Nova role for OpenStack-Ansible¶

# Enable/Disable barbican configurations
nova_barbican_enabled: False
# Enable/Disable designate configurations
nova_designate_enabled: False
# Notification topics for designate.
nova_notifications_designate: notifications_designate
# Enable/Disable ceilometer configurations
nova_ceilometer_enabled: False

## Verbosity Options
debug: False

# Set the package install state for distribution and pip packages
# Options are 'present' and 'latest'
nova_package_state: "latest"
nova_pip_package_state: "latest"

nova_git_repo: https://git.openstack.org/openstack/nova
nova_git_install_branch: stable/pike

nova_lxd_git_repo: https://git.openstack.org/openstack/nova-lxd
nova_lxd_git_install_branch: stable/pike

nova_developer_mode: false
nova_developer_constraints:
  - "git+{{ nova_git_repo }}@{{ nova_git_install_branch }}#egg=nova"
  - "git+{{ nova_lxd_git_repo }}@{{ nova_lxd_git_install_branch }}#egg=nova-lxd"

# Name of the virtual env to deploy into
nova_venv_tag: untagged
nova_bin: "/openstack/venvs/nova-{{ nova_venv_tag }}/bin"

# venv_download, even when true, will use the fallback method of building the
# venv from scratch if the venv download fails.
nova_venv_download: "{{ not nova_developer_mode | bool }}"
nova_venv_download_url: http://127.0.0.1/venvs/untagged/ubuntu/nova.tgz

nova_fatal_deprecations: False

## Nova user information
nova_system_user_name: nova
nova_system_group_name: nova
nova_system_shell: /bin/bash
nova_system_comment: nova system user
nova_system_home_folder: "/var/lib/{{ nova_system_user_name }}"
nova_libvirt_save_path: "{{ nova_system_home_folder }}/save"

nova_lock_path: "/var/lock/nova"

## Manually specified nova UID/GID
# Deployers can specify a UID for the nova user as well as the GID for the
# nova group if needed. This is commonly used in environments where shared
# storage is used, such as NFS or GlusterFS, and nova UID/GID values must be
# in sync between multiple servers.
#
# WARNING: Changing these values on an existing deployment can lead to
#          failures, errors, and instability.
#
# nova_system_user_uid = <UID>
# nova_system_group_gid = <GID>

## DB
nova_galera_user: nova
nova_galera_database: nova
nova_db_max_overflow: 10
nova_db_max_pool_size: 120
nova_db_pool_timeout: 30
# Toggle whether nova connects via an encrypted connection
nova_galera_use_ssl: False
# The path where to store the database server CA certificate
nova_galera_ssl_ca_cert: /etc/ssl/certs/galera-ca.pem

## DB API
nova_api_galera_user: nova_api
nova_api_galera_database: nova_api
nova_api_db_max_overflow: 10
nova_api_db_max_pool_size: 120
nova_api_db_pool_timeout: 30

## DB Placement
nova_placement_galera_user: nova_placement
nova_placement_galera_database: nova_placement
nova_placement_db_max_overflow: 10
nova_placement_db_max_pool_size: 120
nova_placement_db_pool_timeout: 30

## DB Cells
nova_cell0_database: "nova_cell0"
nova_cell1_name: "cell1"

## RabbitMQ info

## Configuration for RPC communications
nova_rpc_thread_pool_size: 64
nova_rpc_conn_pool_size: 30
nova_rpc_response_timeout: 60

nova_rabbitmq_servers: 127.0.0.1
nova_rabbitmq_port: 5672
nova_rabbitmq_userid: nova
nova_rabbitmq_vhost: /nova
nova_rabbitmq_use_ssl: False

## Configuration for notifications communication, i.e. [oslo_messaging_notifications]
nova_rabbitmq_telemetry_userid: "{{ nova_rabbitmq_userid }}"
nova_rabbitmq_telemetry_password: "{{ nova_rabbitmq_password }}"
nova_rabbitmq_telemetry_vhost: "{{ nova_rabbitmq_vhost }}"
nova_rabbitmq_telemetry_port: "{{ nova_rabbitmq_port }}"
nova_rabbitmq_telemetry_servers: "{{ nova_rabbitmq_servers }}"
nova_rabbitmq_telemetry_use_ssl: "{{ nova_rabbitmq_use_ssl }}"


