Chapter 17. Networking (neutron) Parameters

CertificateKeySize

Specifies the private key size used when creating the certificate. The default value is 2048.

ContainerOvnCertificateKeySize

Override the private key size used when creating the certificate for this service.

DerivePciWhitelistEnabled

Whether to enable or not the pci passthrough whitelist automation. The default value is true.

DhcpAgentNotification

Enables DHCP agent notifications. The default value is false.

DockerAdditionalSockets

Additional domain sockets for the docker daemon to bind to (useful for mounting into containers that launch other containers). The default value is ['/var/lib/openstack/docker.sock'].

DockerNeutronDHCPAgentUlimit

Ulimit for OpenStack Networking (neutron) DHCP Agent Container. The default value is ['nofile=16384'].

DockerNeutronL3AgentUlimit

Ulimit for OpenStack Networking (neutron) L3 Agent Container. The default value is ['nofile=16384'].

DockerOpenvswitchUlimit

Ulimit for Openvswitch Container. The default value is ['nofile=16384'].

DockerPuppetMountHostPuppet

Whether containerized puppet executions use modules from the baremetal host. Defaults to true. Can be set to false to consume puppet modules from containers directly. The default value is true.

DockerSRIOVUlimit

Ulimit for SR-IOV Container. The default value is ['nofile=16384'].

EnableSQLAlchemyCollectd

Set to true to enable the SQLAlchemy-collectd server plugin. The default value is false.

EnableVLANTransparency

If True, then allow plugins that support it to create VLAN transparent networks. The default value is false.

EnforceSecureRbac

Setting this option to True will configure each OpenStack service to enforce Secure RBAC by setting [oslo_policy] enforce_new_defaults and [oslo_policy] enforce_scope to True. This introduces a consistent set of RBAC personas across OpenStack services that include support for system and project scope, as well as keystone’s default roles, admin, member, and reader. Do not enable this functionality until all services in your deployment actually support secure RBAC. The default value is false.

MemcacheUseAdvancedPool

Use the advanced (eventlet safe) memcached client pool. The default value is true.

NeutronAgentDownTime

Seconds to regard the agent as down; should be at least twice NeutronGlobalReportInterval, to be sure the agent is down for good. The default value is 600.

NeutronAgentExtensions

Comma-separated list of extensions enabled for the OpenStack Networking (neutron) agents. The default value is qos.

NeutronAllowL3AgentFailover

Allow automatic l3-agent failover. The default value is True.

NeutronApiOptEnvVars

Hash of optional environment variables.

NeutronApiOptVolumes

List of optional volumes to be mounted.

NeutronBridgeMappings

The logical to physical bridge mappings to use. The default (datacentre:br-ex) maps br-ex (the external bridge on hosts) to a physical name datacentre, which provider networks can use (for example, the default floating network). If changing this, either use different post-install network scripts or be sure to keep datacentre as a mapping network name. The default value is datacentre:br-ex.

NeutronCertificateKeySize

Override the private key size used when creating the certificate for this service.

NeutronCorePlugin

The core plugin for networking. The value should be the entrypoint to be loaded from neutron.core_plugins namespace. The default value is ml2.

NeutronDBSyncExtraParams

String of extra command line parameters to append to the neutron-db-manage upgrade head command.

NeutronDefaultAvailabilityZones

Comma-separated list of default network availability zones to be used by OpenStack Networking (neutron) if its resource is created without availability zone hints. If not set, no AZs will be configured for OpenStack Networking (neutron) network services.

NeutronDhcpAgentAvailabilityZone

Availability zone for OpenStack Networking (neutron) DHCP agent. If not set, no AZs will be configured for OpenStack Networking (neutron) network services.

NeutronDhcpAgentDnsmasqDnsServers

List of servers to use as dnsmasq forwarders.

NeutronDhcpAgentDnsmasqEnableAddr6List

Enable dhcp-host entry with list of addresses when port has multiple IPv6 addresses in the same subnet. The default value is true.

