Merge "Enable TLS in the internal networkf or Mysql"

[apex-tripleo-heat-templates.git] / network / config / multiple-nics / controller-v6.yaml

diff --git a/network/config/multiple-nics/controller-v6.yaml b/network/config/multiple-nics/controller-v6.yaml
index b69879f..bbc89ab 100644 (file)
--- a/network/config/multiple-nics/controller-v6.yaml
+++ b/network/config/multiple-nics/controller-v6.yaml
@@ -59,10 +59,6 @@ parameters:
     default: 60
     description: Vlan ID for the management network traffic.
     type: number
-  ExternalInterfaceDefaultRoute:
-    default: '10.0.0.1'
-    description: default route for the external network
-    type: string
   ControlPlaneSubnetCidr: # Override this via parameter_defaults
     default: '24'
     description: The subnet CIDR of the control plane network.
@@ -70,6 +66,14 @@ parameters:
   ControlPlaneDefaultRoute: # Override this via parameter_defaults
     description: The default route of the control plane network.
     type: string
+  ExternalInterfaceDefaultRoute:
+    default: '10.0.0.1'
+    description: default route for the external network
+    type: string
+  ManagementInterfaceDefaultRoute: # Commented out by default in this template
+    default: unset
+    description: The default route of the management network.
+    type: string
   DnsServers: # Override this via parameter_defaults
     default: []
     description: A list of DNS servers (2 max for some implementations) that will be added to resolv.conf.
@@ -102,6 +106,7 @@ resources:
                 -
                   ip_netmask: 169.254.169.254/32
                   next_hop: {get_param: EC2MetadataIp}
+                # IPv4 Default Route
                 -
                   default: true
                   next_hop: {get_param: ControlPlaneDefaultRoute}
@@ -127,7 +132,6 @@ resources:
                 -
                   ip_netmask: {get_param: InternalApiIpSubnet}
             -
-              # Create a bridge which can also be used for VLAN-mode bridge mapping
               type: ovs_bridge
               name: br-tenant
               use_dhcp: false
@@ -139,7 +143,6 @@ resources:
                   type: interface
                   name: nic5
                   use_dhcp: false
-                  # force the MAC address of the bridge to this interface
                   primary: true
             -
               type: ovs_bridge
@@ -157,9 +160,11 @@ resources:
                 -
                   type: interface
                   name: nic6
-                  # force the MAC address of the bridge to this interface
                   primary: true
             # Uncomment when including environments/network-management.yaml
+            # If setting default route on the Management interface, comment
+            # out the default route on the External interface. This will
+            # make the External API unreachable from remote subnets.
             #-
             #  type: interface
             #  name: nic7
@@ -167,6 +172,10 @@ resources:
             #  addresses:
             #    -
             #      ip_netmask: {get_param: ManagementIpSubnet}
+            #  routes:
+            #    -
+            #      default: true
+            #      next_hop: {get_param: ManagementInterfaceDefaultRoute}
 
 outputs:
   OS::stack_id: