Red Hat SummitChapter 9. Networking
This chapter explains the OpenStack Networking configuration options.
9.1. Networking configuration options
Copy linkLink copied to clipboard!
The options and descriptions listed in this introduction are auto generated from the code in the Networking service project, which provides software-defined networking between VMs run in Compute. The list contains common options, while the subsections list the options for the various networking plug-ins.
| Configuration option = Default value | Description |
|---|---|
[DEFAULT]
|
|
agent_down_time = 75
|
(Integer) Seconds to regard the agent is down; should be at least twice report_interval, to be sure the agent is down for good. |
api_workers = None
|
(Integer) Number of separate API worker processes for service. If not specified, the default is equal to the number of CPUs available for best performance. |
auth_ca_cert = None
|
(String) Certificate Authority public key (CA cert) file for ssl |
auth_strategy = keystone
|
(String) The type of authentication to use |
base_mac = fa:16:3e:00:00:00
|
(String) The base MAC address Neutron will use for VIFs. The first 3 octets will remain unchanged. If the 4th octet is not 00, it will also be used. The others will be randomly generated. |
bgp_drscheduler_driver = neutron.services.bgp.scheduler.bgp_dragent_scheduler.ChanceScheduler
|
(String) Driver used for scheduling BGP speakers to BGP DrAgent |
bind_host = 0.0.0.0
|
(String) The host IP to bind to |
bind_port = 9696
|
(Port number) The port to bind to |
core_plugin = None
|
(String) The core plugin Neutron will use |
default_availability_zones =
|
(List) Default value of availability zone hints. The availability zone aware schedulers use this when the resources availability_zone_hints is empty. Multiple availability zones can be specified by a comma separated string. This value can be empty. In this case, even if availability_zone_hints for a resource is empty, availability zone is considered for high availability while scheduling the resource. |
default_ipv4_subnet_pool = None
|
(String) DEPRECATED: Default IPv4 subnet pool to be used for automatic subnet CIDR allocation. Specifies by UUID the pool to be used in case where creation of a subnet is being called without a subnet pool ID. If not set then no pool will be used unless passed explicitly to the subnet create. If no pool is used, then a CIDR must be passed to create a subnet and that subnet will not be allocated from any pool; it will be considered part of the tenant's private address space. This option is deprecated for removal in the N release. |
default_ipv6_subnet_pool = None
|
(String) DEPRECATED: Default IPv6 subnet pool to be used for automatic subnet CIDR allocation. Specifies by UUID the pool to be used in case where creation of a subnet is being called without a subnet pool ID. See the description for default_ipv4_subnet_pool for more information. This option is deprecated for removal in the N release. |
dhcp_agent_notification = True
|
(Boolean) Allow sending resource operation notification to DHCP agent |
dhcp_agents_per_network = 1
|
(Integer) Number of DHCP agents scheduled to host a tenant network. If this number is greater than 1, the scheduler automatically assigns multiple DHCP agents for a given tenant network, providing high availability for DHCP service. |
dhcp_broadcast_reply = False
|
(Boolean) Use broadcast in DHCP replies. |
dhcp_confs = $state_path/dhcp
|
(String) Location to store DHCP server config files. |
dhcp_domain = openstacklocal
|
(String) DEPRECATED: Domain to use for building the hostnames. This option is deprecated. It has been moved to neutron.conf as dns_domain. It will be removed in a future release. |
dhcp_lease_duration = 86400
|
(Integer) DHCP lease duration (in seconds). Use -1 to tell dnsmasq to use infinite lease times. |
dhcp_load_type = networks
|
(String) Representing the resource type whose load is being reported by the agent. This can be "networks", "subnets" or "ports". When specified (Default is networks), the server will extract particular load sent as part of its agent configuration object from the agent report state, which is the number of resources being consumed, at every report_interval.dhcp_load_type can be used in combination with network_scheduler_driver = neutron.scheduler.dhcp_agent_scheduler.WeightScheduler When the network_scheduler_driver is WeightScheduler, dhcp_load_type can be configured to represent the choice for the resource being balanced. Example: dhcp_load_type=networks |
dns_domain = openstacklocal
|
(String) Domain to use for building the hostnames |
enable_new_agents = True
|
(Boolean) Agent starts with admin_state_up=False when enable_new_agents=False. In the case, user's resources will not be scheduled automatically to the agent until admin changes admin_state_up to True. |
enable_services_on_agents_with_admin_state_down = False
|
(Boolean) Enable services on an agent with admin_state_up False. If this option is False, when admin_state_up of an agent is turned False, services on it will be disabled. Agents with admin_state_up False are not selected for automatic scheduling regardless of this option. But manual scheduling to such agents is available if this option is True. |
executor_thread_pool_size = 64
|
(Integer) Size of executor thread pool. |
external_dns_driver = None
|
(String) Driver for external DNS integration. |
global_physnet_mtu = 1500
|
(Integer) MTU of the underlying physical network. Neutron uses this value to calculate MTU for all virtual network components. For flat and VLAN networks, neutron uses this value without modification. For overlay networks such as VXLAN, neutron automatically subtracts the overlay protocol overhead from this value. Defaults to 1500, the standard value for Ethernet. If using the ML2 plug-in with overlay/tunnel networks, also configure the ml2 path_mtu option with the same value as the global_physnet_mtu option. |
ip_lib_force_root = False
|
(Boolean) Force ip_lib calls to use the root helper |
ipam_driver = None
|
(String) Neutron IPAM (IP address management) driver to use. If ipam_driver is not set (default behavior), no IPAM driver is used. In order to use the reference implementation of Neutron IPAM driver, use 'internal'. |
mac_generation_retries = 16
|
(Integer) How many times Neutron will retry MAC generation |
max_allowed_address_pair = 10
|
(Integer) Maximum number of allowed address pairs |
max_dns_nameservers = 5
|
(Integer) Maximum number of DNS nameservers per subnet |
max_fixed_ips_per_port = 5
|
(Integer) DEPRECATED: Maximum number of fixed ips per port. This option is deprecated and will be removed in the N release. |
max_rtr_adv_interval = 100
|
(Integer) MaxRtrAdvInterval setting for radvd.conf |
max_subnet_host_routes = 20
|
(Integer) Maximum number of host routes per subnet |
memcached_servers = None
|
(List) Memcached servers or None for in process cache. |
min_rtr_adv_interval = 30
|
(Integer) MinRtrAdvInterval setting for radvd.conf |
periodic_fuzzy_delay = 5
|
(Integer) Range of seconds to randomly delay when starting the periodic task scheduler to reduce stampeding. (Disable by setting to 0) |
periodic_interval = 40
|
(Integer) Seconds between running periodic tasks |
report_interval = 300
|
(Integer) Interval between two metering reports |
state_path = /var/lib/neutron
|
(String) Where to store Neutron state files. This directory must be writable by the agent. |
vlan_transparent = False
|
(Boolean) If True, then allow plugins that support it to create VLAN transparent networks. |
web_framework = legacy
|
(String) This will choose the web framework in which to run the Neutron API server. 'pecan' is a new experiemental rewrite of the API server. |
[AGENT]
|
|
check_child_processes_action = respawn
|
(String) Action to be executed when a child process dies |
check_child_processes_interval = 60
|
(Integer) Interval between checks of child process liveness (seconds), use 0 to disable |
log_agent_heartbeats = False
|
(Boolean) Log agent heartbeats |
polling_interval = 2
|
(Integer) The number of seconds the agent will wait between polling for local device changes. |
root_helper = sudo
|
(String) Root helper application. Use 'sudo neutron-rootwrap /etc/neutron/rootwrap.conf' to use the real root filter facility. Change to 'sudo' to skip the filtering and just run the command directly. |
root_helper_daemon = None
|
(String) Root helper daemon application to use when possible. |
[keystone_authtoken]
|
|
memcached_servers = None
|
(List) Optionally specify a list of memcached server(s) to use for caching. If left undefined, tokens will instead be cached in-process. |
[qos]
|
|
notification_drivers = message_queue
|
(List) Drivers list to use to send the update notification |
[service_providers]
|
|
service_provider = []
|
(Multi-valued) Defines providers for advanced services using the format: <service_type>:<name>:<driver>[:default] |
9.1.1. Networking plug-ins
Copy linkLink copied to clipboard!
OpenStack Networking introduces the concept of a plug-in, which is a back-end implementation of the OpenStack Networking API. A plug-in can use a variety of technologies to implement the logical API requests. Some OpenStack Networking plug-ins might use basic Linux VLANs and IP tables, while others might use more advanced technologies, such as L2-in-L3 tunneling or OpenFlow. These sections detail the configuration options for the various plug-ins.
Note
The following plugins have been removed in Kilo:
- Ryu plugin. The Ryu team recommends that you migrate to the ML2 plugin with the ofagent mechanism driver. However, note that the functionality is not the same. There is no upgrade procedure currently available.
- Mellanox plugin.
9.1.1.1. BaGpipe configuration options
Copy linkLink copied to clipboard!
| Configuration option = Default value | Description |
|---|---|
| [BAGPIPE] | |
bagpipe_bgp_ip = 127.0.0.1
|
(StrOpt) BGP component REST service IP address. |
bagpipe_bgp_port = 8082
|
(IntOpt) BGP component REST service IP port. |
mpls_bridge = br-mpls
|
(StrOpt) OVS MPLS bridge to use. |
mpls_from_tun_peer_patch_port = patch-from-tun
|
(StrOpt) OVS Peer patch port in MPLS bridge to tunnel bridge (traffic from tunnel bridge). |
mpls_to_tun_peer_patch_port = patch-to-tun
|
(StrOpt) OVS Peer patch port in MPLS bridge to tunnel bridge(traffic to tunnel bridge). |
ping_interval = 10
|
(IntOpt) The number of seconds the BGP component client will wait between polling for restart detection. |
tun_from_mpls_peer_patch_port = patch-from-mpls
|
(StrOpt) OVS Peer patch port in tunnel bridge to MPLS bridge (traffic from MPLS bridge). |
tun_to_mpls_peer_patch_port = patch-to-mpls
|
(StrOpt) OVS Peer patch port in tunnel bridge to MPLS bridge (traffic to MPLS bridge). |
9.1.1.2. BigSwitch configuration options
Copy linkLink copied to clipboard!
| Configuration option = Default value | Description |
|---|---|
| [NOVA] | |
node_override_vif_802.1qbg =
|
(ListOpt) Nova compute nodes to manually set VIF type to 802.1qbg |
node_override_vif_802.1qbh =
|
(ListOpt) Nova compute nodes to manually set VIF type to 802.1qbh |
node_override_vif_binding_failed =
|
(ListOpt) Nova compute nodes to manually set VIF type to binding_failed |
node_override_vif_bridge =
|
(ListOpt) Nova compute nodes to manually set VIF type to bridge |
node_override_vif_distributed =
|
(ListOpt) Nova compute nodes to manually set VIF type to distributed |
node_override_vif_dvs =
|
(ListOpt) Nova compute nodes to manually set VIF type to dvs |
node_override_vif_hw_web =
|
(ListOpt) Nova compute nodes to manually set VIF type to hw_web |
node_override_vif_hyperv =
|
(ListOpt) Nova compute nodes to manually set VIF type to hyperv |
node_override_vif_ib_hostdev =
|
(ListOpt) Nova compute nodes to manually set VIF type to ib_hostdev |
node_override_vif_iovisor =
|
(ListOpt) Nova compute nodes to manually set VIF type to iovisor |
node_override_vif_ivs =
|
(ListOpt) Nova compute nodes to manually set VIF type to ivs |
node_override_vif_midonet =
|
(ListOpt) Nova compute nodes to manually set VIF type to midonet |
node_override_vif_other =
|
(ListOpt) Nova compute nodes to manually set VIF type to other |
node_override_vif_ovs =
|
(ListOpt) Nova compute nodes to manually set VIF type to ovs |
node_override_vif_unbound =
|
(ListOpt) Nova compute nodes to manually set VIF type to unbound |
node_override_vif_vhostuser =
|
(ListOpt) Nova compute nodes to manually set VIF type to vhostuser |
node_override_vif_vrouter =
|
(ListOpt) Nova compute nodes to manually set VIF type to vrouter |
vif_type = ivs
|
(StrOpt) Virtual interface type to configure on Nova compute nodes |
vif_types = unbound, binding_failed, distributed, ovs, bridge, other, ivs, iovisor, vhostuser, dvs, 802.1qbg, 802.1qbh, hyperv, midonet, ib_hostdev, hw_web, vrouter
|
(ListOpt) List of allowed vif_type values. |
| [RESTPROXY] | |
add_meta_server_route = True
|
(BoolOpt) Determines whether a route to the metadata server should be injected into the VM |
auto_sync_on_failure = True
|
(BoolOpt) If neutron fails to create a resource because the back end controller doesn't know of a dependency, the plugin automatically triggers a full data synchronization to the controller. |
cache_connections = True
|
(BoolOpt) Re-use HTTP/HTTPS connections to the controller. |
consistency_interval = 60
|
(IntOpt) Time between verifications that the backend controller database is consistent with Neutron. (0 to disable) |
neutron_id = neutron-images
|
(StrOpt) User-defined identifier for this neutron deployment |
no_ssl_validation = False
|
(BoolOpt) Disables SSL certificate validation for controllers |
server_auth = None
|
(StrOpt) The username and password for authenticating against the Big Switch or Floodlight controller. |
server_ssl = True
|
(BoolOpt) If True, use SSL when connecting to the Big Switch or Floodlight controller. |
server_timeout = 10
|
(IntOpt) Maximum number of seconds to wait for proxy request to connect and complete. |
servers = localhost:8800
|
(ListOpt) A comma separated list of Big Switch/Floodlight servers, and port numbers. The plugin proxies the requests to the Big Switch/Floodlight server, which performs the networking configuration. Only one server is needed per deployment, but you can deploy multiple servers for failover. |
ssl_cert_directory = /etc/neutron/plugins/bigswitch/ssl
|
(StrOpt) Directory containing ca_certs and host_certs certificate directories. |
ssl_sticky = True
|
(BoolOpt) Trust and store the first certificate received for each controller address and use it to validate future connections to that address. |
sync_data = False
|
(BoolOpt) Sync data on connect |
thread_pool_size = 4
|
(IntOpt) Maximum number of threads to spawn to handle large volumes of port creations. |
| [RESTPROXYAGENT] | |
integration_bridge = br-int
|
(StrOpt) Name of integration bridge on Compute nodes used for security group insertion. |
polling_interval = 5
|
(IntOpt) Seconds between agent checks for port changes |
virtual_switch_type = ivs
|
(StrOpt) Virtual switch type. |
| [ROUTER] | |
max_router_rules = 200
|
(IntOpt) Maximum number of router rules |
tenant_default_router_rule = ['*:any:any:permit']
|
(MultiStrOpt) The default router rules installed in new tenant routers. Repeat the config option for each rule. Format is <tenant>:<source>:<destination>:<action> Use an * to specify default for all tenants. |
9.1.1.3. Brocade configuration options
Copy linkLink copied to clipboard!
| Configuration option = Default value | Description |
|---|---|
| [PHYSICAL_INTERFACE] | |
physical_interface = eth0
|
(StrOpt) The network interface to use when creating a port |
| [SWITCH] | |
address =
|
(StrOpt) The address of the host to SSH to |
ostype = NOS
|
(StrOpt) Currently unused |
password =
|
(StrOpt) The SSH password to use |
username =
|
(StrOpt) The SSH username to use |
9.1.1.4. Brocade MLX L3 plug-in
Copy linkLink copied to clipboard!
Configure switch names to be used as group names as described below
| Configuration option = Default value | Description |
|---|---|
| [L3_BROCADE_MLX_EXAMPLE] | |
address =
|
(StrOpt) The IP address of the MLX switch |
password = password
|
(StrOpt) The SSH password of the switch |
physical_networks =
|
(StrOpt) Allowed physical networks where VLAN can be configured on this switch |
ports =
|
(StrOpt) Ports to be tagged in the VLAN being configured on the switch |
username = admin
|
(StrOpt) The SSH username for the switch |
| [l3_brocade_mlx] | |
switch_names =
|
(StrOpt) Switches connected to the Compute nodes |
9.1.1.5. Brocade Vyatta layer 3 plug-in
Copy linkLink copied to clipboard!
The Brocade Vyatta Layer 3 plug-in configures Vyatta vRouter. More information about the plug-in is available at: Brocade_Vyatta_L3_Plugin.
Use the following options to configure the Brocade Vyatta Layer 3 plug-in.
| Configuration option = Default value | Description |
|---|---|
| [VROUTER] | |
flavor = 2
|
(StrOpt) Nova VM flavor for instances of Vyatta vRouter. |
image_id = None
|
(StrOpt) Nova image id for instances of Vyatta vRouter. |
keystone_url = None
|
(StrOpt) Keystone URL. |
management_network_id = None
|
(StrOpt) Vyatta vRouter management network id. |
nova_poll_interval = 5
|
(IntOpt) Number of seconds between consecutive Nova queries when waiting for router instance status change. |
nova_spawn_timeout = 300
|
(IntOpt) Number of seconds to wait for Nova to activate instance before setting resource to error state. |
tenant_admin_name = None
|
(StrOpt) Name of tenant admin user. |
tenant_admin_password = None
|
(StrOpt) Tenant admin password. |
tenant_id = None
|
(StrOpt) UUID of tenant that holds Vyatta vRouter instances. |
vrouter_boot_timeout = 300
|
(IntOpt) Number of seconds to wait for Vyatta vRouter to boot before setting resource to error state. |
vrouter_credentials = vyatta:vyatta
|
(StrOpt) Vyatta vRouter login credentials |
vrouter_poll_interval = 5
|
(IntOpt) Number of seconds between consecutive Vyatta vRouter queries when waiting for router instance boot. |
9.1.1.6. CISCO configuration options
Copy linkLink copied to clipboard!
| Configuration option = Default value | Description |
|---|---|
| [cfg_agent] | |
device_connection_timeout = 30
|
(IntOpt) Time in seconds for connecting to a hosting device |
fw_svc_helper_class = neutron_fwaas.services.firewall.drivers.cisco.csr_firewall_svc_helper.CsrFirewallServiceHelper
|
(StrOpt) Path of the firewall service helper class. |
hosting_device_dead_timeout = 300
|
(IntOpt) The time in seconds until a backlogged hosting device is presumed dead. This value should be set up high enough to recover from a period of connectivity loss or high load when the device may not be responding. |
routing_svc_helper_class = networking_cisco.plugins.cisco.cfg_agent.service_helpers.routing_svc_helper.RoutingServiceHelper
|
(StrOpt) Path of the routing service helper class. |
rpc_loop_interval = 10
|
(IntOpt) Interval when the process_services() loop executes in seconds. This is when the config agent lets each service helper process its neutron resources. |
| [cisco_csr_ipsec] | |
status_check_interval = 60
|
(IntOpt) Status check interval for Cisco CSR IPSec connections |
| [general] | |
backlog_processing_interval = 10
|
(IntOpt) Time in seconds between renewed scheduling attempts of non-scheduled routers. |
cfg_agent_down_time = 60
|
(IntOpt) Seconds of no status update until a cfg agent is considered down. |
default_security_group = mgmt_sec_grp
|
(StrOpt) Default security group applied on management port. Default value is mgmt_sec_grp. |
ensure_nova_running = True
|
(BoolOpt) Ensure that nova is running before attempting to create a VM. |
l3_admin_tenant = L3AdminTenant
|
(StrOpt) Name of the L3 admin tenant. |
management_network = osn_mgmt_nw
|
(StrOpt) Name of management network for device configuration. Default value is osn_mgmt_nw |
service_vm_config_path = /opt/stack/data/neutron/cisco/config_drive
|
(StrOpt) Path to config drive files for service VM instances. |
templates_path = /opt/stack/data/neutron/cisco/templates
|
(StrOpt) Path to templates for hosting devices. |
| [hosting_devices] | |
csr1kv_booting_time = 420
|
(IntOpt) Booting time in seconds before a CSR1kv becomes operational. |
csr1kv_cfgagent_router_driver = networking_cisco.plugins.cisco.cfg_agent.device_drivers.csr1kv.csr1kv_routing_driver.CSR1kvRoutingDriver
|
(StrOpt) Config agent driver for CSR1kv. |
csr1kv_configdrive_template = csr1kv_cfg_template
|
(StrOpt) CSR1kv configdrive template file. |
csr1kv_device_driver = networking_cisco.plugins.cisco.l3.hosting_device_drivers.csr1kv_hd_driver.CSR1kvHostingDeviceDriver
|
(StrOpt) Hosting device driver for CSR1kv. |
csr1kv_flavor = 621
|
(StrOpt) UUID of Nova flavor for CSR1kv. |
csr1kv_image = csr1kv_openstack_img
|
(StrOpt) Name of Glance image for CSR1kv. |
csr1kv_password = cisco
|
(StrOpt) Password to use for CSR1kv configurations. |
csr1kv_plugging_driver = networking_cisco.plugins.cisco.l3.plugging_drivers.n1kv_trunking_driver.N1kvTrunkingPlugDriver
|
(StrOpt) Plugging driver for CSR1kv. |
csr1kv_username = stack
|
(StrOpt) Username to use for CSR1kv configurations. |
| [ml2_cisco_n1kv] | |
max_vsm_retries = 2
|
(IntOpt) Maximum number of retry attempts for VSM REST API. |
| [n1kv] | |
management_port_profile = osn_mgmt_pp
|
(StrOpt) Name of N1kv port profile for management ports. |
t1_network_profile = osn_t1_np
|
(StrOpt) Name of N1kv network profile for T1 networks (for example, trunk networks for VXLAN segmented traffic). |
t1_port_profile = osn_t1_pp
|
(StrOpt) Name of N1kv port profile for T1 ports (for example, ports carrying traffic from VXLAN segmented networks). |
t2_network_profile = osn_t2_np
|
(StrOpt) Name of N1kv network profile for T2 networks (for example, trunk networks for VLAN segmented traffic). |
t2_port_profile = osn_t2_pp
|
(StrOpt) Name of N1kv port profile for T2 ports (for example, ports carrying traffic from VLAN segmented networks). |
9.1.1.7. Fujitsu CFAB configuration options
Copy linkLink copied to clipboard!
