summaryrefslogtreecommitdiffstats
path: root/puppet/services/kernel.yaml
AgeCommit message (Collapse)AuthorFilesLines
2017-07-14Adds network/cidr mapping into a new service propertyGiulio Fidente1-0/+4
Makes it possible to resolve network subnets within a service template; the data is transported into a new property ServiceData wired into every service which hopefully is generic enough to be extended in the future and transport more data. Data can be consumed in service templates to set config values which need to know what is the subnet where a deamon operates (for example the Ceph Public vs Cluster network). Change-Id: I28e21c46f1ef609517175f7e7ee19e28d1c0cba2
2017-05-25Enable arp_accept for all interfacesIhar Hrachyshka1-0/+2
OpenStack heavily relies on gratuitous ARP updates when moving floating IP addresses between devices. When a floating IP moves, Neutron L3 agent issues a burst of gratuitous ARP packets that should update any existing ARP table entries on all nodes that belong to the same network segment. Due to locktime kernel behavior, some gratuitous ARP packets may be ignored [1], rendering ARP table entries broken for some time. Due to a kernel bug [2], the time may be as long as hours, depending on other traffic flowing to the node. With the current EL7 kernel, the only way to make sure that nodes honor all sent gratuitous ARP updates is to set arp_accept to 1; this will disable locktime mechanism for the packets sent by Neutron L3 agent, and will make sure ARP tables are always updated. [1] https://patchwork.ozlabs.org/patch/762732/ [2] https://bugzilla.redhat.com/show_bug.cgi?id=1450203 Related-Bug: #1690165 Change-Id: I863b240e0ab4c4d5bb844f91b607fd0937d5cedf
2017-05-19Update the template_version alias for all the templates to pike.Carlos Camacho1-1/+1
Master is now the development branch for pike changing the release alias name. Change-Id: I938e4a983e361aefcaa0bd9a4226c296c5823127
2017-05-16Merge "Optimize kernel neighbour table for large scale environments"Jenkins1-0/+29
2017-05-16Optimize kernel neighbour table for large scale environmentsOr Idgar1-0/+29
Changing the default values of neighbor table (also known as ARP table) in the kernel to avoid neighbour table overflow and thus fix communication errors between overcloud nodes. default kernel values support L2 network up to 1024 hosts (/22). The patch will allow up to 4096 hosts (/20). Change-Id: I5fabc766dd75a38cd3d835deee7e168f04dd30ce Closes-Bug: #1690087
2017-05-15Add role specific information to the service templateSaravanan KR1-0/+8
When a service is enabled on multiple roles, the parameters for the service will be global. This change enables an option to provide role specific parameter to services and other templates. Two new parameters - RoleName and RoleParameters, are added to the service template. RoleName provides the role name of on which the current instance of the service is being applied on. RoleParameters provides the list of parameters which are configured specific to the role in the environment file, like below: parameters_default: # Default value for applied to all roles NovaReservedHostMemory: 2048 ComputeDpdkParameters: # Applied only to ComputeDpdk role NovaReservedHostMemory: 4096 In above sample, the cluster contains 2 roles - Compute, ComputeDpdk. The values of ComputeDpdkParameters will be passed on to the templates as RoleParameters while creating the stack for ComputeDpdk role. The parameter which supports role specific configuration, should find the parameter first in in the RoleParameters list, if not found, then the default (for all roles) should be used. Implements: blueprint tripleo-derive-parameters Change-Id: I72376a803ec6b2ed93903cc0c95a6ffce718b6dc
2017-04-12Merge "Add IPv6 disable option"Jenkins1-0/+8
2017-04-11Add IPv6 disable optionzshi1-0/+8
This will give user the ability to set these values, if IPv6 is not to be used, it's recommended that it be disabled to reduce the attack surface of the system. Change-Id: Ib3142cce49b93a421ca142a59961ce49a77e66b1 Co-Authored-By: Luke Hinds <lhinds@redhat.com> Signed-off-by: zshi <zshi@redhat.com>
2017-04-06Fix conntrack proto sctp moduleAlex Schultz1-1/+1
ip_conntrack_proto_sctp is the old name for the module and it is now nf_conntrack_proto_sctp. In order for the kmod module to not keep trying to modprobe the module, we need to use the correct name. Change-Id: Ieaed235e71e9e6e41a46d9be0e02beb8f4341b1a Closes-Bug: #1680579
2017-04-06Merge "Add network sysctl tweaks for security"Jenkins1-0/+18
2017-03-29Add network sysctl tweaks for securityzshi1-0/+18
