openstack/openstack-helm
Code Issues Proposed changes
6c9b4df6fe
openstack-helm/mistral/values.yaml
Pete Birley 40a45b9751 RabbitMQ: Add vHost management and improve security 
This PS adds vhost management to rabbitmq jobs. It also prevents
sensitive information being displayed in the management job, and
removes the 'administrator' tag from service users.

Change-Id: Id337f763c5e4776bce7269676a8a2dc54dc2e5f8
2018-04-19 08:26:45 -05:00

498 lines
12 KiB
YAML
Raw Blame History

# Copyright 2017 The Openstack-Helm Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# Default values for mistral.
# This is a YAML-formatted file.
# Declare name/value pairs to be passed into your templates.
# name: value
labels:
api:
node_selector_key: openstack-control-plane
node_selector_value: enabled
engine:
node_selector_key: openstack-control-plane
node_selector_value: enabled
event_engine:
node_selector_key: openstack-control-plane
node_selector_value: enabled
executor:
node_selector_key: openstack-control-plane
node_selector_value: enabled
job:
node_selector_key: openstack-control-plane
node_selector_value: enabled
release_group: null
images:
tags:
bootstrap: docker.io/openstackhelm/heat:newton
dep_check: quay.io/stackanetes/kubernetes-entrypoint:v0.3.0
db_init: docker.io/openstackhelm/heat:newton
mistral_db_sync: docker.io/kolla/ubuntu-source-mistral-api:3.0.3
db_drop: docker.io/openstackhelm/heat:newton
rabbit_init: docker.io/rabbitmq:3.7-management
ks_user: docker.io/openstackhelm/heat:newton
ks_service: docker.io/openstackhelm/heat:newton
ks_endpoints: docker.io/openstackhelm/heat:newton
mistral_api: docker.io/kolla/ubuntu-source-mistral-api:3.0.3
mistral_engine: docker.io/kolla/ubuntu-source-mistral-engine:3.0.3
mistral_event_engine: docker.io/kolla/ubuntu-source-mistral-engine:3.0.3
mistral_executor: docker.io/kolla/ubuntu-source-mistral-executor:3.0.3
pull_policy: "IfNotPresent"
network:
api:
ingress:
public: true
classes:
namespace: "nginx"
cluster: "nginx-cluster"
annotations:
nginx.ingress.kubernetes.io/rewrite-target: /
node_port:
enabled: false
port: 28989
bootstrap:
enabled: false
ks_user: mistral
script: |
openstack token issue
dependencies:
static:
api:
jobs:
- mistral-db-sync
- mistral-ks-user
- mistral-ks-endpoints
services:
- endpoint: internal
service: oslo_db
- endpoint: internal
service: identity
db_drop:
services:
- endpoint: internal
service: oslo_db
db_init:
services:
- endpoint: internal
service: oslo_db
db_sync:
jobs:
- mistral-db-init
services:
- endpoint: internal
service: oslo_db
engine:
jobs:
- mistral-db-sync
- mistral-ks-user
- mistral-ks-endpoints
services:
- endpoint: internal
service: oslo_db
- endpoint: internal
service: identity
event_engine:
jobs:
- mistral-db-sync
- mistral-ks-user
- mistral-ks-endpoints
services:
- endpoint: internal
service: oslo_db
- endpoint: internal
service: identity
executor:
jobs:
- mistral-db-sync
- mistral-ks-user
- mistral-ks-endpoints
services:
- endpoint: internal
service: oslo_db
- endpoint: internal
service: identity
ks_endpoints:
jobs:
- mistral-ks-service
services:
- endpoint: internal
service: identity
ks_service:
services:
- endpoint: internal
service: identity
ks_user:
services:
- endpoint: internal
service: identity
rabbit_init:
services:
- service: oslo_messaging
endpoint: internal
# Names of secrets used by bootstrap and environmental checks
secrets:
identity:
admin: mistral-keystone-admin
mistral: mistral-keystone-user
oslo_db:
admin: mistral-db-admin
mistral: mistral-db-user
oslo_messaging:
admin: mistral-rabbitmq-admin
mistral: mistral-rabbitmq-user
# typically overridden by environmental
# values, but should include all endpoints
# required by this chart
endpoints:
