diff --git a/ansible/roles/neutron/defaults/main.yml b/ansible/roles/neutron/defaults/main.yml index 4418b6698e97c45b20733d1989a4fc77ab4ea96b..5e946bd5f5a90c9b6d830cd6501ddac19b97bed9 100644 --- a/ansible/roles/neutron/defaults/main.yml +++ b/ansible/roles/neutron/defaults/main.yml @@ -242,6 +242,8 @@ neutron_logging_debug: "{{ openstack_logging_debug }}" openstack_neutron_auth: "{{ openstack_auth }}" +neutron_l3_agent_host_rp_filter_mode: 0 + #################### # Extension drivers #################### diff --git a/ansible/roles/neutron/tasks/config.yml b/ansible/roles/neutron/tasks/config.yml index 983a55ed9046fcf0a33cf897c53f2d3819102c32..f5b31535524871bb952a9ca31092cdbc28991aa5 100644 --- a/ansible/roles/neutron/tasks/config.yml +++ b/ansible/roles/neutron/tasks/config.yml @@ -6,8 +6,8 @@ sysctl: name={{ item.name }} value={{ item.value }} sysctl_set=yes with_items: - { name: "net.ipv4.ip_forward", value: 1} - - { name: "net.ipv4.conf.all.rp_filter", value: 0} - - { name: "net.ipv4.conf.default.rp_filter", value: 0} + - { name: "net.ipv4.conf.all.rp_filter", value: "{{ neutron_l3_agent_host_rp_filter_mode }}"} + - { name: "net.ipv4.conf.default.rp_filter", value: "{{ neutron_l3_agent_host_rp_filter_mode }}"} when: - set_sysctl | bool - (neutron_l3_agent.enabled | bool and neutron_l3_agent.host_in_groups | bool) diff --git a/ansible/roles/nova/defaults/main.yml b/ansible/roles/nova/defaults/main.yml index 689c1bef8a70169671049bf05db1a8aa1291905a..dffa7f4d85906910c0f00f067701487c29f98356 100644 --- a/ansible/roles/nova/defaults/main.yml +++ b/ansible/roles/nova/defaults/main.yml @@ -277,6 +277,7 @@ nova_logging_debug: "{{ openstack_logging_debug }}" openstack_nova_auth: "{{ openstack_auth }}" openstack_placement_auth: "{{ openstack_auth }}" +nova_compute_host_rp_filter_mode: 0 nova_libvirt_port: "16509" nova_ssh_port: "8022" diff --git a/ansible/roles/nova/tasks/config.yml b/ansible/roles/nova/tasks/config.yml index d3199e7f7c83136b73dfbe326d68fa4734d0fcd2..3b87f0af87724b112cf19f3aafda77e93e90901b 100644 --- a/ansible/roles/nova/tasks/config.yml +++ b/ansible/roles/nova/tasks/config.yml @@ -5,8 +5,8 @@ with_items: - { name: "net.bridge.bridge-nf-call-iptables", value: 1} - { name: "net.bridge.bridge-nf-call-ip6tables", value: 1} - - { name: "net.ipv4.conf.all.rp_filter", value: 0} - - { name: "net.ipv4.conf.default.rp_filter", value: 0} + - { name: "net.ipv4.conf.all.rp_filter", value: "{{ nova_compute_host_rp_filter_mode }}"} + - { name: "net.ipv4.conf.default.rp_filter", value: "{{ nova_compute_host_rp_filter mode }}"} when: - set_sysctl | bool - inventory_hostname in groups['compute']