apiVersion: v1
data:
  policy.yaml: |
    "create_port:binding:profile": "rule:admin_or_network_owner"
    "get_port:binding:profile": "rule:admin_or_network_owner"
    "update_port:binding:profile": "rule:admin_or_network_owner"
    "create_network:provider:network_type": "rule:regular_user"
    "get_network:provider:network_type": "rule:regular_user"
    "update_network:provider:network_type": "rule:regular_user"
    "create_network:provider:physical_network": "rule:regular_user"
    "get_network:provider:physical_network": "rule:regular_user"
    "update_network:provider:physical_network": "rule:regular_user"
    "create_network:provider:segmentation_id": "rule:regular_user"
    "get_network:provider:segmentation_id": "rule:regular_user"
    "update_network:provider:segmentation_id": "rule:regular_user"
kind: ConfigMap
metadata:
  name: neutron-policy
  namespace: openstack
---
apiVersion: v1
data:
  AdminPassword: MTIzNDU2Nzg=
  AodhDatabasePassword: MTIzNDU2Nzg=
  AodhPassword: MTIzNDU2Nzg=
  BarbicanDatabasePassword: MTIzNDU2Nzg=
  BarbicanPassword: MTIzNDU2Nzg=
  BarbicanSimpleCryptoKEK: c0VGbWRGakRVcVJNMlZlbVlzbFY1eUdOV2pva2lvSlhzZzhOcmxjM2RyVT0=
  CeilometerPassword: MTIzNDU2Nzg=
  CinderDatabasePassword: MTIzNDU2Nzg=
  CinderPassword: MTIzNDU2Nzg=
  CloudKittyPassword: MTIzNDU2Nzg=
  DatabasePassword: MTIzNDU2Nzg=
  DbRootPassword: MTIzNDU2Nzg=
  DesignateDatabasePassword: MTIzNDU2Nzg=
  DesignatePassword: MTIzNDU2Nzg=
  GlanceDatabasePassword: MTIzNDU2Nzg=
  GlancePassword: MTIzNDU2Nzg=
  HeatAuthEncryptionKey: NzY3YzNlZDA1NmNiYWEzYjlkZmVkYjhjNmY4MjViZjA=
  HeatDatabasePassword: MTIzNDU2Nzg=
  HeatPassword: MTIzNDU2Nzg=
  IronicDatabasePassword: MTIzNDU2Nzg=
  IronicInspectorDatabasePassword: MTIzNDU2Nzg=
  IronicInspectorPassword: MTIzNDU2Nzg=
  IronicPassword: MTIzNDU2Nzg=
  KeystoneDatabasePassword: MTIzNDU2Nzg=
  ManilaDatabasePassword: MTIzNDU2Nzg=
  ManilaPassword: MTIzNDU2Nzg=
  MetadataSecret: MTIzNDU2Nzg0Mg==
  NeutronDatabasePassword: MTIzNDU2Nzg=
  NeutronPassword: MTIzNDU2Nzg=
  NovaAPIDatabasePassword: MTIzNDU2Nzg=
  NovaCell0DatabasePassword: MTIzNDU2Nzg=
  NovaCell1DatabasePassword: MTIzNDU2Nzg=
  NovaPassword: MTIzNDU2Nzg=
  OctaviaDatabasePassword: MTIzNDU2Nzg=
  OctaviaHeartbeatKey: MTIzNDU2Nzg=
  OctaviaPassword: MTIzNDU2Nzg=
  PlacementDatabasePassword: MTIzNDU2Nzg=
  PlacementPassword: MTIzNDU2Nzg=
  SwiftPassword: MTIzNDU2Nzg=
  WatcherPassword: MTIzNDU2Nzg=
kind: Secret
metadata:
  name: osp-secret
  namespace: openstack
type: Opaque
---
apiVersion: core.openstack.org/v1beta1
kind: OpenStackControlPlane
metadata:
  name: controlplane
  namespace: openstack
spec:
  barbican:
    apiOverride:
      route: {}
    template:
      barbicanAPI:
        override:
          service:
            internal:
              metadata:
                annotations:
                  metallb.universe.tf/address-pool: internalapi
                  metallb.universe.tf/allow-shared-ip: internalapi
                  metallb.universe.tf/loadBalancerIPs: 172.17.0.80
              spec:
                type: LoadBalancer
        replicas: 3
      barbicanKeystoneListener:
        replicas: 1
      barbicanWorker:
        replicas: 3
      databaseInstance: openstack
      preserveJobs: false
      secret: osp-secret
  cinder:
    apiOverride:
      route: {}
    template:
      apiTimeout: 600
      cinderAPI:
        override:
          service:
            internal:
              metadata:
                annotations:
                  metallb.universe.tf/address-pool: internalapi
                  metallb.universe.tf/allow-shared-ip: internalapi
