-
Notifications
You must be signed in to change notification settings - Fork 44
Expand file tree
/
Copy pathmain.yml
More file actions
614 lines (523 loc) · 24.3 KB
/
Copy pathmain.yml
File metadata and controls
614 lines (523 loc) · 24.3 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
---
# DON'T EDIT THIS FILE. JUST OVERRIDE THE VARIABLES.
# ==============================
# UPGRADE
# ==============================
# Upgrades Scylla version if a previous installation is detected
# Values:
# [default] false: don't check for upgrades
# true: check for upgrades and apply them
upgrade_version: false
# Defines if the upgrade is 'major' or 'minor' (patch)
# Values:
# [default] false: 'minor' upgrade
# true: 'major' upgrade
upgrade_major: false
# Define if upgrade validation checks are skipped.
# - minor or major version upgrade verification
# - check if upgrade is to the closest subsequent major version
# Values:
# [default] true: always upgrade even if the same version is installed
# false: don't do anything
upgrade_skip_validation: false
# Skips the specific upgrade path version check. When upgrade_skip_validation is set to true, this validation is skipped as well.
# This checks if for a major upgrade that if it will upgrade to the next major version.
# E.g. 2024.1 -> 2024.2
# Values:
# [default] false: Check upgrade path for major upgrades
# false: Skip upgrade path check
upgrade_skip_upgrade_path_validation: false
# Defines if the upgrade process should rollback on failure
# Values:
# [default] true: rollback on failure
# false: don't do anything
upgrade_rollback_on_failure: true
# Defines if the cross-edition upgrade is allowed
# Values:
# [default] false: cross-edition upgrade not allowed
# true: cross-edition upgrade allowed
upgrade_cross_edition: false
# Defines if the user can manually run a downgrade
# Values:
# [default] false: manual downgrade not allowed
# true: manual downgrade allowed (FOR EXPERIENCED USERS ONLY!)
upgrade_allow_user_manual_downgrade: false
# Defines if snapshots should be generated before starting the upgrade
# Values:
# [default] false: don't generate snapshots
# true: generate snapshots
upgrade_generate_snapshots: false
# Defines how many retries should be used for API usage before failing
# Values:
# [default] 20
# Any value above 0
upgrade_api_default_retries: 20
# Defines how many seconds of delay should be applied between retries for API usage
# Values:
# [default] 15
# Any value above 0
upgrade_api_default_delay: 15
# Defines how many seconds Ansible should wait before starting the verification process
# Values:
# [default] 90
# Any value above 0
upgrade_break_before_verification: 90
# Defines backup folder path
# Values:
# [default] /root/scylla-backup
# Any valid folder
upgrade_backup_path: /root/scylla-backup
# Run nodetool upgradesstables after the node is upgraded and CQL is up.
# Rewrites SSTables to the current format (e.g. system keyspace format drifts).
# Values:
# [default] true: run upgradesstables after post-upgrade start
# false: skip upgradesstables
upgrade_sstables: true
# Max wall-clock seconds for nodetool upgradesstables (async timeout).
# Values:
# [default] 36000 (10h), same order as cleanup/repair timeouts
# Any positive integer
upgrade_sstables_timeout_seconds: 36000
# ==============================
# INSTALL
# ==============================
scylla_cluster_name: 'testcluster123'
# set to true if the role should enable the specified repos, install the binaries and stop
install_only: false
# Change here or override in vars
scylla_nic: "{{ ansible_default_ipv4.interface }}"
cluster_local_files_path: "{{ inventory_dir }}"
# online|offline - offline will disable all the attepts to download packages
# node_exporter will need to be installed manually
scylla_install_type: online
# Defines if the node firewall should be enabled or not
# Values:
# [default] false: all front-end firewall services will be disabled and iptables rules flushed
# true: keep node configuration as is
firewall_enabled: false
# URL of an RPM .repo file or a DEB .list file
# deprecated in favour of below, it will be dropped soon, below should be used
#scylla_repos:
