diff --git a/git/gitolite.md b/git/gitolite.md new file mode 100644 index 0000000..0415207 --- /dev/null +++ b/git/gitolite.md @@ -0,0 +1,21 @@ +# gitolite + +## deployment + +``` bash +sudo apt-get install git openssh-server openssh-client + + +sudo adduser --system --shell /bin/bash --gecos 'Git SCM User' --group --disabled-password --home /home/git git + +sudo su git + +cd ~ + +git clone http://github.com/sitaramc/gitolite + +mkdir -p ~/bin + +~/gitolite/install -to ~/bin + +``` \ No newline at end of file diff --git a/openstack/cinder.conf b/openstack/cinder.conf new file mode 100644 index 0000000..3630aa9 --- /dev/null +++ b/openstack/cinder.conf @@ -0,0 +1,52 @@ +[DEFAULT] +glance_api_servers = http://controller:9292 +iscsi_protocol = iscsi +volume_driver = cinder.volume.drivers.lvm.LVMVolumeDriver +my_ip = 10.0.0.31 +transport_url = rabbit://openstack:rabbitPass@controller +rootwrap_config = /etc/cinder/rootwrap.conf +api_paste_confg = /etc/cinder/api-paste.ini +iscsi_helper = tgtadm +volume_name_template = volume-%s +volume_group = cinder-volumes +verbose = True +auth_strategy = keystone +state_path = /var/lib/cinder +lock_path = /var/lock/cinder +volumes_dir = /var/lib/cinder/volumes +enabled_backends = ds1515pV1, lvm + +[ds1515pV1] +# Required settings +volume_driver = cinder.volume.drivers.synology.synology_iscsi.SynoISCSIDriver +target_protocol = iscsi +target_ip_address = 192.168.2.253 +synology_admin_port = 5000 +synology_username = Pridetest +synology_password = jxh1952jxh +synology_pool_name = volume1 + +# Optional settings +#volume_backend_name = VOLUME_BACKEND_NAME +#iscsi_secondary_ip_addresses = IP_ADDRESSES +#driver_use_ssl = True +use_chap_auth = True +chap_username = pride +chap_password = 1234567890AB + +[database] +connection = mysql+pymysql://cinder:cinder_db_secret@controller/cinder + +[keystone_authtoken] +password = cinder_user_secret +username = cinder +project_name = service +user_domain_id = default +project_domain_id = default +auth_type = password +memcached_servers = controller:11211 +auth_url = http://controller:5000 +auth_uri = http://controller:5000 + +[oslo_concurrency] +lock_path = /var/lib/cinder/tmp diff --git a/openstack/openstack_conf/compute/cinder/api-paste.ini b/openstack/openstack_conf/compute/cinder/api-paste.ini new file mode 100755 index 0000000..cb783b8 --- /dev/null +++ b/openstack/openstack_conf/compute/cinder/api-paste.ini @@ -0,0 +1,65 @@ +############# +# OpenStack # +############# + +[composite:osapi_volume] +use = call:cinder.api:root_app_factory +/: apiversions +/v2: openstack_volume_api_v2 +/v3: openstack_volume_api_v3 + +[composite:openstack_volume_api_v2] +use = call:cinder.api.middleware.auth:pipeline_factory +noauth = cors http_proxy_to_wsgi request_id faultwrap sizelimit osprofiler noauth apiv2 +keystone = cors http_proxy_to_wsgi request_id faultwrap sizelimit osprofiler authtoken keystonecontext apiv2 +keystone_nolimit = cors http_proxy_to_wsgi request_id faultwrap sizelimit osprofiler authtoken keystonecontext apiv2 + +[composite:openstack_volume_api_v3] +use = call:cinder.api.middleware.auth:pipeline_factory +noauth = cors http_proxy_to_wsgi request_id faultwrap sizelimit osprofiler noauth apiv3 +keystone = cors http_proxy_to_wsgi request_id faultwrap sizelimit osprofiler authtoken keystonecontext apiv3 +keystone_nolimit = cors http_proxy_to_wsgi request_id faultwrap sizelimit osprofiler authtoken keystonecontext apiv3 + +[filter:request_id] +paste.filter_factory = oslo_middleware.request_id:RequestId.factory + +[filter:http_proxy_to_wsgi] +paste.filter_factory = oslo_middleware.http_proxy_to_wsgi:HTTPProxyToWSGI.factory + +[filter:cors] +paste.filter_factory = oslo_middleware.cors:filter_factory +oslo_config_project = cinder + +[filter:faultwrap] +paste.filter_factory = cinder.api.middleware.fault:FaultWrapper.factory + +[filter:osprofiler] +paste.filter_factory = osprofiler.web:WsgiMiddleware.factory + +[filter:noauth] +paste.filter_factory = cinder.api.middleware.auth:NoAuthMiddleware.factory + +[filter:sizelimit] +paste.filter_factory = oslo_middleware.sizelimit:RequestBodySizeLimiter.factory + +[app:apiv2] +paste.app_factory = cinder.api.v2.router:APIRouter.factory + +[app:apiv3] +paste.app_factory = cinder.api.v3.router:APIRouter.factory + +[pipeline:apiversions] +pipeline = cors http_proxy_to_wsgi faultwrap osvolumeversionapp + +[app:osvolumeversionapp] +paste.app_factory = cinder.api.versions:Versions.factory + +########## +# Shared # +########## + +[filter:keystonecontext] +paste.filter_factory = cinder.api.middleware.auth:CinderKeystoneContext.factory + +[filter:authtoken] +paste.filter_factory = keystonemiddleware.auth_token:filter_factory diff --git a/openstack/openstack_conf/compute/cinder/cinder.conf b/openstack/openstack_conf/compute/cinder/cinder.conf new file mode 100755 index 0000000..3630aa9 --- /dev/null +++ b/openstack/openstack_conf/compute/cinder/cinder.conf @@ -0,0 +1,52 @@ +[DEFAULT] +glance_api_servers = http://controller:9292 +iscsi_protocol = iscsi +volume_driver = cinder.volume.drivers.lvm.LVMVolumeDriver +my_ip = 10.0.0.31 +transport_url = rabbit://openstack:rabbitPass@controller +rootwrap_config = /etc/cinder/rootwrap.conf +api_paste_confg = /etc/cinder/api-paste.ini +iscsi_helper = tgtadm +volume_name_template = volume-%s +volume_group = cinder-volumes +verbose = True +auth_strategy = keystone +state_path = /var/lib/cinder +lock_path = /var/lock/cinder +volumes_dir = /var/lib/cinder/volumes +enabled_backends = ds1515pV1, lvm + +[ds1515pV1] +# Required settings +volume_driver = cinder.volume.drivers.synology.synology_iscsi.SynoISCSIDriver +target_protocol = iscsi +target_ip_address = 192.168.2.253 +synology_admin_port = 5000 +synology_username = Pridetest +synology_password = jxh1952jxh +synology_pool_name = volume1 + +# Optional settings +#volume_backend_name = VOLUME_BACKEND_NAME +#iscsi_secondary_ip_addresses = IP_ADDRESSES +#driver_use_ssl = True +use_chap_auth = True +chap_username = pride +chap_password = 1234567890AB + +[database] +connection = mysql+pymysql://cinder:cinder_db_secret@controller/cinder + +[keystone_authtoken] +password = cinder_user_secret +username = cinder +project_name = service +user_domain_id = default +project_domain_id = default +auth_type = password +memcached_servers = controller:11211 +auth_url = http://controller:5000 +auth_uri = http://controller:5000 + +[oslo_concurrency] +lock_path = /var/lib/cinder/tmp diff --git a/openstack/openstack_conf/compute/cinder/logging.conf b/openstack/openstack_conf/compute/cinder/logging.conf new file mode 100755 index 0000000..476425b --- /dev/null +++ b/openstack/openstack_conf/compute/cinder/logging.conf @@ -0,0 +1,76 @@ +[loggers] +keys = root, cinder + +[handlers] +keys = stderr, stdout, watchedfile, syslog, null + +[formatters] +keys = legacycinder, default + +[logger_root] +level = WARNING +handlers = null + +[logger_cinder] +level = INFO +handlers = stderr +qualname = cinder + +[logger_amqplib] +level = WARNING +handlers = stderr +qualname = amqplib + +[logger_sqlalchemy] +level = WARNING +handlers = stderr +qualname = sqlalchemy +# "level = INFO" logs SQL queries. +# "level = DEBUG" logs SQL queries and results. +# "level = WARNING" logs neither. (Recommended for production systems.) + +[logger_boto] +level = WARNING +handlers = stderr +qualname = boto + +[logger_suds] +level = INFO +handlers = stderr +qualname = suds + +[logger_eventletwsgi] +level = WARNING +handlers = stderr +qualname = eventlet.wsgi.server + +[handler_stderr] +class = StreamHandler +args = (sys.stderr,) +formatter = legacycinder + +[handler_stdout] +class = StreamHandler +args = (sys.stdout,) +formatter = legacycinder + +[handler_watchedfile] +class = handlers.WatchedFileHandler +args = ('cinder.log',) +formatter = legacycinder + +[handler_syslog] +class = handlers.SysLogHandler +args = ('/dev/log', handlers.SysLogHandler.LOG_USER) +formatter = legacycinder + +[handler_null] +class = cinder.log.NullHandler +formatter = default +args = () + +[formatter_legacycinder] +class = cinder.log.LegacyCinderFormatter + +[formatter_default] +format = %(message)s diff --git a/openstack/openstack_conf/compute/cinder/rootwrap.conf b/openstack/openstack_conf/compute/cinder/rootwrap.conf new file mode 100755 index 0000000..bf41bbd --- /dev/null +++ b/openstack/openstack_conf/compute/cinder/rootwrap.conf @@ -0,0 +1,27 @@ +# Configuration for cinder-rootwrap +# This file should be owned by (and only-writeable by) the root user + +[DEFAULT] +# List of directories to load filter definitions from (separated by ','). +# These directories MUST all be only writeable by root ! +filters_path=/etc/cinder/rootwrap.d,/usr/share/cinder/rootwrap + +# List of directories to search executables in, in case filters do not +# explicitely specify a full path (separated by ',') +# If not specified, defaults to system PATH environment variable. +# These directories MUST all be only writeable by root ! +exec_dirs=/sbin,/usr/sbin,/bin,/usr/bin,/usr/local/bin,/usr/local/sbin,/usr/lpp/mmfs/bin + +# Enable logging to syslog +# Default value is False +use_syslog=False + +# Which syslog facility to use. +# Valid values include auth, authpriv, syslog, local0, local1... +# Default value is 'syslog' +syslog_log_facility=syslog + +# Which messages to log. +# INFO means log all usage +# ERROR means only log unsuccessful attempts +syslog_log_level=ERROR diff --git a/openstack/openstack_conf/compute/cinder/rootwrap.d/volume.filters b/openstack/openstack_conf/compute/cinder/rootwrap.d/volume.filters new file mode 100755 index 0000000..733bc9b --- /dev/null +++ b/openstack/openstack_conf/compute/cinder/rootwrap.d/volume.filters @@ -0,0 +1,234 @@ +# cinder-rootwrap command filters for volume nodes +# This file should be owned by (and only-writeable by) the root user + +[Filters] +# cinder/volume/iscsi.py: iscsi_helper '--op' ... +ietadm: CommandFilter, ietadm, root +tgtadm: CommandFilter, tgtadm, root +iscsictl: CommandFilter, iscsictl, root +tgt-admin: CommandFilter, tgt-admin, root +cinder-rtstool: CommandFilter, cinder-rtstool, root +scstadmin: CommandFilter, scstadmin, root + +# HyperScale command to handle cinder operations +hscli: CommandFilter, hscli, root + +# LVM related show commands +pvs: EnvFilter, env, root, LC_ALL=C, pvs +vgs: EnvFilter, env, root, LC_ALL=C, vgs +lvs: EnvFilter, env, root, LC_ALL=C, lvs +lvdisplay: EnvFilter, env, root, LC_ALL=C, lvdisplay + +# -LVM related show commands with suppress fd warnings +pvs2: EnvFilter, env, root, LC_ALL=C, LVM_SUPPRESS_FD_WARNINGS=, pvs +vgs2: EnvFilter, env, root, LC_ALL=C, LVM_SUPPRESS_FD_WARNINGS=, vgs +lvs2: EnvFilter, env, root, LC_ALL=C, LVM_SUPPRESS_FD_WARNINGS=, lvs +lvdisplay2: EnvFilter, env, root, LC_ALL=C, LVM_SUPPRESS_FD_WARNINGS=, lvdisplay + + +# -LVM related show commands conf var +pvs3: EnvFilter, env, root, LC_ALL=C, LVM_SYSTEM_DIR=, pvs +vgs3: EnvFilter, env, root, LC_ALL=C, LVM_SYSTEM_DIR=, vgs +lvs3: EnvFilter, env, root, LC_ALL=C, LVM_SYSTEM_DIR=, lvs +lvdisplay3: EnvFilter, env, root, LC_ALL=C, LVM_SYSTEM_DIR=, lvdisplay + +# -LVM conf var with suppress fd_warnings +pvs4: EnvFilter, env, root, LC_ALL=C, LVM_SYSTEM_DIR=, LVM_SUPPRESS_FD_WARNINGS=, pvs +vgs4: EnvFilter, env, root, LC_ALL=C, LVM_SYSTEM_DIR=, LVM_SUPPRESS_FD_WARNINGS=, vgs +lvs4: EnvFilter, env, root, LC_ALL=C, LVM_SYSTEM_DIR=, LVM_SUPPRESS_FD_WARNINGS=, lvs +lvdisplay4: EnvFilter, env, root, LC_ALL=C, LVM_SYSTEM_DIR=, LVM_SUPPRESS_FD_WARNINGS=, lvdisplay + +# os-brick library commands +# os_brick.privileged.run_as_root oslo.privsep context +# This line ties the superuser privs with the config files, context name, +# and (implicitly) the actual python code invoked. +privsep-rootwrap: RegExpFilter, privsep-helper, root, privsep-helper, --config-file, /etc/(?!\.\.).*, --privsep_context, os_brick.privileged.default, --privsep_sock_path, /tmp/.* +# The following and any cinder/brick/* entries should all be obsoleted +# by privsep, and may be removed once the os-brick version requirement +# is updated appropriately. +scsi_id: CommandFilter, /lib/udev/scsi_id, root +drbdadm: CommandFilter, drbdadm, root + +# cinder/brick/local_dev/lvm.py: 'vgcreate', vg_name, pv_list +vgcreate: CommandFilter, vgcreate, root + +# cinder/brick/local_dev/lvm.py: 'lvcreate', '-L', sizestr, '-n', volume_name,.. +# cinder/brick/local_dev/lvm.py: 'lvcreate', '-L', ... +lvcreate: EnvFilter, env, root, LC_ALL=C, lvcreate +lvcreate_lvmconf: EnvFilter, env, root, LVM_SYSTEM_DIR=, LC_ALL=C, lvcreate +lvcreate_fdwarn: EnvFilter, env, root, LC_ALL=C, LVM_SUPPRESS_FD_WARNINGS=, lvcreate +lvcreate_lvmconf_fdwarn: EnvFilter, env, root, LVM_SYSTEM_DIR=, LVM_SUPPRESS_FD_WARNINGS=, LC_ALL=C, lvcreate + +# cinder/volume/driver.py: 'dd', 'if=%s' % srcstr, 'of=%s' % deststr,... +dd: CommandFilter, dd, root + +# cinder/volume/driver.py: 'lvremove', '-f', %s/%s % ... +lvremove: CommandFilter, lvremove, root + +# cinder/volume/driver.py: 'lvrename', '%(vg)s', '%(orig)s' '(new)s'... +lvrename: CommandFilter, lvrename, root + +# cinder/brick/local_dev/lvm.py: 'lvextend', '-L' '%(new_size)s', '%(lv_name)s' ... +# cinder/brick/local_dev/lvm.py: 'lvextend', '-L' '%(new_size)s', '%(thin_pool)s' ... +lvextend: EnvFilter, env, root, LC_ALL=C, lvextend +lvextend_lvmconf: EnvFilter, env, root, LVM_SYSTEM_DIR=, LC_ALL=C, lvextend +lvextend_fdwarn: EnvFilter, env, root, LC_ALL=C, LVM_SUPPRESS_FD_WARNINGS=, lvextend +lvextend_lvmconf_fdwarn: EnvFilter, env, root, LVM_SYSTEM_DIR=, LC_ALL=C, LVM_SUPPRESS_FD_WARNINGS=, lvextend + +# cinder/brick/local_dev/lvm.py: 'lvchange -a y -K ' +lvchange: CommandFilter, lvchange, root + +# cinder/brick/local_dev/lvm.py: 'lvconvert', '--merge', snapshot_name +lvconvert: CommandFilter, lvconvert, root + +# cinder/volume/driver.py: 'iscsiadm', '-m', 'discovery', '-t',... +# cinder/volume/driver.py: 'iscsiadm', '-m', 'node', '-T', ... +iscsiadm: CommandFilter, iscsiadm, root + +# cinder/volume/utils.py: utils.temporary_chown(path, 0) +chown: CommandFilter, chown, root + +# cinder/volume/utils.py: copy_volume(..., ionice='...') +ionice_1: ChainingRegExpFilter, ionice, root, ionice, -c[0-3], -n[0-7] +ionice_2: ChainingRegExpFilter, ionice, root, ionice, -c[0-3] + +# cinder/volume/utils.py: setup_blkio_cgroup() +cgcreate: CommandFilter, cgcreate, root +cgset: CommandFilter, cgset, root +cgexec: ChainingRegExpFilter, cgexec, root, cgexec, -g, blkio:\S+ + +# cinder/volume/driver.py +dmsetup: CommandFilter, dmsetup, root +ln: CommandFilter, ln, root + +# cinder/image/image_utils.py +qemu-img: EnvFilter, env, root, LC_ALL=C, qemu-img +qemu-img_convert: CommandFilter, qemu-img, root + +udevadm: CommandFilter, udevadm, root + +# cinder/volume/driver.py: utils.read_file_as_root() +cat: CommandFilter, cat, root + +# cinder/volume/nfs.py +stat: CommandFilter, stat, root +mount: CommandFilter, mount, root +df: CommandFilter, df, root +du: CommandFilter, du, root +truncate: CommandFilter, truncate, root +chmod: CommandFilter, chmod, root +rm: CommandFilter, rm, root + +# cinder/volume/drivers/remotefs.py +mkdir: CommandFilter, mkdir, root + +# cinder/volume/drivers/netapp/dataontap/nfs_base.py: +netapp_nfs_find: RegExpFilter, find, root, find, ^[/]*([^/\0]+(/+)?)*$, -maxdepth, \d+, -name, img-cache.*, -amin, \+\d+ +netapp_nfs_touch: CommandFilter, touch, root + +# cinder/volume/drivers/glusterfs.py +chgrp: CommandFilter, chgrp, root +umount: CommandFilter, umount, root + +# cinder/volumes/drivers/hds/hds.py: +hus-cmd: CommandFilter, hus-cmd, root +hus-cmd_local: CommandFilter, /usr/local/bin/hus-cmd, root + +# cinder/volumes/drivers/hds/hnas_backend.py +ssc: CommandFilter, ssc, root + +# cinder/brick/initiator/connector.py: +ls: CommandFilter, ls, root +tee: CommandFilter, tee, root +multipath: CommandFilter, multipath, root +multipathd: CommandFilter, multipathd, root +systool: CommandFilter, systool, root + +# cinder/volume/drivers/block_device.py +blockdev: CommandFilter, blockdev, root + +# cinder/volume/drivers/ibm/gpfs.py +# cinder/volume/drivers/tintri.py +# cinder/volume/drivers/netapp/dataontap/nfs_base.py +mv: CommandFilter, mv, root + +# cinder/volume/drivers/ibm/gpfs.py +cp: CommandFilter, cp, root +mmgetstate: CommandFilter, mmgetstate, root +mmclone: CommandFilter, mmclone, root +mmlsattr: CommandFilter, mmlsattr, root +mmchattr: CommandFilter, mmchattr, root +mmlsconfig: CommandFilter, mmlsconfig, root +mmlsfs: CommandFilter, mmlsfs, root +mmlspool: CommandFilter, mmlspool, root +mkfs: CommandFilter, mkfs, root +mmcrfileset: CommandFilter, mmcrfileset, root +mmlsfileset: CommandFilter, mmlsfileset, root +mmlinkfileset: CommandFilter, mmlinkfileset, root +mmunlinkfileset: CommandFilter, mmunlinkfileset, root +mmdelfileset: CommandFilter, mmdelfileset, root +mmcrsnapshot: CommandFilter, mmcrsnapshot, root +mmdelsnapshot: CommandFilter, mmdelsnapshot, root + +# cinder/volume/drivers/ibm/gpfs.py +# cinder/volume/drivers/ibm/ibmnas.py +find_maxdepth_inum: RegExpFilter, find, root, find, ^[/]*([^/\0]+(/+)?)*$, -maxdepth, \d+, -ignore_readdir_race, -inum, \d+, -print0, -quit + +# cinder/brick/initiator/connector.py: +aoe-revalidate: CommandFilter, aoe-revalidate, root +aoe-discover: CommandFilter, aoe-discover, root +aoe-flush: CommandFilter, aoe-flush, root + +# cinder/brick/initiator/linuxscsi.py: +sg_scan: CommandFilter, sg_scan, root + +#cinder/backup/services/tsm.py +dsmc:CommandFilter,/usr/bin/dsmc,root + +# cinder/volume/drivers/hitachi/hbsd_horcm.py +raidqry: CommandFilter, raidqry, root +raidcom: CommandFilter, raidcom, root +pairsplit: CommandFilter, pairsplit, root +paircreate: CommandFilter, paircreate, root +pairdisplay: CommandFilter, pairdisplay, root +pairevtwait: CommandFilter, pairevtwait, root +horcmstart.sh: CommandFilter, horcmstart.sh, root +horcmshutdown.sh: CommandFilter, horcmshutdown.sh, root +horcmgr: EnvFilter, env, root, HORCMINST=, /etc/horcmgr + +# cinder/volume/drivers/hitachi/hbsd_snm2.py +auman: EnvFilter, env, root, LANG=, STONAVM_HOME=, LD_LIBRARY_PATH=, STONAVM_RSP_PASS=, STONAVM_ACT=, /usr/stonavm/auman +auluref: EnvFilter, env, root, LANG=, STONAVM_HOME=, LD_LIBRARY_PATH=, STONAVM_RSP_PASS=, STONAVM_ACT=, /usr/stonavm/auluref +auhgdef: EnvFilter, env, root, LANG=, STONAVM_HOME=, LD_LIBRARY_PATH=, STONAVM_RSP_PASS=, STONAVM_ACT=, /usr/stonavm/auhgdef +aufibre1: EnvFilter, env, root, LANG=, STONAVM_HOME=, LD_LIBRARY_PATH=, STONAVM_RSP_PASS=, STONAVM_ACT=, /usr/stonavm/aufibre1 +auhgwwn: EnvFilter, env, root, LANG=, STONAVM_HOME=, LD_LIBRARY_PATH=, STONAVM_RSP_PASS=, STONAVM_ACT=, /usr/stonavm/auhgwwn +auhgmap: EnvFilter, env, root, LANG=, STONAVM_HOME=, LD_LIBRARY_PATH=, STONAVM_RSP_PASS=, STONAVM_ACT=, /usr/stonavm/auhgmap +autargetmap: EnvFilter, env, root, LANG=, STONAVM_HOME=, LD_LIBRARY_PATH=, STONAVM_RSP_PASS=, STONAVM_ACT=, /usr/stonavm/autargetmap +aureplicationvvol: EnvFilter, env, root, LANG=, STONAVM_HOME=, LD_LIBRARY_PATH=, STONAVM_RSP_PASS=, STONAVM_ACT=, /usr/stonavm/aureplicationvvol +auluadd: EnvFilter, env, root, LANG=, STONAVM_HOME=, LD_LIBRARY_PATH=, STONAVM_RSP_PASS=, STONAVM_ACT=, /usr/stonavm/auluadd +auludel: EnvFilter, env, root, LANG=, STONAVM_HOME=, LD_LIBRARY_PATH=, STONAVM_RSP_PASS=, STONAVM_ACT=, /usr/stonavm/auludel +auluchgsize: EnvFilter, env, root, LANG=, STONAVM_HOME=, LD_LIBRARY_PATH=, STONAVM_RSP_PASS=, STONAVM_ACT=, /usr/stonavm/auluchgsize +auchapuser: EnvFilter, env, root, LANG=, STONAVM_HOME=, LD_LIBRARY_PATH=, STONAVM_RSP_PASS=, STONAVM_ACT=, /usr/stonavm/auchapuser +autargetdef: EnvFilter, env, root, LANG=, STONAVM_HOME=, LD_LIBRARY_PATH=, STONAVM_RSP_PASS=, STONAVM_ACT=, /usr/stonavm/autargetdef +autargetopt: EnvFilter, env, root, LANG=, STONAVM_HOME=, LD_LIBRARY_PATH=, STONAVM_RSP_PASS=, STONAVM_ACT=, /usr/stonavm/autargetopt +autargetini: EnvFilter, env, root, LANG=, STONAVM_HOME=, LD_LIBRARY_PATH=, STONAVM_RSP_PASS=, STONAVM_ACT=, /usr/stonavm/autargetini +auiscsi: EnvFilter, env, root, LANG=, STONAVM_HOME=, LD_LIBRARY_PATH=, STONAVM_RSP_PASS=, STONAVM_ACT=, /usr/stonavm/auiscsi +audppool: EnvFilter, env, root, LANG=, STONAVM_HOME=, LD_LIBRARY_PATH=, STONAVM_RSP_PASS=, STONAVM_ACT=, /usr/stonavm/audppool +aureplicationlocal: EnvFilter, env, root, LANG=, STONAVM_HOME=, LD_LIBRARY_PATH=, STONAVM_RSP_PASS=, STONAVM_ACT=, /usr/stonavm/aureplicationlocal +aureplicationmon: EnvFilter, env, root, LANG=, STONAVM_HOME=, LD_LIBRARY_PATH=, STONAVM_RSP_PASS=, STONAVM_ACT=, /usr/stonavm/aureplicationmon + +# cinder/volume/drivers/hgst.py +vgc-cluster: CommandFilter, vgc-cluster, root + +# cinder/volume/drivers/vzstorage.py +pstorage-mount: CommandFilter, pstorage-mount, root +pstorage: CommandFilter, pstorage, root +ploop: CommandFilter, ploop, root + +# initiator/connector.py: +drv_cfg: CommandFilter, /opt/emc/scaleio/sdc/bin/drv_cfg, root, /opt/emc/scaleio/sdc/bin/drv_cfg, --query_guid + +# cinder/volume/drivers/quobyte.py +mount.quobyte: CommandFilter, mount.quobyte, root +umount.quobyte: CommandFilter, umount.quobyte, root + diff --git a/openstack/openstack_conf/compute/neutron/api-paste.ini b/openstack/openstack_conf/compute/neutron/api-paste.ini new file mode 100644 index 0000000..f79088c --- /dev/null +++ b/openstack/openstack_conf/compute/neutron/api-paste.ini @@ -0,0 +1,45 @@ +[composite:neutron] +use = egg:Paste#urlmap +/: neutronversions_composite +/v2.0: neutronapi_v2_0 + +[composite:neutronapi_v2_0] +use = call:neutron.auth:pipeline_factory +noauth = cors http_proxy_to_wsgi request_id catch_errors extensions neutronapiapp_v2_0 +keystone = cors http_proxy_to_wsgi request_id catch_errors authtoken keystonecontext extensions neutronapiapp_v2_0 + +[composite:neutronversions_composite] +use = call:neutron.auth:pipeline_factory +noauth = cors http_proxy_to_wsgi neutronversions +keystone = cors http_proxy_to_wsgi neutronversions + +[filter:request_id] +paste.filter_factory = oslo_middleware:RequestId.factory + +[filter:catch_errors] +paste.filter_factory = oslo_middleware:CatchErrors.factory + +[filter:cors] +paste.filter_factory = oslo_middleware.cors:filter_factory +oslo_config_project = neutron + +[filter:http_proxy_to_wsgi] +paste.filter_factory = oslo_middleware.http_proxy_to_wsgi:HTTPProxyToWSGI.factory + +[filter:keystonecontext] +paste.filter_factory = neutron.auth:NeutronKeystoneContext.factory + +[filter:authtoken] +paste.filter_factory = keystonemiddleware.auth_token:filter_factory + +[filter:extensions] +paste.filter_factory = neutron.api.extensions:plugin_aware_extension_middleware_factory + +[app:neutronversions] +paste.app_factory = neutron.pecan_wsgi.app:versions_factory + +[app:neutronapiapp_v2_0] +paste.app_factory = neutron.api.v2.router:APIRouter.factory + +[filter:osprofiler] +paste.filter_factory = osprofiler.web:WsgiMiddleware.factory diff --git a/openstack/openstack_conf/compute/neutron/fwaas_driver.ini b/openstack/openstack_conf/compute/neutron/fwaas_driver.ini new file mode 100644 index 0000000..a707978 --- /dev/null +++ b/openstack/openstack_conf/compute/neutron/fwaas_driver.ini @@ -0,0 +1,23 @@ +[DEFAULT] + + +[fwaas] + +# +# From firewall.agent +# + +# Name of the FWaaS Driver (string value) +#driver = + +# Enable FWaaS (boolean value) +#enabled = false + +# Firewall agent class (string value) +#agent_version = v2 + +# Name of the FWaaS Conntrack Driver (string value) +#conntrack_driver = conntrack + +# Name of the firewall l2 driver (string value) +#firewall_l2_driver = noop diff --git a/openstack/openstack_conf/compute/neutron/l3_agent.ini b/openstack/openstack_conf/compute/neutron/l3_agent.ini new file mode 100644 index 0000000..c963007 --- /dev/null +++ b/openstack/openstack_conf/compute/neutron/l3_agent.ini @@ -0,0 +1,344 @@ +[DEFAULT] + +# +# From neutron.base.agent +# + +# Name of Open vSwitch bridge to use (string value) +#ovs_integration_bridge = br-int + +# Uses veth for an OVS interface or not. Support kernels with limited namespace +# support (e.g. RHEL 6.5) and rate limiting on router's gateway port so long as +# ovs_use_veth is set to True. (boolean value) +#ovs_use_veth = false + +# The driver used to manage the virtual interface. (string value) +#interface_driver = + +# +# From neutron.l3.agent +# + +# The working mode for the agent. Allowed modes are: 'legacy' - this preserves +# the existing behavior where the L3 agent is deployed on a centralized +# networking node to provide L3 services like DNAT, and SNAT. Use this mode if +# you do not want to adopt DVR. 'dvr' - this mode enables DVR functionality and +# must be used for an L3 agent that runs on a compute host. 'dvr_snat' - this +# enables centralized SNAT support in conjunction with DVR. This mode must be +# used for an L3 agent running on a centralized node (or in single-host +# deployments, e.g. devstack). 'dvr_no_external' - this mode enables only +# East/West DVR routing functionality for a L3 agent that runs on a compute +# host, the North/South functionality such as DNAT and SNAT will be provided by +# the centralized network node that is running in 'dvr_snat' mode. This mode +# should be used when there is no external network connectivity on the compute +# host. (string value) +# Possible values: +# dvr - +# dvr_snat - +# legacy - +# dvr_no_external - +#agent_mode = legacy + +# TCP Port used by Neutron metadata namespace proxy. (port value) +# Minimum value: 0 +# Maximum value: 65535 +#metadata_port = 9697 + +# Indicates that this L3 agent should also handle routers that do not have an +# external network gateway configured. This option should be True only for a +# single agent in a Neutron deployment, and may be False for all agents if all +# routers must have an external network gateway. (boolean value) +#handle_internal_only_routers = true + +# DEPRECATED: When external_network_bridge is set, each L3 agent can be +# associated with no more than one external network. This value should be set +# to the UUID of that external network. To allow L3 agent support multiple +# external networks, both the external_network_bridge and +# gateway_external_network_id must be left empty. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +#gateway_external_network_id = + +# With IPv6, the network used for the external gateway does not need to have an +# associated subnet, since the automatically assigned link-local address (LLA) +# can be used. However, an IPv6 gateway address is needed for use as the next- +# hop for the default route. If no IPv6 gateway address is configured here, +# (and only then) the neutron router will be configured to get its default +# route from router advertisements (RAs) from the upstream router; in which +# case the upstream router must also be configured to send these RAs. The +# ipv6_gateway, when configured, should be the LLA of the interface on the +# upstream router. If a next-hop using a global unique address (GUA) is +# desired, it needs to be done via a subnet allocated to the network and not +# through this parameter. (string value) +#ipv6_gateway = + +# Driver used for ipv6 prefix delegation. This needs to be an entry point +# defined in the neutron.agent.linux.pd_drivers namespace. See setup.cfg for +# entry points included with the neutron source. (string value) +#prefix_delegation_driver = dibbler + +# Allow running metadata proxy. (boolean value) +#enable_metadata_proxy = true + +# Iptables mangle mark used to mark metadata valid requests. This mark will be +# masked with 0xffff so that only the lower 16 bits will be used. (string +# value) +#metadata_access_mark = 0x1 + +# Iptables mangle mark used to mark ingress from external network. This mark +# will be masked with 0xffff so that only the lower 16 bits will be used. +# (string value) +#external_ingress_mark = 0x2 + +# DEPRECATED: Name of bridge used for external network traffic. When this +# parameter is set, the L3 agent will plug an interface directly into an +# external bridge which will not allow any wiring by the L2 agent. Using this +# will result in incorrect port statuses. This option is deprecated and will be +# removed in Ocata. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +#external_network_bridge = + +# Seconds between running periodic tasks. (integer value) +#periodic_interval = 40 + +# Number of separate API worker processes for service. If not specified, the +# default is equal to the number of CPUs available for best performance. +# (integer value) +#api_workers = + +# Number of RPC worker processes for service. (integer value) +#rpc_workers = 1 + +# Number of RPC worker processes dedicated to state reports queue. (integer +# value) +#rpc_state_report_workers = 1 + +# Range of seconds to randomly delay when starting the periodic task scheduler +# to reduce stampeding. (Disable by setting to 0) (integer value) +#periodic_fuzzy_delay = 5 + +# Location to store keepalived/conntrackd config files (string value) +#ha_confs_path = $state_path/ha_confs + +# VRRP authentication type (string value) +# Possible values: +# AH - +# PASS - +#ha_vrrp_auth_type = PASS + +# VRRP authentication password (string value) +#ha_vrrp_auth_password = + +# The advertisement interval in seconds (integer value) +#ha_vrrp_advert_int = 2 + +# Number of concurrent threads for keepalived server connection requests. More +# threads create a higher CPU load on the agent node. (integer value) +# Minimum value: 1 +#ha_keepalived_state_change_server_threads = (1 + ) / 2 + +# The VRRP health check interval in seconds. Values > 0 enable VRRP health +# checks. Setting it to 0 disables VRRP health checks. Recommended value is 5. +# This will cause pings to be sent to the gateway IP address(es) - requires +# ICMP_ECHO_REQUEST to be enabled on the gateway. If gateway fails, all routers +# will be reported as master, and master election will be repeated in round- +# robin fashion, until one of the router restore the gateway connection. +# (integer value) +#ha_vrrp_health_check_interval = 0 + +# Location to store IPv6 PD files. (string value) +#pd_confs = $state_path/pd + +# A decimal value as Vendor's Registered Private Enterprise Number as required +# by RFC3315 DUID-EN. (string value) +#vendor_pen = 8888 + +# Location to store IPv6 RA config files (string value) +#ra_confs = $state_path/ra + +# MinRtrAdvInterval setting for radvd.conf (integer value) +#min_rtr_adv_interval = 30 + +# MaxRtrAdvInterval setting for radvd.conf (integer value) +#max_rtr_adv_interval = 100 + +# +# From oslo.log +# + +# If set to true, the logging level will be set to DEBUG instead of the default +# INFO level. (boolean value) +# Note: This option can be changed without restarting. +#debug = false + +# The name of a logging configuration file. This file is appended to any +# existing logging configuration files. For details about logging configuration +# files, see the Python logging module documentation. Note that when logging +# configuration files are used then all logging configuration is set in the +# configuration file and other logging configuration options are ignored (for +# example, logging_context_format_string). (string value) +# Note: This option can be changed without restarting. +# Deprecated group/name - [DEFAULT]/log_config +#log_config_append = + +# Defines the format string for %%(asctime)s in log records. Default: +# %(default)s . This option is ignored if log_config_append is set. (string +# value) +#log_date_format = %Y-%m-%d %H:%M:%S + +# (Optional) Name of log file to send logging output to. If no default is set, +# logging will go to stderr as defined by use_stderr. This option is ignored if +# log_config_append is set. (string value) +# Deprecated group/name - [DEFAULT]/logfile +#log_file = + +# (Optional) The base directory used for relative log_file paths. This option +# is ignored if log_config_append is set. (string value) +# Deprecated group/name - [DEFAULT]/logdir +#log_dir = + +# Uses logging handler designed to watch file system. When log file is moved or +# removed this handler will open a new log file with specified path +# instantaneously. It makes sense only if log_file option is specified and +# Linux platform is used. This option is ignored if log_config_append is set. +# (boolean value) +#watch_log_file = false + +# Use syslog for logging. Existing syslog format is DEPRECATED and will be +# changed later to honor RFC5424. This option is ignored if log_config_append +# is set. (boolean value) +#use_syslog = false + +# Enable journald for logging. If running in a systemd environment you may wish +# to enable journal support. Doing so will use the journal native protocol +# which includes structured metadata in addition to log messages.This option is +# ignored if log_config_append is set. (boolean value) +#use_journal = false + +# Syslog facility to receive log lines. This option is ignored if +# log_config_append is set. (string value) +#syslog_log_facility = LOG_USER + +# Use JSON formatting for logging. This option is ignored if log_config_append +# is set. (boolean value) +#use_json = false + +# Log output to standard error. This option is ignored if log_config_append is +# set. (boolean value) +#use_stderr = false + +# Format string to use for log messages with context. (string value) +#logging_context_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user_identity)s] %(instance)s%(message)s + +# Format string to use for log messages when context is undefined. (string +# value) +#logging_default_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [-] %(instance)s%(message)s + +# Additional data to append to log message when logging level for the message +# is DEBUG. (string value) +#logging_debug_format_suffix = %(funcName)s %(pathname)s:%(lineno)d + +# Prefix each line of exception output with this format. (string value) +#logging_exception_prefix = %(asctime)s.