                  metallb.universe.tf/loadBalancerIPs: 172.17.0.80
              spec:
                type: LoadBalancer
        replicas: 3
      cinderBackup:
        networkAttachments:
        - storage
        replicas: 0
      cinderScheduler:
        replicas: 1
      cinderVolumes: {}
      customServiceConfig: |
        # Debug logs by default, jobs can override as needed.
        [DEFAULT]
        debug = true
      databaseInstance: openstack
      preserveJobs: false
      secret: osp-secret
    uniquePodNames: true
  designate:
    enabled: false
    template:
      customServiceConfig: |
        [DEFAULT]
        debug = true
      designateAPI:
        override:
          service:
            internal:
              metadata:
                annotations:
                  metallb.universe.tf/address-pool: internalapi
                  metallb.universe.tf/allow-shared-ip: internalapi
                  metallb.universe.tf/loadBalancerIPs: 172.17.0.80
        replicas: 3
      designateBackendbind9:
        networkAttachments:
        - designate
        replicas: 3
        storageClass: local-storage
        storageRequest: 10Gi
      designateCentral:
        replicas: 1
      designateMdns:
        networkAttachments:
        - designate
        replicas: 3
      designateProducer:
        networkAttachments:
        - designate
        replicas: 2
      designateUnbound:
        networkAttachments:
        - designate
        replicas: 1
      designateWorker:
        networkAttachments:
        - designate
        replicas: 3
      nsRecords:
      - hostname: ns1.example.org.
        priority: 1
      - hostname: ns2.example.org.
        priority: 2
      preserveJobs: false
  dns:
    template:
      options:
      - key: server
        values:
        - 192.168.122.1
      override:
        service:
          metadata:
            annotations:
              metallb.universe.tf/address-pool: ctlplane
              metallb.universe.tf/allow-shared-ip: ctlplane
              metallb.universe.tf/loadBalancerIPs: 192.168.122.80
          spec:
            type: LoadBalancer
      replicas: 2
  extraMounts:
  - extraVol:
    - extraVolType: Policy
      mounts:
      - mountPath: /etc/neutron/policy.d
        name: neutron-policy
        readOnly: true
      propagation:
      - NeutronAPI
      volumes:
      - configMap:
          name: neutron-policy
        name: neutron-policy
    name: v1
    region: r1
  galera:
    enabled: true
    templates:
      openstack:
        replicas: 3
        secret: osp-secret
        storageRequest: 5Gi
      openstack-cell1:
        replicas: 3
        secret: osp-secret
        storageRequest: 5Gi
  glance:
    apiOverrides:
      default:
        route: {}
    template:
      customServiceConfig: |
        [DEFAULT]
        enabled_backends = default_backend:swift
        [glance_store]
        default_backend = default_backend
        [default_backend]
        swift_store_create_container_on_put = True
        swift_store_auth_version = 3
        swift_store_auth_address = {{ .KeystoneInternalURL }}
        swift_store_endpoint_type = internalURL
        swift_store_user = service:glance
        swift_store_key = {{ .ServicePassword }}
      databaseInstance: openstack
      glanceAPIs:
        default:
          apiTimeout: 600
          networkAttachments:
          - storage
          override:
            service:
              internal:
                metadata:
                  annotations:
                    metallb.universe.tf/address-pool: internalapi
