MCP Salt Formulas¶

Usage¶

This file provides the debmirror sample pillars configurations for different use cases.

See debmirror/schemas/*.yaml for all possible options A sample of one debmirror mirror configuration (Ubuntu):

parameters:
  debmirror:
    client:
      enabled: true
      mirrors:
        target01:
          enabled: true
          fetch_retry: 3
          http_proxy : "url"
          https_proxy: "url"
          ftp_proxy: "url"
          rsync_proxy: "url"
          # no_proxy: ['val1', 'val2'] The no_proxy parameter has been removed.
          # To bypass the system proxy, set http_proxy to an empty string.
          force: False
          lock_target: True
          extra_flags: [ '--verbose', '--progress', '--nosource', '--no-check-gpg', '--rsync-extra=none' ]
          method: "rsync" # string
          arch: [ 'amd64' ]
          mirror_host: "mirror.mirantis.com" # rsync
          mirror_root: ':mirror/nightly/ubuntu/'
          cache_dir: "/var/www/mirror/.cache/ubuntu"
          target_dir: "/var/www/mirror/ubuntu/"
          log_file: "/var/www/mirror/target01_log.log"
          dist: [ xenial ] #, xenial-security, xenial-updates ]
          section: [ main ] #, multiverse, restricted, universe ]
          exclude_deb_section: [ 'games', gnome, Xfce, sound, electronics, graphics, hamradio , doc, localization, kde, video ]
          filter:
            00: "--exclude=/"
            01: "--exclude='/android*'"
            02: "--exclude='/firefox*'"
            03: "--exclude='/chromium-browser*'"
            04: "--exclude='/ceph*'"
            05: "--exclude='/*-wallpapers*'"
            06: "--exclude='/language-pack-(?!en)'"
            07: "--include='/main(.*)manpages'"
            08: "--include='/main(.*)python-(.*)doc'"
            09: "--include='/main(.*)python-(.*)network'"

The cache_dir parameter is optional and can be used to avoid extra disk space usage for repos, which can have same packages, by using hardlinks to files.

Metadata schema specifications for debmirror client¶

Usage¶

The Network Time Protocol (NTP) formula is used to properly synchronize services across the nodes. This file provides the sample configurations for different use cases.

• [Deprecated] NTP client configuration, should not be used if the stratum parameter exists:

  ntp:
    client:
      enabled: true
      strata:
      - ntp.cesnet.cz
      - ntp.nic.cz
  

• The NTP client extended definition with auth:

  ntp:
    client:
      enabled: true
      stratum:
        primary:
          server: ntp.cesnet.cz
          key_id: 1
        secondary:
          server: ntp.nic.cz
          key_id: 2
  

• The NTP client with MD5 auth configuration:

  ntp:
    client:
      enabled: true
      auth:
        enabled: true
        secrets:
          1:
            secret_type: 'M'
            secret: 'Runrabbitrundigthath'
            trustedkey: true
          2:
            secret_type: 'M'
            secret: 'Howiwishyouwereherew'
            trustedkey: true
      stratum:
        primary:
          server: ntp.cesnet.cz
          key_id: 1
        secondary:
          server: ntp.nic.cz
          key_id: 2
  

• The NTP server with MD5 auth configuration:

  ntp:
    client:
      enabled: false
    server:
      enabled: true
      auth:
        enabled: true
        secrets:
          1:
            secret_type: 'M'
            secret: 'Runrabbitrundigthath'
            trustedkey: true
          2:
            secret_type: 'M'
            secret: 'Howiwishyouwereherew'
            trustedkey: true
      stratum:
        primary:
          server: ntp.cesnet.cz
          key_id: 1
        secondary:
          server: ntp.nic.cz
          key_id: 2
  

• A cleaning up of the NTP configurations left by DHCP:

  ntp:
    client:
      enabled: true
      remove_dhcp_conf: true # default false
  

• The NTP server simple peering definition:

  ntp:
    server:
      peers:
      - 192.168.0.241
      - 192.168.0.242
  

• The NTP server extended peering definition:

  ntp:
     server:
       peers:
         1:
           host: 192.168.31.1
         2:
           host: 192.168.31.2
         3:
           host: 192.168.31.3
  

• The NTP server definition enabling the listen and ignore actions on specific addresses:

  ntp:
    server:
        1:
          value: wildcard
          action: ignore
        2:
          value: ::1
          action: listen
        3:
          value: 192.168.31.1
          action: listen
  

Read more

• https://collectd.org/wiki/index.php/Plugin:NTPd

Metadata schema specifications for NTP client¶

Metadata schema specifications for NTP server¶

Usage¶

OpenSSH is a free version of the SSH connectivity tools that technical users of the Internet rely on. The passwords of Telnet, remote login (rlogin), and File Transfer Protocol (FTP) users are transmitted across the Internet unencrypted. OpenSSH encrypts all traffic, including passwords, to effectively eliminate eavesdropping, connection hijacking, and other attacks. Additionally, OpenSSH provides secure tunneling capabilities and several authentication methods, and supports all SSH protocol versions.

This file provides the sample pillars configurations for different use cases.

OpenSSH client

• The OpenSSH client configuration with a shared private key:

  openssh:
    client:
      enabled: true
      use_dns: False
      user:
        root:
          enabled: true
          private_key:
            type: rsa
            key: ${_param:root_private_key}
          user: ${linux:system:user:root}
  

• The OpenSSH client configuration with an individual private key and known host:

  openssh:
    client:
      enabled: true
      user:
        root:
          enabled: true
          user: ${linux:system:user:root}
          known_hosts:
          - name: repo.domain.com
            type: rsa
            fingerprint: dd:fa:e8:68:b1:ea:ea:a0:63:f1:5a:55:48:e1:7e:37
            fingerprint_hash_type: sha256|md5
  

• The OpenSSH client configuration with keep alive settings:

  openssh:
    client:
      alive:
        interval: 600
        count: 3
  

OpenSSH server

• The OpenSSH server simple configuration:

  openssh:
    server:
      enabled: true
      permit_root_login: true
      public_key_auth: true
      password_auth: true
      host_auth: true
      banner: Welcome to server!
      bind:
        address: 0.0.0.0
        port: 22
  

• The OpenSSH server configuration with auth keys for users:

  openssh:
    server:
      enabled: true
      bind:
        address: 0.0.0.0
        port: 22
      ...
      user:
        newt:
          enabled: true
          user: ${linux:system:user:newt}
          public_keys:
          - ${public_keys:newt}
        root:
          enabled: true
          purge: true
          user: ${linux:system:user:root}
          public_keys:
          - ${public_keys:newt}
  

  Note

  Setting the purge parameter to true ensures that the exact authorized_keys contents will be filled explicitly from the model and undefined keys will be removed.

• The OpenSSH server configuration that binds OpenSSH on multiple addresses and ports:

  openssh:
    server:
      enabled: true
      binds:
        - address: 127.0.0.1
          port: 22
        - address: 192.168.1.1
          port: 2222
  

• The OpenSSH server with FreeIPA configuration:

  openssh:
    server:
      enabled: true
      bind:
        address: 0.0.0.0
        port: 22
      public_key_auth: true
      authorized_keys_command:
        command: /usr/bin/sss_ssh_authorizedkeys
        user: nobody
  

• The OpenSSH server configuration with keep alive settings:

  openssh:
    server:
      alive:
        keep: yes
        interval: 600
        count: 3
  #
  # will give you an timeout of 30 minutes (600 sec x 3)
  

• The OpenSSH server configuration with the DSA legacy keys enabled:

  openssh:
    server:
      dss_enabled: true
  

• The OpenSSH server configuration with the duo 2FA https://duo.com/docs/duounix with Match User 2FA can be bypassed for some accounts

  openssh:
    server:
      use_dns: false
      password_auth: false
      challenge_response_auth: true
      ciphers:
        aes256-ctr:
          enabled: true
        aes192-ctr:
          enabled: true
        aes128-ctr:
          enabled: true
      authentication_methods:
        publickey:
          enabled: true
        keyboard-interactive:
          enabled: true
      match_user:
        jenkins:
          authentication_methods:
            publickey:
              enabled: true
  

• OpenSSH server configuration supports AllowUsers, DenyUsers, AllowGroup, DenyGroups via allow_users, deny_users, allow_groups, deny_groups keys respectively.