%(msecs)03d %(process)d ERROR %(name)s %(instance)s + +# Defines the format string for %(user_identity)s that is used in +# logging_context_format_string. (string value) +#logging_user_identity_format = %(user)s %(tenant)s %(domain)s %(user_domain)s %(project_domain)s + +# List of package logging levels in logger=LEVEL pairs. This option is ignored +# if log_config_append is set. (list value) +#default_log_levels = amqp=WARN,amqplib=WARN,boto=WARN,qpid=WARN,sqlalchemy=WARN,suds=INFO,oslo.messaging=INFO,oslo_messaging=INFO,iso8601=WARN,requests.packages.urllib3.connectionpool=WARN,urllib3.connectionpool=WARN,websocket=WARN,requests.packages.urllib3.util.retry=WARN,urllib3.util.retry=WARN,keystonemiddleware=WARN,routes.middleware=WARN,stevedore=WARN,taskflow=WARN,keystoneauth=WARN,oslo.cache=INFO,dogpile.core.dogpile=INFO + +# Enables or disables publication of error events. (boolean value) +#publish_errors = false + +# The format for an instance that is passed with the log message. (string +# value) +#instance_format = "[instance: %(uuid)s] " + +# The format for an instance UUID that is passed with the log message. (string +# value) +#instance_uuid_format = "[instance: %(uuid)s] " + +# Interval, number of seconds, of log rate limiting. (integer value) +#rate_limit_interval = 0 + +# Maximum number of logged messages per rate_limit_interval. (integer value) +#rate_limit_burst = 0 + +# Log level name used by rate limiting: CRITICAL, ERROR, INFO, WARNING, DEBUG +# or empty string. Logs with level greater or equal to rate_limit_except_level +# are not filtered. An empty string means that all levels are filtered. (string +# value) +#rate_limit_except_level = CRITICAL + +# Enables or disables fatal status of deprecations. (boolean value) +#fatal_deprecations = false + + +[agent] + +# +# From neutron.az.agent +# + +# Availability zone of this node (string value) +#availability_zone = nova + +# +# From neutron.base.agent +# + +# Seconds between nodes reporting state to server; should be less than +# agent_down_time, best if it is half or less than agent_down_time. (floating +# point value) +#report_interval = 30 + +# Log agent heartbeats (boolean value) +#log_agent_heartbeats = false + +# +# From neutron.l3.agent +# + +# Extensions list to use (list value) +#extensions = + + +[ovs] + +# +# From neutron.base.agent +# + +# DEPRECATED: The interface for interacting with the OVSDB (string value) +# Possible values: +# vsctl - +# native - +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +#ovsdb_interface = native + +# The connection string for the OVSDB backend. Will be used by ovsdb-client +# when monitoring and used for the all ovsdb commands when native +# ovsdb_interface is enabled (string value) +#ovsdb_connection = tcp:127.0.0.1:6640 + +# The SSL private key file to use when interacting with OVSDB. Required when +# using an "ssl:" prefixed ovsdb_connection (string value) +#ssl_key_file = + +# The SSL certificate file to use when interacting with OVSDB. Required when +# using an "ssl:" prefixed ovsdb_connection (string value) +#ssl_cert_file = + +# The Certificate Authority (CA) certificate to use when interacting with +# OVSDB. Required when using an "ssl:" prefixed ovsdb_connection (string +# value) +#ssl_ca_cert_file = + +# Timeout in seconds for ovsdb commands. If the timeout expires, ovsdb commands +# will fail with ALARMCLOCK error. (integer value) +# Deprecated group/name - [DEFAULT]/ovs_vsctl_timeout +#ovsdb_timeout = 10 diff --git a/openstack/openstack_conf/compute/neutron/neutron.conf b/openstack/openstack_conf/compute/neutron/neutron.conf new file mode 100755 index 0000000..736fe8b --- /dev/null +++ b/openstack/openstack_conf/compute/neutron/neutron.conf @@ -0,0 +1,2068 @@ +[DEFAULT] +auth_strategy = keystone +transport_url = rabbit://openstack:rabbitPass@controller +core_plugin = ml2 + +# +# From neutron +# + +# Where to store Neutron state files. This directory must be writable by the +# agent. (string value) +#state_path = /var/lib/neutron + +# The host IP to bind to. (unknown value) +#bind_host = 0.0.0.0 + +# The port to bind to (port value) +# Minimum value: 0 +# Maximum value: 65535 +#bind_port = 9696 + +# The path for API extensions. Note that this can be a colon-separated list of +# paths. For example: api_extensions_path = +# extensions:/path/to/more/exts:/even/more/exts. The __path__ of +# neutron.extensions is appended to this, so if your extensions are in there +# you don't need to specify them here. (string value) +#api_extensions_path = + +# The type of authentication to use (string value) +#auth_strategy = keystone + +# The core plugin Neutron will use (string value) +#core_plugin = + +# The service plugins Neutron will use (list value) +#service_plugins = + +# The base MAC address Neutron will use for VIFs. The first 3 octets will +# remain unchanged. If the 4th octet is not 00, it will also be used. The +# others will be randomly generated. (string value) +#base_mac = fa:16:3e:00:00:00 + +# Allow the usage of the bulk API (boolean value) +#allow_bulk = true + +# The maximum number of items returned in a single response, value was +# 'infinite' or negative integer means no limit (string value) +#pagination_max_limit = -1 + +# Default value of availability zone hints. The availability zone aware +# schedulers use this when the resources availability_zone_hints is empty. +# Multiple availability zones can be specified by a comma separated string. +# This value can be empty. In this case, even if availability_zone_hints for a +# resource is empty, availability zone is considered for high availability +# while scheduling the resource. (list value) +#default_availability_zones = + +# Maximum number of DNS nameservers per subnet (integer value) +#max_dns_nameservers = 5 + +# Maximum number of host routes per subnet (integer value) +#max_subnet_host_routes = 20 + +# Enables IPv6 Prefix Delegation for automatic subnet CIDR allocation. Set to +# True to enable IPv6 Prefix Delegation for subnet allocation in a PD-capable +# environment. Users making subnet creation requests for IPv6 subnets without +# providing a CIDR or subnetpool ID will be given a CIDR via the Prefix +# Delegation mechanism. Note that enabling PD will override the behavior of the +# default IPv6 subnetpool. (boolean value) +#ipv6_pd_enabled = false + +# DHCP lease duration (in seconds). Use -1 to tell dnsmasq to use infinite +# lease times. (integer value) +#dhcp_lease_duration = 86400 + +# Domain to use for building the hostnames (string value) +#dns_domain = openstacklocal + +# Driver for external DNS integration. (string value) +#external_dns_driver = + +# Allow sending resource operation notification to DHCP agent (boolean value) +#dhcp_agent_notification = true + +# Allow overlapping IP support in Neutron. Attention: the following parameter +# MUST be set to False if Neutron is being used in conjunction with Nova +# security groups. (boolean value) +#allow_overlapping_ips = false + +# Hostname to be used by the Neutron server, agents and services running on +# this machine. All the agents and services running on this machine must use +# the same host value. (unknown value) +#host = example.domain + +# This string is prepended to the normal URL that is returned in links to the +# OpenStack Network API. If it is empty (the default), the URLs are returned +# unchanged. (string value) +#network_link_prefix = + +# Send notification to nova when port status changes (boolean value) +#notify_nova_on_port_status_changes = true + +# Send notification to nova when port data (fixed_ips/floatingip) changes so +# nova can update its cache. (boolean value) +#notify_nova_on_port_data_changes = true + +# Number of seconds between sending events to nova if there are any events to +# send. (integer value) +#send_events_interval = 2 + +# Neutron IPAM (IP address management) driver to use. By default, the reference +# implementation of the Neutron IPAM driver is used. (string value) +#ipam_driver = internal + +# If True, then allow plugins that support it to create VLAN transparent +# networks. (boolean value) +#vlan_transparent = false + +# MTU of the underlying physical network. Neutron uses this value to calculate +# MTU for all virtual network components. For flat and VLAN networks, neutron +# uses this value without modification. For overlay networks such as VXLAN, +# neutron automatically subtracts the overlay protocol overhead from this +# value. Defaults to 1500, the standard value for Ethernet. (integer value) +# Deprecated group/name - [ml2]/segment_mtu +#global_physnet_mtu = 1500 + +# Number of backlog requests to configure the socket with (integer value) +#backlog = 4096 + +# Number of seconds to keep retrying to listen (integer value) +#retry_until_window = 30 + +# Enable SSL on the API server (boolean value) +#use_ssl = false + +# Seconds between running periodic tasks. (integer value) +#periodic_interval = 40 + +# Number of separate API worker processes for service. If not specified, the +# default is equal to the number of CPUs available for best performance. +# (integer value) +#api_workers = + +# Number of RPC worker processes for service. (integer value) +#rpc_workers = 1 + +# Number of RPC worker processes dedicated to state reports queue. (integer +# value) +#rpc_state_report_workers = 1 + +# Range of seconds to randomly delay when starting the periodic task scheduler +# to reduce stampeding. (Disable by setting to 0) (integer value) +#periodic_fuzzy_delay = 5 + +# +# From neutron.agent +# + +# The driver used to manage the virtual interface. (string value) +#interface_driver = + +# Location for Metadata Proxy UNIX domain socket. (string value) +#metadata_proxy_socket = $state_path/metadata_proxy + +# User (uid or name) running metadata proxy after its initialization (if empty: +# agent effective user). (string value) +#metadata_proxy_user = + +# Group (gid or name) running metadata proxy after its initialization (if +# empty: agent effective group). (string value) +#metadata_proxy_group = + +# +# From neutron.db +# + +# Seconds to regard the agent is down; should be at least twice +# report_interval, to be sure the agent is down for good. (integer value) +#agent_down_time = 75 + +# Representing the resource type whose load is being reported by the agent. +# This can be "networks", "subnets" or "ports". When specified (Default is +# networks), the server will extract particular load sent as part of its agent +# configuration object from the agent report state, which is the number of +# resources being consumed, at every report_interval.dhcp_load_type can be used +# in combination with network_scheduler_driver = +# neutron.scheduler.dhcp_agent_scheduler.WeightScheduler When the +# network_scheduler_driver is WeightScheduler, dhcp_load_type can be configured +# to represent the choice for the resource being balanced. Example: +# dhcp_load_type=networks (string value) +# Possible values: +# networks - +# subnets - +# ports - +#dhcp_load_type = networks + +# Agent starts with admin_state_up=False when enable_new_agents=False. In the +# case, user's resources will not be scheduled automatically to the agent until +# admin changes admin_state_up to True. (boolean value) +#enable_new_agents = true + +# Maximum number of routes per router (integer value) +#max_routes = 30 + +# Define the default value of enable_snat if not provided in +# external_gateway_info. (boolean value) +#enable_snat_by_default = true + +# Driver to use for scheduling network to DHCP agent (string value) +#network_scheduler_driver = neutron.scheduler.dhcp_agent_scheduler.WeightScheduler + +# Allow auto scheduling networks to DHCP agent. (boolean value) +#network_auto_schedule = true + +# Automatically remove networks from offline DHCP agents. (boolean value) +#allow_automatic_dhcp_failover = true + +# Number of DHCP agents scheduled to host a tenant network. If this number is +# greater than 1, the scheduler automatically assigns multiple DHCP agents for +# a given tenant network, providing high availability for DHCP service. +# (integer value) +#dhcp_agents_per_network = 1 + +# Enable services on an agent with admin_state_up False. If this option is +# False, when admin_state_up of an agent is turned False, services on it will +# be disabled. Agents with admin_state_up False are not selected for automatic +# scheduling regardless of this option. But manual scheduling to such agents is +# available if this option is True. (boolean value) +#enable_services_on_agents_with_admin_state_down = false + +# The base mac address used for unique DVR instances by Neutron. The first 3 +# octets will remain unchanged. If the 4th octet is not 00, it will also be +# used. The others will be randomly generated. The 'dvr_base_mac' *must* be +# different from 'base_mac' to avoid mixing them up with MAC's allocated for +# tenant ports. A 4 octet example would be dvr_base_mac = fa:16:3f:4f:00:00. +# The default is 3 octet (string value) +#dvr_base_mac = fa:16:3f:00:00:00 + +# System-wide flag to determine the type of router that tenants can create. +# Only admin can override. (boolean value) +#router_distributed = false + +# Determine if setup is configured for DVR. If False, DVR API extension will be +# disabled. (boolean value) +#enable_dvr = true + +# Driver to use for scheduling router to a default L3 agent (string value) +#router_scheduler_driver = neutron.scheduler.l3_agent_scheduler.LeastRoutersScheduler + +# Allow auto scheduling of routers to L3 agent. (boolean value) +#router_auto_schedule = true + +# Automatically reschedule routers from offline L3 agents to online L3 agents. +# (boolean value) +#allow_automatic_l3agent_failover = false + +# Enable HA mode for virtual routers. (boolean value) +#l3_ha = false + +# Maximum number of L3 agents which a HA router will be scheduled on. If it is +# set to 0 then the router will be scheduled on every agent. (integer value) +#max_l3_agents_per_router = 3 + +# Subnet used for the l3 HA admin network. (string value) +#l3_ha_net_cidr = 169.254.192.0/18 + +# The network type to use when creating the HA network for an HA router. By +# default or if empty, the first 'tenant_network_types' is used. This is +# helpful when the VRRP traffic should use a specific network which is not the +# default one. (string value) +#l3_ha_network_type = + +# The physical network name with which the HA network can be created. (string +# value) +#l3_ha_network_physical_name = + +# +# From neutron.extensions +# + +# Maximum number of allowed address pairs (integer value) +#max_allowed_address_pair = 10 + +# +# From oslo.log +# + +# If set to true, the logging level will be set to DEBUG instead of the default +# INFO level. (boolean value) +# Note: This option can be changed without restarting. +#debug = false + +# The name of a logging configuration file. This file is appended to any +# existing logging configuration files. For details about logging configuration +# files, see the Python logging module documentation. Note that when logging +# configuration files are used then all logging configuration is set in the +# configuration file and other logging configuration options are ignored (for +# example, logging_context_format_string). (string value) +# Note: This option can be changed without restarting. +# Deprecated group/name - [DEFAULT]/log_config +#log_config_append = + +# Defines the format string for %%(asctime)s in log records. Default: +# %(default)s . This option is ignored if log_config_append is set. (string +# value) +#log_date_format = %Y-%m-%d %H:%M:%S + +# (Optional) Name of log file to send logging output to. If no default is set, +# logging will go to stderr as defined by use_stderr. This option is ignored if +# log_config_append is set. (string value) +# Deprecated group/name - [DEFAULT]/logfile +#log_file = + +# (Optional) The base directory used for relative log_file paths. This option +# is ignored if log_config_append is set. (string value) +# Deprecated group/name - [DEFAULT]/logdir +#log_dir = + +# Uses logging handler designed to watch file system. When log file is moved or +# removed this handler will open a new log file with specified path +# instantaneously. It makes sense only if log_file option is specified and +# Linux platform is used. This option is ignored if log_config_append is set. +# (boolean value) +#watch_log_file = false + +# Use syslog for logging. Existing syslog format is DEPRECATED and will be +# changed later to honor RFC5424. This option is ignored if log_config_append +# is set. (boolean value) +#use_syslog = false + +# Enable journald for logging. If running in a systemd environment you may wish +# to enable journal support. Doing so will use the journal native protocol +# which includes structured metadata in addition to log messages.This option is +# ignored if log_config_append is set. (boolean value) +#use_journal = false + +# Syslog facility to receive log lines. This option is ignored if +# log_config_append is set. (string value) +#syslog_log_facility = LOG_USER + +# Use JSON formatting for logging. This option is ignored if log_config_append +# is set. (boolean value) +#use_json = false + +# Log output to standard error. This option is ignored if log_config_append is +# set. (boolean value) +#use_stderr = false + +# Format string to use for log messages with context. (string value) +#logging_context_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user_identity)s] %(instance)s%(message)s + +# Format string to use for log messages when context is undefined. (string +# value) +#logging_default_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [-] %(instance)s%(message)s + +# Additional data to append to log message when logging level for the message +# is DEBUG. (string value) +#logging_debug_format_suffix = %(funcName)s %(pathname)s:%(lineno)d + +# Prefix each line of exception output with this format. (string value) +#logging_exception_prefix = %(asctime)s.%(msecs)03d %(process)d ERROR %(name)s %(instance)s + +# Defines the format string for %(user_identity)s that is used in +# logging_context_format_string. (string value) +#logging_user_identity_format = %(user)s %(tenant)s %(domain)s %(user_domain)s %(project_domain)s + +# List of package logging levels in logger=LEVEL pairs. This option is ignored +# if log_config_append is set. (list value) +#default_log_levels = amqp=WARN,amqplib=WARN,boto=WARN,qpid=WARN,sqlalchemy=WARN,suds=INFO,oslo.messaging=INFO,oslo_messaging=INFO,iso8601=WARN,requests.packages.urllib3.connectionpool=WARN,urllib3.connectionpool=WARN,websocket=WARN,requests.packages.urllib3.util.retry=WARN,urllib3.util.retry=WARN,keystonemiddleware=WARN,routes.middleware=WARN,stevedore=WARN,taskflow=WARN,keystoneauth=WARN,oslo.cache=INFO,dogpile.core.dogpile=INFO + +# Enables or disables publication of error events. (boolean value) +#publish_errors = false + +# The format for an instance that is passed with the log message. (string +# value) +#instance_format = "[instance: %(uuid)s] " + +# The format for an instance UUID that is passed with the log message. (string +# value) +#instance_uuid_format = "[instance: %(uuid)s] " + +# Interval, number of seconds, of log rate limiting. (integer value) +#rate_limit_interval = 0 + +# Maximum number of logged messages per rate_limit_interval. (integer value) +#rate_limit_burst = 0 + +# Log level name used by rate limiting: CRITICAL, ERROR, INFO, WARNING, DEBUG +# or empty string. Logs with level greater or equal to rate_limit_except_level +# are not filtered. An empty string means that all levels are filtered. (string +# value) +#rate_limit_except_level = CRITICAL + +# Enables or disables fatal status of deprecations. (boolean value) +#fatal_deprecations = false + +# +# From oslo.messaging +# + +# Size of RPC connection pool. (integer value) +#rpc_conn_pool_size = 30 + +# The pool size limit for connections expiration policy (integer value) +#conn_pool_min_size = 2 + +# The time-to-live in sec of idle connections in the pool (integer value) +#conn_pool_ttl = 1200 + +# ZeroMQ bind address. Should be a wildcard (*), an ethernet interface, or IP. +# The "host" option should point or resolve to this address. (string value) +#rpc_zmq_bind_address = * + +# MatchMaker driver. (string value) +# Possible values: +# redis - +# sentinel - +# dummy - +#rpc_zmq_matchmaker = redis + +# Number of ZeroMQ contexts, defaults to 1. (integer value) +#rpc_zmq_contexts = 1 + +# Maximum number of ingress messages to locally buffer per topic. Default is +# unlimited. (integer value) +#rpc_zmq_topic_backlog = + +# Directory for holding IPC sockets. (string value) +#rpc_zmq_ipc_dir = /var/run/openstack + +# Name of this node. Must be a valid hostname, FQDN, or IP address. Must match +# "host" option, if running Nova. (string value) +#rpc_zmq_host = localhost + +# Number of seconds to wait before all pending messages will be sent after +# closing a socket. The default value of -1 specifies an infinite linger +# period. The value of 0 specifies no linger period. Pending messages shall be +# discarded immediately when the socket is closed. Positive values specify an +# upper bound for the linger period. (integer value) +# Deprecated group/name - [DEFAULT]/rpc_cast_timeout +#zmq_linger = -1 + +# The default number of seconds that poll should wait. Poll raises timeout +# exception when timeout expired. (integer value) +#rpc_poll_timeout = 1 + +# Expiration timeout in seconds of a name service record about existing target +# ( < 0 means no timeout). (integer value) +#zmq_target_expire = 300 + +# Update period in seconds of a name service record about existing target. +# (integer value) +#zmq_target_update = 180 + +# Use PUB/SUB pattern for fanout methods. PUB/SUB always uses proxy. (boolean +# value) +#use_pub_sub = false + +# Use ROUTER remote proxy. (boolean value) +#use_router_proxy = false + +# This option makes direct connections dynamic or static. It makes sense only +# with use_router_proxy=False which means to use direct connections for direct +# message types (ignored otherwise). (boolean value) +#use_dynamic_connections = false + +# How many additional connections to a host will be made for failover reasons. +# This option is actual only in dynamic connections mode. (integer value) +#zmq_failover_connections = 2 + +# Minimal port number for random ports range. (port value) +# Minimum value: 0 +# Maximum value: 65535 +#rpc_zmq_min_port = 49153 + +# Maximal port number for random ports range. (integer value) +# Minimum value: 1 +# Maximum value: 65536 +#rpc_zmq_max_port = 65536 + +# Number of retries to find free port number before fail with ZMQBindError. +# (integer value) +#rpc_zmq_bind_port_retries = 100 + +# Default serialization mechanism for serializing/deserializing +# outgoing/incoming messages (string value) +# Possible values: +# json - +# msgpack - +#rpc_zmq_serialization = json + +# This option configures round-robin mode in zmq socket. True means not keeping +# a queue when server side disconnects. False means to keep queue and messages +# even if server is disconnected, when the server appears we send all +# accumulated messages to it. (boolean value) +#zmq_immediate = true + +# Enable/disable TCP keepalive (KA) mechanism. The default value of -1 (or any +# other negative value) means to skip any overrides and leave it to OS default; +# 0 and 1 (or any other positive value) mean to disable and enable the option +# respectively. (integer value) +#zmq_tcp_keepalive = -1 + +# The duration between two keepalive transmissions in idle condition. The unit +# is platform dependent, for example, seconds in Linux, milliseconds in Windows +# etc. The default value of -1 (or any other negative value and 0) means to +# skip any overrides and leave it to OS default. (integer value) +#zmq_tcp_keepalive_idle = -1 + +# The number of retransmissions to be carried out before declaring that remote +# end is not available. The default value of -1 (or any other negative value +# and 0) means to skip any overrides and leave it to OS default. (integer +# value) +#zmq_tcp_keepalive_cnt = -1 + +# The duration between two successive keepalive retransmissions, if +# acknowledgement to the previous keepalive transmission is not received. The +# unit is platform dependent, for example, seconds in Linux, milliseconds in +# Windows etc. The default value of -1 (or any other negative value and 0) +# means to skip any overrides and leave it to OS default. (integer value) +#zmq_tcp_keepalive_intvl = -1 + +# Maximum number of (green) threads to work concurrently. (integer value) +#rpc_thread_pool_size = 100 + +# Expiration timeout in seconds of a sent/received message after which it is +# not tracked anymore by a client/server. (integer value) +#rpc_message_ttl = 300 + +# Wait for message acknowledgements from receivers. This mechanism works only +# via proxy without PUB/SUB. (boolean value) +#rpc_use_acks = false + +# Number of seconds to wait for an ack from a cast/call. After each retry +# attempt this timeout is multiplied by some specified multiplier. (integer +# value) +#rpc_ack_timeout_base = 15 + +# Number to multiply base ack timeout by after each retry attempt. (integer +# value) +#rpc_ack_timeout_multiplier = 2 + +# Default number of message sending attempts in case of any problems occurred: +# positive value N means at most N retries, 0 means no retries, None or -1 (or +# any other negative values) mean to retry forever. This option is used only if +# acknowledgments are enabled. (integer value) +#rpc_retry_attempts = 3 + +# List of publisher hosts SubConsumer can subscribe on. This option has higher +# priority then the default publishers list taken from the matchmaker. (list +# value) +#subscribe_on = + +# Size of executor thread pool when executor is threading or eventlet. (integer +# value) +# Deprecated group/name - [DEFAULT]/rpc_thread_pool_size +#executor_thread_pool_size = 64 + +# Seconds to wait for a response from a call. (integer value) +#rpc_response_timeout = 60 + +# The network address and optional user credentials for connecting to the +# messaging backend, in URL format. The expected format is: +# +# driver://[user:pass@]host:port[,[userN:passN@]hostN:portN]/virtual_host?query +# +# Example: rabbit://rabbitmq:password@127.0.0.1:5672// +# +# For full details on the fields in the URL see the documentation of +# oslo_messaging.TransportURL at +# https://docs.openstack.org/oslo.messaging/latest/reference/transport.html +# (string value) +#transport_url = + +# DEPRECATED: The messaging driver to use, defaults to rabbit. Other drivers +# include amqp and zmq. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#rpc_backend = rabbit + +# The default exchange under which topics are scoped. May be overridden by an +# exchange name specified in the transport_url option. (string value) +#control_exchange = neutron + +# +# From oslo.service.wsgi +# + +# File name for the paste.deploy config for api service (string value) +#api_paste_config = api-paste.ini + +# A python format string that is used as the template to generate log lines. +# The following values can beformatted into it: client_ip, date_time, +# request_line, status_code, body_length, wall_seconds. (string value) +#wsgi_log_format = %(client_ip)s "%(request_line)s" status: %(status_code)s len: %(body_length)s time: %(wall_seconds).7f + +# Sets the value of TCP_KEEPIDLE in seconds for each server socket. Not +# supported on OS X. (integer value) +#tcp_keepidle = 600 + +# Size of the pool of greenthreads used by wsgi (integer value) +#wsgi_default_pool_size = 100 + +# Maximum line size of message headers to be accepted. max_header_line may need +# to be increased when using large tokens (typically those generated when +# keystone is configured to use PKI tokens with big service catalogs). (integer +# value) +#max_header_line = 16384 + +# If False, closes the client socket connection explicitly. (boolean value) +#wsgi_keep_alive = true + +# Timeout for client connections' socket operations. If an incoming connection +# is idle for this number of seconds it will be closed. A value of '0' means +# wait forever. (integer value) +#client_socket_timeout = 900 + + +[agent] +root_helper = "sudo /usr/bin/neutron-rootwrap /etc/neutron/rootwrap.conf" + +# +# From neutron.agent +# + +# Root helper application. Use 'sudo neutron-rootwrap +# /etc/neutron/rootwrap.conf' to use the real root filter facility. Change to +# 'sudo' to skip the filtering and just run the command directly. (string +# value) +#root_helper = sudo + +# Use the root helper when listing the namespaces on a system. This may not be +# required depending on the security configuration. If the root helper is not +# required, set this to False for a performance improvement. (boolean value) +#use_helper_for_ns_read = true + +# Root helper daemon application to use when possible. For the agent which +# needs to execute commands in Dom0 in the hypervisor of XenServer, this item +# should be set to 'xenapi_root_helper', so that it will keep a XenAPI session +# to pass commands to Dom0. (string value) +#root_helper_daemon = + +# Seconds between nodes reporting state to server; should be less than +# agent_down_time, best if it is half or less than agent_down_time. (floating +# point value) +#report_interval = 30 + +# Log agent heartbeats (boolean value) +#log_agent_heartbeats = false + +# Add comments to iptables rules. Set to false to disallow the addition of +# comments to generated iptables rules that describe each rule's purpose. +# System must support the iptables comments module for addition of comments. +# (boolean value) +#comment_iptables_rules = true + +# Duplicate every iptables difference calculation to ensure the format being +# generated matches the format of iptables-save. This option should not be +# turned on for production systems because it imposes a performance penalty. +# (boolean value) +#debug_iptables_rules = false + +# Action to be executed when a child process dies (string value) +# Possible values: +# respawn - +# exit - +#check_child_processes_action = respawn + +# Interval between checks of child process liveness (seconds), use 0 to disable +# (integer value) +#check_child_processes_interval = 60 + +# Availability zone of this node (string value) +#availability_zone = nova + + +[cors] + +# +# From oslo.middleware.cors +# + +# Indicate whether this resource may be shared with the domain received in the +# requests "origin" header. Format: "://[:]", no trailing +# slash. Example: https://horizon.example.com (list value) +#allowed_origin = + +# Indicate that the actual request can include user credentials (boolean value) +#allow_credentials = true + +# Indicate which headers are safe to expose to the API. Defaults to HTTP Simple +# Headers. (list value) +#expose_headers = X-Auth-Token,X-Subject-Token,X-Service-Token,X-OpenStack-Request-ID,OpenStack-Volume-microversion + +# Maximum cache age of CORS preflight requests. (integer value) +#max_age = 3600 + +# Indicate which methods can be used during the actual request. (list value) +#allow_methods = GET,PUT,POST,DELETE,PATCH + +# Indicate which header field names may be used during the actual request. +# (list value) +#allow_headers = X-Auth-Token,X-Identity-Status,X-Roles,X-Service-Catalog,X-User-Id,X-Tenant-Id,X-OpenStack-Request-ID + + +[database] +connection = sqlite:////var/lib/neutron/neutron.sqlite + +# +# From neutron.db +# + +# Database engine for which script will be generated when using offline +# migration. (string value) +#engine = + +# +# From oslo.db +# + +# If True, SQLite uses synchronous mode. (boolean value) +#sqlite_synchronous = true + +# The back end to use for the database. (string value) +# Deprecated group/name - [DEFAULT]/db_backend +#backend = sqlalchemy + +# The SQLAlchemy connection string to use to connect to the database. (string +# value) +# Deprecated group/name - [DEFAULT]/sql_connection +# Deprecated group/name - [DATABASE]/sql_connection +# Deprecated group/name - [sql]/connection +#connection = + +# The SQLAlchemy connection string to use to connect to the slave database. +# (string value) +#slave_connection = + +# The SQL mode to be used for MySQL sessions. This option, including the +# default, overrides any server-set SQL mode. To use whatever SQL mode is set +# by the server configuration, set this to no value. Example: mysql_sql_mode= +# (string value) +#mysql_sql_mode = TRADITIONAL + +# If True, transparently enables support for handling MySQL Cluster (NDB). +# (boolean value) +#mysql_enable_ndb = false + +# Connections which have been present in the connection pool longer than this +# number of seconds will be replaced with a new one the next time they are +# checked out from the pool. (integer value) +# Deprecated group/name - [DATABASE]/idle_timeout +# Deprecated group/name - [database]/idle_timeout +# Deprecated group/name - [DEFAULT]/sql_idle_timeout +# Deprecated group/name - [DATABASE]/sql_idle_timeout +# Deprecated group/name - [sql]/idle_timeout +#connection_recycle_time = 3600 + +# Minimum number of SQL connections to keep open in a pool. (integer value) +# Deprecated group/name - [DEFAULT]/sql_min_pool_size +# Deprecated group/name - [DATABASE]/sql_min_pool_size +#min_pool_size = 1 + +# Maximum number of SQL connections to keep open in a pool. Setting a value of +# 0 indicates no limit. (integer value) +# Deprecated group/name - [DEFAULT]/sql_max_pool_size +# Deprecated group/name - [DATABASE]/sql_max_pool_size +#max_pool_size = 5 + +# Maximum number of database connection retries during startup. Set to -1 to +# specify an infinite retry count. (integer value) +# Deprecated group/name - [DEFAULT]/sql_max_retries +# Deprecated group/name - [DATABASE]/sql_max_retries +#max_retries = 10 + +# Interval between retries of opening a SQL connection. (integer value) +# Deprecated group/name - [DEFAULT]/sql_retry_interval +# Deprecated group/name - [DATABASE]/reconnect_interval +#retry_interval = 10 + +# If set, use this value for max_overflow with SQLAlchemy. (integer value) +# Deprecated group/name - [DEFAULT]/sql_max_overflow +# Deprecated group/name - [DATABASE]/sqlalchemy_max_overflow +#max_overflow = 50 + +# Verbosity of SQL debugging information: 0=None, 100=Everything. (integer +# value) +# Minimum value: 0 +# Maximum value: 100 +# Deprecated group/name - [DEFAULT]/sql_connection_debug +#connection_debug = 0 + +# Add Python stack traces to SQL as comment strings. (boolean value) +# Deprecated group/name - [DEFAULT]/sql_connection_trace +#connection_trace = false + +# If set, use this value for pool_timeout with SQLAlchemy. (integer value) +# Deprecated group/name - [DATABASE]/sqlalchemy_pool_timeout +#pool_timeout = + +# Enable the experimental use of database reconnect on connection lost. +# (boolean value) +#use_db_reconnect = false + +# Seconds between retries of a database transaction. (integer value) +#db_retry_interval = 1 + +# If True, increases the interval between retries of a database operation up to +# db_max_retry_interval. (boolean value) +#db_inc_retry_interval = true + +# If db_inc_retry_interval is set, the maximum seconds between retries of a +# database operation. (integer value) +#db_max_retry_interval = 10 + +# Maximum retries in case of connection error or deadlock error before error is +# raised. Set to -1 to specify an infinite retry count. (integer