| Configuration option = Default value | Description |
|---|---|
| [fujitsu_cfab] | |
address =
|
(StrOpt) The address of the C-Fabric to telnet to. |
password = admin
|
(StrOpt) The C-Fabric password to use. |
physical_networks =
|
(ListOpt) List of <physical_network>:<vfab_id> tuples specifying physical_network names and corresponding vfab ids. |
pprofile_prefix =
|
(StrOpt) The prefix string for pprofile name. |
save_config = True
|
(BoolOpt) Whether to save configuration. |
share_pprofile = False
|
(BoolOpt) Whether to share a C-Fabric pprofile among Neutron ports using the same VLAN ID. |
username = admin
|
(StrOpt) The C-Fabric username to use. |
9.1.1.8. Fujitsu ISM configuration options
Copy linkLink copied to clipboard!
| Configuration option = Default value | Description |
|---|---|
| [fujitsu_ism] | |
address = furukawa-ism
|
(StrOpt) The IP address or hostname of the ISM. |
certificate_authority = /etc/neutron/plugins/ml2/fujitsu/server.crt
|
(StrOpt) The certification authority for ISM. |
password = admin
|
(StrOpt) The ISM password to use. |
port = 25566
|
(StrOpt) The port number of the ISM. |
timeout = 30
|
(StrOpt) The API timeout value for ISM. |
username = admin
|
(StrOpt) The ISM username to use. |
9.1.1.9. CloudBase Hyper-V Agent configuration options
Copy linkLink copied to clipboard!
| Configuration option = Default value | Description |
|---|---|
| [AGENT] | |
enable_metrics_collection = False
|
(BoolOpt) Enables metrics collections for switch ports by using Hyper-V's metric APIs. Collected data can by retrieved by other apps and services, e.g. ceilometer. Requires Hyper-V / Windows Server 2012 and above |
local_network_vswitch = private
|
(StrOpt) Private vswitch name used for local networks |
metrics_max_retries = 100
|
(IntOpt) Specifies the maximum number of retries to enable Hyper-V's port metrics collection. The agent will try to enable the feature once every polling_interval period for at most metrics_max_retries, or until it succeeds. |
neutron_metadata_address = 169.254.169.254
|
(StrOpt) Specifies the address which will serve the metadata for the instance. |
physical_network_vswitch_mappings =
|
(ListOpt) List of <physical_network>:<vswitch> where the physical networks can be expressed with wildcards, e.g. ."*:external" |
polling_interval = 2
|
(IntOpt) The number of seconds the agent will wait between polling for local device changes. |
| [NVGRE] | |
enable_support = False
|
(BoolOpt) Enables Hyper-V NVGRE. Requires Windows Server 2012 or above. |
provider_tunnel_ip = None
|
(StrOpt) Specifies the tunnel IP which will be used and reported by this host for NVGRE networks. |
provider_vlan_id = 0
|
(IntOpt) Specifies the VLAN ID of the physical network, required for setting the NVGRE Provider Address. |
| [hyperv] | |
force_hyperv_utils_v1 = False
|
(BoolOpt) Force V1 WMI utility classes |
| [neutron] | |
admin_auth_url = http://localhost:5000/v2.0
|
(StrOpt) auth url for connecting to neutron in admin context |
admin_password = None
|
(StrOpt) password for connecting to neutron in admin context |
admin_tenant_name = None
|
(StrOpt) tenant name for connecting to neutron in admin context |
admin_username = None
|
(StrOpt) username for connecting to neutron in admin context |
auth_strategy = keystone
|
(StrOpt) auth strategy for connecting to neutron in admin context |
url = http://127.0.0.1:9696
|
(StrOpt) URL for connecting to neutron |
url_timeout = 30
|
(IntOpt) timeout value for connecting to neutron in seconds |
9.1.1.10. Embrane configuration options
Copy linkLink copied to clipboard!
| Configuration option = Default value | Description |
|---|---|
| [heleos] | |
admin_username = admin
|
(StrOpt) ESM admin username. |
async_requests = True
|
(BoolOpt) Define if the requests have run asynchronously or not |
dummy_utif_id = None
|
(StrOpt) Dummy user traffic Security Zone id |
esm_mgmt = None
|
(StrOpt) ESM management root address |
inband_id = None
|
(StrOpt) In band Security Zone id |
mgmt_id = None
|
(StrOpt) Management Security Zone id |
oob_id = None
|
(StrOpt) Out of band Security Zone id |
resource_pool_id = default
|
(StrOpt) Shared resource pool id |
router_image = None
|
(StrOpt) Router image id (Embrane FW/VPN) |
9.1.1.11. IBM SDN-VE configuration options
Copy linkLink copied to clipboard!
| Configuration option = Default value | Description |
|---|---|
| [SDNVE] | |
base_url = /one/nb/v2/
|
(StrOpt) Base URL for SDN-VE controller REST API. |
controller_ips = 127.0.0.1
|
(ListOpt) List of IP addresses of SDN-VE controller(s). |
default_tenant_type = OVERLAY
|
(StrOpt) Tenant type: OVERLAY (default) or OF. |
format = json
|
(StrOpt) SDN-VE request/response format. |
info = sdnve_info_string
|
(StrOpt) SDN-VE RPC subject. |
integration_bridge = None
|
(StrOpt) Integration bridge to use. |
interface_mappings =
|
(ListOpt) List of <physical_network_name>:<interface_name> mappings. |
of_signature = SDNVE-OF
|
(StrOpt) The string in tenant description that indicates the tenant is a OF tenant. |
out_of_band = True
|
(BoolOpt) Indicating if controller is out of band or not. |
overlay_signature = SDNVE-OVERLAY
|
(StrOpt) The string in tenant description that indicates the tenant is a OVERLAY tenant. |
password = admin
|
(StrOpt) SDN-VE administrator password. |
port = 8443
|
(StrOpt) SDN-VE controller port number. |
reset_bridge = True
|
(BoolOpt) Whether to reset the integration bridge before use. |
use_fake_controller = False
|
(BoolOpt) Whether to use a fake controller. |
userid = admin
|
(StrOpt) SDN-VE administrator user ID. |
| [SDNVE_AGENT] | |
polling_interval = 2
|
(IntOpt) Agent polling interval if necessary. |
rpc = True
|
(BoolOpt) Whether to use rpc. |
9.1.1.12. Layer 2 Gateway configuration options
Copy linkLink copied to clipboard!
| Configuration option = Default value | Description |
|---|---|
[agent]
|
|
extensions =
|
(List) Extensions list to use |
9.1.1.13. Layer 2 Gateway configuration options
Copy linkLink copied to clipboard!
| Configuration option = Default value | Description |
|---|---|
| [DEFAULT] | |
default_device_name = Switch1
|
(StrOpt) default_device_name of the l2 gateway |
default_l2_gw_service_uuid = None
|
(StrOpt) Unique identifier of the NSX L2 Gateway service which will be used by default for network gateways |
default_l3_gw_service_uuid = None
|
(StrOpt) Unique identifier of the NSX L3 Gateway service which will be used for implementing routers and floating IPs |
l2gw_callback_class = networking_l2gw.services.l2gateway.ovsdb.data.L2GatewayOVSDBCallbacks
|
(StrOpt) L2 gateway plugin callback class where the RPCs from the agent are going to get invoked |
quota_l2_gateway = 5
|
(IntOpt) Number of l2 gateways allowed per tenant, -1 for unlimited |
| [ovsdb] | |
enable_manager = False
|
(BoolOpt) Set to 'True' if ovsdb Manager manages the client |
l2_gw_agent_ca_cert_base_path = None
|
(StrOpt) Trusted issuer CA cert |
l2_gw_agent_cert_base_path = None
|
(StrOpt) L2 gateway agent public certificate |
l2_gw_agent_priv_key_base_path = None
|
(StrOpt) L2 gateway agent private key |
max_connection_retries = 10
|
(IntOpt) Maximum number of retries to open a socket with the OVSDB server |
ovsdb_hosts = host1:127.0.0.1:6632
|
(StrOpt) OVSDB server name:host/IP:port |
periodic_interval = 20
|
(IntOpt) Seconds between periodic task runs |
9.1.1.14. Linux bridge Agent configuration options
Copy linkLink copied to clipboard!
| Configuration option = Default value | Description |
|---|---|
[AGENT]
|
|
quitting_rpc_timeout = 10
|
(Integer) Set new timeout in seconds for new rpc calls after agent receives SIGTERM. If value is set to 0, rpc timeout won't be changed |
[LINUX_BRIDGE]
|
|
bridge_mappings =
|
(List) List of <physical_network>:<physical_bridge> |
physical_interface_mappings =
|
(List) Comma-separated list of <physical_network>:<physical_interface> tuples mapping physical network names to the agent's node-specific physical network interfaces to be used for flat and VLAN networks. All physical networks listed in network_vlan_ranges on the server should have mappings to appropriate interfaces on each agent. |
[VXLAN]
|
|
arp_responder = False
|
(Boolean) Enable local ARP responder which provides local responses instead of performing ARP broadcast into the overlay. Enabling local ARP responder is not fully compatible with the allowed-address-pairs extension. |
enable_vxlan = True
|
(Boolean) Enable VXLAN on the agent. Can be enabled when agent is managed by ml2 plugin using linuxbridge mechanism driver |
l2_population = False
|
(Boolean) Extension to use alongside ml2 plugin's l2population mechanism driver. It enables the plugin to populate VXLAN forwarding table. |
local_ip = None
|
(Unknown) Local IP address of the VXLAN endpoints. |
tos = None
|
(Integer) TOS for vxlan interface protocol packets. |
ttl = None
|
(Integer) TTL for vxlan interface protocol packets. |
vxlan_group = 224.0.0.1
|
(String) Multicast group(s) for vxlan interface. A range of group addresses may be specified by using CIDR notation. Specifying a range allows different VNIs to use different group addresses, reducing or eliminating spurious broadcast traffic to the tunnel endpoints. To reserve a unique group for each possible (24-bit) VNI, use a /8 such as 239.0.0.0/8. This setting must be the same on all the agents. |
9.1.1.15. Modular Layer 2 (ml2) configuration options
Copy linkLink copied to clipboard!
The Modular Layer 2 (ml2) plug-in has two components: network types and mechanisms. You can configure these components separately. This section describes these configuration options.
Configure MTU for VXLAN tunnelling
Specific MTU configuration is necessary for VXLAN to function as expected:
- One option is to increase the MTU value of the physical interface and physical switch fabric by at least 50 bytes. For example, increase the MTU value to 1550. This value enables an automatic 50-byte MTU difference between the physical interface (1500) and the VXLAN interface (automatically 1500-50 = 1450). An MTU value of 1450 causes issues when virtual machine taps are configured at an MTU value of 1500.
- Another option is to decrease the virtual Ethernet devices' MTU. Set the
network_device_mtuoption to 1450 in theneutron.conffile, and set all guest virtual machines' MTU to the same value by using a DHCP option. For information about how to use this option, see Configure OVS plug-in.
| Configuration option = Default value | Description |
|---|---|
[ml2]
|
|
extension_drivers =
|
(List) An ordered list of extension driver entrypoints to be loaded from the neutron.ml2.extension_drivers namespace. For example: extension_drivers = port_security,qos |
external_network_type = None
|
(String) Default network type for external networks when no provider attributes are specified. By default it is None, which means that if provider attributes are not specified while creating external networks then they will have the same type as tenant networks. Allowed values for external_network_type config option depend on the network type values configured in type_drivers config option. |
mechanism_drivers =
|
(List) An ordered list of networking mechanism driver entrypoints to be loaded from the neutron.ml2.mechanism_drivers namespace. |
path_mtu = 1500
|
(Integer) Maximum size of an IP packet (MTU) that can traverse the underlying physical network infrastructure without fragmentation for overlay/tunnel networks. In most cases, use the same value as the global_physnet_mtu option. |
physical_network_mtus =
|
(List) A list of mappings of physical networks to MTU values. The format of the mapping is <physnet>:<mtu val>. This mapping allows specifying a physical network MTU value that differs from the default global_physnet_mtu value. |
tenant_network_types = local
|
(List) Ordered list of network_types to allocate as tenant networks. The default value 'local' is useful for single-box testing but provides no connectivity between hosts. |
type_drivers = local, flat, vlan, gre, vxlan, geneve
|
(List) List of network type driver entrypoints to be loaded from the neutron.ml2.type_drivers namespace. |
9.1.1.15.1. Modular Layer 2 (ml2) Flat Type configuration options
Copy linkLink copied to clipboard!
| Configuration option = Default value | Description |
|---|---|
[ml2_type_flat]
|
|
flat_networks = *
|
(List) List of physical_network names with which flat networks can be created. Use default '*' to allow flat networks with arbitrary physical_network names. Use an empty list to disable flat networks. |
9.1.1.15.2. Modular Layer 2 (ml2) GRE Type configuration options
Copy linkLink copied to clipboard!
| Configuration option = Default value | Description |
|---|---|
[ml2_type_gre]
|
|
tunnel_id_ranges =
|
(List) Comma-separated list of <tun_min>:<tun_max> tuples enumerating ranges of GRE tunnel IDs that are available for tenant network allocation |
9.1.1.15.3. Modular Layer 2 (ml2) VLAN Type configuration options
Copy linkLink copied to clipboard!
| Configuration option = Default value | Description |
|---|---|
[ml2_type_vlan]
|
|
network_vlan_ranges =
|
(List) List of <physical_network>:<vlan_min>:<vlan_max> or <physical_network> specifying physical_network names usable for VLAN provider and tenant networks, as well as ranges of VLAN tags on each available for allocation to tenant networks. |
9.1.1.15.4. Modular Layer 2 (ml2) VXLAN Type configuration options
Copy linkLink copied to clipboard!
| Configuration option = Default value | Description |
|---|---|
[ml2_type_vxlan]
|
|
vni_ranges =
|
(List) Comma-separated list of <vni_min>:<vni_max> tuples enumerating ranges of VXLAN VNI IDs that are available for tenant network allocation |
vxlan_group = None
|
(String) Multicast group for VXLAN. When configured, will enable sending all broadcast traffic to this multicast group. When left unconfigured, will disable multicast VXLAN mode. |
9.1.1.15.5. Modular Layer 2 (ml2) Arista Mechanism configuration options
Copy linkLink copied to clipboard!
| Configuration option = Default value | Description |
|---|---|
| [ml2_arista] | |
eapi_host =
|
(StrOpt) Arista EOS IP address. This is required field. If not set, all communications to Arista EOS will fail. |
eapi_password =
|
(StrOpt) Password for Arista EOS. This is required field. If not set, all communications to Arista EOS will fail. |
eapi_username =
|
(StrOpt) Username for Arista EOS. This is required field. If not set, all communications to Arista EOS will fail. |
region_name = RegionOne
|
(StrOpt) Defines Region Name that is assigned to this OpenStack Controller. This is useful when multiple OpenStack/neutron controllers are managing the same Arista HW clusters. Note that this name must match with the region name registered (or known) to keystone service. Authentication with keystone is performed by EOS. This is an optional field. If not set, a value of 'RegionOne' is assumed. |
sync_interval = 180
|
(IntOpt) Sync interval in seconds between neutron plugin and EOS. This interval defines how often the synchronization is performed. This is an optional field. If not set, a value of '180' seconds is assumed. |
use_fqdn = True
|
(BoolOpt) Defines if hostnames are sent to Arista EOS as FQDNs ("node1.domain.com") or as short names ("node1"). This is optional field. If not set, a value of 'True' is assumed. |
| Configuration option = Default value | Description |
|---|---|
| [l3_arista] | |
l3_sync_interval = 180
|
(IntOpt) Sync interval in seconds between L3 Service plugin and EOS. This interval defines how often the synchronization is performed. This is an optional field. If not set, a value of 180 seconds is assumed |
mlag_config = False
|
(BoolOpt) This flag is used indicate if Arista Switches are configured in MLAG mode. If yes, all L3 config is pushed to both the switches automatically. If this flag is set to True, ensure to specify IP addresses of both switches. This is optional. If not set, a value of "False" is assumed. |
primary_l3_host =
|
(StrOpt) Arista EOS IP address. This is required field. If not set, all communications to Arista EOS will fail |
primary_l3_host_password =
|
(StrOpt) Password for Arista EOS. This is required field. If not set, all communications to Arista EOS will fail |
primary_l3_host_username =
|
(StrOpt) Username for Arista EOS. This is required field. If not set, all communications to Arista EOS will fail |
secondary_l3_host =
|
(StrOpt) Arista EOS IP address for second Switch MLAGed with the first one. This an optional field, however, if mlag_config flag is set, then this is required. If not set, all communications to Arista EOS will fail |
use_vrf = False
|
(BoolOpt) A "True" value for this flag indicates to create a router in VRF. If not set, all routers are created in default VRF. This is optional. If not set, a value of "False" is assumed. |
9.1.1.15.6. Modular Layer 2 (ml2) BaGpipe Mechanism configuration options
Copy linkLink copied to clipboard!
| Configuration option = Default value | Description |
|---|---|
| [ml2_bagpipe] | |
as_number = 64512
|
(IntOpt) Autonomous System number |
| [ml2_type_route_target] | |
rt_asn = 64512
|
(IntOpt) Route Target Autonomous System number. |
rt_nn_ranges =
|
(ListOpt) Comma-separated list of <rt_nn_min>:<rt_nn_max> tuples enumerating ranges of Route Target number that are available for tenant network allocation |
9.1.1.15.7. Modular Layer 2 (ml2) BigSwitch Mechanism configuration options
Copy linkLink copied to clipboard!