## Nova virtualization Types
# The nova_virt_types dictionary contains global overrides used for
#  specific compute types. Every variable inside of this dictionary
#  will become an ansible fact. This gives the user the option to set
#  or customize things based on their needs without having to redefine
#  this entire data structure. Every supported compute type will be
#  have its specific variable requirements set under its short name.
nova_virt_types:
  ironic:
    nova_compute_driver: ironic.IronicDriver
    nova_scheduler_host_manager: ironic_host_manager
    nova_reserved_host_memory_mb: 0
    nova_firewall_driver: nova.virt.firewall.NoopFirewallDriver
    nova_scheduler_use_baremetal_filters: True
    nova_scheduler_tracks_instance_changes: False
  kvm:
    nova_compute_driver: libvirt.LibvirtDriver
    nova_scheduler_host_manager: host_manager
    nova_reserved_host_memory_mb: 2048
    nova_firewall_driver: nova.virt.firewall.NoopFirewallDriver
    nova_scheduler_use_baremetal_filters: False
    nova_scheduler_tracks_instance_changes: True
  lxd:
    nova_compute_driver: lxd.LXDDriver
    nova_scheduler_host_manager: host_manager
    nova_reserved_host_memory_mb: 2048
    nova_compute_manager: nova.compute.manager.ComputeManager
    nova_firewall_driver: nova.virt.firewall.NoopFirewallDriver
    nova_scheduler_use_baremetal_filters: False
    nova_scheduler_tracks_instance_changes: True
  qemu:
    nova_compute_driver: libvirt.LibvirtDriver
    nova_scheduler_host_manager: host_manager
    nova_reserved_host_memory_mb: 2048
    nova_firewall_driver: nova.virt.firewall.NoopFirewallDriver
    nova_scheduler_use_baremetal_filters: False
    nova_scheduler_tracks_instance_changes: True
    nova_cpu_mode: "none"
  powervm:
    nova_compute_driver: powervm.driver.PowerVMDriver
    nova_scheduler_host_manager: host_manager
    nova_reserved_host_memory_mb: 8192
    nova_firewall_driver: nova.virt.firewall.NoopFirewallDriver
    nova_scheduler_use_baremetal_filters: False
    nova_scheduler_tracks_instance_changes: True


# If this is not set, then the playbook will try to guess it.
#nova_virt_type: kvm

# Enable Kernel Shared Memory (KSM)
nova_compute_ksm_enabled: False

#if set, nova_virt_type must be one of these:
nova_supported_virt_types:
  - qemu
  - kvm
  - lxd
  - ironic
  - powervm

## Nova Auth
nova_service_region: RegionOne
nova_service_project_name: "service"
nova_service_project_domain_id: default
nova_service_user_domain_id: default
nova_service_user_name: "nova"
nova_service_role_name: "admin"

## Keystone authentication middleware
nova_keystone_auth_plugin: password

## Nova enabled apis
nova_enabled_apis: "osapi_compute,metadata"

## Nova v2.1
nova_service_name: nova
nova_service_type: compute
nova_service_proto: http
nova_service_publicuri_proto: "{{ openstack_service_publicuri_proto | default(nova_service_proto) }}"
nova_service_adminuri_proto: "{{ openstack_service_adminuri_proto | default(nova_service_proto) }}"
nova_service_internaluri_proto: "{{ openstack_service_internaluri_proto | default(nova_service_proto) }}"
nova_service_port: 8774
nova_service_description: "Nova Compute Service"
nova_service_publicuri: "{{ nova_service_publicuri_proto }}://{{ external_lb_vip_address }}:{{ nova_service_port }}"
nova_service_publicurl: "{{ nova_service_publicuri }}/v2.1"
nova_service_adminuri: "{{ nova_service_adminuri_proto }}://{{ internal_lb_vip_address }}:{{ nova_service_port }}"
nova_service_adminurl: "{{ nova_service_adminuri }}/v2.1"
nova_service_internaluri: "{{ nova_service_internaluri_proto }}://{{ internal_lb_vip_address }}:{{ nova_service_port }}"
nova_service_internalurl: "{{ nova_service_internaluri }}/v2.1"