                    metallb.universe.tf/allow-shared-ip: internalapi
                    metallb.universe.tf/loadBalancerIPs: 172.17.0.80
                spec:
                  type: LoadBalancer
          replicas: 1
      preserveJobs: false
      storage:
        storageClass: local-storage
        storageRequest: 10Gi
    uniquePodNames: true
  heat:
    apiOverride:
      route: {}
    cnfAPIOverride:
      route: {}
    enabled: false
    template:
      databaseInstance: openstack
      heatAPI:
        override:
          service:
            internal:
              metadata:
                annotations:
                  metallb.universe.tf/address-pool: internalapi
                  metallb.universe.tf/allow-shared-ip: internalapi
                  metallb.universe.tf/loadBalancerIPs: 172.17.0.80
              spec:
                type: LoadBalancer
        replicas: 1
      heatEngine:
        replicas: 1
      preserveJobs: false
      secret: osp-secret
  horizon:
    apiOverride:
      route: {}
    enabled: true
    template:
      preserveJobs: false
      replicas: 1
      secret: osp-secret
  ironic:
    enabled: false
    template:
      databaseInstance: openstack
      ironicAPI:
        replicas: 1
      ironicConductors:
      - replicas: 1
        storageRequest: 10Gi
      ironicInspector:
        preserveJobs: false
        replicas: 1
      ironicNeutronAgent:
        replicas: 1
      preserveJobs: false
      secret: osp-secret
  keystone:
    apiOverride:
      route: {}
    template:
      databaseInstance: openstack
      override:
        service:
          internal:
            metadata:
              annotations:
                metallb.universe.tf/address-pool: internalapi
                metallb.universe.tf/allow-shared-ip: internalapi
                metallb.universe.tf/loadBalancerIPs: 172.17.0.80
            spec:
              type: LoadBalancer
      preserveJobs: false
      replicas: 3
      secret: osp-secret
  manila:
    apiOverride:
      route:
        haproxy.router.openshift.io/timeout: 60s
    enabled: false
    template:
      databaseInstance: openstack
      manilaAPI:
        networkAttachments:
        - internalapi
        override:
          service:
            internal:
              metadata:
                annotations:
                  metallb.universe.tf/address-pool: internalapi
                  metallb.universe.tf/allow-shared-ip: internalapi
                  metallb.universe.tf/loadBalancerIPs: 172.17.0.80
              spec:
                type: LoadBalancer
        replicas: 1
      manilaScheduler:
        replicas: 1
      manilaShares:
        share1:
          networkAttachments:
          - storage
          replicas: 1
      preserveJobs: false
  memcached:
    templates:
      memcached:
        replicas: 3
  neutron:
    apiOverride:
      route: {}
    template:
      customServiceConfig: |
        [DEFAULT]
        global_physnet_mtu = 9000
        [ml2]
        mechanism_drivers = ovn,sriovnicswitch
        [ovn]
        vhost_sock_dir = /var/lib/vhost_sockets
        [ml2_type_vlan]
        network_vlan_ranges = dpdk1:206:209,dpdk2:206:209,sriov1,sriov2 # CHANGEME
        [ovs]
        igmp_snooping_enable = True
        [oslo_policy]
        policy_file=/etc/neutron/policy.d/policy.yaml
      databaseInstance: openstack
      networkAttachments:
      - internalapi
      override:
        service:
          internal:
            metadata:
              annotations:
                metallb.universe.tf/address-pool: internalapi
                metallb.universe.tf/allow-shared-ip: internalapi