| Configuration option = Default value | Description |
|---|---|
| [NOVA] | |
node_override_vif_802.1qbg =
|
(ListOpt) Nova compute nodes to manually set VIF type to 802.1qbg |
node_override_vif_802.1qbh =
|
(ListOpt) Nova compute nodes to manually set VIF type to 802.1qbh |
node_override_vif_binding_failed =
|
(ListOpt) Nova compute nodes to manually set VIF type to binding_failed |
node_override_vif_bridge =
|
(ListOpt) Nova compute nodes to manually set VIF type to bridge |
node_override_vif_distributed =
|
(ListOpt) Nova compute nodes to manually set VIF type to distributed |
node_override_vif_dvs =
|
(ListOpt) Nova compute nodes to manually set VIF type to dvs |
node_override_vif_hw_web =
|
(ListOpt) Nova compute nodes to manually set VIF type to hw_web |
node_override_vif_hyperv =
|
(ListOpt) Nova compute nodes to manually set VIF type to hyperv |
node_override_vif_ib_hostdev =
|
(ListOpt) Nova compute nodes to manually set VIF type to ib_hostdev |
node_override_vif_iovisor =
|
(ListOpt) Nova compute nodes to manually set VIF type to iovisor |
node_override_vif_ivs =
|
(ListOpt) Nova compute nodes to manually set VIF type to ivs |
node_override_vif_midonet =
|
(ListOpt) Nova compute nodes to manually set VIF type to midonet |
node_override_vif_other =
|
(ListOpt) Nova compute nodes to manually set VIF type to other |
node_override_vif_ovs =
|
(ListOpt) Nova compute nodes to manually set VIF type to ovs |
node_override_vif_unbound =
|
(ListOpt) Nova compute nodes to manually set VIF type to unbound |
node_override_vif_vhostuser =
|
(ListOpt) Nova compute nodes to manually set VIF type to vhostuser |
node_override_vif_vrouter =
|
(ListOpt) Nova compute nodes to manually set VIF type to vrouter |
vif_type = ivs
|
(StrOpt) Virtual interface type to configure on Nova compute nodes |
vif_types = unbound, binding_failed, distributed, ovs, bridge, other, ivs, iovisor, vhostuser, dvs, 802.1qbg, 802.1qbh, hyperv, midonet, ib_hostdev, hw_web, vrouter
|
(ListOpt) List of allowed vif_type values. |
| [RESTPROXY] | |
add_meta_server_route = True
|
(BoolOpt) Determines if a route to the metadata server should be injected into the VM. |
auto_sync_on_failure = True
|
(BoolOpt) If neutron fails to create a resource because the back end controller doesn't know of a dependency, the plugin automatically triggers a full data synchronization to the controller. |
cache_connections = True
|
(BoolOpt) Re-use HTTP/HTTPS connections to the controller. |
consistency_interval = 60
|
(IntOpt) Time between verifications that the backend controller database is consistent with Neutron. (0 to disable) |
neutron_id = neutron-ubuntu1404-master
|
(StrOpt) User defined identifier for this Neutron deployment |
no_ssl_validation = False
|
(BoolOpt) Disables SSL certificate validation for controllers |
server_auth = None
|
(StrOpt) The username and password for authenticating against the Big Switch or Floodlight controller. |
server_ssl = True
|
(BoolOpt) If True, Use SSL when connecting to the Big Switch or Floodlight controller. |
server_timeout = 10
|
(IntOpt) Maximum number of seconds to wait for proxy request to connect and complete. |
servers = localhost:8800
|
(ListOpt) A comma separated list of Big Switch or Floodlight servers and port numbers. The plugin proxies the requests to the Big Switch/Floodlight server, which performs the networking configuration. Only one server is needed per deployment, but you can deploy multiple servers for failover. |
ssl_cert_directory = /etc/neutron/plugins/bigswitch/ssl
|
(StrOpt) Directory containing ca_certs and host_certs certificate directories. |
ssl_sticky = True
|
(BoolOpt) Trust and store the first certificate received for each controller address and use it to validate future connections to that address. |
sync_data = False
|
(BoolOpt) Sync data on connect |
thread_pool_size = 4
|
(IntOpt) Maximum number of threads to spawn to handle large volumes of port creations. |
| [RESTPROXYAGENT] | |
integration_bridge = br-int
|
(StrOpt) Name of integration bridge on compute nodes used for security group insertion. |
polling_interval = 5
|
(IntOpt) Seconds between agent checks for port changes |
virtual_switch_type = ivs
|
(StrOpt) Virtual switch type. |
| [ROUTER] | |
max_router_rules = 200
|
(IntOpt) Maximum number of router rules |
tenant_default_router_rule = ['*:any:any:permit']
|
(MultiStrOpt) The default router rules installed in new tenant routers. Repeat the config option for each rule. Format is <tenant>:<source>:<destination>:<action> Use an * to specify default for all tenants. |
9.1.1.15.8. Modular Layer 2 (ml2) Brocade Mechanism configuration options
Copy linkLink copied to clipboard!
| Configuration option = Default value | Description |
|---|---|
| [ML2_BROCADE_MLX_EXAMPLE] | |
address =
|
(StrOpt) The address of the host to SSH to |
ostype = NI
|
(StrOpt) OS type of the device. |
password = password
|
(StrOpt) The SSH password to use |
physical_networks =
|
(StrOpt) Allowed physical networks |
ports =
|
(StrOpt) Ports |
transport = SSH
|
(StrOpt) Protocol used to communicate with the switch |
username = admin
|
(StrOpt) The SSH username to use |
| [ml2_brocade] | |
address =
|
(StrOpt) The address of the host to SSH to |
ostype = NOS
|
(StrOpt) OS Type of the switch |
osversion = 4.0.0
|
(StrOpt) OS Version number |
password = password
|
(StrOpt) The SSH password to use |
physical_networks =
|
(StrOpt) Allowed physical networks |
rbridge_id = 1
|
(StrOpt) Rbridge id of provider edge router(s) |
username = admin
|
(StrOpt) The SSH username to use |
9.1.1.15.9. Modular Layer 3 (ml2) Brocade MLX ICX Mechanism configuration options
Copy linkLink copied to clipboard!
Configure switch names to be used as group names as described below
| Configuration option = Default value | Description |
|---|---|
| [ml2_brocade_fi_ni] | |
switch_names =
|
(StrOpt) Switches connected to the compute nodes |
9.1.1.15.10. Modular Layer 2 (ml2) Cisco Mechanism configuration options
Copy linkLink copied to clipboard!
| Configuration option = Default value | Description |
|---|---|
| [DEFAULT] | |
apic_system_id = openstack
|
(StrOpt) Prefix for APIC domain/names/profiles created |
| [ml2_cisco] | |
host_key_checks = False
|
(BoolOpt) Enable strict host key checks when connecting to Nexus switches |
managed_physical_network = None
|
(StrOpt) The physical network managed by the switches. |
never_cache_ssh_connection = False
|
(BoolOpt) Prevent caching SSH connections to Nexus device |
persistent_switch_config = False
|
(BoolOpt) To make Nexus configuration persistent |
provider_vlan_auto_create = True
|
(BoolOpt) Provider VLANs are automatically created as needed on the Nexus switch |
provider_vlan_auto_trunk = True
|
(BoolOpt) Provider VLANs are automatically trunked as needed on the ports of the Nexus switch |
provider_vlan_name_prefix = p-
|
(StrOpt) VLAN Name prefix for provider VLANs |
svi_round_robin = False
|
(BoolOpt) Distribute SVI interfaces over all switches |
switch_heartbeat_time = 0
|
(IntOpt) Periodic time to check switch connection. (0=disabled) |
vlan_name_prefix = q-
|
(StrOpt) VLAN Name prefix |
vxlan_global_config = False
|
(BoolOpt) Create and delete Nexus switch VXLAN global settings; feature nv overlay, feature vn-segment-vlan-based, interface nve + source-interface loopback |
| [ml2_cisco_apic] | |
apic_agent_poll_interval = 2
|
(FloatOpt) Interval between agent poll for topology (in sec) |
apic_agent_report_interval = 30
|
(FloatOpt) Interval between agent status updates (in sec) |
apic_app_profile_name = ${apic_system_id}_app
|
(StrOpt) Name for the app profile used for Openstack |
apic_domain_name = ${apic_system_id}
|
(StrOpt) Name for the domain created on APIC |
apic_entity_profile = ${apic_system_id}_entity_profile
|
(StrOpt) Name of the entity profile to be created |
apic_function_profile = ${apic_system_id}_function_profile
|
(StrOpt) Name of the function profile to be created |
apic_host_uplink_ports =
|
(ListOpt) The uplink ports to check for ACI connectivity |
apic_hosts =
|
(ListOpt) An ordered list of host names or IP addresses of the APIC controller(s). |
apic_lacp_profile = ${apic_system_id}_lacp_profile
|
(StrOpt) Name of the LACP profile to be created |
apic_name_mapping = use_name
|
(StrOpt) Name mapping strategy to use: use_uuid | use_name |
apic_node_profile = ${apic_system_id}_node_profile
|
(StrOpt) Name of the node profile to be created |
apic_password = None
|
(StrOpt) Password for the APIC controller |
apic_sync_interval = 0
|
(IntOpt) Synchronization interval in seconds |
apic_use_ssl = True
|
(BoolOpt) Use SSL to connect to the APIC controller |
apic_username = None
|
(StrOpt) Username for the APIC controller |
apic_vlan_ns_name = ${apic_system_id}_vlan_ns
|
(StrOpt) Name of the VLAN namespace to be used for Openstack |
apic_vlan_range = 2:4093
|
(StrOpt) Range of VLANs to be used for Openstack |
apic_vpc_pairs =
|
(ListOpt) The switch pairs for VPC connectivity |
| [ml2_cisco_n1kv] | |
default_policy_profile = default-pp
|
(StrOpt) Cisco Nexus1000V default policy profile. |
http_pool_size = 4
|
(IntOpt) Number of threads to use to make HTTP requests. |
http_timeout = 15
|
(IntOpt) HTTP timeout, in seconds, for connections to the Cisco Nexus1000V VSMs. |
n1kv_vsm_ips = None
|
(ListOpt) Comma-separated IP Addresses of the Cisco Nexus1000V VSMs. |
password = None
|
(StrOpt) Password for all configured Cisco Nexus1000V VSMs. |
poll_duration = 60
|
(IntOpt) Cisco Nexus1000V policy profile polling duration in seconds. |
restrict_network_profiles = False
|
(BoolOpt) Restrict the visibility of network profiles to the tenants. |
restrict_policy_profiles = False
|
(BoolOpt) Restrict the visibility of policy profiles to the tenants. |
sync_interval = 300
|
(IntOpt) Time interval between consecutive neutron-VSM syncs. |
username = None
|
(StrOpt) Username for all configured Cisco Nexus1000V VSMs. |
| [ml2_cisco_ucsm] | |
supported_pci_devs = 1137:0071, 8086:10c9
|
(ListOpt) List of comma separated vendor_id:product_id of SR_IOV capable devices supported by this MD. This MD supports both VM-FEX and SR-IOV devices. |
ucsm_host_list = None
|
(ListOpt) List of comma separated Host:Service Profile tuples providing the Service Profile associated with each host to be supported by this MD. |
ucsm_ip = None
|
(StrOpt) Cisco UCS Manager IP address. This is a required field to communicate with a Cisco UCS Manager. |
ucsm_password = None
|
(StrOpt) Password for UCS Manager. This is a required field to communicate with a Cisco UCS Manager. |
ucsm_username = None
|
(StrOpt) Username for UCS Manager. This is a required field to communicate with a Cisco UCS Manager. |
| [ml2_type_nexus_vxlan] | |
mcast_ranges =
|
(ListOpt) List of multicast groups to be used for global VNIDs in the format - a:b,c,e:f. |
vni_ranges =
|
(ListOpt) List of global VNID ranges in the format - a:b, c:d. Multiple ranges can be separated by a comma |
9.1.1.15.11. Modular Layer 2 (ml2) Freescale SDN Mechanism configuration options
Copy linkLink copied to clipboard!
| Configuration option = Default value | Description |
|---|---|
| [ml2_fslsdn] | |
crd_api_insecure = False
|
(BoolOpt) If set, ignore any SSL validation issues. |
crd_auth_strategy = keystone
|
(StrOpt) Auth strategy for connecting to neutron in admin context. |
crd_auth_url = http://127.0.0.1:5000/v2.0/
|
(StrOpt) CRD Auth URL. |
crd_ca_certificates_file = None
|
(StrOpt) Location of ca certificates file to use for CRD client requests. |
crd_password = password
|
(StrOpt) CRD Service Password. |
crd_region_name = RegionOne
|
(StrOpt) Region name for connecting to CRD Service in admin context. |
crd_tenant_name = service
|
(StrOpt) CRD Tenant Name. |
crd_url = http://127.0.0.1:9797
|
(StrOpt) URL for connecting to CRD service. |
crd_url_timeout = 30
|
(IntOpt) Timeout value for connecting to CRD service in seconds. |
crd_user_name = crd
|
(StrOpt) CRD service Username. |
9.1.1.15.12. Modular Layer 2 (ml2) Geneve Mechanism configuration options
Copy linkLink copied to clipboard!
| Configuration option = Default value | Description |
|---|---|
[ml2_type_geneve]
|
|
max_header_size = 50
|
(Integer) Geneve encapsulation header size is dynamic, this value is used to calculate the maximum MTU for the driver. This is the sum of the sizes of the outer ETH + IP + UDP + GENEVE header sizes. The default size for this field is 50, which is the size of the Geneve header without any additional option headers. |
vni_ranges =
|
(List) Comma-separated list of <vni_min>:<vni_max> tuples enumerating ranges of Geneve VNI IDs that are available for tenant network allocation |
9.1.1.15.13. Modular Layer 2 (ml2) OpenDaylight Mechanism configuration options
Copy linkLink copied to clipboard!
Use of VLANs with the OpenDaylight mechanism driver requires OpenDaylight Helium or newer to be installed.
| Configuration option = Default value | Description |
|---|---|
| [DEFAULT] | |
backdoor_port = None
|
(StrOpt) Enable eventlet backdoor. Acceptable values are 0, <port>, and <start>:<end>, where 0 results in listening on a random tcp port number; <port> results in listening on the specified port number (and not enabling backdoor if that port is in use); and <start>:<end> results in listening on the smallest unused port number within the specified range of port numbers. The chosen port is displayed in the service's log file. |
policy_default_rule = default
|
(StrOpt) Default rule. Enforced when a requested rule is not found. |
policy_dirs = ['policy.d']
|
(MultiStrOpt) Directories where policy configuration files are stored. They can be relative to any directory in the search path defined by the config_dir option, or absolute paths. The file defined by policy_file must exist for these directories to be searched. Missing or empty directories are ignored. |
policy_file = policy.json
|
(StrOpt) The JSON file that defines policies. |
run_external_periodic_tasks = True
|
(BoolOpt) Some periodic tasks can be run in a separate process. Should we run them here? |
| [ml2_odl] | |
password = None
|
(StrOpt) HTTP password for authentication |
session_timeout = 30
|
(IntOpt) Tomcat session timeout in minutes. |
timeout = 10
|
(IntOpt) HTTP timeout in seconds. |
url = None
|
(StrOpt) HTTP URL of OpenDaylight REST interface. |
username = None
|
(StrOpt) HTTP username for authentication |
9.1.1.15.14. Modular Layer 2 (ml2) OpenFlow Agent (ofagent) Mechanism configuration options
Copy linkLink copied to clipboard!
| Configuration option = Default value | Description |
|---|---|
[AGENT]
|
|
dont_fragment = True
|
(Boolean) Set or un-set the don't fragment (DF) bit on outgoing IP packet carrying GRE/VXLAN tunnel. |
9.1.1.15.15. Modular Layer 2 (ml2) L2 Population Mechanism configuration options
Copy linkLink copied to clipboard!
| Configuration option = Default value | Description |
|---|---|
[l2pop]
|
|
agent_boot_time = 180
|
(Integer) Delay within which agent is expected to update existing ports whent it restarts |
9.1.1.15.16. Modular Layer 2 (ml2) Tail-f NCS Mechanism configuration options
Copy linkLink copied to clipboard!
| Configuration option = Default value | Description |
|---|---|
| [ml2_ncs] | |
password = None
|
(StrOpt) HTTP password for authentication |
timeout = 10
|
(IntOpt) HTTP timeout in seconds. |
url = None
|
(StrOpt) HTTP URL of Tail-f NCS REST interface. |
username = None
|
(StrOpt) HTTP username for authentication |
9.1.1.15.17. Modular Layer 2 (ml2) SR-IOV Mechanism configuration options
Copy linkLink copied to clipboard!
| Configuration option = Default value | Description |
|---|---|
[ml2_sriov]
|
|
supported_pci_vendor_devs = 15b3:1004, 8086:10ca
|
(List) Comma-separated list of supported PCI vendor devices, as defined by vendor_id:product_id according to the PCI ID Repository. Default enables support for Intel and Mellanox SR-IOV capable NICs. |
9.1.1.16. MidoNet configuration options
Copy linkLink copied to clipboard!
| Configuration option = Default value | Description |
|---|---|
| [MIDONET] | |
client = midonet.neutron.client.api.MidonetApiClient
|
(StrOpt) MidoNet client used to access MidoNet data storage. |
cluster_ip = localhost
|
(StrOpt) IP that the cluster service can be reached on |
cluster_port = 8088
|
(StrOpt) Port that the cluster service can be reached on |
midonet_uri = http://localhost:8080/midonet-api
|
(StrOpt) MidoNet API server URI. |
password = passw0rd
|
(StrOpt) MidoNet admin password. |
project_id = 77777777-7777-7777-7777-777777777777
|
(StrOpt) ID of the project that MidoNet admin user belongs to. |
tunnel_protocol = vxlan
|
(StrOpt) Tunnel protocol used by Midonet |
username = admin
|
(StrOpt) MidoNet admin username. |
9.1.1.17. NEC configuration options
Copy linkLink copied to clipboard!
| Configuration option = Default value | Description |
|---|---|
| [OFC] | |
api_max_attempts = 3
|
(IntOpt) Maximum attempts per OFC API request. NEC plugin retries API request to OFC when OFC returns ServiceUnavailable (503). The value must be greater than 0. |
cert_file = None
|
(StrOpt) Location of certificate file. |
driver = trema
|
(StrOpt) Driver to use. |
enable_packet_filter = True
|
(BoolOpt) Enable packet filter. |
host = 127.0.0.1
|
(StrOpt) Host to connect to. |
insecure_ssl = False
|
(BoolOpt) Disable SSL certificate verification. |
key_file = None
|
(StrOpt) Location of key file. |
path_prefix =
|
(StrOpt) Base URL of OFC REST API. It is prepended to each API request. |
port = 8888
|
(StrOpt) Port to connect to. |
support_packet_filter_on_ofc_router = True
|
(BoolOpt) Support packet filter on OFC router interface. |
use_ssl = False
|
(BoolOpt) Use SSL to connect. |
| [PROVIDER] | |
default_router_provider = l3-agent
|
(StrOpt) Default router provider to use. |
router_providers = l3-agent, openflow
|
(ListOpt) List of enabled router providers. |
| [fwaas] | |
driver =
|
(StrOpt) Name of the FWaaS Driver |
9.1.1.18. One Convergence NVSD configuration options
Copy linkLink copied to clipboard!
| Configuration option = Default value | Description |
|---|---|
| [AGENT] | |
integration_bridge = br-int
|
(StrOpt) Integration bridge |
| [nvsd] | |
nvsd_ip = 127.0.0.1
|
(StrOpt) NVSD Controller IP address |
nvsd_passwd = oc123
|
(StrOpt) NVSD Controller password |
nvsd_port = 8082
|
(IntOpt) NVSD Controller Port number |
nvsd_retries = 0
|
(IntOpt) Number of login retries to NVSD controller |
nvsd_user = ocplugin
|
(StrOpt) NVSD Controller username |
request_timeout = 30
|
(IntOpt) NVSD controller REST API request timeout in seconds |
9.1.1.19. Open Networking Operating System (ONOS) configuration options
Copy linkLink copied to clipboard!
| Configuration option = Default value | Description |
|---|---|
| [onos] | |
password =
|
(StrOpt) Password for authentication. |
url_path =
|
(StrOpt) ONOS ReST interface URL |
username =
|
(StrOpt) Username for authentication. |
9.1.1.20. OpenContrail configuration options
Copy linkLink copied to clipboard!
