-
Notifications
You must be signed in to change notification settings - Fork 10
/
nodedict.py
1756 lines (1738 loc) · 60.8 KB
/
nodedict.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
import sys
from env import Env
from core.keywords import KeywordStore
# deprecated => supported
DEPRECATED_KEYWORDS = {
"node.host_mode": "env",
"node.environment": "asset_env",
"node.environnement": "asset_env",
}
# supported => deprecated
REVERSE_DEPRECATED_KEYWORDS = {
"node.asset_env": ["environnement", "environment"],
"node.env": ["host_mode"],
}
DEPRECATED_SECTIONS = {
}
BASE_SECTIONS = [
"node",
"cluster",
"compliance",
"stats",
"checks",
"packages",
"patches",
"asset",
"nsr",
"hds",
"necism",
"eva",
"ibmsvc",
"vioserver",
"brocade",
"disks",
"sym",
"rotate_root_pw",
"listener",
"syslog",
"stats_collection",
"reboot",
"cluster",
]
PRIVATE_KEYWORDS = [
{
"section": "node",
"keyword": "oci",
"text": "The default micro-container driver. If not set, prefer podman if installed, fallback to docker."
},
{
"section": "node",
"keyword": "uuid",
"text": "The auth token provided by the collector on :cmd:`om node register`."
},
{
"section": "node",
"keyword": "prkey",
"default_text": "<autogenerated>",
"text": "The scsi3 persistent reservation key used by the pr resources."
},
{
"section": "node",
"keyword": "connect_to",
"example": "1.2.3.4",
"text": "An asset information to push to the collector on pushasset, overriding the currently discovered value. On GCE instances, defaults to the instance ip address."
},
{
"section": "node",
"keyword": "mem_bytes",
"example": "256mb",
"convert": "size",
"text": "Override for the corresponding pushasset discovery probe."
},
{
"section": "node",
"keyword": "mem_banks",
"example": "4",
"convert": "integer",
"text": "Override for the corresponding pushasset discovery probe."
},
{
"section": "node",
"keyword": "mem_slots",
"example": "4",
"convert": "integer",
"text": "Override for the corresponding pushasset discovery probe."
},
{
"section": "node",
"keyword": "os_vendor",
"example": "Digital",
"text": "Override for the corresponding pushasset discovery probe."
},
{
"section": "node",
"keyword": "os_release",
"example": "5",
"text": "Override for the corresponding pushasset discovery probe."
},
{
"section": "node",
"keyword": "os_kernel",
"example": "5.1234",
"text": "Override for the corresponding pushasset discovery probe."
},
{
"section": "node",
"keyword": "os_arch",
"example": "5.1234",
"text": "Override for the corresponding pushasset discovery probe."
},
{
"section": "node",
"keyword": "cpu_freq",
"example": "3.2 Ghz",
"text": "Override for the corresponding pushasset discovery probe."
},
{
"section": "node",
"keyword": "cpu_threads",
"example": "4",
"convert": "integer",
"text": "Override for the corresponding pushasset discovery probe."
},
{
"section": "node",
"keyword": "cpu_cores",
"example": "2",
"convert": "integer",
"text": "Override for the corresponding pushasset discovery probe."
},
{
"section": "node",
"keyword": "cpu_dies",
"example": "1",
"convert": "integer",
"text": "Override for the corresponding pushasset discovery probe."
},
{
"section": "node",
"keyword": "cpu_model",
"example": "Alpha EV5",
"text": "Override for the corresponding pushasset discovery probe."
},
{
"section": "node",
"keyword": "serial",
"example": "abcdef0123456",
"text": "Override for the corresponding pushasset discovery probe."
},
{
"section": "node",
"keyword": "bios_version",
"example": "1.025",
"text": "Override for the corresponding pushasset discovery probe."
},
{
"section": "node",
"keyword": "sp_version",
"example": "1.026",
"text": "Override for the corresponding pushasset discovery probe."