  For example, here is how to manage AllowUsers configuration item:

  openssh:
    server:
      allow_users:
        <user_name>:
          enabled: true
        <pattern_list_name>:
          enabled: true
          pattern: <pattern>
  

Elements of allow_users are either user names or pattern list names:

• <user name> goes to configurational file as is.
• <pattern list name> is not used directly - its main purpose is to provide a meaningfull name for a pattern specified in ‘pattern’ key. Another advantage is that pattern can be overriden.

<enabled> by default is ‘true’.

See PATTERNS in ssh_config(5) for more information on what <pattern> is.

CIS Compliance

There is a number of configuration options that make the OpenSSH service compliant with CIS Benchmark. These options can be found under metadata/service/server/cis, and are not enabled by default. For each CIS item a comprehensive description is provided with the pillar data.

See also https://www.cisecurity.org/cis-benchmarks/ for the details abouth CIS Benchmark.

Read more

• http://www.openssh.org/manual.html
• https://help.ubuntu.com/community/SSH/OpenSSH/Configuring
• http://www.cyberciti.biz/tips/linux-unix-bsd-openssh-server-best-practices.html
• http://www.zeitoun.net/articles/ssh-through-http-proxy/start

Metadata Schema Specifications for OpenSSH client¶

Metadata schema specifications for OpenSSH server¶

Usage¶

The Aptly formula configures and installs the Aptly server and client.

The available states include:

• aptly.server
• aptly.publisher

The available metadata include:

• metadata.aptly.server.single
• metadata.aptly.client.publisher

This file provides the sample configurations for different use cases.

• Reclass examples:

  • The basic Aptly server configuration without repositories or mirrors:

    classes:
    - service.aptly.server.single
    parameters:
       aptly:
         server:
           enabled: true
           secure: true
           gpg_keypair_id: A76882D3
           gpg_passphrase:
           gpg_public_key: |
             -----BEGIN PGP PUBLIC KEY BLOCK-----
             Version: GnuPG v1
             ...
           gpg_private_key: |
             -----BEGIN PGP PRIVATE KEY BLOCK-----
             Version: GnuPG v1
             ...
    

  • The definition of an s3 endpoint:

    parameters:
      aptly:
        server:
          endpoint:
            mys3endpoint:
              engine: s3
              awsAccessKeyID: xxxx
              awsSecretAccessKey: xxxx
              bucket: test
    

• Pillar examples:

  • The Aptly server basic configuration:

    aptly:
      server:
        enabled: true
        repo:
          myrepo:
            distribution: trusty
            component: main
            architectures: amd64
            comment: "Custom components"
            publisher:
              component: mycomponent
              distributions:
                - nightly/trusty
    

  • The Aptly server mirrors configuration:

    aptly:
      server:
        mirror:
          mirror_name:
            source: http://example.com/debian
            distribution: xenial
            components: main
            architectures: amd64
            gpgkeys: 460F3999
            filter: "!(Name (% *-dbg))"
            filter_with_deps: true
            publisher:
              component: example
              distributions:
                - xenial/repo/nightly
                - "s3:aptcdn:xenial/repo/nightly"
    

  • The definition of the proxy environment variables in cron job for mirroring script:

    aptly:
      server:
        enabled: true
        ...
        mirror_update:
          enabled: true
          http_proxy: "http://1.2.3.4:8000"
          https_proxy: "http://1.2.3.4:8000"
        ...
    

Read more

• http://www.aptly.info/doc/configuration/

Metadata schema specifications for aptly publisher¶

Metadata schema specifications for aptly server¶

Usage¶

Cinder provides an infrastructure for managing volumes in OpenStack. Originally, this project was the Nova component called nova-volume and starting from the Folsom OpenStack release it has become an independent project.