## Nova cinder
nova_cross_az_attach: True

## Nova spice
nova_spice_html5proxy_base_proto: "{{ openstack_service_publicuri_proto | default('http') }}"
nova_spice_html5proxy_base_port: 6082
nova_spice_html5proxy_base_uri: "{{ nova_spice_html5proxy_base_proto }}://{{ external_lb_vip_address }}:{{ nova_spice_html5proxy_base_port }}"
nova_spice_html5proxy_base_url: "{{ nova_spice_html5proxy_base_uri }}/spice_auto.html"
nova_spice_console_agent_enabled: True
nova_spicehtml5_git_repo: https://gitlab.freedesktop.org/spice/spice-html5.git
nova_spicehtml5_git_install_branch: master

## Nova novnc
nova_novncproxy_proto: "{{ openstack_service_publicuri_proto | default('http') }}"
nova_novncproxy_port: 6080
nova_novncproxy_base_uri: "{{ nova_novncproxy_proto }}://{{ external_lb_vip_address }}:{{ nova_novncproxy_port }}"
nova_novncproxy_base_url: "{{ nova_novncproxy_base_uri }}/vnc_lite.html"
nova_novncproxy_vncserver_proxyclient_address: "{{ ansible_host }}"
nova_novncproxy_vncserver_listen: "{{ ansible_host }}"
nova_novncproxy_agent_enabled: True
nova_novncproxy_git_repo: https://github.com/novnc/noVNC
nova_novncproxy_git_install_branch: master

## Nova metadata
nova_metadata_proxy_enabled: "{{ nova_network_services[nova_network_type]['metadata_proxy_enabled'] | bool }}"
nova_metadata_host: "{{ internal_lb_vip_address }}"
nova_metadata_port: 8775

## Nova compute
nova_enable_instance_password: True
nova_force_config_drive: False

## Nova placement
nova_placement_service_enabled: True
nova_placement_service_user_domain_id: Default
nova_placement_service_project_domain_id: Default
nova_placement_service_interface: internal
nova_placement_service_in_ldap: "{{ nova_service_in_ldap }}"
nova_placement_service_username: placement
nova_placement_service_name: placement
nova_placement_service_role_name: "{{ nova_service_role_name }}"
nova_placement_service_type: placement
nova_placement_service_project_name: "{{ nova_service_project_name }}"
nova_placement_service_region: "{{ nova_service_region }}"
nova_placement_service_description: "Openstack Placement Service"
nova_placement_service_port: 8780
nova_placement_service_proto: "{{ nova_service_proto }}"
nova_placement_ssl: false
nova_placement_service_publicuri_proto: "{{ openstack_service_publicuri_proto | default(nova_placement_service_proto) }}"
nova_placement_service_adminuri_proto: "{{ openstack_service_adminuri_proto | default(nova_placement_service_proto) }}"
nova_placement_service_internaluri_proto: "{{ openstack_service_internaluri_proto | default(nova_placement_service_proto) }}"
nova_placement_service_publicuri: "{{ nova_placement_service_publicuri_proto }}://{{ external_lb_vip_address }}:{{ nova_placement_service_port }}"
nova_placement_service_publicurl: "{{ nova_placement_service_publicuri }}"
nova_placement_service_adminuri: "{{ nova_placement_service_adminuri_proto }}://{{ internal_lb_vip_address }}:{{ nova_placement_service_port }}"
nova_placement_service_adminurl: "{{ nova_placement_service_adminuri }}"
nova_placement_service_internaluri: "{{ nova_placement_service_internaluri_proto }}://{{ internal_lb_vip_address }}:{{ nova_placement_service_port }}"
nova_placement_service_internalurl: "{{ nova_placement_service_internaluri }}"

# Uwsgi settings
nova_wsgi_processes_max: 16
nova_wsgi_processes: "{{ [[ansible_processor_vcpus|default(1), 1] | max * 2, nova_wsgi_processes_max] | min }}"
nova_wsgi_buffer_size: 65535
nova_wsgi_threads: 1