},
{
"section": "node",
"keyword": "enclosure",
"example": "1",
"text": "Override for the corresponding pushasset discovery probe."
},
{
"section": "node",
"keyword": "tz",
"example": "+0200",
"text": "Override for the corresponding pushasset discovery probe."
},
{
"section": "node",
"keyword": "manufacturer",
"example": "Digital",
"text": "Override for the corresponding pushasset discovery probe."
},
{
"section": "node",
"keyword": "model",
"example": "ds20e",
"text": "Override for the corresponding pushasset discovery probe."
},
{
"section": "centera",
"keyword": "schedule",
"text": "Schedule parameter for the :c-action:`pushcentera` node action. See usr/share/doc/schedule for the schedule syntax."
},
{
"section": "xtremio",
"keyword": "schedule",
"text": "Schedule parameter for the :c-action:`pushxtremio` node action. See usr/share/doc/schedule for the schedule syntax."
},
{
"section": "array",
"rtype": "xtremio",
"keyword": "name",
"example": "array1",
"text": "The name of the array. If not provided, fallback to the section name suffix."
},
{
"section": "hp3par",
"keyword": "schedule",
"text": "Schedule parameter for the :c-action:`pushhp3par` node action. See usr/share/doc/schedule for the schedule syntax."
},
{
"section": "emcvnx",
"keyword": "schedule",
"text": "Schedule parameter for the :c-action:`pushvnx` node action. See usr/share/doc/schedule for the schedule syntax."
},
{
"section": "freenas",
"keyword": "schedule",
"text": "Schedule parameter for the :c-action:`pushfreenas` node action. See usr/share/doc/schedule for the schedule syntax."
},
{
"section": "hcs",
"keyword": "schedule",
"text": "Schedule parameter for the :c-action:`pushhcs` node action. See usr/share/doc/schedule for the schedule syntax."
},
{
"section": "dorado",
"keyword": "schedule",
"text": "Schedule parameter for the :c-action:`pushdorado` node action. See usr/share/doc/schedule for the schedule syntax."
},
{
"section": "gcedisks",
"keyword": "schedule",
"text": "Schedule parameter for the :c-action:`pushgcedisks` node action. See usr/share/doc/schedule for the schedule syntax."
},
{
"section": "sym",
"keyword": "schedule",
"text": "Schedule parameter for the :c-action:`pushsym` node action. See usr/share/doc/schedule for the schedule syntax."
},
{
"section": "nsr",
"keyword": "schedule",
"text": "Schedule parameter for the :c-action:`pushnsr` node action. See usr/share/doc/schedule for the schedule syntax."
},
{
"section": "hds",
"keyword": "schedule",
"text": "Schedule parameter for the :c-action:`pushhds` node action. See usr/share/doc/schedule for the schedule syntax."
},
{
"section": "necism",
"keyword": "schedule",
"text": "Schedule parameter for the :c-action:`pushnecism` node action. See usr/share/doc/schedule for the schedule syntax."
},
{
"section": "eva",
"keyword": "schedule",
"text": "Schedule parameter for the :c-action:`pusheva` node action. See usr/share/doc/schedule for the schedule syntax."
},
{
"section": "ibmds",
"keyword": "schedule",
"text": "Schedule parameter for the :c-action:`pushibmds` node action. See usr/share/doc/schedule for the schedule syntax."
},
{
"section": "ibmsvc",
"keyword": "schedule",
"text": "Schedule parameter for the :c-action:`pushibmsvc` node action. See usr/share/doc/schedule for the schedule syntax."
},
{
"section": "vioserver",
"keyword": "schedule",
"text": "Schedule parameter for the :c-action:`pushvioserver` node action. See usr/share/doc/schedule for the schedule syntax."
},
{
"section": "netapp",
"keyword": "schedule",
"text": "Schedule parameter for the :c-action:`pushnetapp` node action. See usr/share/doc/schedule for the schedule syntax."
