upload openstack queens conf
This commit is contained in:
light
@@ -0,0 +1,45 @@
|
||||
[composite:neutron]
|
||||
use = egg:Paste#urlmap
|
||||
/: neutronversions_composite
|
||||
/v2.0: neutronapi_v2_0
|
||||
|
||||
[composite:neutronapi_v2_0]
|
||||
use = call:neutron.auth:pipeline_factory
|
||||
noauth = cors http_proxy_to_wsgi request_id catch_errors extensions neutronapiapp_v2_0
|
||||
keystone = cors http_proxy_to_wsgi request_id catch_errors authtoken keystonecontext extensions neutronapiapp_v2_0
|
||||
|
||||
[composite:neutronversions_composite]
|
||||
use = call:neutron.auth:pipeline_factory
|
||||
noauth = cors http_proxy_to_wsgi neutronversions
|
||||
keystone = cors http_proxy_to_wsgi neutronversions
|
||||
|
||||
[filter:request_id]
|
||||
paste.filter_factory = oslo_middleware:RequestId.factory
|
||||
|
||||
[filter:catch_errors]
|
||||
paste.filter_factory = oslo_middleware:CatchErrors.factory
|
||||
|
||||
[filter:cors]
|
||||
paste.filter_factory = oslo_middleware.cors:filter_factory
|
||||
oslo_config_project = neutron
|
||||
|
||||
[filter:http_proxy_to_wsgi]
|
||||
paste.filter_factory = oslo_middleware.http_proxy_to_wsgi:HTTPProxyToWSGI.factory
|
||||
|
||||
[filter:keystonecontext]
|
||||
paste.filter_factory = neutron.auth:NeutronKeystoneContext.factory
|
||||
|
||||
[filter:authtoken]
|
||||
paste.filter_factory = keystonemiddleware.auth_token:filter_factory
|
||||
|
||||
[filter:extensions]
|
||||
paste.filter_factory = neutron.api.extensions:plugin_aware_extension_middleware_factory
|
||||
|
||||
[app:neutronversions]
|
||||
paste.app_factory = neutron.pecan_wsgi.app:versions_factory
|
||||
|
||||
[app:neutronapiapp_v2_0]
|
||||
paste.app_factory = neutron.api.v2.router:APIRouter.factory
|
||||
|
||||
[filter:osprofiler]
|
||||
paste.filter_factory = osprofiler.web:WsgiMiddleware.factory
|
||||
@@ -0,0 +1,23 @@
|
||||
[DEFAULT]
|
||||
|
||||
|
||||
[fwaas]
|
||||
|
||||
#
|
||||
# From firewall.agent
|
||||
#
|
||||
|
||||
# Name of the FWaaS Driver (string value)
|
||||
#driver =
|
||||
|
||||
# Enable FWaaS (boolean value)
|
||||
#enabled = false
|
||||
|
||||
# Firewall agent class (string value)
|
||||
#agent_version = v2
|
||||
|
||||
# Name of the FWaaS Conntrack Driver (string value)
|
||||
#conntrack_driver = conntrack
|
||||
|
||||
# Name of the firewall l2 driver (string value)
|
||||
#firewall_l2_driver = noop
|
||||
@@ -0,0 +1,344 @@
|
||||
[DEFAULT]