cluster_domain_suffix: cluster.local
identity:
name: keystone
auth:
admin:
region_name: RegionOne
username: admin
password: password
project_name: admin
user_domain_name: default
project_domain_name: default
mistral:
role: admin
region_name: RegionOne
username: mistral
password: password
project_name: service
user_domain_name: default
project_domain_name: default
hosts:
default: keystone-api
public: keystone
host_fqdn_override:
default: null
path:
default: /v3
scheme:
default: http
port:
admin:
default: 35357
api:
default: 80
workflow:
name: mistral
hosts:
default: mistral-api
public: mistral
host_fqdn_override:
default: null
path:
default: /v2
scheme:
default: 'http'
port:
api:
default: 8989
public: 80
oslo_db:
auth:
admin:
username: root
password: password
mistral:
username: mistral
password: password
hosts:
default: mariadb
host_fqdn_override:
default: null
path: /mistral
scheme: mysql+pymysql
port:
mysql:
default: 3306
oslo_messaging:
auth:
admin:
username: rabbitmq
password: password
mistral:
username: mistral
password: password
hosts:
default: rabbitmq
host_fqdn_override:
default: null
path: /mistral
scheme: rabbit
port:
amqp:
default: 5672
http:
default: 15672
oslo_cache:
auth:
# NOTE(portdirect): this is used to define the value for keystone
# authtoken cache encryption key, if not set it will be populated
# automatically with a random value, but to take advantage of
# this feature all services should be set to use the same key,
# and memcache service.
memcache_secret_key: null
hosts:
default: memcached
host_fqdn_override:
default: null
port:
memcache:
default: 11211
conf:
policy:
admin_only: is_admin:True
admin_or_owner: is_admin:True or project_id:%(project_id)s
default: rule:admin_or_owner
action_executions:delete: rule:admin_or_owner
action_execution:create: rule:admin_or_owner
action_executions:get: rule:admin_or_owner
action_executions:list: rule:admin_or_owner
action_executions:update: rule:admin_or_owner
actions:create: rule:admin_or_owner
actions:delete: rule:admin_or_owner
actions:get: rule:admin_or_owner
actions:list: rule:admin_or_owner
actions:update: rule:admin_or_owner
cron_triggers:create: rule:admin_or_owner
cron_triggers:delete: rule:admin_or_owner
cron_triggers:get: rule:admin_or_owner
cron_triggers:list: rule:admin_or_owner
environments:create: rule:admin_or_owner
environments:delete: rule:admin_or_owner
environments:get: rule:admin_or_owner
environments:list: rule:admin_or_owner
environments:update: rule:admin_or_owner
executions:create: rule:admin_or_owner
executions:delete: rule:admin_or_owner
executions:get: rule:admin_or_owner
executions:list: rule:admin_or_owner
executions:update: rule:admin_or_owner
members:create: rule:admin_or_owner
members:delete: rule:admin_or_owner
members:get: rule:admin_or_owner
members:list: rule:admin_or_owner
members:update: rule:admin_or_owner
services:list: rule:admin_or_owner
tasks:get: rule:admin_or_owner
tasks:list: rule:admin_or_owner
tasks:update: rule:admin_or_owner
workbooks:create: rule:admin_or_owner
workbooks:delete: rule:admin_or_owner
workbooks:get: rule:admin_or_owner
workbooks:list: rule:admin_or_owner
workbooks:update: rule:admin_or_owner
workflows:create: rule:admin_or_owner
workflows:delete: rule:admin_or_owner
workflows:get: rule:admin_or_owner
workflows:list: rule:admin_or_owner
workflows:update: rule:admin_or_owner
event_triggers:create: rule:admin_or_owner
event_triggers:delete: rule:admin_or_owner
event_triggers:get: rule:admin_or_owner
event_triggers:list: rule:admin_or_owner
event_triggers:update: rule:admin_or_owner
mistral:
DEFAULT:
transport_url: null
api:
# NOTE(portdirect): the bind port should not be defined, and is manipulated
# via the endpoints section.
port: null
api_workers: 8
coordination:
backend_url: null
database:
max_retries: -1
keystone_authtoken:
auth_type: password
auth_version: v3
memcache_security_strategy: ENCRYPT
pod:
user:
mistral:
uid: 1000
affinity:
anti:
type:
default: preferredDuringSchedulingIgnoredDuringExecution
topologyKey:
default: kubernetes.io/hostname
mounts:
mistral_api:
init_container: null
mistral_api:
mistral_executor:
init_container: null
mistral_executor:
mistral_engine:
init_container: null
mistral_engine:
mistral_event_engine:
init_container: null
mistral_event_engine:
mistral_bootstrap:
init_container: null
mistral_bootstrap:
replicas:
api: 1
engine: 1
event_engine: 1
executor: 1
lifecycle:
upgrades:
deployments:
revision_history: 3
pod_replacement_strategy: RollingUpdate
rolling_update:
max_unavailable: 1
max_surge: 3
disruption_budget:
api:
min_available: 0
termination_grace_period:
api:
timeout: 30
resources:
enabled: false
api:
requests:
memory: "128Mi"
cpu: "100m"
limits:
memory: "1024Mi"
cpu: "2000m"
engine:
requests:
memory: "128Mi"
cpu: "100m"
limits:
memory: "1024Mi"
cpu: "2000m"
event_engine:
requests:
memory: "128Mi"
cpu: "100m"
limits:
memory: "1024Mi"
cpu: "2000m"
executor:
requests:
memory: "128Mi"
cpu: "100m"
limits:
memory: "1024Mi"
cpu: "2000m"
jobs:
bootstrap:
requests:
memory: "128Mi"
cpu: "100m"
limits:
memory: "1024Mi"
cpu: "2000m"
db_init:
requests:
memory: "128Mi"
cpu: "100m"
limits:
memory: "1024Mi"
cpu: "2000m"
db_sync:
requests:
memory: "128Mi"
cpu: "100m"
limits:
memory: "1024Mi"
cpu: "2000m"
db_drop:
requests:
memory: "128Mi"
cpu: "100m"
limits:
memory: "1024Mi"
cpu: "2000m"
ks_endpoints:
requests:
memory: "128Mi"
cpu: "100m"
limits:
memory: "1024Mi"
cpu: "2000m"
ks_service:
requests:
memory: "128Mi"
cpu: "100m"
limits:
memory: "1024Mi"
cpu: "2000m"
ks_user:
requests:
memory: "128Mi"
cpu: "100m"
limits:
memory: "1024Mi"
cpu: "2000m"
rabbit_init:
requests:
memory: "128Mi"
cpu: "100m"
limits:
memory: "1024Mi"
cpu: "2000m"
tests:
requests:
memory: "128Mi"
cpu: "100m"
limits:
memory: "1024Mi"
cpu: "2000m"
manifests:
configmap_bin: true
configmap_etc: true
deployment_api: true
deployment_executor: true
ingress_api: true
job_bootstrap: true
job_db_init: true
job_db_sync: true
job_db_drop: false
job_ks_endpoints: true
job_ks_service: true
job_ks_user: true
job_rabbit_init: true
pdb_api: true
secret_db: true
secret_keystone: true
secret_rabbitmq: true
service_ingress_api: true
service_api: true
statefulset_engine: true
statefulset_event_engine: true
View Git Blame Copy Permalink