# - https://downloads.scylladb.com/rpm/centos/scylla-2021.1.repo
#
# Both scylla_deb_repos and scylla_rpm_repos, if undefined, would resolve to a URL that corresponds
# to a scylla version to which scylla_version resolves to.
#scylla_deb_repos:
# - https://downloads.scylladb.com/deb/ubuntu/scylla-2021.1.list
#
#scylla_rpm_repos: "{{ scylla_repos }}"
# Use a newer kernel from ELRepo (was recommended for RHEL/CentOS until 5.11)
# Reboot after the elrepo kernel has been installed is recommended as well.
# Note that kernel 5.16 has serious issues on GCP and on Azure, last known
# working kernel was 5.11 that can now only be used from archives
elrepo_kernel: False
reboot_after_kernel_upgrade: False
# set this to false when the role isn't being applied to a full inventory reflecting the whole cluster
full_inventory: true
# set this to false to disable automatic
# authenticator: PasswordAuthenticator
# authorizer: CassandraAuthorizer
# injected into scylla.yaml
# !!! also make sure you override scylla_yaml_params and remove authorization from there !!!
scylla_authentication: True
# Set this to false to disable automatic adjustment of system_auth keyspace replication
adjust_system_auth_replication: False
# Set this to false to disable automatic adjustment of audit keyspace replication
adjust_audit_replication: False
# Set this to false to disable automatic adjustment of system_distributed keyspace replication
adjust_system_distributed_replication: False
# Set this to false to disable automatic adjustment of system_traces keyspace replication
adjust_system_traces_replication: False
# Replication variables and cql credentials are intended to be used to adjust system_auth and audit keyspaces when necessary.
system_auth_rf: 3
system_auth_replication_strategy: NetworkTopologyStrategy
audit_rf: 3
audit_replication_strategy: NetworkTopologyStrategy
system_distributed_rf: 3
system_distributed_replication_strategy: NetworkTopologyStrategy
system_traces_rf: 3
system_traces_replication_strategy: NetworkTopologyStrategy
# scylla_admin_default_user must be a valid user defined in the inventory.ini under the cql_credentials section.
# scylla_admin_default_user: scylla_admin
repair_timeout_seconds: 36000
cleanup_timeout_seconds: 36000
# set to enabled when the scylla-server service should be started by applying the role.
# if, for example, we add a node, but prefer to wait before we start the service and add it to the cluster,
# this should be set to false
start_scylla_service: true
# Only relevant for Debian/Ubuntu
scylla_repo_keyserver: 'hkp://keyserver.ubuntu.com:80'
scylla_repo_keys:
- 491c93b9de7496a7
- d0a112e067426ab2
- 5e08fbd8b5d6ec9c
- a43e06657bac99e3
- c503c686b007f39e
scylla_repo_keyring_dir: /etc/apt/keyrings/
scylla_repo_keyringfile: "{{ scylla_repo_keyring_dir }}/scylladb.gpg"
scylla_manager_repo_keys:
- 491c93b9de7496a7
- d0a112e067426ab2
- 5e08fbd8b5d6ec9c
- 6B2BFD3660EF3F5B
- a43e06657bac99e3
- c503c686b007f39e
# Set when relevant (Debian for example)
#scylla_repo_keyfile_urls:
# - https://download.opensuse.org/repositories/home:/scylladb:/scylla-3rdparty-stretch/Debian_9.0/Release.key
# Deprecated in favor of scylla_debian_dependencies
scylla_dependencies:
- curl
- wget
- python3-yaml # this will fail on non centos systems
- nvme-cli
- netcat
#- software-properties-common
#- apt-transport-https
#- gnupg2
#- dirmngr
# Configure when additional dependency packages are required
scylla_debian_dependencies: "{{ scylla_dependencies }}"
# Configure when additional dependency packages are required
scylla_redhat_dependencies:
- systemd-udev
- policycoreutils
- python3-pyyaml
- nvme-cli
- nmap-ncat
debian_packages_to_remove:
- google-guest-agent
redhat_packages_to_remove:
- abrt
- google-guest-agent
# Specify a Scylla version here (should be available in repo)
# ex: scylla_version: 2019.1.9 or 3.2.1
# 'latest' value would resolve to a current latest OSS or Enterprise version
# according to a scylla_edition value.
# scylla_version: 'latest'
# Starting from version 2025, there is a single ScyllaDB edition.
# When using 2025, or later, please use the option 'enterprise'.
# Options are oss|enterprise
#scylla_edition: oss
scylla_edition: enterprise
# Calculate package prefix based on version and edition
# Starting from version 2025, the 'scylla' or 'scylla-enterprise' package prefix can be used.
# For versions before 2025: use legacy logic and distinction between 'scylla' and 'scylla-enterprise'
scylla_legacy_package_prefix: "{{ 'scylla-enterprise' if scylla_edition == 'enterprise' else 'scylla' }}"
scylla_package_prefix: >-
{%- if scylla_version == 'latest' -%}
scylla
{%- else -%}
{%- if scylla_version is version('2025.1.0', '>=') -%}
scylla
{%- else -%}
{{ scylla_legacy_package_prefix }}
{%- endif -%}
{%- endif -%}
# Set to true if you want to allow a Role to upgrade and already installed Scylla
skip_installed_scylla_version_check: False
scylla_snitch: GossipingPropertyFileSnitch
# OPTIONAL: If GossipingPropertyFileSnitch in use, set this variable as per Scylla documentation
# https://docs.scylladb.com/operating-scylla/system-configuration/snitch/#gossipingpropertyfilesnitch
gpfs_prefer_local: "true"
# IO settings
# probe for IO figures on one node and reuse the figures on all nodes (recommended: True)
scylla_io_probe: True
# If set to True, scylla_io_probe must be True and dc variable must be defined in the inventory
# for each one of the nodes.
# This will make sure that scylla_io_setup will be executed in one node from each datacenter
# and then the configuration files will be propagated for the other nodes of each datacenter.
scylla_io_probe_dc_aware: False
# If set to True the content of io.conf is going to be aligned with the first node or the
# first node in each DC (depending on the value of scylla_io_probe_dc_aware)
always_replace_io_conf: False
# If set to True the content of io_properties.yaml is going to be aligned with the first node or the
# first node in each DC (depending on the value of scylla_io_probe_dc_aware)
always_replace_io_properties: False
# These can be arbitrarily set if scylla_io_probe is set to False
# io_properties:
# disks:
# - mountpoint: /var/lib/scylla/data
# read_iops: 10962999
# read_bandwidth: 348093056
# write_iops: 9722999
# write_bandwidth: 352182944
io_conf: 'SEASTAR_IO="--io-properties-file /etc/scylla.d/io_properties.yaml"'
# This parameter allows overriding a default SCYLLA_ARGS value in /etc/default/scylla-server file
# When defined and not empty SCYLLA_ARGS is going to be set the corresponding value.
#
# The provided value will be set in double quotes by the Role:
# SCYLLA_ARGS="{{ scylla_args_value }}"
#
# scylla_args_value: "--log-to-syslog 1 --log-to-stdout 0 --default-log-level info --network-stack posix"
# Seeds node list
scylla_seeds:
- "{{ groups['scylla'][0] }}"
scylla_listen_address: "{{ vars['ansible_'~scylla_nic].ipv4.address }}"
scylla_rpc_address: "{{ vars['ansible_'~scylla_nic].ipv4.address }}"
scylla_broadcast_address: "{{ vars['ansible_'~scylla_nic].ipv4.address }}"
scylla_broadcast_rpc_address: "{{ scylla_rpc_address }}"
scylla_api_address: '127.0.0.1'
scylla_api_port: '10000'
# Additional parameters for scylla.yaml, only usable for the simple one-line parameters
# Check the official scylla.yaml for available options.
scylla_yaml_params:
authorizer: CassandraAuthorizer
authenticator: PasswordAuthenticator
internode_compression: all
# The 'scylla_ssl' dict is deprecated and will be removed soon.
# You should use the 'ssl_*' vars instead.
#
# scylla_ssl:
# localhost_cert_path: "{{ inventory_dir }}/ssl/scylla.crt"
# localhost_cert_key_path: "{{ inventory_dir }}/scylla.pem"
# localhost_truststore_path: "{{ inventory_dir }}/ssl/truststore.crt"
# localhost_ca_cert_path: "{{ inventory_dir }}/ssl/ca/"
# cert_path: /etc/scylla
# internode:
# enabled: true
# internode_encryption: all
# client:
# enabled: true
ssl_internode_enabled: "{{ (scylla_ssl | default({})).internode.enabled | default(true) }}"
ssl_internode_encryption: "{{ (scylla_ssl | default({})).internode.internode_encryption | default('all') }}"
ssl_client_enabled: "{{ (scylla_ssl | default({})).client.enabled | default(true) }}"