This file provides the sample configurations for different use cases:

• Pillar sample of a basic Cinder configuration:

  The pillar structure defines cinder-api and cinder-scheduler inside the controller role and cinder-volume inside the to volume role.

  cinder:
    controller:
      enabled: true
      version: juno
      cinder_uid: 304
      cinder_gid: 304
      nas_secure_file_permissions: false
      nas_secure_file_operations: false
      cinder_internal_tenant_user_id: f46924c112a14c80ab0a24a613d95eef
      cinder_internal_tenant_project_id: b7455b8974bb4064ad247c8f375eae6c
      default_volume_type: 7k2SaS
      enable_force_upload: true
      availability_zone_fallback: True
      database:
        engine: mysql
        host: 127.0.0.1
        port: 3306
        name: cinder
        user: cinder
        password: pwd
      identity:
        engine: keystone
        host: 127.0.0.1
        port: 35357
        tenant: service
        user: cinder
        password: pwd
      message_queue:
        engine: rabbitmq
        host: 127.0.0.1
        port: 5672
        user: openstack
        password: pwd
        virtual_host: '/openstack'
     client:
       connection_params:
         connect_retries: 50
         connect_retry_delay: 1
      backend:
        7k2_SAS:
          engine: storwize
          type_name: slow-disks
          host: 192.168.0.1
          port: 22
          user: username
          password: pass
          connection: FC/iSCSI
          multihost: true
          multipath: true
          pool: SAS7K2
      audit:
        enabled: false
      osapi_max_limit: 500
      barbican:
        enabled: true
  
  cinder:
    volume:
      enabled: true
      version: juno
      cinder_uid: 304
      cinder_gid: 304
      nas_secure_file_permissions: false
      nas_secure_file_operations: false
      cinder_internal_tenant_user_id: f46924c112a14c80ab0a24a613d95eef
      cinder_internal_tenant_project_id: b7455b8974bb4064ad247c8f375eae6c
      default_volume_type: 7k2SaS
      enable_force_upload: true
      my_ip: 192.168.0.254
      database:
        engine: mysql
        host: 127.0.0.1
        port: 3306
        name: cinder
        user: cinder
        password: pwd
      identity:
        engine: keystone
        host: 127.0.0.1
        port: 35357
        tenant: service
        user: cinder
        password: pwd
      message_queue:
        engine: rabbitmq
        host: 127.0.0.1
        port: 5672
        user: openstack
        password: pwd
        virtual_host: '/openstack'
      backend:
        7k2_SAS:
          engine: storwize
          type_name: 7k2 SAS disk
          host: 192.168.0.1
          port: 22
          user: username
          password: pass
          connection: FC/iSCSI
          multihost: true
          multipath: true
          pool: SAS7K2
      audit:
        enabled: false
      barbican:
        enabled: true
  

Volume vmware related options:

cinder:
  volume:
    backend:
      vmware:
        engine: vmware
        host_username: vmware
        host_password: vmware
        cluster_names: vmware_cluster01,vmware_cluster02

• The CORS parameters enablement:

  cinder:
    controller:
      cors:
        allowed_origin: https:localhost.local,http:localhost.local
        expose_headers: X-Auth-Token,X-Openstack-Request-Id,X-Subject-Token
        allow_methods: GET,PUT,POST,DELETE,PATCH
        allow_headers: X-Auth-Token,X-Openstack-Request-Id,X-Subject-Token
        allow_credentials: True
        max_age: 86400
  

• The client-side RabbitMQ HA setup for the controller:

  cinder:
    controller:
      ....
      message_queue:
        engine: rabbitmq
        members:
          - host: 10.0.16.1
          - host: 10.0.16.2
          - host: 10.0.16.3
        user: openstack
        password: pwd
        virtual_host: '/openstack'
      ....
  

• The client-side RabbitMQ HA setup for the volume component

  cinder:
    volume:
      ....
      message_queue:
        engine: rabbitmq
        members:
          - host: 10.0.16.1
          - host: 10.0.16.2
          - host: 10.0.16.3
        user: openstack
        password: pwd
        virtual_host: '/openstack'
      ....
  

• Configuring TLS communications.

  Note

  By default, system-wide installed CA certs are used. Therefore, the cacert_file and cacert parameters are optional.