},
{
"section": "brocade",
"keyword": "schedule",
"text": "Schedule parameter for the :c-action:`pushbrocade` node action. See usr/share/doc/schedule for the schedule syntax."
},
]
KEYWORDS = [
{
"section": "node",
"keyword": "secure_fetch",
"default": True,
"convert": "boolean",
"text": "If set to false, disable ssl authentication checks on all uri fetches."
},
{
"section": "node",
"keyword": "min_avail_mem",
"default": "2%",
"convert": "size",
"text": "The minimum required available memory to allow orchestration."
},
{
"section": "node",
"keyword": "min_avail_swap",
"default": "10%",
"convert": "size",
"text": "The minimum required available swap to allow orchestration."
},
{
"section": "node",
"keyword": "env",
"default": "TST",
"candidates": Env.allowed_svc_envs,
"text": "A non-PRD service can not be brought up on a PRD node, but a PRD service can be startup on a non-PRD node (in a DRP situation)."
},
{
"section": "node",
"keyword": "max_parallel",
"default": 10,
"convert": "integer",
"text": "Allow a maximum of :kw:`max_parallel` subprocesses to run simultaneously on :cmd:`om <selector> --parallel <action>` commands."
},
{
"section": "node",
"keyword": "allowed_networks",
"default": ["10.0.0.0/8", "172.16.0.0/24", "192.168.0.0/16"],
"default_text": "10.0.0.0/8 172.16.0.0/24 192.168.0.0/16",
"convert": "list",
"text": "The list of cidr blocks the agents allows creation of backend network into. Should be restricted to match your site constraints."
},
{
"section": "node",
"keyword": "loc_country",
"example": "fr",
"text": "An asset information to push to the collector on pushasset, overriding the currently stored value."
},
{
"section": "node",
"keyword": "loc_city",
"example": "Paris",
"text": "An asset information to push to the collector on pushasset, overriding the currently stored value."
},
{
"section": "node",
"keyword": "loc_zip",
"example": "75017",
"text": "An asset information to push to the collector on pushasset, overriding the currently stored value."
},
{
"section": "node",
"keyword": "loc_addr",
"example": "7 rue blanche",
"text": "An asset information to push to the collector on pushasset, overriding the currently stored value."
},
{
"section": "node",
"keyword": "loc_building",
"example": "Crystal",
"text": "An asset information to push to the collector on pushasset, overriding the currently stored value."
},
{
"section": "node",
"keyword": "loc_floor",
"example": "21",
"text": "An asset information to push to the collector on pushasset, overriding the currently stored value."
},
{
"section": "node",
"keyword": "loc_room",
"example": "102",
"text": "An asset information to push to the collector on pushasset, overriding the currently stored value."
},
{
"section": "node",
"keyword": "loc_rack",
"example": "R42",
"text": "An asset information to push to the collector on pushasset, overriding the currently stored value."
},
{
"section": "node",
"keyword": "sec_zone",
"example": "dmz1",
"text": "An asset information to push to the collector on pushasset, overriding the currently stored value."
},
{
"section": "node",
"keyword": "team_integ",
"example": "TINT",
"text": "An asset information to push to the collector on pushasset, overriding the currently stored value."
},
{
"section": "node",
"keyword": "team_support",
"example": "TSUP",
"text": "An asset information to push to the collector on pushasset, overriding the currently stored value."
},
{
"section": "node",
"keyword": "asset_env",
"example": "Production",
"text": "An asset information to push to the collector on pushasset, overriding the currently stored value."
},
{
"section": "node",
"keyword": "dbopensvc",
"example": "https://collector.opensvc.com",
"text": "Set the uri of the collector main xmlrpc server. The path part of the uri can be left unspecified. If not set, the agent does not try to communicate with a collector."
},
{
"section": "node",
"keyword": "dbcompliance",
"example": "https://collector.opensvc.com/init/compliance/call/xmlrpc",
"default_text": "Same protocol, server and port as dbopensvc, but with an different path.",
"text": "Set the uri of the collector's main xmlrpc server. The path part of the uri can be left unspecified."