| Configuration option = Default value | Description |
|---|---|
| [CONTRAIL] | |
api_server_ip = 127.0.0.1
|
(StrOpt) IP address to connect to the OpenContrail controller. |
api_server_port = 8082
|
(IntOpt) Port to connect to the OpenContrail controller. |
9.1.1.21. Open vSwitch Agent configuration options
Copy linkLink copied to clipboard!
| Configuration option = Default value | Description |
|---|---|
[DEFAULT]
|
|
ovs_integration_bridge = br-int
|
(String) Name of Open vSwitch bridge to use |
ovs_use_veth = False
|
(Boolean) Uses veth for an OVS interface or not. Support kernels with limited namespace support (e.g. RHEL 6.5) so long as ovs_use_veth is set to True. |
ovs_vsctl_timeout = 10
|
(Integer) Timeout in seconds for ovs-vsctl commands. If the timeout expires, ovs commands will fail with ALARMCLOCK error. |
[AGENT]
|
|
arp_responder = False
|
(Boolean) Enable local ARP responder if it is supported. Requires OVS 2.1 and ML2 l2population driver. Allows the switch (when supporting an overlay) to respond to an ARP request locally without performing a costly ARP broadcast into the overlay. |
dont_fragment = True
|
(Boolean) Set or un-set the don't fragment (DF) bit on outgoing IP packet carrying GRE/VXLAN tunnel. |
drop_flows_on_start = False
|
(Boolean) Reset flow table on start. Setting this to True will cause brief traffic interruption. |
enable_distributed_routing = False
|
(Boolean) Make the l2 agent run in DVR mode. |
l2_population = False
|
(Boolean) Use ML2 l2population mechanism driver to learn remote MAC and IPs and improve tunnel scalability. |
minimize_polling = True
|
(Boolean) Minimize polling by monitoring ovsdb for interface changes. |
ovsdb_monitor_respawn_interval = 30
|
(Integer) The number of seconds to wait before respawning the ovsdb monitor after losing communication with it. |
prevent_arp_spoofing = True
|
(Boolean) DEPRECATED: Enable suppression of ARP responses that don't match an IP address that belongs to the port from which they originate. Note: This prevents the VMs attached to this agent from spoofing, it doesn't protect them from other devices which have the capability to spoof (e.g. bare metal or VMs attached to agents without this flag set to True). Spoofing rules will not be added to any ports that have port security disabled. For LinuxBridge, this requires ebtables. For OVS, it requires a version that supports matching ARP headers. This option will be removed in Newton so the only way to disable protection will be via the port security extension. |
quitting_rpc_timeout = 10
|
(Integer) Set new timeout in seconds for new rpc calls after agent receives SIGTERM. If value is set to 0, rpc timeout won't be changed |
tunnel_csum = False
|
(Boolean) Set or un-set the tunnel header checksum on outgoing IP packet carrying GRE/VXLAN tunnel. |
tunnel_types =
|
(List) Network types supported by the agent (gre and/or vxlan). |
veth_mtu = 9000
|
(Integer) MTU size of veth interfaces |
vxlan_udp_port = 4789
|
(Port number) The UDP port to use for VXLAN tunnels. |
[OVS]
|
|
bridge_mappings =
|
(List) Comma-separated list of <physical_network>:<bridge> tuples mapping physical network names to the agent's node-specific Open vSwitch bridge names to be used for flat and VLAN networks. The length of bridge names should be no more than 11. Each bridge must exist, and should have a physical network interface configured as a port. All physical networks configured on the server should have mappings to appropriate bridges on each agent. Note: If you remove a bridge from this mapping, make sure to disconnect it from the integration bridge as it won't be managed by the agent anymore. Deprecated for ofagent. |
datapath_type = system
|
(String) OVS datapath to use. 'system' is the default value and corresponds to the kernel datapath. To enable the userspace datapath set this value to 'netdev'. |
int_peer_patch_port = patch-tun
|
(String) Peer patch port in integration bridge for tunnel bridge. |
integration_bridge = br-int
|
(String) Integration bridge to use. Do not change this parameter unless you have a good reason to. This is the name of the OVS integration bridge. There is one per hypervisor. The integration bridge acts as a virtual 'patch bay'. All VM VIFs are attached to this bridge and then 'patched' according to their network connectivity. |
local_ip = None
|
(Unknown) Local IP address of tunnel endpoint. |
of_connect_timeout = 30
|
(Integer) Timeout in seconds to wait for the local switch connecting the controller. Used only for 'native' driver. |
of_interface = ovs-ofctl
|
(String) OpenFlow interface to use. |
of_listen_address = 127.0.0.1
|
(Unknown) Address to listen on for OpenFlow connections. Used only for 'native' driver. |
of_listen_port = 6633
|
(Port number) Port to listen on for OpenFlow connections. Used only for 'native' driver. |
of_request_timeout = 10
|
(Integer) Timeout in seconds to wait for a single OpenFlow request. Used only for 'native' driver. |
ovsdb_connection = tcp:127.0.0.1:6640
|
(String) The connection string for the native OVSDB backend. Requires the native ovsdb_interface to be enabled. |
ovsdb_interface = vsctl
|
(String) The interface for interacting with the OVSDB |
tun_peer_patch_port = patch-int
|
(String) Peer patch port in tunnel bridge for integration bridge. |
tunnel_bridge = br-tun
|
(String) Tunnel bridge to use. |
use_veth_interconnection = False
|
(Boolean) Use veths instead of patch ports to interconnect the integration bridge to physical networks. Support kernel without Open vSwitch patch port support so long as it is set to True. |
vhostuser_socket_dir = /var/run/openvswitch
|
(String) OVS vhost-user socket directory. |
9.1.1.22. Virtual Network for Open vSwitch options
Copy linkLink copied to clipboard!
| Configuration option = Default value | Description |
|---|---|
| [ovn] | |
neutron_sync_mode = log
|
(StrOpt) The synchronization mode of OVN with Neutron DB. Available options are: 'off' - synchronization is off. 'log' - during neutron-server startup, check to see if OVN is in sync with the neutron database. Log warnings for any inconsistencies found so that an admin can investigate. 'repair' - during neutron-server startup, automatically create resources found in Neutron but not in OVN. Also remove resources from OVN that are no longer in neutron. |
ovsdb_connection = tcp:127.0.0.1:6640
|
(StrOpt) The connection string for the native OVSDB backend. |
ovsdb_connection_timeout = 60
|
(IntOpt) Timeout in seconds for the OVSDB connection transaction. |
9.1.1.23. IPv6 Prefix Delegation configuradtion options
Copy linkLink copied to clipboard!
| Configuration option = Default value | Description |
|---|---|
[DEFAULT]
|
|
pd_confs = $state_path/pd
|
(String) Location to store IPv6 PD files. |
pd_dhcp_driver = dibbler
|
(String) Service to handle DHCPv6 Prefix delegation. |
vendor_pen = 8888
|
(String) A decimal value as Vendor's Registered Private Enterprise Number as required by RFC3315 DUID-EN. |
9.1.1.24. PLUMgrid configuration options
Copy linkLink copied to clipboard!
| Configuration option = Default value | Description |
|---|---|
| [plumgriddirector] | |
director_server = localhost
|
(StrOpt) PLUMgrid Director server to connect to |
director_server_port = 8080
|
(IntOpt) PLUMgrid Director server port to connect to |
distributed_locking = True
|
(BoolOpt) Distributed locking is enabled or disabled |
driver = networking_plumgrid.neutron.plugins.drivers.plumlib.Plumlib
|
(StrOpt) PLUMgrid Driver |
password = password
|
(StrOpt) PLUMgrid Director admin password |
servertimeout = 5
|
(IntOpt) PLUMgrid Director server timeout |
username = username
|
(StrOpt) PLUMgrid Director admin username |
9.1.1.25. SR-IOV configuration options
Copy linkLink copied to clipboard!
| Configuration option = Default value | Description |
|---|---|
| [SRIOV_NIC] | |
exclude_devices =
|
(ListOpt) List of <network_device>:<excluded_devices> mapping network_device to the agent's node-specific list of virtual functions that should not be used for virtual networking. excluded_devices is a semicolon separated list of virtual functions (BDF format).to exclude from network_device. The network_device in the mapping should appear in the physical_device_mappings list. |
physical_device_mappings =
|
(ListOpt) List of <physical_network>:<network_device> mapping physical network names to the agent's node-specific physical network device of SR-IOV physical function to be used for VLAN networks. All physical networks listed in network_vlan_ranges on the server should have mappings to appropriate interfaces on each agent |
9.1.1.26. VMware vSphere configuration options
Copy linkLink copied to clipboard!
| Configuration option = Default value | Description |
|---|---|
| [DEFAULT] | |
default_interface_name = FortyGigE1/0/1
|
(StrOpt) default_interface_name of the l2 gateway |
| [OVSVAPP] | |
agent_driver = networking_vsphere.agent.ovsvapp_agent.OVSvAppL2Agent
|
(StrOpt) OVSvApp Agent implementation. |
bridge_mappings =
|
(ListOpt) Bridge mappings. |
dont_fragment = True
|
(IntOpt) Do not fragment. |
enable_ovsvapp_monitor = True
|
(BoolOpt) To monitor the OVSvApp Agents. |
integration_bridge = br-int
|
(StrOpt) Integration Bridge. |
local_ip =
|
(StrOpt) Local IP address of VXLAN tunnel endpoint. |
monitoring_ip =
|
(StrOpt) IP address for monitoring OVS Status. |
network_manager = networking_vsphere.drivers.manager.VcenterManager
|
(StrOpt) Driver Manager implementation for NetworkDriver. |
polling_interval = 2
|
(IntOpt) The number of seconds the agent will wait between polling for local device changes. |
report_interval = 30
|
(IntOpt) Seconds between nodes reporting state to server. |
tenant_network_type = vlan
|
(StrOpt) Network type for tenant networks |
tunnel_bridge = br-tun
|
(StrOpt) Tunnel Bridge for tunneling. |
tunnel_csum = False
|
(BoolOpt) Set or un-set the tunnel header checksum on outgoing IP packet carrying GRE/VXLAN tunnel. |
tunnel_types = vxlan
|
(ListOpt) Tunnel network types supported by the OVSvApp Agent. |
veth_mtu = 1500
|
(IntOpt) MTU size of veth interfaces. |
vxlan_udp_port = 4789
|
(IntOpt) The UDP port to use for VXLAN tunnels. |
| [VMWARE] | |
cert_check = False
|
(BoolOpt) Enable SSL certificate check for vCenter. |
cert_path = None
|
(StrOpt) Certificate chain path containing cacert of vCenters. |
cluster_dvs_mapping = ['']
|
(MultiStrOpt) vCenter cluster to DVS mapping. |
esx_hostname = None
|
(StrOpt) ESX host name where this OVSvApp is hosted. |
esx_maintenance_mode = True
|
(BoolOpt) Set host into maintenance mode. |
https_port = 443
|
(IntOpt) Customized https_port for vCenter communication. |
vcenter_api_retry_count = 5
|
(StrOpt) Number of retries while connecting to vcenter server. |
vcenter_id = None
|
(StrOpt) Unique ID of the vCenter Server on which this OVSvApp ishosted |
vcenter_ip = None
|
(StrOpt) vCenter server IP. |
vcenter_password = None
|
(StrOpt) vCenter server password. |
vcenter_username = None
|
(StrOpt) vCenter server user name. |
wsdl_location = None
|
(StrOpt) vCenter server wsdl location. |
| [vmware] | |
console_delay_seconds = None
|
(IntOpt) Set this value if affected by an increased network latency causing repeated characters when typing in a remote console. |
maximum_objects = 100
|
(IntOpt) The maximum number of ObjectContent data objects that should be returned in a single result. A positive value will cause the operation to suspend the retrieval when the count of objects reaches the specified maximum. The server may still limit the count to something less than the configured value. Any remaining objects may be retrieved with additional requests. |
serial_port_proxy_uri = None
|
(StrOpt) Identifies a proxy service that provides network access to the serial_port_service_uri. This option is ignored if serial_port_service_uri is not specified. |
serial_port_service_uri = None
|
(StrOpt) Identifies the remote system that serial port traffic will be sent to. If this is not set, no serial ports will be added to the created VMs. |
9.1.1.27. VMware NSX configuration options
Copy linkLink copied to clipboard!
| Configuration option = Default value | Description |
|---|---|
| [DEFAULT] | |
conn_idle_timeout = 900
|
(IntOpt) Reconnect connection to nsx if not used within this amount of time. |
default_service_cluster_uuid = None
|
(StrOpt) Unique identifier of the Service Cluster which will be used by logical services like dhcp and metadata |
default_tz_uuid = None
|
(StrOpt) This is uuid of the default NSX Transport zone that will be used for creating tunneled isolated "Neutron" networks. It needs to be created in NSX before starting Neutron with the nsx plugin. |
http_timeout = 75
|
(IntOpt) Time before aborting a request |
nsx_controllers = None
|
(ListOpt) Lists the NSX controllers in this cluster |
nsx_default_interface_name = breth0
|
(StrOpt) Name of the interface on a L2 Gateway transport nodewhich should be used by default when setting up a network connection |
nsx_l2gw_driver = None
|
(StrOpt) Class path for the L2 gateway backend driver |
nsx_password = admin
|
(StrOpt) Password for NSX controllers in this cluster |
nsx_user = admin
|
(StrOpt) User name for NSX controllers in this cluster |
redirects = 2
|
(IntOpt) Number of times a redirect should be followed |
retries = 2
|
(IntOpt) Number of time a request should be retried |
| [NSX] | |
agent_mode = agent
|
(StrOpt) The mode used to implement DHCP/metadata services. |
concurrent_connections = 10
|
(IntOpt) Maximum concurrent connections to each NSX controller. |
default_transport_type = stt
|
(StrOpt) The default network tranport type to use (stt, gre, bridge, ipsec_gre, or ipsec_stt) |
max_lp_per_bridged_ls = 5000
|
(IntOpt) Maximum number of ports of a logical switch on a bridged transport zone (default 5000) |
max_lp_per_overlay_ls = 256
|
(IntOpt) Maximum number of ports of a logical switch on an overlay transport zone (default 256) |
metadata_mode = access_network
|
(StrOpt) If set to access_network this enables a dedicated connection to the metadata proxy for metadata server access via Neutron router. If set to dhcp_host_route this enables host route injection via the dhcp agent. This option is only useful if running on a host that does not support namespaces otherwise access_network should be used. |
nsx_gen_timeout = -1
|
(IntOpt) Number of seconds a generation id should be valid for (default -1 meaning do not time out) |
replication_mode = service
|
(StrOpt) The default option leverages service nodes to perform packet replication though one could set to this to 'source' to perform replication locally. This is useful if one does not want to deploy a service node(s). It must be set to 'service' for leveraging distributed routers. |
| [NSX_DHCP] | |
default_lease_time = 43200
|
(IntOpt) Default DHCP lease time |
domain_name = openstacklocal
|
(StrOpt) Domain to use for building the hostnames |
extra_domain_name_servers =
|
(ListOpt) Comma separated list of additional domain name servers |
| [NSX_LSN] | |
sync_on_missing_data = False
|
(BoolOpt) Pull LSN information from NSX in case it is missing from the local data store. This is useful to rebuild the local store in case of server recovery. |
| [NSX_METADATA] | |
metadata_server_address = 127.0.0.1
|
(StrOpt) IP address used by Metadata server. |
metadata_server_port = 8775
|
(IntOpt) TCP Port used by Metadata server. |
metadata_shared_secret =
|
(StrOpt) Shared secret to sign instance-id request |
| [NSX_SYNC] | |
always_read_status = False
|
(BoolOpt) Always read operational status from backend on show operations. Enabling this option might slow down the system. |
max_random_sync_delay = 0
|
(IntOpt) Maximum value for the additional random delay in seconds between runs of the state synchronization task |
min_chunk_size = 500
|
(IntOpt) Minimum number of resources to be retrieved from NSX during state synchronization |
min_sync_req_delay = 1
|
(IntOpt) Minimum delay, in seconds, between two state synchronization queries to NSX. It must not exceed state_sync_interval |
state_sync_interval = 10
|
(IntOpt) Interval in seconds between runs of the state synchronization task. Set it to 0 to disable it |
| [nsx_v3] | |
ca_file = None
|
(StrOpt) Specify a CA bundle file to use in verifying the NSX Manager server certificate. |
default_bridge_cluster_uuid = None
|
(StrOpt) Default bridge cluster identifier for L2 gateway. This needs to be created in NSX before using the L2 gateway service plugin. |
default_edge_cluster_uuid = None
|
(StrOpt) Default edge cluster identifier |
default_overlay_tz_uuid = None
|
(StrOpt) This is the UUID of the default NSX overlay transport zone that will be used for creating tunneled isolated Neutron networks. It needs to be created in NSX before starting Neutron with the NSX plugin. |
default_tier0_router_uuid = None
|
(StrOpt) Default tier0 router identifier |
default_vlan_tz_uuid = None
|
(StrOpt) This is the UUID of the default NSX VLAN transport zone that will be used for bridging between Neutron networks. It needs to be created in NSX before starting Neutron with the NSX plugin. |
insecure = True
|
(BoolOpt) If true, the NSX Manager server certificate is not verified. If false, then the default CA truststore is used for verification. This option is ignored if "ca_file" is set. |
nsx_manager = None
|
(StrOpt) IP address of the NSX manager |
nsx_password = default
|
(StrOpt) Password for the NSX manager |
nsx_user = admin
|
(StrOpt) User name for the NSX manager |
retries = 10
|
(IntOpt) Maximum number of times to retry API request |
| [nsxv] | |
backup_edge_pool = service:large:4:10, service:compact:4:10, vdr:large:4:10
|
(ListOpt) Defines edge pool using the format: <edge_type>:[edge_size]:<min_edges>:<max_edges>.edge_type: service,vdr. edge_size: compact, large, xlarge, quadlarge and default is large. |
ca_file = None
|
(StrOpt) Specify a CA bundle file to use in verifying the NSXv server certificate. |
cluster_moid =
|
(ListOpt) Parameter listing the IDs of the clusters which are used by OpenStack. |
datacenter_moid = None
|
(StrOpt) Optional parameter identifying the ID of datacenter to deploy NSX Edges |
datastore_id = None
|
(StrOpt) Optional parameter identifying the ID of datastore to deploy NSX Edges |
deployment_container_id = None
|
(StrOpt) Optional parameter identifying the ID of datastore to deploy NSX Edges |
dhcp_lease_time = 86400
|
(IntOpt) DHCP default lease time. |
dvs_id = None
|
(StrOpt) DVS ID for VLANs |
edge_appliance_password = None
|
(StrOpt) Password to configure for Edge appliance login |
edge_appliance_user = None
|
(StrOpt) Username to configure for Edge appliance login |
edge_ha = False
|
(BoolOpt) Enable HA for NSX Edges |
exclusive_router_appliance_size = compact
|
(StrOpt) Edge appliance size to be used for creating exclusive router. Valid values: ['compact', 'large', 'xlarge', 'quadlarge']. This edge_appliance_size will be picked up if --router-size parameter is not specified while doing neutron router-create |
external_network = None
|
(StrOpt) Network ID for physical network connectivity |
insecure = True
|
(BoolOpt) If true, the NSXv server certificate is not verified. If false, then the default CA truststore is used for verification. This option is ignored if "ca_file" is set. |
locking_coordinator_url = None
|
(StrOpt) A URL to a locking mechanism coordinator |
manager_uri = None
|
(StrOpt) uri for vsm |
maximum_tunnels_per_vnic = 20
|
(IntOpt) Maximum number of sub interfaces supported per vnic in edge. |
metadata_initializer = True
|
(BoolOpt) If True, the server instance will attempt to initialize the metadata infrastructure |
metadata_shared_secret = None
|
(StrOpt) Shared secret to sign metadata requests |
mgt_net_default_gateway = None
|
(StrOpt) Management network default gateway for metadata proxy |
mgt_net_moid = None
|
(StrOpt) Network ID for management network connectivity |
mgt_net_proxy_ips = None
|
(ListOpt) Management network IP address for metadata proxy |
mgt_net_proxy_netmask = None
|
(StrOpt) Management network netmask for metadata proxy |
nova_metadata_ips = None
|
(ListOpt) IP addresses used by Nova metadata service |
nova_metadata_port = 8775
|
(IntOpt) TCP Port used by Nova metadata server |
password = default
|
(StrOpt) Password for vsm |
resource_pool_id = None
|
(StrOpt) Optional parameter identifying the ID of resource to deploy NSX Edges |
retries = 10
|
(IntOpt) Maximum number of API retries on endpoint. |
spoofguard_enabled = True
|
(BoolOpt) If True then plugin will use NSXV spoofguard component for port-security feature. |
task_status_check_interval = 2000
|
(IntOpt) Task status check interval |
tenant_router_types = shared, distributed, exclusive
|
(ListOpt) Ordered list of router_types to allocate as tenant routers. |
user = admin
|
(StrOpt) User name for vsm |
vdn_scope_id = None
|
(StrOpt) Network scope ID for VXLAN virtual wires |
9.1.1.28. VMware DVS configuration options
Copy linkLink copied to clipboard!
| Configuration option = Default value | Description |
|---|---|
| [dvs] | |
api_retry_count = 10
|
(IntOpt) The number of times we retry on failures, e.g., socket error, etc. |
ca_file = None
|
(StrOpt) Specify a CA bundle file to use in verifying the vCenter server certificate. |
dvs_name = None
|
(StrOpt) The name of the preconfigured DVS. |
host_ip = None
|
(StrOpt) Hostname or IP address for connection to VMware vCenter host. |
host_password = None
|
(StrOpt) Password for connection to VMware vCenter host. |
host_port = 443
|
(IntOpt) Port for connection to VMware vCenter host. |
host_username = None
|
(StrOpt) Username for connection to VMware vCenter host. |
insecure = False
|
(BoolOpt) If true, the vCenter server certificate is not verified. If false, then the default CA truststore is used for verification. This option is ignored if "ca_file" is set. |
task_poll_interval = 0.5
|
(FloatOpt) The interval used for polling of remote tasks. |
9.1.2. Configure the Oslo RPC messaging system
Copy linkLink copied to clipboard!
