puppet/services/kernel.yaml

   1 heat_template_version: ocata
   2
   3 description: >
   4   Load kernel modules with kmod and configure kernel options with sysctl.
   5
   6 parameters:
   7   ServiceNetMap:
   8     default: {}
   9     description: Mapping of service_name -> network name. Typically set
  10                  via parameter_defaults in the resource registry.  This
  11                  mapping overrides those in ServiceNetMapDefaults.
  12     type: json
  13   DefaultPasswords:
  14     default: {}
  15     type: json
  16   EndpointMap:
  17     default: {}
  18     description: Mapping of service endpoint -> protocol. Typically set
  19                  via parameter_defaults in the resource registry.
  20     type: json
  21   KernelPidMax:
  22     default: 1048576
  23     description: Configures sysctl kernel.pid_max key
  24     type: number
  25
  26 outputs:
  27   role_data:
  28     description: Role data for the Kernel modules
  29     value:
  30       service_name: kernel
  31       config_settings:
  32         kernel_modules:
  33           nf_conntrack: {}
  34           nf_conntrack_proto_sctp: {}
  35         sysctl_settings:
  36           net.ipv4.tcp_keepalive_intvl:
  37             value: 1
  38           net.ipv4.tcp_keepalive_probes:
  39             value: 5
  40           net.ipv4.tcp_keepalive_time:
  41             value: 5
  42           net.ipv4.conf.default.send_redirects:
  43             value: 0
  44           net.ipv4.conf.all.send_redirects:
  45             value: 0
  46           net.ipv4.conf.default.accept_redirects:
  47             value: 0
  48           net.ipv4.conf.default.secure_redirects:
  49             value: 0
  50           net.ipv4.conf.all.secure_redirects:
  51             value: 0
  52           net.ipv4.conf.default.log_martians:
  53             value: 1
  54           net.ipv4.conf.all.log_martians:
  55             value: 1
  56           net.nf_conntrack_max:
  57             value: 500000
  58           net.netfilter.nf_conntrack_max:
  59             value: 500000
  60           # prevent neutron bridges from autoconfiguring ipv6 addresses
  61           net.ipv6.conf.all.accept_ra:
  62             value: 0
  63           net.ipv6.conf.default.accept_ra:
  64             value: 0
  65           net.ipv6.conf.all.autoconf:
  66             value: 0
  67           net.ipv6.conf.default.autoconf:
  68             value: 0
  69           net.ipv6.conf.default.accept_redirects:
  70             value: 0
  71           net.ipv6.conf.all.accept_redirects:
  72             value: 0
  73           net.core.netdev_max_backlog:
  74             value: 10000
  75           kernel.pid_max:
  76             value: {get_param: KernelPidMax}
  77           kernel.dmesg_restrict:
  78             value: 1
  79           fs.suid_dumpable:
  80             value: 0
  81       step_config: |
  82         include ::tripleo::profile::base::kernel