},
{
"section": "node",
"keyword": "dblog",
"convert": "boolean",
"default": True,
"text": "If true and dbopensvc is set, the objects action logs are reported to the collector. Set to false to disable log reporting to the collector, event if dbopensvc is set."
},
{
"section": "node",
"keyword": "branch",
"example": "1.9",
"text": "Set the targeted opensvc agent branch. The downloaded upgrades will honor that branch. If not set, the :kw:`repopkg` imposes the target branch, which is not recommended with a public repopkg."
},
{
"section": "node",
"keyword": "pkg_format",
"example": "tar",
"candidates": ["tar", "auto"],
"default": "auto",
"text": "Force usage of a package format. Only the tar format can be forced."
},
{
"section": "node",
"keyword": "repo",
"example": "http://opensvc.repo.corp",
"text": """Set the uri of the opensvc agent package repository and compliance modules gzipped tarball repository. This parameter is used by the :cmd:`om node updatepkg` and :cmd:`om node updatecomp` commands.
Expected repository structure::
ROOT
+- compliance
+- compliance-100.tar.gz
+- compliance-101.tar.gz
+- current -> compliance-101.tar.gz
+- packages
+- deb
+- depot
+- pkg
+- sunos-pkg
+- rpms
+- current -> 2.0/current
+- 1.9
+- current -> opensvc-1.9-50.rpm
+- opensvc-1.9-49.rpm
+- opensvc-1.9-50.rpm
+- 2.0
+- current -> opensvc-2.0-90.rpm
+- opensvc-2.0-90.rpm
+- tbz
"""
},
{
"section": "node",
"keyword": "repopkg",
"example": "http://repo.opensvc.com",
"text": """Set the uri of the opensvc agent package repository. This parameter is used by the :cmd:`om node updatepkg` command.
Expected repository structure::
ROOT
+- deb
+- depot
+- pkg
+- sunos-pkg
+- rpms
+- current -> 2.0/current
+- 1.9
+- current -> opensvc-1.9-50.rpm
+- opensvc-1.9-49.rpm
+- opensvc-1.9-50.rpm
+- 2.0
+- current -> opensvc-2.0-90.rpm
+- opensvc-2.0-90.rpm
+- tbz
"""
},
{
"section": "node",
"keyword": "repocomp",
"example": "http://compliance.repo.corp",
"text": """Set the uri of the opensvc compliance modules gzipped tarball repository. This parameter is used by the :cmd:`om node updatecomp` command.
Expected repository structure::
ROOT
+- compliance-100.tar.gz
+- compliance-101.tar.gz
+- current -> compliance-101.tar.gz
"""
},
{
"section": "node",
"keyword": "ruser",
"default": "root",
"example": "root opensvc@node1",
"text": """Set the remote user to use to login to a remote node with ssh and rsync. The remote user must have the privileges to run as root the following commands on the remote node:
* om
* rsync
The default ruser is root for all nodes. ruser accepts a list of user[@node] ... If @node is ommited, user is considered the new default user.
"""
},
{
"section": "node",
"keyword": "maintenance_grace_period",
"convert": "duration",
"default": 60,
"text": "A duration expression, like ``1m30s``, defining how long the daemon retains a"
" remote in-maintenance (daemon restart or upgrade) node data."
" The maintenance state is announced to peers on daemon stop and daemon restart."
" The upgrade state is announced to peers on daemon stop for upgrade."
" The maintenance grace period does not apply to shutdown state."
" As long as the remote node data are retained, the local daemon won't try to takeover"
" its running instances."
" This parameter should be adjusted to span the daemon restart time."
},
{
"section": "node",
"keyword": "rejoin_grace_period",
"convert": "duration",
"default": 90,
"text": "A duration expression, like ``90m``, defining how long the daemon restrains from taking start decisions if no heartbeat has been received from a peer since daemon startup. This should be adjusted to the maximum delay you can afford to give a chance to services to start on their placement leader after a simultaneous node reboot."