|
||||
|
||||
#
|
||||
# From neutron.base.agent
|
||||
#
|
||||
|
||||
# Name of Open vSwitch bridge to use (string value)
|
||||
#ovs_integration_bridge = br-int
|
||||
|
||||
# Uses veth for an OVS interface or not. Support kernels with limited namespace
|
||||
# support (e.g. RHEL 6.5) and rate limiting on router's gateway port so long as
|
||||
# ovs_use_veth is set to True. (boolean value)
|
||||
#ovs_use_veth = false
|
||||
|
||||
# The driver used to manage the virtual interface. (string value)
|
||||
#interface_driver = <None>
|
||||
|
||||
#
|
||||
# From neutron.l3.agent
|
||||
#
|
||||
|
||||
# The working mode for the agent. Allowed modes are: 'legacy' - this preserves
|
||||
# the existing behavior where the L3 agent is deployed on a centralized
|
||||
# networking node to provide L3 services like DNAT, and SNAT. Use this mode if
|
||||
# you do not want to adopt DVR. 'dvr' - this mode enables DVR functionality and
|
||||
# must be used for an L3 agent that runs on a compute host. 'dvr_snat' - this
|
||||
# enables centralized SNAT support in conjunction with DVR. This mode must be
|
||||
# used for an L3 agent running on a centralized node (or in single-host
|
||||
# deployments, e.g. devstack). 'dvr_no_external' - this mode enables only
|
||||
# East/West DVR routing functionality for a L3 agent that runs on a compute
|
||||
# host, the North/South functionality such as DNAT and SNAT will be provided by
|
||||
# the centralized network node that is running in 'dvr_snat' mode. This mode
|
||||
# should be used when there is no external network connectivity on the compute
|
||||
# host. (string value)
|
||||
# Possible values:
|
||||
# dvr - <No description provided>
|
||||
# dvr_snat - <No description provided>
|
||||
# legacy - <No description provided>
|
||||
# dvr_no_external - <No description provided>
|
||||
#agent_mode = legacy
|
||||
|
||||
# TCP Port used by Neutron metadata namespace proxy. (port value)
|
||||
# Minimum value: 0
|
||||
# Maximum value: 65535
|
||||
#metadata_port = 9697
|
||||
|
||||
# Indicates that this L3 agent should also handle routers that do not have an
|
||||
# external network gateway configured. This option should be True only for a
|
||||
# single agent in a Neutron deployment, and may be False for all agents if all
|
||||
# routers must have an external network gateway. (boolean value)
|
||||
#handle_internal_only_routers = true
|
||||
|
||||
# DEPRECATED: When external_network_bridge is set, each L3 agent can be
|
||||
# associated with no more than one external network. This value should be set
|
||||
# to the UUID of that external network. To allow L3 agent support multiple
|
||||
# external networks, both the external_network_bridge and
|
||||
# gateway_external_network_id must be left empty. (string value)
|
||||
# This option is deprecated for removal.
|
||||
# Its value may be silently ignored in the future.
|
||||
#gateway_external_network_id =
|
||||
|
||||
# With IPv6, the network used for the external gateway does not need to have an
|
||||
# associated subnet, since the automatically assigned link-local address (LLA)
|
||||
# can be used. However, an IPv6 gateway address is needed for use as the next-
|
||||
# hop for the default route. If no IPv6 gateway address is configured here,
|
||||
# (and only then) the neutron router will be configured to get its default
|
||||
# route from router advertisements (RAs) from the upstream router; in which
|
||||
# case the upstream router must also be configured to send these RAs. The
|
||||
# ipv6_gateway, when configured, should be the LLA of the interface on the
|
||||
# upstream router. If a next-hop using a global unique address (GUA) is
|
||||
# desired, it needs to be done via a subnet allocated to the network and not
|
||||
# through this parameter. (string value)
|
||||
#ipv6_gateway =
|
||||
|
||||
# Driver used for ipv6 prefix delegation. This needs to be an entry point
|
||||
# defined in the neutron.agent.linux.pd_drivers namespace. See setup.cfg for
|
||||
# entry points included with the neutron source. (string value)
|
||||
#prefix_delegation_driver = dibbler
|
||||
|
||||
# Allow running metadata proxy. (boolean value)
|
||||
#enable_metadata_proxy = true
|
||||
|
||||
# Iptables mangle mark used to mark metadata valid requests. This mark will be
|
||||
# masked with 0xffff so that only the lower 16 bits will be used. (string
|
||||
# value)
|
||||
#metadata_access_mark = 0x1
|
||||
|
||||
# Iptables mangle mark used to mark ingress from external network. This mark
|
||||
# will be masked with 0xffff so that only the lower 16 bits will be used.
|
||||
# (string value)
|
||||
#external_ingress_mark = 0x2
|
||||
|
||||
# DEPRECATED: Name of bridge used for external network traffic. When this
|
||||
# parameter is set, the L3 agent will plug an interface directly into an
|
||||
# external bridge which will not allow any wiring by the L2 agent. Using this
|
||||
# will result in incorrect port statuses. This option is deprecated and will be
|
||||
# removed in Ocata. (string value)
|
||||
# This option is deprecated for removal.
|
||||
# Its value may be silently ignored in the future.
|
||||
#external_network_bridge =
|
||||
|
||||
# Seconds between running periodic tasks. (integer value)
|
||||
#periodic_interval = 40
|
||||
|
||||
# Number of separate API worker processes for service. If not specified, the
|
||||
# default is equal to the number of CPUs available for best performance.
|
||||
# (integer value)
|
||||
#api_workers = <None>
|
||||
|
||||
# Number of RPC worker processes for service. (integer value)
|
||||
#rpc_workers = 1
|
||||
|
||||
# Number of RPC worker processes dedicated to state reports queue. (integer
|
||||
# value)
|
||||
#rpc_state_report_workers = 1
|
||||
|
||||
# Range of seconds to randomly delay when starting the periodic task scheduler
|
||||
# to reduce stampeding. (Disable by setting to 0) (integer value)
|
||||
#periodic_fuzzy_delay = 5
|
||||
|
||||
# Location to store keepalived/conntrackd config files (string value)
|
||||
#ha_confs_path = $state_path/ha_confs
|
||||
|
||||
# VRRP authentication type (string value)
|
||||
# Possible values:
|
||||
# AH - <No description provided>
|
||||
# PASS - <No description provided>
|
||||
#ha_vrrp_auth_type = PASS
|
||||
|
||||
# VRRP authentication password (string value)
|
||||
#ha_vrrp_auth_password = <None>
|
||||
|
||||
# The advertisement interval in seconds (integer value)
|
||||
#ha_vrrp_advert_int = 2
|
||||
|
||||
# Number of concurrent threads for keepalived server connection requests. More
|
||||
# threads create a higher CPU load on the agent node. (integer value)
|
||||
# Minimum value: 1
|
||||
#ha_keepalived_state_change_server_threads = (1 + <num_of_cpus>) / 2
|
||||
|
||||
# The VRRP health check interval in seconds. Values > 0 enable VRRP health
|
||||
# checks. Setting it to 0 disables VRRP health checks. Recommended value is 5.
|
||||
# This will cause pings to be sent to the gateway IP address(es) - requires
|
||||
# ICMP_ECHO_REQUEST to be enabled on the gateway. If gateway fails, all routers
|
||||
# will be reported as master, and master election will be repeated in round-
|
||||
# robin fashion, until one of the router restore the gateway connection.
|
||||
# (integer value)
|
||||
#ha_vrrp_health_check_interval = 0
|
||||
|
||||
# Location to store IPv6 PD files. (string value)
|
||||
#pd_confs = $state_path/pd
|
||||
|
||||
# A decimal value as Vendor's Registered Private Enterprise Number as required
|
||||
# by RFC3315 DUID-EN. (string value)
|
||||
#vendor_pen = 8888
|
||||
|
||||
# Location to store IPv6 RA config files (string value)
|
||||
#ra_confs = $state_path/ra
|
||||
|
||||
# MinRtrAdvInterval setting for radvd.conf (integer value)
|
||||
#min_rtr_adv_interval = 30
|
||||
|
||||
# MaxRtrAdvInterval setting for radvd.conf (integer value)
|
||||
#max_rtr_adv_interval = 100
|
||||
|
||||
#
|
||||
# From oslo.log
|
||||
#
|
||||
|
||||