  • RabbitMQ TLS:

    cinder:
      controller, volume:
         message_queue:
           port: 5671
           ssl:
             enabled: True
             (optional) cacert: cert body if the cacert_file does not exists
             (optional) cacert_file: /etc/openstack/rabbitmq-ca.pem
             (optional) version: TLSv1_2
    

  • MySQL TLS:

    cinder:
      controller:
         database:
           ssl:
             enabled: True
             (optional) cacert: cert body if the cacert_file does not exists
             (optional) cacert_file: /etc/openstack/mysql-ca.pem
    

  • Openstack HTTPS API:

    cinder:
     controller, volume:
         identity:
            protocol: https
            (optional) cacert_file: /etc/openstack/proxy.pem
         glance:
            protocol: https
            (optional) cacert_file: /etc/openstack/proxy.pem
    

• Cinder setup with zeroing deleted volumes:

  cinder:
    controller:
      enabled: true
      wipe_method: zero
      ...
  

• Cinder setup with shreding deleted volumes:

  cinder:
    controller:
      enabled: true
      wipe_method: shred
      ...
  

• Configuration of policy.json file:

  cinder:
    controller:
      ....
      policy:
        'volume:delete': 'rule:admin_or_owner'
        # Add key without value to remove line from policy.json
        'volume:extend':
  

• Default Cinder backend lvm_type setup:

  cinder:
    volume:
      enabled: true
      backend:
        # Type of LVM volumes to deploy; (default, thin, or auto). Auto defaults to thin if thin is supported.
        lvm_type: auto
  

• Default Cinder setup with iSCSI target:

  cinder:
    controller:
      enabled: true
      version: mitaka
      default_volume_type: lvmdriver-1
      database:
        engine: mysql
        host: 127.0.0.1
        port: 3306
        name: cinder
        user: cinder
        password: pwd
      identity:
        engine: keystone
        host: 127.0.0.1
        port: 35357
        tenant: service
        user: cinder
        password: pwd
      message_queue:
        engine: rabbitmq
        host: 127.0.0.1
        port: 5672
        user: openstack
        password: pwd
        virtual_host: '/openstack'
      backend:
        lvmdriver-1:
          engine: lvm
          type_name: lvmdriver-1
          volume_group: cinder-volume
  

• Cinder setup for IBM Storwize:

  cinder:
    volume:
      enabled: true
      backend:
        7k2_SAS:
          engine: storwize
          type_name: 7k2 SAS disk
          host: 192.168.0.1
          port: 22
          user: username
          password: pass
          connection: FC/iSCSI
          multihost: true
          multipath: true
          pool: SAS7K2
        10k_SAS:
          engine: storwize
          type_name: 10k SAS disk
          host: 192.168.0.1
          port: 22
          user: username
          password: pass
          connection: FC/iSCSI
          multihost: true
          multipath: true
          pool: SAS10K
        15k_SAS:
          engine: storwize
          type_name: 15k SAS
          host: 192.168.0.1
          port: 22
          user: username
          password: pass
          connection: FC/iSCSI
          multihost: true
          multipath: true
          pool: SAS15K
  

• Cinder setup with NFS:

  cinder:
    controller:
      enabled: true
      default_volume_type: nfs-driver
      backend:
        nfs-driver:
          engine: nfs
          type_name: nfs-driver
          volume_group: cinder-volume
          path: /var/lib/cinder/nfs
          devices:
          - 172.16.10.110:/var/nfs/cinder
          options: rw,sync
  

• Cinder setup with NetApp:

  cinder:
    controller:
      backend:
        netapp:
          engine: netapp
          type_name: netapp
          user: openstack
          vserver: vm1
          server_hostname: 172.18.2.3
          password: password
          storage_protocol: nfs
          transport_type: https
          lun_space_reservation: enabled
          use_multipath_for_image_xfer: True
          nas_secure_file_operations: false
          nas_secure_file_permissions: false
          devices:
            - 172.18.1.2:/vol_1
            - 172.18.1.2:/vol_2
            - 172.18.1.2:/vol_3
            - 172.18.1.2:/vol_4
  linux:
    system:
      package:
        nfs-common:
          version: latest
  