# If ssl_internode_enabled and/or ssl_client_enabled are true, these variables define the local paths where
# certificates and keys will be stored before being copied to the target nodes.
# The role will automatically generate the certificates and keys and store them at these paths.
# Alternatively, you can provide your own certificates, and the role will use those instead of generating new ones.
ssl_localhost_cert_path: "{{ (scylla_ssl | default({})).localhost_cert_path | default(inventory_dir + '/ssl/' + inventory_hostname + '/' + inventory_hostname + '.crt') }}"
ssl_localhost_cert_key_path: "{{ (scylla_ssl | default({})).localhost_cert_key_path | default(inventory_dir + '/ssl/' + inventory_hostname + '/' + inventory_hostname + '.pem') }}"
ssl_localhost_ca_path: "{{ inventory_dir }}/ssl/ca/{{ scylla_cluster_name }}-ca.crt"
ssl_localhost_ca_key_path: "{{ inventory_dir }}/ssl/ca/{{ scylla_cluster_name }}-ca.pem"
ssl_localhost_truststore_path: "{{ (scylla_ssl | default({})).localhost_truststore_path | default(ssl_localhost_ca_path) }}"
# Defines whether the node certificates and keys should be regenerated or not
ssl_regenerate_node_certs: false
# These variables define the remote paths where the certificates and keys will be copied to.
ssl_cert_dir: "/etc/scylla"
ssl_cert_path: "{{ (scylla_ssl | default({})).cert_path | default(ssl_cert_dir) }}/{{ ssl_localhost_cert_path | basename }}"
ssl_cert_key_path: "{{ (scylla_ssl | default({})).cert_path | default(ssl_cert_dir) }}/{{ ssl_localhost_cert_key_path | basename }}"
# Certificate subject alternative names (SAN) that will appear in the certificate of the host.
# IP or DNS addresses are automatically included based on various Scylla addresses and hostnames
# The `ssl_cert_san_dns` allows to set DNS entries specifically, while e.g. still preserving the defaults in `ssl_cert_san`.
# By convenience, it does not require a `DNS:` prefix per entry.
ssl_cert_san: >-
{{
(
(['IP:' ~ scylla_rpc_address] if scylla_rpc_address is defined else []) +
(['IP:' ~ scylla_broadcast_rpc_address] if scylla_broadcast_rpc_address is defined else []) +
(['DNS:' ~ inventory_hostname] if not ansible_host is defined and not (inventory_hostname is ansible.utils.ipv4 or inventory_hostname is ansible.utils.ipv6) else []) +
(['DNS:' ~ ansible_hostname] if ansible_hostname is defined else []) +
(['DNS:' ~ ansible_fqdn] if ansible_fqdn is defined else [])
) | unique | list
}}
ssl_cert_san_dns: []
ssl_truststore_path: "{{ (scylla_ssl | default({})).cert_path | default (ssl_cert_dir) }}/truststore.crt"
# Two types of encryption keys are available: System Keys and Table Keys.
# System keys can be used for encrypting system data, like commit logs, batches and hints logs.
# However, in the context of table keys (for encrypting sstables), if the user decides to use
# a Replicated Key Provider, a system key will also be necessary for encrypting the encrypted_keys table,
# where the replicated keys will be kept.
# If you want to use this role for managing your system keys, regardless of them being used for system_info encryption
# or for encrypting the encrypted_keys table, you should set {{ handle_system_keys }} to true and place all of your system
# keys under the {{ localhost_system_key_directory }} folder. The role will copy all the local keys to the {{ system_key_directory }}
# of every node.
# Note that by default the {{ inventory_hostname }} is part of the localhost_system_key_directory. This allows you to define
# different keys per host.
# e.g.:
# If your localhost_system_key_directory is set to "{{ inventory_dir }}/encryption_at_rest/{{ inventory_hostname }}/system_encryption_keys"