# If set to true, the logging level will be set to DEBUG instead of the default
|
||||
# INFO level. (boolean value)
|
||||
# Note: This option can be changed without restarting.
|
||||
#debug = false
|
||||
|
||||
# The name of a logging configuration file. This file is appended to any
|
||||
# existing logging configuration files. For details about logging configuration
|
||||
# files, see the Python logging module documentation. Note that when logging
|
||||
# configuration files are used then all logging configuration is set in the
|
||||
# configuration file and other logging configuration options are ignored (for
|
||||
# example, logging_context_format_string). (string value)
|
||||
# Note: This option can be changed without restarting.
|
||||
# Deprecated group/name - [DEFAULT]/log_config
|
||||
#log_config_append = <None>
|
||||
|
||||
# Defines the format string for %%(asctime)s in log records. Default:
|
||||
# %(default)s . This option is ignored if log_config_append is set. (string
|
||||
# value)
|
||||
#log_date_format = %Y-%m-%d %H:%M:%S
|
||||
|
||||
# (Optional) Name of log file to send logging output to. If no default is set,
|
||||
# logging will go to stderr as defined by use_stderr. This option is ignored if
|
||||
# log_config_append is set. (string value)
|
||||
# Deprecated group/name - [DEFAULT]/logfile
|
||||
#log_file = <None>
|
||||
|
||||
# (Optional) The base directory used for relative log_file paths. This option
|
||||
# is ignored if log_config_append is set. (string value)
|
||||
# Deprecated group/name - [DEFAULT]/logdir
|
||||
#log_dir = <None>
|
||||
|
||||
# Uses logging handler designed to watch file system. When log file is moved or
|
||||
# removed this handler will open a new log file with specified path
|
||||
# instantaneously. It makes sense only if log_file option is specified and
|
||||
# Linux platform is used. This option is ignored if log_config_append is set.
|
||||
# (boolean value)
|
||||
#watch_log_file = false
|
||||
|
||||
# Use syslog for logging. Existing syslog format is DEPRECATED and will be
|
||||
# changed later to honor RFC5424. This option is ignored if log_config_append
|
||||
# is set. (boolean value)
|
||||
#use_syslog = false
|
||||
|
||||
# Enable journald for logging. If running in a systemd environment you may wish
|
||||
# to enable journal support. Doing so will use the journal native protocol
|
||||
# which includes structured metadata in addition to log messages.This option is
|
||||
# ignored if log_config_append is set. (boolean value)
|
||||
#use_journal = false
|
||||
|
||||
# Syslog facility to receive log lines. This option is ignored if
|
||||
# log_config_append is set. (string value)
|
||||
#syslog_log_facility = LOG_USER
|
||||
|
||||
# Use JSON formatting for logging. This option is ignored if log_config_append
|
||||
# is set. (boolean value)
|
||||
#use_json = false
|
||||
|
||||
# Log output to standard error. This option is ignored if log_config_append is
|
||||
# set. (boolean value)
|
||||
#use_stderr = false
|
||||
|
||||
# Format string to use for log messages with context. (string value)
|
||||
#logging_context_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user_identity)s] %(instance)s%(message)s
|
||||
|
||||
# Format string to use for log messages when context is undefined. (string
|
||||
# value)
|
||||
#logging_default_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [-] %(instance)s%(message)s
|
||||
|
||||
# Additional data to append to log message when logging level for the message
|
||||
# is DEBUG. (string value)
|
||||
#logging_debug_format_suffix = %(funcName)s %(pathname)s:%(lineno)d
|
||||
|
||||
# Prefix each line of exception output with this format. (string value)
|
||||
#logging_exception_prefix = %(asctime)s.%(msecs)03d %(process)d ERROR %(name)s %(instance)s
|
||||
|
||||
# Defines the format string for %(user_identity)s that is used in
|
||||
# logging_context_format_string. (string value)
|
||||
#logging_user_identity_format = %(user)s %(tenant)s %(domain)s %(user_domain)s %(project_domain)s
|
||||
|
||||
# List of package logging levels in logger=LEVEL pairs. This option is ignored
|
||||
# if log_config_append is set. (list value)
|
||||
#default_log_levels = amqp=WARN,amqplib=WARN,boto=WARN,qpid=WARN,sqlalchemy=WARN,suds=INFO,oslo.messaging=INFO,oslo_messaging=INFO,iso8601=WARN,requests.packages.urllib3.connectionpool=WARN,urllib3.connectionpool=WARN,websocket=WARN,requests.packages.urllib3.util.retry=WARN,urllib3.util.retry=WARN,keystonemiddleware=WARN,routes.middleware=WARN,stevedore=WARN,taskflow=WARN,keystoneauth=WARN,oslo.cache=INFO,dogpile.core.dogpile=INFO
|
||||
|
||||
# Enables or disables publication of error events. (boolean value)
|
||||
#publish_errors = false
|
||||
|
||||
# The format for an instance that is passed with the log message. (string
|
||||
# value)
|
||||
#instance_format = "[instance: %(uuid)s] "
|
||||
|
||||
# The format for an instance UUID that is passed with the log message. (string
|
||||
# value)
|
||||
#instance_uuid_format = "[instance: %(uuid)s] "
|
||||
|
||||
# Interval, number of seconds, of log rate limiting. (integer value)
|
||||
#rate_limit_interval = 0
|
||||
|
||||
# Maximum number of logged messages per rate_limit_interval. (integer value)
|
||||
#rate_limit_burst = 0
|
||||
|
||||
# Log level name used by rate limiting: CRITICAL, ERROR, INFO, WARNING, DEBUG
|
||||
# or empty string. Logs with level greater or equal to rate_limit_except_level
|
||||
# are not filtered. An empty string means that all levels are filtered. (string
|
||||
# value)
|
||||
#rate_limit_except_level = CRITICAL
|
||||
|
||||
# Enables or disables fatal status of deprecations. (boolean value)
|
||||
#fatal_deprecations = false
|
||||
|
||||
|
||||
[agent]
|
||||
|
||||
#
|
||||
# From neutron.az.agent
|
||||
#
|
||||
|
||||
# Availability zone of this node (string value)
|
||||
#availability_zone = nova
|
||||
|
||||
#
|
||||
# From neutron.base.agent
|
||||
#
|
||||
|
||||
# Seconds between nodes reporting state to server; should be less than
|
||||
# agent_down_time, best if it is half or less than agent_down_time. (floating
|
||||
# point value)
|
||||
#report_interval = 30
|
||||
|
||||
# Log agent heartbeats (boolean value)
|
||||
#log_agent_heartbeats = false
|
||||
|
||||
#
|
||||
# From neutron.l3.agent
|
||||
#
|
||||
|
||||
# Extensions list to use (list value)
|
||||
#extensions =
|
||||
|
||||
|
||||
[ovs]
|
||||
|
||||
#
|
||||
# From neutron.base.agent
|
||||
#
|
||||
|
||||
# DEPRECATED: The interface for interacting with the OVSDB (string value)
|
||||
# Possible values:
|
||||
# vsctl - <No description provided>
|
||||
# native - <No description provided>
|
||||
# This option is deprecated for removal.
|
||||
# Its value may be silently ignored in the future.
|
||||
#ovsdb_interface = native
|
||||
|
||||
# The connection string for the OVSDB backend. Will be used by ovsdb-client
|
||||
# when monitoring and used for the all ovsdb commands when native
|
||||
# ovsdb_interface is enabled (string value)
|
||||
#ovsdb_connection = tcp:127.0.0.1:6640
|
||||
|
||||
# The SSL private key file to use when interacting with OVSDB. Required when
|
||||
# using an "ssl:" prefixed ovsdb_connection (string value)
|
||||
#ssl_key_file = <None>
|
||||
|
||||
# The SSL certificate file to use when interacting with OVSDB. Required when
|
||||
# using an "ssl:" prefixed ovsdb_connection (string value)
|
||||
#ssl_cert_file = <None>
|
||||
|
||||
# The Certificate Authority (CA) certificate to use when interacting with
|
||||
# OVSDB. Required when using an "ssl:" prefixed ovsdb_connection (string
|
||||
# value)
|
||||
#ssl_ca_cert_file = <None>
|
||||
|
||||
# Timeout in seconds for ovsdb commands. If the timeout expires, ovsdb commands
|
||||
# will fail with ALARMCLOCK error. (integer value)
|
||||
# Deprecated group/name - [DEFAULT]/ovs_vsctl_timeout
|
||||
#ovsdb_timeout = 10
|
||||
+2068
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,275 @@
|
||||
[DEFAULT]
