puppet/services/kernel.yaml

   1 heat_template_version: ocata
   2
   3 description: >
   4   Load kernel modules with kmod and configure kernel options with sysctl.
   5
   6 parameters:
   7   ServiceNetMap:
   8     default: {}
   9     description: Mapping of service_name -> network name. Typically set
  10                  via parameter_defaults in the resource registry.  This
  11                  mapping overrides those in ServiceNetMapDefaults.
  12     type: json
  13   DefaultPasswords:
  14     default: {}
  15     type: json
  16   EndpointMap:
  17     default: {}
  18     description: Mapping of service endpoint -> protocol. Typically set
  19                  via parameter_defaults in the resource registry.
  20     type: json
  21   KernelPidMax:
  22     default: 1048576
  23     description: Configures sysctl kernel.pid_max key
  24     type: number
  25   KernelDisableIPv6:
  26     default: 0
  27     description: Configures sysctl net.ipv6.{default/all}.disable_ipv6 keys
  28     type: number
  29
  30 outputs:
  31   role_data:
  32     description: Role data for the Kernel modules
  33     value:
  34       service_name: kernel
  35       config_settings:
  36         kernel_modules:
  37           nf_conntrack: {}
  38           nf_conntrack_proto_sctp: {}
  39         sysctl_settings:
  40           net.ipv4.tcp_keepalive_intvl:
  41             value: 1
  42           net.ipv4.tcp_keepalive_probes:
  43             value: 5
  44           net.ipv4.tcp_keepalive_time:
  45             value: 5
  46           net.ipv4.conf.default.send_redirects:
  47             value: 0
  48           net.ipv4.conf.all.send_redirects:
  49             value: 0
  50           net.ipv4.conf.default.accept_redirects:
  51             value: 0
  52           net.ipv4.conf.default.secure_redirects:
  53             value: 0
  54           net.ipv4.conf.all.secure_redirects:
  55             value: 0
  56           net.ipv4.conf.default.log_martians:
  57             value: 1
  58           net.ipv4.conf.all.log_martians:
  59             value: 1
  60           net.nf_conntrack_max:
  61             value: 500000
  62           net.netfilter.nf_conntrack_max:
  63             value: 500000
  64           net.ipv6.conf.default.disable_ipv6:
  65             value: {get_param: KernelDisableIPv6}
  66           net.ipv6.conf.all.disable_ipv6:
  67             value: {get_param: KernelDisableIPv6}
  68           # prevent neutron bridges from autoconfiguring ipv6 addresses
  69           net.ipv6.conf.all.accept_ra:
  70             value: 0
  71           net.ipv6.conf.default.accept_ra:
  72             value: 0
  73           net.ipv6.conf.all.autoconf:
  74             value: 0
  75           net.ipv6.conf.default.autoconf:
  76             value: 0
  77           net.ipv6.conf.default.accept_redirects:
  78             value: 0
  79           net.ipv6.conf.all.accept_redirects:
  80             value: 0
  81           net.core.netdev_max_backlog:
  82             value: 10000
  83           kernel.pid_max:
  84             value: {get_param: KernelPidMax}
  85           kernel.dmesg_restrict:
  86             value: 1
  87           fs.suid_dumpable:
  88             value: 0
  89       step_config: |
  90         include ::tripleo::profile::base::kernel