• Cinder setup with Hitachi VPS:

  cinder:
    controller:
      enabled: true
      backend:
        hus100_backend:
          type_name: HUS100
          backend: hus100_backend
          engine: hitachi_vsp
          connection: FC
  

• Cinder setup with Hitachi VPS with defined ldev range:

  cinder:
    controller:
      enabled: true
      backend:
        hus100_backend:
          type_name: HUS100
          backend: hus100_backend
          engine: hitachi_vsp
          connection: FC
          ldev_range: 0-1000
  

• Cinder setup with Ceph:

  cinder:
    controller:
      enabled: true
      backend:
        ceph_backend:
          type_name: standard-iops
          backend: ceph_backend
          backend_host: ceph
          pool: volumes
          engine: ceph
          user: cinder
          secret_uuid: da74ccb7-aa59-1721-a172-0006b1aa4e3e
          client_cinder_key: AQDOavlU6BsSJhAAnpFR906mvdgdfRqLHwu0Uw==
          report_discard_supported: True
          image_volume_cache_enabled: False
  

  Note

  Ceph official documentation

• Cinder setup with HP3par:

  cinder:
    controller:
      enabled: true
      backend:
        hp3par_backend:
          type_name: hp3par
          backend: hp3par_backend
          user: hp3paruser
          password: something
          url: http://10.10.10.10/api/v1
          cpg: OpenStackCPG
          host: 10.10.10.10
          login: hp3paradmin
          sanpassword: something
          debug: True
          snapcpg: OpenStackSNAPCPG
  

• Cinder setup with Fujitsu Eternus:

  Note

  Starting from MCP 2019.2.14 maintenance update, the new backend_host parameter overrides host.

  cinder:
    volume:
      enabled: true
      backend:
        10kThinPro:
          type_name: 10kThinPro
          engine: fujitsu
          pool: 10kThinPro
          backend_host: 192.168.0.1
          port: 5988
          user: username
          password: pass
          connection: FC/iSCSI
          name: 10kThinPro
        10k_SAS:
          type_name: 10k_SAS
          pool: SAS10K
          engine: fujitsu
          backend_host: 192.168.0.1
          port: 5988
          user: username
          password: pass
          connection: FC/iSCSI
          name: 10k_SAS
  

• Cinder setup with IBM GPFS filesystem:

  cinder:
    volume:
      enabled: true
      backend:
        GPFS-GOLD:
          type_name: GPFS-GOLD
          engine: gpfs
          mount_point: '/mnt/gpfs-openstack/cinder/gold'
        GPFS-SILVER:
          type_name: GPFS-SILVER
          engine: gpfs
          mount_point: '/mnt/gpfs-openstack/cinder/silver'
  

• Cinder setup with HP LeftHand:

  cinder:
    volume:
      enabled: true
      backend:
        HP-LeftHand:
          type_name: normal-storage
          engine: hp_lefthand
          api_url: 'https://10.10.10.10:8081/lhos'
          username: user
          password: password
          clustername: cluster1
          iscsi_chap_enabled: false
  

• Extra parameters for HP LeftHand:

  cinder type-key normal-storage set hplh:data_pl=r-10-2 hplh:provisioning=full
  

• Cinder setup with Solidfire:

  cinder:
    volume:
      enabled: true
      backend:
        solidfire:
          type_name: normal-storage
          engine: solidfire
          san_ip: 10.10.10.10
          san_login: user
          san_password: password
          clustername: cluster1
          sf_emulate_512: false
          sf_api_port: 14443
          host: ctl01
          #for compatibility with old versions
          sf_account_prefix: PREFIX
  

• Cinder setup with Block Device driver:

  cinder:
    volume:
      enabled: true
      backend:
        bdd:
          engine: bdd
          enabled: true
          type_name: bdd
          devices:
            - sdb
            - sdc
            - sdd
  