|
||||
|
||||
#
|
||||
# From oslo.log
|
||||
#
|
||||
|
||||
# If set to true, the logging level will be set to DEBUG instead of the default
|
||||
# INFO level. (boolean value)
|
||||
# Note: This option can be changed without restarting.
|
||||
#debug = false
|
||||
|
||||
# The name of a logging configuration file. This file is appended to any
|
||||
# existing logging configuration files. For details about logging configuration
|
||||
# files, see the Python logging module documentation. Note that when logging
|
||||
# configuration files are used then all logging configuration is set in the
|
||||
# configuration file and other logging configuration options are ignored (for
|
||||
# example, logging_context_format_string). (string value)
|
||||
# Note: This option can be changed without restarting.
|
||||
# Deprecated group/name - [DEFAULT]/log_config
|
||||
#log_config_append = <None>
|
||||
|
||||
# Defines the format string for %%(asctime)s in log records. Default:
|
||||
# %(default)s . This option is ignored if log_config_append is set. (string
|
||||
# value)
|
||||
#log_date_format = %Y-%m-%d %H:%M:%S
|
||||
|
||||
# (Optional) Name of log file to send logging output to. If no default is set,
|
||||
# logging will go to stderr as defined by use_stderr. This option is ignored if
|
||||
# log_config_append is set. (string value)
|
||||
# Deprecated group/name - [DEFAULT]/logfile
|
||||
#log_file = <None>
|
||||
|
||||
# (Optional) The base directory used for relative log_file paths. This option
|
||||
# is ignored if log_config_append is set. (string value)
|
||||
# Deprecated group/name - [DEFAULT]/logdir
|
||||
#log_dir = <None>
|
||||
|
||||
# Uses logging handler designed to watch file system. When log file is moved or
|
||||
# removed this handler will open a new log file with specified path
|
||||
# instantaneously. It makes sense only if log_file option is specified and
|
||||
# Linux platform is used. This option is ignored if log_config_append is set.
|
||||
# (boolean value)
|
||||
#watch_log_file = false
|
||||
|
||||
# Use syslog for logging. Existing syslog format is DEPRECATED and will be
|
||||
# changed later to honor RFC5424. This option is ignored if log_config_append
|
||||
# is set. (boolean value)
|
||||
#use_syslog = false
|
||||
|
||||
# Enable journald for logging. If running in a systemd environment you may wish
|
||||
# to enable journal support. Doing so will use the journal native protocol
|
||||
# which includes structured metadata in addition to log messages.This option is
|
||||
# ignored if log_config_append is set. (boolean value)
|
||||
#use_journal = false
|
||||
|
||||
# Syslog facility to receive log lines. This option is ignored if
|
||||
# log_config_append is set. (string value)
|
||||
#syslog_log_facility = LOG_USER
|
||||
|
||||
# Use JSON formatting for logging. This option is ignored if log_config_append
|
||||
# is set. (boolean value)
|
||||
#use_json = false
|
||||
|
||||
# Log output to standard error. This option is ignored if log_config_append is
|
||||
# set. (boolean value)
|
||||
#use_stderr = false
|
||||
|
||||
# Format string to use for log messages with context. (string value)
|
||||
#logging_context_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user_identity)s] %(instance)s%(message)s
|
||||
|
||||
# Format string to use for log messages when context is undefined. (string
|
||||
# value)
|
||||
#logging_default_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [-] %(instance)s%(message)s
|
||||
|
||||
# Additional data to append to log message when logging level for the message
|
||||
# is DEBUG. (string value)
|
||||
#logging_debug_format_suffix = %(funcName)s %(pathname)s:%(lineno)d
|
||||
|
||||
# Prefix each line of exception output with this format. (string value)
|
||||
#logging_exception_prefix = %(asctime)s.%(msecs)03d %(process)d ERROR %(name)s %(instance)s
|
||||
|
||||
# Defines the format string for %(user_identity)s that is used in
|
||||
# logging_context_format_string. (string value)
|
||||
#logging_user_identity_format = %(user)s %(tenant)s %(domain)s %(user_domain)s %(project_domain)s
|
||||
|
||||
# List of package logging levels in logger=LEVEL pairs. This option is ignored
|
||||
# if log_config_append is set. (list value)
|
||||
#default_log_levels = amqp=WARN,amqplib=WARN,boto=WARN,qpid=WARN,sqlalchemy=WARN,suds=INFO,oslo.messaging=INFO,oslo_messaging=INFO,iso8601=WARN,requests.packages.urllib3.connectionpool=WARN,urllib3.connectionpool=WARN,websocket=WARN,requests.packages.urllib3.util.retry=WARN,urllib3.util.retry=WARN,keystonemiddleware=WARN,routes.middleware=WARN,stevedore=WARN,taskflow=WARN,keystoneauth=WARN,oslo.cache=INFO,dogpile.core.dogpile=INFO
|
||||
|
||||
# Enables or disables publication of error events. (boolean value)
|
||||
#publish_errors = false
|
||||
|
||||
# The format for an instance that is passed with the log message. (string
|
||||
# value)
|
||||
#instance_format = "[instance: %(uuid)s] "
|
||||
|
||||
# The format for an instance UUID that is passed with the log message. (string
|
||||
# value)
|
||||
#instance_uuid_format = "[instance: %(uuid)s] "
|
||||
|
||||
# Interval, number of seconds, of log rate limiting. (integer value)
|
||||
#rate_limit_interval = 0
|
||||
|
||||
# Maximum number of logged messages per rate_limit_interval. (integer value)
|
||||
#rate_limit_burst = 0
|
||||
|
||||
# Log level name used by rate limiting: CRITICAL, ERROR, INFO, WARNING, DEBUG
|
||||
# or empty string. Logs with level greater or equal to rate_limit_except_level
|
||||
# are not filtered. An empty string means that all levels are filtered. (string
|
||||
# value)
|
||||
#rate_limit_except_level = CRITICAL
|
||||
|
||||
# Enables or disables fatal status of deprecations. (boolean value)
|
||||
#fatal_deprecations = false
|
||||
|
||||
|
||||
[agent]
|
||||
|
||||
#
|
||||
# From neutron.ml2.linuxbridge.agent
|
||||
#
|
||||
|
||||
# The number of seconds the agent will wait between polling for local device
|
||||
# changes. (integer value)
|
||||
#polling_interval = 2
|
||||
|
||||
# Set new timeout in seconds for new rpc calls after agent receives SIGTERM. If
|
||||
# value is set to 0, rpc timeout won't be changed (integer value)
|
||||
#quitting_rpc_timeout = 10
|
||||
|
||||
# The DSCP value to use for outer headers during tunnel encapsulation. (integer
|
||||
# value)
|
||||
# Minimum value: 0
|
||||
# Maximum value: 63
|
||||
#dscp = <None>
|
||||
|
||||
# If set to True, the DSCP value of tunnel interfaces is overwritten and set to
|
||||
# inherit. The DSCP value of the inner header is then copied to the outer
|
||||
# header. (boolean value)
|
||||
#dscp_inherit = false
|
||||
|
||||
# Extensions list to use (list value)
|
||||
#extensions =
|
||||
|
||||
|
||||
[linux_bridge]
|
||||
physical_interface_mappings = provider:enp0s9
|
||||
|
||||
#
|
||||
# From neutron.ml2.linuxbridge.agent
|
||||
#
|
||||
|
||||
# Comma-separated list of <physical_network>:<physical_interface> tuples
|
||||
# mapping physical network names to the agent's node-specific physical network
|
||||
# interfaces to be used for flat and VLAN networks. All physical networks
|
||||
# listed in network_vlan_ranges on the server should have mappings to
|
||||
# appropriate interfaces on each agent. (list value)
|
||||
#physical_interface_mappings =
|
||||
|
||||
# List of <physical_network>:<physical_bridge> (list value)
|
||||
#bridge_mappings =
|
||||
|
||||
|
||||
[network_log]
|
||||
|
||||
#
|
||||
# From neutron.ml2.linuxbridge.agent
|
||||
#
|
||||
|
||||
# Maximum packets logging per second. (integer value)
|
||||
# Minimum value: 100
|
||||
#rate_limit = 100
|
||||
|
||||
# Maximum number of packets per rate_limit. (integer value)
|
||||
# Minimum value: 25
|
||||
#burst_limit = 25
|
||||
|
||||
# Output logfile path on agent side, default syslog file. (string value)
|
||||
#local_output_log_base = <None>
|
||||
|
||||
|
||||
[securitygroup]
|
||||
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
|
||||
enable_security_group = true
|
||||
|
||||
#
|
||||
# From neutron.ml2.linuxbridge.agent
|
||||
#
|
||||
|
||||
# Driver for security groups firewall in the L2 agent (string value)
|
||||
#firewall_driver = <None>
|
||||
|
||||
# Controls whether the neutron security group API is enabled in the server. It
|
||||
# should be false when using no security groups or using the nova security
|
||||
# group API. (boolean value)
|
||||
#enable_security_group = true
|
||||
|
||||
# Use ipset to speed-up the iptables based security groups. Enabling ipset
|
||||
# support requires that ipset is installed on L2 agent node. (boolean value)
|
||||
#enable_ipset = true
|
||||
|
||||
|
||||
[vxlan]
