interface. Use "swift" for the Object Storage temporary URLs, use "http" for the local HTTP server (the same as for iPXE). The default value is http.

IronicInspectorCollectors

Comma-separated list of IPA inspection collectors. The default value is default,logs.

IronicInspectorDiscoveryDefaultDriver

The default driver to use for newly discovered nodes (requires IronicInspectorEnableNodeDiscovery set to True). This driver is automatically added to enabled_drivers. The default value is ipmi.

IronicInspectorEnableNodeDiscovery

Makes ironic-inspector enroll any unknown node that PXE-boots introspection ramdisk in OpenStack Bare Metal (ironic). The default driver to use for new nodes is specified by the IronicInspectorDiscoveryDefaultDriver parameter. Introspection rules can also be used to specify it. The default value is false.

IronicInspectorExtraProcessingHooks

Comma-separated list of processing hooks to append to the default list. The default value is extra_hardware,lldp_basic,local_link_connection,physnet_cidr_map.

IronicInspectorInterface

Network interface on which inspection dnsmasq will listen. The default value is br-ex.

IronicInspectorIpRange

Temporary IP range that will be given to nodes during the inspection process. This should not overlap with any range that OpenStack Networking (neutron) DHCP allocates, but it has to be routeable back to ironic-inspector. This option has no meaningful defaults, and thus is required.

IronicInspectorIPXEEnabled

Whether to use iPXE for inspection. The default value is true.

IronicInspectorKernelArgs

Kernel args for the OpenStack Bare Metal (ironic) inspector. The default value is ipa-inspection-dhcp-all-interfaces=1 ipa-collect-lldp=1 ipa-debug=1.

IronicInspectorStorageBackend

Storage backend for storing introspection data. The default value is none.

IronicInspectorSubnets

Temporary IP ranges that will be given to nodes during the inspection process. These ranges should not overlap with any range that OpenStack Networking (neutron) DHCP provides, but they need to be routeable back to the ironic-inspector API. This option has no meaningful defaults and is required.

IronicInspectorUseSwift

DEPRECATED: Use IronicInspectorStorageBackend instead. Whether to use Swift for storing introspection data. The default value is true.

IronicIpVersion

The IP version that will be used for PXE booting. The default value is 4.

IronicIPXEEnabled

Whether to use iPXE instead of PXE for deployment. The default value is true.

IronicIPXEPort

Port to use for serving images when iPXE is used. The default value is 8088.

IronicIPXETimeout

IPXE timeout in second. Set to 0 for infinite timeout. The default value is 60.

IronicIPXEUefiSnpOnly

Whether to use SNP (Simple Network Protocol) iPXE EFI, or not. When set to true ipxe-snponly EFI is used. The default value is true.

IronicPassword

The password for the Bare Metal service and database account.

IronicPowerStateChangeTimeout

Number of seconds to wait for power operations to complete, i.e., so that a baremetal node is in the desired power state. If timed out, the power operation is considered a failure. The default value is 60.

IronicProvisioningNetwork

Name or UUID of the overcloud network used for provisioning of bare metal nodes if IronicDefaultNetworkInterface is set to neutron. Set to provisioning during the initial deployment (when no networks are created yet) and change to an actual UUID in a post-deployment stack update. The default value is provisioning.

IronicRescuingNetwork

Name or UUID of the overcloud network used for rescuing of bare metal nodes, if IronicDefaultRescueInterface is not set to "no-rescue". The default value of "provisioning" can be left during the initial deployment (when no networks are created yet) and should be changed to an actual UUID in a post-deployment stack update. The default value is provisioning.

IronicRpcTransport

The remote procedure call transport between conductor and API processes, such as a messaging broker or JSON RPC.

MemcacheUseAdvancedPool

Use the advanced (eventlet safe) memcached client pool. The default value is true.

PortPhysnetCidrMap

Mapping of IP subnet CIDR to physical network. When the physnet_cidr_map processing hook is enabled the physical_network property of baremetal ports is populated based on this mapping. Example: PortPhysnetCidrMap: 10.10.10.0/24: physnet_a 2001:db8::/64: physnet_b.

ApacheCertificateKeySize

Override the private key size used when creating the certificate for this service.

ApacheTimeout

The timeout in seconds for Apache, which defines duration Apache waits for I/O operations. The default value is 90.

AuthCloudName

Entry in clouds.yaml to use for authentication.

CephClusterFSID

The Ceph cluster FSID. Must be a UUID.

CephClusterName

The Ceph cluster name. The default value is ceph.

CephConfigPath

The path where the Ceph Cluster configuration files are stored on the host. The default value is /var/lib/tripleo-config/ceph.

CephExternalMultiConfig

List of maps describing extra overrides which will be applied when configuring extra external Ceph clusters. If this list is non-empty, ceph-ansible will run an extra count(list) times using the same parameters as the first run except each parameter within each map will override the defaults. If the following were used, the second run would configure the overcloud to also use the ceph2 cluster with all the previous parameters except /etc/ceph/ceph2.conf would have a mon_host entry containing the value of external_cluster_mon_ips below, and not the default CephExternalMonHost. Subsequent ceph-ansible runs are restricted to just ceph clients. CephExternalMultiConfig may not be used to deploy additional internal Ceph clusters within one OpenStack Orchestration (heat) stack. The map for each list should contain not tripleo-heat-template parameters but ceph-ansible parameters. - cluster: ceph2 fsid: e2cba068-5f14-4b0f-b047-acf375c0004a external_cluster_mon_ips: 172.18.0.5,172.18.0.6,172.18.0.7 keys: - name: "client.openstack" caps: mgr: "allow *" mon: "profile rbd" osd: "osd: profile rbd pool=volumes, profile rbd pool=backups, profile rbd pool=vms, profile rbd pool=images" key: "AQCwmeRcAAAAABAA6SQU/bGqFjlfLro5KxrB1Q==" mode: "0600" dashboard_enabled: false.

CertificateKeySize

Specifies the private key size used when creating the certificate. The default value is 2048.

CinderApiWsgiTimeout

The number of seconds until a OpenStack Block Storage (cinder) API WSGI connection times out. The default value is 60.

CinderBackupOptVolumes

List of optional volumes to be mounted.

CinderCronDbPurgeAge

Cron to purge database entries marked as deleted and older than $age - Age. The default value is 30.

CinderCronDbPurgeDestination

Cron to purge database entries marked as deleted and older than $age - Log destination. The default value is /var/log/cinder/cinder-rowsflush.log.

CinderCronDbPurgeHour

Cron to purge database entries marked as deleted and older than $age - Hour. The default value is 0.

CinderCronDbPurgeMaxDelay

Cron to purge database entries marked as deleted and older than $age - Max Delay. The default value is 3600.

CinderCronDbPurgeMinute

Cron to purge database entries marked as deleted and older than $age - Minute. The default value is 1.

CinderCronDbPurgeMonth

Cron to purge database entries marked as deleted and older than $age - Month. The default value is *.

CinderCronDbPurgeMonthday

Cron to purge database entries marked as deleted and older than $age - Month Day. The default value is *.

CinderCronDbPurgeUser

Cron to purge database entries marked as deleted and older than $age - User. The default value is cinder.

CinderCronDbPurgeWeekday

Cron to purge database entries marked as deleted and older than $age - Week Day. The default value is *.

CinderDefaultVolumeType

The name of the OpenStack Block Storage (cinder) default volume type. The default value is tripleo.

CinderEnableDBPurge

Whether to create cron job for purging soft deleted rows in OpenStack Block Storage (cinder) database. The default value is true.

CinderEnableIscsiBackend

Whether to enable or not the Iscsi backend for OpenStack Block Storage (cinder). The default value is true.

CinderEnableNfsBackend

Whether to enable or not the NFS backend for OpenStack Block Storage (cinder). The default value is false.

CinderEnableNVMeOFBackend

Whether to enable or not the NVMeOF backend for OpenStack Block Storage (cinder). The default value is false.

CinderEnableRbdBackend

Whether to enable or not the Rbd backend for OpenStack Block Storage (cinder). The default value is false.

CinderEtcdLocalConnect

When running OpenStack Block Storage (cinder) A/A, whether to connect to Etcd via the local IP for the Etcd network. If set to true, the ip on the local node will be used. If set to false, the VIP on the Etcd network will be used instead. Defaults to false. The default value is false.

CinderImageConversionNfsOptions

NFS mount options when using an NFS share for the OpenStack Block Storage (cinder) image conversion directory. The default value is _netdev,bg,intr,context=system_u:object_r:container_file_t:s0.

CinderImageConversionNfsShare

When set, the NFS share to be used for the OpenStack Block Storage (cinder) image conversion directory.

CinderISCSIAvailabilityZone

The availability zone of the Iscsi OpenStack Block Storage (cinder) backend. When set, it overrides the default CinderStorageAvailabilityZone.

CinderISCSIHelper

The iSCSI helper to use with cinder. The default value is lioadm.

CinderISCSIProtocol

Whether to use TCP (iscsi) or iSER RDMA (iser) for iSCSI. The default value is iscsi.

CinderLVMConfigureVG

Whether to configure the cinder-volumes VG used by the LVM driver. When disabled (set to False), the LVM driver will work as long as the cinder-volumes VG has been created through some other means. The default value is true.

CinderLVMLoopDeviceSize

The size of the loopback file used by the cinder LVM driver. The default value is 10280.

CinderNasSecureFileOperations

Controls whether security enhanced NFS file operations are enabled. Valid values are auto, true or false. Effective when CinderEnableNfsBackend is true. The default value is false.

CinderNasSecureFilePermissions

Controls whether security enhanced NFS file permissions are enabled. Valid values are auto, true or false. Effective when CinderEnableNfsBackend is true. The default value is false.

CinderNfsAvailabilityZone

The availability zone of the NFS OpenStack Block Storage (cinder) backend. When set, it overrides the default CinderStorageAvailabilityZone.

CinderNfsMountOptions

Mount options for NFS mounts used by OpenStack Block Storage (cinder) NFS backend. Effective when CinderEnableNfsBackend is true. The default value is context=system_u:object_r:container_file_t:s0.

CinderNfsServers

NFS servers used by OpenStack Block Storage (cinder) NFS backend. Effective when CinderEnableNfsBackend is true.

CinderNfsSnapshotSupport

Whether to enable support for snapshots in the NFS driver. Effective when CinderEnableNfsBackend is true. The default value is false.

CinderNVMeOFAvailabilityZone

The availability zone of the NVMeOF OpenStack Block Storage (cinder) backend. When set, it overrides the default CinderStorageAvailabilityZone.

CinderNVMeOFTargetProtocol

The target protocol, supported values are nvmet_rdma and nvmet_tcp. The default value is nvmet_rdma.

CinderPassword

The password for the cinder service and database account.

CinderRbdAvailabilityZone

The availability zone of the RBD OpenStack Block Storage (cinder) backend. When set, it overrides the default CinderStorageAvailabilityZone.

CinderRbdBackendName

A list of OpenStack Block Storage (cinder) RBD backend names. The default value is tripleo_ceph.

CinderRbdExtraPools

List of extra Ceph pools for use with RBD backends for OpenStack Block Storage (cinder). An extra OpenStack Block Storage (cinder) RBD backend driver is created for each pool in the list. This is in addition to the standard RBD backend driver associated with the CinderRbdPoolName.

CinderRbdFlattenVolumeFromSnapshot

Whether RBD volumes created from a snapshot should be flattened in order to remove a dependency on the snapshot. The default value is false.

CinderRbdMultiConfig

Dictionary of settings when configuring multiple RBD backends. The hash key is the backend name, and the value is a dictionary of parameter values unique to that backend. The following parameters are required, and must match the corresponding value defined in CephExternalMultiConfig. CephClusterName (must match the CephExternalMultiConfig entry’s cluster) CephClusterFSID (must match the CephExternalMultiConfig entry’s fsid) The following parameters are optional, and override the corresponding parameter’s default value. CephClientUserName CinderRbdPoolName CinderRbdExtraPools CinderRbdAvailabilityZone CinderRbdFlattenVolumeFromSnapshot.

CinderRbdPoolName

The Ceph pool to use for cinder volumes. The default value is volumes.

CinderRpcResponseTimeout

Cinder’s RPC response timeout, in seconds. The default value is 60.

CinderStorageAvailabilityZone

The OpenStack Block Storage (cinder) service’s storage availability zone. The default value is nova.

CinderVolumeCluster

The cluster name used for deploying the cinder-volume service in an active-active (A/A) configuration. This configuration requires the OpenStack Block Storage (cinder) backend drivers support A/A, and the cinder-volume service not be managed by pacemaker. If these criteria are not met then the cluster name must be left blank.

CinderVolumeOptEnvVars

Hash of optional environment variables.

CinderVolumeOptVolumes

List of optional volumes to be mounted.

CinderWorkers

Set the number of workers for the block storage service. Note that more workers creates a larger number of processes on systems, which results in excess memory consumption. It is recommended to choose a suitable non-default value on systems with high CPU core counts. 0 sets to the OpenStack internal default, which is equal to the number of CPU cores on the node. The default value is equal to the number of vCPU cores on the physical node.

ClusterCommonTag

When set to false, a pacemaker service is configured to use a floating tag for its container image name, e.g. REGISTRY/NAMESPACE/IMAGENAME:pcmklatest. When set to true, the service uses a floating prefix as well, e.g. cluster.common.tag/IMAGENAME:pcmklatest. The default value is false.

ClusterFullTag

When set to true, the pacemaker service uses a fully constant tag for its container image name, e.g. cluster.common.tag/SERVICENAME:pcmklatest. The default value is true.

DockerCinderVolumeUlimit

Ulimit for OpenStack Block Storage (cinder) Volume Container. The default value is ['nofile=131072'].

EnableEtcdInternalTLS

Controls whether etcd and the cinder-volume service use TLS for cinder’s lock manager, even when the rest of the internal API network is using TLS. The default value is true.

EnableSQLAlchemyCollectd

Set to true to enable the SQLAlchemy-collectd server plugin. The default value is false.

MemcacheUseAdvancedPool

Use the advanced (eventlet safe) memcached client pool. The default value is true.

