Chapter 15. Tips for undercloud and overcloud services This section provides advice on tuning and managing specific OpenStack services on the undercloud. 15.1. Tuning deployment performance Red Hat OpenStack Platform (RHOSP) director uses OpenStack Orchestration (heat) to conduct the main deployment and provisioning functions. You can use the --heat-config-vars-file option on the openstack overcloud deploy command to tune the following parameters: debug Run in debug mode. log_file Specify log file path. max_json_body_size Maximum raw byte size of JSON request body. num_engine_workers Set the number of workers. Heat uses a series of workers to execute deployment tasks. To calculate the default number of workers, the director heat configuration halves the total CPU thread count of the undercloud. In this instance, thread count refers to the number of CPU cores multiplied by the hyper-threading value. For example, if your undercloud has a CPU with 16 threads, heat spawns 8 workers by default. The director configuration also uses a minimum and maximum cap by default. The minimum is 4 and the max is 24. rpc_response_timeout Seconds to wait for a response from a call. Example Create a file such as heat-overrides.yaml . Enter parameters as needed: Include the file in an openstack overcloud deploy command: 15.2. Changing the SSL/TLS cipher rules for HAProxy If you enabled SSL/TLS in the undercloud (see Section 4.2, "Undercloud configuration parameters" ), you might want to harden the SSL/TLS ciphers and rules that are used with the HAProxy configuration. This hardening helps to avoid SSL/TLS vulnerabilities, such as the POODLE vulnerability . Set the following hieradata using the hieradata_override undercloud configuration option: tripleo::haproxy::ssl_cipher_suite The cipher suite to use in HAProxy. tripleo::haproxy::ssl_options The SSL/TLS rules to use in HAProxy. For example, you might want to use the following cipher and rules: Cipher: ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS Rules: no-sslv3 no-tls-tickets Create a hieradata override file ( haproxy-hiera-overrides.yaml ) with the following content: Note The cipher collection is one continuous line. Set the hieradata_override parameter in the undercloud.conf file to use the hieradata override file you created before you ran openstack undercloud install :

Commands:
rpc_response_timeout: 1200 num_engine_workers: 24 debug: true
openstack overcloud deploy --heat-config-vars-file heat-overrides.yaml --answers-file templates/answers.yaml
tripleo::haproxy::ssl_cipher_suite: ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS tripleo::haproxy::ssl_options: no-sslv3 no-tls-tickets
[DEFAULT] hieradata_override = haproxy-hiera-overrides.yaml