},
{
"section": "node",
"keyword": "ready_period",
"convert": "duration",
"default": 5,
"text": "A duration expression, like ``10s``, defining how long the daemon monitor waits before starting a service instance in ``ready`` state. A peer node can preempt the start during this period. Usually set to allow at least a couple of heartbeats to be received."
},
{
"section": "dequeue_actions",
"keyword": "schedule",
"text": "Schedule parameter for the :c-action:`dequeue actions` node action. See usr/share/doc/schedule for the schedule syntax."
},
{
"section": "sysreport",
"keyword": "schedule",
"default": "~00:00-06:00",
"text": "Schedule parameter for the :c-action:`sysreport` node action, which check all modules and fix only modules flagged ``autofix``. See usr/share/doc/schedule for the schedule syntax."
},
{
"section": "compliance",
"keyword": "schedule",
"default": "~02:00-06:00",
"text": "Schedule parameter for the :c-action:`compliance auto` node action, which check all modules and fix only modules flagged ``autofix``. See usr/share/doc/schedule for the schedule syntax."
},
{
"section": "compliance",
"keyword": "auto_update",
"convert": "boolean",
"default": False,
"text": "If set to ``true``, and if the execution context indicates a scheduled run, execute :cmd:`om node updatecomp` upon :cmd:`om node compliance check`. This toggle helps keep the compliance modules in sync with the reference repository. Beware of the security impact of this setting: you must be careful your module repository is kept secure."
},
{
"section": "stats",
"keyword": "schedule",
"default": "~00:00-06:00",
"text": "Schedule parameter for the :c-action:`pushstats` node action. See usr/share/doc/schedule for the schedule syntax."
},
{
"section": "stats",
"keyword": "disable",
"convert": "list",
"example": "blockdev, mem_u",
"text": "Disable push for a stats group (mem_u, cpu, proc, swap, netdev, netdev_err, block, blockdev, fs_u)."
},
{
"section": "checks",
"keyword": "schedule",
"default": "~00:00-06:00",
"text": "Schedule parameter for the :c-action:`pushchecks` node action. See usr/share/doc/schedule for the schedule syntax."
},
{
"section": "packages",
"keyword": "schedule",
"default": "~00:00-06:00",
"text": "Schedule parameter for the :c-action:`pushpkg` node action. See usr/share/doc/schedule for the schedule syntax."
},
{
"section": "patches",
"keyword": "schedule",
"default": "~00:00-06:00",
"text": "Schedule parameter for the :c-action:`pushpatch` node action. See usr/share/doc/schedule for the schedule syntax."
},
{
"section": "asset",
"keyword": "schedule",
"default": "~00:00-06:00",
"text": "Schedule parameter for the :c-action:`pushasset` node action. See usr/share/doc/schedule for the schedule syntax."
},
{
"section": "disks",
"keyword": "schedule",
"default": "~00:00-06:00",
"text": "Schedule parameter for the :c-action:`pushdisks` node action. See usr/share/doc/schedule for the schedule syntax."
},
{
"section": "rotate_root_pw",
"keyword": "schedule",
"text": "Schedule parameter for the :c-action:`rotate root pw` node action. See usr/share/doc/schedule for the schedule syntax."
},
{
"section": "stats_collection",
"keyword": "schedule",
"default": "@10",
"text": "Schedule parameter for the :c-action:`collect stats` node action. See usr/share/doc/schedule for the schedule syntax."
},
{
"section": "reboot",
"keyword": "schedule",
"text": "Schedule parameter for the :c-action:`auto reboot node` action. See usr/share/doc/schedule for the schedule syntax."
},
{
"section": "reboot",
"keyword": "once",
"convert": "boolean",
"default": True,
"text": """If once is set to ``false``, do not remove the reboot flag before rebooting,
so that the node is ready to reboot again in the next allowed timerange.