NeutronDhcpAgentsPerNetwork

The number of DHCP agents to schedule per network. The default value is 0.

NeutronDhcpCertificateKeySize

Override the private key size used when creating the certificate for this service.

NeutronDhcpLoadType

Additional to the availability zones aware network scheduler. The default value is networks.

NeutronDhcpOvsIntegrationBridge

Name of Open vSwitch bridge to use.

NeutronDhcpServerBroadcastReply

OpenStack Networking (neutron) DHCP agent to use broadcast in DHCP replies. The default value is false.

NeutronDnsDomain

Domain to use for building the hostnames. The default value is openstacklocal.

NeutronEnableARPResponder

Enable ARP responder feature in the OVS Agent. The default value is false.

NeutronEnableDnsmasqDockerWrapper

Generate a dnsmasq wrapper script so that OpenStack Networking (neutron) launches dnsmasq in a separate container. The default value is true.

NeutronEnableDVR

Enable Distributed Virtual Router.

NeutronEnableForceMetadata

If True, DHCP always provides metadata route to VM. The default value is false.

NeutronEnableHaproxyDockerWrapper

Generate a wrapper script so OpenStack Networking (neutron) launches haproxy in a separate container. The default value is true.

NeutronEnableIgmpSnooping

Enable IGMP Snooping. The default value is false.

NeutronEnableInternalDNS

If True, enable the internal OpenStack Networking (neutron) DNS server that provides name resolution between VMs. This parameter has no effect if NeutronDhcpAgentDnsmasqDnsServers is set. The default value is false.

NeutronEnableIsolatedMetadata

If True, DHCP allows metadata support on isolated networks. The default value is false.

NeutronEnableKeepalivedWrapper

Generate a wrapper script so OpenStack Networking (neutron) launches keepalived processes in a separate container. The default value is true.

NeutronEnableL2Pop

Enable/disable the L2 population feature in the OpenStack Networking (neutron) agents. The default value is False.

NeutronEnableMetadataNetwork

If True, DHCP provides metadata network. Requires either NeutronEnableIsolatedMetadata or NeutronEnableForceMetadata parameters to also be True. The default value is false.

NeutronExcludeDevices

List of <network_device>:<excluded_devices> mapping network_device to the agent’s node-specific list of virtual functions that should not be used for virtual networking. excluded_devices is a semicolon separated list of virtual functions to exclude from network_device. The network_device in the mapping should appear in the physical_device_mappings list.

NeutronFirewallDriver

Firewall driver for realizing OpenStack Networking (neutron) security group function.

NeutronFlatNetworks

Sets the flat network name to configure in plugins. The default value is datacentre.

NeutronGeneveMaxHeaderSize

Geneve encapsulation header size. The default value is 38.

NeutronGlobalPhysnetMtu

MTU of the underlying physical network. OpenStack Networking (neutron) uses this value to calculate MTU for all virtual network components. For flat and VLAN networks, OpenStack Networking uses this value without modification. For overlay networks such as VXLAN, OpenStack Networking automatically subtracts the overlay protocol overhead from this value. The default value is 0.

NeutronGlobalReportInterval

Seconds between nodes reporting state to server; should be less than NeutronAgentDownTime, best if it is half or less than NeutronAgentDownTime. The default value is 300.

NeutronInterfaceDriver

OpenStack Networking (neutron) DHCP Agent interface driver. The default value is neutron.agent.linux.interface.OVSInterfaceDriver.

NeutronL3AgentAvailabilityZone

Availability zone for OpenStack Networking (neutron) L3 agent. If not set, no AZs will be configured for OpenStack Networking (neutron) network services.

NeutronL3AgentExtensions

Comma-separated list of extensions enabled for the OpenStack Networking (neutron) L3 agent.

NeutronL3AgentLoggingBurstLimit

Maximum number of packets per rate_limit. The default value is 25.

NeutronL3AgentLoggingLocalOutputLogBase

Output logfile path on agent side, default syslog file.