MultipathdEnable

Whether to enable the multipath daemon. The default value is false.

NotificationDriver

Driver or drivers to handle sending notifications. The default value is noop.

CephAnsibleDisksConfig

Disks configuration settings. The default value is {'devices': [], 'osd_scenario': 'lvm', 'osd_objectstore': 'bluestore'}.

CephAnsibleEnvironmentVariables

Mapping of Ansible environment variables to override defaults.

CephAnsibleExtraConfig

Extra vars for the ceph-ansible playbook.

CephAnsiblePlaybook

List of paths to the ceph-ansible playbooks to execute. If not specified, the playbook will be determined automatically depending on type of operation being performed (deploy/update/upgrade). The default value is ['default'].

CephAnsiblePlaybookVerbosity

The number of -v, -vv, etc. passed to ansible-playbook command. The default value is 1.

CephAnsibleRepo

The repository that should be used to install the right ceph-ansible package. This value can be used by tripleo-validations to double check the right ceph-ansible version is installed. The default value is centos-ceph-nautilus.

CephAnsibleSkipClient

This boolean (when true) prevents the ceph-ansible client role execution by adding the ceph-ansible tag ceph_client to the --skip-tags list. The default value is true.

CephAnsibleSkipTags

List of ceph-ansible tags to skip. The default value is package-install,with_pkg.

CephAnsibleWarning

In particular scenarios we want this validation to show the warning but don’t fail because the package is installed on the system but repos are disabled. The default value is true.

CephCertificateKeySize

Override the private key size used when creating the certificate for this service.

CephClientKey

The Ceph client key. Currently only used for external Ceph deployments to create the openstack user keyring. Can be created with: ceph-authtool --gen-print-key

CephClusterFSID

The Ceph cluster FSID. Must be a UUID.

CephClusterName

The Ceph cluster name. The default value is ceph.

CephConfigOverrides

Extra configuration settings to dump into ceph.conf.

CephConfigPath

The path where the Ceph Cluster configuration files are stored on the host. The default value is /var/lib/tripleo-config/ceph.

CephDashboardAdminPassword

Admin password for the dashboard component.

CephDashboardAdminRO

Parameter used to set a read-only admin user. The default value is true.

CephDashboardAdminUser

Admin user for the dashboard component. The default value is admin.

CephDashboardPort

Parameter that defines the ceph dashboard port. The default value is 8444.

CephEnableDashboard

Parameter used to trigger the dashboard deployment. The default value is false.

CephExternalMonHost

List of externally managed Ceph Mon Host IPs. Only used for external Ceph deployments.

CephExternalMultiConfig

List of maps describing extra overrides which will be applied when configuring extra external Ceph clusters. If this list is non-empty, ceph-ansible will run an extra count(list) times using the same parameters as the first run except each parameter within each map will override the defaults. If the following were used, the second run would configure the overcloud to also use the ceph2 cluster with all the previous parameters except /etc/ceph/ceph2.conf would have a mon_host entry containing the value of external_cluster_mon_ips below, and not the default CephExternalMonHost. Subsequent ceph-ansible runs are restricted to just ceph clients. CephExternalMultiConfig may not be used to deploy additional internal Ceph clusters within one OpenStack Orchestration (heat) stack. The map for each list should contain not tripleo-heat-template parameters but ceph-ansible parameters. - cluster: ceph2 fsid: e2cba068-5f14-4b0f-b047-acf375c0004a external_cluster_mon_ips: 172.18.0.5,172.18.0.6,172.18.0.7 keys: - name: "client.openstack" caps: mgr: "allow *" mon: "profile rbd" osd: "osd: profile rbd pool=volumes, profile rbd pool=backups, profile rbd pool=vms, profile rbd pool=images" key: "AQCwmeRcAAAAABAA6SQU/bGqFjlfLro5KxrB1Q==" mode: "0600" dashboard_enabled: false.

CephExtraKeys

List of maps describing extra keys which will be created on the deployed Ceph cluster. Uses ceph-ansible/library/ceph_key.py ansible module. Each item in the list must be in the following example format - name: "client.glance" caps: mgr: "allow *" mon: "profile rbd" osd: "profile rbd pool=images" key: "AQBRgQ9eAAAAABAAv84zEilJYZPNuJ0Iwn9Ndg==" mode: "0600".

CephGrafanaAdminPassword

Admin password for grafana component.

CephIPv6

Enables Ceph daemons to bind to IPv6 addresses. The default value is False.

CephManilaClientKey

The Ceph client key. Can be created with: ceph-authtool --gen-print-key

CephMsgrSecureMode

Enable Ceph msgr2 secure mode to enable on-wire encryption between Ceph daemons and also between Ceph clients and daemons. The default value is false.

CephOsdPercentageMin

The minimum percentage of Ceph OSDs which must be running and in the Ceph cluster, according to ceph osd stat, for the deployment not to fail. Used to catch deployment errors early. Set this value to 0 to disable this check. Deprecated in Wallaby because of the move from ceph-ansible to cephadm; the later only brings up OSDs out of band and deployment does not block while waiting for them to come up, thus we cannot do this anymore. The default value is 0.

CephPoolDefaultPgNum

Default placement group size to use for the RBD pools. The default value is 16.

CephPoolDefaultSize

Default minimum replication for RBD copies. The default value is 3.

CephPools

Override settings for one of the predefined pools or to create additional ones. Example: { "volumes": { "size": 5, "pg_num": 128, "pgp_num": 128 } }

CephRbdMirrorConfigure

Perform mirror configuration between local and remote pool. The default value is true.

CephRbdMirrorCopyAdminKey

Copy the admin key to all nodes. The default value is false.

CephRbdMirrorPool

Name of the local pool to mirror to remote cluster.

CephRbdMirrorRemoteCluster

The name given to the remote Ceph cluster from the local cluster. Keys reside in the /etc/ceph directory. The default value is not-ceph.

CephRbdMirrorRemoteUser

The rbd-mirror daemon needs a user to authenticate with the remote cluster. By default, this key should be available under /etc/ceph/<remote_cluster>.client.<remote_user>.keyring.

CephRgwCertificateKeySize

Override the private key size used when creating the certificate for this service.

CephRgwClientName

The client name for the RADOSGW service." The default value is radosgw.

CephRgwKey

The cephx key for the RADOSGW client. Can be created with ceph-authtool --gen-print-key.

CephValidationDelay

Interval (in seconds) in between validation checks. The default value is 30.

CephValidationRetries

Number of retry attempts for Ceph validation. The default value is 40.

CertificateKeySize

Specifies the private key size used when creating the certificate. The default value is 2048.

CinderBackupBackend

The short name of the OpenStack Block Storage (cinder) Backup backend to use. The default value is swift.

CinderBackupRbdPoolName

Pool to use if Block Storage (cinder) Backup is enabled. The default value is backups.

CinderEnableRbdBackend

Whether to enable or not the Rbd backend for OpenStack Block Storage (cinder). The default value is false.

CinderRbdExtraPools

List of extra Ceph pools for use with RBD backends for OpenStack Block Storage (cinder). An extra OpenStack Block Storage (cinder) RBD backend driver is created for each pool in the list. This is in addition to the standard RBD backend driver associated with the CinderRbdPoolName.

CinderRbdPoolName

Pool to use for Block Storage (cinder) service. The default value is volumes.

DeploymentServerBlacklist

List of server hostnames to blocklist from any triggered deployments.

GlanceBackend

The short name of the OpenStack Image Storage (glance) backend to use. Set to rbd to use Ceph Storage.` The default value is swift.

GlanceMultistoreConfig

Dictionary of settings when configuring additional glance backends. The hash key is the backend ID, and the value is a dictionary of parameter values unique to that backend. Multiple rbd and cinder backends are allowed, but file and swift backends are limited to one each. Example: # Default glance store is rbd. GlanceBackend: rbd GlanceStoreDescription: Default rbd store # GlanceMultistoreConfig specifies a second rbd backend, plus a cinder # backend. GlanceMultistoreConfig: rbd2_store: GlanceBackend: rbd GlanceStoreDescription: Second rbd store CephClusterName: ceph2 # Override CephClientUserName if this cluster uses a different # client name. CephClientUserName: client2 cinder1_store: GlanceBackend: cinder GlanceCinderVolumeType: volume-type-1 GlanceStoreDescription: First cinder store cinder2_store: GlanceBackend: cinder GlanceCinderVolumeType: volume-type-2 GlanceStoreDescription: Seconde cinder store.

GlanceRbdPoolName

Pool to use for Image Storage (glance) service. The default value is images.

GnocchiBackend

The short name of the OpenStack Telemetry Metrics (gnocchi) backend to use. Should be one of swift, rbd, file or s3. The default value is swift.

GnocchiRbdPoolName

Pool to use for Telemetry storage. The default value is metrics.

LocalCephAnsibleFetchDirectoryBackup

Filesystem path on undercloud to persist a copy of the data from the ceph-ansible fetch directory. Used as an alternative to backing up the fetch_directory in Swift. Path must be writable and readable by the user running ansible from config-download, e.g. the mistral user in the mistral-executor container is able to read/write to /var/lib/mistral/ceph_fetch.

ManilaCephFSCephFSAuthId

The CephFS user ID for Shared Filesystem Service (manila). The default value is manila.

ManilaCephFSDataPoolName

Pool to use for file share storage. The default value is manila_data.

ManilaCephFSMetadataPoolName

Pool to use for file share metadata storage. The default value is manila_metadata.

ManilaCephFSShareBackendName

Backend name of the CephFS share for file share storage. The default value is cephfs.

NodeExporterContainerImage

Ceph NodeExporter container image.

NovaEnableRbdBackend

Whether to enable the Ceph backend for Compute (nova). The default value is false.

NovaRbdPoolName

Pool to use for Compute storage. The default value is vms.

ApacheCertificateKeySize

Override the private key size used when creating the certificate for this service.

ApacheTimeout

The timeout in seconds for Apache, which defines duration Apache waits for I/O operations. The default value is 90.

AuthCloudName

Entry in clouds.yaml to use for authentication.

CertificateKeySize

Specifies the private key size used when creating the certificate. The default value is 2048.

ContainerNovaLibvirtPidsLimit

Tune nova_libvirt container PID limit (set to 0 for unlimited) (defaults to 65536). The default value is 65536.

ContainerNovaLibvirtUlimit

Ulimit for OpenStack Compute (nova) Libvirt Container. The default value is ['nofile=131072', 'nproc=126960'].

CustomProviderInventories

Array of hashes describing the custom providers for the compute role. Format: name/uuid - Resource providers to target can be identified by either UUID or name. In addition, the value $COMPUTE_NODE can be used in the UUID field to identify all nodes managed by the service. Exactly one of uuid or name is mandatory. If neither uuid or name is provided, the special uuid $COMPUTE_NODE gets set in the template.

inventories - (Optional) Hash of custom provider inventories. total is a mandatory property. Any other optional properties not populated will be given a default value by placement. If overriding a pre-existing provider values will not be preserved from the existing inventory.

traits - (Optional) Array of additional traits. Example: ComputeParameters: CustomProviderInventories: - uuid: $COMPUTE_NODE inventories: CUSTOM_EXAMPLE_RESOURCE_CLASS: total: 100 reserved: 0 min_unit: 1 max_unit: 10 step_size: 1 allocation_ratio: 1.0 CUSTOM_ANOTHER_EXAMPLE_RESOURCE_CLASS: total: 100 traits: - CUSTOM_P_STATE_ENABLED - CUSTOM_C_STATE_ENABLED.

DockerNovaComputeUlimit

Ulimit for OpenStack Compute (nova) Compute Container. The default value is ['nofile=131072', 'memlock=67108864'].

DockerNovaMigrationSshdPort

Port that dockerized nova migration target sshd service binds to. The default value is 2022.

EnableCache

Enable caching with memcached. The default value is true.

EnableConfigPurge

Remove configuration that is not generated by the director. Used to avoid configuration remnants after upgrades. The default value is false.

EnableInstanceHA

Whether to enable an Instance Ha configurarion or not. This setup requires the Compute role to have the PacemakerRemote service added to it. The default value is false.

EnableSQLAlchemyCollectd

Set to true to enable the SQLAlchemy-collectd server plugin. The default value is false.

EnforceSecureRbac

Setting this option to True will configure each OpenStack service to enforce Secure RBAC by setting [oslo_policy] enforce_new_defaults and [oslo_policy] enforce_scope to True. This introduces a consistent set of RBAC personas across OpenStack services that include support for system and project scope, as well as keystone’s default roles, admin, member, and reader. Do not enable this functionality until all services in your deployment actually support secure RBAC. The default value is false.

GlanceBackendID

The default backend’s identifier. The default value is default_backend.

GlanceMultistoreConfig

Dictionary of settings when configuring additional glance backends. The hash key is the backend ID, and the value is a dictionary of parameter values unique to that backend. Multiple rbd and cinder backends are allowed, but file and swift backends are limited to one each. Example: # Default glance store is rbd. GlanceBackend: rbd GlanceStoreDescription: Default rbd store # GlanceMultistoreConfig specifies a second rbd backend, plus a cinder # backend. GlanceMultistoreConfig: rbd2_store: GlanceBackend: rbd GlanceStoreDescription: Second rbd store CephClusterName: ceph2 # Override CephClientUserName if this cluster uses a different # client name. CephClientUserName: client2 cinder1_store: GlanceBackend: cinder GlanceCinderVolumeType: volume-type-1 GlanceStoreDescription: First cinder store cinder2_store: GlanceBackend: cinder GlanceCinderVolumeType: volume-type-2 GlanceStoreDescription: Seconde cinder store.

InstanceNameTemplate

Template string to be used to generate instance names. The default value is instance-%08x.

InternalTLSVncProxyCAFile

Specifies the CA cert to use for VNC TLS. The default value is /etc/ipa/ca.crt.

KernelArgs

Kernel Args to apply to the host.

LibvirtCACert

This specifies the CA certificate to use for TLS in libvirt. This file will be symlinked to the default CA path in libvirt, which is /etc/pki/CA/cacert.pem. Note that due to limitations GNU TLS, which is the TLS backend for libvirt, the file must be less than 65K (so we can’t use the system’s CA bundle). This parameter should be used if the default (which comes from the InternalTLSCAFile parameter) is not desired. The current default reflects TripleO’s default CA, which is FreeIPA. It will only be used if internal TLS is enabled.