value) +#db_max_retries = 20 + + +[keystone_authtoken] +password = neutron_user_secret +username = neutron +project_name = service +user_domain_name = default +project_domain_name = default +auth_type = password +memcached_servers = controller:11211 +auth_url = http://controller:5000 +auth_uri = http://controller:5000 + +# +# From keystonemiddleware.auth_token +# + +# Complete "public" Identity API endpoint. This endpoint should not be an +# "admin" endpoint, as it should be accessible by all end users. +# Unauthenticated clients are redirected to this endpoint to authenticate. +# Although this endpoint should ideally be unversioned, client support in the +# wild varies. If you're using a versioned v2 endpoint here, then this should +# *not* be the same endpoint the service user utilizes for validating tokens, +# because normal end users may not be able to reach that endpoint. (string +# value) +# Deprecated group/name - [keystone_authtoken]/auth_uri +#www_authenticate_uri = + +# DEPRECATED: Complete "public" Identity API endpoint. This endpoint should not +# be an "admin" endpoint, as it should be accessible by all end users. +# Unauthenticated clients are redirected to this endpoint to authenticate. +# Although this endpoint should ideally be unversioned, client support in the +# wild varies. If you're using a versioned v2 endpoint here, then this should +# *not* be the same endpoint the service user utilizes for validating tokens, +# because normal end users may not be able to reach that endpoint. This option +# is deprecated in favor of www_authenticate_uri and will be removed in the S +# release. (string value) +# This option is deprecated for removal since Queens. +# Its value may be silently ignored in the future. +# Reason: The auth_uri option is deprecated in favor of www_authenticate_uri +# and will be removed in the S release. +#auth_uri = + +# API version of the admin Identity API endpoint. (string value) +#auth_version = + +# Do not handle authorization requests within the middleware, but delegate the +# authorization decision to downstream WSGI components. (boolean value) +#delay_auth_decision = false + +# Request timeout value for communicating with Identity API server. (integer +# value) +#http_connect_timeout = + +# How many times are we trying to reconnect when communicating with Identity +# API Server. (integer value) +#http_request_max_retries = 3 + +# Request environment key where the Swift cache object is stored. When +# auth_token middleware is deployed with a Swift cache, use this option to have +# the middleware share a caching backend with swift. Otherwise, use the +# ``memcached_servers`` option instead. (string value) +#cache = + +# Required if identity server requires client certificate (string value) +#certfile = + +# Required if identity server requires client certificate (string value) +#keyfile = + +# A PEM encoded Certificate Authority to use when verifying HTTPs connections. +# Defaults to system CAs. (string value) +#cafile = + +# Verify HTTPS connections. (boolean value) +#insecure = false + +# The region in which the identity server can be found. (string value) +#region_name = + +# DEPRECATED: Directory used to cache files related to PKI tokens. This option +# has been deprecated in the Ocata release and will be removed in the P +# release. (string value) +# This option is deprecated for removal since Ocata. +# Its value may be silently ignored in the future. +# Reason: PKI token format is no longer supported. +#signing_dir = + +# Optionally specify a list of memcached server(s) to use for caching. If left +# undefined, tokens will instead be cached in-process. (list value) +# Deprecated group/name - [keystone_authtoken]/memcache_servers +#memcached_servers = + +# In order to prevent excessive effort spent validating tokens, the middleware +# caches previously-seen tokens for a configurable duration (in seconds). Set +# to -1 to disable caching completely. (integer value) +#token_cache_time = 300 + +# DEPRECATED: Determines the frequency at which the list of revoked tokens is +# retrieved from the Identity service (in seconds). A high number of revocation +# events combined with a low cache duration may significantly reduce +# performance. Only valid for PKI tokens. This option has been deprecated in +# the Ocata release and will be removed in the P release. (integer value) +# This option is deprecated for removal since Ocata. +# Its value may be silently ignored in the future. +# Reason: PKI token format is no longer supported. +#revocation_cache_time = 10 + +# (Optional) If defined, indicate whether token data should be authenticated or +# authenticated and encrypted. If MAC, token data is authenticated (with HMAC) +# in the cache. If ENCRYPT, token data is encrypted and authenticated in the +# cache. If the value is not one of these options or empty, auth_token will +# raise an exception on initialization. (string value) +# Possible values: +# None - +# MAC - +# ENCRYPT - +#memcache_security_strategy = None + +# (Optional, mandatory if memcache_security_strategy is defined) This string is +# used for key derivation. (string value) +#memcache_secret_key = + +# (Optional) Number of seconds memcached server is considered dead before it is +# tried again. (integer value) +#memcache_pool_dead_retry = 300 + +# (Optional) Maximum total number of open connections to every memcached +# server. (integer value) +#memcache_pool_maxsize = 10 + +# (Optional) Socket timeout in seconds for communicating with a memcached +# server. (integer value) +#memcache_pool_socket_timeout = 3 + +# (Optional) Number of seconds a connection to memcached is held unused in the +# pool before it is closed. (integer value) +#memcache_pool_unused_timeout = 60 + +# (Optional) Number of seconds that an operation will wait to get a memcached +# client connection from the pool. (integer value) +#memcache_pool_conn_get_timeout = 10 + +# (Optional) Use the advanced (eventlet safe) memcached client pool. The +# advanced pool will only work under python 2.x. (boolean value) +#memcache_use_advanced_pool = false + +# (Optional) Indicate whether to set the X-Service-Catalog header. If False, +# middleware will not ask for service catalog on token validation and will not +# set the X-Service-Catalog header. (boolean value) +#include_service_catalog = true + +# Used to control the use and type of token binding. Can be set to: "disabled" +# to not check token binding. "permissive" (default) to validate binding +# information if the bind type is of a form known to the server and ignore it +# if not. "strict" like "permissive" but if the bind type is unknown the token +# will be rejected. "required" any form of token binding is needed to be +# allowed. Finally the name of a binding method that must be present in tokens. +# (string value) +#enforce_token_bind = permissive + +# DEPRECATED: If true, the revocation list will be checked for cached tokens. +# This requires that PKI tokens are configured on the identity server. (boolean +# value) +# This option is deprecated for removal since Ocata. +# Its value may be silently ignored in the future. +# Reason: PKI token format is no longer supported. +#check_revocations_for_cached = false + +# DEPRECATED: Hash algorithms to use for hashing PKI tokens. This may be a +# single algorithm or multiple. The algorithms are those supported by Python +# standard hashlib.new(). The hashes will be tried in the order given, so put +# the preferred one first for performance. The result of the first hash will be +# stored in the cache. This will typically be set to multiple values only while +# migrating from a less secure algorithm to a more secure one. Once all the old +# tokens are expired this option should be set to a single value for better +# performance. (list value) +# This option is deprecated for removal since Ocata. +# Its value may be silently ignored in the future. +# Reason: PKI token format is no longer supported. +#hash_algorithms = md5 + +# A choice of roles that must be present in a service token. Service tokens are +# allowed to request that an expired token can be used and so this check should +# tightly control that only actual services should be sending this token. Roles +# here are applied as an ANY check so any role in this list must be present. +# For backwards compatibility reasons this currently only affects the +# allow_expired check. (list value) +#service_token_roles = service + +# For backwards compatibility reasons we must let valid service tokens pass +# that don't pass the service_token_roles check as valid. Setting this true +# will become the default in a future release and should be enabled if +# possible. (boolean value) +#service_token_roles_required = false + +# Prefix to prepend at the beginning of the path. Deprecated, use identity_uri. +# (string value) +#auth_admin_prefix = + +# Host providing the admin Identity API endpoint. Deprecated, use identity_uri. +# (string value) +#auth_host = 127.0.0.1 + +# Port of the admin Identity API endpoint. Deprecated, use identity_uri. +# (integer value) +#auth_port = 35357 + +# Protocol of the admin Identity API endpoint. Deprecated, use identity_uri. +# (string value) +# Possible values: +# http - +# https - +#auth_protocol = https + +# Complete admin Identity API endpoint. This should specify the unversioned +# root endpoint e.g. https://localhost:35357/ (string value) +#identity_uri = + +# This option is deprecated and may be removed in a future release. Single +# shared secret with the Keystone configuration used for bootstrapping a +# Keystone installation, or otherwise bypassing the normal authentication +# process. This option should not be used, use `admin_user` and +# `admin_password` instead. (string value) +#admin_token = + +# Service username. (string value) +#admin_user = + +# Service user password. (string value) +#admin_password = + +# Service tenant name. (string value) +#admin_tenant_name = admin + +# Authentication type to load (string value) +# Deprecated group/name - [keystone_authtoken]/auth_plugin +#auth_type = + +# Config Section from which to load plugin specific options (string value) +#auth_section = + + +[matchmaker_redis] + +# +# From oslo.messaging +# + +# DEPRECATED: Host to locate redis. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#host = 127.0.0.1 + +# DEPRECATED: Use this port to connect to redis host. (port value) +# Minimum value: 0 +# Maximum value: 65535 +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#port = 6379 + +# DEPRECATED: Password for Redis server (optional). (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#password = + +# DEPRECATED: List of Redis Sentinel hosts (fault tolerance mode), e.g., +# [host:port, host1:port ... ] (list value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#sentinel_hosts = + +# Redis replica set name. (string value) +#sentinel_group_name = oslo-messaging-zeromq + +# Time in ms to wait between connection attempts. (integer value) +#wait_timeout = 2000 + +# Time in ms to wait before the transaction is killed. (integer value) +#check_timeout = 20000 + +# Timeout in ms on blocking socket operations. (integer value) +#socket_timeout = 10000 + + +[nova] + +# +# From neutron +# + +# Name of nova region to use. Useful if keystone manages more than one region. +# (string value) +#region_name = + +# Type of the nova endpoint to use. This endpoint will be looked up in the +# keystone catalog and should be one of public, internal or admin. (string +# value) +# Possible values: +# public - +# admin - +# internal - +#endpoint_type = public + +# +# From nova.auth +# + +# Authentication URL (string value) +#auth_url = + +# Authentication type to load (string value) +# Deprecated group/name - [nova]/auth_plugin +#auth_type = + +# PEM encoded Certificate Authority to use when verifying HTTPs connections. +# (string value) +#cafile = + +# PEM encoded client certificate cert file (string value) +#certfile = + +# Optional domain ID to use with v3 and v2 parameters. It will be used for both +# the user and project domain in v3 and ignored in v2 authentication. (string +# value) +#default_domain_id = + +# Optional domain name to use with v3 API and v2 parameters. It will be used +# for both the user and project domain in v3 and ignored in v2 authentication. +# (string value) +#default_domain_name = + +# Domain ID to scope to (string value) +#domain_id = + +# Domain name to scope to (string value) +#domain_name = + +# Verify HTTPS connections. (boolean value) +#insecure = false + +# PEM encoded client certificate key file (string value) +#keyfile = + +# User's password (string value) +#password = + +# Domain ID containing project (string value) +#project_domain_id = + +# Domain name containing project (string value) +#project_domain_name = + +# Project ID to scope to (string value) +# Deprecated group/name - [nova]/tenant_id +#project_id = + +# Project name to scope to (string value) +# Deprecated group/name - [nova]/tenant_name +#project_name = + +# Scope for system operations (string value) +#system_scope = + +# Tenant ID (string value) +#tenant_id = + +# Tenant Name (string value) +#tenant_name = + +# Timeout value for http requests (integer value) +#timeout = + +# Trust ID (string value) +#trust_id = + +# User's domain id (string value) +#user_domain_id = + +# User's domain name (string value) +#user_domain_name = + +# User id (string value) +#user_id = + +# Username (string value) +# Deprecated group/name - [nova]/user_name +#username = + + +[oslo_concurrency] + +# +# From oslo.concurrency +# + +# Enables or disables inter-process locks. (boolean value) +#disable_process_locking = false + +# Directory to use for lock files. For security, the specified directory +# should only be writable by the user running the processes that need locking. +# Defaults to environment variable OSLO_LOCK_PATH. If OSLO_LOCK_PATH is not set +# in the environment, use the Python tempfile.gettempdir function to find a +# suitable location. If external locks are used, a lock path must be set. +# (string value) +#lock_path = /tmp + + +[oslo_messaging_amqp] + +# +# From oslo.messaging +# + +# Name for the AMQP container. must be globally unique. Defaults to a generated +# UUID (string value) +#container_name = + +# Timeout for inactive connections (in seconds) (integer value) +#idle_timeout = 0 + +# Debug: dump AMQP frames to stdout (boolean value) +#trace = false + +# Attempt to connect via SSL. If no other ssl-related parameters are given, it +# will use the system's CA-bundle to verify the server's certificate. (boolean +# value) +#ssl = false + +# CA certificate PEM file used to verify the server's certificate (string +# value) +#ssl_ca_file = + +# Self-identifying certificate PEM file for client authentication (string +# value) +#ssl_cert_file = + +# Private key PEM file used to sign ssl_cert_file certificate (optional) +# (string value) +#ssl_key_file = + +# Password for decrypting ssl_key_file (if encrypted) (string value) +#ssl_key_password = + +# By default SSL checks that the name in the server's certificate matches the +# hostname in the transport_url. In some configurations it may be preferable to +# use the virtual hostname instead, for example if the server uses the Server +# Name Indication TLS extension (rfc6066) to provide a certificate per virtual +# host. Set ssl_verify_vhost to True if the server's SSL certificate uses the +# virtual host name instead of the DNS name. (boolean value) +#ssl_verify_vhost = false + +# DEPRECATED: Accept clients using either SSL or plain TCP (boolean value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Not applicable - not a SSL server +#allow_insecure_clients = false + +# Space separated list of acceptable SASL mechanisms (string value) +#sasl_mechanisms = + +# Path to directory that contains the SASL configuration (string value) +#sasl_config_dir = + +# Name of configuration file (without .conf suffix) (string value) +#sasl_config_name = + +# SASL realm to use if no realm present in username (string value) +#sasl_default_realm = + +# DEPRECATED: User name for message broker authentication (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Should use configuration option transport_url to provide the +# username. +#username = + +# DEPRECATED: Password for message broker authentication (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Should use configuration option transport_url to provide the +# password. +#password = + +# Seconds to pause before attempting to re-connect. (integer value) +# Minimum value: 1 +#connection_retry_interval = 1 + +# Increase the connection_retry_interval by this many seconds after each +# unsuccessful failover attempt. (integer value) +# Minimum value: 0 +#connection_retry_backoff = 2 + +# Maximum limit for connection_retry_interval + connection_retry_backoff +# (integer value) +# Minimum value: 1 +#connection_retry_interval_max = 30 + +# Time to pause between re-connecting an AMQP 1.0 link that failed due to a +# recoverable error. (integer value) +# Minimum value: 1 +#link_retry_delay = 10 + +# The maximum number of attempts to re-send a reply message which failed due to +# a recoverable error. (integer value) +# Minimum value: -1 +#default_reply_retry = 0 + +# The deadline for an rpc reply message delivery. (integer value) +# Minimum value: 5 +#default_reply_timeout = 30 + +# The deadline for an rpc cast or call message delivery. Only used when caller +# does not provide a timeout expiry. (integer value) +# Minimum value: 5 +#default_send_timeout = 30 + +# The deadline for a sent notification message delivery. Only used when caller +# does not provide a timeout expiry. (integer value) +# Minimum value: 5 +#default_notify_timeout = 30 + +# The duration to schedule a purge of idle sender links. Detach link after +# expiry. (integer value) +# Minimum value: 1 +#default_sender_link_timeout = 600 + +# Indicates the addressing mode used by the driver. +# Permitted values: +# 'legacy' - use legacy non-routable addressing +# 'routable' - use routable addresses +# 'dynamic' - use legacy addresses if the message bus does not support routing +# otherwise use routable addressing (string value) +#addressing_mode = dynamic + +# Enable virtual host support for those message buses that do not natively +# support virtual hosting (such as qpidd). When set to true the virtual host +# name will be added to all message bus addresses, effectively creating a +# private 'subnet' per virtual host. Set to False if the message bus supports +# virtual hosting using the 'hostname' field in the AMQP 1.0 Open performative +# as the name of the virtual host. (boolean value) +#pseudo_vhost = true + +# address prefix used when sending to a specific server (string value) +#server_request_prefix = exclusive + +# address prefix used when broadcasting to all servers (string value) +#broadcast_prefix = broadcast + +# address prefix when sending to any server in group (string value) +#group_request_prefix = unicast + +# Address prefix for all generated RPC addresses (string value) +#rpc_address_prefix = openstack.org/om/rpc + +# Address prefix for all generated Notification addresses (string value) +#notify_address_prefix = openstack.org/om/notify + +# Appended to the address prefix when sending a fanout message. Used by the +# message bus to identify fanout messages. (string value) +#multicast_address = multicast + +# Appended to the address prefix when sending to a particular RPC/Notification +# server. Used by the message bus to identify messages sent to a single +# destination. (string value) +#unicast_address = unicast + +# Appended to the address prefix when sending to a group of consumers. Used by +# the message bus to identify messages that should be delivered in a round- +# robin fashion across consumers. (string value) +#anycast_address = anycast + +# Exchange name used in notification addresses. +# Exchange name resolution precedence: +# Target.exchange if set +# else default_notification_exchange if set +# else control_exchange if set +# else 'notify' (string value) +#default_notification_exchange = + +# Exchange name used in RPC addresses. +# Exchange name resolution precedence: +# Target.exchange if set +# else default_rpc_exchange if set +# else control_exchange if set +# else 'rpc' (string value) +#default_rpc_exchange = + +# Window size for incoming RPC Reply messages. (integer value) +# Minimum value: 1 +#reply_link_credit = 200 + +# Window size for incoming RPC Request messages (integer value) +# Minimum value: 1 +#rpc_server_credit = 100 + +# Window size for incoming Notification messages (integer value) +# Minimum value: 1 +#notify_server_credit = 100 + +# Send messages of this type pre-settled. +# Pre-settled messages will not receive acknowledgement +# from the peer. Note well: pre-settled messages may be +# silently discarded if the delivery fails. +# Permitted values: +# 'rpc-call' - send RPC Calls pre-settled +# 'rpc-reply'- send RPC Replies pre-settled +# 'rpc-cast' - Send RPC Casts pre-settled +# 'notify' - Send Notifications pre-settled +# (multi valued) +#pre_settled = rpc-cast +#pre_settled = rpc-reply + + +[oslo_messaging_kafka] + +# +# From oslo.messaging +# + +# DEPRECATED: Default Kafka broker Host (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#kafka_default_host = localhost + +# DEPRECATED: Default Kafka broker Port (port value) +# Minimum value: 0 +# Maximum value: 65535 +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#kafka_default_port = 9092 + +# Max fetch bytes of Kafka consumer (integer value) +#kafka_max_fetch_bytes = 1048576 + +# Default timeout(s) for Kafka consumers (floating point value) +#kafka_consumer_timeout = 1.0 + +# DEPRECATED: Pool Size for Kafka Consumers (integer value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Driver no longer uses connection pool. +#pool_size = 10 + +# DEPRECATED: The pool size limit for connections expiration policy (integer +# value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Driver no longer uses connection pool. +#conn_pool_min_size = 2 + +# DEPRECATED: The time-to-live in sec of idle connections in the pool (integer +# value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Driver no longer uses connection pool. +#conn_pool_ttl = 1200 + +# Group id for Kafka consumer. Consumers in one group will coordinate message +# consumption (string value) +#consumer_group = oslo_messaging_consumer + +# Upper bound on the delay for KafkaProducer batching in seconds (floating +# point value) +#producer_batch_timeout = 0.0 + +# Size of batch for the producer async send (integer value) +#producer_batch_size = 16384 + + +[oslo_messaging_notifications] + +# +# From oslo.messaging +# + +# The Drivers(s) to handle sending notifications. Possible values are +# messaging, messagingv2, routing, log, test, noop (multi valued) +# Deprecated group/name - [DEFAULT]/notification_driver +#driver = + +# A URL representing the messaging driver to use for notifications. If not set, +# we fall back to the same configuration used for RPC. (string value) +# Deprecated group/name - [DEFAULT]/notification_transport_url +#transport_url = + +# AMQP topic used for OpenStack notifications. (list value) +# Deprecated group/name - [rpc_notifier2]/topics +# Deprecated group/name - [DEFAULT]/notification_topics +#topics = notifications + +# The maximum number of attempts to re-send a notification message which failed +# to be delivered due to a recoverable error. 0 - No retry, -1 - indefinite +# (integer value) +#retry = -1 + + +[oslo_messaging_rabbit] + +# +# From oslo.messaging +# + +# Use durable queues in AMQP. (boolean value) +# Deprecated group/name - [DEFAULT]/amqp_durable_queues +# Deprecated group/name - [DEFAULT]/rabbit_durable_queues +#amqp_durable_queues = false + +# Auto-delete queues in AMQP. (boolean value) +#amqp_auto_delete = false + +# Enable SSL (boolean value) +#ssl = + +# SSL version to use (valid only if SSL enabled). Valid values are TLSv1 and +# SSLv23. SSLv2, SSLv3, TLSv1_1, and TLSv1_2 may be available on some +# distributions. (string value) +# Deprecated group/name - [oslo_messaging_rabbit]/kombu_ssl_version +#ssl_version = + +# SSL key file (valid only if SSL enabled). (string value) +# Deprecated group/name - [oslo_messaging_rabbit]/kombu_ssl_keyfile +#ssl_key_file = + +# SSL cert file (valid only if SSL enabled). (string value) +# Deprecated group/name - [oslo_messaging_rabbit]/kombu_ssl_certfile +#ssl_cert_file = + +# SSL certification authority file (valid only if SSL enabled). (string value) +# Deprecated group/name - [oslo_messaging_rabbit]/kombu_ssl_ca_certs +#ssl_ca_file = + +# How long to wait before reconnecting in response to an AMQP consumer cancel +# notification. (floating point value) +#kombu_reconnect_delay = 1.0 + +# EXPERIMENTAL: Possible values are: gzip, bz2. If not set compression will not +# be used. This option may not be available in future versions. (string value) +#kombu_compression = + +# How long to wait a missing client before abandoning to send it its replies. +# This value should not be longer than rpc_response_timeout. (integer value) +# Deprecated group/name - [oslo_messaging_rabbit]/kombu_reconnect_timeout +#kombu_missing_consumer_retry_timeout = 60 + +# Determines how the next RabbitMQ node is chosen in case the one we are +# currently connected to becomes unavailable. Takes effect only if more than +# one RabbitMQ node is provided in config. (string value) +# Possible values: +# round-robin - +# shuffle - +#kombu_failover_strategy = round-robin + +# DEPRECATED: The RabbitMQ broker address where a single node is used. (string +# value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#rabbit_host = localhost + +# DEPRECATED: The RabbitMQ broker port where a single node is used. (port +# value) +# Minimum value: 0 +# Maximum value: 65535 +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#rabbit_port = 5672 + +# DEPRECATED: RabbitMQ HA cluster host:port pairs. (list value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#rabbit_hosts = $rabbit_host:$rabbit_port + +# DEPRECATED: The RabbitMQ userid. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#rabbit_userid = guest + +# DEPRECATED: The RabbitMQ password. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#rabbit_password = guest + +# The RabbitMQ login method. (string value) +# Possible values: +# PLAIN - +# AMQPLAIN - +# RABBIT-CR-DEMO - +#rabbit_login_method = AMQPLAIN + +# DEPRECATED: The RabbitMQ virtual host. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#rabbit_virtual_host = / + +# How frequently to retry connecting with RabbitMQ. (integer value) +#rabbit_retry_interval = 1 + +# How long to backoff for between retries when connecting to RabbitMQ. (integer +# value) +#rabbit_retry_backoff = 2 + +# Maximum interval of RabbitMQ connection retries. Default is 30 seconds. +# (integer value) +#rabbit_interval_max = 30 + +# DEPRECATED: Maximum number of RabbitMQ connection retries. Default is 0 +# (infinite retry count). (integer value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +#rabbit_max_retries = 0 + +# Try to use HA queues in RabbitMQ (x-ha-policy: all). If you change this +# option, you must wipe the RabbitMQ database. In RabbitMQ 3.0, queue mirroring +# is no longer controlled by the x-ha-policy argument when declaring a queue. +# If you just want to make sure that all queues (except those with auto- +# generated names) are mirrored across all nodes, run: "rabbitmqctl set_policy +# HA '^(?!amq\.).*' '{"ha-mode": "all"}' " (boolean value) +#rabbit_ha_queues = false + +# Positive integer representing duration in seconds for queue TTL (x-expires). +# Queues which are unused for the duration of the TTL are automatically +# deleted. The parameter affects only reply and fanout queues. (integer value) +# Minimum value: 1 +#rabbit_transient_queues_ttl = 1800 + +# Specifies the number of messages to prefetch. Setting to zero allows +# unlimited messages. (integer value) +#rabbit_qos_prefetch_count = 0 + +# Number of seconds after which the Rabbit broker is considered down if +# heartbeat's keep-alive fails (0 disable the heartbeat). EXPERIMENTAL (integer +# value) +#heartbeat_timeout_threshold = 60 + +# How often times during the heartbeat_timeout_threshold we check the +# heartbeat. (integer value) +#heartbeat_rate = 2 + +# Deprecated, use rpc_backend=kombu+memory or rpc_backend=fake (boolean value) +#fake_rabbit = false + +# Maximum number of channels to allow (integer value) +#channel_max = + +# The maximum byte size for an AMQP frame (integer value) +#frame_max = + +# How often to send heartbeats for consumer's connections (integer value) +#heartbeat_interval = 3 + +# Arguments passed to ssl.wrap_socket (dict value) +#ssl_options = + +# Set socket timeout in seconds for connection's socket (floating point value) +#socket_timeout = 0.25 + +# Set TCP_USER_TIMEOUT in seconds for connection's socket (floating point +# value) +#tcp_user_timeout = 0.25 + +# Set delay for reconnection to some host which has connection error (floating +# point value) +#host_connection_reconnect_delay = 0.25 + +# Connection factory implementation (string value) +# Possible values: +# new - +# single - +# read_write - +#connection_factory = single + +# Maximum number of connections to keep queued. (integer value) +#pool_max_size = 30 + +# Maximum number of connections to create above `pool_max_size`. (integer +# value) +#pool_max_overflow = 0 + +# Default number of seconds to wait for a connections to available (integer +# value) +#pool_timeout = 30 + +# Lifetime of a connection (since creation) in seconds or None for no +# recycling. Expired connections are closed on acquire. (integer value) +#pool_recycle = 600 + +# Threshold at which inactive (since release) connections are considered stale +# in seconds or None for no staleness. Stale connections are closed on acquire. +# (integer value) +#pool_stale = 60 + +# Default serialization mechanism for serializing/deserializing +# outgoing/incoming messages (string value) +# Possible values: +# json - +# msgpack - +#default_serializer_type = json + +# Persist notification messages. (boolean value) +#notification_persistence = false + +# Exchange name for sending notifications (string value) +#default_notification_exchange = ${control_exchange}_notification + +# Max number of not acknowledged message which RabbitMQ can send to +# notification listener. (integer value) +#notification_listener_prefetch_count = 100 + +# Reconnecting retry count in case of connectivity problem during sending +# notification, -1 means infinite retry. (integer value) +#default_notification_retry_attempts = -1 + +# Reconnecting retry delay in case of connectivity problem during sending +# notification message (floating point value) +#notification_retry_delay = 0.25 + +# Time to live for rpc queues without consumers in seconds. (integer value) +#rpc_queue_expiration = 60 + +# Exchange name for sending RPC messages (string value) +#default_rpc_exchange = ${control_exchange}_rpc + +# Exchange name for receiving RPC replies (string value) +#rpc_reply_exchange = ${control_exchange}_rpc_reply + +# Max number of not acknowledged message which RabbitMQ can send to rpc +# listener. (integer value) +#rpc_listener_prefetch_count = 100 + +# Max number of not acknowledged message which RabbitMQ can send to rpc reply +# listener. (integer value) +#rpc_reply_listener_prefetch_count = 100 + +# Reconnecting retry count in case of connectivity problem during sending +# reply. -1 means infinite retry during rpc_timeout (integer value) +#rpc_reply_retry_attempts = -1 + +# Reconnecting retry delay in case of connectivity problem during sending +# reply. (floating point value) +#rpc_reply_retry_delay = 0.25 + +# Reconnecting retry count in case of connectivity problem during sending RPC +# message, -1 means infinite retry. If actual retry attempts in not 0 the rpc +# request could be processed more than one time (integer value) +#default_rpc_retry_attempts = -1 + +# Reconnecting retry delay in case of connectivity problem during sending RPC +# message (floating point value) +#rpc_retry_delay = 0.25 + + +[oslo_messaging_zmq] + +# +# From oslo.messaging +# + +# ZeroMQ bind address. Should be a wildcard (*), an ethernet interface, or IP. +# The "host" option should point or resolve to this address. (string value) +#rpc_zmq_bind_address = * + +# MatchMaker driver. (string value) +# Possible values: +# redis - +# sentinel - +# dummy - +#rpc_zmq_matchmaker = redis + +# Number of ZeroMQ contexts, defaults to 1. (integer value) +#rpc_zmq_contexts = 1 + +# Maximum number of ingress messages to locally buffer per topic. Default is +# unlimited. (integer value) +#rpc_zmq_topic_backlog = + +# Directory for holding IPC sockets. (string value) +#rpc_zmq_ipc_dir = /var/run/openstack + +# Name of this node. Must be a valid hostname, FQDN, or IP address. Must match +# "host" option, if running Nova. (string value) +#rpc_zmq_host = localhost + +# Number of seconds to wait before all pending messages will be sent after +# closing a socket. The default value of -1 specifies an infinite linger +# period. The value of 0 specifies no linger period. Pending messages shall be +# discarded immediately when the socket is closed. Positive values specify an +# upper bound for the linger period. (integer value) +# Deprecated group/name - [DEFAULT]/rpc_cast_timeout +#zmq_linger = -1 + +# The default number of seconds that poll should wait. Poll raises timeout +# exception when timeout expired. (integer value) +#rpc_poll_timeout = 1 + +# Expiration timeout in seconds of a name service record about existing target +# ( < 0 means no timeout). (integer value) +#zmq_target_expire = 300 + +# Update period in seconds of a name service record about existing target. +# (integer value) +#zmq_target_update = 180 + +# Use PUB/SUB pattern for fanout methods. PUB/SUB always uses proxy. (boolean +# value) +#use_pub_sub = false + +# Use ROUTER remote proxy. (boolean value) +#use_router_proxy = false + +# This option makes direct connections dynamic or static. It makes sense only +# with use_router_proxy=False which means to use direct connections for direct +# message types (ignored otherwise). (boolean value) +#use_dynamic_connections = false + +# How many additional connections to a host will be made for failover reasons. +# This option is actual only in dynamic connections mode. (integer value) +#zmq_failover_connections = 2 + +# Minimal port number for