From d62d663a2daaf301c6ca5ae7d314e61b904af575 Mon Sep 17 00:00:00 2001 From: Kaspars Skels Date: Mon, 15 Jul 2019 15:27:12 -0500 Subject: Initial site reference manifests for intel-pod17 This includes cntt type definition as well as site manifests. Change-Id: I4829c80199795af0c841419b8fd19557295fe244 Signed-off-by: Kaspars Skels --- site/intel-pod17/networks/common-addresses.yaml | 155 ++++++++++ site/intel-pod17/networks/physical/networks.yaml | 365 +++++++++++++++++++++++ 2 files changed, 520 insertions(+) create mode 100644 site/intel-pod17/networks/common-addresses.yaml create mode 100644 site/intel-pod17/networks/physical/networks.yaml (limited to 'site/intel-pod17/networks') diff --git a/site/intel-pod17/networks/common-addresses.yaml b/site/intel-pod17/networks/common-addresses.yaml new file mode 100644 index 0000000..1fe0357 --- /dev/null +++ b/site/intel-pod17/networks/common-addresses.yaml @@ -0,0 +1,155 @@ +--- +# The purpose of this file is to define network related paramters that are +# referenced elsewhere in the manifests for this site. +# +schema: pegleg/CommonAddresses/v1 +metadata: + schema: metadata/Document/v1 + name: common-addresses + layeringDefinition: + abstract: false + layer: site + storagePolicy: cleartext +data: + calico: + # NEWSITE-CHANGEME: The interface that calico will use. Update if your + # logical bond interface name or calico VLAN have changed from the reference + # site design. + # This should be whichever + # bond and VLAN number specified in networks/physical/networks.yaml for the Calico + # network. E.g. VLAN 22 for the calico network as a member of bond0, you + # would set "interface=bond0.22" as shown here. + ip_autodetection_method: interface=ens785f0 + etcd: + # etcd service IP address + service_ip: 10.96.232.136 + + vip: + ingress_vip: '10.10.170.100/32' + maas_vip: '10.10.171.100/32' + + dns: + # Kubernetes cluster domain. Do not change. This is internal to the cluster. + cluster_domain: cluster.local + # DNS service ip + service_ip: 10.96.0.10 + # List of upstream DNS forwards. Verify you can reach them from your + # environment. If so, you should not need to change them. + upstream_servers: + - 8.8.8.8 + - 8.8.4.4 + # Repeat the same values as above, but formatted as a common separated + # string + upstream_servers_joined: 8.8.8.8,8.8.4.4 + # NEWSITE-CHANGEME: FQDN for ingress (i.e. "publicly facing" access point) + # Choose FQDN according to the ingress/public FQDN naming conventions at + # the top of this document. + ingress_domain: intel-pod17.opnfv.org + + genesis: + # NEWSITE-CHANGEME: Update with the hostname for the node which will take on + # the Genesis role. Refer to the hostname naming stardards in + # networks/physical/networks.yaml + # NOTE: Ensure that the genesis node is manually configured with this + # hostname before running `genesis.sh` on the node. + hostname: pod17-jump + # NEWSITE-CHANGEME: Calico IP of the Genesis node. Use the "start" value for + # the calico network defined in networks/physical/networks.yaml for this IP. + ip: 10.10.172.20 + + bootstrap: + # NEWSITE-CHANGEME: Update with the "start" value/IP of the static range + # defined for the pxe network in networks/physical/networks.yaml + ip: 10.10.171.20 + + kubernetes: + # K8s API service IP + api_service_ip: 10.96.0.1 + # etcd service IP + etcd_service_ip: 10.96.0.2 + # k8s pod CIDR (network which pod traffic will traverse) + pod_cidr: 10.97.0.0/16 + # k8s service CIDR (network which k8s API traffic will traverse) + service_cidr: 10.96.0.0/16 + # misc k8s port settings + apiserver_port: 6443 + haproxy_port: 6553 + service_node_port_range: 30000-32767 + + # etcd port settings + etcd: + container_port: 2379 + haproxy_port: 2378 + + # NEWSITE-CHANGEME: A list of nodes (apart from Genesis) which act as the + # control plane servers. Ensure that this matches the nodes with the 'masters' + # tags applied in baremetal/nodes.yaml + masters: + - hostname: pod17-node1 + - hostname: pod17-node2 + + # NEWSITE-CHANGEME: Environment proxy information. + # NOTE: Reference Airship sites do not deploy behind a proxy, so this proxy section + # should be commented out. + # However if you are in a lab that requires proxy, ensure that these proxy + # settings are correct and reachable in your environment; otherwise update + # them with the correct values for your environment. + proxy: + http: "" + https: "" + no_proxy: [] + + node_ports: + drydock_api: 30000 + maas_api: 30001 + maas_proxy: 31800 # hardcoded in MAAS + + ntp: + # comma separated NTP server list. Verify that these upstream NTP servers are + # reachable in your environment; otherwise update them with the correct + # values for your environment. + servers_joined: '0.ubuntu.pool.ntp.org,1.ubuntu.pool.ntp.org,2.ubuntu.pool.ntp.org,4.ubuntu.pool.ntp.org' + + # NOTE: This will be updated soon + ldap: + # NEWSITE-CHANGEME: FQDN for LDAP. Update to the FQDN that is + # relevant for your type of deployment (test vs prod values, etc). + base_url: 'ldap.example.com' + # NEWSITE-CHANGEME: As above, with the protocol included to create a full URI + url: 'ldap://ldap.example.com' + # NEWSITE-CHANGEME: Update to the correct expression relevant for this + # deployment (test vs prod values, etc) + auth_path: DC=test,DC=test,DC=com?sAMAccountName?sub?memberof=CN=test,OU=Application,OU=Groups,DC=test,DC=test,DC=com + # NEWSITE-CHANGEME: Update to the correct AD group that contains the users + # relevant for this deployment (test users vs prod users/values, etc) + common_name: test + # NEWSITE-CHANGEME: Update to the correct subdomain for your type of + # deployment (test vs prod values, etc) + subdomain: test + # NEWSITE-CHANGEME: Update to the correct domain for your type of + # deployment (test vs prod values, etc) + domain: example + + storage: + ceph: + # NEWSITE-CHANGEME: CIDRs for Ceph. Update to match the network CIDR + # used for the `storage` network in networks/physical/networks.yaml + public_cidr: '10.10.173.0/24' + cluster_cidr: '10.10.173.0/24' + + neutron: + # NEWSITE-CHANGEME: Overlay network for VM traffic. Ensure the bond name and + # VLAN number are consistent with what's defined for the bond and the overlay + # network in networks/physical/networks.yaml + tunnel_device: 'ens785f0' + # bond which the overlay is a member of. Ensure the bond name is consistent + # with the bond assigned to the overlay network in + # networks/physical/networks.yaml + external_iface: 'ens785f1.1173' + + openvswitch: + # bond which the overlay is a member of. Ensure the bond name is consistent + # with the bond assigned to the overlay network in + # networks/physical/networks.yaml + external_iface: 'ens785f1.1173' +... diff --git a/site/intel-pod17/networks/physical/networks.yaml b/site/intel-pod17/networks/physical/networks.yaml new file mode 100644 index 0000000..d149b07 --- /dev/null +++ b/site/intel-pod17/networks/physical/networks.yaml @@ -0,0 +1,365 @@ +--- +# The purpose of this file is to define all of the NetworkLinks (i.e. layer 1 +# devices) and Networks (i.e. layer 3 configurations). The following is standard +# for the logical networks in Airship: +# +# https://wiki.opnfv.org/display/pharos/Intel+POD17 +# +--------+------------+-----------------------------------+----------+----------+----------------+ +# | | | | | | | +# +--------+------------+-----------------------------------+----------+----------+----------------+ +# |IF0 1G | dmz | OoB & OAM (default route) | VLAN 170 | untagged | 10.10.170.0/24 | +# |IF1 1G | admin | PXE boot network | VLAN 171 | untagged | 10.10.171.0/24 | +# |IF2 10G | private | Underlay calico and ovs overlay | VLAN 172 | untagged | 10.10.172.0/24 | +# | | management | Management (unused for now) | VLAN 174 | tagged | 10.10.174.0/24 | +# |IF3 10G | storage | Storage network | VLAN 173 | untagged | 10.10.173.0/24 | +# | | public | Public network for VMs | VLAN 175 | tagged | 10.10.175.0/24 | +# +--------+------------+-----------------------------------+----------+----------+----------------+ +# +# For standard Airship deployments, you should not need to modify the number of +# NetworkLinks and Networks in this file. Only the IP addresses and CIDRs should +# need editing. +# +# TODO: Given that we expect all network broadcast domains to span all racks in +# Airship, we should choose network names that do not include the rack number. +# +# TODO: FQDN naming standards for hosts +# +schema: 'drydock/NetworkLink/v1' +metadata: + schema: 'metadata/Document/v1' + name: oob + layeringDefinition: + abstract: false + layer: site + storagePolicy: cleartext +data: + # MaaS doesnt own this network like it does the others, so the noconfig label + # is specified. + labels: + noconfig: enabled + bonding: + mode: disabled + mtu: 1500 + linkspeed: auto + trunking: + mode: disabled + default_network: oob + allowed_networks: + - oob +... +--- +schema: 'drydock/Network/v1' +metadata: + schema: 'metadata/Document/v1' + name: oob + layeringDefinition: + abstract: false + layer: site + storagePolicy: cleartext +data: + # NEWSITE-CHANGEME: Update with the site's out-of-band CIDR + cidr: 10.10.170.0/24 + routes: + # NEWSITE-CHANGEME: Update with the site's out-of-band gateway IP + - subnet: '0.0.0.0/0' + gateway: 10.10.170.1 + metric: 100 + # NEWSITE-CHANGEME: Update with the site's out-of-band IP allocation range + # FIXME: Is this IP range actually used/allocated for anything? The HW already + # has its OOB IPs assigned. None of the Ubuntu OS's should need IPs on OOB + # network either, as they should be routable via the default gw on OAM network + ranges: + - type: static + start: 10.10.170.20 + end: 10.10.170.39 +... +--- +schema: 'drydock/NetworkLink/v1' +metadata: + schema: 'metadata/Document/v1' + name: dmz + layeringDefinition: + abstract: false + layer: site + storagePolicy: cleartext +data: + bonding: + mode: disabled + mtu: 1500 + linkspeed: auto + trunking: + mode: disabled + default_network: dmz + allowed_networks: + - dmz +... +--- +schema: 'drydock/Network/v1' +metadata: + schema: 'metadata/Document/v1' + name: dmz + layeringDefinition: + abstract: false + layer: site + storagePolicy: cleartext +data: + # NEWSITE-CHANGEME: Update with the site's PXE network CIDR + # NOTE: The CIDR minimum size = (number of nodes * 2) + 10 + cidr: 10.10.170.0/24 + routes: + - subnet: 0.0.0.0/0 + # NEWSITE-CHANGEME: Set the OAM network gateway IP address + gateway: 10.10.170.1 + metric: 100 + # NOTE: The first 10 IPs in the subnet are reserved for network infrastructure. + # The remainder of the range is divided between two subnets of equal size: + # one static, and one DHCP. + # The DHCP addresses are used when nodes perform a PXE boot (DHCP address gets + # assigned), and when a node is commissioning in MaaS (also uses DHCP to get + # its IP address). However, when MaaS installs the