This setup is needed to enforce a periodic reboot, with a patching script
hooked as a pre trigger for example.
If not set, or set to ``true``, the reboot flag is removed before reboot, and a :cmd:`om node schedule reboot` is needed to rearm.
"""
},
{
"section": "reboot",
"keyword": "pre",
"example": "yum upgrade -y",
"text": "A command to execute before reboot. Errors are ignored."
},
{
"section": "reboot",
"keyword": "blocking_pre",
"example": "yum upgrade -y",
"text": "A command to execute before reboot. Abort the reboot on error."
},
{
"section": "listener",
"keyword": "crl",
"example": "https://crl.opensvc.com",
"default": Env.paths.crl,
"text": "The url serving the certificate revocation list. The default points to the path of the cluster ca crl in ``{var}/certs/ca_crl``."
},
{
"section": "listener",
"keyword": "tls_addr",
"default": "",
"example": "1.2.3.4",
"text": "The ip addr the daemon tls listener must listen on. The empty value used as default means: all ip4 and ip6."
},
{
"section": "listener",
"keyword": "tls_port",
"convert": "integer",
"default": 1215,
"text": """The port the daemon tls listener must listen on."""
},
{
"section": "listener",
"keyword": "addr",
"default": "",
"example": "1.2.3.4",
"text": "The ip addr the daemon raw listener must listen on. The empty value used as default means: all ip4 and ip6."
},
{
"section": "listener",
"keyword": "port",
"convert": "integer",
"default": 1214,
"text": """The port the daemon raw listener must listen on. In pull action mode, the collector sends a tcp packet to the server to notify there are actions to unqueue. The opensvc daemon executes the :c-action:`dequeue actions` node action upon receive. The :kw:`listener.port` parameter is sent to the collector upon :c-action:`pushasset`. The collector uses this port to notify the node."""
},
{
"section": "listener",
"keyword": "openid_well_known",
"example": "https://keycloak.opensvc.com/auth/realms/clusters/.well-known/openid-configuration",
"text": "The url serving the well-known configuration of an openid provider. If set, the h2 listener will try to validate the Bearer token provided in the requests. If valid the user name is fetched from the 'preferred_username' claim (fallback on 'name'), and the user grants are fetched from the 'grant' claim. Grant can be a list, in which case a proper grant value is formatted via concatenation of the list elements."
},
{
"section": "listener",
"keyword": "ui",
"convert": "boolean",
"default": True,
"text": "Serve the ui webapp to browsers getting the api / path.",
},
{
"section": "syslog",
"keyword": "facility",
"default": "daemon",
"text": """The syslog facility to log to."""
},
{
"section": "syslog",
"keyword": "level",
"default": "info",
"candidates": ["critical", "error", "warning", "info", "debug"],
"text": "The minimum message criticity to feed to syslog. Setting to critical actually disables the syslog logging, as the agent does not emit message at this level."
},
{
"section": "syslog",
"keyword": "host",
"default_text": "localhost if port is set",
"text": "The syslog host to send logs to. If neither host nor port are specified and if /dev/log exists, the messages are posted to /dev/log."
},
{
"section": "syslog",
"keyword": "port",
"default": 514,
"text": "The syslog host to send logs to. If neither host nor port are specified and if /dev/log exists, the messages are posted to /dev/log."
},
{
"section": "cluster",
"keyword": "vip",
"example": "192.168.99.12/24@eth0",
"at": True,
"text": "The cluster virtual ip. If configured, the daemon creates a ``system/svc/vip`` failover service to manage this ip."
},
{
"section": "cluster",
"keyword": "default_mon_format",
"candidates": ["compact", "matrix"],
"example": "compact",
"at": True,
"text": "The renderer to use with monitor commands, if not explicitely set by the --format option. The compact renderer is optimized for large clusters."