|
||||
l2_population = true
|
||||
local_ip = 10.0.0.31
|
||||
enable_vxlan = true
|
||||
|
||||
#
|
||||
# From neutron.ml2.linuxbridge.agent
|
||||
#
|
||||
|
||||
# Enable VXLAN on the agent. Can be enabled when agent is managed by ml2 plugin
|
||||
# using linuxbridge mechanism driver (boolean value)
|
||||
#enable_vxlan = true
|
||||
|
||||
# TTL for vxlan interface protocol packets. (integer value)
|
||||
#ttl = <None>
|
||||
|
||||
# DEPRECATED: TOS for vxlan interface protocol packets. This option is
|
||||
# deprecated in favor of the dscp option in the AGENT section and will be
|
||||
# removed in a future release. To convert the TOS value to DSCP, divide by 4.
|
||||
# (integer value)
|
||||
# This option is deprecated for removal.
|
||||
# Its value may be silently ignored in the future.
|
||||
#tos = <None>
|
||||
|
||||
# Multicast group(s) for vxlan interface. A range of group addresses may be
|
||||
# specified by using CIDR notation. Specifying a range allows different VNIs to
|
||||
# use different group addresses, reducing or eliminating spurious broadcast
|
||||
# traffic to the tunnel endpoints. To reserve a unique group for each possible
|
||||
# (24-bit) VNI, use a /8 such as 239.0.0.0/8. This setting must be the same on
|
||||
# all the agents. (string value)
|
||||
#vxlan_group = 224.0.0.1
|
||||
|
||||
# IP address of local overlay (tunnel) network endpoint. Use either an IPv4 or
|
||||
# IPv6 address that resides on one of the host network interfaces. The IP
|
||||
# version of this value must match the value of the 'overlay_ip_version' option
|
||||
# in the ML2 plug-in configuration file on the neutron server node(s). (IP
|
||||
# address value)
|
||||
#local_ip = <None>
|
||||
|
||||
# The minimum of the UDP source port range used for VXLAN communication. (port
|
||||
# value)
|
||||
# Minimum value: 0
|
||||
# Maximum value: 65535
|
||||
#udp_srcport_min = 0
|
||||
|
||||
# The maximum of the UDP source port range used for VXLAN communication. (port
|
||||
# value)
|
||||
# Minimum value: 0
|
||||
# Maximum value: 65535
|
||||
#udp_srcport_max = 0
|
||||
|
||||
# The UDP port used for VXLAN communication. By default, the Linux kernel
|
||||
# doesn't use the IANA assigned standard value, so if you want to use it, this
|
||||
# option must be set to 4789. It is not set by default because of backward
|
||||
# compatibiltiy. (port value)
|
||||
# Minimum value: 0
|
||||
# Maximum value: 65535
|
||||
#udp_dstport = <None>
|
||||
|
||||
# Extension to use alongside ml2 plugin's l2population mechanism driver. It
|
||||
# enables the plugin to populate VXLAN forwarding table. (boolean value)
|
||||
#l2_population = false
|
||||
|
||||
# Enable local ARP responder which provides local responses instead of
|
||||
# performing ARP broadcast into the overlay. Enabling local ARP responder is
|
||||
# not fully compatible with the allowed-address-pairs extension. (boolean
|
||||
# value)
|
||||
#arp_responder = false
|
||||
|
||||
# Optional comma-separated list of <multicast address>:<vni_min>:<vni_max>
|
||||
# triples describing how to assign a multicast address to VXLAN according to
|
||||
# its VNI ID. (list value)
|
||||
#multicast_ranges =
|
||||
@@ -0,0 +1,235 @@
|
||||
{
|
||||
"context_is_admin": "role:admin",
|
||||
"owner": "tenant_id:%(tenant_id)s",
|
||||
"admin_or_owner": "rule:context_is_admin or rule:owner",
|
||||
"context_is_advsvc": "role:advsvc",
|
||||
"admin_or_network_owner": "rule:context_is_admin or tenant_id:%(network:tenant_id)s",
|
||||
"admin_owner_or_network_owner": "rule:owner or rule:admin_or_network_owner",
|
||||
"admin_only": "rule:context_is_admin",
|
||||
"regular_user": "",
|
||||
"admin_or_data_plane_int": "rule:context_is_admin or role:data_plane_integrator",
|
||||
"shared": "field:networks:shared=True",
|
||||
"shared_subnetpools": "field:subnetpools:shared=True",
|
||||
"shared_address_scopes": "field:address_scopes:shared=True",
|
||||
"external": "field:networks:router:external=True",
|
||||
"default": "rule:admin_or_owner",
|
||||
|
||||
"create_subnet": "rule:admin_or_network_owner",
|
||||
"create_subnet:segment_id": "rule:admin_only",
|
||||
"create_subnet:service_types": "rule:admin_only",
|
||||
"get_subnet": "rule:admin_or_owner or rule:shared",
|
||||
"get_subnet:segment_id": "rule:admin_only",
|
||||
"update_subnet": "rule:admin_or_network_owner",
|
||||
"update_subnet:service_types": "rule:admin_only",
|
||||
"delete_subnet": "rule:admin_or_network_owner",
|
||||
|
||||
"create_subnetpool": "",
|
||||
"create_subnetpool:shared": "rule:admin_only",
|
||||
"create_subnetpool:is_default": "rule:admin_only",
|
||||
"get_subnetpool": "rule:admin_or_owner or rule:shared_subnetpools",
|
||||
"update_subnetpool": "rule:admin_or_owner",
|
||||
"update_subnetpool:is_default": "rule:admin_only",
|
||||
"delete_subnetpool": "rule:admin_or_owner",
|
||||
|
||||
"create_address_scope": "",
|
||||
"create_address_scope:shared": "rule:admin_only",
|
||||
"get_address_scope": "rule:admin_or_owner or rule:shared_address_scopes",
|
||||
"update_address_scope": "rule:admin_or_owner",
|
||||
"update_address_scope:shared": "rule:admin_only",
|
||||
"delete_address_scope": "rule:admin_or_owner",
|
||||
|
||||
"create_network": "",
|
||||
"get_network": "rule:admin_or_owner or rule:shared or rule:external or rule:context_is_advsvc",
|
||||
"get_network:router:external": "rule:regular_user",
|
||||
"get_network:segments": "rule:admin_only",
|
||||
"get_network:provider:network_type": "rule:admin_only",
|
||||
"get_network:provider:physical_network": "rule:admin_only",
|
||||
"get_network:provider:segmentation_id": "rule:admin_only",
|
||||
"get_network:queue_id": "rule:admin_only",
|
||||
"get_network_ip_availabilities": "rule:admin_only",
|
||||
"get_network_ip_availability": "rule:admin_only",
|
||||
"create_network:shared": "rule:admin_only",
|
||||
"create_network:router:external": "rule:admin_only",
|
||||
"create_network:is_default": "rule:admin_only",
|
||||
"create_network:segments": "rule:admin_only",
|
||||
"create_network:provider:network_type": "rule:admin_only",
|
||||
"create_network:provider:physical_network": "rule:admin_only",
|
||||
"create_network:provider:segmentation_id": "rule:admin_only",
|
||||
"update_network": "rule:admin_or_owner",
|
||||
"update_network:segments": "rule:admin_only",
|