random ports range. (port value) +# Minimum value: 0 +# Maximum value: 65535 +#rpc_zmq_min_port = 49153 + +# Maximal port number for random ports range. (integer value) +# Minimum value: 1 +# Maximum value: 65536 +#rpc_zmq_max_port = 65536 + +# Number of retries to find free port number before fail with ZMQBindError. +# (integer value) +#rpc_zmq_bind_port_retries = 100 + +# Default serialization mechanism for serializing/deserializing +# outgoing/incoming messages (string value) +# Possible values: +# json - +# msgpack - +#rpc_zmq_serialization = json + +# This option configures round-robin mode in zmq socket. True means not keeping +# a queue when server side disconnects. False means to keep queue and messages +# even if server is disconnected, when the server appears we send all +# accumulated messages to it. (boolean value) +#zmq_immediate = true + +# Enable/disable TCP keepalive (KA) mechanism. The default value of -1 (or any +# other negative value) means to skip any overrides and leave it to OS default; +# 0 and 1 (or any other positive value) mean to disable and enable the option +# respectively. (integer value) +#zmq_tcp_keepalive = -1 + +# The duration between two keepalive transmissions in idle condition. The unit +# is platform dependent, for example, seconds in Linux, milliseconds in Windows +# etc. The default value of -1 (or any other negative value and 0) means to +# skip any overrides and leave it to OS default. (integer value) +#zmq_tcp_keepalive_idle = -1 + +# The number of retransmissions to be carried out before declaring that remote +# end is not available. The default value of -1 (or any other negative value +# and 0) means to skip any overrides and leave it to OS default. (integer +# value) +#zmq_tcp_keepalive_cnt = -1 + +# The duration between two successive keepalive retransmissions, if +# acknowledgement to the previous keepalive transmission is not received. The +# unit is platform dependent, for example, seconds in Linux, milliseconds in +# Windows etc. The default value of -1 (or any other negative value and 0) +# means to skip any overrides and leave it to OS default. (integer value) +#zmq_tcp_keepalive_intvl = -1 + +# Maximum number of (green) threads to work concurrently. (integer value) +#rpc_thread_pool_size = 100 + +# Expiration timeout in seconds of a sent/received message after which it is +# not tracked anymore by a client/server. (integer value) +#rpc_message_ttl = 300 + +# Wait for message acknowledgements from receivers. This mechanism works only +# via proxy without PUB/SUB. (boolean value) +#rpc_use_acks = false + +# Number of seconds to wait for an ack from a cast/call. After each retry +# attempt this timeout is multiplied by some specified multiplier. (integer +# value) +#rpc_ack_timeout_base = 15 + +# Number to multiply base ack timeout by after each retry attempt. (integer +# value) +#rpc_ack_timeout_multiplier = 2 + +# Default number of message sending attempts in case of any problems occurred: +# positive value N means at most N retries, 0 means no retries, None or -1 (or +# any other negative values) mean to retry forever. This option is used only if +# acknowledgments are enabled. (integer value) +#rpc_retry_attempts = 3 + +# List of publisher hosts SubConsumer can subscribe on. This option has higher +# priority then the default publishers list taken from the matchmaker. (list +# value) +#subscribe_on = + + +[oslo_middleware] + +# +# From oslo.middleware.http_proxy_to_wsgi +# + +# Whether the application is behind a proxy or not. This determines if the +# middleware should parse the headers or not. (boolean value) +#enable_proxy_headers_parsing = false + + +[oslo_policy] + +# +# From oslo.policy +# + +# This option controls whether or not to enforce scope when evaluating +# policies. If ``True``, the scope of the token used in the request is compared +# to the ``scope_types`` of the policy being enforced. If the scopes do not +# match, an ``InvalidScope`` exception will be raised. If ``False``, a message +# will be logged informing operators that policies are being invoked with +# mismatching scope. (boolean value) +#enforce_scope = false + +# The file that defines policies. (string value) +#policy_file = policy.json + +# Default rule. Enforced when a requested rule is not found. (string value) +#policy_default_rule = default + +# Directories where policy configuration files are stored. They can be relative +# to any directory in the search path defined by the config_dir option, or +# absolute paths. The file defined by policy_file must exist for these +# directories to be searched. Missing or empty directories are ignored. (multi +# valued) +#policy_dirs = policy.d + +# Content Type to send and receive data for REST based policy check (string +# value) +# Possible values: +# application/x-www-form-urlencoded - +# application/json - +#remote_content_type = application/x-www-form-urlencoded + +# server identity verification for REST based policy check (boolean value) +#remote_ssl_verify_server_crt = false + +# Absolute path to ca cert file for REST based policy check (string value) +#remote_ssl_ca_crt_file = + +# Absolute path to client cert for REST based policy check (string value) +#remote_ssl_client_crt_file = + +# Absolute path client key file REST based policy check (string value) +#remote_ssl_client_key_file = + + +[quotas] + +# +# From neutron +# + +# Default number of resource allowed per tenant. A negative value means +# unlimited. (integer value) +#default_quota = -1 + +# Number of networks allowed per tenant. A negative value means unlimited. +# (integer value) +#quota_network = 100 + +# Number of subnets allowed per tenant, A negative value means unlimited. +# (integer value) +#quota_subnet = 100 + +# Number of ports allowed per tenant. A negative value means unlimited. +# (integer value) +#quota_port = 500 + +# Default driver to use for quota checks. (string value) +#quota_driver = neutron.db.quota.driver.DbQuotaDriver + +# Keep in track in the database of current resource quota usage. Plugins which +# do not leverage the neutron database should set this flag to False. (boolean +# value) +#track_quota_usage = true + +# +# From neutron.extensions +# + +# Number of routers allowed per tenant. A negative value means unlimited. +# (integer value) +#quota_router = 10 + +# Number of floating IPs allowed per tenant. A negative value means unlimited. +# (integer value) +#quota_floatingip = 50 + +# Number of security groups allowed per tenant. A negative value means +# unlimited. (integer value) +#quota_security_group = 10 + +# Number of security rules allowed per tenant. A negative value means +# unlimited. (integer value) +#quota_security_group_rule = 100 + + +[ssl] + +# +# From oslo.service.sslutils +# + +# CA certificate file to use to verify connecting clients. (string value) +# Deprecated group/name - [DEFAULT]/ssl_ca_file +#ca_file = + +# Certificate file to use when starting the server securely. (string value) +# Deprecated group/name - [DEFAULT]/ssl_cert_file +#cert_file = + +# Private key file to use when starting the server securely. (string value) +# Deprecated group/name - [DEFAULT]/ssl_key_file +#key_file = + +# SSL version to use (valid only if SSL enabled). Valid values are TLSv1 and +# SSLv23. SSLv2, SSLv3, TLSv1_1, and TLSv1_2 may be available on some +# distributions. (string value) +#version = + +# Sets the list of available ciphers. value should be a string in the OpenSSL +# cipher list format. (string value) +#ciphers = diff --git a/openstack/openstack_conf/compute/neutron/plugins/ml2/linuxbridge_agent.ini b/openstack/openstack_conf/compute/neutron/plugins/ml2/linuxbridge_agent.ini new file mode 100644 index 0000000..379bbb7 --- /dev/null +++ b/openstack/openstack_conf/compute/neutron/plugins/ml2/linuxbridge_agent.ini @@ -0,0 +1,275 @@ +[DEFAULT] + +# +# From oslo.log +# + +# If set to true, the logging level will be set to DEBUG instead of the default +# INFO level. (boolean value) +# Note: This option can be changed without restarting. +#debug = false + +# The name of a logging configuration file. This file is appended to any +# existing logging configuration files. For details about logging configuration +# files, see the Python logging module documentation. Note that when logging +# configuration files are used then all logging configuration is set in the +# configuration file and other logging configuration options are ignored (for +# example, logging_context_format_string). (string value) +# Note: This option can be changed without restarting. +# Deprecated group/name - [DEFAULT]/log_config +#log_config_append = + +# Defines the format string for %%(asctime)s in log records. Default: +# %(default)s . This option is ignored if log_config_append is set. (string +# value) +#log_date_format = %Y-%m-%d %H:%M:%S + +# (Optional) Name of log file to send logging output to. If no default is set, +# logging will go to stderr as defined by use_stderr. This option is ignored if +# log_config_append is set. (string value) +# Deprecated group/name - [DEFAULT]/logfile +#log_file = + +# (Optional) The base directory used for relative log_file paths. This option +# is ignored if log_config_append is set. (string value) +# Deprecated group/name - [DEFAULT]/logdir +#log_dir = + +# Uses logging handler designed to watch file system. When log file is moved or +# removed this handler will open a new log file with specified path +# instantaneously. It makes sense only if log_file option is specified and +# Linux platform is used. This option is ignored if log_config_append is set. +# (boolean value) +#watch_log_file = false + +# Use syslog for logging. Existing syslog format is DEPRECATED and will be +# changed later to honor RFC5424. This option is ignored if log_config_append +# is set. (boolean value) +#use_syslog = false + +# Enable journald for logging. If running in a systemd environment you may wish +# to enable journal support. Doing so will use the journal native protocol +# which includes structured metadata in addition to log messages.This option is +# ignored if log_config_append is set. (boolean value) +#use_journal = false + +# Syslog facility to receive log lines. This option is ignored if +# log_config_append is set. (string value) +#syslog_log_facility = LOG_USER + +# Use JSON formatting for logging. This option is ignored if log_config_append +# is set. (boolean value) +#use_json = false + +# Log output to standard error. This option is ignored if log_config_append is +# set. (boolean value) +#use_stderr = false + +# Format string to use for log messages with context. (string value) +#logging_context_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user_identity)s] %(instance)s%(message)s + +# Format string to use for log messages when context is undefined. (string +# value) +#logging_default_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [-] %(instance)s%(message)s + +# Additional data to append to log message when logging level for the message +# is DEBUG. (string value) +#logging_debug_format_suffix = %(funcName)s %(pathname)s:%(lineno)d + +# Prefix each line of exception output with this format. (string value) +#logging_exception_prefix = %(asctime)s.%(msecs)03d %(process)d ERROR %(name)s %(instance)s + +# Defines the format string for %(user_identity)s that is used in +# logging_context_format_string. (string value) +#logging_user_identity_format = %(user)s %(tenant)s %(domain)s %(user_domain)s %(project_domain)s + +# List of package logging levels in logger=LEVEL pairs. This option is ignored +# if log_config_append is set. (list value) +#default_log_levels = amqp=WARN,amqplib=WARN,boto=WARN,qpid=WARN,sqlalchemy=WARN,suds=INFO,oslo.messaging=INFO,oslo_messaging=INFO,iso8601=WARN,requests.packages.urllib3.connectionpool=WARN,urllib3.connectionpool=WARN,websocket=WARN,requests.packages.urllib3.util.retry=WARN,urllib3.util.retry=WARN,keystonemiddleware=WARN,routes.middleware=WARN,stevedore=WARN,taskflow=WARN,keystoneauth=WARN,oslo.cache=INFO,dogpile.core.dogpile=INFO + +# Enables or disables publication of error events. (boolean value) +#publish_errors = false + +# The format for an instance that is passed with the log message. (string +# value) +#instance_format = "[instance: %(uuid)s] " + +# The format for an instance UUID that is passed with the log message. (string +# value) +#instance_uuid_format = "[instance: %(uuid)s] " + +# Interval, number of seconds, of log rate limiting. (integer value) +#rate_limit_interval = 0 + +# Maximum number of logged messages per rate_limit_interval. (integer value) +#rate_limit_burst = 0 + +# Log level name used by rate limiting: CRITICAL, ERROR, INFO, WARNING, DEBUG +# or empty string. Logs with level greater or equal to rate_limit_except_level +# are not filtered. An empty string means that all levels are filtered. (string +# value) +#rate_limit_except_level = CRITICAL + +# Enables or disables fatal status of deprecations. (boolean value) +#fatal_deprecations = false + + +[agent] + +# +# From neutron.ml2.linuxbridge.agent +# + +# The number of seconds the agent will wait between polling for local device +# changes. (integer value) +#polling_interval = 2 + +# Set new timeout in seconds for new rpc calls after agent receives SIGTERM. If +# value is set to 0, rpc timeout won't be changed (integer value) +#quitting_rpc_timeout = 10 + +# The DSCP value to use for outer headers during tunnel encapsulation. (integer +# value) +# Minimum value: 0 +# Maximum value: 63 +#dscp = + +# If set to True, the DSCP value of tunnel interfaces is overwritten and set to +# inherit. The DSCP value of the inner header is then copied to the outer +# header. (boolean value) +#dscp_inherit = false + +# Extensions list to use (list value) +#extensions = + + +[linux_bridge] +physical_interface_mappings = provider:enp0s9 + +# +# From neutron.ml2.linuxbridge.agent +# + +# Comma-separated list of : tuples +# mapping physical network names to the agent's node-specific physical network +# interfaces to be used for flat and VLAN networks. All physical networks +# listed in network_vlan_ranges on the server should have mappings to +# appropriate interfaces on each agent. (list value) +#physical_interface_mappings = + +# List of : (list value) +#bridge_mappings = + + +[network_log] + +# +# From neutron.ml2.linuxbridge.agent +# + +# Maximum packets logging per second. (integer value) +# Minimum value: 100 +#rate_limit = 100 + +# Maximum number of packets per rate_limit. (integer value) +# Minimum value: 25 +#burst_limit = 25 + +# Output logfile path on agent side, default syslog file. (string value) +#local_output_log_base = + + +[securitygroup] +firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver +enable_security_group = true + +# +# From neutron.ml2.linuxbridge.agent +# + +# Driver for security groups firewall in the L2 agent (string value) +#firewall_driver = + +# Controls whether the neutron security group API is enabled in the server. It +# should be false when using no security groups or using the nova security +# group API. (boolean value) +#enable_security_group = true + +# Use ipset to speed-up the iptables based security groups. Enabling ipset +# support requires that ipset is installed on L2 agent node. (boolean value) +#enable_ipset = true + + +[vxlan] +l2_population = true +local_ip = 10.0.0.31 +enable_vxlan = true + +# +# From neutron.ml2.linuxbridge.agent +# + +# Enable VXLAN on the agent. Can be enabled when agent is managed by ml2 plugin +# using linuxbridge mechanism driver (boolean value) +#enable_vxlan = true + +# TTL for vxlan interface protocol packets. (integer value) +#ttl = + +# DEPRECATED: TOS for vxlan interface protocol packets. This option is +# deprecated in favor of the dscp option in the AGENT section and will be +# removed in a future release. To convert the TOS value to DSCP, divide by 4. +# (integer value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +#tos = + +# Multicast group(s) for vxlan interface. A range of group addresses may be +# specified by using CIDR notation. Specifying a range allows different VNIs to +# use different group addresses, reducing or eliminating spurious broadcast +# traffic to the tunnel endpoints. To reserve a unique group for each possible +# (24-bit) VNI, use a /8 such as 239.0.0.0/8. This setting must be the same on +# all the agents. (string value) +#vxlan_group = 224.0.0.1 + +# IP address of local overlay (tunnel) network endpoint. Use either an IPv4 or +# IPv6 address that resides on one of the host network interfaces. The IP +# version of this value must match the value of the 'overlay_ip_version' option +# in the ML2 plug-in configuration file on the neutron server node(s). (IP +# address value) +#local_ip = + +# The minimum of the UDP source port range used for VXLAN communication. (port +# value) +# Minimum value: 0 +# Maximum value: 65535 +#udp_srcport_min = 0 + +# The maximum of the UDP source port range used for VXLAN communication. (port +# value) +# Minimum value: 0 +# Maximum value: 65535 +#udp_srcport_max = 0 + +# The UDP port used for VXLAN communication. By default, the Linux kernel +# doesn't use the IANA assigned standard value, so if you want to use it, this +# option must be set to 4789. It is not set by default because of backward +# compatibiltiy. (port value) +# Minimum value: 0 +# Maximum value: 65535 +#udp_dstport = + +# Extension to use alongside ml2 plugin's l2population mechanism driver. It +# enables the plugin to populate VXLAN forwarding table. (boolean value) +#l2_population = false + +# Enable local ARP responder which provides local responses instead of +# performing ARP broadcast into the overlay. Enabling local ARP responder is +# not fully compatible with the allowed-address-pairs extension. (boolean +# value) +#arp_responder = false + +# Optional comma-separated list of :: +# triples describing how to assign a multicast address to VXLAN according to +# its VNI ID. (list value) +#multicast_ranges = diff --git a/openstack/openstack_conf/compute/neutron/policy.json b/openstack/openstack_conf/compute/neutron/policy.json new file mode 100644 index 0000000..bd7630c --- /dev/null +++ b/openstack/openstack_conf/compute/neutron/policy.json @@ -0,0 +1,235 @@ +{ + "context_is_admin": "role:admin", + "owner": "tenant_id:%(tenant_id)s", + "admin_or_owner": "rule:context_is_admin or rule:owner", + "context_is_advsvc": "role:advsvc", + "admin_or_network_owner": "rule:context_is_admin or tenant_id:%(network:tenant_id)s", + "admin_owner_or_network_owner": "rule:owner or rule:admin_or_network_owner", + "admin_only": "rule:context_is_admin", + "regular_user": "", + "admin_or_data_plane_int": "rule:context_is_admin or role:data_plane_integrator", + "shared": "field:networks:shared=True", + "shared_subnetpools": "field:subnetpools:shared=True", + "shared_address_scopes": "field:address_scopes:shared=True", + "external": "field:networks:router:external=True", + "default": "rule:admin_or_owner", + + "create_subnet": "rule:admin_or_network_owner", + "create_subnet:segment_id": "rule:admin_only", + "create_subnet:service_types": "rule:admin_only", + "get_subnet": "rule:admin_or_owner or rule:shared", + "get_subnet:segment_id": "rule:admin_only", + "update_subnet": "rule:admin_or_network_owner", + "update_subnet:service_types": "rule:admin_only", + "delete_subnet": "rule:admin_or_network_owner", + + "create_subnetpool": "", + "create_subnetpool:shared": "rule:admin_only", + "create_subnetpool:is_default": "rule:admin_only", + "get_subnetpool": "rule:admin_or_owner or rule:shared_subnetpools", + "update_subnetpool": "rule:admin_or_owner", + "update_subnetpool:is_default": "rule:admin_only", + "delete_subnetpool": "rule:admin_or_owner", + + "create_address_scope": "", + "create_address_scope:shared": "rule:admin_only", + "get_address_scope": "rule:admin_or_owner or rule:shared_address_scopes", + "update_address_scope": "rule:admin_or_owner", + "update_address_scope:shared": "rule:admin_only", + "delete_address_scope": "rule:admin_or_owner", + + "create_network": "", + "get_network": "rule:admin_or_owner or rule:shared or rule:external or rule:context_is_advsvc", + "get_network:router:external": "rule:regular_user", + "get_network:segments": "rule:admin_only", + "get_network:provider:network_type": "rule:admin_only", + "get_network:provider:physical_network": "rule:admin_only", + "get_network:provider:segmentation_id": "rule:admin_only", + "get_network:queue_id": "rule:admin_only", + "get_network_ip_availabilities": "rule:admin_only", + "get_network_ip_availability": "rule:admin_only", + "create_network:shared": "rule:admin_only", + "create_network:router:external": "rule:admin_only", + "create_network:is_default": "rule:admin_only", + "create_network:segments": "rule:admin_only", + "create_network:provider:network_type": "rule:admin_only", + "create_network:provider:physical_network": "rule:admin_only", + "create_network:provider:segmentation_id": "rule:admin_only", + "update_network": "rule:admin_or_owner", + "update_network:segments": "rule:admin_only", + "update_network:shared": "rule:admin_only", + "update_network:provider:network_type": "rule:admin_only", + "update_network:provider:physical_network": "rule:admin_only", + "update_network:provider:segmentation_id": "rule:admin_only", + "update_network:router:external": "rule:admin_only", + "delete_network": "rule:admin_or_owner", + + "create_segment": "rule:admin_only", + "get_segment": "rule:admin_only", + "update_segment": "rule:admin_only", + "delete_segment": "rule:admin_only", + + "network_device": "field:port:device_owner=~^network:", + "create_port": "", + "create_port:device_owner": "not rule:network_device or rule:context_is_advsvc or rule:admin_or_network_owner", + "create_port:mac_address": "rule:context_is_advsvc or rule:admin_or_network_owner", + "create_port:fixed_ips:ip_address": "rule:context_is_advsvc or rule:admin_or_network_owner", + "create_port:fixed_ips:subnet_id": "rule:context_is_advsvc or rule:admin_or_network_owner or rule:shared", + "create_port:port_security_enabled": "rule:context_is_advsvc or rule:admin_or_network_owner", + "create_port:binding:host_id": "rule:admin_only", + "create_port:binding:profile": "rule:admin_only", + "create_port:mac_learning_enabled": "rule:context_is_advsvc or rule:admin_or_network_owner", + "create_port:allowed_address_pairs": "rule:admin_or_network_owner", + "get_port": "rule:context_is_advsvc or rule:admin_owner_or_network_owner", + "get_port:queue_id": "rule:admin_only", + "get_port:binding:vif_type": "rule:admin_only", + "get_port:binding:vif_details": "rule:admin_only", + "get_port:binding:host_id": "rule:admin_only", + "get_port:binding:profile": "rule:admin_only", + "update_port": "rule:admin_or_owner or rule:context_is_advsvc", + "update_port:device_owner": "not rule:network_device or rule:context_is_advsvc or rule:admin_or_network_owner", + "update_port:mac_address": "rule:admin_only or rule:context_is_advsvc", + "update_port:fixed_ips:ip_address": "rule:context_is_advsvc or rule:admin_or_network_owner", + "update_port:fixed_ips:subnet_id": "rule:context_is_advsvc or rule:admin_or_network_owner or rule:shared", + "update_port:port_security_enabled": "rule:context_is_advsvc or rule:admin_or_network_owner", + "update_port:binding:host_id": "rule:admin_only", + "update_port:binding:profile": "rule:admin_only", + "update_port:mac_learning_enabled": "rule:context_is_advsvc or rule:admin_or_network_owner", + "update_port:allowed_address_pairs": "rule:admin_or_network_owner", + "update_port:data_plane_status": "rule:admin_or_data_plane_int", + "delete_port": "rule:context_is_advsvc or rule:admin_owner_or_network_owner", + + "get_router:ha": "rule:admin_only", + "create_router": "rule:regular_user", + "create_router:external_gateway_info:enable_snat": "rule:admin_only", + "create_router:distributed": "rule:admin_only", + "create_router:ha": "rule:admin_only", + "get_router": "rule:admin_or_owner", + "get_router:distributed": "rule:admin_only", + "update_router": "rule:admin_or_owner", + "update_router:external_gateway_info": "rule:admin_or_owner", + "update_router:external_gateway_info:network_id": "rule:admin_or_owner", + "update_router:external_gateway_info:enable_snat": "rule:admin_only", + "update_router:distributed": "rule:admin_only", + "update_router:ha": "rule:admin_only", + "delete_router": "rule:admin_or_owner", + + "add_router_interface": "rule:admin_or_owner", + "remove_router_interface": "rule:admin_or_owner", + + "create_router:external_gateway_info:external_fixed_ips": "rule:admin_only", + "update_router:external_gateway_info:external_fixed_ips": "rule:admin_only", + + "create_qos_queue": "rule:admin_only", + "get_qos_queue": "rule:admin_only", + + "update_agent": "rule:admin_only", + "delete_agent": "rule:admin_only", + "get_agent": "rule:admin_only", + + "create_dhcp-network": "rule:admin_only", + "delete_dhcp-network": "rule:admin_only", + "get_dhcp-networks": "rule:admin_only", + "create_l3-router": "rule:admin_only", + "delete_l3-router": "rule:admin_only", + "get_l3-routers": "rule:admin_only", + "get_dhcp-agents": "rule:admin_only", + "get_l3-agents": "rule:admin_only", + "get_loadbalancer-agent": "rule:admin_only", + "get_loadbalancer-pools": "rule:admin_only", + "get_agent-loadbalancers": "rule:admin_only", + "get_loadbalancer-hosting-agent": "rule:admin_only", + + "create_floatingip": "rule:regular_user", + "create_floatingip:floating_ip_address": "rule:admin_only", + "update_floatingip": "rule:admin_or_owner", + "delete_floatingip": "rule:admin_or_owner", + "get_floatingip": "rule:admin_or_owner", + + "create_network_profile": "rule:admin_only", + "update_network_profile": "rule:admin_only", + "delete_network_profile": "rule:admin_only", + "get_network_profiles": "", + "get_network_profile": "", + "update_policy_profiles": "rule:admin_only", + "get_policy_profiles": "", + "get_policy_profile": "", + + "create_metering_label": "rule:admin_only", + "delete_metering_label": "rule:admin_only", + "get_metering_label": "rule:admin_only", + + "create_metering_label_rule": "rule:admin_only", + "delete_metering_label_rule": "rule:admin_only", + "get_metering_label_rule": "rule:admin_only", + + "get_service_provider": "rule:regular_user", + "get_lsn": "rule:admin_only", + "create_lsn": "rule:admin_only", + + "create_flavor": "rule:admin_only", + "update_flavor": "rule:admin_only", + "delete_flavor": "rule:admin_only", + "get_flavors": "rule:regular_user", + "get_flavor": "rule:regular_user", + "create_service_profile": "rule:admin_only", + "update_service_profile": "rule:admin_only", + "delete_service_profile": "rule:admin_only", + "get_service_profiles": "rule:admin_only", + "get_service_profile": "rule:admin_only", + + "get_policy": "rule:regular_user", + "create_policy": "rule:admin_only", + "update_policy": "rule:admin_only", + "delete_policy": "rule:admin_only", + "get_policy_bandwidth_limit_rule": "rule:regular_user", + "create_policy_bandwidth_limit_rule": "rule:admin_only", + "delete_policy_bandwidth_limit_rule": "rule:admin_only", + "update_policy_bandwidth_limit_rule": "rule:admin_only", + "get_policy_dscp_marking_rule": "rule:regular_user", + "create_policy_dscp_marking_rule": "rule:admin_only", + "delete_policy_dscp_marking_rule": "rule:admin_only", + "update_policy_dscp_marking_rule": "rule:admin_only", + "get_rule_type": "rule:regular_user", + "get_policy_minimum_bandwidth_rule": "rule:regular_user", + "create_policy_minimum_bandwidth_rule": "rule:admin_only", + "delete_policy_minimum_bandwidth_rule": "rule:admin_only", + "update_policy_minimum_bandwidth_rule": "rule:admin_only", + + "restrict_wildcard": "(not field:rbac_policy:target_tenant=*) or rule:admin_only", + "create_rbac_policy": "", + "create_rbac_policy:target_tenant": "rule:restrict_wildcard", + "update_rbac_policy": "rule:admin_or_owner", + "update_rbac_policy:target_tenant": "rule:restrict_wildcard and rule:admin_or_owner", + "get_rbac_policy": "rule:admin_or_owner", + "delete_rbac_policy": "rule:admin_or_owner", + + "create_flavor_service_profile": "rule:admin_only", + "delete_flavor_service_profile": "rule:admin_only", + "get_flavor_service_profile": "rule:regular_user", + "get_auto_allocated_topology": "rule:admin_or_owner", + + "create_trunk": "rule:regular_user", + "get_trunk": "rule:admin_or_owner", + "delete_trunk": "rule:admin_or_owner", + "get_subports": "", + "add_subports": "rule:admin_or_owner", + "remove_subports": "rule:admin_or_owner", + + "get_security_groups": "rule:admin_or_owner", + "get_security_group": "rule:admin_or_owner", + "create_security_group": "rule:admin_or_owner", + "update_security_group": "rule:admin_or_owner", + "delete_security_group": "rule:admin_or_owner", + "get_security_group_rules": "rule:admin_or_owner", + "get_security_group_rule": "rule:admin_or_owner", + "create_security_group_rule": "rule:admin_or_owner", + "delete_security_group_rule": "rule:admin_or_owner", + + "get_loggable_resources": "rule:admin_only", + "create_log": "rule:admin_only", + "update_log": "rule:admin_only", + "delete_log": "rule:admin_only", + "get_logs": "rule:admin_only", + "get_log": "rule:admin_only" +} diff --git a/openstack/openstack_conf/compute/neutron/rootwrap.conf b/openstack/openstack_conf/compute/neutron/rootwrap.conf new file mode 100644 index 0000000..3a6b11f --- /dev/null +++ b/openstack/openstack_conf/compute/neutron/rootwrap.conf @@ -0,0 +1,34 @@ +# Configuration for neutron-rootwrap +# This file should be owned by (and only-writeable by) the root user + +[DEFAULT] +# List of directories to load filter definitions from (separated by ','). +# These directories MUST all be only writeable by root ! +filters_path=/etc/neutron/rootwrap.d,/usr/share/neutron/rootwrap + +# List of directories to search executables in, in case filters do not +# explicitely specify a full path (separated by ',') +# If not specified, defaults to system PATH environment variable. +# These directories MUST all be only writeable by root ! +exec_dirs=/sbin,/usr/sbin,/bin,/usr/bin,/usr/local/bin,/usr/local/sbin + +# Enable logging to syslog +# Default value is False +use_syslog=False + +# Which syslog facility to use. +# Valid values include auth, authpriv, syslog, local0, local1... +# Default value is 'syslog' +syslog_log_facility=syslog + +# Which messages to log. +# INFO means log all usage +# ERROR means only log unsuccessful attempts +syslog_log_level=ERROR + +[xenapi] +# XenAPI configuration is only required by the L2 agent if it is to +# target a XenServer/XCP compute host's dom0. +xenapi_connection_url= +xenapi_connection_username=root +xenapi_connection_password= diff --git a/openstack/openstack_conf/compute/neutron/rootwrap.d/debug.filters b/openstack/openstack_conf/compute/neutron/rootwrap.d/debug.filters new file mode 100644 index 0000000..8d72ce2 --- /dev/null +++ b/openstack/openstack_conf/compute/neutron/rootwrap.d/debug.filters @@ -0,0 +1,18 @@ +# neutron-rootwrap command filters for nodes on which neutron is +# expected to control network +# +# This file should be owned by (and only-writeable by) the root user + +# format seems to be +# cmd-name: filter-name, raw-command, user, args + +[Filters] + +# This is needed because we should ping +# from inside a namespace which requires root +# _alt variants allow to match -c and -w in any order +# (used by NeutronDebugAgent.ping_all) +ping: RegExpFilter, ping, root, ping, -w, \d+, -c, \d+, [0-9\.]+ +ping_alt: RegExpFilter, ping, root, ping, -c, \d+, -w, \d+, [0-9\.]+ +ping6: RegExpFilter, ping6, root, ping6, -w, \d+, -c, \d+, [0-9A-Fa-f:]+ +ping6_alt: RegExpFilter, ping6, root, ping6, -c, \d+, -w, \d+, [0-9A-Fa-f:]+ \ No newline at end of file diff --git a/openstack/openstack_conf/compute/neutron/rootwrap.d/dibbler.filters b/openstack/openstack_conf/compute/neutron/rootwrap.d/dibbler.filters new file mode 100644 index 0000000..7ba7015 --- /dev/null +++ b/openstack/openstack_conf/compute/neutron/rootwrap.d/dibbler.filters @@ -0,0 +1,17 @@ +# neutron-rootwrap command filters for nodes on which neutron is +# expected to control network +# +# This file should be owned by (and only-writeable by) the root user + +# format seems to be +# cmd-name: filter-name, raw-command, user, args + +[Filters] + +# Filters for the dibbler-based reference implementation of the pluggable +# Prefix Delegation driver. Other implementations using an alternative agent +# should include a similar filter in this folder. + +# prefix_delegation_agent +dibbler-client: CommandFilter, dibbler-client, root +kill_dibbler-client: KillFilter, root, dibbler-client, -9 diff --git a/openstack/openstack_conf/compute/neutron/rootwrap.d/ebtables.filters b/openstack/openstack_conf/compute/neutron/rootwrap.d/ebtables.filters new file mode 100644 index 0000000..8e810e7 --- /dev/null +++ b/openstack/openstack_conf/compute/neutron/rootwrap.d/ebtables.filters @@ -0,0 +1,11 @@ +# neutron-rootwrap command filters for nodes on which neutron is +# expected to control network +# +# This file should be owned by (and only-writeable by) the root user + +# format seems to be +# cmd-name: filter-name, raw-command, user, args + +[Filters] + +ebtables: CommandFilter, ebtables, root diff --git a/openstack/openstack_conf/compute/neutron/rootwrap.d/ipset-firewall.filters b/openstack/openstack_conf/compute/neutron/rootwrap.d/ipset-firewall.filters new file mode 100644 index 0000000..52c6637 --- /dev/null +++ b/openstack/openstack_conf/compute/neutron/rootwrap.d/ipset-firewall.filters @@ -0,0 +1,12 @@ +# neutron-rootwrap command filters for nodes on which neutron is +# expected to control network +# +# This file should be owned by (and only-writeable by) the root user + +# format seems to be +# cmd-name: filter-name, raw-command, user, args + +[Filters] +# neutron/agent/linux/iptables_firewall.py +# "ipset", "-A", ... +ipset: CommandFilter, ipset, root diff --git a/openstack/openstack_conf/compute/neutron/rootwrap.d/iptables-firewall.filters b/openstack/openstack_conf/compute/neutron/rootwrap.d/iptables-firewall.filters new file mode 100644 index 0000000..3960a78 --- /dev/null +++ b/openstack/openstack_conf/compute/neutron/rootwrap.d/iptables-firewall.filters @@ -0,0 +1,24 @@ +# neutron-rootwrap command filters for nodes on which neutron is +# expected to control network +# +# This file should be owned by (and only-writeable by) the root user + +# format seems to be +# cmd-name: filter-name, raw-command, user, args + +[Filters] + +# neutron/agent/linux/iptables_firewall.py +# "iptables-save", ... +iptables-save: CommandFilter, iptables-save, root +iptables-restore: CommandFilter, iptables-restore, root +ip6tables-save: CommandFilter, ip6tables-save, root +ip6tables-restore: CommandFilter, ip6tables-restore, root + +# neutron/agent/linux/iptables_firewall.py +# "iptables", "-A", ... +iptables: CommandFilter, iptables, root +ip6tables: CommandFilter, ip6tables, root + +# neutron/agent/linux/ip_conntrack.py +conntrack: CommandFilter, conntrack, root diff --git a/openstack/openstack_conf/compute/neutron/rootwrap.d/l3.filters b/openstack/openstack_conf/compute/neutron/rootwrap.d/l3.filters new file mode 100644 index 0000000..ea18b1c --- /dev/null +++ b/openstack/openstack_conf/compute/neutron/rootwrap.d/l3.filters @@ -0,0 +1,66 @@ +# neutron-rootwrap command filters for nodes on which neutron is +# expected to control network +# +# This file should be owned by (and only-writeable by) the root user + +# format seems to be +# cmd-name: filter-name, raw-command, user, args + +[Filters] + +# arping +arping: CommandFilter, arping, root + +# l3_agent +sysctl: CommandFilter, sysctl, root +route: CommandFilter, route, root +radvd: CommandFilter, radvd, root + +# haproxy +haproxy: RegExpFilter, haproxy, root, haproxy, -f, .