operating system + # ("Deploying/Deployed" states), it will write a static IP assignment to + # /etc/network/interfaces[.d] with IPs from the "static" subnet defined here. + ranges: + # NEWSITE-CHANGEME: Update to the first 10 IPs in the CIDR + - type: reserved + start: 10.10.170.1 + end: 10.10.170.19 + # NEWSITE-CHANGEME: Update to the first half of the remaining range after + # excluding the 10 reserved IPs. + - type: static + start: 10.10.170.20 + end: 10.10.170.39 + # NEWSITE-CHANGEME: Update to the second half of the remaining range after + # excluding the 10 reserved IPs. + - type: dhcp + start: 10.10.170.40 + end: 10.10.170.79 + dns: + # NEWSITE-CHANGEME: FQDN for bare metal nodes. + # Choose FQDN according to the node FQDN naming conventions at the top of + # this document. + domain: intel-pod17.opnfv.org + # List of upstream DNS forwards. Verify you can reach them from your + # environment. If so, you should not need to change them. + # TODO: This should be populated via substitution from common-addresses + servers: '8.8.8.8,8.8.4.4' +... +--- +schema: 'drydock/NetworkLink/v1' +metadata: + schema: 'metadata/Document/v1' + name: admin + layeringDefinition: + abstract: false + layer: site + storagePolicy: cleartext +data: + bonding: + mode: disabled + mtu: 1500 + linkspeed: auto + trunking: + mode: disabled + default_network: admin + allowed_networks: + - admin +... +--- +schema: 'drydock/Network/v1' +metadata: + schema: 'metadata/Document/v1' + name: admin + layeringDefinition: + abstract: false + layer: site + storagePolicy: cleartext +data: + # NEWSITE-CHANGEME: Update with the site's PXE network CIDR + # NOTE: The CIDR minimum size = (number of nodes * 2) + 10 + cidr: 10.10.171.0/24 + # routes: + # - subnet: 0.0.0.0/0 + # # NEWSITE-CHANGEME: Set the OAM network gateway IP address + # gateway: 10.10.171.1 + # metric: 100 + # NOTE: The first 10 IPs in the subnet are reserved for network infrastructure. + # The remainder of the range is divided between two subnets of equal size: + # one static, and one DHCP. + # The DHCP addresses are used when nodes perform a PXE boot (DHCP address gets + # assigned), and when a node is commissioning in MaaS (also uses DHCP to get + # its IP address). However, when MaaS installs the operating system + # ("Deploying/Deployed" states), it will write a static IP assignment to + # /etc/network/interfaces[.d] with IPs from the "static" subnet defined here. + ranges: + # NEWSITE-CHANGEME: Update to the first 10 IPs in the CIDR + - type: reserved + start: 10.10.171.1 + end: 10.10.171.19 + # NEWSITE-CHANGEME: Update to the first half of the remaining range after + # excluding the 10 reserved IPs. + - type: static + start: 10.10.171.20 + end: 10.10.171.39 + # NEWSITE-CHANGEME: Update to the second half of the remaining range after + # excluding the 10 reserved IPs. + - type: dhcp + start: 10.10.171.40 + end: 10.10.171.79 + dns: + # NEWSITE-CHANGEME: FQDN for bare metal nodes. + # Choose FQDN according to the node FQDN naming conventions at the top of + # this document. + domain: intel-pod17.opnfv.org + # List of upstream DNS forwards. Verify you can reach them from your + # environment. If so, you should not need to change them. + # TODO: This should be populated via substitution from common-addresses + servers: '10.10.171.100' +... +--- +schema: 'drydock/NetworkLink/v1' +metadata: + schema: 'metadata/Document/v1' + name: data1 + layeringDefinition: + abstract: false + layer: site + storagePolicy: cleartext +data: + bonding: + mode: disabled + # NEWSITE-CHANGEME: Ensure the network switches in the environment are + # configured for this MTU or greater. Even if switches are configured for or + # can support a slightly higher MTU, there is no need (and negliable benefit) + # to squeeze every last byte into the MTU (e.g., 9216 vs 9100). Leave MTU at + # 9100 for maximum compatibility. + mtu: 1500 + linkspeed: auto + trunking: + mode: 802.1q + allowed_networks: + - private + - management +... +--- +schema: 'drydock/Network/v1' +metadata: + schema: 'metadata/Document/v1' + name: private + layeringDefinition: + abstract: false + layer: site + storagePolicy: cleartext +data: + # NEWSITE-CHANGEME: Set the VLAN ID which the storage network is on + vlan: '0' + mtu: 1500 + # NEWSITE-CHANGEME: Set the CIDR for the storage network + # NOTE: The CIDR minimum size = number of nodes + 10 + cidr: 10.10.172.0/24 + ranges: + # NEWSITE-CHANGEME: Update to the remaining range after excluding the 10 + # 10 reserved IPs. + - type: static + start: 10.10.172.1 + end: 10.10.172.19 +... +--- +schema: 'drydock/Network/v1' +metadata: + schema: 'metadata/Document/v1' + name: management + layeringDefinition: + abstract: false + layer: site + storagePolicy: cleartext +data: + # NEWSITE-CHANGEME: Set the VLAN ID which the OAM network is on + vlan: '174' + mtu: 1500 + # NEWSITE-CHANGEME: Set the CIDR for the OAM network + # NOTE: The CIDR minimum size = number of nodes + 10 + cidr: 10.10.174.0/24 + routes: + - subnet: 0.0.0.0/0 + # NEWSITE-CHANGEME: Set the OAM network gateway IP address + gateway: 10.10.174.1 + metric: 100 + ranges: + # NEWSITE-CHANGEME: Update to the remaining range after excluding the 10 + # 10 reserved IPs. + - type: static + start: 10.10.174.1 + end: 10.23.21.19 + dns: + # NEWSITE-CHANGEME: FQDN for bare metal nodes. + # Choose FQDN according to the node FQDN naming conventions at the top of + # this document. + domain: intel-pod17.opnfv.org + # List of upstream DNS forwards. Verify you can reach them from your + # environment. If so, you should not need to change them. + # TODO: This should be populated via substitution from common-addresses + servers: '8.8.8.8,8.8.4.4' +... +--- +schema: 'drydock/NetworkLink/v1' +metadata: + schema: 'metadata/Document/v1' + name: data2 + layeringDefinition: + abstract: false + layer: site + storagePolicy: cleartext +data: + bonding: + mode: disabled + # NEWSITE-CHANGEME: Ensure the network switches in the environment are + # configured for this MTU or greater. Even if switches are configured for or + # can support a slightly higher MTU, there is no need (and negliable benefit) + # to squeeze every last byte into the MTU (e.g., 9216 vs 9100). Leave MTU at + # 9100 for maximum compatibility. + mtu: 1500 + linkspeed: auto + trunking: + mode: 802.1q + default_network: storage + allowed_networks: + - storage + - public +... +--- +schema: 'drydock/Network/v1' +metadata: + schema: 'metadata/Document/v1' + name: storage + layeringDefinition: + abstract: false + layer: site + storagePolicy: cleartext +data: + # NEWSITE-CHANGEME: Set the VLAN ID which the storage network is on + vlan: '0' + mtu: 1500 + # NEWSITE-CHANGEME: Set the CIDR for the storage network + # NOTE: The CIDR minimum size = number of nodes + 10 + cidr: 10.10.173.0/24 + ranges: + # NEWSITE-CHANGEME: Update to the remaining range after excluding the 10 + # 10 reserved IPs. + - type: static + start: 10.10.173.1 + end: 10.10.173.19 +... +--- +schema: 'drydock/Network/v1' +metadata: + schema: 'metadata/Document/v1' + name: public + layeringDefinition: + abstract: false + layer: site + storagePolicy: cleartext +data: + vlan: '1173' + mtu: 1500 + cidr: 10.10.175.0/24 +... -- cgit 1.2.3-korg