||||
"update_network:shared": "rule:admin_only",
|
||||
"update_network:provider:network_type": "rule:admin_only",
|
||||
"update_network:provider:physical_network": "rule:admin_only",
|
||||
"update_network:provider:segmentation_id": "rule:admin_only",
|
||||
"update_network:router:external": "rule:admin_only",
|
||||
"delete_network": "rule:admin_or_owner",
|
||||
|
||||
"create_segment": "rule:admin_only",
|
||||
"get_segment": "rule:admin_only",
|
||||
"update_segment": "rule:admin_only",
|
||||
"delete_segment": "rule:admin_only",
|
||||
|
||||
"network_device": "field:port:device_owner=~^network:",
|
||||
"create_port": "",
|
||||
"create_port:device_owner": "not rule:network_device or rule:context_is_advsvc or rule:admin_or_network_owner",
|
||||
"create_port:mac_address": "rule:context_is_advsvc or rule:admin_or_network_owner",
|
||||
"create_port:fixed_ips:ip_address": "rule:context_is_advsvc or rule:admin_or_network_owner",
|
||||
"create_port:fixed_ips:subnet_id": "rule:context_is_advsvc or rule:admin_or_network_owner or rule:shared",
|
||||
"create_port:port_security_enabled": "rule:context_is_advsvc or rule:admin_or_network_owner",
|
||||
"create_port:binding:host_id": "rule:admin_only",
|
||||
"create_port:binding:profile": "rule:admin_only",
|
||||
"create_port:mac_learning_enabled": "rule:context_is_advsvc or rule:admin_or_network_owner",
|
||||
"create_port:allowed_address_pairs": "rule:admin_or_network_owner",
|
||||
"get_port": "rule:context_is_advsvc or rule:admin_owner_or_network_owner",
|
||||
"get_port:queue_id": "rule:admin_only",
|
||||
"get_port:binding:vif_type": "rule:admin_only",
|
||||
"get_port:binding:vif_details": "rule:admin_only",
|
||||
"get_port:binding:host_id": "rule:admin_only",
|
||||
"get_port:binding:profile": "rule:admin_only",
|
||||
"update_port": "rule:admin_or_owner or rule:context_is_advsvc",
|
||||
"update_port:device_owner": "not rule:network_device or rule:context_is_advsvc or rule:admin_or_network_owner",
|
||||
"update_port:mac_address": "rule:admin_only or rule:context_is_advsvc",
|
||||
"update_port:fixed_ips:ip_address": "rule:context_is_advsvc or rule:admin_or_network_owner",
|
||||
"update_port:fixed_ips:subnet_id": "rule:context_is_advsvc or rule:admin_or_network_owner or rule:shared",
|
||||
"update_port:port_security_enabled": "rule:context_is_advsvc or rule:admin_or_network_owner",
|
||||
"update_port:binding:host_id": "rule:admin_only",
|
||||
"update_port:binding:profile": "rule:admin_only",
|
||||
"update_port:mac_learning_enabled": "rule:context_is_advsvc or rule:admin_or_network_owner",
|
||||
"update_port:allowed_address_pairs": "rule:admin_or_network_owner",
|
||||
"update_port:data_plane_status": "rule:admin_or_data_plane_int",
|
||||
"delete_port": "rule:context_is_advsvc or rule:admin_owner_or_network_owner",
|
||||
|
||||
"get_router:ha": "rule:admin_only",
|
||||
"create_router": "rule:regular_user",
|
||||
"create_router:external_gateway_info:enable_snat": "rule:admin_only",
|
||||
"create_router:distributed": "rule:admin_only",
|
||||
"create_router:ha": "rule:admin_only",
|
||||
"get_router": "rule:admin_or_owner",
|
||||
"get_router:distributed": "rule:admin_only",
|
||||
"update_router": "rule:admin_or_owner",
|
||||
"update_router:external_gateway_info": "rule:admin_or_owner",
|
||||
"update_router:external_gateway_info:network_id": "rule:admin_or_owner",
|
||||
"update_router:external_gateway_info:enable_snat": "rule:admin_only",
|
||||
"update_router:distributed": "rule:admin_only",
|
||||
"update_router:ha": "rule:admin_only",
|
||||
"delete_router": "rule:admin_or_owner",
|
||||
|
||||
"add_router_interface": "rule:admin_or_owner",
|
||||
"remove_router_interface": "rule:admin_or_owner",
|
||||
|
||||
"create_router:external_gateway_info:external_fixed_ips": "rule:admin_only",
|
||||
"update_router:external_gateway_info:external_fixed_ips": "rule:admin_only",
|
||||
|
||||
"create_qos_queue": "rule:admin_only",
|
||||
"get_qos_queue": "rule:admin_only",
|
||||
|
||||
"update_agent": "rule:admin_only",
|
||||
"delete_agent": "rule:admin_only",
|
||||
"get_agent": "rule:admin_only",
|
||||
|
||||
"create_dhcp-network": "rule:admin_only",
|
||||
"delete_dhcp-network": "rule:admin_only",
|
||||
"get_dhcp-networks": "rule:admin_only",
|
||||
"create_l3-router": "rule:admin_only",
|
||||
"delete_l3-router": "rule:admin_only",
|
||||
"get_l3-routers": "rule:admin_only",
|
||||
"get_dhcp-agents": "rule:admin_only",
|
||||
"get_l3-agents": "rule:admin_only",
|
||||
"get_loadbalancer-agent": "rule:admin_only",
|
||||
"get_loadbalancer-pools": "rule:admin_only",
|
||||
"get_agent-loadbalancers": "rule:admin_only",
|
||||
"get_loadbalancer-hosting-agent": "rule:admin_only",
|
||||
|
||||
"create_floatingip": "rule:regular_user",
|
||||
"create_floatingip:floating_ip_address": "rule:admin_only",
|
||||
"update_floatingip": "rule:admin_or_owner",
|
||||
"delete_floatingip": "rule:admin_or_owner",
|
||||
"get_floatingip": "rule:admin_or_owner",
|
||||
|
||||
"create_network_profile": "rule:admin_only",
|
||||
"update_network_profile": "rule:admin_only",
|
||||
"delete_network_profile": "rule:admin_only",
|
||||
"get_network_profiles": "",
|
||||
"get_network_profile": "",
|
||||
"update_policy_profiles": "rule:admin_only",
|
||||
"get_policy_profiles": "",
|
||||
"get_policy_profile": "",
|
||||
|
||||
"create_metering_label": "rule:admin_only",
|
||||
"delete_metering_label": "rule:admin_only",
|
||||
"get_metering_label": "rule:admin_only",
|
||||
|
||||
"create_metering_label_rule": "rule:admin_only",
|
||||
"delete_metering_label_rule": "rule:admin_only",
|
||||
"get_metering_label_rule": "rule:admin_only",
|
||||
|
||||
"get_service_provider": "rule:regular_user",
|
||||
"get_lsn": "rule:admin_only",
|
||||
"create_lsn": "rule:admin_only",
|
||||
|
||||
"create_flavor": "rule:admin_only",
|
||||
"update_flavor": "rule:admin_only",
|
||||
"delete_flavor": "rule:admin_only",
|
||||
"get_flavors": "rule:regular_user",
|
||||
"get_flavor": "rule:regular_user",
|
||||
"create_service_profile": "rule:admin_only",
|
||||
"update_service_profile": "rule:admin_only",
|
||||
"delete_service_profile": "rule:admin_only",
|
||||
"get_service_profiles": "rule:admin_only",
|
||||
"get_service_profile": "rule:admin_only",
|
||||
|
||||
"get_policy": "rule:regular_user",
|
||||
"create_policy": "rule:admin_only",