* +kill_haproxy: KillFilter, root, haproxy, -15, -9, -HUP +# RHEL invocation of the metadata proxy will report /usr/bin/python +# TODO(dalvarez): Remove kill_metadata* filters in Q release since +# neutron-ns-metadata-proxy is now replaced by haproxy. We keep them for now +# for the migration process +kill_metadata: KillFilter, root, python, -15, -9 +kill_metadata7: KillFilter, root, python2.7, -15, -9 +kill_metadata35: KillFilter, root, python3.5, -15, -9 +kill_radvd_usr: KillFilter, root, /usr/sbin/radvd, -15, -9, -HUP +kill_radvd: KillFilter, root, /sbin/radvd, -15, -9, -HUP + +# ip_lib +ip: IpFilter, ip, root +find: RegExpFilter, find, root, find, /sys/class/net, -maxdepth, 1, -type, l, -printf, %.* +ip_exec: IpNetnsExecFilter, ip, root + +# l3_tc_lib +l3_tc_show_qdisc: RegExpFilter, tc, root, tc, qdisc, show, dev, .+ +l3_tc_add_qdisc_ingress: RegExpFilter, tc, root, tc, qdisc, add, dev, .+, ingress +l3_tc_add_qdisc_egress: RegExpFilter, tc, root, tc, qdisc, add, dev, .+, root, handle, 1:, htb +l3_tc_show_filters: RegExpFilter, tc, root, tc, -p, -s, -d, filter, show, dev, .+, parent, .+, prio, 1 +l3_tc_delete_filters: RegExpFilter, tc, root, tc, filter, del, dev, .+, parent, .+, prio, 1, handle, .+, u32 +l3_tc_add_filter_ingress: RegExpFilter, tc, root, tc, filter, add, dev, .+, parent, .+, protocol, ip, prio, 1, u32, match, ip, dst, .+, police, rate, .+, burst, .+, drop, flowid, :1 +l3_tc_add_filter_egress: RegExpFilter, tc, root, tc, filter, add, dev, .+, parent, .+, protocol, ip, prio, 1, u32, match, ip, src, .+, police, rate, .+, burst, .+, drop, flowid, :1 + +# For ip monitor +kill_ip_monitor: KillFilter, root, ip, -9 + +# ovs_lib (if OVSInterfaceDriver is used) +ovs-vsctl: CommandFilter, ovs-vsctl, root + +# iptables_manager +iptables-save: CommandFilter, iptables-save, root +iptables-restore: CommandFilter, iptables-restore, root +ip6tables-save: CommandFilter, ip6tables-save, root +ip6tables-restore: CommandFilter, ip6tables-restore, root + +# Keepalived +keepalived: CommandFilter, keepalived, root +kill_keepalived: KillFilter, root, /usr/sbin/keepalived, -HUP, -15, -9 + +# l3 agent to delete floatingip's conntrack state +conntrack: CommandFilter, conntrack, root + +# keepalived state change monitor +keepalived_state_change: CommandFilter, neutron-keepalived-state-change, root diff --git a/openstack/openstack_conf/compute/neutron/rootwrap.d/linuxbridge-plugin.filters b/openstack/openstack_conf/compute/neutron/rootwrap.d/linuxbridge-plugin.filters new file mode 100644 index 0000000..298b807 --- /dev/null +++ b/openstack/openstack_conf/compute/neutron/rootwrap.d/linuxbridge-plugin.filters @@ -0,0 +1,29 @@ +# neutron-rootwrap command filters for nodes on which neutron is +# expected to control network +# +# This file should be owned by (and only-writeable by) the root user + +# format seems to be +# cmd-name: filter-name, raw-command, user, args + +[Filters] + +# linuxbridge-agent +# unclear whether both variants are necessary, but I'm transliterating +# from the old mechanism +brctl: CommandFilter, brctl, root +bridge: CommandFilter, bridge, root +sysctl: CommandFilter, sysctl, root + +# ip_lib +ip: IpFilter, ip, root +find: RegExpFilter, find, root, find, /sys/class/net, -maxdepth, 1, -type, l, -printf, %.* +ip_exec: IpNetnsExecFilter, ip, root + +# tc commands needed for QoS support +tc_replace_tbf: RegExpFilter, tc, root, tc, qdisc, replace, dev, .+, root, tbf, rate, .+, latency, .+, burst, .+ +tc_add_ingress: RegExpFilter, tc, root, tc, qdisc, add, dev, .+, ingress, handle, .+ +tc_delete: RegExpFilter, tc, root, tc, qdisc, del, dev, .+, .+ +tc_show_qdisc: RegExpFilter, tc, root, tc, qdisc, show, dev, .+ +tc_show_filters: RegExpFilter, tc, root, tc, filter, show, dev, .+, parent, .+ +tc_add_filter: RegExpFilter, tc, root, tc, filter, add, dev, .+, parent, .+, protocol, all, prio, .+, basic, police, rate, .+, burst, .+, mtu, .+, drop diff --git a/openstack/openstack_conf/compute/nova/api-paste.ini b/openstack/openstack_conf/compute/nova/api-paste.ini new file mode 100755 index 0000000..8bde418 --- /dev/null +++ b/openstack/openstack_conf/compute/nova/api-paste.ini @@ -0,0 +1,84 @@ +############ +# Metadata # +############ +[composite:metadata] +use = egg:Paste#urlmap +/: meta + +[pipeline:meta] +pipeline = cors metaapp + +[app:metaapp] +paste.app_factory = nova.api.metadata.handler:MetadataRequestHandler.factory + +############# +# OpenStack # +############# + +[composite:osapi_compute] +use = call:nova.api.openstack.urlmap:urlmap_factory +/: oscomputeversions +# v21 is an exactly feature match for v2, except it has more stringent +# input validation on the wsgi surface (prevents fuzzing early on the +# API). It also provides new features via API microversions which are +# opt into for clients. Unaware clients will receive the same frozen +# v2 API feature set, but with some relaxed validation +/v2: openstack_compute_api_v21_legacy_v2_compatible +/v2.1: openstack_compute_api_v21 + +[composite:openstack_compute_api_v21] +use = call:nova.api.auth:pipeline_factory_v21 +noauth2 = cors http_proxy_to_wsgi compute_req_id faultwrap request_log sizelimit osprofiler noauth2 osapi_compute_app_v21 +keystone = cors http_proxy_to_wsgi compute_req_id faultwrap request_log sizelimit osprofiler authtoken keystonecontext osapi_compute_app_v21 + +[composite:openstack_compute_api_v21_legacy_v2_compatible] +use = call:nova.api.auth:pipeline_factory_v21 +noauth2 = cors http_proxy_to_wsgi compute_req_id faultwrap request_log sizelimit osprofiler noauth2 legacy_v2_compatible osapi_compute_app_v21 +keystone = cors http_proxy_to_wsgi compute_req_id faultwrap request_log sizelimit osprofiler authtoken keystonecontext legacy_v2_compatible osapi_compute_app_v21 + +[filter:request_log] +paste.filter_factory = nova.api.openstack.requestlog:RequestLog.factory + +[filter:compute_req_id] +paste.filter_factory = nova.api.compute_req_id:ComputeReqIdMiddleware.factory + +[filter:faultwrap] +paste.filter_factory = nova.api.openstack:FaultWrapper.factory + +[filter:noauth2] +paste.filter_factory = nova.api.openstack.auth:NoAuthMiddleware.factory + +[filter:osprofiler] +paste.filter_factory = nova.profiler:WsgiMiddleware.factory + +[filter:sizelimit] +paste.filter_factory = oslo_middleware:RequestBodySizeLimiter.factory + +[filter:http_proxy_to_wsgi] +paste.filter_factory = oslo_middleware.http_proxy_to_wsgi:HTTPProxyToWSGI.factory + +[filter:legacy_v2_compatible] +paste.filter_factory = nova.api.openstack:LegacyV2CompatibleWrapper.factory + +[app:osapi_compute_app_v21] +paste.app_factory = nova.api.openstack.compute:APIRouterV21.factory + +[pipeline:oscomputeversions] +pipeline = cors faultwrap request_log http_proxy_to_wsgi oscomputeversionapp + +[app:oscomputeversionapp] +paste.app_factory = nova.api.openstack.compute.versions:Versions.factory + +########## +# Shared # +########## + +[filter:cors] +paste.filter_factory = oslo_middleware.cors:filter_factory +oslo_config_project = nova + +[filter:keystonecontext] +paste.filter_factory = nova.api.auth:NovaKeystoneContext.factory + +[filter:authtoken] +paste.filter_factory = keystonemiddleware.auth_token:filter_factory diff --git a/openstack/openstack_conf/compute/nova/logging.conf b/openstack/openstack_conf/compute/nova/logging.conf new file mode 100755 index 0000000..6841819 --- /dev/null +++ b/openstack/openstack_conf/compute/nova/logging.conf @@ -0,0 +1,84 @@ +[loggers] +keys = root, nova + +[handlers] +keys = stderr, stdout, watchedfile, syslog, null + +[formatters] +keys = context, default + +[logger_root] +level = WARNING +handlers = null + +[logger_nova] +level = INFO +handlers = stderr +qualname = nova + +[logger_amqp] +level = WARNING +handlers = stderr +qualname = amqp + +[logger_amqplib] +level = WARNING +handlers = stderr +qualname = amqplib + +[logger_sqlalchemy] +level = WARNING +handlers = stderr +qualname = sqlalchemy +# "level = INFO" logs SQL queries. +# "level = DEBUG" logs SQL queries and results. +# "level = WARNING" logs neither. (Recommended for production systems.) + +[logger_boto] +level = WARNING +handlers = stderr +qualname = boto + +# NOTE(mikal): suds is used by the vmware driver, removing this will +# cause many extraneous log lines for their tempest runs. Refer to +# https://review.openstack.org/#/c/219225/ for details. +[logger_suds] +level = INFO +handlers = stderr +qualname = suds + +[logger_eventletwsgi] +level = WARNING +handlers = stderr +qualname = eventlet.wsgi.server + +[handler_stderr] +class = StreamHandler +args = (sys.stderr,) +formatter = context + +[handler_stdout] +class = StreamHandler +args = (sys.stdout,) +formatter = context + +[handler_watchedfile] +class = handlers.WatchedFileHandler +args = ('nova.log',) +formatter = context + +[handler_syslog] +class = handlers.SysLogHandler +args = ('/dev/log', handlers.SysLogHandler.LOG_USER) +formatter = context + +[handler_null] +class = logging.NullHandler +formatter = default +args = () + +[formatter_context] +class = oslo_log.formatters.ContextFormatter + +[formatter_default] +format = %(message)s diff --git a/openstack/openstack_conf/compute/nova/nova-compute.conf b/openstack/openstack_conf/compute/nova/nova-compute.conf new file mode 100755 index 0000000..1ef5590 --- /dev/null +++ b/openstack/openstack_conf/compute/nova/nova-compute.conf @@ -0,0 +1,4 @@ +[DEFAULT] +compute_driver=libvirt.LibvirtDriver +[libvirt] +virt_type=qemu diff --git a/openstack/openstack_conf/compute/nova/nova.conf b/openstack/openstack_conf/compute/nova/nova.conf new file mode 100755 index 0000000..b710649 --- /dev/null +++ b/openstack/openstack_conf/compute/nova/nova.conf @@ -0,0 +1,11227 @@ +[DEFAULT] +firewall_driver = nova.virt.firewall.NoopFirewallDriver +use_neutron = True +my_ip = 10.0.0.31 +transport_url = rabbit://openstack:rabbitPass@controller +lock_path = /var/lock/nova +state_path = /var/lib/nova + +# +# From nova.conf +# + +# +# Availability zone for internal services. +# +# This option determines the availability zone for the various internal nova +# services, such as 'nova-scheduler', 'nova-conductor', etc. +# +# Possible values: +# +# * Any string representing an existing availability zone name. +# (string value) +#internal_service_availability_zone = internal + +# +# Default availability zone for compute services. +# +# This option determines the default availability zone for 'nova-compute' +# services, which will be used if the service(s) do not belong to aggregates +# with +# availability zone metadata. +# +# Possible values: +# +# * Any string representing an existing availability zone name. +# (string value) +#default_availability_zone = nova + +# +# Default availability zone for instances. +# +# This option determines the default availability zone for instances, which will +# be used when a user does not specify one when creating an instance. The +# instance(s) will be bound to this availability zone for their lifetime. +# +# Possible values: +# +# * Any string representing an existing availability zone name. +# * None, which means that the instance can move from one availability zone to +# another during its lifetime if it is moved from one compute node to another. +# (string value) +#default_schedule_zone = + +# Length of generated instance admin passwords. (integer value) +# Minimum value: 0 +#password_length = 12 + +# +# Time period to generate instance usages for. It is possible to define optional +# offset to given period by appending @ character followed by a number defining +# offset. +# +# Possible values: +# +# * period, example: ``hour``, ``day``, ``month` or ``year`` +# * period with offset, example: ``month@15`` will result in monthly audits +# starting on 15th day of month. +# (string value) +#instance_usage_audit_period = month + +# +# Start and use a daemon that can run the commands that need to be run with +# root privileges. This option is usually enabled on nodes that run nova compute +# processes. +# (boolean value) +#use_rootwrap_daemon = false + +# +# Path to the rootwrap configuration file. +# +# Goal of the root wrapper is to allow a service-specific unprivileged user to +# run a number of actions as the root user in the safest manner possible. +# The configuration file used here must match the one defined in the sudoers +# entry. +# (string value) +#rootwrap_config = /etc/nova/rootwrap.conf + +# Explicitly specify the temporary working directory. (string value) +#tempdir = + +# DEPRECATED: +# Determine if monkey patching should be applied. +# +# Related options: +# +# * ``monkey_patch_modules``: This must have values set for this option to +# have any effect +# (boolean value) +# This option is deprecated for removal since 17.0.0. +# Its value may be silently ignored in the future. +# Reason: +# Monkey patching nova is not tested, not supported, and is a barrier +# for interoperability. +#monkey_patch = false + +# DEPRECATED: +# List of modules/decorators to monkey patch. +# +# This option allows you to patch a decorator for all functions in specified +# modules. +# +# Possible values: +# +# * nova.compute.api:nova.notifications.notify_decorator +# * [...] +# +# Related options: +# +# * ``monkey_patch``: This must be set to ``True`` for this option to +# have any effect +# (list value) +# This option is deprecated for removal since 17.0.0. +# Its value may be silently ignored in the future. +# Reason: +# Monkey patching nova is not tested, not supported, and is a barrier +# for interoperability. +#monkey_patch_modules = nova.compute.api:nova.notifications.notify_decorator + +# +# Defines which driver to use for controlling virtualization. +# +# Possible values: +# +# * ``libvirt.LibvirtDriver`` +# * ``xenapi.XenAPIDriver`` +# * ``fake.FakeDriver`` +# * ``ironic.IronicDriver`` +# * ``vmwareapi.VMwareVCDriver`` +# * ``hyperv.HyperVDriver`` +# * ``powervm.PowerVMDriver`` +# (string value) +#compute_driver = + +# +# Allow destination machine to match source for resize. Useful when +# testing in single-host environments. By default it is not allowed +# to resize to the same host. Setting this option to true will add +# the same host to the destination options. Also set to true +# if you allow the ServerGroupAffinityFilter and need to resize. +# (boolean value) +#allow_resize_to_same_host = false + +# +# Image properties that should not be inherited from the instance +# when taking a snapshot. +# +# This option gives an opportunity to select which image-properties +# should not be inherited by newly created snapshots. +# +# Possible values: +# +# * A comma-separated list whose item is an image property. Usually only +# the image properties that are only needed by base images can be included +# here, since the snapshots that are created from the base images don't +# need them. +# * Default list: cache_in_nova, bittorrent, img_signature_hash_method, +# img_signature, img_signature_key_type, +# img_signature_certificate_uuid +# +# (list value) +#non_inheritable_image_properties = cache_in_nova,bittorrent,img_signature_hash_method,img_signature,img_signature_key_type,img_signature_certificate_uuid + +# DEPRECATED: +# When creating multiple instances with a single request using the +# os-multiple-create API extension, this template will be used to build +# the display name for each instance. The benefit is that the instances +# end up with different hostnames. Example display names when creating +# two VM's: name-1, name-2. +# +# Possible values: +# +# * Valid keys for the template are: name, uuid, count. +# (string value) +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# This config changes API behaviour. All changes in API behaviour should be +# discoverable. +#multi_instance_display_name_template = %(name)s-%(count)d + +# +# Maximum number of devices that will result in a local image being +# created on the hypervisor node. +# +# A negative number means unlimited. Setting max_local_block_devices +# to 0 means that any request that attempts to create a local disk +# will fail. This option is meant to limit the number of local discs +# (so root local disc that is the result of --image being used, and +# any other ephemeral and swap disks). 0 does not mean that images +# will be automatically converted to volumes and boot instances from +# volumes - it just means that all requests that attempt to create a +# local disk will fail. +# +# Possible values: +# +# * 0: Creating a local disk is not allowed. +# * Negative number: Allows unlimited number of local discs. +# * Positive number: Allows only these many number of local discs. +# (Default value is 3). +# (integer value) +#max_local_block_devices = 3 + +# +# A comma-separated list of monitors that can be used for getting +# compute metrics. You can use the alias/name from the setuptools +# entry points for nova.compute.monitors.* namespaces. If no +# namespace is supplied, the "cpu." namespace is assumed for +# backwards-compatibility. +# +# NOTE: Only one monitor per namespace (For example: cpu) can be loaded at +# a time. +# +# Possible values: +# +# * An empty list will disable the feature (Default). +# * An example value that would enable both the CPU and NUMA memory +# bandwidth monitors that use the virt driver variant: +# +# compute_monitors = cpu.virt_driver, numa_mem_bw.virt_driver +# (list value) +#compute_monitors = + +# +# The default format an ephemeral_volume will be formatted with on creation. +# +# Possible values: +# +# * ``ext2`` +# * ``ext3`` +# * ``ext4`` +# * ``xfs`` +# * ``ntfs`` (only for Windows guests) +# (string value) +#default_ephemeral_format = + +# +# Determine if instance should boot or fail on VIF plugging timeout. +# +# Nova sends a port update to Neutron after an instance has been scheduled, +# providing Neutron with the necessary information to finish setup of the port. +# Once completed, Neutron notifies Nova that it has finished setting up the +# port, at which point Nova resumes the boot of the instance since network +# connectivity is now supposed to be present. A timeout will occur if the reply +# is not received after a given interval. +# +# This option determines what Nova does when the VIF plugging timeout event +# happens. When enabled, the instance will error out. When disabled, the +# instance will continue to boot on the assumption that the port is ready. +# +# Possible values: +# +# * True: Instances should fail after VIF plugging timeout +# * False: Instances should continue booting after VIF plugging timeout +# (boolean value) +#vif_plugging_is_fatal = true + +# +# Timeout for Neutron VIF plugging event message arrival. +# +# Number of seconds to wait for Neutron vif plugging events to +# arrive before continuing or failing (see 'vif_plugging_is_fatal'). +# +# Related options: +# +# * vif_plugging_is_fatal - If ``vif_plugging_timeout`` is set to zero and +# ``vif_plugging_is_fatal`` is False, events should not be expected to +# arrive at all. +# (integer value) +# Minimum value: 0 +#vif_plugging_timeout = 300 + +# Path to '/etc/network/interfaces' template. +# +# The path to a template file for the '/etc/network/interfaces'-style file, +# which +# will be populated by nova and subsequently used by cloudinit. This provides a +# method to configure network connectivity in environments without a DHCP +# server. +# +# The template will be rendered using Jinja2 template engine, and receive a +# top-level key called ``interfaces``. This key will contain a list of +# dictionaries, one for each interface. +# +# Refer to the cloudinit documentaion for more information: +# +# https://cloudinit.readthedocs.io/en/latest/topics/datasources.html +# +# Possible values: +# +# * A path to a Jinja2-formatted template for a Debian '/etc/network/interfaces' +# file. This applies even if using a non Debian-derived guest. +# +# Related options: +# +# * ``flat_inject``: This must be set to ``True`` to ensure nova embeds network +# configuration information in the metadata provided through the config drive. +# (string value) +#injected_network_template = $pybasedir/nova/virt/interfaces.template + +# +# The image preallocation mode to use. +# +# Image preallocation allows storage for instance images to be allocated up +# front +# when the instance is initially provisioned. This ensures immediate feedback is +# given if enough space isn't available. In addition, it should significantly +# improve performance on writes to new blocks and may even improve I/O +# performance to prewritten blocks due to reduced fragmentation. +# +# Possible values: +# +# * "none" => no storage provisioning is done up front +# * "space" => storage is fully allocated at instance start +# (string value) +# Possible values: +# none - +# space - +#preallocate_images = none + +# +# Enable use of copy-on-write (cow) images. +# +# QEMU/KVM allow the use of qcow2 as backing files. By disabling this, +# backing files will not be used. +# (boolean value) +#use_cow_images = true + +# +# Force conversion of backing images to raw format. +# +# Possible values: +# +# * True: Backing image files will be converted to raw image format +# * False: Backing image files will not be converted +# +# Related options: +# +# * ``compute_driver``: Only the libvirt driver uses this option. +# (boolean value) +#force_raw_images = true + +# +# Name of the mkfs commands for ephemeral device. +# +# The format is = +# (multi valued) +#virt_mkfs = + +# +# Enable resizing of filesystems via a block device. +# +# If enabled, attempt to resize the filesystem by accessing the image over a +# block device. This is done by the host and may not be necessary if the image +# contains a recent version of cloud-init. Possible mechanisms require the nbd +# driver (for qcow and raw), or loop (for raw). +# (boolean value) +#resize_fs_using_block_device = false + +# Amount of time, in seconds, to wait for NBD device start up. (integer value) +# Minimum value: 0 +#timeout_nbd = 10 + +# +# Location of cached images. +# +# This is NOT the full path - just a folder name relative to '$instances_path'. +# For per-compute-host cached images, set to '_base_$my_ip' +# (string value) +#image_cache_subdirectory_name = _base + +# Should unused base images be removed? (boolean value) +#remove_unused_base_images = true + +# +# Unused unresized base images younger than this will not be removed. +# (integer value) +#remove_unused_original_minimum_age_seconds = 86400 + +# +# Generic property to specify the pointer type. +# +# Input devices allow interaction with a graphical framebuffer. For +# example to provide a graphic tablet for absolute cursor movement. +# +# If set, the 'hw_pointer_model' image property takes precedence over +# this configuration option. +# +# Possible values: +# +# * None: Uses default behavior provided by drivers (mouse on PS2 for +# libvirt x86) +# * ps2mouse: Uses relative movement. Mouse connected by PS2 +# * usbtablet: Uses absolute movement. Tablet connect by USB +# +# Related options: +# +# * usbtablet must be configured with VNC enabled or SPICE enabled and SPICE +# agent disabled. When used with libvirt the instance mode should be +# configured as HVM. +# (string value) +# Possible values: +# - +# ps2mouse - +# usbtablet - +#pointer_model = usbtablet + +# +# Defines which physical CPUs (pCPUs) can be used by instance +# virtual CPUs (vCPUs). +# +# Possible values: +# +# * A comma-separated list of physical CPU numbers that virtual CPUs can be +# allocated to by default. Each element should be either a single CPU number, +# a range of CPU numbers, or a caret followed by a CPU number to be +# excluded from a previous range. For example: +# +# vcpu_pin_set = "4-12,^8,15" +# (string value) +#vcpu_pin_set = + +# +# Number of huge/large memory pages to reserved per NUMA host cell. +# +# Possible values: +# +# * A list of valid key=value which reflect NUMA node ID, page size +# (Default unit is KiB) and number of pages to be reserved. +# +# reserved_huge_pages = node:0,size:2048,count:64 +# reserved_huge_pages = node:1,size:1GB,count:1 +# +# In this example we are reserving on NUMA node 0 64 pages of 2MiB +# and on NUMA node 1 1 page of 1GiB. +# (dict value) +#reserved_huge_pages = + +# +# Amount of disk resources in MB to make them always available to host. The +# disk usage gets reported back to the scheduler from nova-compute running +# on the compute nodes. To prevent the disk resources from being considered +# as available, this option can be used to reserve disk space for that host. +# +# Possible values: +# +# * Any positive integer representing amount of disk in MB to reserve +# for the host. +# (integer value) +# Minimum value: 0 +#reserved_host_disk_mb = 0 + +# +# Amount of memory in MB to reserve for the host so that it is always available +# to host processes. The host resources usage is reported back to the scheduler +# continuously from nova-compute running on the compute node. To prevent the +# host +# memory from being considered as available, this option is used to reserve +# memory for the host. +# +# Possible values: +# +# * Any positive integer representing amount of memory in MB to reserve +# for the host. +# (integer value) +# Minimum value: 0 +#reserved_host_memory_mb = 512 + +# +# Number of physical CPUs to reserve for the host. The host resources usage is +# reported back to the scheduler continuously from nova-compute running on the +# compute node. To prevent the host CPU from being considered as available, +# this option is used to reserve random pCPU(s) for the host. +# +# Possible values: +# +# * Any positive integer representing number of physical CPUs to reserve +# for the host. +# (integer value) +# Minimum value: 0 +#reserved_host_cpus = 0 + +# +# This option helps you specify virtual CPU to physical CPU allocation ratio. +# +# From Ocata (15.0.0) this is used to influence the hosts selected by +# the Placement API. Note that when Placement is used, the CoreFilter +# is redundant, because the Placement API will have already filtered +# out hosts that would have failed the CoreFilter. +# +# This configuration specifies ratio for CoreFilter which can be set +# per compute node. For AggregateCoreFilter, it will fall back to this +# configuration value if no per-aggregate setting is found. +# +# NOTE: This can be set per-compute, or if set to 0.0, the value +# set on the scheduler node(s) or compute node(s) will be used +# and defaulted to 16.0. +# +# NOTE: As of the 16.0.0 Pike release, this configuration option is ignored +# for the ironic.IronicDriver compute driver and is hardcoded to 1.0. +# +# Possible values: +# +# * Any valid positive integer or float value +# (floating point value) +# Minimum value: 0 +#cpu_allocation_ratio = 0.0 + +# +# This option helps you specify virtual RAM to physical RAM +# allocation ratio. +# +# From Ocata (15.0.0) this is used to influence the hosts selected by +# the Placement API. Note that when Placement is used, the RamFilter +# is redundant, because the Placement API will have already filtered +# out hosts that would have failed the RamFilter. +# +# This configuration specifies ratio for RamFilter which can be set +# per compute node. For AggregateRamFilter, it will fall back to this +# configuration value if no per-aggregate setting found. +# +# NOTE: This can be set per-compute, or if set to 0.0, the value +# set on the scheduler node(s) or compute node(s) will be used and +# defaulted to 1.5. +# +# NOTE: As of the 16.0.0 Pike release, this configuration option is ignored +# for the ironic.IronicDriver compute driver and is hardcoded to 1.0. +# +# Possible values: +# +# * Any valid positive integer or float value +# (floating point value) +# Minimum value: 0 +#ram_allocation_ratio = 0.0 + +# +# This option helps you specify virtual disk to physical disk +# allocation ratio. +# +# From Ocata (15.0.0) this is used to influence the hosts selected by +# the Placement API. Note that when Placement is used, the DiskFilter +# is redundant, because the Placement API will have already filtered +# out hosts that would have failed the DiskFilter. +# +# A ratio greater than 1.0 will result in over-subscription of the +# available physical disk, which can be useful for more +# efficiently packing instances created with images that do not +# use the entire virtual disk, such as sparse or compressed +# images. It can be set to a value between 0.0 and 1.0 in order +# to preserve a percentage of the disk for uses other than +# instances. +# +# NOTE: This can be set per-compute, or if set to 0.0, the value +# set on the scheduler node(s) or compute node(s) will be used and +# defaulted to 1.0. +# +# NOTE: As of the 16.0.0 Pike release, this configuration option is ignored +# for the ironic.IronicDriver compute driver and is hardcoded to 1.0. +# +# Possible values: +# +# * Any valid positive integer or float value +# (floating point value) +# Minimum value: 0 +#disk_allocation_ratio = 0.0 + +# +# Console proxy host to be used to connect to instances on this host. It is the +# publicly visible name for the console host. +# +# Possible values: +# +# * Current hostname (default) or any string representing hostname. +# (string value) +#console_host = + +# +# Name of the network to be used to set access IPs for instances. If there are +# multiple IPs to choose from, an arbitrary one will be chosen. +# +# Possible values: +# +# * None (default) +# * Any string representing network name. +# (string value) +#default_access_ip_network_name = + +# +# Whether to batch up the application of IPTables rules during a host restart +# and apply all at the end of the init phase. +# (boolean value) +#defer_iptables_apply = false + +# +# Specifies where instances are stored on the hypervisor's disk. +# It can point to locally attached storage or a directory on NFS. +# +# Possible values: +# +# * $state_path/instances where state_path is a config option that specifies +# the top-level directory for maintaining nova's state. (default) or +# Any string representing directory path. +# (string value) +#instances_path = $state_path/instances + +# +# This option enables periodic compute.instance.exists notifications. Each +# compute node must be configured to generate system usage data. These +# notifications are consumed by OpenStack Telemetry service. +# (boolean value) +#instance_usage_audit = false + +# +# Maximum number of 1 second retries in live_migration. It specifies number +# of retries to iptables when it complains. It happens when an user continuously +# sends live-migration request to same host leading to concurrent request +# to iptables. +# +# Possible values: +# +# * Any positive integer representing retry count. +# (integer value) +# Minimum value: 0 +#live_migration_retry_count = 30 + +# +# This option specifies whether to start guests that were running before the +# host rebooted. It ensures that all of the instances on a Nova compute node +# resume their state each time the compute node boots or restarts. +# (boolean value) +#resume_guests_state_on_host_boot = false + +# +# Number of times to retry network allocation. It is required to attempt network +# allocation retries if the virtual interface plug fails. +# +# Possible values: +# +# * Any positive integer representing retry count. +# (integer value) +# Minimum value: 0 +#network_allocate_retries = 0 + +# +# Limits the maximum number of instance builds to run concurrently by +# nova-compute. Compute service can attempt to build an infinite number of +# instances, if asked to do so. This limit is enforced to avoid building +# unlimited instance concurrently on a compute node. This value can be set +# per compute node. +# +# Possible Values: +# +# * 0 : treated as unlimited. +# * Any positive integer representing maximum concurrent builds. +# (integer value) +# Minimum value: 0 +#max_concurrent_builds = 10 + +# +# Maximum number of live migrations to run concurrently. This limit is enforced +# to avoid outbound live migrations overwhelming the host/network and causing +# failures. It is not recommended that you change this unless you are very sure +# that doing so is safe and stable in your environment. +# +# Possible values: +# +# * 0 : treated as unlimited. +# * Negative value defaults to 0. +# * Any positive integer representing maximum number of live migrations +# to run concurrently. +# (integer value) +#max_concurrent_live_migrations = 1 + +# +# Number of times to retry block device allocation on failures. Starting with +# Liberty, Cinder can use image volume cache. This may help with block device +# allocation performance. Look at the cinder image_volume_cache_enabled +# configuration option. +# +# Possible values: +# +# * 60 (default) +# * If value is 0, then one attempt is made. +# * Any negative value is treated as 0. +# * For any value > 0, total attempts are (value + 1) +# (integer value) +#block_device_allocate_retries = 60 + +# +# Number of greenthreads available for use to sync power states. +# +# This option can be used to reduce the number of concurrent requests +# made to the hypervisor or system with real instance power states +# for performance reasons, for example, with Ironic. +# +# Possible values: +# +# * Any positive integer representing greenthreads count. +# (integer value) +#sync_power_state_pool_size = 1000 + +# +# Number of seconds to wait between runs of the image cache manager. +# +# Possible values: +# * 0: run at the