},
{
"section": "cluster",
"keyword": "dns",
"convert": "list",
"default": [],
"default_text": "",
"at": True,
"text": "The list of nodes to set as dns in the containers resolvers. If set, the search will also be set to :c-dns-domain:`<name>.<namespace>.svc.<clustername>`, :c-dns-domain:`<namespace>.svc.<clustername>` and :c-dns-domain:`<clustername>`."
},
{
"section": "cluster",
"keyword": "ca",
"convert": "list",
"default_text": "system/sec/ca-<clustername>",
"text": "A whitespace-separated list of paths of the secrets hosting the ca certificates that the listener use to validate clients certificates."
},
{
"section": "cluster",
"keyword": "cert",
"default_text": "system/sec/cert-<clustername>",
"text": "The path of the secret hosting the certificate that the listener use for its tls socket."
},
{
"section": "cluster",
"keyword": "id",
"at": True,
"default_text": "<auto-generated>",
"text": "This information is fetched from the join command payload received from the joined node."
},
{
"section": "cluster",
"keyword": "name",
"at": True,
"default": "default",
"text": "The cluster name is used as the zone name in the cluster dns records, in the {fqdn} configuration reference, in the aes secret encryption metadata, in the default name of the secret storing the listener certificate authority (system/sec/ca-<clustername>), in the default name of the secret storing the listener certificate and private key (system/sec/cert-<clustername>). The cluster name should be unique site-wide and be set right before populating secrets. It is always lowercased, so better to set it to a lowercase value to avoid confusion. This information is fetched from the join command payload received from the joined node."
},
{
"section": "cluster",
"keyword": "secret",
"at": True,
"default_text": "<random autogenerated on first use>",
"text": "The cluster shared secret. Used to encrypt/decrypt data with AES256. This secret is either autogenerated or fetched from a join command."
},
{
"section": "cluster",
"keyword": "nodes",
"convert": "list",
"text": "This list is fetched from the join command payload received from the joined node. The service configuration ``{clusternodes}`` is resolved to this keyword value."
},
{
"section": "cluster",
"keyword": "drpnodes",
"convert": "list",
"text": "This list is fetched from the join command payload received from the joined node. The service configuration ``{clusterdrpnodes}`` is resolved to this keyword value."
},
{
"section": "cluster",
"keyword": "quorum",
"convert": "boolean",
"default": False,
"text": "Should a split segment of the cluster commit suicide. Default is False. If set to ``true``, please set at least 2 arbitrators so you can rolling upgrade the opensvc daemons."
},
{
"section": "node",
"keyword": "split_action",
"candidates": ["crash", "reboot"],
"default": "crash",
"text": "Commit suicide method when cluster split occur."
" Default is crash."
" reboot method may be used instead of crash when it is not"
" simple to poweron node after crash."
},
{
"section": "arbitrator",
"keyword": "name",
"required": True,
"text": """The arbitrator resolvable node name.
An arbitrator is a opensvc node (running the usual osvc daemon) this
cluster nodes can ask for a vote when the cluster is split.
Arbitrators are tried in sequence, the first reachable arbitrator
gives a vote. In case of a real split, all arbitrators are expected to
be unreachable from the lost segment. At least one of them is
expected to be reachable from the surviving segment.
Arbitrators of a cluster must thus be located close enough to each
other, so a subset of arbitrators can't be reachable from a split
cluster segment, while another subset of arbitrators is reachable
from the other split cluster segment. But not close enough so they can
all fail together. Usually, this can be interpreted as: same site,
not same rack and power lines.
Arbitrators usually don't run services, even though they could, as their
secret might be known by multiple clusters of different responsibles.
Arbitrators can be tested using :cmd:`om node ping --node <arbitrator name>`.
"""
},
{
"section": "arbitrator",
"keyword": "secret",
"required": True,
"text": "The secret to use to encrypt/decrypt data exchanged with the arbitrator (AES256)."