OpenStack projects use an open standard for messaging middleware known as AMQP. This messaging middleware enables the OpenStack services that run on multiple servers to talk to each other. OpenStack Oslo RPC supports two implementations of AMQP: RabbitMQ and Qpid.
9.1.2.1. Configure RabbitMQ
Copy linkLink copied to clipboard!
OpenStack Oslo RPC uses RabbitMQ by default. Use these options to configure the RabbitMQ message system. The
rpc_backend option is optional as long as RabbitMQ is the default messaging system. However, if it is included the configuration, you must set it to neutron.openstack.common.rpc.impl_kombu.
rpc_backend=neutron.openstack.common.rpc.impl_kombu
rpc_backend=neutron.openstack.common.rpc.impl_kombu
Use these options to configure the RabbitMQ messaging system. You can configure messaging communication for different installation scenarios, tune retries for RabbitMQ, and define the size of the RPC thread pool. To monitor notifications through RabbitMQ, you must set the
notification_driver option to neutron.openstack.common.notifier.rpc_notifier in the neutron.conf file:
| Configuration option = Default value | Description |
|---|---|
[oslo_messaging_rabbit]
|
|
amqp_auto_delete = False
|
(Boolean) Auto-delete queues in AMQP. |
amqp_durable_queues = False
|
(Boolean) Use durable queues in AMQP. |
channel_max = None
|
(Integer) Maximum number of channels to allow |
default_notification_exchange = ${control_exchange}_notification
|
(String) Exchange name for for sending notifications |
default_notification_retry_attempts = -1
|
(Integer) Reconnecting retry count in case of connectivity problem during sending notification, -1 means infinite retry. |
default_rpc_exchange = ${control_exchange}_rpc
|
(String) Exchange name for sending RPC messages |
default_rpc_retry_attempts = -1
|
(Integer) Reconnecting retry count in case of connectivity problem during sending RPC message, -1 means infinite retry. If actual retry attempts in not 0 the rpc request could be processed more then one time |
fake_rabbit = False
|
(Boolean) Deprecated, use rpc_backend=kombu+memory or rpc_backend=fake |
frame_max = None
|
(Integer) The maximum byte size for an AMQP frame |
heartbeat_interval = 1
|
(Integer) How often to send heartbeats for consumer's connections |
heartbeat_rate = 2
|
(Integer) How often times during the heartbeat_timeout_threshold we check the heartbeat. |
heartbeat_timeout_threshold = 60
|
(Integer) Number of seconds after which the Rabbit broker is considered down if heartbeat's keep-alive fails (0 disable the heartbeat). EXPERIMENTAL |
host_connection_reconnect_delay = 0.25
|
(Floating point) Set delay for reconnection to some host which has connection error |
kombu_compression = None
|
(String) EXPERIMENTAL: Possible values are: gzip, bz2. If not set compression will not be used. This option may notbe available in future versions. |
kombu_failover_strategy = round-robin
|
(String) Determines how the next RabbitMQ node is chosen in case the one we are currently connected to becomes unavailable. Takes effect only if more than one RabbitMQ node is provided in config. |
kombu_missing_consumer_retry_timeout = 60
|
(Integer) How long to wait a missing client beforce abandoning to send it its replies. This value should not be longer than rpc_response_timeout. |
kombu_reconnect_delay = 1.0
|
(Floating point) How long to wait before reconnecting in response to an AMQP consumer cancel notification. |
kombu_ssl_ca_certs =
|
(String) SSL certification authority file (valid only if SSL enabled). |
kombu_ssl_certfile =
|
(String) SSL cert file (valid only if SSL enabled). |
kombu_ssl_keyfile =
|
(String) SSL key file (valid only if SSL enabled). |
kombu_ssl_version =
|
(String) SSL version to use (valid only if SSL enabled). Valid values are TLSv1 and SSLv23. SSLv2, SSLv3, TLSv1_1, and TLSv1_2 may be available on some distributions. |
notification_listener_prefetch_count = 100
|
(Integer) Max number of not acknowledged message which RabbitMQ can send to notification listener. |
notification_persistence = False
|
(Boolean) Persist notification messages. |
notification_retry_delay = 0.25
|
(Floating point) Reconnecting retry delay in case of connectivity problem during sending notification message |
pool_max_overflow = 0
|
(Integer) Maximum number of connections to create above `pool_max_size`. |
pool_max_size = 10
|
(Integer) Maximum number of connections to keep queued. |
pool_recycle = 600
|
(Integer) Lifetime of a connection (since creation) in seconds or None for no recycling. Expired connections are closed on acquire. |
pool_stale = 60
|
(Integer) Threshold at which inactive (since release) connections are considered stale in seconds or None for no staleness. Stale connections are closed on acquire. |
pool_timeout = 30
|
(Integer) Default number of seconds to wait for a connections to available |
rabbit_ha_queues = False
|
(Boolean) Try to use HA queues in RabbitMQ (x-ha-policy: all). If you change this option, you must wipe the RabbitMQ database. In RabbitMQ 3.0, queue mirroring is no longer controlled by the x-ha-policy argument when declaring a queue. If you just want to make sure that all queues (except those with auto-generated names) are mirrored across all nodes, run: "rabbitmqctl set_policy HA '^(?!amq\.).*' '{"ha-mode": "all"}' " |
rabbit_host = localhost
|
(String) The RabbitMQ broker address where a single node is used. |
rabbit_hosts = $rabbit_host:$rabbit_port
|
(List) RabbitMQ HA cluster host:port pairs. |
rabbit_interval_max = 30
|
(Integer) Maximum interval of RabbitMQ connection retries. Default is 30 seconds. |
rabbit_login_method = AMQPLAIN
|
(String) The RabbitMQ login method. |
rabbit_max_retries = 0
|
(Integer) Maximum number of RabbitMQ connection retries. Default is 0 (infinite retry count). |
rabbit_password = guest
|
(String) The RabbitMQ password. |
rabbit_port = 5672
|
(Port number) The RabbitMQ broker port where a single node is used. |
rabbit_qos_prefetch_count = 0
|
(Integer) Specifies the number of messages to prefetch. Setting to zero allows unlimited messages. |
rabbit_retry_backoff = 2
|
(Integer) How long to backoff for between retries when connecting to RabbitMQ. |
rabbit_retry_interval = 1
|
(Integer) How frequently to retry connecting with RabbitMQ. |
rabbit_transient_queues_ttl = 1800
|
(Integer) Positive integer representing duration in seconds for queue TTL (x-expires). Queues which are unused for the duration of the TTL are automatically deleted. The parameter affects only reply and fanout queues. |
rabbit_use_ssl = False
|
(Boolean) Connect over SSL for RabbitMQ. |
rabbit_userid = guest
|
(String) The RabbitMQ userid. |
rabbit_virtual_host = /
|
(String) The RabbitMQ virtual host. |
rpc_listener_prefetch_count = 100
|
(Integer) Max number of not acknowledged message which RabbitMQ can send to rpc listener. |
rpc_queue_expiration = 60
|
(Integer) Time to live for rpc queues without consumers in seconds. |
rpc_reply_exchange = ${control_exchange}_rpc_reply
|
(String) Exchange name for receiving RPC replies |
rpc_reply_listener_prefetch_count = 100
|
(Integer) Max number of not acknowledged message which RabbitMQ can send to rpc reply listener. |
rpc_reply_retry_attempts = -1
|
(Integer) Reconnecting retry count in case of connectivity problem during sending reply. -1 means infinite retry during rpc_timeout |
rpc_reply_retry_delay = 0.25
|
(Floating point) Reconnecting retry delay in case of connectivity problem during sending reply. |
rpc_retry_delay = 0.25
|
(Floating point) Reconnecting retry delay in case of connectivity problem during sending RPC message |
socket_timeout = 0.25
|
(Floating point) Set socket timeout in seconds for connection's socket |
ssl = None
|
(Boolean) Enable SSL |
ssl_options = None
|
(Dict) Arguments passed to ssl.wrap_socket |
tcp_user_timeout = 0.25
|
(Floating point) Set TCP_USER_TIMEOUT in seconds for connection's socket |
9.1.2.2. Configure Qpid
Copy linkLink copied to clipboard!
Use these options to configure the Qpid messaging system for OpenStack Oslo RPC. Qpid is not the default messaging system, so you must enable it by setting the
rpc_backend option in the neutron.conf file:
rpc_backend=neutron.openstack.common.rpc.impl_qpid
rpc_backend=neutron.openstack.common.rpc.impl_qpid
This critical option points the compute nodes to the Qpid broker (server). Set the
qpid_hostname option to the host name where the broker runs in the neutron.conf file.
Note
The
--qpid_hostname parameter accepts a host name or IP address value.
qpid_hostname=hostname.example.com
qpid_hostname=hostname.example.com
If the Qpid broker listens on a port other than the AMQP default of
5672, you must set the qpid_port option to that value:
qpid_port=12345
qpid_port=12345
If you configure the Qpid broker to require authentication, you must add a user name and password to the configuration:
qpid_username=username qpid_password=password
qpid_username=username
qpid_password=password
By default, TCP is used as the transport. To enable SSL, set the
qpid_protocol option:
qpid_protocol=ssl
qpid_protocol=ssl
Use these additional options to configure the Qpid messaging driver for OpenStack Oslo RPC. These options are used infrequently.
| Configuration option = Default value | Description |
|---|---|
| [oslo_messaging_qpid] | |
amqp_auto_delete = False
|
(BoolOpt) Auto-delete queues in AMQP. |
amqp_durable_queues = False
|
(BoolOpt) Use durable queues in AMQP. |
qpid_heartbeat = 60
|
(IntOpt) Seconds between connection keepalive heartbeats. |
qpid_hostname = localhost
|
(StrOpt) Qpid broker hostname. |
qpid_hosts = $qpid_hostname:$qpid_port
|
(ListOpt) Qpid HA cluster host:port pairs. |
qpid_password =
|
(StrOpt) Password for Qpid connection. |
qpid_port = 5672
|
(IntOpt) Qpid broker port. |
qpid_protocol = tcp
|
(StrOpt) Transport to use, either 'tcp' or 'ssl'. |
qpid_receiver_capacity = 1
|
(IntOpt) The number of prefetched messages held by receiver. |
qpid_sasl_mechanisms =
|
(StrOpt) Space separated list of SASL mechanisms to use for auth. |
qpid_tcp_nodelay = True
|
(BoolOpt) Whether to disable the Nagle algorithm. |
qpid_topology_version = 1
|
(IntOpt) The qpid topology version to use. Version 1 is what was originally used by impl_qpid. Version 2 includes some backwards-incompatible changes that allow broker federation to work. Users should update to version 2 when they are able to take everything down, as it requires a clean break. |
qpid_username =
|
(StrOpt) Username for Qpid connection. |
send_single_reply = False
|
(BoolOpt) Send a single AMQP reply to call message. The current behavior since oslo-incubator is to send two AMQP replies - first one with the payload, a second one to ensure the other has finished to send the payload. We are going to remove it in the N release, but we must keep backward compatible at the same time. This option provides such compatibility - it defaults to False in Liberty and can be turned on for early adopters with new installations or for testing. This option will be removed in the Mitaka release. |
9.1.2.3. Configure messaging
Copy linkLink copied to clipboard!
Use these common options to configure the RabbitMQ, and Qpid messaging drivers:
| Configuration option = Default value | Description |
|---|---|
[DEFAULT]
|
|
rpc_backend = rabbit
|
(String) The messaging driver to use, defaults to rabbit. Other drivers include amqp and zmq. |
rpc_cast_timeout = -1
|
(Integer) Seconds to wait before a cast expires (TTL). The default value of -1 specifies an infinite linger period. The value of 0 specifies no linger period. Pending messages shall be discarded immediately when the socket is closed. Only supported by impl_zmq. |
rpc_conn_pool_size = 30
|
(Integer) Size of RPC connection pool. |
rpc_poll_timeout = 1
|
(Integer) The default number of seconds that poll should wait. Poll raises timeout exception when timeout expired. |
rpc_response_timeout = 60
|
(Integer) Seconds to wait for a response from a call. |
rpc_state_report_workers = 1
|
(Integer) Number of RPC worker processes dedicated to state reports queue |
rpc_workers = 1
|
(Integer) Number of RPC worker processes for service |
[oslo_concurrency]
|
|
disable_process_locking = False
|
(Boolean) Enables or disables inter-process locks. |
lock_path = None
|
(String) Directory to use for lock files. For security, the specified directory should only be writable by the user running the processes that need locking. Defaults to environment variable OSLO_LOCK_PATH. If external locks are used, a lock path must be set. |
[oslo_messaging]
|
|
event_stream_topic = neutron_lbaas_event
|
(String) topic name for receiving events from a queue |
[oslo_messaging_amqp]
|
|
allow_insecure_clients = False
|
(Boolean) Accept clients using either SSL or plain TCP |
broadcast_prefix = broadcast
|
(String) address prefix used when broadcasting to all servers |
container_name = None
|
(String) Name for the AMQP container |
group_request_prefix = unicast
|
(String) address prefix when sending to any server in group |
idle_timeout = 0
|
(Integer) Timeout for inactive connections (in seconds) |
password =
|
(String) Password for message broker authentication |
sasl_config_dir =
|
(String) Path to directory that contains the SASL configuration |
sasl_config_name =
|
(String) Name of configuration file (without .conf suffix) |
sasl_mechanisms =
|
(String) Space separated list of acceptable SASL mechanisms |
server_request_prefix = exclusive
|
(String) address prefix used when sending to a specific server |
ssl_ca_file =
|
(String) CA certificate PEM file to verify server certificate |
ssl_cert_file =
|
(String) Identifying certificate PEM file to present to clients |
ssl_key_file =
|
(String) Private key PEM file used to sign cert_file certificate |
ssl_key_password = None
|
(String) Password for decrypting ssl_key_file (if encrypted) |
trace = False
|
(Boolean) Debug: dump AMQP frames to stdout |
username =
|
(String) User name for message broker authentication |
[oslo_messaging_notifications]
|
|
driver = []
|
(Multi-valued) The Drivers(s) to handle sending notifications. Possible values are messaging, messagingv2, routing, log, test, noop |
topics = notifications
|
(List) AMQP topic used for OpenStack notifications. |
transport_url = None
|
(String) A URL representing the messaging driver to use for notifications. If not set, we fall back to the same configuration used for RPC. |
| Configuration option = Default value | Description |
|---|---|
[matchmaker_redis]
|
|
check_timeout = 20000
|
(Integer) Time in ms to wait before the transaction is killed. |
host = 127.0.0.1
|
(String) Host to locate redis. |
password =
|
(String) Password for Redis server (optional). |
port = 6379
|
(Port number) Use this port to connect to redis host. |
sentinel_group_name = oslo-messaging-zeromq
|
(String) Redis replica set name. |
sentinel_hosts =
|
(List) List of Redis Sentinel hosts (fault tolerance mode) e.g. [host:port, host1:port ... ] |
socket_timeout = 1000
|
(Integer) Timeout in ms on blocking socket operations |
wait_timeout = 500
|
(Integer) Time in ms to wait between connection attempts. |
| Configuration option = Default value | Description |
|---|---|
[DEFAULT]
|
|
control_exchange = neutron
|
(String) The default exchange under which topics are scoped. May be overridden by an exchange name specified in the transport_url option. |
transport_url = None
|
(String) A URL representing the messaging driver to use and its full configuration. If not set, we fall back to the rpc_backend option and driver specific configuration. |
9.1.3. Agent
Copy linkLink copied to clipboard!
Use the following options to alter agent-related settings.
| Configuration option = Default value | Description |
|---|---|
[DEFAULT]
|
|
external_pids = $state_path/external/pids
|
(String) Location to store child pid files |
network_device_mtu = None
|
(Integer) DEPRECATED: MTU setting for device. This option will be removed in Newton. Please use the system-wide segment_mtu setting which the agents will take into account when wiring VIFs. |
prefix_delegation_driver = dibbler
|
(String) Driver used for ipv6 prefix delegation. This needs to be an entry point defined in the neutron.agent.linux.pd_drivers namespace. See setup.cfg for entry points included with the neutron source. |
[AGENT]
|
|
agent_type = Open vSwitch agent
|
(String) DEPRECATED: Selects the Agent Type reported |
availability_zone = nova
|
(String) Availability zone of this node |
9.1.4. API
Copy linkLink copied to clipboard!
Use the following options to alter API-related settings.
| Configuration option = Default value | Description |
|---|---|
[DEFAULT]
|
|
allow_bulk = True
|
(Boolean) Allow the usage of the bulk API |
allow_pagination = False
|
(Boolean) Allow the usage of the pagination |
allow_sorting = False
|
(Boolean) Allow the usage of the sorting |
api_extensions_path =
|
(String) The path for API extensions. Note that this can be a colon-separated list of paths. For example: api_extensions_path = extensions:/path/to/more/exts:/even/more/exts. The __path__ of neutron.extensions is appended to this, so if your extensions are in there you don't need to specify them here. |
api_paste_config = api-paste.ini
|
(String) File name for the paste.deploy config for api service |
backlog = 4096
|
(Integer) Number of backlog requests to configure the socket with |
client_socket_timeout = 900
|
(Integer) Timeout for client connections' socket operations. If an incoming connection is idle for this number of seconds it will be closed. A value of '0' means wait forever. |
max_header_line = 16384
|
(Integer) Maximum line size of message headers to be accepted. max_header_line may need to be increased when using large tokens (typically those generated when keystone is configured to use PKI tokens with big service catalogs). |
pagination_max_limit = -1
|
(String) The maximum number of items returned in a single response, value was 'infinite' or negative integer means no limit |
retry_until_window = 30
|
(Integer) Number of seconds to keep retrying to listen |
service_plugins =
|
(List) The service plugins Neutron will use |
tcp_keepidle = 600
|
(Integer) Sets the value of TCP_KEEPIDLE in seconds for each server socket. Not supported on OS X. |
wsgi_default_pool_size = 100
|
(Integer) Size of the pool of greenthreads used by wsgi |
wsgi_keep_alive = True
|
(Boolean) If False, closes the client socket connection explicitly. |
[oslo_middleware]
|
|
max_request_body_size = 114688
|
(Integer) The maximum body size for each request, in bytes. |
secure_proxy_ssl_header = X-Forwarded-Proto
|
(String) DEPRECATED: The HTTP Header that will be used to determine what the original request protocol scheme was, even if it was hidden by an SSL termination proxy. |
[oslo_policy]
|
|
policy_default_rule = default
|
(String) Default rule. Enforced when a requested rule is not found. |
policy_dirs = ['policy.d']
|
(Multi-valued) Directories where policy configuration files are stored. They can be relative to any directory in the search path defined by the config_dir option, or absolute paths. The file defined by policy_file must exist for these directories to be searched. Missing or empty directories are ignored. |
policy_file = policy.json
|
(String) The JSON file that defines policies. |
9.1.5. Token authentication
Copy linkLink copied to clipboard!
Use the following options to alter token authentication settings.
| Configuration option = Default value | Description |
|---|---|
[keystone_authtoken]
|
|
admin_password = None
|
(String) Service user password. |
admin_tenant_name = admin
|
(String) Service tenant name. |
admin_token = None
|
(String) This option is deprecated and may be removed in a future release. Single shared secret with the Keystone configuration used for bootstrapping a Keystone installation, or otherwise bypassing the normal authentication process. This option should not be used, use `admin_user` and `admin_password` instead. |
admin_user = None
|
(String) Service username. |
auth_admin_prefix =
|
(String) Prefix to prepend at the beginning of the path. Deprecated, use identity_uri. |
auth_host = 127.0.0.1
|
(String) Host providing the admin Identity API endpoint. Deprecated, use identity_uri. |
auth_port = 35357
|
(Integer) Port of the admin Identity API endpoint. Deprecated, use identity_uri. |
auth_protocol = https
|
(String) Protocol of the admin Identity API endpoint. Deprecated, use identity_uri. |
auth_section = None
|
(Unknown) Config Section from which to load plugin specific options |
auth_type = None
|
(Unknown) Authentication type to load |
auth_uri = None
|
(String) Complete public Identity API endpoint. |
auth_version = None
|
(String) API version of the admin Identity API endpoint. |
cache = None
|
(String) Env key for the swift cache. |
cafile = None
|
(String) A PEM encoded Certificate Authority to use when verifying HTTPs connections. Defaults to system CAs. |
certfile = None
|
(String) Required if identity server requires client certificate |
check_revocations_for_cached = False
|
(Boolean) If true, the revocation list will be checked for cached tokens. This requires that PKI tokens are configured on the identity server. |
delay_auth_decision = False
|
(Boolean) Do not handle authorization requests within the middleware, but delegate the authorization decision to downstream WSGI components. |
enforce_token_bind = permissive
|
(String) Used to control the use and type of token binding. Can be set to: "disabled" to not check token binding. "permissive" (default) to validate binding information if the bind type is of a form known to the server and ignore it if not. "strict" like "permissive" but if the bind type is unknown the token will be rejected. "required" any form of token binding is needed to be allowed. Finally the name of a binding method that must be present in tokens. |
hash_algorithms = md5
|
(List) Hash algorithms to use for hashing PKI tokens. This may be a single algorithm or multiple. The algorithms are those supported by Python standard hashlib.new(). The hashes will be tried in the order given, so put the preferred one first for performance. The result of the first hash will be stored in the cache. This will typically be set to multiple values only while migrating from a less secure algorithm to a more secure one. Once all the old tokens are expired this option should be set to a single value for better performance. |
http_connect_timeout = None
|
(Integer) Request timeout value for communicating with Identity API server. |
http_request_max_retries = 3
|
(Integer) How many times are we trying to reconnect when communicating with Identity API Server. |
identity_uri = None
|
(String) Complete admin Identity API endpoint. This should specify the unversioned root endpoint e.g. https://localhost:35357/ |
include_service_catalog = True
|
(Boolean) (Optional) Indicate whether to set the X-Service-Catalog header. If False, middleware will not ask for service catalog on token validation and will not set the X-Service-Catalog header. |
insecure = False
|
(Boolean) Verify HTTPS connections. |
keyfile = None
|
(String) Required if identity server requires client certificate |
memcache_pool_conn_get_timeout = 10
|
(Integer) (Optional) Number of seconds that an operation will wait to get a memcached client connection from the pool. |
memcache_pool_dead_retry = 300
|
(Integer) (Optional) Number of seconds memcached server is considered dead before it is tried again. |
memcache_pool_maxsize = 10
|
(Integer) (Optional) Maximum total number of open connections to every memcached server. |
memcache_pool_socket_timeout = 3
|
(Integer) (Optional) Socket timeout in seconds for communicating with a memcached server. |
memcache_pool_unused_timeout = 60
|
(Integer) (Optional) Number of seconds a connection to memcached is held unused in the pool before it is closed. |
memcache_secret_key = None
|
(String) (Optional, mandatory if memcache_security_strategy is defined) This string is used for key derivation. |
memcache_security_strategy = None
|
(String) (Optional) If defined, indicate whether token data should be authenticated or authenticated and encrypted. If MAC, token data is authenticated (with HMAC) in the cache. If ENCRYPT, token data is encrypted and authenticated in the cache. If the value is not one of these options or empty, auth_token will raise an exception on initialization. |
memcache_use_advanced_pool = False
|
(Boolean) (Optional) Use the advanced (eventlet safe) memcached client pool. The advanced pool will only work under python 2.x. |
region_name = None
|
(String) The region in which the identity server can be found. |
revocation_cache_time = 10
|
(Integer) Determines the frequency at which the list of revoked tokens is retrieved from the Identity service (in seconds). A high number of revocation events combined with a low cache duration may significantly reduce performance. |
signing_dir = None
|
(String) Directory used to cache files related to PKI tokens. |
token_cache_time = 300
|
(Integer) In order to prevent excessive effort spent validating tokens, the middleware caches previously-seen tokens for a configurable duration (in seconds). Set to -1 to disable caching completely. |
9.1.6. Compute
Copy linkLink copied to clipboard!
Use the following options to alter Compute-related settings.
| Configuration option = Default value | Description |
|---|---|
[DEFAULT]
|
|
notify_nova_on_port_data_changes = True
|
(Boolean) Send notification to nova when port data (fixed_ips/floatingip) changes so nova can update its cache. |
notify_nova_on_port_status_changes = True
|
(Boolean) Send notification to nova when port status changes |
nova_client_cert =
|
(String) Client certificate for nova metadata api server. |
nova_client_priv_key =
|
(String) Private key of client certificate. |
send_events_interval = 2
|
(Integer) Number of seconds between sending events to nova if there are any events to send. |
9.1.7. CORS
Copy linkLink copied to clipboard!
Use the following options to alter CORS-related settings.
| Configuration option = Default value | Description |
|---|---|
[cors]
|
|
allow_credentials = True
|
(Boolean) Indicate that the actual request can include user credentials |
allow_headers = Content-Type, Cache-Control, Content-Language, Expires, Last-Modified, Pragma
|
(List) Indicate which header field names may be used during the actual request. |
allow_methods = GET, POST, PUT, DELETE, OPTIONS
|
(List) Indicate which methods can be used during the actual request. |
allowed_origin = None
|
(List) Indicate whether this resource may be shared with the domain received in the requests "origin" header. |
expose_headers = Content-Type, Cache-Control, Content-Language, Expires, Last-Modified, Pragma
|
(List) Indicate which headers are safe to expose to the API. Defaults to HTTP Simple Headers. |
max_age = 3600
|
(Integer) Maximum cache age of CORS preflight requests. |
[cors.subdomain]
|
|
allow_credentials = True
|
(Boolean) Indicate that the actual request can include user credentials |
allow_headers = Content-Type, Cache-Control, Content-Language, Expires, Last-Modified, Pragma
|
(List) Indicate which header field names may be used during the actual request. |
allow_methods = GET, POST, PUT, DELETE, OPTIONS
|
(List) Indicate which methods can be used during the actual request. |
allowed_origin = None
|
(List) Indicate whether this resource may be shared with the domain received in the requests "origin" header. |
expose_headers = Content-Type, Cache-Control, Content-Language, Expires, Last-Modified, Pragma
|
(List) Indicate which headers are safe to expose to the API. Defaults to HTTP Simple Headers. |
max_age = 3600
|
(Integer) Maximum cache age of CORS preflight requests. |
9.1.8. Database
Copy linkLink copied to clipboard!
Use the following options to alter Database-related settings.
| Configuration option = Default value | Description |
|---|---|
[database]
|
|
backend = sqlalchemy
|
(String) The back end to use for the database. |
connection = None
|
(String) The SQLAlchemy connection string to use to connect to the database. |
connection_debug = 0
|
(Integer) Verbosity of SQL debugging information: 0=None, 100=Everything. |
connection_trace = False
|
(Boolean) Add Python stack traces to SQL as comment strings. |
db_inc_retry_interval = True
|
(Boolean) If True, increases the interval between retries of a database operation up to db_max_retry_interval. |
db_max_retries = 20
|
(Integer) Maximum retries in case of connection error or deadlock error before error is raised. Set to -1 to specify an infinite retry count. |
db_max_retry_interval = 10
|
(Integer) If db_inc_retry_interval is set, the maximum seconds between retries of a database operation. |
db_retry_interval = 1
|
(Integer) Seconds between retries of a database transaction. |
idle_timeout = 3600
|
(Integer) Timeout before idle SQL connections are reaped. |
max_overflow = 50
|
(Integer) If set, use this value for max_overflow with SQLAlchemy. |
max_pool_size = None
|
(Integer) Maximum number of SQL connections to keep open in a pool. |
max_retries = 10
|
(Integer) Maximum number of database connection retries during startup. Set to -1 to specify an infinite retry count. |
min_pool_size = 1
|
(Integer) Minimum number of SQL connections to keep open in a pool. |
mysql_sql_mode = TRADITIONAL
|
(String) The SQL mode to be used for MySQL sessions. This option, including the default, overrides any server-set SQL mode. To use whatever SQL mode is set by the server configuration, set this to no value. Example: mysql_sql_mode= |
pool_timeout = None
|
(Integer) If set, use this value for pool_timeout with SQLAlchemy. |
retry_interval = 10
|
(Integer) Interval between retries of opening a SQL connection. |
slave_connection = None
|
(String) The SQLAlchemy connection string to use to connect to the slave database. |
sqlite_db = oslo.sqlite
|
(String) The file name to use with SQLite. |
sqlite_synchronous = True
|
(Boolean) If True, SQLite uses synchronous mode. |
use_db_reconnect = False
|
(Boolean) Enable the experimental use of database reconnect on connection lost. |
9.1.9. Designate
Copy linkLink copied to clipboard!
Use the following options to alter Designate-related settings.
| Configuration option = Default value | Description |
|---|---|
[designate]
|
|
admin_auth_url = None
|
(String) Authorization URL for connecting to designate in admin context |
admin_password = None
|
(String) Password for connecting to designate in admin context |
admin_tenant_id = None
|
(String) Tenant id for connecting to designate in admin context |
admin_tenant_name = None
|
(String) Tenant name for connecting to designate in admin context |
admin_username = None
|
(String) Username for connecting to designate in admin context |
allow_reverse_dns_lookup = True
|
(Boolean) Allow the creation of PTR records |
ipv4_ptr_zone_prefix_size = 24
|
(Integer) Number of bits in an ipv4 PTR zone that will be considered network prefix. It has to align to byte boundary. Minimum value is 8. Maximum value is 24. As a consequence, range of values is 8, 16 and 24 |
ipv6_ptr_zone_prefix_size = 120
|
(Integer) Number of bits in an ipv6 PTR zone that will be considered network prefix. It has to align to nyble boundary. Minimum value is 4. Maximum value is 124. As a consequence, range of values is 4, 8, 12, 16,..., 124 |
ptr_zone_email =
|
(String) The email address to be used when creating PTR zones. If not specified, the email address will be admin@<dns_domain> |
url = None
|
(String) URL for connecting to designate |
9.1.10. DHCP agent
Copy linkLink copied to clipboard!
Use the following options to alter Database-related settings.
| Configuration option = Default value | Description |
|---|---|
[DEFAULT]
|
|
advertise_mtu = True
|
(Boolean) If True, advertise network MTU values if core plugin calculates them. MTU is advertised to running instances via DHCP and RA MTU options. |
dhcp_driver = neutron.agent.linux.dhcp.Dnsmasq
|
(String) The driver used to manage the DHCP server. |
dnsmasq_base_log_dir = None
|
(String) Base log dir for dnsmasq logging. The log contains DHCP and DNS log information and is useful for debugging issues with either DHCP or DNS. If this section is null, disable dnsmasq log. |
dnsmasq_config_file =
|
(String) Override the default dnsmasq settings with this file. |
dnsmasq_dns_servers = None
|
(List) Comma-separated list of the DNS servers which will be used as forwarders. |
dnsmasq_lease_max = 16777216
|
(Integer) Limit number of leases to prevent a denial-of-service. |
dnsmasq_local_resolv = False
|
(Boolean) Enables the dnsmasq service to provide name resolution for instances via DNS resolvers on the host running the DHCP agent. Effectively removes the '--no-resolv' option from the dnsmasq process arguments. Adding custom DNS resolvers to the 'dnsmasq_dns_servers' option disables this feature. |
enable_isolated_metadata = False
|
(Boolean) The DHCP server can assist with providing metadata support on isolated networks. Setting this value to True will cause the DHCP server to append specific host routes to the DHCP request. The metadata service will only be activated when the subnet does not contain any router port. The guest instance must be configured to request host routes via DHCP (Option 121). This option doesn't have any effect when force_metadata is set to True. |
enable_metadata_network = False
|
(Boolean) Allows for serving metadata requests coming from a dedicated metadata access network whose CIDR is 169.254.169.254/16 (or larger prefix), and is connected to a Neutron router from which the VMs send metadata:1 request. In this case DHCP Option 121 will not be injected in VMs, as they will be able to reach 169.254.169.254 through a router. This option requires enable_isolated_metadata = True. |
force_metadata = False
|
(Boolean) In some cases the Neutron router is not present to provide the metadata IP but the DHCP server can be used to provide this info. Setting this value will force the DHCP server to append specific host routes to the DHCP request. If this option is set, then the metadata service will be activated for all the networks. |
host = example.domain
|
(String) Hostname to be used by the Neutron server, agents and services running on this machine. All the agents and services running on this machine must use the same host value. |
interface_driver = None
|
(String) The driver used to manage the virtual interface. |
num_sync_threads = 4
|
(Integer) Number of threads to use during sync process. Should not exceed connection pool size configured on server. |
resync_interval = 5
|
(Integer) The DHCP agent will resync its state with Neutron to recover from any transient notification or RPC errors. The interval is number of seconds between attempts. |
9.1.11. Distributed virtual router
Copy linkLink copied to clipboard!
Use the following options to alter DVR-related settings.
| Configuration option = Default value | Description |
|---|---|
[DEFAULT]
|
|
dvr_base_mac = fa:16:3f:00:00:00
|
(String) The base mac address used for unique DVR instances by Neutron. The first 3 octets will remain unchanged. If the 4th octet is not 00, it will also be used. The others will be randomly generated. The 'dvr_base_mac' *must* be different from 'base_mac' to avoid mixing them up with MAC's allocated for tenant ports. A 4 octet example would be dvr_base_mac = fa:16:3f:4f:00:00. The default is 3 octet |
router_distributed = False
|
(Boolean) System-wide flag to determine the type of router that tenants can create. Only admin can override. |
9.1.12. Firewall-as-a-Service driver
Copy linkLink copied to clipboard!
Use the following options in the
fwaas_driver.ini file for the FWaaS driver.
| Configuration option = Default value | Description |
|---|---|
[fwaas]
|
|
driver =
|
(String) Name of the FWaaS Driver |
enabled = False
|
(Boolean) Enable FWaaS |
| Configuration option = Default value | Description |
|---|---|
[ngfw]
|
|
smc_api_auth_key =
|
(String) Authentication key to SMC API |
smc_api_version =
|
(String) verion of SMC API |
smc_url =
|
(String) URL to contact SMC server |
| Configuration option = Default value | Description |
|---|---|
[vArmour]
|
|
director = localhost
|
(String) vArmour director ip |
director_port = 443
|
(String) vArmour director port |
password = varmour
|
(String) vArmour director password |
username = varmour
|
(String) vArmour director username |
9.1.13. Load-Balancer-as-a-Service configuration options
Copy linkLink copied to clipboard!
Use the following options in the
neutron_lbaas.conf file for the LBaaS agent.
| Configuration option = Default value | Description |
|---|---|
[certificates]
|
|
barbican_auth = barbican_acl_auth
|
(String) Name of the Barbican authentication method to use |
cert_manager_type = barbican
|
(String) Certificate Manager plugin. Defaults to barbican. |
storage_path = /var/lib/neutron-lbaas/certificates/
|
(String) Absolute path to the certificate storage directory. Defaults to env[OS_LBAAS_TLS_STORAGE]. |
Use the following options in the
neutron_lbaas.conf file for the LBaaS agent.
| Configuration option = Default value | Description |
|---|---|
[service_auth]
|
|
admin_password = password
|
(String) The service admin password |
admin_project_domain = admin
|
(String) The admin project domain name |
admin_tenant_name = admin
|
(String) The service admin tenant name |
admin_user = admin
|
(String) The service admin user name |
admin_user_domain = admin
|
(String) The admin user domain name |
auth_url = http://127.0.0.1:5000/v2.0
|
(String) Authentication endpoint |
auth_version = 2
|
(String) The auth version used to authenticate |
endpoint_type = public
|
(String) The endpoint_type to be used |
region = RegionOne
|
(String) The deployment region |
service_name = lbaas
|
(String) The name of the service |
Use the following options in the
lbaas_agent.ini file for the LBaaS agent.
| Configuration option = Default value | Description |
|---|---|
[DEFAULT]
|
|
debug = False
|
(Boolean) If set to true, the logging level will be set to DEBUG instead of the default INFO level. |
device_driver = ['neutron_lbaas.drivers.haproxy.namespace_driver.HaproxyNSDriver']
|
(Multi-valued) Drivers used to manage loadbalancing devices |
interface_driver = None
|
(String) The driver used to manage the virtual interface. |
periodic_interval = 40
|
(Integer) Seconds between running periodic tasks |
[haproxy]
|
|
loadbalancer_state_path = $state_path/lbaas
|
(String) Location to store config and state files |
send_gratuitous_arp = 3
|
(Integer) When delete and re-add the same vip, send this many gratuitous ARPs to flush the ARP cache in the Router. Set it below or equal to 0 to disable this feature. |
user_group = nogroup
|
(String) The user group |
Use the following options in the
services_lbaas.conf file for the LBaaS agent.