LibvirtCertificateKeySize

Override the private key size used when creating the certificate for this service.

LibvirtEnabledPerfEvents

This is a performance event list which could be used as monitor. For example: cmt,mbml,mbmt. Make sure you are using Red Hat Enterprise Linux 7.4 as the base and libvirt version is 1.3.3 or above. Also ensure you have enabled the notifications and are using hardware with a CPU that supports the cmt flag.

LibvirtLogFilters

Defines a filter in libvirt daemon to select a different logging level for a given category log outputs, as specified in https://libvirt.org/logging.html . The default value is 1:libvirt 1:qemu 1:conf 1:security 3:event 3:json 3:file 3:object 1:util.

LibvirtTLSPassword

The password for the libvirt service when TLS is enabled.

LibvirtTLSPriority

Override the compile time default TLS priority string. The default value is NORMAL:-VERS-SSL3.0:-VERS-TLS-ALL:+VERS-TLS1.2.

LibvirtVirtlogdLogFilters

Defines a filter in virtlogd to select a different logging level for a given category log outputs, as specified in https://libvirt.org/logging.html . The default value is 1:logging 4:object 4:json 4:event 1:util.

LibvirtVirtnodedevdLogFilters

Defines a filter in virtnodedevd to select a different logging level for a given category log outputs, as specified in https://libvirt.org/logging.html . The default value is 1:qemu 1:libvirt 4:object 4:json 4:event 1:util.

LibvirtVirtproxydLogFilters

Defines a filter in virtproxyd to select a different logging level for a given category log outputs, as specified in https://libvirt.org/logging.html . The default value is 1:qemu 1:libvirt 4:object 4:json 4:event 1:util.

LibvirtVirtqemudLogFilters

Defines a filter in virtqemud to select a different logging level for a given category log outputs, as specified in https://libvirt.org/logging.html . The default value is 1:qemu 1:libvirt 4:object 4:json 4:event 1:util.

LibvirtVirtsecretdLogFilters

Defines a filter in virtsecretd to select a different logging level for a given category log outputs, as specified in https://libvirt.org/logging.html . The default value is 1:qemu 1:libvirt 4:object 4:json 4:event 1:util.

LibvirtVirtstoragedLogFilters

Defines a filter in virtstoraged to select a different logging level for a given category log outputs, as specified in https://libvirt.org/logging.html . The default value is 1:qemu 1:libvirt 4:object 4:json 4:event 1:util.

LibvirtVncCACert

This specifies the CA certificate to use for VNC TLS. This file will be symlinked to the default CA path, which is /etc/pki/CA/certs/vnc.crt. This parameter should be used if the default (which comes from the InternalTLSVncProxyCAFile parameter) is not desired. The current default reflects TripleO’s default CA, which is FreeIPA. It will only be used if internal TLS is enabled.

LibvirtVNCClientCertificateKeySize

Override the private key size used when creating the certificate for this service.

MemcachedTLS

Set to True to enable TLS on Memcached service. Because not all services support Memcached TLS, during the migration period, Memcached will listen on 2 ports - on the port set with MemcachedPort parameter (above) and on 11211, without TLS. The default value is false.

MemcacheUseAdvancedPool

Use the advanced (eventlet safe) memcached client pool. The default value is true.

MigrationSshKey

SSH key for migration. Expects a dictionary with keys public_key and private_key. Values should be identical to SSH public/private key files. The default value is {'public_key': '', 'private_key': ''}.

MigrationSshPort

Target port for migration over ssh. The default value is 2022.

MultipathdEnable

Whether to enable the multipath daemon. The default value is false.

MysqlIPv6

Enable IPv6 in MySQL. The default value is false.

NeutronMetadataProxySharedSecret

Shared secret to prevent spoofing.

NeutronPhysnetNUMANodesMapping

Map of phynet name as key and NUMA nodes as value. For example: NeutronPhysnetNUMANodesMapping: {'foo': [0, 1], 'bar': [1]} where foo and bar are physnet names and corresponding values are list of associated numa_nodes.

NeutronTunnelNUMANodes

Used to configure NUMA affinity for all tunneled networks.

NotificationDriver

Driver or drivers to handle sending notifications. The default value is noop.

NovaAdditionalCell

Whether this is an cell additional to the default cell. The default value is false.

NovaAllowResizeToSameHost

Allow destination machine to match source for resize. The default value is false.

NovaApiHostStatusPolicy

Configures a custom API policy rule or role for the configured value of the NovaShowHostStatus parameter. The cloud user must be granted this role to access the configured level of Compute host status and the role must already be created in your RHOSP deployment. The default value is role:reader. If you set the NovaShowHostStatus parameter to unknown-only, users with the specified NovaApiHostStatusPolicy role can see the limited host status UNKNOWN when a heartbeat is not received within the configured threshold. If you set the NovaShowHostStatus parameter to all, users with the specified role can see the following statuses of the Compute host for an instance: UP, DOWN, MAINTENANCE, UNKNOWN, and NONE. If you set NovaShowHostStatus to hidden, users with the specified role cannot see the status of the Compute host for an instance. Only the RHOSP administrator can view the Compute host status. To use this feature, ensure that SRBAC is enabled in your RHOSP environment. You must have python-openstackclient-6.0.0 or greater installed to see the host status when you use the openstack server list --long command. The default value is role:reader.

NovaApiMaxLimit

Max number of objects returned per API query. The default value is 1000.

NovaAutoDisabling

Max number of consecutive build failures before the nova-compute will disable itself. The default value is 10.

NovaComputeCpuDedicatedSet

A comma-separated list or range of physical host CPU numbers to which processes for pinned instance CPUs can be scheduled. For example, NovaComputeCpuDedicatedSet: [4-12,^8,15] reserves cores from 4-12 and 15, excluding 8. If setting this option, do not set the deprecated NovaVcpuPinSet parameter.

NovaComputeCpuSharedSet

If the deprecated NovaVcpuPinSet option is not set, then NovaComputeCpuSharedSet is set to a comma-separated list or range of physical host CPU numbers used to provide vCPU inventory, determine the host CPUs that unpinned instances can be scheduled to, and determine the host CPUS that instance emulator threads should be offloaded to for instances configured with the share emulator thread policy, hw:emulator_threads_policy=share. If the deprecated NovaVcpuPinSet is set, then NovaComputeCpuSharedSet is set to a list or range of host CPU cores used to determine the host CPUs that instance emulator threads should be offloaded to for instances configured with the share emulator thread policy (hw:emulator_threads_policy=share). In this case, NovaVcpuPinSet is used to provide vCPU inventory and to determine the host CPUs that both pinned and unpinned instances can be scheduled to. For example, NovaComputeCpuSharedSet: [4-12,^8,15] reserves cores from 4-12 and 15, excluding 8.

NovaComputeDisableIrqBalance

Whether to disable irqbalance on compute nodes or not. Especially in Realtime Compute role one wants to keep it disabled. The default value is false.

NovaComputeEnableKsm

Whether to enable KSM on compute nodes or not. Especially in NFV use case one wants to keep it disabled. The default value is false.

NovaComputeForceRawImages

Set to "True" to convert non-raw cached base images to raw format. Set to "False" if you have a system with slow I/O or low available space, trading the higher CPU requirements of compression for that of minimized input bandwidth. Notes:: - The Compute service removes any compression from the base image during compression, to avoid CPU bottlenecks. Converted images cannot have backing files, which might be a security issue. - The raw image format uses more space than other image formats, for example, qcow2. Raw base images are always used with libvirt_images_type=lvm. The default value is true.

NovaComputeImageCacheManagerInterval

Specifies the number of seconds to wait between runs of the image cache manager, which impacts base image caching on Compute nodes. This period is used in the auto removal of unused cached images configured with remove_unused_base_images and remove_unused_original_minimum_age_seconds.

Set to "0" to run at the default interval of 60 seconds (not recommended). The default value is 2400.

NovaComputeImageCachePrecacheConcurrency

Maximum number of Compute nodes to trigger image precaching in parallel. When an image precache request is made, Compute nodes are contacted {by who/which service} to initiate the download.

Higher numbers will cause more computes to work in parallel and may result in reduced time to complete the operation, but may also DDoS the image service. Lower numbers will result in more sequential operation, lower image service load, but likely longer runtime to completion. The default value is 1.

NovaComputeImageCacheRemoveUnusedBaseImages

Set to "True" to automatically remove unused base images from the cache at intervals configured by using image_cache_manager_interval. Images are defined as unused if they have not been accessed during the time specified by using remove_unused_original_minimum_age_seconds. The default value is true.

NovaComputeImageCacheRemoveUnusedResizedMinimumAge

Specifies the minimum age that an unused resized base image must be to be removed from the cache, in seconds. Unused unresized base images younger than this will not be removed. The default value is 3600.

NovaComputeLibvirtPreAllocateImages

Specifies the preallocation mode for libvirt instance disks. Set to one of the following valid values:: - none - No storage is provisioned at instance start. - space - Storage is fully allocated at instance start using fallocate, which can help with both space guarantees and I/O performance.

Even when not using CoW instance disks, the copy each instance gets is sparse and so the instance might fail unexpectedly at run time with ENOSPC. By running fallocate(1) on the instance disk images, the Compute service immediately and efficiently allocates the space for them in the file system, if supported. Run time performance should also be improved because the file system does not have to dynamically allocate blocks at run time, which reduces CPU overhead and file fragmentation. The default value is none.

NovaComputeLibvirtType

Libvirt domain type. Defaults to kvm. The default value is kvm.

NovaComputeOptEnvVars

List of optional environment variables.

NovaComputeOptVolumes

List of optional volumes.

NovaComputeStartupDelay

Delays the startup of nova-compute service after compute node is booted. This is to give a chance to ceph to get back healthy before booting instances after and overcloud reboot. The default value is 0.

NovaComputeUseCowImages

Set to "True" to use CoW (Copy on Write) images in cqow2 format for libvirt instance disks. With CoW, depending on the backing store and host caching, there might be better concurrency achieved by having each instance operate on its own copy. Set to "False" to use the raw format. Raw format uses more space for common parts of the disk image. The default value is true.

NovaCPUAllocationRatio

Virtual CPU to physical CPU allocation ratio. The default value is 0.0.

NovaCronArchiveDeleteAllCells

Archive deleted instances from all cells. The default value is true.

NovaCronArchiveDeleteRowsAge

Cron to archive deleted instances - Age. This will define the retention policy when archiving the deleted instances entries in days. 0 means archive data older than today in shadow tables. The default value is 90. The default value is 90.

NovaCronArchiveDeleteRowsDestination

Cron to move deleted instances to another table - Log destination. The default value is /var/log/nova/nova-rowsflush.log.

NovaCronArchiveDeleteRowsHour

Cron to move deleted instances to another table - Hour. The default value is 0.

NovaCronArchiveDeleteRowsMaxDelay

Cron to move deleted instances to another table - Max Delay. The default value is 3600.

NovaCronArchiveDeleteRowsMaxRows

Cron to move deleted instances to another table - Max Rows. The default value is 1000.

NovaCronArchiveDeleteRowsMinute

Cron to move deleted instances to another table - Minute. The default value is 1.

NovaCronArchiveDeleteRowsMonth

Cron to move deleted instances to another table - Month. The default value is *.

NovaCronArchiveDeleteRowsMonthday

Cron to move deleted instances to another table - Month Day. The default value is *.

NovaCronArchiveDeleteRowsPurge

Purge shadow tables immediately after scheduled archiving. The default value is false.

NovaCronArchiveDeleteRowsUntilComplete

Cron to move deleted instances to another table - Until complete. The default value is true.

NovaCronArchiveDeleteRowsUser

Cron to move deleted instances to another table - User. The default value is nova.

NovaCronArchiveDeleteRowsWeekday

Cron to move deleted instances to another table - Week Day. The default value is *.

NovaCronPurgeShadowTablesAge

Cron to purge shadow tables - Age This will define the retention policy when purging the shadow tables in days. 0 means, purge data older than today in shadow tables. The default value is 14.

NovaCronPurgeShadowTablesAllCells

Cron to purge shadow tables - All cells. The default value is true.

NovaCronPurgeShadowTablesDestination

Cron to purge shadow tables - Log destination. The default value is /var/log/nova/nova-rowspurge.log.

NovaCronPurgeShadowTablesHour

Cron to purge shadow tables - Hour. The default value is 5.

NovaCronPurgeShadowTablesMaxDelay

Cron to purge shadow tables - Max Delay. The default value is 3600.

NovaCronPurgeShadowTablesMinute

Cron to purge shadow tables - Minute. The default value is 0.

NovaCronPurgeShadowTablesMonth

Cron to purge shadow tables - Month. The default value is *.

NovaCronPurgeShadowTablesMonthday

Cron to purge shadow tables - Month Day. The default value is *.

NovaCronPurgeShadowTablesUser

Cron to purge shadow tables - User. The default value is nova.

NovaCronPurgeShadowTablesVerbose

Cron to purge shadow tables - Verbose. The default value is false.

NovaCronPurgeShadowTablesWeekday

Cron to purge shadow tables - Week Day. The default value is *.

NovaCrossAZAttach

Whether instances can attach cinder volumes from a different availability zone. The default value is true.

NovaDefaultFloatingPool

Default pool for floating IP addresses. The default value is public.

NovaDisableComputeServiceCheckForFfu

Facilitate a Fast-Forward upgrade where new control services are being started before compute nodes have been able to update their service record. The default value is false.

NovaDisableImageDownloadToRbd

Refuse to boot an instance if it would require downloading from glance and uploading to ceph instead of a COW clone. The default value is false.

NovaDiskAllocationRatio

Virtual disk to physical disk allocation ratio. The default value is 0.0.

NovaEnableDBArchive

Whether to create cron job for archiving soft deleted rows in OpenStack Compute (nova) database. The default value is true.

NovaEnableDBPurge

Whether to create cron job for purging soft deleted rows in OpenStack Compute (nova) database. The default value is true.