|
||||
"update_policy": "rule:admin_only",
|
||||
"delete_policy": "rule:admin_only",
|
||||
"get_policy_bandwidth_limit_rule": "rule:regular_user",
|
||||
"create_policy_bandwidth_limit_rule": "rule:admin_only",
|
||||
"delete_policy_bandwidth_limit_rule": "rule:admin_only",
|
||||
"update_policy_bandwidth_limit_rule": "rule:admin_only",
|
||||
"get_policy_dscp_marking_rule": "rule:regular_user",
|
||||
"create_policy_dscp_marking_rule": "rule:admin_only",
|
||||
"delete_policy_dscp_marking_rule": "rule:admin_only",
|
||||
"update_policy_dscp_marking_rule": "rule:admin_only",
|
||||
"get_rule_type": "rule:regular_user",
|
||||
"get_policy_minimum_bandwidth_rule": "rule:regular_user",
|
||||
"create_policy_minimum_bandwidth_rule": "rule:admin_only",
|
||||
"delete_policy_minimum_bandwidth_rule": "rule:admin_only",
|
||||
"update_policy_minimum_bandwidth_rule": "rule:admin_only",
|
||||
|
||||
"restrict_wildcard": "(not field:rbac_policy:target_tenant=*) or rule:admin_only",
|
||||
"create_rbac_policy": "",
|
||||
"create_rbac_policy:target_tenant": "rule:restrict_wildcard",
|
||||
"update_rbac_policy": "rule:admin_or_owner",
|
||||
"update_rbac_policy:target_tenant": "rule:restrict_wildcard and rule:admin_or_owner",
|
||||
"get_rbac_policy": "rule:admin_or_owner",
|
||||
"delete_rbac_policy": "rule:admin_or_owner",
|
||||
|
||||
"create_flavor_service_profile": "rule:admin_only",
|
||||
"delete_flavor_service_profile": "rule:admin_only",
|
||||
"get_flavor_service_profile": "rule:regular_user",
|
||||
"get_auto_allocated_topology": "rule:admin_or_owner",
|
||||
|
||||
"create_trunk": "rule:regular_user",
|
||||
"get_trunk": "rule:admin_or_owner",
|
||||
"delete_trunk": "rule:admin_or_owner",
|
||||
"get_subports": "",
|
||||
"add_subports": "rule:admin_or_owner",
|
||||
"remove_subports": "rule:admin_or_owner",
|
||||
|
||||
"get_security_groups": "rule:admin_or_owner",
|
||||
"get_security_group": "rule:admin_or_owner",
|
||||
"create_security_group": "rule:admin_or_owner",
|
||||
"update_security_group": "rule:admin_or_owner",
|
||||
"delete_security_group": "rule:admin_or_owner",
|
||||
"get_security_group_rules": "rule:admin_or_owner",
|
||||
"get_security_group_rule": "rule:admin_or_owner",
|
||||
"create_security_group_rule": "rule:admin_or_owner",
|
||||
"delete_security_group_rule": "rule:admin_or_owner",
|
||||
|
||||
"get_loggable_resources": "rule:admin_only",
|
||||
"create_log": "rule:admin_only",
|
||||
"update_log": "rule:admin_only",
|
||||
"delete_log": "rule:admin_only",
|
||||
"get_logs": "rule:admin_only",
|
||||
"get_log": "rule:admin_only"
|
||||
}
|
||||
@@ -0,0 +1,34 @@
|
||||
# Configuration for neutron-rootwrap
|
||||
# This file should be owned by (and only-writeable by) the root user
|
||||
|
||||
[DEFAULT]
|
||||
# List of directories to load filter definitions from (separated by ',').
|
||||
# These directories MUST all be only writeable by root !
|
||||
filters_path=/etc/neutron/rootwrap.d,/usr/share/neutron/rootwrap
|
||||
|
||||
# List of directories to search executables in, in case filters do not
|
||||
# explicitely specify a full path (separated by ',')
|
||||
# If not specified, defaults to system PATH environment variable.
|
||||
# These directories MUST all be only writeable by root !
|
||||
exec_dirs=/sbin,/usr/sbin,/bin,/usr/bin,/usr/local/bin,/usr/local/sbin
|
||||
|
||||
# Enable logging to syslog
|
||||
# Default value is False
|
||||
use_syslog=False
|
||||
|
||||
# Which syslog facility to use.
|
||||
# Valid values include auth, authpriv, syslog, local0, local1...
|
||||
# Default value is 'syslog'
|
||||
syslog_log_facility=syslog
|
||||
|
||||
# Which messages to log.
|
||||
# INFO means log all usage
|
||||
# ERROR means only log unsuccessful attempts
|
||||
syslog_log_level=ERROR
|
||||
|
||||
[xenapi]
|
||||
# XenAPI configuration is only required by the L2 agent if it is to
|
||||
# target a XenServer/XCP compute host's dom0.
|
||||
xenapi_connection_url=<None>
|
||||
xenapi_connection_username=root
|
||||
xenapi_connection_password=<None>
|
||||
@@ -0,0 +1,18 @@
|
||||
# neutron-rootwrap command filters for nodes on which neutron is
|
||||
# expected to control network
|
||||
#
|
||||
# This file should be owned by (and only-writeable by) the root user
|
||||
|
||||
# format seems to be
|
||||
# cmd-name: filter-name, raw-command, user, args
|
||||
|
||||
[Filters]
|
||||
|
||||
# This is needed because we should ping
|
||||
# from inside a namespace which requires root
|
||||
# _alt variants allow to match -c and -w in any order
|
||||
# (used by NeutronDebugAgent.ping_all)
|
||||
ping: RegExpFilter, ping, root, ping, -w, \d+, -c, \d+, [0-9\.]+
|
||||
ping_alt: RegExpFilter, ping, root, ping, -c, \d+, -w, \d+, [0-9\.]+
|
||||
ping6: RegExpFilter, ping6, root, ping6, -w, \d+, -c, \d+, [0-9A-Fa-f:]+
|
||||
ping6_alt: RegExpFilter, ping6, root, ping6, -c, \d+, -w, \d+, [0-9A-Fa-f:]+
|
||||
@@ -0,0 +1,17 @@
|
||||
# neutron-rootwrap command filters for nodes on which neutron is
|
||||
# expected to control network
|
||||
#
|
||||
# This file should be owned by (and only-writeable by) the root user
|
||||
|
||||
# format seems to be
|
||||
# cmd-name: filter-name, raw-command, user, args
|
||||
|
||||
[Filters]
|
||||
|
||||
# Filters for the dibbler-based reference implementation of the pluggable
|
||||
# Prefix Delegation driver. Other implementations using an alternative agent
|
||||
# should include a similar filter in this folder.
|
||||
|
||||
# prefix_delegation_agent
|
||||
dibbler-client: CommandFilter, dibbler-client, root
|
||||
kill_dibbler-client: KillFilter, root, dibbler-client, -9
|
||||
@@ -0,0 +1,11 @@
|
||||
# neutron-rootwrap command filters for nodes on which neutron is
|
||||
# expected to control network
|
||||
#
|
||||
# This file should be owned by (and only-writeable by) the root user
|
||||
|
||||
# format seems to be
|
||||
# cmd-name: filter-name, raw-command, user, args
|
||||
|
||||
[Filters]
|
||||
|
||||
ebtables: CommandFilter, ebtables, root
|
||||
@@ -0,0 +1,12 @@
|
||||
# neutron-rootwrap command filters for nodes on which neutron is
|
||||
# expected to control network
|
||||
#
|
||||
# This file should be owned by (and only-writeable by) the root user
|
||||
|
||||
# format seems to be
|
||||
# cmd-name: filter-name, raw-command, user, args
|
||||
|
||||
[Filters]