# and you have the following file tree:
#
# ├── encryption_at_rest
# │ ├── node1
# │ │ └── system_encryption_keys
# │ │ └── key1
# │ ├── node2
# │ │ └── system_encryption_keys
# │ │ └── key2
# │ └── node3
# │ └── system_encryption_keys
# │ └── key3
# └── inventory.ini
#
# At the end of the process node1 will have key1, node2 will have key2 and node3 will have key3.
# On the other hand, if you want to have the same keys for all the hosts you can define a {{ localhost_system_key_directory }}
# without the {{ inventory_hostname }} in it or simply copy the same key for all the node folders.
handle_system_keys: false
localhost_system_key_directory: "{{ inventory_dir }}/encryption_at_rest/{{ inventory_hostname }}/system_encryption_keys"
system_key_directory: "/etc/scylla/system_encryption_keys"
# Table keys are used for encrypting SSTables. Depending on your key provider, this key is stored in different locations:
# Replicated key provider - encrypted_keys table
# KMIP key provider - KMIP server
# KMS key provider - AWS
# Local key provider - in a local file with multiple keys. You can provide your own key or Scylla can make one for you.
# You can use this role for managing your local table keys. In order to do so, you need to set {{ handle_table_keys }} to true
# and place all of your local table keys under the {{ localhost_table_key_directory }} folder. The role will copy all the
# local table keys to the {{ table_key_directory }} folder.
# Note that by default the {{ inventory_hostname }} is part of the localhost_table_key_directory. This allows you to define
# different keys per host.
# e.g.:
# If your localhost_table_key_directory is set to "{{ inventory_dir }}/encryption_at_rest/{{ inventory_hostname }}/table_encryption_keys"
# and you have the following file tree:
#
# ├── encryption_at_rest
# │ ├── node1
# │ │ └── table_encryption_keys
# │ │ └── key1
# │ ├── node2
# │ │ └── table_encryption_keys
# │ │ └── key2
# │ └── node3
# │ └── table_encryption_keys
# │ └── key3
# └── inventory.ini
#
# At the end of the process node1 will have key1, node2 will have key2 and node3 will have key3.
# On the other hand, if you want to have the same keys for all the hosts you can define a {{ localhost_table_key_directory }}
# without the {{ inventory_hostname }} in it or simply copy the same key for all the node folders.
handle_table_keys: false
localhost_table_key_directory: "{{ inventory_dir }}/encryption_at_rest/{{ inventory_hostname }}/table_encryption_keys"
table_key_directory: "/etc/scylla/table_encryption_keys"
# Encrypt system resources:
# System encryption is applied to semi-transient on-disk data, such as commit logs, batch logs, and hinted handoff data.
# Note that for system info encryption, only the following key providers are supported:
# LocalKeyProvider: Stores the key on the same machine as the data. Please use the system_info_encrypt_local config.
# KMIPKeyProvider: External key management server. Please use the system_info_encryption_kmip config.
# KMSKeyProvider: Uses key(s) provided by the AWS KMS service. Please use the system_info_encryption_kms config.
# If you decide to use a LocalKeyProvider and also want the role to manage the local key that will be used, make sure you
# have {{ handle_system_keys }}, {{ localhost_system_key_directory }} and {{ system_key_directory }} set appropriately.
# LocalKeyProvider:
system_info_encryption_local:
enabled: false
secret_key_file: "{{ system_key_directory }}/system_info_key"
cipher_algorithm: AES/CBC/PKCS5Padding
secret_key_strength: 128
# KMIPKeyProvider:
# Make sure you set kmip_hosts accordingly
system_info_encryption_kmip:
enabled: false
cipher_algorithm: AES
secret_key_strength: 128
kmip_host: yourkmipServerIP.com
# KMSKeyProvider:
# Make sure you set kms_hosts accordingly
system_info_encryption_kms:
enabled: false
cipher_algorithm: AES/CBC/PKCS5Padding
secret_key_strength: 128
kms_host: myScylla
# If Scylla Manager will be used, set the following variables
scylla_manager_enabled: true
scylla_manager_deb_repo_url: "https://downloads.scylladb.com/deb/ubuntu/scylladb-manager-3.11.list"
scylla_manager_rpm_repo_url: "https://downloads.scylladb.com/rpm/centos/scylladb-manager-3.11.repo"