NovaEnableVirtlogdContainerWrapper

Generate a virtlogd wrapper script so that virtlogd launches in a separate container and won’t get restarted e.g. on minor updates. The default value is true.

NovaEnableVTPM

Whether to enable support for enumlated Trusted Platform Module (TPM) devices. The default value is false.

NovaGlanceEnableRbdDownload

Enable download of OpenStack Image Storage (glance) images directly via RBD. The default value is false.

NovaGlanceRbdCopyPollInterval

The interval in seconds with which to poll OpenStack Image Storage (glance) after asking for it to copy an image to the local rbd store. The default value is 15.

NovaGlanceRbdCopyTimeout

The overall maximum time we will wait for OpenStack Image Storage (glance) to complete an image copy to our local rbd store. The default value is 600.

NovaGlanceRbdDownloadMultistoreID

The hash key, which is the backend ID, of the GlanceMultistoreConfig to be used for the role where NovaGlanceEnableRbdDownload is enabled and defaults should be overridden. If CephClientUserName or GlanceRbdPoolName are not set in the GlanceMultistoreConfig, the global values of those parameters will be used.

NovaHWMachineType

Specifies the default machine type for each host architecture. Red Hat recommends setting the default to the lowest RHEL minor release in your environment, for backwards compatibility during live migration. The default value is x86_64=pc-q35-rhel9.0.0.

NovaImageCacheTTL

Time in seconds that nova compute should continue caching an image once it is no longer used by any instances on the host. The default value is 86400.

NovaImageTypeExcludeList

List of image formats that should not be advertised as supported by the compute service.

NovaLibvirtCPUMode

The libvirt CPU mode to configure. Defaults to host-model if virt_type is set to kvm, otherwise defaults to none. The default value is host-model.

NovaLibvirtCPUModelExtraFlags

This allows specifying granular CPU feature flags when specifying CPU models. Only has effect if cpu_mode is not set to none.

NovaLibvirtCPUModels

The named libvirt CPU model (see names listed in /usr/share/libvirt/cpu_map.xml). Only has effect if cpu_mode="custom" and virt_type="kvm|qemu".

NovaLibvirtFileBackedMemory

Available capacity in MiB for file-backed memory. When configured, the NovaRAMAllocationRatio and NovaReservedHostMemory parameters must be set to 0. The default value is 0.

NovaLibvirtMaxQueues

Add parameter to configure the libvirt max_queues. The maximum number of virtio queue pairs that can be enabled when creating a multiqueue guest. The number of virtio queues allocated will be the lesser of the CPUs requested by the guest and the max value defined. Default 0 corresponds to not set. The default value is 0.

NovaLibvirtMemStatsPeriodSeconds

A number of seconds to memory usage statistics period, zero or negative value mean to disable memory usage statistics. The default value is 10.

NovaLibvirtNumPciePorts

Set num_pcie_ports to specify the number of PCIe ports an instance will get. Libvirt allows a custom number of PCIe ports (pcie-root-port controllers) a target instance will get. Some will be used by default, rest will be available for hotplug use. The default value is 16.

NovaLibvirtOptVolumes

List of optional volumes to be mounted.

NovaLibvirtRxQueueSize

Virtio-net RX queue size. Valid values are 256, 512, 1024. The default value is 512.

NovaLibvirtTxQueueSize

Virtio-net TX queue size. Valid values are 256, 512, 1024. The default value is 512.

NovaLibvirtVolumeUseMultipath

Whether to enable or not the multipath connection of the volumes. The default value is false.

NovaLiveMigrationPermitAutoConverge

Defaults to "True" to slow down the instance CPU until the memory copy process is faster than the instance’s memory writes when the migration performance is slow and might not complete. Auto converge will only be used if this flag is set to True and post copy is not permitted or post copy is unavailable due to the version of libvirt and QEMU. The default value is true.

NovaLiveMigrationPermitPostCopy

If "True" activates the instance on the destination node before migration is complete, and to set an upper bound on the memory that needs to be transferred. Post copy gets enabled per default if the compute roles is not a realtime role or disabled by this parameter. The default value is true.

NovaLiveMigrationWaitForVIFPlug

Whether to wait for network-vif-plugged events before starting guest transfer. The default value is true.

NovaLocalMetadataPerCell

Indicates that the nova-metadata API service has been deployed per-cell, so that we can have better performance and data isolation in a multi-cell deployment. Users should consider the use of this configuration depending on how OpenStack Networking (neutron) is setup. If networks span cells, you might need to run nova-metadata API service globally. If your networks are segmented along cell boundaries, then you can run nova-metadata API service per cell. When running nova-metadata API service per cell, you should also configure each OpenStack Networking (neutron) metadata-agent to point to the corresponding nova-metadata API service. The default value is false.

NovaMaxDiskDevicesToAttach

Maximum number of disk devices allowed to attach to a single server. Note that the number of disks supported by an server depends on the bus used. For example, the ide disk bus is limited to 4 attached devices. The configured maximum is enforced during server create, rebuild, evacuate, unshelve, live migrate, and attach volume. Operators changing this parameter on a compute service that is hosting servers should be aware that it could cause rebuilds to fail, if the maximum is decreased lower than the number of devices already attached to servers. Operators should also be aware that during a cold migration, the configured maximum is only enforced in-place and the destination is not checked before the move. -1 means unlimited. The default value is -1.

NovaMkisofsCmd

Name or path of the tool used for ISO image creation. The default value is mkisofs.

NovaNfsEnabled

Whether to enable or not the NFS backend for OpenStack Compute (nova). The default value is false.

NovaNfsOptions

NFS mount options for nova storage (when NovaNfsEnabled is true). The default value is context=system_u:object_r:nfs_t:s0.

NovaNfsShare

NFS share to mount for nova storage (when NovaNfsEnabled is true).

NovaNfsVersion

NFS version used for nova storage (when NovaNfsEnabled is true). Since NFSv3 does not support full locking a NFSv4 version need to be used. The default value is 4.2.

NovaOVSBridge

Name of integration bridge used by Open vSwitch. The default value is br-int.

NovaOVSDBConnection

OVS DB connection string to used by OpenStack Compute (nova).

NovaPassword

The password for the OpenStack Compute (nova) service and database account.

NovaPCIPassthrough

YAML list of PCI passthrough whitelist parameters.

NovaPMEMMappings

PMEM namespace mappings as backend for vPMEM feature. This parameter sets Nova’s pmem_namespaces configuration options. PMEM namespaces needs to be create manually or with conjunction with NovaPMEMNamespaces parameter. Requires format: $LABEL:$NSNAME[|$NSNAME][,$LABEL:$NSNAME[|$NSNAME]].

NovaPMEMNamespaces

Creates PMEM namespaces on the host server using ndctl tool through Ansible. Requires format: $SIZE:$NSNAME[,$SIZE:$NSNAME…​]. $SIZE supports the suffixes "k" or "K" for KiB, "m" or "M" for MiB, "g" or "G" for GiB and "t" or "T" for TiB. NOTE: This requires properly configured NVDIMM regions and enough space for requested namespaces.

NovaRAMAllocationRatio

Virtual RAM to physical RAM allocation ratio. The default value is 1.0.

NovaReservedHostMemory

Reserved RAM for host processes. The default value is 4096.

NovaReservedHugePages

A list of valid key=value which reflect NUMA node ID, page size (Default unit is KiB) and number of pages to be reserved. Example - NovaReservedHugePages: ["node:0,size:2048,count:64","node:1,size:1GB,count:1"] will reserve on NUMA node 0 64 pages of 2MiB and on NUMA node 1 1 page of 1GiB.

NovaResumeGuestsShutdownTimeout

Number of seconds we’re willing to wait for a guest to shut down. If this is 0, then there is no time out (use with caution, as guests might not respond to a shutdown request). The default value is 300 seconds (5 minutes). The default value is 300.

NovaResumeGuestsStateOnHostBoot

Whether to start running instance on compute host reboot. The default value is false.

NovaSchedulerAvailableFilters

List of available filters for OpenStack Compute (nova) to use to filter nodes.

NovaSchedulerDefaultFilters

(DEPRECATED) An array of filters used by OpenStack Compute (nova) to filter a node. These filters will be applied in the order they are listed, so place your most restrictive filters first to make the filtering process more efficient.

NovaSchedulerDiscoverHostsInCellsInterval

This value controls how often (in seconds) the scheduler should attempt to discover new hosts that have been added to cells. The default value of -1 disables the periodic task completely. It is recommended to set this parameter for deployments using OpenStack Bare Metal (ironic). The default value is -1.

NovaSchedulerEnabledFilters

An array of filters that OpenStack Compute (nova) uses to filter a node. OpenStack Compute applies these filters in the order they are listed. Place your most restrictive filters first to make the filtering process more efficient.

NovaSchedulerEnableIsolatedAggregateFiltering

This setting allows the scheduler to restrict hosts in aggregates based on matching required traits in the aggregate metadata and the instance flavor/image. If an aggregate is configured with a property with key trait:$TRAIT_NAME and value required, the instance flavor extra_specs and/or image metadata must also contain trait:$TRAIT_NAME=required to be eligible to be scheduled to hosts in that aggregate. The default value is false.

NovaSchedulerHostSubsetSize

Size of subset of best hosts selected by scheduler. The default value is 1.

NovaSchedulerLimitTenantsToPlacementAggregate

This value allows to have tenant isolation with placement. It ensures hosts in tenant-isolated host aggregate and availability zones will only be available to specific set of tenants. The default value is false.

NovaSchedulerMaxAttempts

Maximum number of attempts the scheduler will make when deploying the instance. You should keep it greater or equal to the number of bare metal nodes you expect to deploy at once to work around potential race conditions when scheduling. The default value is 3.

NovaSchedulerPlacementAggregateRequiredForTenants

This setting, when NovaSchedulerLimitTenantsToPlacementAggregate is true, controls whether or not a tenant with no aggregate affinity will be allowed to schedule to any available node. If aggregates are used to limit some tenants but not all, then this should be False. If all tenants should be confined via aggregate, then this should be True. The default value is false.

NovaSchedulerQueryImageType

This setting causes the scheduler to ask placement only for compute hosts that support the disk_format of the image used in the request. The default value is true.

NovaSchedulerQueryPlacementForAvailabilityZone

This setting allows the scheduler to look up a host aggregate with metadata key of availability zone set to the value provided by incoming request, and request result from placement be limited to that aggregate. The default value is false.

NovaSchedulerQueryPlacementForRoutedNetworkAggregates

This setting allows the scheduler to verify if the requested networks or port are related to OpenStack Networking (neutron) routed network. This requires that the related aggregates to be reported in placement, so only hosts within the asked aggregates would be accepted. The default value is false.

NovaSchedulerShuffleBestSameWeighedHosts

Enable spreading the instances between hosts with the same best weight. The default value is false.

NovaSchedulerWorkers

Number of workers for OpenStack Compute (nova) Scheduler services. The default value is 0.

NovaShowHostStatus

Allows the role that is configured with the NovaApiHostStatusPolicy parameter to access the status of a Compute host for an instance. You can set the NovaShowHostStatus parameter to one of the following valid values: hidden (default) allows only RHOSP administrators to access the Compute host status; all shows the UP, DOWN, MAINTENANCE, UNKNOWN, and NONE Compute host statuses to the role configured with NovaApiHostStatusPolicy; and unknown-only shows the UNKNOWN Compute host status to the role configured with the NovaApiHostStatusPolicy parameter. To use this feature, ensure that SRBAC is enabled in your RHOSP environment. You must have python-openstackclient-6.0.0 or greater installed to see the host status when you use the openstack server list --long command. The default value is hidden.

NovaStatedirOwnershipSkip

List of paths relative to nova_statedir to ignore when recursively setting the ownership and selinux context. The default value is ['triliovault-mounts'].

NovaSyncPowerStateInterval

Interval to sync power states between the database and the hypervisor. Set to -1 to disable. Setting this to 0 will run at the default rate(60) defined in oslo.service. The default value is 600.

NovaVcpuPinSet

(Deprecated) A list or range of physical CPU cores to reserve for virtual machine processes. For example, NovaVcpuPinSet: [4-12,^8] reserves cores from 4-12 excluding 8. This parameter has been deprecated. Use NovaComputeCpuDedicatedSet and NovaComputeCpuSharedSet instead. If you require support for a RHOSP deployment that continues to use NovaVcpuPinSet instead of NovaComputeCpuDedicatedSet and NovaComputeCpuSharedSet, contact the Red Hat Customer Experience and Engagement team to obtain a support exception. For information about how to update NovaVcpuPinSet to the supported parameters NovaComputeCpuDedicatedSet and NovaComputeCpuSharedSet, see Updating CPU pinning parameters in the Framework for upgrades (16.2 to 17.1) guide.

NovaVGPUTypesDeviceAddressesMapping

Map of vgpu type(s) the instances can get as key and list of corresponding device addresses as value. For example, NovaVGPUTypesDeviceAddressesMapping: {nvidia-35: [0000:84:00.0, 0000:85:00.0], nvidia-36: [0000:86:00.0]} where nvidia-35 and nvidia-36 are vgpu types and corresponding values are list of associated device addresses.

NovaVNCCertificateKeySize

Override the private key size used when creating the certificate for this service.

NovaVNCProxySSLCiphers

OpenSSL cipher preference string that specifies what ciphers to allow for TLS connections from clients. See the man page for the OpenSSL ciphers command for details of the cipher preference string format and allowed values.

NovaVNCProxySSLMinimumVersion

Minimum allowed SSL/TLS protocol version. Valid values are default, tlsv1_1, tlsv1_2, and tlsv1_3. A value of default will use the underlying system OpenSSL defaults. The default value is default.

NovaWorkers

Number of workers for the Compute’s Conductor service. Note that more workers creates a larger number of processes on systems, which results in excess memory consumption. 0 sets to the OpenStack internal default, which is equal to the number of CPU cores on the node. The default value is 0.

OvsDpdkSocketMemory

Sets the amount of hugepage memory to assign per NUMA node. It is recommended to use the socket closest to the PCIe slot used for the desired DPDK NIC. The format should be in "<socket 0 mem>, <socket 1 mem>, <socket n mem>", where the value is specified in MB. For example: "1024,0".