• Enable cinder-backup service for ceph

  cinder:
    controller:
      enabled: true
      version: mitaka
      backup:
        engine: ceph
        ceph_conf: "/etc/ceph/ceph.conf"
        ceph_pool: backup
        ceph_stripe_count: 0
        ceph_stripe_unit: 0
        ceph_user: cinder
        ceph_chunk_size: 134217728
        restore_discard_excess_bytes: false
    volume:
      enabled: true
      version: mitaka
      backup:
        engine: ceph
        ceph_conf: "/etc/ceph/ceph.conf"
        ceph_pool: backup
        ceph_stripe_count: 0
        ceph_stripe_unit: 0
        ceph_user: cinder
        ceph_chunk_size: 134217728
        restore_discard_excess_bytes: false
  

• Auditing filter (CADF) enablement:

  cinder:
    controller:
      audit:
        enabled: true
    ....
        filter_factory: 'keystonemiddleware.audit:filter_factory'
        map_file: '/etc/pycadf/cinder_api_audit_map.conf'
    ....
    volume:
      audit:
        enabled: true
    ....
        filter_factory: 'keystonemiddleware.audit:filter_factory'
        map_file: '/etc/pycadf/cinder_api_audit_map.conf'
  

• Cinder setup with custom availability zones:

  cinder:
    controller:
      default_availability_zone: my-default-zone
      storage_availability_zone: my-custom-zone-name
  cinder:
    volume:
      default_availability_zone: my-default-zone
      storage_availability_zone: my-custom-zone-name
  

  The default_availability_zone is used when a volume has been created, without specifying a zone in the create request as this zone must exist in your configuration.

  The storage_availability_zone is an actual zone where the node belongs to and must be specified per each node.

• Cinder setup with custom non-admin volume query filters:

  cinder:
    controller:
      query_volume_filters:
        - name
        - status
        - metadata
        - availability_zone
        - bootable
  

• public_endpoint and osapi_volume_base_url:

  • public_endpoint

    Used for configuring versions endpoint

  • osapi_volume_base_URL

    Used to present Cinder URL to users

  These parameters can be useful when running Cinder under load balancer in SSL.

  cinder:
    controller:
      public_endpoint_address: https://${_param:cluster_domain}:8776
  

• Client role definition:

  cinder:
    client:
      enabled: true
      identity:
        host: 127.0.0.1
        port: 35357
        project: service
        user: cinder
        password: pwd
        protocol: http
        endpoint_type: internalURL
        region_name: RegionOne
      connection_params:
        connect_retries: 5
        connect_retry_delay: 1
      backend:
        ceph:
          type_name: standard-iops
          engine: ceph
          key:
            conn_speed: fibre-10G
  

• Barbican integration enablement:

  cinder:
    controller:
      barbican:
        enabled: true
  

• Keystone API version specification (v3 is default):

  cinder:
    controller:
      identity:
        api_version: v2.0
  

Enhanced logging with logging.conf

By default logging.conf is disabled. You can enable per-binary logging.conf by setting the following parameters:

• openstack_log_appender

  Set to true to enable log_config_append for all OpenStack services

• openstack_fluentd_handler_enabled

  Set to true to enable FluentHandler for all Openstack services

• openstack_ossyslog_handler_enabled

  Set to true to enable OSSysLogHandler for all Openstack services

Only WatchedFileHandler, OSSysLogHandler, and FluentHandler are available.

To configure this functionality with pillar:

cinder:
  controller:
    logging:
      log_appender: true
      log_handlers:
        watchedfile:
          enabled: true
        fluentd:
          enabled: true
        ossyslog:
          enabled: true

  volume:
    logging:
      log_appender: true
      log_handlers:
        watchedfile:
          enabled: true
        fluentd:
          enabled: true
        ossyslog:
          enabled: true

cinder:
  volume:
    database:
      x509:
        enabled: True
  controller:
    database:
      x509:
        enabled: True

cinder:
  controller:
    database:
      x509:
        cacert: (certificate content)
        cert: (certificate content)
        key: (certificate content)
  volume:
    database:
      x509:
        cacert: (certificate content)
        cert: (certificate content)
        key: (certificate content)

cinder:
  volume:
    enabled: true
    ...
    cache:
      engine: memcached
      members:
      - host: 127.0.0.1
        port: 11211
      - host: 127.0.0.1
        port: 11211
      security:
        enabled: true
        strategy: ENCRYPT
        secret_key: secret

cinder:
  controller:
    enabled: true
    ...
    cache:
      engine: memcached
      members:
      - host: 127.0.0.1
        port: 11211
      - host: 127.0.0.1
        port: 11211
      security:
        enabled: true
        strategy: ENCRYPT
        secret_key: secret

cinder:
  volume:
    ...
    backend:
      lvm:
        ...
        engine: lvm
        iscsi_helper: tgtadm

cinder:
  volume:
    ...
    scheduler_default_filters: (filters)

cinder:
  controller:
    ...
    scheduler_default_filters: (filters)

