puppet/services/kernel.yaml

   1 heat_template_version: ocata
   2
   3 description: >
   4   Load kernel modules with kmod and configure kernel options with sysctl.
   5
   6 parameters:
   7   ServiceNetMap:
   8     default: {}
   9     description: Mapping of service_name -> network name. Typically set
  10                  via parameter_defaults in the resource registry.  This
  11                  mapping overrides those in ServiceNetMapDefaults.
  12     type: json
  13   DefaultPasswords:
  14     default: {}
  15     type: json
  16   RoleName:
  17     default: ''
  18     description: Role name on which the service is applied
  19     type: string
  20   RoleParameters:
  21     default: {}
  22     description: Parameters specific to the role
  23     type: json
  24   EndpointMap:
  25     default: {}
  26     description: Mapping of service endpoint -> protocol. Typically set
  27                  via parameter_defaults in the resource registry.
  28     type: json
  29   KernelPidMax:
  30     default: 1048576
  31     description: Configures sysctl kernel.pid_max key
  32     type: number
  33   KernelDisableIPv6:
  34     default: 0
  35     description: Configures sysctl net.ipv6.{default/all}.disable_ipv6 keys
  36     type: number
  37
  38 outputs:
  39   role_data:
  40     description: Role data for the Kernel modules
  41     value:
  42       service_name: kernel
  43       config_settings:
  44         kernel_modules:
  45           nf_conntrack: {}
  46           nf_conntrack_proto_sctp: {}
  47         sysctl_settings:
  48           net.ipv4.tcp_keepalive_intvl:
  49             value: 1
  50           net.ipv4.tcp_keepalive_probes:
  51             value: 5
  52           net.ipv4.tcp_keepalive_time:
  53             value: 5
  54           net.ipv4.conf.default.send_redirects:
  55             value: 0
  56           net.ipv4.conf.all.send_redirects:
  57             value: 0
  58           net.ipv4.conf.default.accept_redirects:
  59             value: 0
  60           net.ipv4.conf.default.secure_redirects:
  61             value: 0
  62           net.ipv4.conf.all.secure_redirects:
  63             value: 0
  64           net.ipv4.conf.default.log_martians:
  65             value: 1
  66           net.ipv4.conf.all.log_martians:
  67             value: 1
  68           net.nf_conntrack_max:
  69             value: 500000
  70           net.netfilter.nf_conntrack_max:
  71             value: 500000
  72           net.ipv6.conf.default.disable_ipv6:
  73             value: {get_param: KernelDisableIPv6}
  74           net.ipv6.conf.all.disable_ipv6:
  75             value: {get_param: KernelDisableIPv6}
  76           # prevent neutron bridges from autoconfiguring ipv6 addresses
  77           net.ipv6.conf.all.accept_ra:
  78             value: 0
  79           net.ipv6.conf.default.accept_ra:
  80             value: 0
  81           net.ipv6.conf.all.autoconf:
  82             value: 0
  83           net.ipv6.conf.default.autoconf:
  84             value: 0
  85           net.ipv6.conf.default.accept_redirects:
  86             value: 0
  87           net.ipv6.conf.all.accept_redirects:
  88             value: 0
  89           net.core.netdev_max_backlog:
  90             value: 10000
  91           kernel.pid_max:
  92             value: {get_param: KernelPidMax}
  93           kernel.dmesg_restrict:
  94             value: 1
  95           fs.suid_dumpable:
  96             value: 0
  97       step_config: |
  98         include ::tripleo::profile::base::kernel