PlacementAPIInterface

Endpoint interface to be used for the placement API. The default value is internal.

PlacementPassword

The password for the Placement service and database account.

QemuCACert

This specifies the CA certificate to use for qemu. This file will be symlinked to the default CA path, which is /etc/pki/qemu/ca-cert.pem. This parameter should be used if the default (which comes from the InternalTLSCAFile parameter) is not desired. The current default reflects TripleO’s default CA, which is FreeIPA. It will only be used if internal TLS is enabled.

QemuClientCertificateKeySize

Override the private key size used when creating the certificate for this service.

QemuDefaultTLSVerify

Whether to enable or disable TLS client certificate verification. Enabling this option will reject any client who does not have a certificate signed by the CA in /etc/pki/qemu/ca-cert.pem. The default value is true.

QemuMemoryBackingDir

Directory used for memoryBacking source if configured as file. NOTE: big files will be stored here.

QemuServerCertificateKeySize

Override the private key size used when creating the certificate for this service.

RbdDiskCachemodes

Disk cachemodes for RBD backend. The default value is ['network=writeback'].

UpgradeLevelNovaCompute

OpenStack Compute upgrade level.

UseTLSTransportForNbd

If set to true and if EnableInternalTLS is enabled, it will enable TLS transport for libvirt NBD and configure the relevant keys for libvirt. The default value is true.

UseTLSTransportForVnc

If set to true and if EnableInternalTLS is enabled, it will enable TLS transport for libvirt VNC and configure the relevant keys for libvirt. The default value is true.

VerifyGlanceSignatures

Whether to verify image signatures. The default value is False.

VhostuserSocketGroup

The vhost-user socket directory group name. Defaults to qemu. When vhostuser mode is dpdkvhostuserclient (which is the default mode), the vhost socket is created by qemu. The default value is qemu.

HorizonAllowedHosts

A list of IP/Hostname for the server OpenStack Dashboard (horizon) is running on. Used for header checks. The default value is *.

HorizonCustomizationModule

OpenStack Dashboard (horizon) has a global overrides mechanism available to perform customizations.

HorizonDomainChoices

Specifies available domains to choose from. We expect an array of hashes, and the hashes should have two items each (name, display) containing OpenStack Identity (keystone) domain name and a human-readable description of the domain respectively.

HorizonHelpURL

On top of dashboard there is a Help button. This button could be used to re-direct user to vendor documentation or dedicated help portal. The default value is http://docs.openstack.org.

HorizonHstsHeaderValue

Enables HTTP Strict-Transport-Security header in response.

HorizonPasswordValidator

Regex for password validation.

HorizonPasswordValidatorHelp

Help text for password validation.

HorizonSecret

Secret key for the webserver.

HorizonSecureCookies

Set CSRF_COOKIE_SECURE / SESSION_COOKIE_SECURE in OpenStack Dashboard (horizon). The default value is false.

HorizonSessionTimeout

Set session timeout for horizon in seconds. The default value is 1800.

HorizonVhostExtraParams

Extra parameters for OpenStack Dashboard (horizon) vhost configuration. The default value is {'add_listen': 'true', 'priority': '10', 'access_log_format': '%a %l %u %t \\"%r\\" %>s %b \\"%%{}{Referer}i\\" \\"%%{}{User-Agent}i\\"', 'options': ['FollowSymLinks', 'MultiViews']}.

MemcachedIPv6

Enable IPv6 features in Memcached. The default value is false.

TimeZone

The timezone to be set on the overcloud. The default value is UTC.

WebSSOChoices

Specifies the list of SSO authentication choices to present. Each item is a list of an SSO choice identifier and a display message. The default value is [['OIDC', 'OpenID Connect']].

WebSSOEnable

Enable support for Web Single Sign-On. The default value is false.

WebSSOIDPMapping

Specifies a mapping from SSO authentication choice to identity provider and protocol. The identity provider and protocol names must match the resources defined in keystone. The default value is {'OIDC': ['myidp', 'openid']}.

WebSSOInitialChoice

The initial authentication choice to select by default. The default value is OIDC.

AdminToken

The OpenStack Identity (keystone) secret and database password.

ApacheCertificateKeySize

Override the private key size used when creating the certificate for this service.

ApacheTimeout

The timeout in seconds for Apache, which defines duration Apache waits for I/O operations. The default value is 90.

CertificateKeySize

Specifies the private key size used when creating the certificate. The default value is 2048.

EnableCache

Enable caching with memcached. The default value is true.

EnablePublicTLS

Whether to enable TLS on the public interface or not. The default value is true.

EnableSQLAlchemyCollectd

Set to true to enable the SQLAlchemy-collectd server plugin. The default value is false.

EnforceSecureRbac

Setting this option to True will configure each OpenStack service to enforce Secure RBAC by setting [oslo_policy] enforce_new_defaults and [oslo_policy] enforce_scope to True. This introduces a consistent set of RBAC personas across OpenStack services that include support for system and project scope, as well as keystone’s default roles, admin, member, and reader. Do not enable this functionality until all services in your deployment actually support secure RBAC. The default value is false.

KeystoneAuthMethods

A list of methods used for authentication.

KeystoneChangePasswordUponFirstUse

Enabling this option requires users to change their password when the user is created, or upon administrative reset.

KeystoneCorsAllowedOrigin

Indicate whether this resource may be shared with the domain received in the request "origin" header.

KeystoneCredential0

The first OpenStack Identity (keystone) credential key. Must be a valid key.

KeystoneCredential1

The second OpenStack Identity (keystone) credential key. Must be a valid key.

KeystoneCronTrustFlushDestination

Cron to purge expired or soft-deleted trusts - Log destination. The default value is /var/log/keystone/keystone-trustflush.log.

KeystoneCronTrustFlushEnsure

Cron to purge expired or soft-deleted trusts - Ensure. The default value is present.

KeystoneCronTrustFlushHour

Cron to purge expired or soft-deleted trusts - Hour. The default value is *.

KeystoneCronTrustFlushMaxDelay

Cron to purge expired or soft-deleted trusts - Max Delay. The default value is 0.

KeystoneCronTrustFlushMinute

Cron to purge expired or soft-deleted trusts - Minute. The default value is 1.

KeystoneCronTrustFlushMonth

Cron to purge expired or soft-deleted trusts - Month. The default value is *.

KeystoneCronTrustFlushMonthday

Cron to purge expired or soft-deleted trusts - Month Day. The default value is *.

KeystoneCronTrustFlushUser

Cron to purge expired or soft-deleted trusts - User. The default value is keystone.

KeystoneCronTrustFlushWeekday

Cron to purge expired or soft-deleted trusts - Week Day. The default value is *.

KeystoneDisableUserAccountDaysInactive

The maximum number of days a user can go without authenticating before being considered "inactive" and automatically disabled (locked).

KeystoneEnableDBPurge

Whether to create cron job for purging soft deleted rows in OpenStack Identity (keystone) database. The default value is true.

KeystoneEnableMember

Create the member role, useful for undercloud deployment. The default value is False.

KeystoneFederationEnable

Enable support for federated authentication. The default value is false.

KeystoneFernetKeys

Mapping containing OpenStack Identity (keystone) fernet keys and their paths.

KeystoneFernetMaxActiveKeys

The maximum active keys in the OpenStack Identity (keystone) fernet key repository. The default value is 5.

KeystoneLDAPBackendConfigs

Hash containing the configurations for the LDAP backends configured in keystone.

KeystoneLDAPDomainEnable

Trigger to call ldap_backend puppet keystone define. The default value is False.

KeystoneLockoutDuration

The number of seconds a user account will be locked when the maximum number of failed authentication attempts (as specified by KeystoneLockoutFailureAttempts) is exceeded.

KeystoneLockoutFailureAttempts

The maximum number of times that a user can fail to authenticate before the user account is locked for the number of seconds specified by KeystoneLockoutDuration.

KeystoneMinimumPasswordAge

The number of days that a password must be used before the user can change it. This prevents users from changing their passwords immediately in order to wipe out their password history and reuse an old password.

KeystoneNotificationDriver

Comma-separated list of Oslo notification drivers used by OpenStack Identity (keystone).

KeystoneNotificationFormat

The OpenStack Identity (keystone) notification format. The default value is basic.

KeystoneNotificationTopics

OpenStack Identity (keystone) notification topics to enable.

KeystoneOpenIdcClientId

The client ID to use when handshaking with your OpenID Connect provider.

KeystoneOpenIdcClientSecret

The client secret to use when handshaking with your OpenID Connect provider.

KeystoneOpenIdcCryptoPassphrase

Passphrase to use when encrypting data for OpenID Connect handshake. The default value is openstack.

KeystoneOpenIdcEnable

Enable support for OpenIDC federation. The default value is false.

KeystoneOpenIdcEnableOAuth

Enable OAuth 2.0 integration. The default value is false.

KeystoneOpenIdcIdpName

The name associated with the IdP in OpenStack Identity (keystone).

KeystoneOpenIdcIntrospectionEndpoint

OAuth 2.0 introspection endpoint for mod_auth_openidc.

KeystoneOpenIdcProviderMetadataUrl

The url that points to your OpenID Connect provider metadata.

KeystoneOpenIdcRemoteIdAttribute

Attribute to be used to obtain the entity ID of the Identity Provider from the environment. The default value is HTTP_OIDC_ISS.

KeystoneOpenIdcResponseType

Response type to be expected from the OpenID Connect provider. The default value is id_token.

KeystonePasswordExpiresDays

The number of days for which a password will be considered valid before requiring it to be changed.

KeystonePasswordRegex

The regular expression used to validate password strength requirements.

KeystonePasswordRegexDescription

Describe your password regular expression here in language for humans.

KeystoneSSLCertificate

OpenStack Identity (keystone) certificate for verifying token validity.

KeystoneSSLCertificateKey

OpenStack Identity (keystone) key for signing tokens.

KeystoneTokenProvider

The OpenStack Identity (keystone) token format. The default value is fernet.

KeystoneTrustedDashboards

A list of dashboard URLs trusted for single sign-on.

KeystoneUniqueLastPasswordCount

This controls the number of previous user password iterations to keep in history, in order to enforce that newly created passwords are unique.

KeystoneWorkers

Set the number of workers for the OpenStack Identity (keystone) service. Note that more workers creates a larger number of processes on systems, which results in excess memory consumption. It is recommended to choose a suitable non-default value on systems with high CPU core counts. 0 sets to the OpenStack internal default, which is equal to the number of CPU cores on the node. The default value is equal to the number of vCPU cores on the physical node.

ManageKeystoneFernetKeys

Whether director should manage the OpenStack Identity (keystone) fernet keys or not. If set to True, the fernet keys will get the values from the saved keys repository in OpenStack Workflow (mistral) from the KeystoneFernetKeys variable. If set to false, only the stack creation initializes the keys, but subsequent updates will not touch them. The default value is true.

MemcachedTLS

Set to True to enable TLS on Memcached service. Because not all services support Memcached TLS, during the migration period, Memcached will listen on 2 ports - on the port set with MemcachedPort parameter (above) and on 11211, without TLS. The default value is false.

NotificationDriver

Driver or drivers to handle sending notifications. The default value is noop.

PublicSSLCertificateAutogenerated

Whether the public SSL certificate was autogenerated or not. The default value is false.

PublicTLSCAFile

Specifies the default CA cert to use if TLS is used for services in the public network.

SSLCertificate

The content of the SSL certificate (without Key) in PEM format.

TokenExpiration

Set a token expiration time in seconds. The default value is 3600.

CephClusterName

The Ceph cluster name. The default value is ceph.

CephConfigPath

The path where the Ceph Cluster configuration files are stored on the host. The default value is /var/lib/tripleo-config/ceph.

CinderEnableNVMeOFBackend

Whether to enable or not the NVMeOF backend for OpenStack Block Storage (cinder). The default value is false.

CinderNVMeOFAvailabilityZone

The availability zone of the NVMeOF OpenStack Block Storage (cinder) backend. When set, it overrides the default CinderStorageAvailabilityZone.

CinderNVMeOFTargetProtocol

The target protocol, supported values are nvmet_rdma and nvmet_tcp. The default value is nvmet_rdma.

EnableSQLAlchemyCollectd

Set to true to enable the SQLAlchemy-collectd server plugin. The default value is false.

EnforceSecureRbac

Setting this option to True will configure each OpenStack service to enforce Secure RBAC by setting [oslo_policy] enforce_new_defaults and [oslo_policy] enforce_scope to True. This introduces a consistent set of RBAC personas across OpenStack services that include support for system and project scope, as well as keystone’s default roles, admin, member, and reader. Do not enable this functionality until all services in your deployment actually support secure RBAC. The default value is false.

GlanceApiOptVolumes

List of optional volumes to be mounted.

GlanceBackend

The short name of the OpenStack Image Storage (glance) backend to use. Should be one of swift, rbd, cinder, or file. The default value is swift.

GlanceBackendID

The default backend’s identifier. The default value is default_backend.

GlanceCacheEnabled

Enable OpenStack Image Storage (glance) Image Cache. The default value is False.

GlanceCinderMountPointBase

The mount point base when glance is using cinder as store and cinder backend is NFS. This mount point is where the NFS volume is mounted on the glance node. The default value is /var/lib/glance/mnt.

GlanceCinderVolumeType

A unique volume type required for each cinder store while configuring multiple cinder stores as glance backends. The same volume types must be configured in OpenStack Block Storage (cinder) as well. The volume type must exist in cinder prior to any attempt to add an image in the associated cinder store. If no volume type is specified then cinder’s default volume type will be used.

GlanceCronDbPurgeAge

Cron to purge database entries marked as deleted and older than $age - Age. The default value is 30.

GlanceCronDbPurgeDestination

Cron to purge database entries marked as deleted and older than $age - Log destination. The default value is /var/log/glance/glance-rowsflush.log.

GlanceCronDbPurgeHour

Cron to purge database entries marked as deleted and older than $age - Hour. The default value is 0.

GlanceCronDbPurgeMaxDelay

Cron to purge database entries marked as deleted and older than $age - Max Delay. The default value is 3600.