## Nova libvirt
# Warning: If nova_libvirt_inject_key or nova_libvirt_inject_password are enabled for Ubuntu compute hosts
# then the kernel will be made readable to nova user (a requirement for libguestfs).
# See Launchpad bugs 1507915 (Nova), 759725 (Ubuntu), and http://libguestfs.org/guestfs-faq.1.html
nova_libvirt_inject_key: False
# inject partition options:
#  -2 => disable, -1 => inspect (libguestfs only), 0 => not partitioned, >0 => partition number
nova_libvirt_inject_partition: -2
nova_libvirt_inject_password: False
nova_libvirt_disk_cachemodes: '{{ nova_libvirt_images_rbd_pool is defined | ternary("network=writeback", "") }}'
nova_libvirt_hw_disk_discard: '{{ nova_libvirt_images_rbd_pool is defined | ternary("unmap", "ignore") }}'

## Nova console
nova_console_agent_enabled: True
# Set the console type. Presently the only options are ["spice", "novnc"].
nova_console_type: spice

# Nova console ssl info, presently only used by novnc console type
nova_console_ssl_dir: "/etc/nova/ssl"
nova_console_ssl_cert: "{{ nova_console_ssl_dir }}/nova-console.pem"
nova_console_ssl_key: "{{ nova_console_ssl_dir }}/nova-console.key"

# Set to true when terminating SSL/TLS at a load balancer
nova_external_ssl: false

# External SSL forwarding proto
nova_secure_proxy_ssl_header: HTTP_X_FORWARDED_PROTO

## Nova global config
nova_max_age: 0
nova_remove_unused_resized_minimum_age_seconds: 3600
nova_image_cache_manager_interval: 0
nova_resume_guests_state_on_host_boot: False
# nova_default_schedule_zone: nova

# Comma separated list of Glance API servers
# nova_glance_api_servers:

nova_network_type: linuxbridge

nova_network_services:
  linuxbridge:
    use_forwarded_for: False
    metadata_proxy_enabled: True
  nuage:
    use_forwarded_for: True
    metadata_proxy_enabled: True
    ovs_bridge: alubr0
  calico:
    use_forwarded_for: True
    metadata_proxy_enabled: False

# Nova quota
nova_quota_cores: 20
nova_quota_injected_file_content_bytes: 10240
nova_quota_injected_file_path_length: 255
nova_quota_injected_files: 5
nova_quota_instances: 10
nova_quota_key_pairs: 100
nova_quota_metadata_items: 128
nova_quota_ram: 51200
nova_quota_server_group_members: 10
nova_quota_server_groups: 10

# Nova Scheduler
nova_cpu_allocation_ratio: 2.0
nova_disk_allocation_ratio: 1.0
nova_max_instances_per_host: 50
nova_max_io_ops_per_host: 10
nova_ram_allocation_ratio: 1.0
nova_ram_weight_multiplier: 5.0
nova_reserved_host_disk_mb: 2048

nova_scheduler_driver_task_period: 60
nova_scheduler_host_subset_size: 10
nova_scheduler_max_attempts: 5
nova_scheduler_default_filters: >-
  RetryFilter,
  AvailabilityZoneFilter,
  RamFilter,
  AggregateRamFilter,
  ComputeFilter,
  AggregateCoreFilter,
  DiskFilter,
  AggregateDiskFilter,
  AggregateNumInstancesFilter,
  AggregateIoOpsFilter,
  ComputeCapabilitiesFilter,
  ImagePropertiesFilter,
  ServerGroupAntiAffinityFilter,
  ServerGroupAffinityFilter,
  NUMATopologyFilter
nova_scheduler_driver: filter_scheduler
nova_scheduler_available_filters: nova.scheduler.filters.all_filters
nova_scheduler_weight_classes: nova.scheduler.weights.all_weighers

# This should be tuned depending on the number of compute hosts present in the
# deployment. Large clouds may wish to disable automatic discovery by setting
# this value to -1.
nova_discover_hosts_in_cells_interval: "{{ 300 if groups['nova_compute'] | length > 10 else 60 }}"

# If you want to regenerate the nova users SSH keys, on each run, set this var to True
# Otherwise keys will be generated on the first run and not regenerated each run.
nova_recreate_keys: False