Usage¶

Docker is a platform for developers and system administrators for developing, shipping, and running applications. Docker enables you to quickly assemble applications from components and eliminates the friction that can come when shipping the code. Also, with Docker, you get your code tested and deployed into production as fast as possible.

This file provides the sample configurations for different use cases.

parameters:
  docker:
    client:
      service:
        postgresql:
          environment:
            POSTGRES_USER: user
            POSTGRES_PASSWORD: password
            POSTGRES_DB: mydb
          restart:
            condition: on-failure
          image: "postgres:9.5"
          ports:
            - 5432:5432
          volume:
            data:
              type: bind
              source: /srv/volumes/postgresql/maas
              destination: /var/lib/postgresql/data

Metadata schema specifications for Docker client¶

Metadata schema specifications for Docker host¶

Metadata schema specifications for Docker registry¶

Metadata schema specifications for Docker Swarm¶

Usage¶

Galera Cluster for MySQL is a true Multimaster Cluster based on synchronous replication. Galera Cluster is an easy-to-use, high-availability solution, which provides high system uptime, no data loss and scalability for future growth.

galera:
  version:
    mysql: 5.6
    galera: 3
  master:
    enabled: true
    name: openstack
    bind:
      address: 192.168.0.1
      port: 3306
    members:
    - host: 192.168.0.1
      port: 4567
    - host: 192.168.0.2
      port: 4567
    admin:
      user: root
      password: pass
    sst:
      user: sstuser
      password: sstpassword
    database:
      name:
        encoding: 'utf8'
        users:
        - name: 'username'
          password: 'password'
          host: 'localhost'
          rights: 'all privileges'
          database: '*.*'

galera:
  slave:
    enabled: true
    name: openstack
    bind:
      address: 192.168.0.2
      port: 3306
    members:
    - host: 192.168.0.1
      port: 4567
    - host: 192.168.0.2
      port: 4567
    admin:
      user: root
      password: pass
    sst:
      user: sstuser
      password: sstpassword

galera:
   slave or master:
     ssl:
      enabled: True
      ciphers:
        DHE-RSA-AES128-SHA:
          enabled: True
        DHE-RSA-AES256-SHA:
          enabled: True
        EDH-RSA-DES-CBC3-SHA:
          name: EDH-RSA-DES-CBC3-SHA
          enabled: True
        AES128-SHA:AES256-SHA:
          name: AES128-SHA:AES256-SHA
          enabled: True
        DES-CBC3-SHA:
          enabled: True
      # path
      cert_file: /etc/mysql/ssl/cert.pem
      key_file: /etc/mysql/ssl/key.pem
      ca_file: /etc/mysql/ssl/ca.pem

      # content (not required if files already exists)
      key: << body of key >>
      cert: << body of cert >>
      cacert_chain: << body of ca certs chain >>

mysql:
  server:
    users:
      - name: clustercheck
        password: clustercheck
        database: '*.*'
        grants: PROCESS
      - name: inspector
        host: 127.0.0.1
        password: password
        databases:
          mydb:
            - database: mydb
            - table: mytable
            - grant_option: True
            - grants:
              - all privileges

mysql:
  server:
    users:
      - name: clustercheck
        password: clustercheck
        database: '*.*'
        grants: PROCESS
        ssl_option:
          - SSL: True
          - X509: True
          - SUBJECT: <subject>
          - ISSUER: <issuer>
          - CIPHER: <cipher>

galera:
  clustercheck:
    - enabled: True
    - user: clustercheck
    - password: clustercheck
    - available_when_donor: 0
    - available_when_readonly: 1
    - port 9200