scylla_manager_agent_upgrade: true
# Manager Agent Backup configuration - this is a YAML value that will be inserted into the configuration file.
# Please refer to the example configuration file and the documentation for detailed instructions.
#scylla_manager_agent_config:
# s3:
# access_key_id: 12345678
# secret_access_key: QWerty123456789
# provider: AWS
# region: us-east-1c
# endpoint: https://foo.bar.baz
# server_side_encryption:
# sse_kms_key_id:
# upload_concurrency: 2
# chunk_size: 50M
# use_accelerate_endpoint: false
# Configure raid disks via scylla_setup. This requires a list of disks to add to the raid
# scylla_raid_setup:
# - /dev/nvme0n1
# - /dev/nvme0n2
# - /dev/nvme0n3
scylla_raid_online_discard: False
# If scylla_raid_setup is not given and this is set to True, the role will use 'nvme list' for getting the list of nvme devices
# in the machine and pass all of them to scylla_raid_setup
detect_nvmes: False
skip_coredump: False
devmode: False
#below can be dangerous, sysconfig also sets cpuset, so disable both to not do any cpuset.conf changes!
skip_cpuset: False
skip_sysconfig: False
skip_selinux: False
skip_ntp: False
skip_swap: False
skip_mem_setup: False
# Set it to 0 to let scylla choose the swap size.
# Note that the minimum supported value is 1024mb, so any non-zero value smaller than 1024 will be changed to 1024
swap_file_size_mb: 0
# If defined, this enables the usage of a separate token_distributor instead of scylla's default random token distributor
# The token distributor in the provided path must be named token_distributor.py and must have the following list of arguments:
# --node, --rack, --dc, --rf and --get-current-tokens.
# --node must be followed by a comma-separated list with the all the nodes in the cluster.
# --rack must be followed by a comma-separated list indicating the racks of each one of the nodes in the node list,
# in the same order as the nodes were provided.
# --dc must be followed by a comma-separated list indicating the datacenters of each one of the nodes in the node list,
# in the same order as the nodes were provided.
# --rf must be followed by a comma-separated list indicating the replication-factors for which the token ring should
# be optimized. Example: "dc1=3,dc2=2".
# token_distributor:
# path: /path/too/token_distributor
# rf: us-east1=3,us-east2=2
# Default bootstrap timeout
scylla_bootstrap_wait_time_sec: 25200
# sysctl tuning defaults, please leave in place if unsure
update_sysctl: True
sysctl:
- name: 'fs.file-max'
value: '2097152'
- name: 'vm.swappiness'
value: '10'
- name: 'vm.dirty_ratio'
value: '60'
- name: 'vm.dirty_background_ratio'
value: '2'
- name: 'net.ipv4.tcp_synack_retries'
value: '2'
- name: 'net.ipv4.ip_local_port_range'
value: '20000 65535'
- name: 'net.ipv4.tcp_rfc1337'
value: '1'
- name: 'net.ipv4.tcp_fin_timeout'
value: '15'
- name: 'net.ipv4.tcp_keepalive_time'
value: '300'
- name: 'net.ipv4.tcp_keepalive_probes'
value: '5'
- name: 'net.ipv4.tcp_keepalive_intvl'
value: '15'
- name: 'net.core.rmem_default'
value: '31457280'
- name: 'net.core.rmem_max'
value: '12582912'
- name: 'net.core.wmem_default'
value: '31457280'
- name: 'net.core.wmem_max'
value: '12582912'
- name: 'net.core.somaxconn'
value: '65535'
- name: 'net.core.netdev_max_backlog'
value: '65535'
- name: 'net.core.optmem_max'
value: '25165824'
- name: 'net.ipv4.tcp_mem'
value: '65535 131072 262144'
- name: 'net.ipv4.udp_mem'
value: '65535 131072 262144'
- name: 'net.ipv4.tcp_rmem'
value: '8192 87380 16777216'
- name: 'net.ipv4.udp_rmem_min'
value: '16384'
- name: 'net.ipv4.tcp_wmem'
value: '8192 65535 16777216'
- name: 'net.ipv4.udp_wmem_min'
value: '16384'
- name: 'net.ipv4.tcp_max_tw_buckets'
value: '1440000'
- name: 'net.ipv4.tcp_tw_reuse'
value: '1'
# - name: 'net.ipv4.tcp_tw_recycle'
# value: '1'
# Scylla Node Exported configuration that will be configured in the corresponding EnvFile. If not defined the default
# scylla-node-exporter/scylla-enterprise-node-exporter package configuration will be used.
# scylla_node_exporter_params: "--collector.interrupts --collector.netdev.address-info"