NeutronL3AgentLoggingRateLimit

Maximum number of packets logging per second. The default value is 100.

NeutronL3AgentMode

Agent mode for L3 agent. Must be legacy or dvr_snat. The default value is legacy.

NeutronL3AgentRadvdUser

The username passed to radvd, used to drop root privileges and change user ID to username and group ID to the primary group of username. If no user specified, the user executing the L3 agent will be passed. If "root" specified, because radvd is spawned as root, no "username" parameter will be passed. The default value is root.

NeutronMechanismDrivers

The mechanism drivers for the OpenStack Networking (neutron) tenant network. The default value is ovn.

NeutronMetadataProxySharedSecret

Shared secret to prevent spoofing.

NeutronMetadataWorkers

Sets the number of worker processes for the OpenStack Networking (neutron) OVN metadata agent. The default value results in the configuration being left unset and a system-dependent default will be chosen (usually the number of processors). Please note that this can result in a large number of processes and memory consumption on systems with a large core count. On such systems it is recommended that a non-default value be selected that matches the load requirements.

NeutronML2PhysicalNetworkMtus

A list of mappings of physical networks to MTU values. The format of the mapping is <physnet>:<mtu val>. This mapping allows you to specify a physical network MTU value that differs from the default segment_mtu value in ML2 plugin and overwrites values from global_physnet_mtu for the selected network.

NeutronNetworkSchedulerDriver

The network schedule driver to use for availability zones. The default value is neutron.scheduler.dhcp_agent_scheduler.AZAwareWeightScheduler.

NeutronNetworkType

The tenant network type for OpenStack Networking (neutron). The default value is geneve. If you change this value, make sure the new value matches the parameter OVNEncapType. For example, if you want to use VXLAN instead of Geneve in an ML2/OVN environment, ensure that both NeutronNetworkType and OVNEncapType are set to vxlan. The default value is geneve.

NeutronNetworkVLANRanges

The OpenStack Networking (neutron) ML2 and Open vSwitch VLAN mapping range to support. Defaults to permitting any VLAN on the datacentre physical network (See NeutronBridgeMappings). The default value is datacentre:1:1000.

NeutronOverlayIPVersion

IP version used for all overlay network endpoints. The default value is 4.

NeutronOVNLoggingBurstLimit

Maximum number of packets per rate_limit. The default value is 25.

NeutronOVNLoggingLocalOutputLogBase

Output logfile path on agent side, default syslog file.

NeutronOVNLoggingRateLimit

Maximum number of packets logging per second. The default value is 100.

NeutronOVSAgentLoggingBurstLimit

Maximum number of packets per rate_limit. The default value is 25.

NeutronOVSAgentLoggingLocalOutputLogBase

Output logfile path on agent side, default syslog file.

NeutronOVSAgentLoggingRateLimit

Maximum number of packets logging per second. The default value is 100.

NeutronOVSFirewallDriver

Configure the classname of the firewall driver to use for implementing security groups. Possible values depend on system configuration. Some examples are: noop, openvswitch, iptables_hybrid. The default value of an empty string results in a default supported configuration.

NeutronOvsIntegrationBridge

Name of Open vSwitch bridge to use.

NeutronOvsResourceProviderBandwidths

Comma-separated list of <bridge>:<egress_bw>:<ingress_bw> tuples, showing the available bandwidth for the given bridge in the given direction. The direction is meant from VM perspective. Bandwidth is measured in kilobits per second (kbps). The bridge must appear in bridge_mappings as the value.

NeutronOVSTunnelCsum

Set or un-set the tunnel header checksum on outgoing IP packet carrying GRE/VXLAN tunnel. The default value is false.

NeutronOvsVnicTypeBlacklist

Comma-separated list of VNIC types for which support in OpenStack Networking (neutron) is administratively prohibited by the OVS mechanism driver.

NeutronPassword

The password for the OpenStack Networking (neutron) service and database account.

NeutronPermittedEthertypes

Set additional ethertypes to to be configured on OpenStack Networking (neutron) firewalls.