| Configuration option = Default value | Description |
|---|---|
[DEFAULT]
|
|
loadbalancer_pool_scheduler_driver = neutron_lbaas.services.loadbalancer.agent_scheduler.ChanceScheduler
|
(String) Driver to use for scheduling pool to a default loadbalancer agent |
loadbalancer_scheduler_driver = neutron_lbaas.agent_scheduler.ChanceScheduler
|
(String) Driver to use for scheduling to a default loadbalancer agent |
[haproxy]
|
|
jinja_config_template = /usr/lib/python/site-packages/neutron-lbaas/neutron_lbaas/services/loadbalancer/drivers/haproxy/templates/haproxy.loadbalancer.j2
|
(String) Jinja template file for haproxy configuration |
[netscaler_driver]
|
|
is_synchronous = True
|
(String) Setting for option to enable synchronous operationsNetScaler Control Center Server. |
netscaler_ncc_cleanup_mode = None
|
(String) Setting to enable/disable cleanup mode for NetScaler Control Center Server |
netscaler_ncc_password = None
|
(String) Password to login to the NetScaler Control Center Server. |
netscaler_ncc_uri = None
|
(String) The URL to reach the NetScaler Control Center Server. |
netscaler_ncc_username = None
|
(String) Username to login to the NetScaler Control Center Server. |
netscaler_status_collection = True,300
|
(String) Setting for member status collection fromNetScaler Control Center Server. |
periodic_task_interval = 2
|
(String) Setting for periodic task collection interval fromNetScaler Control Center Server.. |
[octavia]
|
|
allocates_vip = False
|
(Boolean) True if Octavia will be responsible for allocating the VIP. False if neutron-lbaas will allocate it and pass to Octavia. |
base_url = http://127.0.0.1:9876
|
(String) URL of Octavia controller root |
request_poll_interval = 3
|
(Integer) Interval in seconds to poll octavia when an entity is created, updated, or deleted. |
request_poll_timeout = 100
|
(Integer) Time to stop polling octavia when a status of an entity does not change. |
[radware]
|
|
actions_to_skip = setup_l2_l3
|
(List) List of actions that are not pushed to the completion queue. |
ha_secondary_address = None
|
(String) IP address of secondary vDirect server. |
l2_l3_ctor_params = {'ha_network_name': 'HA-Network', 'service': '_REPLACE_', 'ha_ip_pool_name': 'default', 'twoleg_enabled': '_REPLACE_', 'allocate_ha_ips': True, 'allocate_ha_vrrp': True}
|
(Dict) Parameter for l2_l3 workflow constructor. |
l2_l3_setup_params = {'data_ip_address': '192.168.200.99', 'data_port': 1, 'gateway': '192.168.200.1', 'ha_port': 2, 'data_ip_mask': '255.255.255.0'}
|
(Dict) Parameter for l2_l3 workflow setup. |
l2_l3_workflow_name = openstack_l2_l3
|
(String) Name of l2_l3 workflow. Default: openstack_l2_l3. |
l4_action_name = BaseCreate
|
(String) Name of the l4 workflow action. Default: BaseCreate. |
l4_workflow_name = openstack_l4
|
(String) Name of l4 workflow. Default: openstack_l4. |
service_adc_type = VA
|
(String) Service ADC type. Default: VA. |
service_adc_version =
|
(String) Service ADC version. |
service_cache = 20
|
(Integer) Size of service cache. Default: 20. |
service_compression_throughput = 100
|
(Integer) Service compression throughput. Default: 100. |
service_ha_pair = False
|
(Boolean) Enables or disables the Service HA pair. Default: False. |
service_isl_vlan = -1
|
(Integer) A required VLAN for the interswitch link to use. |
service_resource_pool_ids =
|
(List) Resource pool IDs. |
service_session_mirroring_enabled = False
|
(Boolean) Enable or disable Alteon interswitch link for stateful session failover. Default: False. |
service_ssl_throughput = 100
|
(Integer) Service SSL throughput. Default: 100. |
service_throughput = 1000
|
(Integer) Service throughput. Default: 1000. |
vdirect_address = None
|
(String) IP address of vDirect server. |
vdirect_password = radware
|
(String) vDirect user password. |
vdirect_user = vDirect
|
(String) vDirect user name. |
[radwarev2]
|
|
child_workflow_template_names = manage_l3
|
(List) Name of child workflow templates used.Default: manage_l3 |
ha_secondary_address = None
|
(String) IP address of secondary vDirect server. |
service_adc_type = VA
|
(String) Service ADC type. Default: VA. |
service_adc_version =
|
(String) Service ADC version. |
service_cache = 20
|
(Integer) Size of service cache. Default: 20. |
service_compression_throughput = 100
|
(Integer) Service compression throughput. Default: 100. |
service_ha_pair = False
|
(Boolean) Enables or disables the Service HA pair. Default: False. |
service_isl_vlan = -1
|
(Integer) A required VLAN for the interswitch link to use. |
service_resource_pool_ids =
|
(List) Resource pool IDs. |
service_session_mirroring_enabled = False
|
(Boolean) Enable or disable Alteon interswitch link for stateful session failover. Default: False. |
service_ssl_throughput = 100
|
(Integer) Service SSL throughput. Default: 100. |
service_throughput = 1000
|
(Integer) Service throughput. Default: 1000. |
stats_action_name = stats
|
(String) Name of the workflow action for statistics. Default: stats. |
vdirect_address = None
|
(String) IP address of vDirect server. |
vdirect_password = radware
|
(String) vDirect user password. |
vdirect_user = vDirect
|
(String) vDirect user name. |
workflow_action_name = apply
|
(String) Name of the workflow action. Default: apply. |
workflow_params = {'data_ip_address': '192.168.200.99', 'ha_network_name': 'HA-Network', 'ha_port': 2, 'allocate_ha_ips': True, 'ha_ip_pool_name': 'default', 'allocate_ha_vrrp': True, 'data_port': 1, 'gateway': '192.168.200.1', 'twoleg_enabled': '_REPLACE_', 'data_ip_mask': '255.255.255.0'}
|
(Dict) Parameter for l2_l3 workflow constructor. |
workflow_template_name = os_lb_v2
|
(String) Name of the workflow template. Default: os_lb_v2. |
[radwarev2_debug]
|
|
configure_l3 = True
|
(Boolean) Configule ADC with L3 parameters? |
configure_l4 = True
|
(Boolean) Configule ADC with L4 parameters? |
provision_service = True
|
(Boolean) Provision ADC service? |
Use the following options in the
/etc/octavia/octavia.conf file for octavia config.
| Configuration option = Default value | Description |
|---|---|
| [DEFAULT] | |
verbose = False
|
(BoolOpt) Print more verbose output (set logging level to INFO instead of default WARNING level). |
debug = False
|
(BoolOpt) Print more verbose output (set logging level to INFO instead of default WARNING level). |
bind_host = 0.0.0.0
|
(StrOpt) The host IP to bind to the api service to . |
bind_port = 9876
|
(IntOpt) The port to bind to the api service to. |
api_handler = simulated_handler
|
(StrOpt) The handler that the API communicates with. |
octavia_plugins = hot_plug_plugin
|
(StrOpt) Name of the controller plugin to use. |
os_region_name =
|
(StrOpt) Region in Identity service catalog to use for communication with the OpenStack services. |
host =
|
(StrOpt) Hostname to be used by the host machine for services running on it.The default value is the hostname of the host machine. |
| [database] | |
connection = mysql+pymysql://root:pass@127.0.0.1:3306/octavia
|
(StrOpt) The SQLAlchemy connection string used to connect to the database. |
| [health_manager] | |
bind_ip = 0.0.0.0
|
(StrOpt) IP address the controller will listen on for heart beats from the amphora. |
bind_port = 5555
|
(IntOpt) Port number the controller will listen on for heart beats from the amphora. |
controller_ip_port_list =
|
(StrOpt) List of controller ip and port pairs for the heartbeat receivers. Example [127.0.0.1:5555, 127.0.0.1:5555]. |
failover_threads = 10
|
(IntOpt) Number of threads performing amphora failovers. |
status_update_threads = 50
|
(IntOpt) Number of threads performing amphora status update. |
heartbeat_interval = 10
|
(IntOpt) Sleep time between sending hearthbeats from the amphora. |
heartbeat_key =
|
(StrOpt) key used to authenticate the heartbeat message sent by the amphora. |
heartbeat_timeout = 60
|
(IntOpt) Interval, in seconds, to wait before failing over an amphora. |
health_check_interval = 3
|
(IntOpt) Sleep time between health checks in seconds. |
sock_rlimit = 0
|
(IntOpt) sets the value of the heartbeat recv buffer. |
| [keystone_authtoken] | |
auth_uri = https://localhost:5000/v3
|
(StrOpt) Complete public Identity API endpoint. |
admin_user = octavia
|
(StrOpt) Keystone account username. |
admin_password = password
|
(StrOpt) Keystone account password. |
admin_tenant_name = service
|
(StrOpt) Keystone service account tenant name to validate user tokens. |
insecure = False
|
(BoolOpt) Verify HTTPS connections. |
| [keystone_authtoken_v3] | |
admin_user_domain = default
|
(StrOpt) Admin user keystone authentication domain. |
admin_project_domain = default
|
(StrOpt) Admin project keystone authentication domain. |
| [certificates] | |
cert_generator_class = octavia.certificates.generator.LocalCertGenerator
|
(StrOpt) Class name which generate certificates. |
cert_manager_class = octavia.certificates.manager.LocalCertManager
|
(StrOpt) Class name of certificate manager. |
ca_certificate = /etc/ssl/certs/ssl-cert-snakeoil.pem
|
(StrOpt) Absolute path to the CA Certificate for signing. Defaults to env[OS_OCTAVIA_TLS_CA_CERT].Local Cert generator only. |
ca_private_key = /etc/ssl/private/ssl-cert-snakeoil.key
|
(StrOpt) Absolute path to the Private Key for signing. Defaults to env[OS_OCTAVIA_TLS_CA_KEY].Local Cert generator only. |
ca_private_key_passphrase =
|
(StrOpt) Passphrase for the Private Key. Defaults to env[OS_OCTAVIA_CA_KEY_PASS] or None.Local Cert generator only. |
signing_digest = sha256
|
(StrOpt) Certificate signing digest. Defaults to env[OS_OCTAVIA_CA_SIGNING_DIGEST] or sha256.Local Cert generator only. |
storage_path = /var/lib/octavia/certificates/
|
(StrOpt) Absolute path to the certificate storage directory. Defaults to env[OS_OCTAVIA_TLS_STORAGE].Local Cert manager only. |
| [octavia_network] | |
lb_network_name =
|
(StrOpt) Network to communicate with amphora. |
max_retries = 15
|
(IntOpt) The maximum attempts to retry an action with the networking service. |
retry_interval = 1
|
(IntOpt) Seconds to wait before retrying an action with the networking service. |
| [haproxy_amphora] | |
base_path = /var/lib/octavia
|
(StrOpt) Base directory for amphora files on amphora. |
base_cert_dir = /var/lib/octavia/certs
|
(StrOpt) Base directory for cert storage on amphora. |
haproxy_template = /var/lib/octavia/custom_template
|
(StrOpt) Custom haproxy template. |
base_log_dir = /logs
|
(StrOpt) Base director for log on amphora. |
connection_max_retries = 300
|
(IntOpt) Retry threshold for connecting to amphorae. |
connection_retry_interval = 5
|
(IntOpt) Retry threshold for connecting to amphorae. |
cert_manager = barbican_cert_manager
|
(StrOpt) Name of the cert manager to use. |
username = ubuntu
|
(StrOpt) Name of user for access to amphora,ssh driver only. |
key_path = /opt/stack/.ssh/id_rsa
|
(StrOpt) Local absolute path to the private key loaded on amphora at boot,ssh driver only. |
bind_host = 0.0.0.0
|
(StrOpt) The host IP to bind to amphora hose/REST driver only. |
bind_port = 9191
|
(IntOpt) The port to bind to.REST driver only. |
haproxy_cmd = /usr/sbin/haproxy
|
(StrOpt) The full path to haproxy. |
respawn_count = 2
|
(IntOpt) The respawn count for haproxy's upstart script. |
respawn_interval = 2
|
(IntOpt) The respawn interval for haproxy's upstart script. |
haproxy_cert_dir = /tmp
|
(StrOpt) The directory to store haproxy cert files in. |
| [controller_worker] | |
amp_active_retries = 10
|
(IntOpt) Retry attempts to wait for Amphora to become active. |
amp_active_wait_sec = 10
|
(IntOpt) Seconds to wait for an Amphora to become active. |
amp_flavor_id =
|
(StrOpt) Nova instance flavor id for the Amphora. |
amp_image_id =
|
(StrOpt) Glance image id for the Amphora image to boot. |
amp_ssh_key_name =
|
(StrOpt) SSH key name used to boot the Amphora.REST driver/or debugging. |
amp_network =
|
(StrOpt) Network to attach to the Amphora. |
amp_secgroup_list =
|
(StrOpt) List of security groups to attach to the Amphora. |
client_ca = /etc/octavia/certs/ca_01.pem
|
(StrOpt) Client CA for the amphora agent to use.REST driver only. |
amphora_driver = amphora_noop_driver
|
(StrOpt) Name of the amphora driver to use. |
compute_driver = compute_noop_driver
|
(StrOpt) Name of the compute driver to use. |
network_driver = network_noop_driver
|
(StrOpt) Name of the network driver to use. |
cert_generator = local_cert_generator
|
(StrOpt) Name of the cert generator to use. |
| [task_flow] | |
engine = serial
|
(StrOpt) TaskFlow engine to use. |
max_workers = 5
|
(IntOpt) The maximum number of workers. |
| [oslo_messaging_rabbi] | |
rabbit_userid = octavia
|
(StrOpt) RabbitMQ username. |
rabbit_password = password
|
(StrOpt) RabbitMQ password. |
rabbit_port = 5672
|
(IntOpt) RabbitMQ port. |
rabbit_hosts = localhost:5672
|
(StrOpt) RabbitMQ host. |
| [oslo_messaging] | |
rpc_thread_pool_size = 2
|
(IntOpt) Queue Consumer Thread Pool Size. |
topic = octavia_prov
|
(StrOpt) Topic (i.e. Queue) Name. |
| [house_keeping] | |
spare_check_interval = 30
|
(IntOpt) Interval in seconds to initiate spare amphora checks. |
spare_amphora_pool_size = 0
|
(IntOpt) Number of spare amphorae. |
cleanup_interval = 30
|
(IntOpt) Cleanup interval for Deleted amphora. |
amphora_expiry_age = 604800
|
(IntOpt) Amphora expiry age in seconds. Default is 1 week. |
9.1.14. VPN-as-a-Service configuration options
Copy linkLink copied to clipboard!
Use the following options in the
vpnaas_agent.ini file for the VPNaaS agent.
| Configuration option = Default value | Description |
|---|---|
[vpnagent]
|
|
vpn_device_driver = ['neutron_vpnaas.services.vpn.device_drivers.ipsec.OpenSwanDriver, neutron_vpnaas.services.vpn.device_drivers.cisco_ipsec.CiscoCsrIPsecDriver, neutron_vpnaas.services.vpn.device_drivers.vyatta_ipsec.VyattaIPSecDriver, neutron_vpnaas.services.vpn.device_drivers.strongswan_ipsec.StrongSwanDriver, neutron_vpnaas.services.vpn.device_drivers.fedora_strongswan_ipsec.FedoraStrongSwanDriver, neutron_vpnaas.services.vpn.device_drivers.libreswan_ipsec.LibreSwanDriver']
|
(Multi-valued) The vpn device drivers Neutron will use |
| Configuration option = Default value | Description |
|---|---|
[cisco_csr_ipsec]
|
|
status_check_interval = 60
|
(Integer) Status check interval for Cisco CSR IPSec connections |
[ipsec]
|
|
config_base_dir = $state_path/ipsec
|
(String) Location to store ipsec server config files |
enable_detailed_logging = False
|
(Boolean) Enable detail logging for ipsec pluto process. If the flag set to True, the detailed logging will be written into config_base_dir/<pid>/log. Note: This setting applies to OpenSwan and LibreSwan only. StrongSwan logs to syslog. |
ipsec_status_check_interval = 60
|
(Integer) Interval for checking ipsec status |
[pluto]
|
|
shutdown_check_back_off = 1.5
|
(Floating point) A factor to increase the retry interval for each retry |
shutdown_check_retries = 5
|
(Integer) The maximum number of retries for checking for pluto daemon shutdown |
shutdown_check_timeout = 1
|
(Integer) Initial interval in seconds for checking if pluto daemon is shutdown |
| Configuration option = Default value | Description |
|---|---|
[openswan]
|
|
ipsec_config_template = /usr/lib/python/site-packages/neutron-vpnaas/neutron_vpnaas/services/vpn/device_drivers/template/openswan/ipsec.conf.template
|
(String) Template file for ipsec configuration |
ipsec_secret_template = /usr/lib/python/site-packages/neutron-vpnaas/neutron_vpnaas/services/vpn/device_drivers/template/openswan/ipsec.secret.template
|
(String) Template file for ipsec secret configuration |
| Configuration option = Default value | Description |
|---|---|
[strongswan]
|
|
default_config_area = /etc/strongswan.d
|
(String) The area where default StrongSwan configuration files are located. |
ipsec_config_template = /usr/lib/python/site-packages/neutron-vpnaas/neutron_vpnaas/services/vpn/device_drivers/template/strongswan/ipsec.conf.template
|
(String) Template file for ipsec configuration. |
ipsec_secret_template = /usr/lib/python/site-packages/neutron-vpnaas/neutron_vpnaas/services/vpn/device_drivers/template/strongswan/ipsec.secret.template
|
(String) Template file for ipsec secret configuration. |
strongswan_config_template = /usr/lib/python/site-packages/neutron-vpnaas/neutron_vpnaas/services/vpn/device_drivers/template/strongswan/strongswan.conf.template
|
(String) Template file for strongswan configuration. |
9.1.15. IPv6 router advertisement
Copy linkLink copied to clipboard!
Use the following options to alter IPv6 RA settings.
| Configuration option = Default value | Description |
|---|---|
[DEFAULT]
|
|
ra_confs = $state_path/ra
|
(String) Location to store IPv6 RA config files |
9.1.16. L3 agent
Copy linkLink copied to clipboard!
Use the following options in the
l3_agent.ini file for the L3 agent.
| Configuration option = Default value | Description |
|---|---|
[DEFAULT]
|
|
agent_mode = legacy
|
(String) The working mode for the agent. Allowed modes are: 'legacy' - this preserves the existing behavior where the L3 agent is deployed on a centralized networking node to provide L3 services like DNAT, and SNAT. Use this mode if you do not want to adopt DVR. 'dvr' - this mode enables DVR functionality and must be used for an L3 agent that runs on a compute host. 'dvr_snat' - this enables centralized SNAT support in conjunction with DVR. This mode must be used for an L3 agent running on a centralized node (or in single-host deployments, e.g. devstack) |
allow_automatic_dhcp_failover = True
|
(Boolean) Automatically remove networks from offline DHCP agents. |
allow_automatic_l3agent_failover = False
|
(Boolean) Automatically reschedule routers from offline L3 agents to online L3 agents. |
enable_metadata_proxy = True
|
(Boolean) Allow running metadata proxy. |
enable_snat_by_default = True
|
(Boolean) Define the default value of enable_snat if not provided in external_gateway_info. |
external_ingress_mark = 0x2
|
(String) Iptables mangle mark used to mark ingress from external network. This mark will be masked with 0xffff so that only the lower 16 bits will be used. |
external_network_bridge = br-ex
|
(String) DEPRECATED: Name of bridge used for external network traffic. This should be set to an empty value for the Linux Bridge. When this parameter is set, each L3 agent can be associated with no more than one external network. This option is deprecated and will be removed in the M release. |
gateway_external_network_id =
|
(String) When external_network_bridge is set, each L3 agent can be associated with no more than one external network. This value should be set to the UUID of that external network. To allow L3 agent support multiple external networks, both the external_network_bridge and gateway_external_network_id must be left empty. |
ha_confs_path = $state_path/ha_confs
|
(String) Location to store keepalived/conntrackd config files |
ha_vrrp_advert_int = 2
|
(Integer) The advertisement interval in seconds |
ha_vrrp_auth_password = None
|
(String) VRRP authentication password |
ha_vrrp_auth_type = PASS
|
(String) VRRP authentication type |
handle_internal_only_routers = True
|
(Boolean) Indicates that this L3 agent should also handle routers that do not have an external network gateway configured. This option should be True only for a single agent in a Neutron deployment, and may be False for all agents if all routers must have an external network gateway. |
host = example.domain
|
(String) Hostname to be used by the Neutron server, agents and services running on this machine. All the agents and services running on this machine must use the same host value. |
interface_driver = None
|
(String) The driver used to manage the virtual interface. |
ipv6_gateway =
|
(String) With IPv6, the network used for the external gateway does not need to have an associated subnet, since the automatically assigned link-local address (LLA) can be used. However, an IPv6 gateway address is needed for use as the next-hop for the default route. If no IPv6 gateway address is configured here, (and only then) the neutron router will be configured to get its default route from router advertisements (RAs) from the upstream router; in which case the upstream router must also be configured to send these RAs. The ipv6_gateway, when configured, should be the LLA of the interface on the upstream router. If a next-hop using a global unique address (GUA) is desired, it needs to be done via a subnet allocated to the network and not through this parameter. |
ipv6_pd_enabled = False
|
(Boolean) Enables IPv6 Prefix Delegation for automatic subnet CIDR allocation. Set to True to enable IPv6 Prefix Delegation for subnet allocation in a PD-capable environment. Users making subnet creation requests for IPv6 subnets without providing a CIDR or subnetpool ID will be given a CIDR via the Prefix Delegation mechanism. Note that enabling PD will override the behavior of the default IPv6 subnetpool. |
l3_ha = False
|
(Boolean) Enable HA mode for virtual routers. |
l3_ha_net_cidr = 169.254.192.0/18
|
(String) Subnet used for the l3 HA admin network. |
l3_ha_network_physical_name =
|
(String) The physical network name with which the HA network can be created. |
l3_ha_network_type =
|
(String) The network type to use when creating the HA network for an HA router. By default or if empty, the first 'tenant_network_types' is used. This is helpful when the VRRP traffic should use a specific network which is not the default one. |
max_l3_agents_per_router = 3
|
(Integer) Maximum number of L3 agents which a HA router will be scheduled on. If it is set to 0 then the router will be scheduled on every agent. |
min_l3_agents_per_router = 2
|
(Integer) Minimum number of L3 agents which a HA router will be scheduled on. If it is set to 0 then the router will be scheduled on every agent. |
router_id =
|
(String) DEPRECATED: If non-empty, the l3 agent can only configure a router that has the matching router ID. |
send_arp_for_ha = 3
|
(Integer) Send this many gratuitous ARPs for HA setup, if less than or equal to 0, the feature is disabled |
[AGENT]
|
|
comment_iptables_rules = True
|
(Boolean) Add comments to iptables rules. Set to false to disallow the addition of comments to generated iptables rules that describe each rule's purpose. System must support the iptables comments module for addition of comments. |
use_helper_for_ns_read = True
|
(Boolean) Use the root helper when listing the namespaces on a system. This may not be required depending on the security configuration. If the root helper is not required, set this to False for a performance improvement. |
9.1.17. Logging
Copy linkLink copied to clipboard!