GlanceCronDbPurgeMaxRows

Cron to purge database entries marked as deleted and older than $age - Max Rows. The default value is 100.

GlanceCronDbPurgeMinute

Cron to purge database entries marked as deleted and older than $age - Minute. The default value is 1.

GlanceCronDbPurgeMonth

Cron to purge database entries marked as deleted and older than $age - Month. The default value is *.

GlanceCronDbPurgeMonthday

Cron to purge database entries marked as deleted and older than $age - Month Day. The default value is *.

GlanceCronDbPurgeUser

Cron to purge database entries marked as deleted and older than $age - User. The default value is glance.

GlanceCronDbPurgeWeekday

Cron to purge database entries marked as deleted and older than $age - Week Day. The default value is *.

GlanceDiskFormats

List of allowed disk formats in Glance; all formats are allowed when left unset.

GlanceEnabledImportMethods

List of enabled Image Import Methods. Valid values in the list are glance-direct, web-download, or copy-image. The default value is web-download.

GlanceIgnoreUserRoles

List of user roles to be ignored for injecting image metadata properties. The default value is admin.

GlanceImageCacheDir

Base directory that the Image Cache uses. The default value is /var/lib/glance/image-cache.

GlanceImageCacheMaxSize

The upper limit on cache size, in bytes, after which the cache-pruner cleans up the image cache. The default value is 10737418240.

GlanceImageCacheStallTime

The amount of time, in seconds, to let an image remain in the cache without being accessed. The default value is 86400.

GlanceImageConversionOutputFormat

Desired output format for image conversion plugin. The default value is raw.

GlanceImageImportPlugins

List of enabled Image Import Plugins. Valid values in the list are image_conversion, inject_metadata, no_op. The default value is ['no_op'].

GlanceImageMemberQuota

Maximum number of image members per image. Negative values evaluate to unlimited. The default value is 128.

GlanceImagePrefetcherInterval

The interval in seconds to run periodic job cache_images. The default value is 300.

GlanceInjectMetadataProperties

Metadata properties to be injected in image.

GlanceLogFile

The filepath of the file to use for logging messages from OpenStack Image Storage (glance).

GlanceMultistoreConfig

Dictionary of settings when configuring additional glance backends. The hash key is the backend ID, and the value is a dictionary of parameter values unique to that backend. Multiple rbd and cinder backends are allowed, but file and swift backends are limited to one each. Example: # Default glance store is rbd. GlanceBackend: rbd GlanceStoreDescription: Default rbd store # GlanceMultistoreConfig specifies a second rbd backend, plus a cinder # backend. GlanceMultistoreConfig: rbd2_store: GlanceBackend: rbd GlanceStoreDescription: Second rbd store CephClusterName: ceph2 # Override CephClientUserName if this cluster uses a different # client name. CephClientUserName: client2 cinder1_store: GlanceBackend: cinder GlanceCinderVolumeType: volume-type-1 GlanceStoreDescription: First cinder store cinder2_store: GlanceBackend: cinder GlanceCinderVolumeType: volume-type-2 GlanceStoreDescription: Seconde cinder store.

GlanceNetappNfsEnabled

When using GlanceBackend: file, Netapp mounts NFS share for image storage. The default value is false.

GlanceNfsEnabled

When using GlanceBackend: file, mount NFS share for image storage. The default value is false.

GlanceNfsOptions

NFS mount options for image storage when GlanceNfsEnabled is true. The default value is _netdev,bg,intr,context=system_u:object_r:container_file_t:s0.

GlanceNfsShare

NFS share to mount for image storage when GlanceNfsEnabled is true.

GlanceNodeStagingUri

URI that specifies the staging location to use when importing images. The default value is file:///var/lib/glance/staging.

GlanceNotifierStrategy

Strategy to use for OpenStack Image Storage (glance) notification queue. The default value is noop.

GlancePassword

The password for the image storage service and database account.

GlanceShowMultipleLocations

Whether to show multiple image locations e.g for copy-on-write support on RBD or Netapp backends. Potential security risk, see glance.conf for more information. The default value is false.

GlanceSparseUploadEnabled

When using GlanceBackend file and rbd to enable or not sparse upload. The default value is false.

GlanceStagingNfsOptions

NFS mount options for NFS image import staging. The default value is _netdev,bg,intr,context=system_u:object_r:container_file_t:s0.

GlanceStagingNfsShare

NFS share to mount for image import staging.

GlanceStoreDescription

User facing description for the OpenStack Image Storage (glance) backend. The default value is Default glance store backend..

GlanceWorkers

Set the number of workers for the image storage service. Note that more workers creates a larger number of processes on systems, which results in excess memory consumption. It is recommended to choose a suitable non-default value on systems with high CPU core counts. 0 sets to the OpenStack internal default, which is equal to the number of CPU cores on the node.

MemcacheUseAdvancedPool

Use the advanced (eventlet safe) memcached client pool. The default value is true.

MultipathdEnable

Whether to enable the multipath daemon. The default value is false.

NetappShareLocation

Netapp share to mount for image storage (when GlanceNetappNfsEnabled is true).

NotificationDriver

Driver or drivers to handle sending notifications. The default value is noop.

ApacheCertificateKeySize

Override the private key size used when creating the certificate for this service.

ApacheTimeout

The timeout in seconds for Apache, which defines duration Apache waits for I/O operations. The default value is 90.

ATOSVars

Hash of atos-hsm role variables used to install ATOS client software.

BarbicanDogtagStoreGlobalDefault

Whether this plugin is the global default plugin. The default value is false.

BarbicanDogtagStoreHost

Hostname of the Dogtag server.

BarbicanDogtagStoreNSSPassword

Password for the NSS DB.

BarbicanDogtagStorePEMPath

Path for the PEM file used to authenticate requests. The default value is /etc/barbican/kra_admin_cert.pem.

BarbicanDogtagStorePort

Port for the Dogtag server. The default value is 8443.

BarbicanKmipStoreGlobalDefault

Whether this plugin is the global default plugin. The default value is false.

BarbicanKmipStoreHost

Host for KMIP device.

BarbicanKmipStorePassword

Password to connect to KMIP device.

BarbicanKmipStorePort

Port for KMIP device.

BarbicanKmipStoreUsername

Username to connect to KMIP device.

BarbicanPassword

The password for the OpenStack Key Manager (barbican) service account.

BarbicanPkcs11AlwaysSetCkaSensitive

Always set CKA_SENSITIVE=CK_TRUE. The default value is true.

BarbicanPkcs11CryptoAESGCMGenerateIV

Generate IVs for CKM_AES_GCM encryption mechanism. The default value is true.

BarbicanPkcs11CryptoATOSEnabled

Enable ATOS for PKCS11. The default value is false.

BarbicanPkcs11CryptoEnabled

Enable PKCS11. The default value is false.

BarbicanPkcs11CryptoEncryptionMechanism

Cryptoki Mechanism used for encryption. The default value is CKM_AES_CBC.

BarbicanPkcs11CryptoGlobalDefault

Whether this plugin is the global default plugin. The default value is false.

BarbicanPkcs11CryptoHMACKeygenMechanism

Cryptoki Mechanism used to generate Master HMAC Key. The default value is CKM_AES_KEY_GEN.

BarbicanPkcs11CryptoHMACKeyType

Cryptoki Key Type for Master HMAC key. The default value is CKK_AES.

BarbicanPkcs11CryptoHMACLabel

Label for the HMAC key.

BarbicanPkcs11CryptoLibraryPath

Path to vendor PKCS11 library.

BarbicanPkcs11CryptoLogin

Password (PIN) to login to PKCS#11 session.

BarbicanPkcs11CryptoLunasaEnabled

Enable Luna SA HSM for PKCS11. The default value is false.

BarbicanPkcs11CryptoMKEKLabel

Label for Master KEK.

BarbicanPkcs11CryptoMKEKLength

Length of Master KEK in bytes. The default value is 256.

BarbicanPkcs11CryptoOsLockingOk

Set CKF_OS_LOCKING_OK flag when initializing the client library. The default value is false.

BarbicanPkcs11CryptoRewrapKeys

Cryptoki Mechanism used to generate Master HMAC Key. The default value is false.

BarbicanPkcs11CryptoSlotId

Slot Id for the PKCS#11 token to be used. The default value is 0.

BarbicanPkcs11CryptoThalesEnabled

Enable Thales for PKCS11. The default value is false.

BarbicanPkcs11CryptoTokenLabel

(DEPRECATED) Use BarbicanPkcs11CryptoTokenLabels instead.

BarbicanPkcs11CryptoTokenLabels

List of comma separated labels for the tokens to be used. This is typically a single label, but some devices may require more than one label for Load Balancing and High Availability configurations.

BarbicanPkcs11CryptoTokenSerialNumber

Serial number for PKCS#11 token to be used.

BarbicanSimpleCryptoGlobalDefault

Whether this plugin is the global default plugin. The default value is false.

BarbicanSimpleCryptoKek

KEK used to encrypt secrets.

BarbicanWorkers

Set the number of workers for barbican::wsgi::apache. The default value is %{::processorcount}.

CertificateKeySize

Specifies the private key size used when creating the certificate. The default value is 2048.

EnableSQLAlchemyCollectd

Set to true to enable the SQLAlchemy-collectd server plugin. The default value is false.

LunasaClientIPNetwork

(Optional) When set OpenStack Key Manager (barbican) nodes will be registered with the HSMs using the IP from this network instead of the FQDN.

LunasaVars

Hash of lunasa-hsm role variables used to install Lunasa client software.

MemcacheUseAdvancedPool

Use the advanced (eventlet safe) memcached client pool. The default value is true.

NotificationDriver

Driver or drivers to handle sending notifications. The default value is noop.

ThalesHSMNetworkName

The network that the HSM is listening on. The default value is internal_api.

ThalesVars

Hash of thales_hsm role variables used to install Thales client software.

RpcCertificateKeySize

Override the private key size used when creating the certificate for this service.

RpcPassword

The password for messaging backend.

RpcPort

The network port for messaging backend. The default value is 5672.

RpcUserName

The username for messaging backend. The default value is guest.

RpcUseSSL

Messaging client subscriber parameter to specify an SSL connection to the messaging host. The default value is false.

CertificateKeySize

Specifies the private key size used when creating the certificate. The default value is 2048.

ContainerOvnCertificateKeySize

Override the private key size used when creating the certificate for this service.

DerivePciWhitelistEnabled

Whether to enable or not the pci passthrough whitelist automation. The default value is true.

DhcpAgentNotification

Enables DHCP agent notifications. The default value is false.

DockerAdditionalSockets

Additional domain sockets for the docker daemon to bind to (useful for mounting into containers that launch other containers). The default value is ['/var/lib/openstack/docker.sock'].

DockerNeutronDHCPAgentUlimit

Ulimit for OpenStack Networking (neutron) DHCP Agent Container. The default value is ['nofile=16384'].

DockerNeutronL3AgentUlimit

Ulimit for OpenStack Networking (neutron) L3 Agent Container. The default value is ['nofile=16384'].

DockerOpenvswitchUlimit

Ulimit for Openvswitch Container. The default value is ['nofile=16384'].

DockerPuppetMountHostPuppet

Whether containerized puppet executions use modules from the baremetal host. Defaults to true. Can be set to false to consume puppet modules from containers directly. The default value is true.

DockerSRIOVUlimit

Ulimit for SR-IOV Container. The default value is ['nofile=16384'].

EnableSQLAlchemyCollectd

Set to true to enable the SQLAlchemy-collectd server plugin. The default value is false.

EnableVLANTransparency

If True, then allow plugins that support it to create VLAN transparent networks. The default value is false.

EnforceSecureRbac

Setting this option to True will configure each OpenStack service to enforce Secure RBAC by setting [oslo_policy] enforce_new_defaults and [oslo_policy] enforce_scope to True. This introduces a consistent set of RBAC personas across OpenStack services that include support for system and project scope, as well as keystone’s default roles, admin, member, and reader. Do not enable this functionality until all services in your deployment actually support secure RBAC. The default value is false.

MemcacheUseAdvancedPool

Use the advanced (eventlet safe) memcached client pool. The default value is true.

NeutronAgentDownTime

Seconds to regard the agent as down; should be at least twice NeutronGlobalReportInterval, to be sure the agent is down for good. The default value is 600.

NeutronAgentExtensions

Comma-separated list of extensions enabled for the OpenStack Networking (neutron) agents. The default value is qos.

NeutronAllowL3AgentFailover

Allow automatic l3-agent failover. The default value is True.

NeutronApiOptEnvVars

Hash of optional environment variables.

NeutronApiOptVolumes

List of optional volumes to be mounted.

NeutronBridgeMappings

The logical to physical bridge mappings to use. The default (datacentre:br-ex) maps br-ex (the external bridge on hosts) to a physical name datacentre, which provider networks can use (for example, the default floating network). If changing this, either use different post-install network scripts or be sure to keep datacentre as a mapping network name. The default value is datacentre:br-ex.

NeutronCertificateKeySize

Override the private key size used when creating the certificate for this service.

NeutronCorePlugin

The core plugin for networking. The value should be the entrypoint to be loaded from neutron.core_plugins namespace. The default value is ml2.

NeutronDBSyncExtraParams

String of extra command line parameters to append to the neutron-db-manage upgrade head command.

NeutronDefaultAvailabilityZones

Comma-separated list of default network availability zones to be used by OpenStack Networking (neutron) if its resource is created without availability zone hints. If not set, no AZs will be configured for OpenStack Networking (neutron) network services.

NeutronDhcpAgentAvailabilityZone

Availability zone for OpenStack Networking (neutron) DHCP agent. If not set, no AZs will be configured for OpenStack Networking (neutron) network services.

NeutronDhcpAgentDnsmasqDnsServers

List of servers to use as dnsmasq forwarders.

NeutronDhcpAgentDnsmasqEnableAddr6List

Enable dhcp-host entry with list of addresses when port has multiple IPv6 addresses in the same subnet. The default value is true.

NeutronDhcpAgentsPerNetwork

The number of DHCP agents to schedule per network. The default value is 0.

NeutronDhcpCertificateKeySize

Override the private key size used when creating the certificate for this service.

NeutronDhcpLoadType

Additional to the availability zones aware network scheduler. The default value is networks.