NeutronPhysicalDevMappings

List of <physical_network>:<physical device> All physical networks listed in network_vlan_ranges on the server should have mappings to appropriate interfaces on each agent. Example "tenant0:ens2f0,tenant1:ens2f1".

NeutronPluginExtensions

Comma-separated list of enabled extension plugins. The default value is qos,port_security,dns_domain_ports.

NeutronPluginMl2PuppetTags

Puppet resource tag names that are used to generate configuration files with puppet. The default value is neutron_plugin_ml2.

NeutronPortQuota

Number of ports allowed per tenant, and minus means unlimited. The default value is 500.

NeutronRouterSchedulerDriver

The router schedule driver to use for availability zones. The default value is neutron.scheduler.l3_agent_scheduler.AZLeastRoutersScheduler.

NeutronRpcWorkers

Sets the number of RPC workers for the OpenStack Networking (neutron) service. If not specified, it’ll take the value of NeutronWorkers and if this is not specified either, the default value results in the configuration being left unset and a system-dependent default will be chosen (usually 1).

NeutronSecurityGroupQuota

Number of security groups allowed per tenant, and minus means unlimited. The default value is 10.

NeutronServicePlugins

Comma-separated list of service plugin entrypoints. The default value is qos,ovn-router,trunk,segments,port_forwarding,log.

NeutronSriovAgentExtensions

Comma-separated list of extensions enabled for the OpenStack Networking (neutron) SR-IOV agents.

NeutronSriovResourceProviderBandwidths

Comma-separated list of <network_device>:<egress_bw>:<ingress_bw> tuples, showing the available bandwidth for the given device in the given direction. The direction is meant from VM perspective. Bandwidth is measured in kilobits per second (kbps). The device must appear in physical_device_mappings as the value.

NeutronSriovVnicTypeBlacklist

Comma-separated list of VNIC types for which support in OpenStack Networking (neutron) is administratively prohibited by the SR-IOV mechanism driver.

NeutronTunnelIdRanges

Comma-separated list of <tun_min>:<tun_max> tuples enumerating ranges of GRE tunnel IDs that are available for tenant network allocation. The default value is ['1:4094'].

NeutronTunnelTypes

The tunnel types for the OpenStack Networking (neutron) tenant network. The default value is vxlan.

NeutronTypeDrivers

Comma-separated list of network type driver entrypoints to be loaded. The default value is geneve,vxlan,vlan,flat.

NeutronVhostuserSocketDir

The vhost-user socket directory for OVS.

NeutronVniRanges

Comma-separated list of <vni_min>:<vni_max> tuples enumerating ranges of VXLAN VNI IDs that are available for tenant network allocation. The default value is ['1:65536'].

NeutronWorkers

Sets the number of API and RPC workers for the OpenStack Networking service. Note that more workers creates a larger number of processes on systems, which results in excess memory consumption. It is recommended to choose a suitable non-default value on systems with high CPU core counts. 0 sets to the OpenStack internal default, which is equal to the number of CPU cores on the node.

NotificationDriver

Driver or drivers to handle sending notifications. The default value is noop.

OVNAvailabilityZone

The az options to configure in ovs db. eg. [az-0, az-1, az-2].

OVNCMSOptions

The CMS options to configure in ovs db.

OVNContainerCpusetCpus

Limit the specific CPUs or cores a container can use. It can be specified as a single core (ex. 0), as a comma-separated list (ex. 0,1), as a range (ex. 0-3) or a combination if previous methods (ex 0-3,7,11-15). The selected cores should be isolated from guests and hypervisor in order to obtain best possible performance.

OVNControllerImageUpdateTimeout

During update, how long we wait for the container image to be updated, in seconds. The default value is 600.

OVNControllerUpdateTimeout

During update, how long we wait for the container to be updated, in seconds. The default value is 600.

OVNDbConnectionTimeout

Timeout in seconds for the OVSDB connection transaction. The default value is 180.