default rate. +# * -1: disable +# * Any other value +# (integer value) +# Minimum value: -1 +#image_cache_manager_interval = 2400 + +# +# Interval to pull network bandwidth usage info. +# +# Not supported on all hypervisors. If a hypervisor doesn't support bandwidth +# usage, it will not get the info in the usage events. +# +# Possible values: +# +# * 0: Will run at the default periodic interval. +# * Any value < 0: Disables the option. +# * Any positive integer in seconds. +# (integer value) +#bandwidth_poll_interval = 600 + +# +# Interval to sync power states between the database and the hypervisor. +# +# The interval that Nova checks the actual virtual machine power state +# and the power state that Nova has in its database. If a user powers +# down their VM, Nova updates the API to report the VM has been +# powered down. Should something turn on the VM unexpectedly, +# Nova will turn the VM back off to keep the system in the expected +# state. +# +# Possible values: +# +# * 0: Will run at the default periodic interval. +# * Any value < 0: Disables the option. +# * Any positive integer in seconds. +# +# Related options: +# +# * If ``handle_virt_lifecycle_events`` in workarounds_group is +# false and this option is negative, then instances that get out +# of sync between the hypervisor and the Nova database will have +# to be synchronized manually. +# (integer value) +#sync_power_state_interval = 600 + +# +# Interval between instance network information cache updates. +# +# Number of seconds after which each compute node runs the task of +# querying Neutron for all of its instances networking information, +# then updates the Nova db with that information. Nova will never +# update it's cache if this option is set to 0. If we don't update the +# cache, the metadata service and nova-api endpoints will be proxying +# incorrect network data about the instance. So, it is not recommended +# to set this option to 0. +# +# Possible values: +# +# * Any positive integer in seconds. +# * Any value <=0 will disable the sync. This is not recommended. +# (integer value) +#heal_instance_info_cache_interval = 60 + +# +# Interval for reclaiming deleted instances. +# +# A value greater than 0 will enable SOFT_DELETE of instances. +# This option decides whether the server to be deleted will be put into +# the SOFT_DELETED state. If this value is greater than 0, the deleted +# server will not be deleted immediately, instead it will be put into +# a queue until it's too old (deleted time greater than the value of +# reclaim_instance_interval). The server can be recovered from the +# delete queue by using the restore action. If the deleted server remains +# longer than the value of reclaim_instance_interval, it will be +# deleted by a periodic task in the compute service automatically. +# +# Note that this option is read from both the API and compute nodes, and +# must be set globally otherwise servers could be put into a soft deleted +# state in the API and never actually reclaimed (deleted) on the compute +# node. +# +# Possible values: +# +# * Any positive integer(in seconds) greater than 0 will enable +# this option. +# * Any value <=0 will disable the option. +# (integer value) +#reclaim_instance_interval = 0 + +# +# Interval for gathering volume usages. +# +# This option updates the volume usage cache for every +# volume_usage_poll_interval number of seconds. +# +# Possible values: +# +# * Any positive integer(in seconds) greater than 0 will enable +# this option. +# * Any value <=0 will disable the option. +# (integer value) +#volume_usage_poll_interval = 0 + +# +# Interval for polling shelved instances to offload. +# +# The periodic task runs for every shelved_poll_interval number +# of seconds and checks if there are any shelved instances. If it +# finds a shelved instance, based on the 'shelved_offload_time' config +# value it offloads the shelved instances. Check 'shelved_offload_time' +# config option description for details. +# +# Possible values: +# +# * Any value <= 0: Disables the option. +# * Any positive integer in seconds. +# +# Related options: +# +# * ``shelved_offload_time`` +# (integer value) +#shelved_poll_interval = 3600 + +# +# Time before a shelved instance is eligible for removal from a host. +# +# By default this option is set to 0 and the shelved instance will be +# removed from the hypervisor immediately after shelve operation. +# Otherwise, the instance will be kept for the value of +# shelved_offload_time(in seconds) so that during the time period the +# unshelve action will be faster, then the periodic task will remove +# the instance from hypervisor after shelved_offload_time passes. +# +# Possible values: +# +# * 0: Instance will be immediately offloaded after being +# shelved. +# * Any value < 0: An instance will never offload. +# * Any positive integer in seconds: The instance will exist for +# the specified number of seconds before being offloaded. +# (integer value) +#shelved_offload_time = 0 + +# +# Interval for retrying failed instance file deletes. +# +# This option depends on 'maximum_instance_delete_attempts'. +# This option specifies how often to retry deletes whereas +# 'maximum_instance_delete_attempts' specifies the maximum number +# of retry attempts that can be made. +# +# Possible values: +# +# * 0: Will run at the default periodic interval. +# * Any value < 0: Disables the option. +# * Any positive integer in seconds. +# +# Related options: +# +# * ``maximum_instance_delete_attempts`` from instance_cleaning_opts +# group. +# (integer value) +#instance_delete_interval = 300 + +# +# Interval (in seconds) between block device allocation retries on failures. +# +# This option allows the user to specify the time interval between +# consecutive retries. 'block_device_allocate_retries' option specifies +# the maximum number of retries. +# +# Possible values: +# +# * 0: Disables the option. +# * Any positive integer in seconds enables the option. +# +# Related options: +# +# * ``block_device_allocate_retries`` in compute_manager_opts group. +# (integer value) +# Minimum value: 0 +#block_device_allocate_retries_interval = 3 + +# +# Interval between sending the scheduler a list of current instance UUIDs to +# verify that its view of instances is in sync with nova. +# +# If the CONF option 'scheduler_tracks_instance_changes' is +# False, the sync calls will not be made. So, changing this option will +# have no effect. +# +# If the out of sync situations are not very common, this interval +# can be increased to lower the number of RPC messages being sent. +# Likewise, if sync issues turn out to be a problem, the interval +# can be lowered to check more frequently. +# +# Possible values: +# +# * 0: Will run at the default periodic interval. +# * Any value < 0: Disables the option. +# * Any positive integer in seconds. +# +# Related options: +# +# * This option has no impact if ``scheduler_tracks_instance_changes`` +# is set to False. +# (integer value) +#scheduler_instance_sync_interval = 120 + +# +# Interval for updating compute resources. +# +# This option specifies how often the update_available_resources +# periodic task should run. A number less than 0 means to disable the +# task completely. Leaving this at the default of 0 will cause this to +# run at the default periodic interval. Setting it to any positive +# value will cause it to run at approximately that number of seconds. +# +# Possible values: +# +# * 0: Will run at the default periodic interval. +# * Any value < 0: Disables the option. +# * Any positive integer in seconds. +# (integer value) +#update_resources_interval = 0 + +# +# Time interval after which an instance is hard rebooted automatically. +# +# When doing a soft reboot, it is possible that a guest kernel is +# completely hung in a way that causes the soft reboot task +# to not ever finish. Setting this option to a time period in seconds +# will automatically hard reboot an instance if it has been stuck +# in a rebooting state longer than N seconds. +# +# Possible values: +# +# * 0: Disables the option (default). +# * Any positive integer in seconds: Enables the option. +# (integer value) +# Minimum value: 0 +#reboot_timeout = 0 + +# +# Maximum time in seconds that an instance can take to build. +# +# If this timer expires, instance status will be changed to ERROR. +# Enabling this option will make sure an instance will not be stuck +# in BUILD state for a longer period. +# +# Possible values: +# +# * 0: Disables the option (default) +# * Any positive integer in seconds: Enables the option. +# (integer value) +# Minimum value: 0 +#instance_build_timeout = 0 + +# +# Interval to wait before un-rescuing an instance stuck in RESCUE. +# +# Possible values: +# +# * 0: Disables the option (default) +# * Any positive integer in seconds: Enables the option. +# (integer value) +# Minimum value: 0 +#rescue_timeout = 0 + +# +# Automatically confirm resizes after N seconds. +# +# Resize functionality will save the existing server before resizing. +# After the resize completes, user is requested to confirm the resize. +# The user has the opportunity to either confirm or revert all +# changes. Confirm resize removes the original server and changes +# server status from resized to active. Setting this option to a time +# period (in seconds) will automatically confirm the resize if the +# server is in resized state longer than that time. +# +# Possible values: +# +# * 0: Disables the option (default) +# * Any positive integer in seconds: Enables the option. +# (integer value) +# Minimum value: 0 +#resize_confirm_window = 0 + +# +# Total time to wait in seconds for an instance toperform a clean +# shutdown. +# +# It determines the overall period (in seconds) a VM is allowed to +# perform a clean shutdown. While performing stop, rescue and shelve, +# rebuild operations, configuring this option gives the VM a chance +# to perform a controlled shutdown before the instance is powered off. +# The default timeout is 60 seconds. +# +# The timeout value can be overridden on a per image basis by means +# of os_shutdown_timeout that is an image metadata setting allowing +# different types of operating systems to specify how much time they +# need to shut down cleanly. +# +# Possible values: +# +# * Any positive integer in seconds (default value is 60). +# (integer value) +# Minimum value: 1 +#shutdown_timeout = 60 + +# +# The compute service periodically checks for instances that have been +# deleted in the database but remain running on the compute node. The +# above option enables action to be taken when such instances are +# identified. +# +# Possible values: +# +# * reap: Powers down the instances and deletes them(default) +# * log: Logs warning message about deletion of the resource +# * shutdown: Powers down instances and marks them as non- +# bootable which can be later used for debugging/analysis +# * noop: Takes no action +# +# Related options: +# +# * running_deleted_instance_poll_interval +# * running_deleted_instance_timeout +# (string value) +# Possible values: +# noop - +# log - +# shutdown - +# reap - +#running_deleted_instance_action = reap + +# +# Time interval in seconds to wait between runs for the clean up action. +# If set to 0, above check will be disabled. If "running_deleted_instance +# _action" is set to "log" or "reap", a value greater than 0 must be set. +# +# Possible values: +# +# * Any positive integer in seconds enables the option. +# * 0: Disables the option. +# * 1800: Default value. +# +# Related options: +# +# * running_deleted_instance_action +# (integer value) +#running_deleted_instance_poll_interval = 1800 + +# +# Time interval in seconds to wait for the instances that have +# been marked as deleted in database to be eligible for cleanup. +# +# Possible values: +# +# * Any positive integer in seconds(default is 0). +# +# Related options: +# +# * "running_deleted_instance_action" +# (integer value) +#running_deleted_instance_timeout = 0 + +# +# The number of times to attempt to reap an instance's files. +# +# This option specifies the maximum number of retry attempts +# that can be made. +# +# Possible values: +# +# * Any positive integer defines how many attempts are made. +# * Any value <=0 means no delete attempts occur, but you should use +# ``instance_delete_interval`` to disable the delete attempts. +# +# Related options: +# * ``instance_delete_interval`` in interval_opts group can be used to disable +# this option. +# (integer value) +#maximum_instance_delete_attempts = 5 + +# +# Sets the scope of the check for unique instance names. +# +# The default doesn't check for unique names. If a scope for the name check is +# set, a launch of a new instance or an update of an existing instance with a +# duplicate name will result in an ''InstanceExists'' error. The uniqueness is +# case-insensitive. Setting this option can increase the usability for end +# users as they don't have to distinguish among instances with the same name +# by their IDs. +# +# Possible values: +# +# * '': An empty value means that no uniqueness check is done and duplicate +# names are possible. +# * "project": The instance name check is done only for instances within the +# same project. +# * "global": The instance name check is done for all instances regardless of +# the project. +# (string value) +# Possible values: +# '' - +# project - +# global - +#osapi_compute_unique_server_name_scope = + +# +# Enable new nova-compute services on this host automatically. +# +# When a new nova-compute service starts up, it gets +# registered in the database as an enabled service. Sometimes it can be useful +# to register new compute services in disabled state and then enabled them at a +# later point in time. This option only sets this behavior for nova-compute +# services, it does not auto-disable other services like nova-conductor, +# nova-scheduler, nova-consoleauth, or nova-osapi_compute. +# +# Possible values: +# +# * ``True``: Each new compute service is enabled as soon as it registers +# itself. +# * ``False``: Compute services must be enabled via an os-services REST API call +# or with the CLI with ``nova service-enable ``, otherwise +# they are not ready to use. +# (boolean value) +#enable_new_services = true + +# +# Template string to be used to generate instance names. +# +# This template controls the creation of the database name of an instance. This +# is *not* the display name you enter when creating an instance (via Horizon +# or CLI). For a new deployment it is advisable to change the default value +# (which uses the database autoincrement) to another value which makes use +# of the attributes of an instance, like ``instance-%(uuid)s``. If you +# already have instances in your deployment when you change this, your +# deployment will break. +# +# Possible values: +# +# * A string which either uses the instance database ID (like the +# default) +# * A string with a list of named database columns, for example ``%(id)d`` +# or ``%(uuid)s`` or ``%(hostname)s``. +# +# Related options: +# +# * not to be confused with: ``multi_instance_display_name_template`` +# (string value) +#instance_name_template = instance-%08x + +# +# Number of times to retry live-migration before failing. +# +# Possible values: +# +# * If == -1, try until out of hosts (default) +# * If == 0, only try once, no retries +# * Integer greater than 0 +# (integer value) +# Minimum value: -1 +#migrate_max_retries = -1 + +# +# Configuration drive format +# +# Configuration drive format that will contain metadata attached to the +# instance when it boots. +# +# Possible values: +# +# * iso9660: A file system image standard that is widely supported across +# operating systems. NOTE: Mind the libvirt bug +# (https://bugs.launchpad.net/nova/+bug/1246201) - If your hypervisor +# driver is libvirt, and you want live migrate to work without shared storage, +# then use VFAT. +# * vfat: For legacy reasons, you can configure the configuration drive to +# use VFAT format instead of ISO 9660. +# +# Related options: +# +# * This option is meaningful when one of the following alternatives occur: +# 1. force_config_drive option set to 'true' +# 2. the REST API call to create the instance contains an enable flag for +# config drive option +# 3. the image used to create the instance requires a config drive, +# this is defined by img_config_drive property for that image. +# * A compute node running Hyper-V hypervisor can be configured to attach +# configuration drive as a CD drive. To attach the configuration drive as a CD +# drive, set config_drive_cdrom option at hyperv section, to true. +# (string value) +# Possible values: +# iso9660 - +# vfat - +#config_drive_format = iso9660 + +# +# Force injection to take place on a config drive +# +# When this option is set to true configuration drive functionality will be +# forced enabled by default, otherwise user can still enable configuration +# drives via the REST API or image metadata properties. +# +# Possible values: +# +# * True: Force to use of configuration drive regardless the user's input in the +# REST API call. +# * False: Do not force use of configuration drive. Config drives can still be +# enabled via the REST API or image metadata properties. +# +# Related options: +# +# * Use the 'mkisofs_cmd' flag to set the path where you install the +# genisoimage program. If genisoimage is in same path as the +# nova-compute service, you do not need to set this flag. +# * To use configuration drive with Hyper-V, you must set the +# 'mkisofs_cmd' value to the full path to an mkisofs.exe installation. +# Additionally, you must set the qemu_img_cmd value in the hyperv +# configuration section to the full path to an qemu-img command +# installation. +# (boolean value) +#force_config_drive = false + +# +# Name or path of the tool used for ISO image creation +# +# Use the mkisofs_cmd flag to set the path where you install the genisoimage +# program. If genisoimage is on the system path, you do not need to change +# the default value. +# +# To use configuration drive with Hyper-V, you must set the mkisofs_cmd value +# to the full path to an mkisofs.exe installation. Additionally, you must set +# the qemu_img_cmd value in the hyperv configuration section to the full path +# to an qemu-img command installation. +# +# Possible values: +# +# * Name of the ISO image creator program, in case it is in the same directory +# as the nova-compute service +# * Path to ISO image creator program +# +# Related options: +# +# * This option is meaningful when config drives are enabled. +# * To use configuration drive with Hyper-V, you must set the qemu_img_cmd +# value in the hyperv configuration section to the full path to an qemu-img +# command installation. +# (string value) +#mkisofs_cmd = genisoimage + +# DEPRECATED: The driver to use for database access (string value) +# This option is deprecated for removal since 13.0.0. +# Its value may be silently ignored in the future. +#db_driver = nova.db + +# DEPRECATED: +# Default flavor to use for the EC2 API only. +# The Nova API does not support a default flavor. +# (string value) +# This option is deprecated for removal since 14.0.0. +# Its value may be silently ignored in the future. +# Reason: The EC2 API is deprecated. +#default_flavor = m1.small + +# +# The IP address which the host is using to connect to the management network. +# +# Possible values: +# +# * String with valid IP address. Default is IPv4 address of this host. +# +# Related options: +# +# * metadata_host +# * my_block_storage_ip +# * routing_source_ip +# * vpn_ip +# (string value) +#my_ip = + +# +# The IP address which is used to connect to the block storage network. +# +# Possible values: +# +# * String with valid IP address. Default is IP address of this host. +# +# Related options: +# +# * my_ip - if my_block_storage_ip is not set, then my_ip value is used. +# (string value) +#my_block_storage_ip = $my_ip + +# +# Hostname, FQDN or IP address of this host. +# +# Used as: +# +# * the oslo.messaging queue name for nova-compute worker +# * we use this value for the binding_host sent to neutron. This means if you +# use +# a neutron agent, it should have the same value for host. +# * cinder host attachment information +# +# Must be valid within AMQP key. +# +# Possible values: +# +# * String with hostname, FQDN or IP address. Default is hostname of this host. +# (string value) +#host = + +# DEPRECATED: +# This option is a list of full paths to one or more configuration files for +# dhcpbridge. In most cases the default path of '/etc/nova/nova-dhcpbridge.conf' +# should be sufficient, but if you have special needs for configuring +# dhcpbridge, +# you can change or add to this list. +# +# Possible values +# +# * A list of strings, where each string is the full path to a dhcpbridge +# configuration file. +# (multi valued) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#dhcpbridge_flagfile = /etc/nova/nova-dhcpbridge.conf + +# DEPRECATED: +# The location where the network configuration files will be kept. The default +# is +# the 'networks' directory off of the location where nova's Python module is +# installed. +# +# Possible values +# +# * A string containing the full path to the desired configuration directory +# (string value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#networks_path = $state_path/networks + +# DEPRECATED: +# This is the name of the network interface for public IP addresses. The default +# is 'eth0'. +# +# Possible values: +# +# * Any string representing a network interface name +# (string value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#public_interface = eth0 + +# DEPRECATED: +# The location of the binary nova-dhcpbridge. By default it is the binary named +# 'nova-dhcpbridge' that is installed with all the other nova binaries. +# +# Possible values: +# +# * Any string representing the full path to the binary for dhcpbridge +# (string value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#dhcpbridge = $bindir/nova-dhcpbridge + +# DEPRECATED: +# The public IP address of the network host. +# +# This is used when creating an SNAT rule. +# +# Possible values: +# +# * Any valid IP address +# +# Related options: +# +# * ``force_snat_range`` +# (string value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#routing_source_ip = $my_ip + +# DEPRECATED: +# The lifetime of a DHCP lease, in seconds. The default is 86400 (one day). +# +# Possible values: +# +# * Any positive integer value. +# (integer value) +# Minimum value: 1 +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#dhcp_lease_time = 86400 + +# DEPRECATED: +# Despite the singular form of the name of this option, it is actually a list of +# zero or more server addresses that dnsmasq will use for DNS nameservers. If +# this is not empty, dnsmasq will not read /etc/resolv.conf, but will only use +# the servers specified in this option. If the option use_network_dns_servers is +# True, the dns1 and dns2 servers from the network will be appended to this +# list, +# and will be used as DNS servers, too. +# +# Possible values: +# +# * A list of strings, where each string is either an IP address or a FQDN. +# +# Related options: +# +# * ``use_network_dns_servers`` +# (multi valued) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#dns_server = + +# DEPRECATED: +# When this option is set to True, the dns1 and dns2 servers for the network +# specified by the user on boot will be used for DNS, as well as any specified +# in +# the `dns_server` option. +# +# Related options: +# +# * ``dns_server`` +# (boolean value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#use_network_dns_servers = false + +# DEPRECATED: +# This option is a list of zero or more IP address ranges in your network's DMZ +# that should be accepted. +# +# Possible values: +# +# * A list of strings, each of which should be a valid CIDR. +# (list value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#dmz_cidr = + +# DEPRECATED: +# This is a list of zero or more IP ranges that traffic from the +# `routing_source_ip` will be SNATted to. If the list is empty, then no SNAT +# rules are created. +# +# Possible values: +# +# * A list of strings, each of which should be a valid CIDR. +# +# Related options: +# +# * ``routing_source_ip`` +# (multi valued) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#force_snat_range = + +# DEPRECATED: +# The path to the custom dnsmasq configuration file, if any. +# +# Possible values: +# +# * The full path to the configuration file, or an empty string if there is no +# custom dnsmasq configuration file. +# (string value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#dnsmasq_config_file = + +# DEPRECATED: +# This is the class used as the ethernet device driver for linuxnet bridge +# operations. The default value should be all you need for most cases, but if +# you +# wish to use a customized class, set this option to the full dot-separated +# import path for that class. +# +# Possible values: +# +# * Any string representing a dot-separated class path that Nova can import. +# (string value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#linuxnet_interface_driver = nova.network.linux_net.LinuxBridgeInterfaceDriver + +# DEPRECATED: +# The name of the Open vSwitch bridge that is used with linuxnet when connecting +# with Open vSwitch." +# +# Possible values: +# +# * Any string representing a valid bridge name. +# (string value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#linuxnet_ovs_integration_bridge = br-int + +# +# When True, when a device starts up, and upon binding floating IP addresses, +# arp +# messages will be sent to ensure that the arp caches on the compute hosts are +# up-to-date. +# +# Related options: +# +# * ``send_arp_for_ha_count`` +# (boolean value) +#send_arp_for_ha = false + +# +# When arp messages are configured to be sent, they will be sent with the count +# set to the value of this option. Of course, if this is set to zero, no arp +# messages will be sent. +# +# Possible values: +# +# * Any integer greater than or equal to 0 +# +# Related options: +# +# * ``send_arp_for_ha`` +# (integer value) +#send_arp_for_ha_count = 3 + +# DEPRECATED: +# When set to True, only the firt nic of a VM will get its default gateway from +# the DHCP server. +# (boolean value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#use_single_default_gateway = false + +# DEPRECATED: +# One or more interfaces that bridges can forward traffic to. If any of the +# items +# in this list is the special keyword 'all', then all traffic will be forwarded. +# +# Possible values: +# +# * A list of zero or more interface names, or the word 'all'. +# (multi valued) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#forward_bridge_interface = all + +# +# This option determines the IP address for the network metadata API server. +# +# This is really the client side of the metadata host equation that allows +# nova-network to find the metadata server when doing a default multi host +# networking. +# +# Possible values: +# +# * Any valid IP address. The default is the address of the Nova API server. +# +# Related options: +# +# * ``metadata_port`` +# (string value) +#metadata_host = $my_ip + +# DEPRECATED: +# This option determines the port used for the metadata API server. +# +# Related options: +# +# * ``metadata_host`` +# (port value) +# Minimum value: 0 +# Maximum value: 65535 +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#metadata_port = 8775 + +# DEPRECATED: +# This expression, if defined, will select any matching iptables rules and place +# them at the top when applying metadata changes to the rules. +# +# Possible values: +# +# * Any string representing a valid regular expression, or an empty string +# +# Related options: +# +# * ``iptables_bottom_regex`` +# (string value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#iptables_top_regex = + +# DEPRECATED: +# This expression, if defined, will select any matching iptables rules and place +# them at the bottom when applying metadata changes to the rules. +# +# Possible values: +# +# * Any string representing a valid regular expression, or an empty string +# +# Related options: +# +# * iptables_top_regex +# (string value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#iptables_bottom_regex = + +# DEPRECATED: +# By default, packets that do not pass the firewall are DROPped. In many cases, +# though, an operator may find it more useful to change this from DROP to +# REJECT, +# so that the user issuing those packets may have a better idea as to what's +# going on, or LOGDROP in order to record the blocked traffic before DROPping. +# +# Possible values: +# +# * A string representing an iptables chain. The default is DROP. +# (string value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#iptables_drop_action = DROP + +# DEPRECATED: +# This option represents the period of time, in seconds, that the ovs_vsctl +# calls +# will wait for a response from the database before timing out. A setting of 0 +# means that the utility should wait forever for a response. +# +# Possible values: +# +# * Any positive integer if a limited timeout is desired, or zero if the calls +# should wait forever for a response. +# (integer value) +# Minimum value: 0 +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#ovs_vsctl_timeout = 120 + +# DEPRECATED: +# This option is used mainly in testing to avoid calls to the underlying network +# utilities. +# (boolean value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#fake_network = false + +# DEPRECATED: +# This option determines the number of times to retry ebtables commands before +# giving up. The minimum number of retries is 1. +# +# Possible values: +# +# * Any positive integer +# +# Related options: +# +# * ``ebtables_retry_interval`` +# (integer value) +# Minimum value: 1 +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#ebtables_exec_attempts = 3 + +# DEPRECATED: +# This option determines the time, in seconds, that the system will sleep in +# between ebtables retries. Note that each successive retry waits a multiple of +# this value, so for example, if this is set to the default of 1.0 seconds, and +# ebtables_exec_attempts is 4, after the first failure, the system will sleep +# for +# 1 * 1.0 seconds, after the second failure it will sleep 2 * 1.0 seconds, and +# after the third failure it will sleep 3 * 1.0 seconds. +# +# Possible values: +# +# * Any non-negative float or integer. Setting this to zero will result in no +# waiting between attempts. +# +# Related options: +# +# * ebtables_exec_attempts +# (floating point value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#ebtables_retry_interval = 1.0 + +# DEPRECATED: +# Enable neutron as the backend for networking. +# +# Determine whether to use Neutron or Nova Network as the back end. Set to true +# to use neutron. +# (boolean value) +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#use_neutron = true + +# +# This option determines whether the network setup information is injected into +# the VM before it is booted. While it was originally designed to be used only +# by nova-network, it is also used by the vmware and xenapi virt drivers to +# control whether network information is injected into a VM. The libvirt virt +# driver also uses it when we use config_drive to configure network to control +# whether network information is injected into a VM. +# (boolean value) +#flat_injected = false + +# DEPRECATED: +# This option determines the bridge used for simple network interfaces when no +# bridge is specified in the VM creation request. +# +# Please note that this option is only used when using nova-network instead of +# Neutron in your deployment. +# +# Possible values: +# +# * Any string representing a valid network bridge, such as 'br100' +# +# Related options: +# +# * ``use_neutron`` +# (string value) +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#flat_network_bridge = + +# DEPRECATED: +# This is the address of the DNS server for a simple network. If this option is +# not specified, the default of '8.8.4.4' is used. +# +# Please note that this option is only used when using nova-network instead of +# Neutron in your deployment. +# +# Possible values: +# +# * Any valid IP address. +# +# Related options: +# +# * ``use_neutron`` +# (string value) +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#flat_network_dns = 8.8.4.4 + +# DEPRECATED: +# This option is the name of the virtual interface of the VM on which the bridge +# will be built. While it was originally designed to be used only by +# nova-network, it is also used by libvirt for the bridge interface name. +# +# Possible values: +# +# * Any valid virtual interface name, such as 'eth0' +# (string value) +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#flat_interface = + +# DEPRECATED: +# This is the VLAN number used for private networks. Note that the when creating +# the networks, if the specified number has already been assigned, nova-network +# will increment this number until it finds an available VLAN. +# +# Please note that this option is only used when using nova-network instead of +# Neutron in your deployment. It also will be ignored if the configuration +# option +# for `network_manager` is not set to the default of +# 'nova.network.manager.VlanManager'. +# +# Possible values: +# +# * Any integer between 1 and 4094. Values outside of that range will raise a +# ValueError exception. +# +# Related options: +# +# * ``network_manager`` +# * ``use_neutron`` +# (integer value) +# Minimum value: 1 +# Maximum value: 4094 +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#vlan_start = 100 + +# DEPRECATED: +# This option is the name of the virtual interface of the VM on which the VLAN +# bridge will be built. While it was originally designed to be used only by +# nova-network, it is also used by libvirt and xenapi for the bridge interface +# name. +# +# Please note that this setting will be ignored in nova-network if the +# configuration option for `network_manager` is not set to the default of +# 'nova.network.manager.VlanManager'. +# +# Possible values: +# +# * Any valid virtual interface name, such as 'eth0' +# (string value) +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. While +# this option has an effect when using neutron, it incorrectly override the +# value +# provided by neutron and should therefore not be used. +#vlan_interface = + +# DEPRECATED: +# This option represents the number of networks to create if