openstack
/
tripleo-heat-templates
Code Issues Proposed changes

Merge "Set bridge-nf-call-* values to 1"

This commit is contained in:
Zuul 2019-10-17 17:12:36 +00:00 committed by Gerrit Code Review
parent 21b56ec34a 3d722dbc81
commit 3c91bc0bac
3 changed files with 43 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
deployment/deprecated/kernel/kernel-baremetal-puppet.yaml
View File

@ -72,6 +72,18 @@ parameters:
default: 1024
description: Configures sysctl fs.inotify.max_user_instances key
type: number
BridgeNfCallArpTables:
default: 1
description: Configures sysctl net.bridge.bridge-nf-call-arptables key
type: number
BridgeNfCallIpTables:
default: 1
description: Configures sysctl net.bridge.bridge-nf-call-iptables key
type: number
BridgeNfCallIp6Tables:
default: 1
description: Configures sysctl net.bridge.bridge-nf-call-ip6tables key
type: number
ExtraKernelModules:
default: {}
description: Hash of extra Kernel modules to load.
@ -126,6 +138,7 @@ outputs:
- 'localhost'
kernel_modules:
map_merge:
- br_netfilter: {}
- nf_conntrack: {}
- {get_attr: [RoleParametersValue, value, extra_kernel_modules]}
kernel_packages: {get_attr: [RoleParametersValue, value, extra_kernel_packages]}
@ -203,6 +216,12 @@ outputs:
value: {get_param: NeighbourGcThreshold2}
net.ipv4.neigh.default.gc_thresh3:
value: {get_param: NeighbourGcThreshold3}
net.bridge.bridge-nf-call-arptables:
value: {get_param: BridgeNfCallArpTables}
net.bridge.bridge-nf-call-iptables:
value: {get_param: BridgeNfCallIpTables}
net.bridge.bridge-nf-call-ip6tables:
value: {get_param: BridgeNfCallIp6Tables}
# set inotify value for neutron/dnsmasq scale
fs.inotify.max_user_instances:
value: {get_param: InotifyIntancesMax}

18
deployment/kernel/kernel-baremetal-ansible.yaml
View File

@ -72,6 +72,18 @@ parameters:
default: 1024
description: Configures sysctl fs.inotify.max_user_instances key
type: number
BridgeNfCallArpTables:
default: 1
description: Configures sysctl net.bridge.bridge-nf-call-arptables key
type: number
BridgeNfCallIpTables:
default: 1
description: Configures sysctl net.bridge.bridge-nf-call-iptables key
type: number
BridgeNfCallIp6Tables:
default: 1
description: Configures sysctl net.bridge.bridge-nf-call-ip6tables key
type: number
ExtraKernelModules:
default: {}
description: Hash of extra Kernel modules to load.
@ -149,6 +161,12 @@ outputs:
value: {get_param: NeighbourGcThreshold2}
net.ipv4.neigh.default.gc_thresh3:
value: {get_param: NeighbourGcThreshold3}
net.bridge.bridge-nf-call-arptables:
value: {get_param: BridgeNfCallArpTables}
net.bridge.bridge-nf-call-iptables:
value: {get_param: BridgeNfCallIpTables}
net.bridge.bridge-nf-call-ip6tables:
value: {get_param: BridgeNfCallIp6Tables}
fs.inotify.max_user_instances:
value: {get_param: InotifyIntancesMax}
- {get_attr: [RoleParametersValue, value, extra_sysctl_settings]}

6
releasenotes/notes/fix-bridge-nf-call-defaults.rst Normal file
View File

@ -0,0 +1,6 @@
---
fixes:
- |
Sets the bridge-nf-call-* values to 1, overriding any distro defaults that
may not be applied due to br_netfilter not being loaded. These values must
be 1 for security groups to work.