NeutronDhcpOvsIntegrationBridge

Name of Open vSwitch bridge to use.

NeutronDhcpServerBroadcastReply

OpenStack Networking (neutron) DHCP agent to use broadcast in DHCP replies. The default value is false.

NeutronDnsDomain

Domain to use for building the hostnames. The default value is openstacklocal.

NeutronEnableARPResponder

Enable ARP responder feature in the OVS Agent. The default value is false.

NeutronEnableDnsmasqDockerWrapper

Generate a dnsmasq wrapper script so that OpenStack Networking (neutron) launches dnsmasq in a separate container. The default value is true.

NeutronEnableDVR

Enable Distributed Virtual Router.

NeutronEnableForceMetadata

If True, DHCP always provides metadata route to VM. The default value is false.

NeutronEnableHaproxyDockerWrapper

Generate a wrapper script so OpenStack Networking (neutron) launches haproxy in a separate container. The default value is true.

NeutronEnableIgmpSnooping

Enable IGMP Snooping. The default value is false.

NeutronEnableInternalDNS

If True, enable the internal OpenStack Networking (neutron) DNS server that provides name resolution between VMs. This parameter has no effect if NeutronDhcpAgentDnsmasqDnsServers is set. The default value is false.

NeutronEnableIsolatedMetadata

If True, DHCP allows metadata support on isolated networks. The default value is false.

NeutronEnableKeepalivedWrapper

Generate a wrapper script so OpenStack Networking (neutron) launches keepalived processes in a separate container. The default value is true.

NeutronEnableL2Pop

Enable/disable the L2 population feature in the OpenStack Networking (neutron) agents. The default value is False.

NeutronEnableMetadataNetwork

If True, DHCP provides metadata network. Requires either NeutronEnableIsolatedMetadata or NeutronEnableForceMetadata parameters to also be True. The default value is false.

NeutronExcludeDevices

List of <network_device>:<excluded_devices> mapping network_device to the agent’s node-specific list of virtual functions that should not be used for virtual networking. excluded_devices is a semicolon separated list of virtual functions to exclude from network_device. The network_device in the mapping should appear in the physical_device_mappings list.

NeutronFirewallDriver

Firewall driver for realizing OpenStack Networking (neutron) security group function.

NeutronFlatNetworks

Sets the flat network name to configure in plugins. The default value is datacentre.

NeutronGeneveMaxHeaderSize

Geneve encapsulation header size. The default value is 38.

NeutronGlobalPhysnetMtu

MTU of the underlying physical network. OpenStack Networking (neutron) uses this value to calculate MTU for all virtual network components. For flat and VLAN networks, OpenStack Networking uses this value without modification. For overlay networks such as VXLAN, OpenStack Networking automatically subtracts the overlay protocol overhead from this value. The default value is 0.

NeutronGlobalReportInterval

Seconds between nodes reporting state to server; should be less than NeutronAgentDownTime, best if it is half or less than NeutronAgentDownTime. The default value is 300.

NeutronInterfaceDriver

OpenStack Networking (neutron) DHCP Agent interface driver. The default value is neutron.agent.linux.interface.OVSInterfaceDriver.

NeutronL3AgentAvailabilityZone

Availability zone for OpenStack Networking (neutron) L3 agent. If not set, no AZs will be configured for OpenStack Networking (neutron) network services.

NeutronL3AgentExtensions

Comma-separated list of extensions enabled for the OpenStack Networking (neutron) L3 agent.

NeutronL3AgentLoggingBurstLimit

Maximum number of packets per rate_limit. The default value is 25.

NeutronL3AgentLoggingLocalOutputLogBase

Output logfile path on agent side, default syslog file.

NeutronL3AgentLoggingRateLimit

Maximum number of packets logging per second. The default value is 100.

NeutronL3AgentMode

Agent mode for L3 agent. Must be legacy or dvr_snat. The default value is legacy.

NeutronL3AgentRadvdUser

The username passed to radvd, used to drop root privileges and change user ID to username and group ID to the primary group of username. If no user specified, the user executing the L3 agent will be passed. If "root" specified, because radvd is spawned as root, no "username" parameter will be passed. The default value is root.

NeutronMechanismDrivers

The mechanism drivers for the OpenStack Networking (neutron) tenant network. The default value is ovn.

NeutronMetadataProxySharedSecret

Shared secret to prevent spoofing.

NeutronMetadataWorkers

Sets the number of worker processes for the OpenStack Networking (neutron) OVN metadata agent. The default value results in the configuration being left unset and a system-dependent default will be chosen (usually the number of processors). Please note that this can result in a large number of processes and memory consumption on systems with a large core count. On such systems it is recommended that a non-default value be selected that matches the load requirements.

NeutronML2PhysicalNetworkMtus

A list of mappings of physical networks to MTU values. The format of the mapping is <physnet>:<mtu val>. This mapping allows you to specify a physical network MTU value that differs from the default segment_mtu value in ML2 plugin and overwrites values from global_physnet_mtu for the selected network.

NeutronNetworkSchedulerDriver

The network schedule driver to use for availability zones. The default value is neutron.scheduler.dhcp_agent_scheduler.AZAwareWeightScheduler.

NeutronNetworkType

The tenant network type for OpenStack Networking (neutron). The default value is geneve. If you change this value, make sure the new value matches the parameter OVNEncapType. For example, if you want to use VXLAN instead of Geneve in an ML2/OVN environment, ensure that both NeutronNetworkType and OVNEncapType are set to vxlan. The default value is geneve.

NeutronNetworkVLANRanges

The OpenStack Networking (neutron) ML2 and Open vSwitch VLAN mapping range to support. Defaults to permitting any VLAN on the datacentre physical network (See NeutronBridgeMappings). The default value is datacentre:1:1000.

NeutronOverlayIPVersion

IP version used for all overlay network endpoints. The default value is 4.

NeutronOVNLoggingBurstLimit

Maximum number of packets per rate_limit. The default value is 25.

NeutronOVNLoggingLocalOutputLogBase

Output logfile path on agent side, default syslog file.

NeutronOVNLoggingRateLimit

Maximum number of packets logging per second. The default value is 100.

NeutronOVSAgentLoggingBurstLimit

Maximum number of packets per rate_limit. The default value is 25.

NeutronOVSAgentLoggingLocalOutputLogBase

Output logfile path on agent side, default syslog file.

NeutronOVSAgentLoggingRateLimit

Maximum number of packets logging per second. The default value is 100.

NeutronOVSFirewallDriver

Configure the classname of the firewall driver to use for implementing security groups. Possible values depend on system configuration. Some examples are: noop, openvswitch, iptables_hybrid. The default value of an empty string results in a default supported configuration.

NeutronOvsIntegrationBridge

Name of Open vSwitch bridge to use.

NeutronOvsResourceProviderBandwidths

Comma-separated list of <bridge>:<egress_bw>:<ingress_bw> tuples, showing the available bandwidth for the given bridge in the given direction. The direction is meant from VM perspective. Bandwidth is measured in kilobits per second (kbps). The bridge must appear in bridge_mappings as the value.

NeutronOVSTunnelCsum

Set or un-set the tunnel header checksum on outgoing IP packet carrying GRE/VXLAN tunnel. The default value is false.

NeutronOvsVnicTypeBlacklist

Comma-separated list of VNIC types for which support in OpenStack Networking (neutron) is administratively prohibited by the OVS mechanism driver.

NeutronPassword

The password for the OpenStack Networking (neutron) service and database account.

NeutronPermittedEthertypes

Set additional ethertypes to to be configured on OpenStack Networking (neutron) firewalls.

NeutronPhysicalDevMappings

List of <physical_network>:<physical device> All physical networks listed in network_vlan_ranges on the server should have mappings to appropriate interfaces on each agent. Example "tenant0:ens2f0,tenant1:ens2f1".

NeutronPluginExtensions

Comma-separated list of enabled extension plugins. The default value is qos,port_security,dns_domain_ports.

NeutronPluginMl2PuppetTags

Puppet resource tag names that are used to generate configuration files with puppet. The default value is neutron_plugin_ml2.

NeutronPortQuota

Number of ports allowed per tenant, and minus means unlimited. The default value is 500.

NeutronRouterSchedulerDriver

The router schedule driver to use for availability zones. The default value is neutron.scheduler.l3_agent_scheduler.AZLeastRoutersScheduler.

NeutronRpcWorkers

Sets the number of RPC workers for the OpenStack Networking (neutron) service. If not specified, it’ll take the value of NeutronWorkers and if this is not specified either, the default value results in the configuration being left unset and a system-dependent default will be chosen (usually 1).

NeutronSecurityGroupQuota

Number of security groups allowed per tenant, and minus means unlimited. The default value is 10.

NeutronServicePlugins

Comma-separated list of service plugin entrypoints. The default value is qos,ovn-router,trunk,segments,port_forwarding,log.

NeutronSriovAgentExtensions

Comma-separated list of extensions enabled for the OpenStack Networking (neutron) SR-IOV agents.

NeutronSriovResourceProviderBandwidths

Comma-separated list of <network_device>:<egress_bw>:<ingress_bw> tuples, showing the available bandwidth for the given device in the given direction. The direction is meant from VM perspective. Bandwidth is measured in kilobits per second (kbps). The device must appear in physical_device_mappings as the value.

NeutronSriovVnicTypeBlacklist

Comma-separated list of VNIC types for which support in OpenStack Networking (neutron) is administratively prohibited by the SR-IOV mechanism driver.

NeutronTunnelIdRanges

Comma-separated list of <tun_min>:<tun_max> tuples enumerating ranges of GRE tunnel IDs that are available for tenant network allocation. The default value is ['1:4094'].

NeutronTunnelTypes

The tunnel types for the OpenStack Networking (neutron) tenant network. The default value is vxlan.

NeutronTypeDrivers

Comma-separated list of network type driver entrypoints to be loaded. The default value is geneve,vxlan,vlan,flat.

NeutronVhostuserSocketDir

The vhost-user socket directory for OVS.

NeutronVniRanges

Comma-separated list of <vni_min>:<vni_max> tuples enumerating ranges of VXLAN VNI IDs that are available for tenant network allocation. The default value is ['1:65536'].

NeutronWorkers

Sets the number of API and RPC workers for the OpenStack Networking service. Note that more workers creates a larger number of processes on systems, which results in excess memory consumption. It is recommended to choose a suitable non-default value on systems with high CPU core counts. 0 sets to the OpenStack internal default, which is equal to the number of CPU cores on the node.

NotificationDriver

Driver or drivers to handle sending notifications. The default value is noop.

OVNAvailabilityZone

The az options to configure in ovs db. eg. [az-0, az-1, az-2].

OVNCMSOptions

The CMS options to configure in ovs db.

OVNContainerCpusetCpus

Limit the specific CPUs or cores a container can use. It can be specified as a single core (ex. 0), as a comma-separated list (ex. 0,1), as a range (ex. 0-3) or a combination if previous methods (ex 0-3,7,11-15). The selected cores should be isolated from guests and hypervisor in order to obtain best possible performance.

OVNControllerImageUpdateTimeout

During update, how long we wait for the container image to be updated, in seconds. The default value is 600.

OVNControllerUpdateTimeout

During update, how long we wait for the container to be updated, in seconds. The default value is 600.

OVNDbConnectionTimeout

Timeout in seconds for the OVSDB connection transaction. The default value is 180.

OvnDBSCertificateKeySize

Override the private key size used when creating the certificate for this service.

OVNDnsServers

List of servers to use as as dns forwarders.

OVNEmitNeedToFrag

Configure OVN to emit "need to frag" packets in case of MTU mismatch. Before enabling this configuration make sure that it’s supported by the host kernel (version >= 5.2) or by checking the output of the following command ovs-appctl -t ovs-vswitchd dpif/show-dp-features br-int | grep "Check pkt length action". The default value is false.

OVNEnableHaproxyDockerWrapper

Generate a wrapper script so that haproxy is launched in a separate container. The default value is true.

OVNEncapTos

The value to be applied to OVN tunnel interface’s option:tos as specified in the Open_vSwitch database Interface table. This feature is supported from OVN v21.12.0. The default value is 0.

OVNEncapType

Type of encapsulation used in OVN. It can be geneve or vxlan. The default value is geneve. If you change this value, make sure the new value is also listed in the parameter NeutronNetworkType. For example, if you change OVNEncapType to vxlan, ensure that the list in NeutronNetworkType includes vxlan. The default value is geneve.

OvnHardwareOffloadedQos

Enable the QoS support for hardware offloaded ports. The default value is false.

OVNIntegrationBridge

Name of the OVS bridge to use as integration bridge by OVN Controller. The default value is br-int.

OvnMetadataCertificateKeySize

Override the private key size used when creating the certificate for this service.

OVNMetadataEnabled

Whether Metadata Service has to be enabled. The default value is true.

OVNNeutronSyncMode

The synchronization mode of OVN with OpenStack Networking (neutron) DB. The default value is log.

OVNNorthboundClusterPort

Cluster port of the OVN Northbound DB server. The default value is 6643.

OVNNorthboundServerPort

Port of the OVN Northbound DB server. The default value is 6641.

OVNOfctrlWaitBeforeClear

Sets the time ovn-controller will wait on startup before clearing all openflow rules and installing the new ones, in ms. The default value is 8000.

OVNOpenflowProbeInterval

The inactivity probe interval of the OpenFlow connection to the OpenvSwitch integration bridge, in seconds. The default value is 60.

OVNOvsdbProbeInterval

Probe interval in ms for the OVSDB session. The default value is 60000.

OVNQosDriver

OVN notification driver for OpenStack Networking (neutron) QOS service plugin. The default value is ovn-qos.

OVNRemoteProbeInterval

Probe interval in ms. The default value is 60000.

OVNSouthboundClusterPort

Cluster port of the OVN Southbound DB server. The default value is 6644.

OVNSouthboundServerPort

Port of the OVN Southbound DB server. The default value is 6642.