# Nova Ceph rbd
# Enble and define nova_libvirt_images_rbd_pool to use rbd as nova backend
#nova_libvirt_images_rbd_pool: vms
nova_ceph_client: '{{ cinder_ceph_client }}'
# TODO(odyssey4me) - the uuid should be removed, there should be no defaults for secrets
nova_ceph_client_uuid: 517a4663-3927-44bc-9ea7-4a90e1cd4c66

# Enabled upstream if RBD is in use on cinder backends, which requires that
# ceph be deployed on the nova compute hosts to enable volume backed instances.
nova_cinder_rbd_inuse: False

## General Nova configuration
# If ``nova_osapi_compute_workers`` is unset the system will use half the number of available VCPUS to
# compute the number of api workers to use.
# nova_osapi_compute_workers: 16

# If ``nova_conductor_workers`` is unset the system will use half the number of available VCPUS to
# compute the number of api workers to use.
# nova_conductor_workers: 16

# If ``nova_metadata_workers`` is unset the system will use half the number of available VCPUS to
# compute the number of api workers to use.
# nova_metadata_workers: 16

## Cap the maximun number of threads / workers when a user value is unspecified.
nova_api_threads_max: 16
nova_api_threads: "{{ [[ansible_processor_vcpus|default(2) // 2, 1] | max, nova_api_threads_max] | min }}"

## Policy vars
# Provide a list of access controls to update the default policy.json with. These changes will be merged
# with the access controls in the default policy.json. E.g.
#nova_policy_overrides:
#  "compute:create": ""
#  "compute:create:attach_network": ""

nova_service_in_ldap: false

## libvirtd config options
nova_libvirtd_listen_tls: 1
nova_libvirtd_listen_tcp: 0
nova_libvirtd_auth_tcp: sasl
nova_libvirtd_debug_log_filters: "3:remote 4:event 3:json 3:rpc"

nova_api_metadata_init_overrides: {}
nova_api_os_compute_init_overrides: {}
nova_compute_init_overrides: {}
nova_conductor_init_overrides: {}
nova_consoleauth_init_overrides: {}
nova_novncproxy_init_overrides: {}
nova_scheduler_init_overrides: {}
nova_spicehtml5proxy_init_overrides: {}
nova_placement_api_init_overrides: {}

## Service Name-Group Mapping
nova_services:
  nova-api-metadata:
    group: nova_api_metadata
    service_name: nova-api-metadata
    init_config_overrides: "{{ nova_api_metadata_init_overrides }}"
    start_order: 4
    log_string: "--logto "
    program_override: "{{ nova_bin }}/uwsgi --ini /etc/uwsgi/nova-api-metadata.ini"
    wsgi_app: True
    wsgi_overrides: "{{ nova_api_metadata_uwsgi_ini_overrides }}"
    uwsgi_port: "{{ nova_metadata_port }}"
    wsgi_name: nova-metadata-wsgi
  nova-api-os-compute:
    group: nova_api_os_compute
    service_name: nova-api-os-compute
    init_config_overrides: "{{ nova_api_os_compute_init_overrides }}"
    start_order: 3
    log_string: "--logto "
    program_override: "{{ nova_bin }}/uwsgi --ini /etc/uwsgi/nova-api-os-compute.ini"
    wsgi_app: True
    wsgi_overrides: "{{ nova_api_os_compute_uwsgi_ini_overrides }}"
    uwsgi_port: "{{ nova_service_port }}"
    wsgi_name: nova-api-wsgi
  nova-compute:
    group: nova_compute
    service_name: nova-compute
    init_config_overrides: "{{ nova_compute_init_overrides }}"
    start_order: 5
  nova-conductor:
    group: nova_conductor
    service_name: nova-conductor
    init_config_overrides: "{{ nova_conductor_init_overrides }}"
    start_order: 1
  nova-consoleauth:
    group: nova_console
    service_name: nova-consoleauth
    init_config_overrides: "{{ nova_consoleauth_init_overrides }}"
    start_order: 2
  nova-novncproxy:
    group: nova_console
    service_name: nova-novncproxy
    init_config_overrides: "{{ nova_novncproxy_init_overrides }}"
    condition: "{{ nova_console_type == 'novnc' }}"
    start_order: 4
  nova-scheduler:
    group: nova_scheduler
    service_name: nova-scheduler
    init_config_overrides: "{{ nova_scheduler_init_overrides }}"
    start_order: 2
  nova-spicehtml5proxy:
    group: nova_console
    service_name: nova-spicehtml5proxy
    init_config_overrides: "{{ nova_spicehtml5proxy_init_overrides }}"
    condition: "{{ nova_console_type == 'spice' }}"
    start_order: 4
  nova-placement-api:
    group: nova_api_placement
    service_name: nova-placement-api
    init_config_overrides: "{{ nova_placement_api_init_overrides }}"
    condition: "{{ nova_placement_service_enabled | bool }}"
    log_string: "--logto "
    start_order: 3
    program_override: "{{ nova_bin }}/uwsgi --ini /etc/uwsgi/nova-placement-api.ini"
    wsgi_app: True
    uwsgi_port: "{{ nova_placement_service_port }}"
    wsgi_name: nova-placement-api
    wsgi_overrides: "{{ nova_placement_uwsgi_ini_overrides }}"