* Disable Kernel Parameter for Sending ICMP Redirects: - net.ipv4.conf.default.send_redirects = 0 - net.ipv4.conf.all.send_redirects = 0 Rationale: An attacker could use a compromised host to send invalid ICMP redirects to other router devices in an attempt to corrupt routing and have users access a system set up by the attacker as opposed to a valid system. * Disable Kernel Parameter for Accepting ICMP Redirects: - net.ipv4.conf.default.accept_redirects = 0 Rationale: Attackers could use bogus ICMP redirect messages to maliciously alter the system routing tables and get them to send packets to incorrect networks and allow your system packets to be captured. * Disable Kernel Parameter for secure ICMP Redirects: - net.ipv4.conf.default.secure_redirects = 0 - net.ipv4.conf.all.secure_redirects = 0 Rationale: Secure ICMP redirects are the same as ICMP redirects, except they come from gateways listed on the default gateway list. It is assumed that these gateways are known to your system, and that they are likely to be secure. * Enable Kernel Parameter to log suspicious packets: - net.ipv4.conf.default.log_martians = 1 - net.ipv4.conf.all.log_martians = 1 Rationale: Enabling this feature and logging these packets allows an administrator to investigate the possibility that an attacker is sending spoofed packets to their system. * Ensure IPv6 redirects are not accepted by Default - net.ipv6.conf.all.accept_redirects = 0 - net.ipv6.conf.default.accept_redirects = 0 Rationale: It is recommended that systems not accept ICMP redirects as they could be tricked into routing traffic to compromised machines. Setting hard routes within the system (usually a single default route to a trusted router) protects the system from bad routes. Change-Id: I2e8ab3141ee37ee6dd5a23d23dbb97c93610ea2e Co-Authored-By: Luke Hinds <lhinds@redhat.com> Signed-off-by: zshi <zshi@redhat.com>
2017-03-28Disable core dump for setuid programszshi1-0/+2
The core dump of a setuid program is more likely to contain sensitive data, as the program itself runs with greater privileges than the user who initiated execution of the program. Disabling the ability for any setuid program to write a core file decreases the risk of unauthorized access of such data. This change sets core dump for setuid programs to '0'. Change-Id: Ib05d993c1bb59b59c784e438f805733f636c743d Signed-off-by: zshi <zshi@redhat.com>
2017-03-22Restrict Access to Kernel Message Bufferzshi1-0/+2
Unprivileged access to the kernel syslog can expose sensitive kernel address information. Change-Id: If40f1b883dfde6c7870bf9c463753d037867c9e2 Signed-off-by: zshi <zshi@redhat.com>
2017-02-23Adding the ip_conntrack_proto_sctp kernel moduleItzik Brown1-0/+1
When using conntrack there is a need to load the ip_conntrack_proto_sctp module for SCTP to work. Closes-bug: 1664192 Change-Id: Ic58f5327401c3ab2215acd8b9ce699f555e8c5e4
2016-12-23Bump template version for all templates to "ocata"Steven Hardy1-1/+1
Heat now supports release name aliases, so we can replace the inconsistent mix of date related versions with one consistent version that aligns with the supported version of heat for this t-h-t branch. This should also help new users who sometimes copy/paste old templates and discover intrinsic functions in the t-h-t docs don't work because their template version is too old. Change-Id: Ib415e7290fea27447460baa280291492df197e54
2016-11-04Defaults kernel.pid_max to 1048576Giulio Fidente1-0/+6
In some scenarios we reach the kernel.pid_max value, this change adds a parameter to the Kernel service for configuration of the sysctl key and defaults it to 1048576. Change-Id: Id8f3e6b7ed9846022898d7158fe9180418847085 Closes-Bug: #1639191
2016-10-12Disable IPv6 RAs & Autoconf For All (Not Just Default)Dan Sneddon1-0/+4
The current kernel sysctl settings modify the net.ipv6.conf.default.accept_ra and net.ipv6.conf.default.autoconf to both be '0'. However, this is overridden by the settings in net.ipv6.conf.all, so no matter what setting is in the ifcfg file for the IPv6 interface, autoconfiguration and accept_ra will be enabled. This causes a security vulnerability where rogue RAs could be used to intercept traffic from the controllers. This change sets both default and all settings to '0' for IPv6 accept_ra and autoconf. Closes-Bug: 1632830 Change-Id: I95b86c5c6feed30dfa5103ffbddb9e85ac567bbb
2016-08-18Add DefaultPasswords to composable servicesDan Prince1-0/+3
This patch adds a new DefaultPasswords parameter to composable services. This is needed to help provide access to top level password resources that overcloud.yaml currently manages (passwords for Rabbit, Mysql, etc.). Moving the RandomString resources into composable services would cause them to regenerate within the stack. With this approach we can leave them where they are while we deprecate the top level mechanism and move the code that uses the passwords into the composable services. Change-Id: I4f21603c58a169a093962594e860933306879e3f
2016-08-18Pass ServiceNetMap to servicesGiulio Fidente1-0/+6
This will be needed to pick the network where the service has to bind to from within the service template. Change-Id: I52652e1ad8c7b360efd2c7af199e35932aaaea8c
2016-07-27Migrate Puppet Hieradata to composable servicesEmilien Macchi1-0/+21
Migrate puppet/hieradata/*.yaml parameters to puppet/services/*.yaml except for some services that are not composable yet. Co-Authored-By: Juan Antonio Osorio Robles <jaosorior@redhat.com> Change-Id: I7e5f8b18ee9aa63a1dffc6facaf88315b07d5fd7
2016-07-22Add 'service_name' to composable servicesDan Prince1-0/+1
This patch adds a new service_name section to each composable service. We now have an explicit unit test check to ensure that service_name exists in tools/yaml-validate.py. This patch also wires service_names into hieradata on each of the roles so that tools can access the deployed services locally during deployment and upgrades. Change-Id: I60861c5aa760534db3e314bba16a13b90ea72f0c
2016-07-05Add kernel serviceEmilien Macchi1-0/+18
Add a new service that will load and configure kernel modules. Depends-On: If4f1047ff8c193a14b821d8b826f637872cf62bd Change-Id: I8f771712595d0f4826858b855985f65d3621c3f1