                metallb.universe.tf/loadBalancerIPs: 172.17.0.80
            spec:
              type: LoadBalancer
      preserveJobs: false
      replicas: 3
      secret: osp-secret
  notificationsBus:
    cluster: rabbitmq
  nova:
    apiOverride:
      route: {}
    template:
      apiServiceTemplate:
        override:
          service:
            internal:
              metadata:
                annotations:
                  metallb.universe.tf/address-pool: internalapi
                  metallb.universe.tf/allow-shared-ip: internalapi
                  metallb.universe.tf/loadBalancerIPs: 172.17.0.80
              spec:
                type: LoadBalancer
        replicas: 3
      apiTimeout: 600
      cellTemplates:
        cell0:
          cellDatabaseAccount: nova-cell0
          cellDatabaseInstance: openstack
          conductorServiceTemplate:
            replicas: 1
          hasAPIAccess: true
          messagingBus:
            cluster: rabbitmq
        cell1:
          cellDatabaseAccount: nova-cell1
          cellDatabaseInstance: openstack-cell1
          conductorServiceTemplate:
            replicas: 1
          hasAPIAccess: true
          messagingBus:
            cluster: rabbitmq-cell1
      metadataServiceTemplate:
        override:
          service:
            metadata:
              annotations:
                metallb.universe.tf/address-pool: internalapi
                metallb.universe.tf/allow-shared-ip: internalapi
                metallb.universe.tf/loadBalancerIPs: 172.17.0.80
            spec:
              type: LoadBalancer
        replicas: 3
      preserveJobs: false
      schedulerServiceTemplate:
        customServiceConfig: |
          [filter_scheduler]
          enabled_filters = AvailabilityZoneFilter,ComputeFilter,ComputeCapabilitiesFilter,ImagePropertiesFilter,ServerGroupAntiAffinityFilter,ServerGroupAffinityFilter,PciPassthroughFilter,NUMATopologyFilter,AggregateInstanceExtraSpecsFilter
        replicas: 3
      secret: osp-secret
  octavia:
    enabled: false
    template:
      databaseInstance: openstack
      octaviaAPI:
        preserveJobs: false
        replicas: 1
      octaviaHealthManager: {}
      octaviaHousekeeping: {}
      octaviaWorker: {}
      preserveJobs: false
      secret: osp-secret
  ovn:
    template:
      ovnController:
        networkAttachment: tenant
        nicMappings:
          datacentre: ospbr
      ovnDBCluster:
        ovndbcluster-nb:
          dbType: NB
          networkAttachment: internalapi
          replicas: 3
          storageRequest: 10Gi
        ovndbcluster-sb:
          dbType: SB
          networkAttachment: internalapi
          replicas: 3
          storageRequest: 10Gi
      ovnNorthd:
        logLevel: info
        nThreads: 1
        replicas: 1
        resources: {}
        tls: {}
  placement:
    apiOverride:
      route: {}
    template:
      databaseInstance: openstack
      override:
        service:
          internal:
            metadata:
              annotations:
                metallb.universe.tf/address-pool: internalapi
                metallb.universe.tf/allow-shared-ip: internalapi
                metallb.universe.tf/loadBalancerIPs: 172.17.0.80
            spec:
              type: LoadBalancer
      preserveJobs: false
      replicas: 3
      secret: osp-secret
  rabbitmq:
    templates:
      rabbitmq:
        override:
          service:
            metadata:
              annotations:
                metallb.universe.tf/address-pool: internalapi
                metallb.universe.tf/loadBalancerIPs: 172.17.0.85