OvnDBSCertificateKeySize

Override the private key size used when creating the certificate for this service.

OVNDnsServers

List of servers to use as as dns forwarders.

OVNEmitNeedToFrag

Configure OVN to emit "need to frag" packets in case of MTU mismatch. Before enabling this configuration make sure that it’s supported by the host kernel (version >= 5.2) or by checking the output of the following command ovs-appctl -t ovs-vswitchd dpif/show-dp-features br-int | grep "Check pkt length action". The default value is false.

OVNEnableHaproxyDockerWrapper

Generate a wrapper script so that haproxy is launched in a separate container. The default value is true.

OVNEncapTos

The value to be applied to OVN tunnel interface’s option:tos as specified in the Open_vSwitch database Interface table. This feature is supported from OVN v21.12.0. The default value is 0.

OVNEncapType

Type of encapsulation used in OVN. It can be geneve or vxlan. The default value is geneve. If you change this value, make sure the new value is also listed in the parameter NeutronNetworkType. For example, if you change OVNEncapType to vxlan, ensure that the list in NeutronNetworkType includes vxlan. The default value is geneve.

OvnHardwareOffloadedQos

Enable the QoS support for hardware offloaded ports. The default value is false.

OVNIntegrationBridge

Name of the OVS bridge to use as integration bridge by OVN Controller. The default value is br-int.

OvnMetadataCertificateKeySize

Override the private key size used when creating the certificate for this service.

OVNMetadataEnabled

Whether Metadata Service has to be enabled. The default value is true.

OVNNeutronSyncMode

The synchronization mode of OVN with OpenStack Networking (neutron) DB. The default value is log.

OVNNorthboundClusterPort

Cluster port of the OVN Northbound DB server. The default value is 6643.

OVNNorthboundServerPort

Port of the OVN Northbound DB server. The default value is 6641.

OVNOfctrlWaitBeforeClear

Sets the time ovn-controller will wait on startup before clearing all openflow rules and installing the new ones, in ms. The default value is 8000.

OVNOpenflowProbeInterval

The inactivity probe interval of the OpenFlow connection to the OpenvSwitch integration bridge, in seconds. The default value is 60.

OVNOvsdbProbeInterval

Probe interval in ms for the OVSDB session. The default value is 60000.

OVNQosDriver

OVN notification driver for OpenStack Networking (neutron) QOS service plugin. The default value is ovn-qos.

OVNRemoteProbeInterval

Probe interval in ms. The default value is 60000.

OVNSouthboundClusterPort

Cluster port of the OVN Southbound DB server. The default value is 6644.

OVNSouthboundServerPort

Port of the OVN Southbound DB server. The default value is 6642.

OVNStaticBridgeMacMappings

Static OVN Bridge MAC address mappings. Unique OVN bridge mac addresses is dynamically allocated by creating OpenStack Networking (neutron) ports. When OpenStack Networking (neutron) isn’t available, for instance in the standalone deployment, use this parameter to provide static OVN bridge mac addresses. For example: controller-0: datacenter: 00:00:5E:00:53:00 provider: 00:00:5E:00:53:01 compute-0: datacenter: 00:00:5E:00:54:00 provider: 00:00:5E:00:54:01.

OvsDisableEMC

Disable OVS Exact Match Cache. The default value is false.

OvsHwOffload

Enable OVS Hardware Offload. This feature supported from OVS 2.8.0. The default value is false.

PythonInterpreter

The python interpreter to use for python and ansible actions. The default value is `$(command -v python3

command -v python)`.

TenantNetPhysnetMtu

MTU of the underlying physical network. OpenStack Networking (neutron) uses this value to calculate MTU for all virtual network components. For flat and VLAN networks, OpenStack Networking (neutron) uses this value without modification. For overlay networks such as VXLAN, OpenStack Networking (neutron) automatically subtracts the overlay protocol overhead from this value. (The mtu setting of the Tenant network in network_data.yaml control’s this parameter.). The default value is 1500.