nova_novnc_pip_packages:
  - websockify

# nova packages that must be installed before anything else
nova_requires_pip_packages:
  - virtualenv
  - virtualenv-tools
  - python-keystoneclient # Keystoneclient needed to OSA keystone lib
  - httplib2
  - python-openstackclient

nova_compute_ironic_pip_packages:
  - python-ironicclient

# Common pip packages
nova_pip_packages:
  - cryptography
  - keystonemiddleware
  - nova
  - PyMySQL
  - python-keystoneclient
  - python-memcached
  - python-novaclient
  - uWSGI

nova_compute_lxd_pip_packages:
  - pylxd
  - nova-lxd
  - pyOpenSSL

nova_qemu_user: libvirt-qemu
nova_qemu_group: kvm

# Define the following variable to drop a replacement
# file for /etc/libvirt/qemu.conf
#qemu_conf_dict: {}

# This variable is used by the repo_build process to determine
# which host group to check for members of before building the
# pip packages required by this role. The value is picked up
# by the py_pkgs lookup.
nova_role_project_group: nova_all

## Tunable overrides
nova_nova_conf_overrides: {}
nova_rootwrap_conf_overrides: {}
nova_api_paste_ini_overrides: {}
nova_policy_overrides: {}
nova_vendor_data_overrides: {}
nova_placement_uwsgi_ini_overrides: {}
nova_api_metadata_uwsgi_ini_overrides: {}
nova_api_os_compute_uwsgi_ini_overrides: {}

nova_compute_powervm_pip_packages:
  - nova-powervm
  - pyasn1-modules

lxd_bind_address: 0.0.0.0
lxd_bind_port: 8443

# Supported backends are 'zfs', 'dir' and 'btrfs' for now.
# To use btrfs, a btrfs filesystem must be mounted in /var/lib/lxd
# during compute node configuration.
lxd_storage_backend: dir
# This needs to be set in the user_secrets.yml file.
#lxd_trust_password:

# This variable should be used with lxd when using a
# storage backend that utilizes storage pools (zfs)
#lxd_storage_pool:
# This variable should be used with lxd when using a
# storage backend that utilizes storage pool if you
# want to use a specific bloc device instead of loop
#lxd_storage_create_device: "/dev/sdb"

# PCI devices passthrough to nova
# For SR-IOV please use:
#   nova_pci_passthrough_whitelist: '{ "physical_network": "<ml2 network name>", "devname": "<physical nic>" }'
#   Example:
#     nova_pci_passthrough_whitelist: '{ "physical_network": "physnet1", "devname": "p1p1" }'
nova_pci_passthrough_whitelist: {}
# PCI alias,
# Example:
# nova_pci_alias:
#  - '{ "name": "card-alias1", "product_id": "XXXX", "vendor_id": "XXXX" }'
#  - '{ "name": "card-alias2", "product_id": "XXXY", "vendor_id": "XXXY" }'
nova_pci_alias: []

.. code-block:: yaml

    - name: Installation and setup of Neutron
      hosts: neutron_all
      user: root
      roles:
        - { role: "os_neutron", tags: [ "os-neutron" ] }
      vars:
        neutron_galera_address: "{{ internal_lb_vip_address }}"