not explicitly +# specified when the network is created. The only time this is used is if a CIDR +# is specified, but an explicit network_size is not. In that case, the subnets +# are created by diving the IP address space of the CIDR by num_networks. The +# resulting subnet sizes cannot be larger than the configuration option +# `network_size`; in that event, they are reduced to `network_size`, and a +# warning is logged. +# +# Please note that this option is only used when using nova-network instead of +# Neutron in your deployment. +# +# Possible values: +# +# * Any positive integer is technically valid, although there are practical +# limits based upon available IP address space and virtual interfaces. +# +# Related options: +# +# * ``use_neutron`` +# * ``network_size`` +# (integer value) +# Minimum value: 1 +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#num_networks = 1 + +# DEPRECATED: +# This option is no longer used since the /os-cloudpipe API was removed in the +# 16.0.0 Pike release. This is the public IP address for the cloudpipe VPN +# servers. It defaults to the IP address of the host. +# +# Please note that this option is only used when using nova-network instead of +# Neutron in your deployment. It also will be ignored if the configuration +# option +# for `network_manager` is not set to the default of +# 'nova.network.manager.VlanManager'. +# +# Possible values: +# +# * Any valid IP address. The default is ``$my_ip``, the IP address of the VM. +# +# Related options: +# +# * ``network_manager`` +# * ``use_neutron`` +# * ``vpn_start`` +# (string value) +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#vpn_ip = $my_ip + +# DEPRECATED: +# This is the port number to use as the first VPN port for private networks. +# +# Please note that this option is only used when using nova-network instead of +# Neutron in your deployment. It also will be ignored if the configuration +# option +# for `network_manager` is not set to the default of +# 'nova.network.manager.VlanManager', or if you specify a value the 'vpn_start' +# parameter when creating a network. +# +# Possible values: +# +# * Any integer representing a valid port number. The default is 1000. +# +# Related options: +# +# * ``use_neutron`` +# * ``vpn_ip`` +# * ``network_manager`` +# (port value) +# Minimum value: 0 +# Maximum value: 65535 +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#vpn_start = 1000 + +# DEPRECATED: +# This option determines the number of addresses in each private subnet. +# +# Please note that this option is only used when using nova-network instead of +# Neutron in your deployment. +# +# Possible values: +# +# * Any positive integer that is less than or equal to the available network +# size. Note that if you are creating multiple networks, they must all fit in +# the available IP address space. The default is 256. +# +# Related options: +# +# * ``use_neutron`` +# * ``num_networks`` +# (integer value) +# Minimum value: 1 +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#network_size = 256 + +# DEPRECATED: +# This option determines the fixed IPv6 address block when creating a network. +# +# Please note that this option is only used when using nova-network instead of +# Neutron in your deployment. +# +# Possible values: +# +# * Any valid IPv6 CIDR +# +# Related options: +# +# * ``use_neutron`` +# (string value) +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#fixed_range_v6 = fd00::/48 + +# DEPRECATED: +# This is the default IPv4 gateway. It is used only in the testing suite. +# +# Please note that this option is only used when using nova-network instead of +# Neutron in your deployment. +# +# Possible values: +# +# * Any valid IP address. +# +# Related options: +# +# * ``use_neutron`` +# * ``gateway_v6`` +# (string value) +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#gateway = + +# DEPRECATED: +# This is the default IPv6 gateway. It is used only in the testing suite. +# +# Please note that this option is only used when using nova-network instead of +# Neutron in your deployment. +# +# Possible values: +# +# * Any valid IP address. +# +# Related options: +# +# * ``use_neutron`` +# * ``gateway`` +# (string value) +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#gateway_v6 = + +# DEPRECATED: +# This option represents the number of IP addresses to reserve at the top of the +# address range for VPN clients. It also will be ignored if the configuration +# option for `network_manager` is not set to the default of +# 'nova.network.manager.VlanManager'. +# +# Possible values: +# +# * Any integer, 0 or greater. +# +# Related options: +# +# * ``use_neutron`` +# * ``network_manager`` +# (integer value) +# Minimum value: 0 +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#cnt_vpn_clients = 0 + +# DEPRECATED: +# This is the number of seconds to wait before disassociating a deallocated +# fixed +# IP address. This is only used with the nova-network service, and has no effect +# when using neutron for networking. +# +# Possible values: +# +# * Any integer, zero or greater. +# +# Related options: +# +# * ``use_neutron`` +# (integer value) +# Minimum value: 0 +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#fixed_ip_disassociate_timeout = 600 + +# DEPRECATED: +# This option determines how many times nova-network will attempt to create a +# unique MAC address before giving up and raising a +# `VirtualInterfaceMacAddressException` error. +# +# Possible values: +# +# * Any positive integer. The default is 5. +# +# Related options: +# +# * ``use_neutron`` +# (integer value) +# Minimum value: 1 +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#create_unique_mac_address_attempts = 5 + +# DEPRECATED: +# Determines whether unused gateway devices, both VLAN and bridge, are deleted +# if +# the network is in nova-network VLAN mode and is multi-hosted. +# +# Related options: +# +# * ``use_neutron`` +# * ``vpn_ip`` +# * ``fake_network`` +# (boolean value) +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#teardown_unused_network_gateway = false + +# DEPRECATED: +# When this option is True, a call is made to release the DHCP for the instance +# when that instance is terminated. +# +# Related options: +# +# * ``use_neutron`` +# (boolean value) +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#force_dhcp_release = true + +# DEPRECATED: +# When this option is True, whenever a DNS entry must be updated, a fanout cast +# message is sent to all network hosts to update their DNS entries in multi-host +# mode. +# +# Related options: +# +# * ``use_neutron`` +# (boolean value) +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#update_dns_entries = false + +# DEPRECATED: +# This option determines the time, in seconds, to wait between refreshing DNS +# entries for the network. +# +# Possible values: +# +# * A positive integer +# * -1 to disable updates +# +# Related options: +# +# * ``use_neutron`` +# (integer value) +# Minimum value: -1 +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#dns_update_periodic_interval = -1 + +# DEPRECATED: +# This option allows you to specify the domain for the DHCP server. +# +# Possible values: +# +# * Any string that is a valid domain name. +# +# Related options: +# +# * ``use_neutron`` +# (string value) +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#dhcp_domain = novalocal + +# DEPRECATED: +# This option allows you to specify the L3 management library to be used. +# +# Possible values: +# +# * Any dot-separated string that represents the import path to an L3 networking +# library. +# +# Related options: +# +# * ``use_neutron`` +# (string value) +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#l3_lib = nova.network.l3.LinuxNetL3 + +# DEPRECATED: +# THIS VALUE SHOULD BE SET WHEN CREATING THE NETWORK. +# +# If True in multi_host mode, all compute hosts share the same dhcp address. The +# same IP address used for DHCP will be added on each nova-network node which is +# only visible to the VMs on the same host. +# +# The use of this configuration has been deprecated and may be removed in any +# release after Mitaka. It is recommended that instead of relying on this +# option, +# an explicit value should be passed to 'create_networks()' as a keyword +# argument +# with the name 'share_address'. +# (boolean value) +# This option is deprecated for removal since 2014.2. +# Its value may be silently ignored in the future. +#share_dhcp_address = false + +# DEPRECATED: +# URL for LDAP server which will store DNS entries +# +# Possible values: +# +# * A valid LDAP URL representing the server +# (uri value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#ldap_dns_url = ldap://ldap.example.com:389 + +# DEPRECATED: Bind user for LDAP server (string value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#ldap_dns_user = uid=admin,ou=people,dc=example,dc=org + +# DEPRECATED: Bind user's password for LDAP server (string value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#ldap_dns_password = password + +# DEPRECATED: +# Hostmaster for LDAP DNS driver Statement of Authority +# +# Possible values: +# +# * Any valid string representing LDAP DNS hostmaster. +# (string value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#ldap_dns_soa_hostmaster = hostmaster@example.org + +# DEPRECATED: +# DNS Servers for LDAP DNS driver +# +# Possible values: +# +# * A valid URL representing a DNS server +# (multi valued) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#ldap_dns_servers = dns.example.org + +# DEPRECATED: +# Base distinguished name for the LDAP search query +# +# This option helps to decide where to look up the host in LDAP. +# (string value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#ldap_dns_base_dn = ou=hosts,dc=example,dc=org + +# DEPRECATED: +# Refresh interval (in seconds) for LDAP DNS driver Start of Authority +# +# Time interval, a secondary/slave DNS server waits before requesting for +# primary DNS server's current SOA record. If the records are different, +# secondary DNS server will request a zone transfer from primary. +# +# NOTE: Lower values would cause more traffic. +# (integer value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#ldap_dns_soa_refresh = 1800 + +# DEPRECATED: +# Retry interval (in seconds) for LDAP DNS driver Start of Authority +# +# Time interval, a secondary/slave DNS server should wait, if an +# attempt to transfer zone failed during the previous refresh interval. +# (integer value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#ldap_dns_soa_retry = 3600 + +# DEPRECATED: +# Expiry interval (in seconds) for LDAP DNS driver Start of Authority +# +# Time interval, a secondary/slave DNS server holds the information +# before it is no longer considered authoritative. +# (integer value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#ldap_dns_soa_expiry = 86400 + +# DEPRECATED: +# Minimum interval (in seconds) for LDAP DNS driver Start of Authority +# +# It is Minimum time-to-live applies for all resource records in the +# zone file. This value is supplied to other servers how long they +# should keep the data in cache. +# (integer value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#ldap_dns_soa_minimum = 7200 + +# DEPRECATED: +# Default value for multi_host in networks. +# +# nova-network service can operate in a multi-host or single-host mode. +# In multi-host mode each compute node runs a copy of nova-network and the +# instances on that compute node use the compute node as a gateway to the +# Internet. Where as in single-host mode, a central server runs the nova-network +# service. All compute nodes forward traffic from the instances to the +# cloud controller which then forwards traffic to the Internet. +# +# If this options is set to true, some rpc network calls will be sent directly +# to host. +# +# Note that this option is only used when using nova-network instead of +# Neutron in your deployment. +# +# Related options: +# +# * ``use_neutron`` +# (boolean value) +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#multi_host = false + +# DEPRECATED: +# Driver to use for network creation. +# +# Network driver initializes (creates bridges and so on) only when the +# first VM lands on a host node. All network managers configure the +# network using network drivers. The driver is not tied to any particular +# network manager. +# +# The default Linux driver implements vlans, bridges, and iptables rules +# using linux utilities. +# +# Note that this option is only used when using nova-network instead +# of Neutron in your deployment. +# +# Related options: +# +# * ``use_neutron`` +# (string value) +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#network_driver = nova.network.linux_net + +# DEPRECATED: +# Firewall driver to use with ``nova-network`` service. +# +# This option only applies when using the ``nova-network`` service. When using +# another networking services, such as Neutron, this should be to set to the +# ``nova.virt.firewall.NoopFirewallDriver``. +# +# Possible values: +# +# * ``nova.virt.firewall.IptablesFirewallDriver`` +# * ``nova.virt.firewall.NoopFirewallDriver`` +# * ``nova.virt.libvirt.firewall.IptablesFirewallDriver`` +# * [...] +# +# Related options: +# +# * ``use_neutron``: This must be set to ``False`` to enable ``nova-network`` +# networking +# (string value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#firewall_driver = nova.virt.firewall.NoopFirewallDriver + +# DEPRECATED: +# Determine whether to allow network traffic from same network. +# +# When set to true, hosts on the same subnet are not filtered and are allowed +# to pass all types of traffic between them. On a flat network, this allows +# all instances from all projects unfiltered communication. With VLAN +# networking, this allows access between instances within the same project. +# +# This option only applies when using the ``nova-network`` service. When using +# another networking services, such as Neutron, security groups or other +# approaches should be used. +# +# Possible values: +# +# * True: Network traffic should be allowed pass between all instances on the +# same network, regardless of their tenant and security policies +# * False: Network traffic should not be allowed pass between instances unless +# it is unblocked in a security group +# +# Related options: +# +# * ``use_neutron``: This must be set to ``False`` to enable ``nova-network`` +# networking +# * ``firewall_driver``: This must be set to +# ``nova.virt.libvirt.firewall.IptablesFirewallDriver`` to ensure the +# libvirt firewall driver is enabled. +# (boolean value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#allow_same_net_traffic = true + +# DEPRECATED: +# Default pool for floating IPs. +# +# This option specifies the default floating IP pool for allocating floating +# IPs. +# +# While allocating a floating ip, users can optionally pass in the name of the +# pool they want to allocate from, otherwise it will be pulled from the +# default pool. +# +# If this option is not set, then 'nova' is used as default floating pool. +# +# Possible values: +# +# * Any string representing a floating IP pool name +# (string value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# This option was used for two purposes: to set the floating IP pool name for +# nova-network and to do the same for neutron. nova-network is deprecated, as +# are +# any related configuration options. Users of neutron, meanwhile, should use the +# 'default_floating_pool' option in the '[neutron]' group. +#default_floating_pool = nova + +# DEPRECATED: +# Autoassigning floating IP to VM +# +# When set to True, floating IP is auto allocated and associated +# to the VM upon creation. +# +# Related options: +# +# * use_neutron: this options only works with nova-network. +# (boolean value) +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#auto_assign_floating_ip = false + +# DEPRECATED: +# Full class name for the DNS Manager for floating IPs. +# +# This option specifies the class of the driver that provides functionality +# to manage DNS entries associated with floating IPs. +# +# When a user adds a DNS entry for a specified domain to a floating IP, +# nova will add a DNS entry using the specified floating DNS driver. +# When a floating IP is deallocated, its DNS entry will automatically be +# deleted. +# +# Possible values: +# +# * Full Python path to the class to be used +# +# Related options: +# +# * use_neutron: this options only works with nova-network. +# (string value) +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#floating_ip_dns_manager = nova.network.noop_dns_driver.NoopDNSDriver + +# DEPRECATED: +# Full class name for the DNS Manager for instance IPs. +# +# This option specifies the class of the driver that provides functionality +# to manage DNS entries for instances. +# +# On instance creation, nova will add DNS entries for the instance name and +# id, using the specified instance DNS driver and domain. On instance deletion, +# nova will remove the DNS entries. +# +# Possible values: +# +# * Full Python path to the class to be used +# +# Related options: +# +# * use_neutron: this options only works with nova-network. +# (string value) +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#instance_dns_manager = nova.network.noop_dns_driver.NoopDNSDriver + +# DEPRECATED: +# If specified, Nova checks if the availability_zone of every instance matches +# what the database says the availability_zone should be for the specified +# dns_domain. +# +# Related options: +# +# * use_neutron: this options only works with nova-network. +# (string value) +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#instance_dns_domain = + +# DEPRECATED: +# Assign IPv6 and IPv4 addresses when creating instances. +# +# Related options: +# +# * use_neutron: this only works with nova-network. +# (boolean value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#use_ipv6 = false + +# DEPRECATED: +# Abstracts out IPv6 address generation to pluggable backends. +# +# nova-network can be put into dual-stack mode, so that it uses +# both IPv4 and IPv6 addresses. In dual-stack mode, by default, instances +# acquire IPv6 global unicast addresses with the help of stateless address +# auto-configuration mechanism. +# +# Related options: +# +# * use_neutron: this option only works with nova-network. +# * use_ipv6: this option only works if ipv6 is enabled for nova-network. +# (string value) +# Possible values: +# rfc2462 - +# account_identifier - +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#ipv6_backend = rfc2462 + +# DEPRECATED: +# This option is used to enable or disable quota checking for tenant networks. +# +# Related options: +# +# * quota_networks +# (boolean value) +# This option is deprecated for removal since 14.0.0. +# Its value may be silently ignored in the future. +# Reason: +# CRUD operations on tenant networks are only available when using nova-network +# and nova-network is itself deprecated. +#enable_network_quota = false + +# DEPRECATED: +# This option controls the number of private networks that can be created per +# project (or per tenant). +# +# Related options: +# +# * enable_network_quota +# (integer value) +# Minimum value: 0 +# This option is deprecated for removal since 14.0.0. +# Its value may be silently ignored in the future. +# Reason: +# CRUD operations on tenant networks are only available when using nova-network +# and nova-network is itself deprecated. +#quota_networks = 3 + +# +# Filename that will be used for storing websocket frames received +# and sent by a proxy service (like VNC, spice, serial) running on this host. +# If this is not set, no recording will be done. +# (string value) +#record = + +# Run as a background process. (boolean value) +#daemon = false + +# Disallow non-encrypted connections. (boolean value) +#ssl_only = false + +# Set to True if source host is addressed with IPv6. (boolean value) +#source_is_ipv6 = false + +# Path to SSL certificate file. (string value) +#cert = self.pem + +# SSL key file (if separate from cert). (string value) +#key = + +# +# Path to directory with content which will be served by a web server. +# (string value) +#web = /usr/share/spice-html5 + +# +# The directory where the Nova python modules are installed. +# +# This directory is used to store template files for networking and remote +# console access. It is also the default path for other config options which +# need to persist Nova internal data. It is very unlikely that you need to +# change this option from its default value. +# +# Possible values: +# +# * The full path to a directory. +# +# Related options: +# +# * ``state_path`` +# (string value) +#pybasedir = /build/nova-jVS_4e/nova-17.0.3 + +# +# The directory where the Nova binaries are installed. +# +# This option is only relevant if the networking capabilities from Nova are +# used (see services below). Nova's networking capabilities are targeted to +# be fully replaced by Neutron in the future. It is very unlikely that you need +# to change this option from its default value. +# +# Possible values: +# +# * The full path to a directory. +# (string value) +#bindir = /usr/local/bin + +# +# The top-level directory for maintaining Nova's state. +# +# This directory is used to store Nova's internal state. It is used by a +# variety of other config options which derive from this. In some scenarios +# (for example migrations) it makes sense to use a storage location which is +# shared between multiple compute hosts (for example via NFS). Unless the +# option ``instances_path`` gets overwritten, this directory can grow very +# large. +# +# Possible values: +# +# * The full path to a directory. Defaults to value provided in ``pybasedir``. +# (string value) +#state_path = $pybasedir + +# +# Number of seconds indicating how frequently the state of services on a +# given hypervisor is reported. Nova needs to know this to determine the +# overall health of the deployment. +# +# Related Options: +# +# * service_down_time +# report_interval should be less than service_down_time. If service_down_time +# is less than report_interval, services will routinely be considered down, +# because they report in too rarely. +# (integer value) +#report_interval = 10 + +# +# Maximum time in seconds since last check-in for up service +# +# Each compute node periodically updates their database status based on the +# specified report interval. If the compute node hasn't updated the status +# for more than service_down_time, then the compute node is considered down. +# +# Related Options: +# +# * report_interval (service_down_time should not be less than report_interval) +# (integer value) +#service_down_time = 60 + +# +# Enable periodic tasks. +# +# If set to true, this option allows services to periodically run tasks +# on the manager. +# +# In case of running multiple schedulers or conductors you may want to run +# periodic tasks on only one host - in this case disable this option for all +# hosts but one. +# (boolean value) +#periodic_enable = true + +# +# Number of seconds to randomly delay when starting the periodic task +# scheduler to reduce stampeding. +# +# When compute workers are restarted in unison across a cluster, +# they all end up running the periodic tasks at the same time +# causing problems for the external services. To mitigate this +# behavior, periodic_fuzzy_delay option allows you to introduce a +# random initial delay when starting the periodic task scheduler. +# +# Possible Values: +# +# * Any positive integer (in seconds) +# * 0 : disable the random delay +# (integer value) +# Minimum value: 0 +#periodic_fuzzy_delay = 60 + +# List of APIs to be enabled by default. (list value) +#enabled_apis = osapi_compute,metadata + +# +# List of APIs with enabled SSL. +# +# Nova provides SSL support for the API servers. enabled_ssl_apis option +# allows configuring the SSL support. +# (list value) +#enabled_ssl_apis = + +# +# IP address on which the OpenStack API will listen. +# +# The OpenStack API service listens on this IP address for incoming +# requests. +# (string value) +#osapi_compute_listen = 0.0.0.0 + +# +# Port on which the OpenStack API will listen. +# +# The OpenStack API service listens on this port number for incoming +# requests. +# (port value) +# Minimum value: 0 +# Maximum value: 65535 +#osapi_compute_listen_port = 8774 + +# +# Number of workers for OpenStack API service. The default will be the number +# of CPUs available. +# +# OpenStack API services can be configured to run as multi-process (workers). +# This overcomes the problem of reduction in throughput when API request +# concurrency increases. OpenStack API service will run in the specified +# number of processes. +# +# Possible Values: +# +# * Any positive integer +# * None (default value) +# (integer value) +# Minimum value: 1 +#osapi_compute_workers = + +# +# IP address on which the metadata API will listen. +# +# The metadata API service listens on this IP address for incoming +# requests. +# (string value) +#metadata_listen = 0.0.0.0 + +# +# Port on which the metadata API will listen. +# +# The metadata API service listens on this port number for incoming +# requests. +# (port value) +# Minimum value: 0 +# Maximum value: 65535 +#metadata_listen_port = 8775 + +# +# Number of workers for metadata service. If not specified the number of +# available CPUs will be used. +# +# The metadata service can be configured to run as multi-process (workers). +# This overcomes the problem of reduction in throughput when API request +# concurrency increases. The metadata service will run in the specified +# number of processes. +# +# Possible Values: +# +# * Any positive integer +# * None (default value) +# (integer value) +# Minimum value: 1 +#metadata_workers = + +# Full class name for the Manager for network (string value) +# Possible values: +# nova.network.manager.FlatManager - +# nova.network.manager.FlatDHCPManager - +# nova.network.manager.VlanManager - +#network_manager = nova.network.manager.VlanManager + +# +# This option specifies the driver to be used for the servicegroup service. +# +# ServiceGroup API in nova enables checking status of a compute node. When a +# compute worker running the nova-compute daemon starts, it calls the join API +# to join the compute group. Services like nova scheduler can query the +# ServiceGroup API to check if a node is alive. Internally, the ServiceGroup +# client driver automatically updates the compute worker status. There are +# multiple backend implementations for this service: Database ServiceGroup +# driver +# and Memcache ServiceGroup driver. +# +# Possible Values: +# +# * db : Database ServiceGroup driver +# * mc : Memcache ServiceGroup driver +# +# Related Options: +# +# * service_down_time (maximum time since last check-in for up service) +# (string value) +# Possible values: +# db - +# mc - +#servicegroup_driver = db + +# +# From oslo.log +# + +# If set to true, the logging level will be set to DEBUG instead of the default +# INFO level. (boolean value) +# Note: This option can be changed without restarting. +#debug = false + +# The name of a logging configuration file. This file is appended to any +# existing logging configuration files. For details about logging configuration +# files, see the Python logging module documentation. Note that when logging +# configuration files are used then all logging configuration is set in the +# configuration file and other logging configuration options are ignored (for +# example, logging_context_format_string). (string value) +# Note: This option can be changed without restarting. +# Deprecated group/name - [DEFAULT]/log_config +#log_config_append = + +# Defines the format string for %%(asctime)s in log records. Default: +# %(default)s . This option is ignored if log_config_append is set. (string +# value) +#log_date_format = %Y-%m-%d %H:%M:%S + +# (Optional) Name of log file to send logging output to. If no default is set, +# logging will go to stderr as defined by use_stderr. This option is ignored if +# log_config_append is set. (string value) +# Deprecated group/name - [DEFAULT]/logfile +#log_file = + +# (Optional) The base directory used for relative log_file paths. This option +# is ignored if log_config_append is set. (string value) +# Deprecated group/name - [DEFAULT]/logdir +#log_dir = + +# Uses logging handler designed to watch file system. When log file is moved or +# removed this handler will open a new log file with specified path +# instantaneously. It makes sense only if log_file option is specified and Linux +# platform is used. This option is ignored if log_config_append is set. (boolean +# value) +#watch_log_file = false + +# Use syslog for logging. Existing syslog format is DEPRECATED and will be +# changed later to honor RFC5424. This option is ignored if log_config_append is +# set. (boolean value) +#use_syslog = false + +# Enable journald for logging. If running in a systemd environment you may wish +# to enable journal support. Doing so will use the journal native protocol which +# includes structured metadata in addition to log messages.This option is +# ignored if log_config_append is set. (boolean value) +#use_journal = false + +# Syslog facility to receive log lines. This option is ignored if +# log_config_append is set. (string value) +#syslog_log_facility = LOG_USER + +# Use JSON formatting for logging. This option is ignored if log_config_append +# is set. (boolean value) +#use_json = false + +# Log output to standard error. This option is ignored if log_config_append is +# set. (boolean value) +#use_stderr = false + +# Format string to use for log messages with context. (string value) +#logging_context_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user_identity)s] %(instance)s%(message)s + +# Format string to use for log messages when context is undefined. (string +# value) +#logging_default_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [-] %(instance)s%(message)s + +# Additional data to append to log message when logging level for the message is +# DEBUG. (string value) +#logging_debug_format_suffix = %(funcName)s %(pathname)s:%(lineno)d + +# Prefix each line of exception output with this format. (string value) +#logging_exception_prefix = %(asctime)s.