            spec:
              type: LoadBalancer
        replicas: 3
        resources:
          limits:
            cpu: "2"
            memory: 4Gi
          requests:
            cpu: "1"
            memory: 4Gi
      rabbitmq-cell1:
        override:
          service:
            metadata:
              annotations:
                metallb.universe.tf/address-pool: internalapi
                metallb.universe.tf/loadBalancerIPs: 172.17.0.86
            spec:
              type: LoadBalancer
        replicas: 3
        resources:
          limits:
            cpu: "2"
            memory: 4Gi
          requests:
            cpu: "1"
            memory: 4Gi
  secret: osp-secret
  storageClass: local-storage
  swift:
    enabled: true
    proxyOverride:
      route: {}
    template:
      swiftProxy:
        override:
          service:
            internal:
              metadata:
                annotations:
                  metallb.universe.tf/address-pool: internalapi
                  metallb.universe.tf/allow-shared-ip: internalapi
                  metallb.universe.tf/loadBalancerIPs: 172.17.0.80
              spec:
                type: LoadBalancer
        replicas: 1
      swiftRing:
        ringReplicas: 1
      swiftStorage:
        replicas: 1
  telemetry:
    enabled: true
    template:
      autoscaling:
        aodh:
          databaseInstance: openstack
          memcachedInstance: memcached
          passwordSelectors: null
          preserveJobs: false
          secret: osp-secret
        enabled: false
        heatInstance: heat
      ceilometer:
        enabled: true
        secret: osp-secret
      logging:
        enabled: false
        port: 10514
      metricStorage:
        enabled: false
        monitoringStack:
          alertingEnabled: true
          scrapeInterval: 30s
          storage:
            persistent:
              pvcStorageClass: local-storage
              pvcStorageRequest: 10Gi
            retention: 24h
            strategy: persistent
  tls:
    caBundleSecretName: ""
---
apiVersion: k8s.cni.cncf.io/v1
kind: NetworkAttachmentDefinition
metadata:
  labels:
    osp/net: ctlplane
    osp/net-attach-def-type: standard
  name: ctlplane
  namespace: openstack
spec:
  config: |
    {
      "cniVersion": "0.3.1",
      "name": "ctlplane",
      "type": "macvlan",
      "master": "ospbr",
      "ipam": {
        "type": "whereabouts",
        "range": "192.168.122.0/24",
        "range_start": "192.168.122.30",
        "range_end": "192.168.122.70"
      }
    }
---
apiVersion: k8s.cni.cncf.io/v1
kind: NetworkAttachmentDefinition
metadata:
  labels:
    osp/net: datacentre
    osp/net-attach-def-type: standard
  name: datacentre
  namespace: openstack
spec:
  config: |
    {
      "cniVersion": "0.3.1",
      "name": "datacentre",
      "type": "bridge",
      "bridge": "ospbr",
      "ipam": {}
    }
---
apiVersion: k8s.cni.cncf.io/v1
kind: NetworkAttachmentDefinition
metadata:
  labels:
    osp/net: internalapi
    osp/net-attach-def-type: standard
  name: internalapi
  namespace: openstack
spec:
  config: |
    {
      "cniVersion": "0.3.1",
      "name": "internalapi",
      "type": "macvlan",
      "master": "internalapi",
      "ipam": {
        "type": "whereabouts",
        "range": "172.17.0.0/24",
        "range_start": "172.17.0.30",
        "range_end": "172.17.0.70"
      }
    }
---
apiVersion: k8s.cni.cncf.io/v1
kind: NetworkAttachmentDefinition
metadata:
  labels:
    osp/net: storage
    osp/net-attach-def-type: standard
  name: storage
  namespace: openstack