OVNStaticBridgeMacMappings

Static OVN Bridge MAC address mappings. Unique OVN bridge mac addresses is dynamically allocated by creating OpenStack Networking (neutron) ports. When OpenStack Networking (neutron) isn’t available, for instance in the standalone deployment, use this parameter to provide static OVN bridge mac addresses. For example: controller-0: datacenter: 00:00:5E:00:53:00 provider: 00:00:5E:00:53:01 compute-0: datacenter: 00:00:5E:00:54:00 provider: 00:00:5E:00:54:01.

OvsDisableEMC

Disable OVS Exact Match Cache. The default value is false.

OvsHwOffload

Enable OVS Hardware Offload. This feature supported from OVS 2.8.0. The default value is false.

PythonInterpreter

The python interpreter to use for python and ansible actions. The default value is `$(command -v python3

command -v python)`.

TenantNetPhysnetMtu

MTU of the underlying physical network. OpenStack Networking (neutron) uses this value to calculate MTU for all virtual network components. For flat and VLAN networks, OpenStack Networking (neutron) uses this value without modification. For overlay networks such as VXLAN, OpenStack Networking (neutron) automatically subtracts the overlay protocol overhead from this value. (The mtu setting of the Tenant network in network_data.yaml control’s this parameter.). The default value is 1500.

EnforceSecureRbac

Setting this option to True will configure each OpenStack service to enforce Secure RBAC by setting [oslo_policy] enforce_new_defaults and [oslo_policy] enforce_scope to True. This introduces a consistent set of RBAC personas across OpenStack services that include support for system and project scope, as well as keystone’s default roles, admin, member, and reader. Do not enable this functionality until all services in your deployment actually support secure RBAC. The default value is false.

MemcachedTLS

Set to True to enable TLS on Memcached service. Because not all services support Memcached TLS, during the migration period, Memcached will listen on 2 ports - on the port set with MemcachedPort parameter (above) and on 11211, without TLS. The default value is false.

SwiftAccountWorkers

Number of workers for Swift account service. The default value is 0.

SwiftCeilometerIgnoreProjects

Comma-seperated list of project names to ignore. The default value is ['service'].

SwiftCeilometerPipelineEnabled

Set to False to disable the object storage proxy ceilometer pipeline. The default value is false.

SwiftContainerSharderEnabled

Set to True to enable Swift container sharder service. The default value is false.

SwiftContainerWorkers

Number of workers for Swift account service. The default value is 0.

SwiftCorsAllowedOrigin

Indicate whether this resource may be shared with the domain received in the request "origin" header.

SwiftEncryptionEnabled

Set to True to enable data-at-rest encryption in Swift. The default value is false.

SwiftHashPrefix

A random string to be used as an extra salt when hashing to determine mappings in the ring.

SwiftHashSuffix

A random string to be used as a salt when hashing to determine mappings in the ring.

SwiftMinPartHours

The minimum time (in hours) before a partition in a ring can be moved following a rebalance. The default value is 1.

SwiftMountCheck

Check if the devices are mounted to prevent accidentally writing to the root device. The default value is false.

SwiftObjectWorkers

Number of workers for Swift account service. The default value is 0.

SwiftPartPower

Partition power to use when building object storage rings. The default value is 10.

SwiftPassword

The password for the object storage service account.

SwiftProxyNodeTimeout

Timeout for requests going from swift-proxy to account, container, and object services. The default value is 60.

SwiftProxyRecoverableNodeTimeout

Timeout for GET/HEAD requests going from swift-proxy to swift a/c/o services. The default value is 30.

SwiftRawDisks

Additional raw devices to use for the object storage backend. For example: {sdb: {}}

SwiftReplicas

Number of replicas to use in the object storage rings. The default value is 3.

SwiftRingBuild

Whether to manage object storage rings or not. The default value is true.

SwiftRingGetTempurl

A temporary Swift URL to download rings from.

SwiftRingPutTempurl

A temporary Swift URL to upload rings to.

SwiftUseLocalDir

Use a local directory for object storage services when building rings. The default value is true.

SwiftUseNodeDataLookup

Use NodeDataLookup for disk devices in order to use persistent naming. The default value is false.

SwiftWorkers

Number of workers for object storage service. Note that more workers creates a larger number of processes on systems, which results in excess memory consumption. It is recommended to choose a suitable non-default value on systems with high CPU core counts. 0 sets to the OpenStack internal default, which is equal to the number of CPU cores on the node. The default value is 0.

ApacheCertificateKeySize

Override the private key size used when creating the certificate for this service.

ApacheTimeout

The timeout in seconds for Apache, which defines duration Apache waits for I/O operations. The default value is 90.

CertificateKeySize

Specifies the private key size used when creating the certificate. The default value is 2048.

ClientRetryLimit

Client retries for transient errors. The default value is 2.

EnableCache

Enable caching with memcached. The default value is true.

EnableSQLAlchemyCollectd

Set to true to enable the SQLAlchemy-collectd server plugin. The default value is false.

EnforceSecureRbac

Setting this option to True will configure each OpenStack service to enforce Secure RBAC by setting [oslo_policy] enforce_new_defaults and [oslo_policy] enforce_scope to True. This introduces a consistent set of RBAC personas across OpenStack services that include support for system and project scope, as well as keystone’s default roles, admin, member, and reader. Do not enable this functionality until all services in your deployment actually support secure RBAC. The default value is false.

HeatApiOptEnvVars

Hash of optional environment variables.

HeatApiOptVolumes

List of optional volumes to be mounted.

HeatAuthEncryptionKey

Auth encryption key for heat-engine.

HeatConfigureDelegatedRoles

Create delegated roles. The default value is false.

HeatConvergenceEngine

Enables the heat engine with the convergence architecture. The default value is true.

HeatCorsAllowedOrigin

Indicate whether this resource may be shared with the domain received in the request "origin" header.

HeatCronPurgeDeletedAge

Cron to purge database entries marked as deleted and older than $age - Age. The default value is 30.

HeatCronPurgeDeletedAgeType

Cron to purge database entries marked as deleted and older than $age - Age type. The default value is days.

HeatCronPurgeDeletedDestination

Cron to purge database entries marked as deleted and older than $age - Log destination. The default value is /dev/null.

HeatCronPurgeDeletedEnsure

Cron to purge database entries marked as deleted and older than $age - Ensure. The default value is present.

HeatCronPurgeDeletedHour

Cron to purge database entries marked as deleted and older than $age - Hour. The default value is 0.

HeatCronPurgeDeletedMaxDelay

Cron to purge database entries marked as deleted and older than $age - Max Delay. The default value is 3600.

HeatCronPurgeDeletedMinute

Cron to purge database entries marked as deleted and older than $age - Minute. The default value is 1.

HeatCronPurgeDeletedMonth

Cron to purge database entries marked as deleted and older than $age - Month. The default value is *.

HeatCronPurgeDeletedMonthday

Cron to purge database entries marked as deleted and older than $age - Month Day. The default value is *.

HeatCronPurgeDeletedUser

Cron to purge database entries marked as deleted and older than $age - User. The default value is heat.

HeatCronPurgeDeletedWeekday

Cron to purge database entries marked as deleted and older than $age - Week Day. The default value is *.

HeatEnableDBPurge

Whether to create cron job for purging soft deleted rows in the OpenStack Orchestration (heat) database. The default value is true.

HeatEngineOptEnvVars

Hash of optional environment variables.

HeatEngineOptVolumes

List of optional volumes to be mounted.

HeatEnginePluginDirs

An array of directories to search for plug-ins.

HeatMaxJsonBodySize

Maximum raw byte size of the OpenStack Orchestration (heat) API JSON request body. The default value is 4194304.

HeatMaxNestedStackDepth

Maximum number of nested stack depth. The default value is 6.

HeatMaxResourcesPerStack

Maximum resources allowed per top-level stack. -1 stands for unlimited. The default value is 1000.

HeatPassword

The password for the Orchestration service and database account.

HeatReauthenticationAuthMethod

Allow reauthentication on token expiry, such that long-running tasks may complete. Note this defeats the expiry of any provided user tokens.

HeatStackDomainAdminPassword

The admin password for the OpenStack Orchestration (heat) domain in OpenStack Identity (keystone).

HeatWorkers

Number of workers for OpenStack Orchestration (heat) service. Note that more workers creates a larger number of processes on systems, which results in excess memory consumption. It is recommended to choose a suitable non-default value on systems with high CPU core counts. 0 sets to the OpenStack internal default, which is equal to the number of CPU cores on the node. The default value is 0.

HeatYaqlLimitIterators

The maximum number of elements in collection yaql expressions can take for its evaluation. The default value is 1000.

HeatYaqlMemoryQuota

The maximum size of memory in bytes that yaql exrpessions can take for its evaluation. The default value is 100000.

MemcachedTLS

Set to True to enable TLS on Memcached service. Because not all services support Memcached TLS, during the migration period, Memcached will listen on 2 ports - on the port set with MemcachedPort parameter (above) and on 11211, without TLS. The default value is false.

MemcacheUseAdvancedPool

Use the advanced (eventlet safe) memcached client pool. The default value is true.

NotificationDriver

Driver or drivers to handle sending notifications. The default value is noop.

ApacheCertificateKeySize

Override the private key size used when creating the certificate for this service.

ApacheTimeout

The timeout in seconds for Apache, which defines duration Apache waits for I/O operations. The default value is 90.

CephClusterName

The Ceph cluster name. The default value is ceph.

CephConfigPath

The path where the Ceph Cluster configuration files are stored on the host. The default value is /var/lib/tripleo-config/ceph.

CertificateKeySize

Specifies the private key size used when creating the certificate. The default value is 2048.

EnableSQLAlchemyCollectd

Set to true to enable the SQLAlchemy-collectd server plugin. The default value is false.

ManilaCephClientUserName

Ceph client username for manila integration. The default value is manila.

ManilaCephFSCephFSProtocolHelperType

Protocol type (CEPHFS or NFS) when cephfs back end is enabled. Set via manila cephfs environment files. The default value is CEPHFS.

ManilaCronDbPurgeAge

Cron to purge database entries marked as deleted and older than $age - Age. The default value is 30.

ManilaCronDbPurgeDestination

Cron to purge database entries marked as deleted and older than $age - Log destination. The default value is /var/log/manila/manila-rowsflush.log.

ManilaCronDbPurgeHour

Cron to purge database entries marked as deleted and older than $age - Hour. The default value is 0.

ManilaCronDbPurgeMaxDelay

Cron to purge database entries marked as deleted and older than $age - Max Delay. The default value is 3600.

ManilaCronDbPurgeMinute

Cron to purge database entries marked as deleted and older than $age - Minute. The default value is 1.

ManilaCronDbPurgeMonth

Cron to purge database entries marked as deleted and older than $age - Month. The default value is *.

ManilaCronDbPurgeMonthday

Cron to purge database entries marked as deleted and older than $age - Month Day. The default value is *.

ManilaCronDbPurgeUser

Cron to purge database entries marked as deleted and older than $age - User. The default value is manila.

ManilaCronDbPurgeWeekday

Cron to purge database entries marked as deleted and older than $age - Week Day. The default value is *.

ManilaEnabledShareProtocols

List of protocols to be allowed for share creation in manila. When not set, the list is inferred via the storage back end/s enabled.

ManilaIPv6

Set to True to enable IPv6 access in manila. The default value is False.

ManilaPassword

The password for the shared file service account.

ManilaStorageAvailabilityZone

The OpenStack Shared File Systems (manila) service’s storage availability zone. The default value is nova.

ManilaWorkers

Set the number of workers for manila::wsgi::apache. The default value is equal to the number of vCPU cores on the physical node.

MemcacheUseAdvancedPool

Use the advanced (eventlet safe) memcached client pool. The default value is true.

NotificationDriver

Driver or drivers to handle sending notifications. The default value is noop.

ChronyAclRules

Access Control List of NTP clients. By default no clients are permitted. The default value is ['deny all'].

ChronyGlobalPoolOptions

Default pool options for the configured NTP pools in chrony.conf. If this is specified, NtpIburstEnable, MaxPoll, and MinPoll are ignored.

ChronyGlobalServerOptions

Default server options for the configured NTP servers in chrony.conf. If this is specified, NtpIburstEnable, MaxPoll, and MinPoll are ignored.

EnablePackageInstall

Set to true to enable package installation at deploy time. The default value is false.

MaxPoll

Specify maximum poll interval of upstream servers for NTP messages, in seconds to the power of two. Allowed values are 4 to 17. The default value is 10.

MinPoll

Specify minimum poll interval of upstream servers for NTP messages, in seconds to the power of two. The minimum poll interval defaults to 6 (64 s). Allowed values are 4 to 17. The default value is 6.

NtpIburstEnable

Specifies whether to enable the iburst option for every NTP peer. If iburst is enabled, when the NTP server is unreachable NTP will send a burst of eight packages instead of one. This is designed to speed up the initial syncrhonization. The default value is true.

NtpPool

NTP pool list. Defaults to [], so only NtpServer is used by default.

NtpServer

NTP servers list. The default value is ['0.pool.ntp.org', '1.pool.ntp.org', '2.pool.ntp.org', '3.pool.ntp.org'].

TimeZone

The timezone to be set on the overcloud. The default value is UTC.

UpgradeInitCommand

Command or script snippet to run on all overcloud nodes to initialize the upgrade process. For example, a repository switch.

UpgradeInitCommonCommand

Common commands required by the upgrades process. This should not normally be modified by the operator and is set and unset in the major-upgrade-composable-steps.yaml and major-upgrade-converge.yaml environment files.

UpgradeLeappCommandOptions

Additional command line options to append to the Leapp command.

UpgradeLeappDebug

Print debugging output when running Leapp. The default value is false.

UpgradeLeappDevelSkip

Skip Leapp checks by setting env variables when running Leapp in development/testing. For example, LEAPP_DEVEL_SKIP_RHSM=1.

UpgradeLeappEnabled

Use Leapp for operating system upgrade. The default value is false.

UpgradeLeappPostRebootDelay

Maximum (seconds) to wait for machine to reboot and respond to a test command. The default value is 120.

UpgradeLeappRebootTimeout

Timeout (seconds) for the OS upgrade phase via Leapp. The default value is 3600.

UpgradeLeappToInstall

List of packages to install after Leapp upgrade.

UpgradeLeappToRemove

List of packages to remove during Leapp upgrade.