Use the following options to alter logging settings.
| Configuration option = Default value | Description |
|---|---|
[DEFAULT]
|
|
debug = False
|
(Boolean) If set to true, the logging level will be set to DEBUG instead of the default INFO level. |
default_log_levels = amqp=WARN, amqplib=WARN, boto=WARN, qpid=WARN, sqlalchemy=WARN, suds=INFO, oslo.messaging=INFO, iso8601=WARN, requests.packages.urllib3.connectionpool=WARN, urllib3.connectionpool=WARN, websocket=WARN, requests.packages.urllib3.util.retry=WARN, urllib3.util.retry=WARN, keystonemiddleware=WARN, routes.middleware=WARN, stevedore=WARN, taskflow=WARN, keystoneauth=WARN, oslo.cache=INFO, dogpile.core.dogpile=INFO
|
(List) List of package logging levels in logger=LEVEL pairs. This option is ignored if log_config_append is set. |
fatal_deprecations = False
|
(Boolean) Enables or disables fatal status of deprecations. |
instance_format = "[instance: %(uuid)s] "
|
(String) The format for an instance that is passed with the log message. |
instance_uuid_format = "[instance: %(uuid)s] "
|
(String) The format for an instance UUID that is passed with the log message. |
log_config_append = None
|
(String) The name of a logging configuration file. This file is appended to any existing logging configuration files. For details about logging configuration files, see the Python logging module documentation. Note that when logging configuration files are used then all logging configuration is set in the configuration file and other logging configuration options are ignored (for example, logging_context_format_string). |
log_date_format = %Y-%m-%d %H:%M:%S
|
(String) Defines the format string for %%(asctime)s in log records. Default: %(default)s . This option is ignored if log_config_append is set. |
log_dir = None
|
(String) (Optional) The base directory used for relative log_file paths. This option is ignored if log_config_append is set. |
log_file = None
|
(String) (Optional) Name of log file to send logging output to. If no default is set, logging will go to stderr as defined by use_stderr. This option is ignored if log_config_append is set. |
logging_context_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user_identity)s] %(instance)s%(message)s
|
(String) Format string to use for log messages with context. |
logging_debug_format_suffix = %(funcName)s %(pathname)s:%(lineno)d
|
(String) Additional data to append to log message when logging level for the message is DEBUG. |
logging_default_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [-] %(instance)s%(message)s
|
(String) Format string to use for log messages when context is undefined. |
logging_exception_prefix = %(asctime)s.%(msecs)03d %(process)d ERROR %(name)s %(instance)s
|
(String) Prefix each line of exception output with this format. |
logging_user_identity_format = %(user)s %(tenant)s %(domain)s %(user_domain)s %(project_domain)s
|
(String) Defines the format string for %(user_identity)s that is used in logging_context_format_string. |
publish_errors = False
|
(Boolean) Enables or disables publication of error events. |
syslog_log_facility = LOG_USER
|
(String) Syslog facility to receive log lines. This option is ignored if log_config_append is set. |
use_ssl = False
|
(Boolean) Enable SSL on the API server |
use_stderr = True
|
(Boolean) Log output to standard error. This option is ignored if log_config_append is set. |
use_syslog = False
|
(Boolean) Use syslog for logging. Existing syslog format is DEPRECATED and will be changed later to honor RFC5424. This option is ignored if log_config_append is set. |
verbose = True
|
(Boolean) DEPRECATED: If set to false, the logging level will be set to WARNING instead of the default INFO level. |
watch_log_file = False
|
(Boolean) Uses logging handler designed to watch file system. When log file is moved or removed this handler will open a new log file with specified path instantaneously. It makes sense only if log_file option is specified and Linux platform is used. This option is ignored if log_config_append is set. |
wsgi_log_format = %(client_ip)s "%(request_line)s" status: %(status_code)s len: %(body_length)s time: %(wall_seconds).7f
|
(String) A python format string that is used as the template to generate log lines. The following values can beformatted into it: client_ip, date_time, request_line, status_code, body_length, wall_seconds. |
[oslo_versionedobjects]
|
|
fatal_exception_format_errors = False
|
(Boolean) Make exception message format errors fatal |
9.1.18. Metadata Agent
Copy linkLink copied to clipboard!
Use the following options in the
metadata_agent.ini file for the Metadata agent.
| Configuration option = Default value | Description |
|---|---|
[DEFAULT]
|
|
metadata_access_mark = 0x1
|
(String) Iptables mangle mark used to mark metadata valid requests. This mark will be masked with 0xffff so that only the lower 16 bits will be used. |
metadata_backlog = 4096
|
(Integer) Number of backlog requests to configure the metadata server socket with |
metadata_port = 9697
|
(Port number) TCP Port used by Neutron metadata namespace proxy. |
metadata_proxy_group =
|
(String) Group (gid or name) running metadata proxy after its initialization (if empty: agent effective group). |
metadata_proxy_shared_secret =
|
(String) When proxying metadata requests, Neutron signs the Instance-ID header with a shared secret to prevent spoofing. You may select any string for a secret, but it must match here and in the configuration used by the Nova Metadata Server. NOTE: Nova uses the same config key, but in [neutron] section. |
metadata_proxy_socket = $state_path/metadata_proxy
|
(String) Location for Metadata Proxy UNIX domain socket. |
metadata_proxy_socket_mode = deduce
|
(String) Metadata Proxy UNIX domain socket mode, 4 values allowed: 'deduce': deduce mode from metadata_proxy_user/group values, 'user': set metadata proxy socket mode to 0o644, to use when metadata_proxy_user is agent effective user or root, 'group': set metadata proxy socket mode to 0o664, to use when metadata_proxy_group is agent effective group or root, 'all': set metadata proxy socket mode to 0o666, to use otherwise. |
metadata_proxy_user =
|
(String) User (uid or name) running metadata proxy after its initialization (if empty: agent effective user). |
metadata_proxy_watch_log = None
|
(Boolean) Enable/Disable log watch by metadata proxy. It should be disabled when metadata_proxy_user/group is not allowed to read/write its log file and copytruncate logrotate option must be used if logrotate is enabled on metadata proxy log files. Option default value is deduced from metadata_proxy_user: watch log is enabled if metadata_proxy_user is agent effective user id/name. |
metadata_workers = 2
|
(Integer) Number of separate worker processes for metadata server (defaults to half of the number of CPUs) |
nova_metadata_insecure = False
|
(Boolean) Allow to perform insecure SSL (https) requests to nova metadata |
nova_metadata_ip = 127.0.0.1
|
(String) IP address used by Nova metadata server. |
nova_metadata_port = 8775
|
(Port number) TCP Port used by Nova metadata server. |
nova_metadata_protocol = http
|
(String) Protocol to access nova metadata, http or https |
Note
Previously, neutron metadata agent connected to a neutron server via REST API using a neutron client. This is ineffective because keystone is then fully involved into the authentication process and gets overloaded.
The neutron metadata agent has been reworked to use RPC by default to connect to a server since Kilo release. This is a typical way of interacting between neutron server and its agents. If neutron server does not support metadata RPC then neutron client will be used.
Warning
Do not run the
neutron-ns-metadata-proxy proxy namespace as root on a node with the L3 agent running. In OpenStack Kilo and newer, you can change the permissions of neutron-ns-metadata-proxy after the proxy installation using the metadata_proxy_user and metadata_proxy_group options.
9.1.19. Metering Agent
Copy linkLink copied to clipboard!
Use the following options in the
metering_agent.ini file for the Metering agent.
| Configuration option = Default value | Description |
|---|---|
[DEFAULT]
|
|
driver = neutron.services.metering.drivers.noop.noop_driver.NoopMeteringDriver
|
(String) Metering driver |
measure_interval = 30
|
(Integer) Interval between two metering measures |
[AGENT]
|
|
report_interval = 30
|
(Floating point) Seconds between nodes reporting state to server; should be less than agent_down_time, best if it is half or less than agent_down_time. |
9.1.20. ML2 MacVTap
Copy linkLink copied to clipboard!
Use the following options to alter ML2 MacVTap-related settings.
| Configuration option = Default value | Description |
|---|---|
[AGENT]
|
|
quitting_rpc_timeout = 10
|
(Integer) Set new timeout in seconds for new rpc calls after agent receives SIGTERM. If value is set to 0, rpc timeout won't be changed |
[macvtap]
|
|
physical_interface_mappings =
|
(List) Comma-separated list of <physical_network>:<physical_interface> tuples mapping physical network names to the agent's node-specific physical network interfaces to be used for flat and VLAN networks. All physical networks listed in network_vlan_ranges on the server should have mappings to appropriate interfaces on each agent. |
9.1.21. Nova
Copy linkLink copied to clipboard!
Use the following options in the
neutron.conf file to change nova-related settings.
| Configuration option = Default value | Description |
|---|---|
[nova]
|
|
auth_section = None
|
(Unknown) Config Section from which to load plugin specific options |
auth_type = None
|
(Unknown) Authentication type to load |
cafile = None
|
(String) PEM encoded Certificate Authority to use when verifying HTTPs connections. |
certfile = None
|
(String) PEM encoded client certificate cert file |
endpoint_type = public
|
(String) Type of the nova endpoint to use. This endpoint will be looked up in the keystone catalog and should be one of public, internal or admin. |
insecure = False
|
(Boolean) Verify HTTPS connections. |
keyfile = None
|
(String) PEM encoded client certificate key file |
region_name = None
|
(String) Name of nova region to use. Useful if keystone manages more than one region. |
timeout = None
|
(Integer) Timeout value for http requests |
9.1.22. Policy
Copy linkLink copied to clipboard!
Use the following options in the
neutron.conf file to change policy settings.
| Configuration option = Default value | Description |
|---|---|
[DEFAULT]
|
|
allow_overlapping_ips = False
|
(Boolean) Allow overlapping IP support in Neutron. Attention: the following parameter MUST be set to False if Neutron is being used in conjunction with Nova security groups. |
9.1.23. Quotas
Copy linkLink copied to clipboard!
Use the following options in the
neutron.conf file for the quota system.
| Configuration option = Default value | Description |
|---|---|
[DEFAULT]
|
|
max_routes = 30
|
(Integer) Maximum number of routes per router |
[QUOTAS]
|
|
default_quota = -1
|
(Integer) Default number of resource allowed per tenant. A negative value means unlimited. |
quota_driver = neutron.db.quota.driver.DbQuotaDriver
|
(String) Default driver to use for quota checks |
quota_firewall = 10
|
(Integer) Number of firewalls allowed per tenant. A negative value means unlimited. |
quota_firewall_policy = 10
|
(Integer) Number of firewall policies allowed per tenant. A negative value means unlimited. |
quota_firewall_rule = 100
|
(Integer) Number of firewall rules allowed per tenant. A negative value means unlimited. |
quota_floatingip = 50
|
(Integer) Number of floating IPs allowed per tenant. A negative value means unlimited. |
quota_health_monitor = -1
|
(Integer) Number of health monitors allowed per tenant. A negative value means unlimited. |
quota_healthmonitor = -1
|
(Integer) Number of health monitors allowed per tenant. A negative value means unlimited. |
quota_items = network, subnet, port
|
(List) DEPRECATED: Resource name(s) that are supported in quota features. This option is now deprecated for removal. |
quota_listener = -1
|
(Integer) Number of Loadbalancer Listeners allowed per tenant. A negative value means unlimited. |
quota_loadbalancer = 10
|
(Integer) Number of LoadBalancers allowed per tenant. A negative value means unlimited. |
quota_member = -1
|
(Integer) Number of pool members allowed per tenant. A negative value means unlimited. |
quota_network = 10
|
(Integer) Number of networks allowed per tenant. A negative value means unlimited. |
quota_pool = 10
|
(Integer) Number of pools allowed per tenant. A negative value means unlimited. |
quota_port = 50
|
(Integer) Number of ports allowed per tenant. A negative value means unlimited. |
quota_rbac_policy = 10
|
(Integer) Default number of RBAC entries allowed per tenant. A negative value means unlimited. |
quota_router = 10
|
(Integer) Number of routers allowed per tenant. A negative value means unlimited. |
quota_security_group = 10
|
(Integer) Number of security groups allowed per tenant. A negative value means unlimited. |
quota_security_group_rule = 100
|
(Integer) Number of security rules allowed per tenant. A negative value means unlimited. |
quota_subnet = 10
|
(Integer) Number of subnets allowed per tenant, A negative value means unlimited. |
quota_vip = 10
|
(Integer) Number of vips allowed per tenant. A negative value means unlimited. |
track_quota_usage = True
|
(Boolean) Keep in track in the database of current resourcequota usage. Plugins which do not leverage the neutron database should set this flag to False |
9.1.24. Scheduler
Copy linkLink copied to clipboard!
Use the following options in the
neutron.conf file to change scheduler settings.
| Configuration option = Default value | Description |
|---|---|
[DEFAULT]
|
|
network_auto_schedule = True
|
(Boolean) Allow auto scheduling networks to DHCP agent. |
network_scheduler_driver = neutron.scheduler.dhcp_agent_scheduler.WeightScheduler
|
(String) Driver to use for scheduling network to DHCP agent |
router_auto_schedule = True
|
(Boolean) Allow auto scheduling of routers to L3 agent. |
router_scheduler_driver = neutron.scheduler.l3_agent_scheduler.LeastRoutersScheduler
|
(String) Driver to use for scheduling router to a default L3 agent |
9.1.25. Security Groups
Copy linkLink copied to clipboard!
Use the following options in the configuration file for your driver to change security group settings.
| Configuration option = Default value | Description |
|---|---|
[SECURITYGROUP]
|
|
enable_ipset = True
|
(Boolean) Use ipset to speed-up the iptables based security groups. Enabling ipset support requires that ipset is installed on L2 agent node. |
enable_security_group = True
|
(Boolean) Controls whether the neutron security group API is enabled in the server. It should be false when using no security groups or using the nova security group API. |
firewall_driver = None
|
(String) Driver for security groups firewall in the L2 agent |
Note
Now Networking uses iptables to achieve security group functions. In L2 agent with
enable_ipset option enabled, it makes use of IPset to improve security group's performance, as it represents a hash set which is insensitive to the number of elements.
When a port is created, L2 agent will add an additional IPset chain to it's iptables chain, if the security group that this port belongs to has rules between other security group, the member of that security group will be added to the ipset chain.
If a member of a security group is changed, it used to reload iptables rules which is expensive. However, when IPset option is enabled on L2 agent, it does not need to reload iptables if only members of security group were changed, it should just update an IPset.
Note
A single default security group has been introduced in order to avoid race conditions when creating a tenant's default security group. The race conditions are caused by the uniqueness check of a new security group name. A table
default_security_group implements such a group. It has tenant_id field as a primary key and security_group_id, which is an identifier of a default security group. The migration that introduces this table has a sanity check that verifies if a default security group is not duplicated in any tenant.
9.1.26. SSL and Certification Authority
Copy linkLink copied to clipboard!
Use the following options in the
neutron.conf file to enable SSL.
| Configuration option = Default value | Description |
|---|---|
| [DEFAULT] | |
ssl_ca_file = None
|
(StrOpt) CA certificate file to use to verify connecting clients |
ssl_cert_file = None
|
(StrOpt) Certificate file to use when starting the server securely |
ssl_key_file = None
|
(StrOpt) Private key file to use when starting the server securely |
9.1.27. Misc
Copy linkLink copied to clipboard!
| Configuration option = Default value | Description |
|---|---|
[BGP]
|
|
bgp_router_id = None
|
(String) 32-bit BGP identifier, typically an IPv4 address owned by the system running the BGP DrAgent. |
bgp_speaker_driver = None
|
(String) BGP speaker driver class to be instantiated. |
| Configuration option = Default value | Description |
|---|---|
[QOS]
|
|
kernel_hz = 250
|
(Integer) Value of host kernel tick rate (hz) for calculating minimum burst value in bandwidth limit rules for a port with QoS. See kernel configuration file for HZ value and tc-tbf manual for more information. |
tbf_latency = 50
|
(Integer) Value of latency (ms) for calculating size of queue for a port with QoS. See tc-tbf manual for more information. |
'%20d='M201.5%20305.5c-13.8%200-24.9-11.1-24.9-24.6%200-13.8%2011.1-24.9%2024.9-24.9%2013.6%200%2024.6%2011.1%2024.6%2024.9%200%2013.6-11.1%2024.6-24.6%2024.6zM504%20256c0%20137-111%20248-248%20248S8%20393%208%20256%20119%208%20256%208s248%20111%20248%20248zm-132.3-41.2c-9.4%200-17.7%203.9-23.8%2010-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3%2055.4%2012.5c0%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.3%2024.9-24.9s-11.1-24.9-24.9-24.9c-9.7%200-18%205.8-22.1%2013.8l-61.2-13.6c-3-.8-6.1%201.4-6.9%204.4l-19.1%2086.4c-33.2%201.4-63.1%2011.3-85.5%2026.8-6.1-6.4-14.7-10.2-24.1-10.2-34.9%200-46.3%2046.9-14.4%2062.8-1.1%205-1.7%2010.2-1.7%2015.5%200%2052.6%2059.2%2095.2%20132%2095.2%2073.1%200%20132.3-42.6%20132.3-95.2%200-5.3-.6-10.8-1.9-15.8%2031.3-16%2019.8-62.5-14.9-62.5zM302.8%20331c-18.2%2018.2-76.1%2017.9-93.6%200-2.2-2.2-6.1-2.2-8.3%200-2.5%202.5-2.5%206.4%200%208.6%2022.8%2022.8%2087.3%2022.8%20110.2%200%202.5-2.2%202.5-6.1%200-8.6-2.2-2.2-6.1-2.2-8.3%200zm7.7-75c-13.6%200-24.6%2011.1-24.6%2024.9%200%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.1%2024.9-24.6%200-13.8-11-24.9-24.9-24.9z'/%3e%3c/svg%3e){kind=small}