spec:
  config: |
    {
      "cniVersion": "0.3.1",
      "name": "storage",
      "type": "macvlan",
      "master": "storage",
      "ipam": {
        "type": "whereabouts",
        "range": "172.18.0.0/24",
        "range_start": "172.18.0.30",
        "range_end": "172.18.0.70"
      }
    }
---
apiVersion: k8s.cni.cncf.io/v1
kind: NetworkAttachmentDefinition
metadata:
  labels:
    osp/net: tenant
    osp/net-attach-def-type: standard
  name: tenant
  namespace: openstack
spec:
  config: |
    {
      "cniVersion": "0.3.1",
      "name": "tenant",
      "type": "macvlan",
      "master": "tenant",
      "ipam": {
        "type": "whereabouts",
        "range": "172.19.0.0/24",
        "range_start": "172.19.0.30",
        "range_end": "172.19.0.70"
      }
    }
---
apiVersion: metallb.io/v1beta1
kind: IPAddressPool
metadata:
  labels:
    osp/lb-addresses-type: standard
  name: ctlplane
  namespace: metallb-system
spec:
  addresses:
  - 192.168.122.80-192.168.122.90
---
apiVersion: metallb.io/v1beta1
kind: IPAddressPool
metadata:
  labels:
    osp/lb-addresses-type: standard
  name: internalapi
  namespace: metallb-system
spec:
  addresses:
  - 172.17.0.80-172.17.0.90
---
apiVersion: metallb.io/v1beta1
kind: IPAddressPool
metadata:
  labels:
    osp/lb-addresses-type: standard
  name: storage
  namespace: metallb-system
spec:
  addresses:
  - 172.18.0.80-172.18.0.90
---
apiVersion: metallb.io/v1beta1
kind: IPAddressPool
metadata:
  labels:
    osp/lb-addresses-type: standard
  name: tenant
  namespace: metallb-system
spec:
  addresses:
  - 172.19.0.80-172.19.0.90
---
apiVersion: metallb.io/v1beta1
kind: L2Advertisement
metadata:
  name: ctlplane
  namespace: metallb-system
spec:
  interfaces:
  - ospbr
  ipAddressPools:
  - ctlplane
---
apiVersion: metallb.io/v1beta1
kind: L2Advertisement
metadata:
  name: internalapi
  namespace: metallb-system
spec:
  interfaces:
  - internalapi
  ipAddressPools:
  - internalapi
---
apiVersion: metallb.io/v1beta1
kind: L2Advertisement
metadata:
  name: storage
  namespace: metallb-system
spec:
  interfaces:
  - storage
  ipAddressPools:
  - storage
---
apiVersion: metallb.io/v1beta1
kind: L2Advertisement
metadata:
  name: tenant
  namespace: metallb-system
spec:
  interfaces:
  - tenant
  ipAddressPools:
  - tenant
---
apiVersion: network.openstack.org/v1beta1
kind: NetConfig
metadata:
  name: netconfig
  namespace: openstack
spec:
  networks:
  - dnsDomain: ctlplane.example.com
    mtu: 1500
    name: ctlplane
    subnets:
    - allocationRanges:
      - end: 192.168.122.120
        start: 192.168.122.100
      - end: 192.168.122.200
        start: 192.168.122.150
      cidr: 192.168.122.0/24
      gateway: 192.168.122.1
      name: subnet1
  - dnsDomain: internalapi.example.com
    mtu: 1496
    name: internalapi
    subnets:
    - allocationRanges:
      - end: 172.17.0.250
        start: 172.17.0.100
      cidr: 172.17.0.0/24
      name: subnet1
      vlan: 20
  - dnsDomain: external.example.com
    mtu: 1500
    name: external
    subnets:
    - allocationRanges:
      - end: 10.0.0.250
        start: 10.0.0.100
      cidr: 10.0.0.0/24
      name: subnet1
      vlan: 22
  - dnsDomain: storage.example.com
    mtu: 1496
    name: storage
    subnets:
    - allocationRanges:
      - end: 172.18.0.250
        start: 172.18.0.100
      cidr: 172.18.0.0/24
      name: subnet1
      vlan: 21
  - dnsDomain: tenant.example.com
    mtu: 1496
    name: tenant
    subnets:
    - allocationRanges:
      - end: 172.19.0.250
        start: 172.19.0.100
      cidr: 172.19.0.0/24
      name: subnet1
      vlan: 22