Orchestration Configuration

Overview

The Orchestration service is configured through the deployment console global variables and service-specific configuration files. Key configuration areas include the stack domain (used for trust delegation), engine worker settings, quota defaults, and integration with the CloudWatch-compatible alarm endpoint.

Administrator Access Required — This operation requires the admin role. Contact your Polystack administrator if you do not have sufficient permissions.

Key Configuration Options

The following settings control core Orchestration service behavior. All settings are managed through the deployment console.

Setting	Default	Description
`enable_heat`	`"no"`	Enable the Orchestration service
`heat_engine_workers`	`4`	Number of engine worker processes per controller node
`heat_api_workers`	`4`	Number of API worker processes per controller node
`heat_max_stacks_per_tenant`	`100`	Maximum stacks per project
`heat_max_resources_per_stack`	`1000`	Maximum resources in a single stack
`heat_max_nested_stack_depth`	`5`	Maximum depth for nested stack hierarchies
`heat_convergence_engine`	`true`	Enable convergence mode for parallel resource provisioning
`heat_default_deployment_signal_transport`	`CFN_SIGNAL`	Default signal transport for `WaitCondition` resources

Enable the Orchestration service by setting enable_heat: "yes" in /etc/ironcore/globals.d/_50_orchestration.yml and running ironcore-ansible deploy -t heat.

Enable the Service

Web Console
CLI

Navigate to Configuration

In the deployment console, navigate to Configuration → Services → Orchestration.

Enable the service

Set Enable Orchestration to Yes and configure the engine worker count appropriate for your controller node capacity (typically 2–4 workers per CPU core).

Apply configuration

Click Save and then Deploy → Orchestration to apply the configuration.

The Orchestration API is accessible at http://<controller-ip>:8004/v1.

Create configuration override

Create orchestration globals

cat > /etc/ironcore/globals.d/_50_orchestration.yml << 'EOF'
enable_heat: "yes"
heat_engine_workers: 4
heat_api_workers: 4
heat_max_stacks_per_tenant: 100
EOF

Deploy the service

Deploy Orchestration

ironcore-ansible deploy -t heat

Verify the service

Check Orchestration endpoint

openstack orchestration service list

All engine and API services show status up.

Stack Domain Setup

The stack domain is a dedicated Polystack Identity domain used for trust delegation. When a template creates resources that require credentials (e.g., WaitCondition signals, auto-scaling webhooks), the engine uses a stack domain user — scoped to the stack’s project — rather than the submitting user’s credentials.

The stack domain must be configured before deploying stacks that use WaitCondition or scaling policy resources. Stacks using only basic compute and network resources do not require the stack domain.

Stack domain configuration is handled automatically by the deployment console during the Orchestration deployment. The following variables control the domain:

Setting	Description
`heat_domain_name`	Name of the stack domain in Polystack Identity (default: `heat`)
`heat_domain_admin`	Admin user for the stack domain
`heat_domain_admin_password`	Password for the stack domain admin (stored in `passwords.yml`)

Default Quotas

Orchestration quotas limit per-project resource consumption. Defaults are set cluster-wide; you can override them per-project.

Quota	Default	Description
`stacks`	100	Maximum stacks per project
`resources`	1000	Maximum resources across all stacks per project

Dashboard
CLI

Navigate to the admin quota settings to adjust global quota defaults. For per-project overrides, navigate to Identity > Projects (admin view), select a project, and click Manage Quota.

Show orchestration quotas for a project

openstack quota show --project <PROJECT_ID>

Update stack quota for a project

openstack quota set --stacks 200 <PROJECT_ID>

Next Steps

Scaling the Service

Configure multiple engine workers for high-throughput deployments

Security

Stack domain trust, policy configuration, and template injection prevention

Architecture

Understand service components and request processing flow

Admin Troubleshooting

Diagnose configuration errors and engine startup failures

Core Services

Other Services

Overview

Key Configuration Options

Enable the Service

Navigate to Configuration

Enable the service

Apply configuration

Create configuration override

Deploy the service

Verify the service

Stack Domain Setup

Default Quotas

Next Steps

Scaling the Service

Security

Architecture

Admin Troubleshooting

​Overview

​Key Configuration Options

​Enable the Service

Navigate to Configuration

Enable the service

Apply configuration

Create configuration override

Deploy the service

Verify the service

​Stack Domain Setup

​Default Quotas

​Next Steps

Scaling the Service

Security

Architecture

Admin Troubleshooting

Overview

Key Configuration Options

Enable the Service

Stack Domain Setup

Default Quotas

Next Steps