|
||||
# neutron/agent/linux/iptables_firewall.py
|
||||
# "ipset", "-A", ...
|
||||
ipset: CommandFilter, ipset, root
|
||||
@@ -0,0 +1,24 @@
|
||||
# neutron-rootwrap command filters for nodes on which neutron is
|
||||
# expected to control network
|
||||
#
|
||||
# This file should be owned by (and only-writeable by) the root user
|
||||
|
||||
# format seems to be
|
||||
# cmd-name: filter-name, raw-command, user, args
|
||||
|
||||
[Filters]
|
||||
|
||||
# neutron/agent/linux/iptables_firewall.py
|
||||
# "iptables-save", ...
|
||||
iptables-save: CommandFilter, iptables-save, root
|
||||
iptables-restore: CommandFilter, iptables-restore, root
|
||||
ip6tables-save: CommandFilter, ip6tables-save, root
|
||||
ip6tables-restore: CommandFilter, ip6tables-restore, root
|
||||
|
||||
# neutron/agent/linux/iptables_firewall.py
|
||||
# "iptables", "-A", ...
|
||||
iptables: CommandFilter, iptables, root
|
||||
ip6tables: CommandFilter, ip6tables, root
|
||||
|
||||
# neutron/agent/linux/ip_conntrack.py
|
||||
conntrack: CommandFilter, conntrack, root
|
||||
@@ -0,0 +1,66 @@
|
||||
# neutron-rootwrap command filters for nodes on which neutron is
|
||||
# expected to control network
|
||||
#
|
||||
# This file should be owned by (and only-writeable by) the root user
|
||||
|
||||
# format seems to be
|
||||
# cmd-name: filter-name, raw-command, user, args
|
||||
|
||||
[Filters]
|
||||
|
||||
# arping
|
||||
arping: CommandFilter, arping, root
|
||||
|
||||
# l3_agent
|
||||
sysctl: CommandFilter, sysctl, root
|
||||
route: CommandFilter, route, root
|
||||
radvd: CommandFilter, radvd, root
|
||||
|
||||
# haproxy
|
||||
haproxy: RegExpFilter, haproxy, root, haproxy, -f, .*
|
||||
kill_haproxy: KillFilter, root, haproxy, -15, -9, -HUP
|
||||
# RHEL invocation of the metadata proxy will report /usr/bin/python
|
||||
# TODO(dalvarez): Remove kill_metadata* filters in Q release since
|
||||
# neutron-ns-metadata-proxy is now replaced by haproxy. We keep them for now
|
||||
# for the migration process
|
||||
kill_metadata: KillFilter, root, python, -15, -9
|
||||
kill_metadata7: KillFilter, root, python2.7, -15, -9
|
||||
kill_metadata35: KillFilter, root, python3.5, -15, -9
|
||||
kill_radvd_usr: KillFilter, root, /usr/sbin/radvd, -15, -9, -HUP
|
||||
kill_radvd: KillFilter, root, /sbin/radvd, -15, -9, -HUP
|
||||
|
||||
# ip_lib
|
||||
ip: IpFilter, ip, root
|
||||
find: RegExpFilter, find, root, find, /sys/class/net, -maxdepth, 1, -type, l, -printf, %.*
|
||||
ip_exec: IpNetnsExecFilter, ip, root
|
||||
|
||||
# l3_tc_lib
|
||||
l3_tc_show_qdisc: RegExpFilter, tc, root, tc, qdisc, show, dev, .+
|
||||
l3_tc_add_qdisc_ingress: RegExpFilter, tc, root, tc, qdisc, add, dev, .+, ingress
|
||||
l3_tc_add_qdisc_egress: RegExpFilter, tc, root, tc, qdisc, add, dev, .+, root, handle, 1:, htb
|
||||
l3_tc_show_filters: RegExpFilter, tc, root, tc, -p, -s, -d, filter, show, dev, .+, parent, .+, prio, 1
|
||||
l3_tc_delete_filters: RegExpFilter, tc, root, tc, filter, del, dev, .+, parent, .+, prio, 1, handle, .+, u32
|
||||
l3_tc_add_filter_ingress: RegExpFilter, tc, root, tc, filter, add, dev, .+, parent, .+, protocol, ip, prio, 1, u32, match, ip, dst, .+, police, rate, .+, burst, .+, drop, flowid, :1
|
||||
l3_tc_add_filter_egress: RegExpFilter, tc, root, tc, filter, add, dev, .+, parent, .+, protocol, ip, prio, 1, u32, match, ip, src, .+, police, rate, .+, burst, .+, drop, flowid, :1
|
||||
|
||||
# For ip monitor
|
||||
kill_ip_monitor: KillFilter, root, ip, -9
|
||||
|
||||
# ovs_lib (if OVSInterfaceDriver is used)
|
||||
ovs-vsctl: CommandFilter, ovs-vsctl, root
|
||||
|
||||
# iptables_manager
|
||||
iptables-save: CommandFilter, iptables-save, root
|
||||
iptables-restore: CommandFilter, iptables-restore, root
|
||||
ip6tables-save: CommandFilter, ip6tables-save, root
|
||||
ip6tables-restore: CommandFilter, ip6tables-restore, root
|
||||
|
||||
# Keepalived
|
||||
keepalived: CommandFilter, keepalived, root
|
||||
kill_keepalived: KillFilter, root, /usr/sbin/keepalived, -HUP, -15, -9
|
||||
|
||||
# l3 agent to delete floatingip's conntrack state
|
||||
conntrack: CommandFilter, conntrack, root
|
||||
|
||||
# keepalived state change monitor
|
||||
keepalived_state_change: CommandFilter, neutron-keepalived-state-change, root
|
||||
@@ -0,0 +1,29 @@
|
||||
# neutron-rootwrap command filters for nodes on which neutron is
|
||||
# expected to control network
|
||||
#
|
||||
# This file should be owned by (and only-writeable by) the root user
|
||||
|
||||
# format seems to be
|
||||
# cmd-name: filter-name, raw-command, user, args
|
||||
|
||||
[Filters]
|
||||
|
||||
# linuxbridge-agent
|
||||
# unclear whether both variants are necessary, but I'm transliterating
|
||||
# from the old mechanism
|
||||
brctl: CommandFilter, brctl, root
|
||||
bridge: CommandFilter, bridge, root
|
||||
sysctl: CommandFilter, sysctl, root
|
||||
|
||||
# ip_lib
|
||||
ip: IpFilter, ip, root
|
||||
find: RegExpFilter, find, root, find, /sys/class/net, -maxdepth, 1, -type, l, -printf, %.*
|
||||
ip_exec: IpNetnsExecFilter, ip, root
|
||||
|
||||
# tc commands needed for QoS support
|
||||
tc_replace_tbf: RegExpFilter, tc, root, tc, qdisc, replace, dev, .+, root, tbf, rate, .+, latency, .+, burst, .+
|
||||
tc_add_ingress: RegExpFilter, tc, root, tc, qdisc, add, dev, .+, ingress, handle, .+
|
||||
tc_delete: RegExpFilter, tc, root, tc, qdisc, del, dev, .+, .+
|
||||
tc_show_qdisc: RegExpFilter, tc, root, tc, qdisc, show, dev, .+
|
||||
tc_show_filters: RegExpFilter, tc, root, tc, filter, show, dev, .+, parent, .+
|
||||
tc_add_filter: RegExpFilter, tc, root, tc, filter, add, dev, .+, parent, .+, protocol, all, prio, .+, basic, police, rate, .+, burst, .+, mtu, .+, drop
|
||||
Reference in New Issue
Block a user