},
{
"section": "arbitrator",
"keyword": "timeout",
"convert": "duration",
"at": True,
"default": 5,
"text": "The maximum time to wait for the arbitrator vote during a quorum election. "
"Upon expiration, the vote is considered lost for the querying node."
},
{
"section": "stonith",
"keyword": "cmd",
"at": True,
"convert": "shlex",
"required": True,
"example": "/bin/true",
"text": "The command to use to STONITH a peer. Usually comes from a fencing utilities collection. The section rindex is the name of the node to stonith, so one section per node must be added."
},
{
"section": "hb",
"keyword": "type",
"candidates": ["unicast", "multicast", "disk", "relay"],
"required": True,
"text": "The heartbeat driver name."
},
{
"section": "hb",
"keyword": "addr",
"rtype": "unicast",
"at": True,
"example": "1.2.3.4",
"default_text": "0.0.0.0 for listening and to the resolved nodename for sending.",
"text": "The ip address of each node."
},
{
"section": "hb",
"keyword": "intf",
"rtype": "unicast",
"at": True,
"default_text": "The natural interface for <addr>",
"example": "eth0",
"text": "The interface to bind."
},
{
"section": "hb",
"keyword": "port",
"rtype": "unicast",
"convert": "integer",
"at": True,
"default": 10000,
"text": "The port for each node to send to or listen on."
},
{
"section": "hb",
"keyword": "timeout",
"convert": "duration",
"at": True,
"default": 15,
"text": "The delay since the last received heartbeat from a node before considering this node is gone."
},
{
"section": "hb",
"keyword": "interval",
"convert": "duration",
"at": True,
"default": 5,
"text": "The interval between tx threads data sends."
},
{
"section": "hb",
"keyword": "addr",
"rtype": "multicast",
"at": True,
"default": "224.3.29.71",
"text": "The multicast address to send to and listen on."
},
{
"section": "hb",
"keyword": "intf",
"rtype": "multicast",
"at": True,
"default_text": "The natural interface for <addr>",
"example": "eth0",
"text": "The interface to bind."
},
{
"section": "hb",
"keyword": "port",
"rtype": "multicast",
"convert": "integer",
"at": True,
"default": 10000,
"text": "The port for each node to send to or listen on."
},
{
"section": "hb",
"keyword": "nodes",
"at": True,
"convert": "list",
"default_text": "All nodes.",
"text": "The nodes participating to the heartbeat.",
},
{
"section": "hb",
"keyword": "dev",
"rtype": "disk",
"at": True,
"required": True,
"text": "The device to write the hearbeats to and read from. It must be dedicated to the daemon use. Its size should be 1M + 1M per cluster node."
},
{
"section": "hb",
"keyword": "relay",
"rtype": "relay",
"required": True,
"example": "relaynode1",
"text": "The relay resolvable node name."
},
{
"section": "hb",
"keyword": "secret",
"rtype": "relay",
"required": True,
"example": "123123123124325543565",
"text": "The secret to use to encrypt/decrypt data exchanged with the relay (AES256)."
},
{
"section": "cni",
"keyword": "plugins",
"default": "/opt/cni/bin",
"text": "The directory hosting the CNI plugins.",
"example": "/var/lib/opensvc/cni/bin"
},
{
"section": "cni",
"keyword": "config",
"default": "/opt/cni/net.d",
"text": "The directory hosting the CNI network configuration files.",
"example": "/var/lib/opensvc/cni/net.d"
},
{
"section": "pool",
"keyword": "type",
"default": "directory",
"candidates": ["directory", "loop", "vg", "zpool", "freenas", "share", "shm", "symmetrix", "virtual", "dorado", "hcs", "drbd", "pure"],
"text": "The pool type."
},
{
"section": "pool",
"keyword": "status_schedule",
"text": "The value to set to the status_schedule keyword of the volume objects allocated from the pool. See usr/share/doc/schedule for the schedule syntax."
},
{
"section": "pool",
"keyword": "mnt_opt",
"at": True,