%(msecs)03d %(process)d ERROR %(name)s %(instance)s + +# Defines the format string for %(user_identity)s that is used in +# logging_context_format_string. (string value) +#logging_user_identity_format = %(user)s %(tenant)s %(domain)s %(user_domain)s %(project_domain)s + +# List of package logging levels in logger=LEVEL pairs. This option is ignored +# if log_config_append is set. (list value) +#default_log_levels = amqp=WARN,amqplib=WARN,boto=WARN,qpid=WARN,sqlalchemy=WARN,suds=INFO,oslo.messaging=INFO,oslo_messaging=INFO,iso8601=WARN,requests.packages.urllib3.connectionpool=WARN,urllib3.connectionpool=WARN,websocket=WARN,requests.packages.urllib3.util.retry=WARN,urllib3.util.retry=WARN,keystonemiddleware=WARN,routes.middleware=WARN,stevedore=WARN,taskflow=WARN,keystoneauth=WARN,oslo.cache=INFO,dogpile.core.dogpile=INFO + +# Enables or disables publication of error events. (boolean value) +#publish_errors = false + +# The format for an instance that is passed with the log message. (string value) +#instance_format = "[instance: %(uuid)s] " + +# The format for an instance UUID that is passed with the log message. (string +# value) +#instance_uuid_format = "[instance: %(uuid)s] " + +# Interval, number of seconds, of log rate limiting. (integer value) +#rate_limit_interval = 0 + +# Maximum number of logged messages per rate_limit_interval. (integer value) +#rate_limit_burst = 0 + +# Log level name used by rate limiting: CRITICAL, ERROR, INFO, WARNING, DEBUG or +# empty string. Logs with level greater or equal to rate_limit_except_level are +# not filtered. An empty string means that all levels are filtered. (string +# value) +#rate_limit_except_level = CRITICAL + +# Enables or disables fatal status of deprecations. (boolean value) +#fatal_deprecations = false + +# +# From oslo.messaging +# + +# Size of RPC connection pool. (integer value) +#rpc_conn_pool_size = 30 + +# The pool size limit for connections expiration policy (integer value) +#conn_pool_min_size = 2 + +# The time-to-live in sec of idle connections in the pool (integer value) +#conn_pool_ttl = 1200 + +# ZeroMQ bind address. Should be a wildcard (*), an ethernet interface, or IP. +# The "host" option should point or resolve to this address. (string value) +#rpc_zmq_bind_address = * + +# MatchMaker driver. (string value) +# Possible values: +# redis - +# sentinel - +# dummy - +#rpc_zmq_matchmaker = redis + +# Number of ZeroMQ contexts, defaults to 1. (integer value) +#rpc_zmq_contexts = 1 + +# Maximum number of ingress messages to locally buffer per topic. Default is +# unlimited. (integer value) +#rpc_zmq_topic_backlog = + +# Directory for holding IPC sockets. (string value) +#rpc_zmq_ipc_dir = /var/run/openstack + +# Name of this node. Must be a valid hostname, FQDN, or IP address. Must match +# "host" option, if running Nova. (string value) +#rpc_zmq_host = localhost + +# Number of seconds to wait before all pending messages will be sent after +# closing a socket. The default value of -1 specifies an infinite linger period. +# The value of 0 specifies no linger period. Pending messages shall be discarded +# immediately when the socket is closed. Positive values specify an upper bound +# for the linger period. (integer value) +# Deprecated group/name - [DEFAULT]/rpc_cast_timeout +#zmq_linger = -1 + +# The default number of seconds that poll should wait. Poll raises timeout +# exception when timeout expired. (integer value) +#rpc_poll_timeout = 1 + +# Expiration timeout in seconds of a name service record about existing target ( +# < 0 means no timeout). (integer value) +#zmq_target_expire = 300 + +# Update period in seconds of a name service record about existing target. +# (integer value) +#zmq_target_update = 180 + +# Use PUB/SUB pattern for fanout methods. PUB/SUB always uses proxy. (boolean +# value) +#use_pub_sub = false + +# Use ROUTER remote proxy. (boolean value) +#use_router_proxy = false + +# This option makes direct connections dynamic or static. It makes sense only +# with use_router_proxy=False which means to use direct connections for direct +# message types (ignored otherwise). (boolean value) +#use_dynamic_connections = false + +# How many additional connections to a host will be made for failover reasons. +# This option is actual only in dynamic connections mode. (integer value) +#zmq_failover_connections = 2 + +# Minimal port number for random ports range. (port value) +# Minimum value: 0 +# Maximum value: 65535 +#rpc_zmq_min_port = 49153 + +# Maximal port number for random ports range. (integer value) +# Minimum value: 1 +# Maximum value: 65536 +#rpc_zmq_max_port = 65536 + +# Number of retries to find free port number before fail with ZMQBindError. +# (integer value) +#rpc_zmq_bind_port_retries = 100 + +# Default serialization mechanism for serializing/deserializing +# outgoing/incoming messages (string value) +# Possible values: +# json - +# msgpack - +#rpc_zmq_serialization = json + +# This option configures round-robin mode in zmq socket. True means not keeping +# a queue when server side disconnects. False means to keep queue and messages +# even if server is disconnected, when the server appears we send all +# accumulated messages to it. (boolean value) +#zmq_immediate = true + +# Enable/disable TCP keepalive (KA) mechanism. The default value of -1 (or any +# other negative value) means to skip any overrides and leave it to OS default; +# 0 and 1 (or any other positive value) mean to disable and enable the option +# respectively. (integer value) +#zmq_tcp_keepalive = -1 + +# The duration between two keepalive transmissions in idle condition. The unit +# is platform dependent, for example, seconds in Linux, milliseconds in Windows +# etc. The default value of -1 (or any other negative value and 0) means to skip +# any overrides and leave it to OS default. (integer value) +#zmq_tcp_keepalive_idle = -1 + +# The number of retransmissions to be carried out before declaring that remote +# end is not available. The default value of -1 (or any other negative value and +# 0) means to skip any overrides and leave it to OS default. (integer value) +#zmq_tcp_keepalive_cnt = -1 + +# The duration between two successive keepalive retransmissions, if +# acknowledgement to the previous keepalive transmission is not received. The +# unit is platform dependent, for example, seconds in Linux, milliseconds in +# Windows etc. The default value of -1 (or any other negative value and 0) means +# to skip any overrides and leave it to OS default. (integer value) +#zmq_tcp_keepalive_intvl = -1 + +# Maximum number of (green) threads to work concurrently. (integer value) +#rpc_thread_pool_size = 100 + +# Expiration timeout in seconds of a sent/received message after which it is not +# tracked anymore by a client/server. (integer value) +#rpc_message_ttl = 300 + +# Wait for message acknowledgements from receivers. This mechanism works only +# via proxy without PUB/SUB. (boolean value) +#rpc_use_acks = false + +# Number of seconds to wait for an ack from a cast/call. After each retry +# attempt this timeout is multiplied by some specified multiplier. (integer +# value) +#rpc_ack_timeout_base = 15 + +# Number to multiply base ack timeout by after each retry attempt. (integer +# value) +#rpc_ack_timeout_multiplier = 2 + +# Default number of message sending attempts in case of any problems occurred: +# positive value N means at most N retries, 0 means no retries, None or -1 (or +# any other negative values) mean to retry forever. This option is used only if +# acknowledgments are enabled. (integer value) +#rpc_retry_attempts = 3 + +# List of publisher hosts SubConsumer can subscribe on. This option has higher +# priority then the default publishers list taken from the matchmaker. (list +# value) +#subscribe_on = + +# Size of executor thread pool when executor is threading or eventlet. (integer +# value) +# Deprecated group/name - [DEFAULT]/rpc_thread_pool_size +#executor_thread_pool_size = 64 + +# Seconds to wait for a response from a call. (integer value) +#rpc_response_timeout = 60 + +# The network address and optional user credentials for connecting to the +# messaging backend, in URL format. The expected format is: +# +# driver://[user:pass@]host:port[,[userN:passN@]hostN:portN]/virtual_host?query +# +# Example: rabbit://rabbitmq:password@127.0.0.1:5672// +# +# For full details on the fields in the URL see the documentation of +# oslo_messaging.TransportURL at +# https://docs.openstack.org/oslo.messaging/latest/reference/transport.html +# (string value) +#transport_url = + +# DEPRECATED: The messaging driver to use, defaults to rabbit. Other drivers +# include amqp and zmq. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#rpc_backend = rabbit + +# The default exchange under which topics are scoped. May be overridden by an +# exchange name specified in the transport_url option. (string value) +#control_exchange = openstack + +# +# From oslo.service.periodic_task +# + +# Some periodic tasks can be run in a separate process. Should we run them here? +# (boolean value) +#run_external_periodic_tasks = true + +# +# From oslo.service.service +# + +# Enable eventlet backdoor. Acceptable values are 0, , and :, +# where 0 results in listening on a random tcp port number; results in +# listening on the specified port number (and not enabling backdoor if that port +# is in use); and : results in listening on the smallest unused port +# number within the specified range of port numbers. The chosen port is +# displayed in the service's log file. (string value) +#backdoor_port = + +# Enable eventlet backdoor, using the provided path as a unix socket that can +# receive connections. This option is mutually exclusive with 'backdoor_port' in +# that only one should be provided. If both are provided then the existence of +# this option overrides the usage of that option. (string value) +#backdoor_socket = + +# Enables or disables logging values of all registered options when starting a +# service (at DEBUG level). (boolean value) +#log_options = true + +# Specify a timeout after which a gracefully shutdown server will exit. Zero +# value means endless wait. (integer value) +#graceful_shutdown_timeout = 60 + + +[api] +auth_strategy = keystone +# +# Options under this group are used to define Nova API. + +# +# From nova.conf +# + +# +# This determines the strategy to use for authentication: keystone or noauth2. +# 'noauth2' is designed for testing only, as it does no actual credential +# checking. 'noauth2' provides administrative credentials only if 'admin' is +# specified as the username. +# (string value) +# Possible values: +# keystone - +# noauth2 - +#auth_strategy = keystone + +# +# When True, the 'X-Forwarded-For' header is treated as the canonical remote +# address. When False (the default), the 'remote_address' header is used. +# +# You should only enable this if you have an HTML sanitizing proxy. +# (boolean value) +#use_forwarded_for = false + +# +# When gathering the existing metadata for a config drive, the EC2-style +# metadata is returned for all versions that don't appear in this option. +# As of the Liberty release, the available versions are: +# +# * 1.0 +# * 2007-01-19 +# * 2007-03-01 +# * 2007-08-29 +# * 2007-10-10 +# * 2007-12-15 +# * 2008-02-01 +# * 2008-09-01 +# * 2009-04-04 +# +# The option is in the format of a single string, with each version separated +# by a space. +# +# Possible values: +# +# * Any string that represents zero or more versions, separated by spaces. +# (string value) +#config_drive_skip_versions = 1.0 2007-01-19 2007-03-01 2007-08-29 2007-10-10 2007-12-15 2008-02-01 2008-09-01 + +# +# A list of vendordata providers. +# +# vendordata providers are how deployers can provide metadata via configdrive +# and metadata that is specific to their deployment. There are currently two +# supported providers: StaticJSON and DynamicJSON. +# +# StaticJSON reads a JSON file configured by the flag vendordata_jsonfile_path +# and places the JSON from that file into vendor_data.json and +# vendor_data2.json. +# +# DynamicJSON is configured via the vendordata_dynamic_targets flag, which is +# documented separately. For each of the endpoints specified in that flag, a +# section is added to the vendor_data2.json. +# +# For more information on the requirements for implementing a vendordata +# dynamic endpoint, please see the vendordata.rst file in the nova developer +# reference. +# +# Possible values: +# +# * A list of vendordata providers, with StaticJSON and DynamicJSON being +# current options. +# +# Related options: +# +# * vendordata_dynamic_targets +# * vendordata_dynamic_ssl_certfile +# * vendordata_dynamic_connect_timeout +# * vendordata_dynamic_read_timeout +# * vendordata_dynamic_failure_fatal +# (list value) +#vendordata_providers = StaticJSON + +# +# A list of targets for the dynamic vendordata provider. These targets are of +# the form @. +# +# The dynamic vendordata provider collects metadata by contacting external REST +# services and querying them for information about the instance. This behaviour +# is documented in the vendordata.rst file in the nova developer reference. +# (list value) +#vendordata_dynamic_targets = + +# +# Path to an optional certificate file or CA bundle to verify dynamic +# vendordata REST services ssl certificates against. +# +# Possible values: +# +# * An empty string, or a path to a valid certificate file +# +# Related options: +# +# * vendordata_providers +# * vendordata_dynamic_targets +# * vendordata_dynamic_connect_timeout +# * vendordata_dynamic_read_timeout +# * vendordata_dynamic_failure_fatal +# (string value) +#vendordata_dynamic_ssl_certfile = + +# +# Maximum wait time for an external REST service to connect. +# +# Possible values: +# +# * Any integer with a value greater than three (the TCP packet retransmission +# timeout). Note that instance start may be blocked during this wait time, +# so this value should be kept small. +# +# Related options: +# +# * vendordata_providers +# * vendordata_dynamic_targets +# * vendordata_dynamic_ssl_certfile +# * vendordata_dynamic_read_timeout +# * vendordata_dynamic_failure_fatal +# (integer value) +# Minimum value: 3 +#vendordata_dynamic_connect_timeout = 5 + +# +# Maximum wait time for an external REST service to return data once connected. +# +# Possible values: +# +# * Any integer. Note that instance start is blocked during this wait time, +# so this value should be kept small. +# +# Related options: +# +# * vendordata_providers +# * vendordata_dynamic_targets +# * vendordata_dynamic_ssl_certfile +# * vendordata_dynamic_connect_timeout +# * vendordata_dynamic_failure_fatal +# (integer value) +# Minimum value: 0 +#vendordata_dynamic_read_timeout = 5 + +# +# Should failures to fetch dynamic vendordata be fatal to instance boot? +# +# Related options: +# +# * vendordata_providers +# * vendordata_dynamic_targets +# * vendordata_dynamic_ssl_certfile +# * vendordata_dynamic_connect_timeout +# * vendordata_dynamic_read_timeout +# (boolean value) +#vendordata_dynamic_failure_fatal = false + +# +# This option is the time (in seconds) to cache metadata. When set to 0, +# metadata caching is disabled entirely; this is generally not recommended for +# performance reasons. Increasing this setting should improve response times +# of the metadata API when under heavy load. Higher values may increase memory +# usage, and result in longer times for host metadata changes to take effect. +# (integer value) +# Minimum value: 0 +#metadata_cache_expiration = 15 + +# +# Cloud providers may store custom data in vendor data file that will then be +# available to the instances via the metadata service, and to the rendering of +# config-drive. The default class for this, JsonFileVendorData, loads this +# information from a JSON file, whose path is configured by this option. If +# there is no path set by this option, the class returns an empty dictionary. +# +# Possible values: +# +# * Any string representing the path to the data file, or an empty string +# (default). +# (string value) +#vendordata_jsonfile_path = + +# +# As a query can potentially return many thousands of items, you can limit the +# maximum number of items in a single response by setting this option. +# (integer value) +# Minimum value: 0 +# Deprecated group/name - [DEFAULT]/osapi_max_limit +#max_limit = 1000 + +# +# This string is prepended to the normal URL that is returned in links to the +# OpenStack Compute API. If it is empty (the default), the URLs are returned +# unchanged. +# +# Possible values: +# +# * Any string, including an empty string (the default). +# (string value) +# Deprecated group/name - [DEFAULT]/osapi_compute_link_prefix +#compute_link_prefix = + +# +# This string is prepended to the normal URL that is returned in links to +# Glance resources. If it is empty (the default), the URLs are returned +# unchanged. +# +# Possible values: +# +# * Any string, including an empty string (the default). +# (string value) +# Deprecated group/name - [DEFAULT]/osapi_glance_link_prefix +#glance_link_prefix = + +# DEPRECATED: +# Operators can turn off the ability for a user to take snapshots of their +# instances by setting this option to False. When disabled, any attempt to +# take a snapshot will result in a HTTP 400 response ("Bad Request"). +# (boolean value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: This option disables the createImage server action API in a non- +# discoverable way and is thus a barrier to interoperability. Also, it is not +# used for other APIs that create snapshots like shelve or createBackup. +# Disabling snapshots should be done via policy if so desired. +#allow_instance_snapshots = true + +# DEPRECATED: +# This option is a list of all instance states for which network address +# information should not be returned from the API. +# +# Possible values: +# +# A list of strings, where each string is a valid VM state, as defined in +# nova/compute/vm_states.py. As of the Newton release, they are: +# +# * "active" +# * "building" +# * "paused" +# * "suspended" +# * "stopped" +# * "rescued" +# * "resized" +# * "soft-delete" +# * "deleted" +# * "error" +# * "shelved" +# * "shelved_offloaded" +# (list value) +# Deprecated group/name - [DEFAULT]/osapi_hide_server_address_states +# This option is deprecated for removal since 17.0.0. +# Its value may be silently ignored in the future. +# Reason: This option hide the server address in server representation for +# configured server states. Which makes GET server API controlled by this config +# options. Due to this config options, user would not be able to discover the +# API behavior on different clouds which leads to the interop issue. +#hide_server_address_states = building + +# The full path to the fping binary. (string value) +#fping_path = /usr/sbin/fping + +# +# When True, the TenantNetworkController will query the Neutron API to get the +# default networks to use. +# +# Related options: +# +# * neutron_default_tenant_id +# (boolean value) +#use_neutron_default_nets = false + +# +# Tenant ID for getting the default network from Neutron API (also referred in +# some places as the 'project ID') to use. +# +# Related options: +# +# * use_neutron_default_nets +# (string value) +#neutron_default_tenant_id = default + +# +# Enables returning of the instance password by the relevant server API calls +# such as create, rebuild, evacuate, or rescue. If the hypervisor does not +# support password injection, then the password returned will not be correct, +# so if your hypervisor does not support password injection, set this to False. +# (boolean value) +#enable_instance_password = true + + +[api_database] +connection = sqlite:////var/lib/nova/nova_api.sqlite +# +# The *Nova API Database* is a separate database which is used for information +# which is used across *cells*. This database is mandatory since the Mitaka +# release (13.0.0). + +# +# From nova.conf +# + +# The SQLAlchemy connection string to use to connect to the database. (string +# value) +#connection = + +# If True, SQLite uses synchronous mode. (boolean value) +#sqlite_synchronous = true + +# The SQLAlchemy connection string to use to connect to the slave database. +# (string value) +#slave_connection = + +# The SQL mode to be used for MySQL sessions. This option, including the +# default, overrides any server-set SQL mode. To use whatever SQL mode is set by +# the server configuration, set this to no value. Example: mysql_sql_mode= +# (string value) +#mysql_sql_mode = TRADITIONAL + +# Connections which have been present in the connection pool longer than this +# number of seconds will be replaced with a new one the next time they are +# checked out from the pool. (integer value) +# Deprecated group/name - [api_database]/idle_timeout +#connection_recycle_time = 3600 + +# Maximum number of SQL connections to keep open in a pool. Setting a value of 0 +# indicates no limit. (integer value) +#max_pool_size = + +# Maximum number of database connection retries during startup. Set to -1 to +# specify an infinite retry count. (integer value) +#max_retries = 10 + +# Interval between retries of opening a SQL connection. (integer value) +#retry_interval = 10 + +# If set, use this value for max_overflow with SQLAlchemy. (integer value) +#max_overflow = + +# Verbosity of SQL debugging information: 0=None, 100=Everything. (integer +# value) +#connection_debug = 0 + +# Add Python stack traces to SQL as comment strings. (boolean value) +#connection_trace = false + +# If set, use this value for pool_timeout with SQLAlchemy. (integer value) +#pool_timeout = + + +[barbican] + +# +# From nova.conf +# + +# Use this endpoint to connect to Barbican, for example: +# "http://localhost:9311/" (string value) +#barbican_endpoint = + +# Version of the Barbican API, for example: "v1" (string value) +#barbican_api_version = + +# Use this endpoint to connect to Keystone (string value) +# Deprecated group/name - [key_manager]/auth_url +#auth_endpoint = http://localhost/identity/v3 + +# Number of seconds to wait before retrying poll for key creation completion +# (integer value) +#retry_delay = 1 + +# Number of times to retry poll for key creation completion (integer value) +#number_of_retries = 60 + +# Specifies if insecure TLS (https) requests. If False, the server's certificate +# will not be validated (boolean value) +#verify_ssl = true + + +[cache] + +# +# From nova.conf +# + +# Prefix for building the configuration dictionary for the cache region. This +# should not need to be changed unless there is another dogpile.cache region +# with the same configuration name. (string value) +#config_prefix = cache.oslo + +# Default TTL, in seconds, for any cached item in the dogpile.cache region. This +# applies to any cached method that doesn't have an explicit cache expiration +# time defined for it. (integer value) +#expiration_time = 600 + +# Cache backend module. For eventlet-based or environments with hundreds of +# threaded servers, Memcache with pooling (oslo_cache.memcache_pool) is +# recommended. For environments with less than 100 threaded servers, Memcached +# (dogpile.cache.memcached) or Redis (dogpile.cache.redis) is recommended. Test +# environments with a single instance of the server can use the +# dogpile.cache.memory backend. (string value) +# Possible values: +# oslo_cache.memcache_pool - +# oslo_cache.dict - +# oslo_cache.mongo - +# oslo_cache.etcd3gw - +# dogpile.cache.memcached - +# dogpile.cache.pylibmc - +# dogpile.cache.bmemcached - +# dogpile.cache.dbm - +# dogpile.cache.redis - +# dogpile.cache.memory - +# dogpile.cache.memory_pickle - +# dogpile.cache.null - +#backend = dogpile.cache.null + +# Arguments supplied to the backend module. Specify this option once per +# argument to be passed to the dogpile.cache backend. Example format: +# ":". (multi valued) +#backend_argument = + +# Proxy classes to import that will affect the way the dogpile.cache backend +# functions. See the dogpile.cache documentation on changing-backend-behavior. +# (list value) +#proxies = + +# Global toggle for caching. (boolean value) +#enabled = false + +# Extra debugging from the cache backend (cache keys, get/set/delete/etc calls). +# This is only really useful if you need to see the specific cache-backend +# get/set/delete calls with the keys/values. Typically this should be left set +# to false. (boolean value) +#debug_cache_backend = false + +# Memcache servers in the format of "host:port". (dogpile.cache.memcache and +# oslo_cache.memcache_pool backends only). (list value) +#memcache_servers = localhost:11211 + +# Number of seconds memcached server is considered dead before it is tried +# again. (dogpile.cache.memcache and oslo_cache.memcache_pool backends only). +# (integer value) +#memcache_dead_retry = 300 + +# Timeout in seconds for every call to a server. (dogpile.cache.memcache and +# oslo_cache.memcache_pool backends only). (integer value) +#memcache_socket_timeout = 3 + +# Max total number of open connections to every memcached server. +# (oslo_cache.memcache_pool backend only). (integer value) +#memcache_pool_maxsize = 10 + +# Number of seconds a connection to memcached is held unused in the pool before +# it is closed. (oslo_cache.memcache_pool backend only). (integer value) +#memcache_pool_unused_timeout = 60 + +# Number of seconds that an operation will wait to get a memcache client +# connection. (integer value) +#memcache_pool_connection_get_timeout = 10 + + +[cells] +enable = False +# +# DEPRECATED: Cells options allow you to use cells v1 functionality in an +# OpenStack deployment. +# +# Note that the options in this group are only for cells v1 functionality, which +# is considered experimental and not recommended for new deployments. Cells v1 +# is being replaced with cells v2, which starting in the 15.0.0 Ocata release is +# required and all Nova deployments will be at least a cells v2 cell of one. +# + +# +# From nova.conf +# + +# DEPRECATED: +# Enable cell v1 functionality. +# +# Note that cells v1 is considered experimental and not recommended for new +# Nova deployments. Cells v1 is being replaced by cells v2 which starting in +# the 15.0.0 Ocata release, all Nova deployments are at least a cells v2 cell +# of one. Setting this option, or any other options in the [cells] group, is +# not required for cells v2. +# +# When this functionality is enabled, it lets you to scale an OpenStack +# Compute cloud in a more distributed fashion without having to use +# complicated technologies like database and message queue clustering. +# Cells are configured as a tree. The top-level cell should have a host +# that runs a nova-api service, but no nova-compute services. Each +# child cell should run all of the typical nova-* services in a regular +# Compute cloud except for nova-api. You can think of cells as a normal +# Compute deployment in that each cell has its own database server and +# message queue broker. +# +# Related options: +# +# * name: A unique cell name must be given when this functionality +# is enabled. +# * cell_type: Cell type should be defined for all cells. +# (boolean value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: Cells v1 is being replaced with Cells v2. +#enable = false + +# DEPRECATED: +# Name of the current cell. +# +# This value must be unique for each cell. Name of a cell is used as +# its id, leaving this option unset or setting the same name for +# two or more cells may cause unexpected behaviour. +# +# Related options: +# +# * enabled: This option is meaningful only when cells service +# is enabled +# (string value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: Cells v1 is being replaced with Cells v2. +#name = nova + +# DEPRECATED: +# Cell capabilities. +# +# List of arbitrary key=value pairs defining capabilities of the +# current cell to be sent to the parent cells. These capabilities +# are intended to be used in cells scheduler filters/weighers. +# +# Possible values: +# +# * key=value pairs list for example; +# ``hypervisor=xenserver;kvm,os=linux;windows`` +# (list value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: Cells v1 is being replaced with Cells v2. +#capabilities = hypervisor=xenserver;kvm,os=linux;windows + +# DEPRECATED: +# Call timeout. +# +# Cell messaging module waits for response(s) to be put into the +# eventlet queue. This option defines the seconds waited for +# response from a call to a cell. +# +# Possible values: +# +# * An integer, corresponding to the interval time in seconds. +# (integer value) +# Minimum value: 0 +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: Cells v1 is being replaced with Cells v2. +#call_timeout = 60 + +# DEPRECATED: +# Reserve percentage +# +# Percentage of cell capacity to hold in reserve, so the minimum +# amount of free resource is considered to be; +# +# min_free = total * (reserve_percent / 100.0) +# +# This option affects both memory and disk utilization. +# +# The primary purpose of this reserve is to ensure some space is +# available for users who want to resize their instance to be larger. +# Note that currently once the capacity expands into this reserve +# space this option is ignored. +# +# Possible values: +# +# * An integer or float, corresponding to the percentage of cell capacity to +# be held in reserve. +# (floating point value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: Cells v1 is being replaced with Cells v2. +#reserve_percent = 10.0 + +# DEPRECATED: +# Type of cell. +# +# When cells feature is enabled the hosts in the OpenStack Compute +# cloud are partitioned into groups. Cells are configured as a tree. +# The top-level cell's cell_type must be set to ``api``. All other +# cells are defined as a ``compute cell`` by default. +# +# Related option: +# +# * quota_driver: Disable quota checking for the child cells. +# (nova.quota.NoopQuotaDriver) +# (string value) +# Possible values: +# api - +# compute - +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: Cells v1 is being replaced with Cells v2. +#cell_type = compute + +# DEPRECATED: +# Mute child interval. +# +# Number of seconds after which a lack of capability and capacity +# update the child cell is to be treated as a mute cell. Then the +# child cell will be weighed as recommend highly that it be skipped. +# +# Possible values: +# +# * An integer, corresponding to the interval time in seconds. +# (integer value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: Cells v1 is being replaced with Cells v2. +#mute_child_interval = 300 + +# DEPRECATED: +# Bandwidth update interval. +# +# Seconds between bandwidth usage cache updates for cells. +# +# Possible values: +# +# * An integer, corresponding to the interval time in seconds. +# (integer value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: Cells v1 is being replaced with Cells v2. +#bandwidth_update_interval = 600 + +# DEPRECATED: +# Instance update sync database limit. +# +# Number of instances to pull from the database at one time for +# a sync. If there are more instances to update the results will +# be paged through. +# +# Possible values: +# +# * An integer, corresponding to a number of instances. +# (integer value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: Cells v1 is being replaced with Cells v2. +#instance_update_sync_database_limit = 100 + +# DEPRECATED: +# Mute weight multiplier. +# +# Multiplier used to weigh mute children. Mute children cells are +# recommended to be skipped so their weight is multiplied by this +# negative value. +# +# Possible values: +# +# * Negative numeric number +# (floating point value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: Cells v1 is being replaced with Cells v2. +#mute_weight_multiplier = -10000.0 + +# DEPRECATED: +# Ram weight multiplier. +# +# Multiplier used for weighing ram. Negative numbers indicate that +# Compute should stack VMs on one host instead of spreading out new +# VMs to more hosts in the cell. +# +# Possible values: +# +# * Numeric multiplier +# (floating point value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: Cells v1 is being replaced with Cells v2. +#ram_weight_multiplier = 10.0 + +# DEPRECATED: +# Offset weight multiplier +# +# Multiplier used to weigh offset weigher. Cells with higher +# weight_offsets in the DB will be preferred. The weight_offset +# is a property of a cell stored in the database. It can be used +# by a deployer to have scheduling decisions favor or disfavor +# cells based on the setting. +# +# Possible values: +# +# * Numeric multiplier +# (floating point value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: Cells v1 is being replaced with Cells v2. +#offset_weight_multiplier = 1.0 + +# DEPRECATED: +# Instance updated at threshold +# +# Number of seconds after an instance was updated or deleted to +# continue to update cells. This option lets cells manager to only +# attempt to sync instances that have been updated recently. +# i.e., a threshold of 3600 means to only update instances that +# have modified in the last hour. +# +# Possible values: +# +# * Threshold in seconds +# +# Related options: +# +# * This value is used with the ``instance_update_num_instances`` +# value in a periodic task run. +# (integer value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: Cells v1 is being replaced with Cells v2. +#instance_updated_at_threshold = 3600 + +# DEPRECATED: +# Instance update num instances +# +# On every run of the periodic task, nova cells manager will attempt to +# sync instance_updated_at_threshold number of instances. When the +# manager gets the list of instances, it shuffles them so that multiple +# nova-cells services do not attempt to sync the same instances in +# lockstep. +# +# Possible values: +# +# * Positive integer number +# +# Related options: +# +# * This value is used with the ``instance_updated_at_threshold`` +# value in a periodic task run. +# (integer value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: Cells v1 is being replaced with Cells v2. +#instance_update_num_instances = 1 + +# DEPRECATED: +# Maximum hop count +# +# When processing a targeted message, if the local cell is not the +# target, a route is defined between neighbouring cells. And the +# message is processed across the whole routing path. This option +# defines the maximum hop counts until reaching the target. +# +# Possible values: +# +# * Positive integer value +# (integer value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: Cells v1 is being replaced with Cells v2. +#max_hop_count = 10 + +# DEPRECATED: +# Cells scheduler. +# +# The class of the driver used by the cells scheduler. This should be +# the full Python path to the class to be used. If nothing is specified +# in this option, the CellsScheduler is used. +# (string value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: Cells v1 is being replaced with Cells v2. +#scheduler = nova.cells.scheduler.CellsScheduler + +# DEPRECATED: +# RPC driver queue base. +# +# When sending a message to another cell by JSON-ifying the message +# and making an RPC cast to 'process_message', a base queue is used. +# This option defines the base queue name to be used when communicating +# between cells. Various topics by message type will be appended to this. +# +# Possible values: +# +# * The base queue name to be used when communicating between cells. +# (string value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: Cells v1 is being replaced with Cells v2. +#rpc_driver_queue_base = cells.intercell + +# DEPRECATED: +# Scheduler filter classes. +# +# Filter classes the cells scheduler should use. An entry of +# "nova.cells.filters.all_filters" maps to all cells filters +# included with nova. As of the Mitaka release the following +# filter classes are available: +# +# Different cell filter: A scheduler hint of 'different_cell' +# with a value of a full cell name may be specified to route +# a build away from a particular cell. +# +# Image properties filter: Image metadata named +# 'hypervisor_version_requires' with a version specification +# may be specified to ensure the build goes to a cell which +# has hypervisors of the required version. If either the version +# requirement on the image or the hypervisor capability of the +# cell is not present, this filter returns without filtering out +# the cells. +# +# Target cell filter: A scheduler hint of 'target_cell' with a +# value of a full cell name may be specified to route a build to +# a particular cell. No error handling is done as there's no way +# to know whether the full path is a valid. +# +# As an admin user, you can also add a filter that directs builds +# to a particular cell. +# +# (list value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: Cells v1 is being replaced with Cells v2. +#scheduler_filter_classes = nova.cells.filters.all_filters + +# DEPRECATED: +# Scheduler weight classes. +# +# Weigher classes the cells scheduler should use. An entry of +# "nova.cells.weights.all_weighers" maps to all cell weighers +# included with nova. As of the Mitaka release the following +# weight classes are available: +# +# mute_child: Downgrades the likelihood of child cells being +# chosen for scheduling requests, which haven't sent capacity +# or capability updates in a while. Options include +# mute_weight_multiplier (multiplier for mute children; value +# should be negative). +# +# ram_by_instance_type: Select cells with the most RAM capacity +# for the instance type being requested. Because higher weights +# win, Compute returns the number of available units for the +# instance type requested. The ram_weight_multiplier option defaults +# to 10.0 that adds to the weight by a factor of 10. Use a negative +# number to stack VMs on one host instead of spreading out new VMs +# to more hosts in the cell. +# +# weight_offset: Allows modifying the database to weight a particular +# cell. The highest weight will be the first cell to be scheduled for +# launching an instance. When the weight_offset of a cell is set to 0, +# it is unlikely to be picked but it could be picked if other cells +# have a lower weight, like if they're full. And when the weight_offset +# is set to a very high value (for example, '999999999999999'), it is +# likely to be picked if another cell do not have a higher weight. +# (list value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: Cells v1 is being replaced with Cells v2. +#scheduler_weight_classes = nova.cells.weights.all_weighers + +# DEPRECATED: +# Scheduler retries. +# +# How many retries when no cells are available. Specifies how many +# times the scheduler tries to launch a new instance when no cells +# are available. +# +# Possible values: +# +# * Positive integer value +# +# Related options: +# +# * This value is used with the ``scheduler_retry_delay`` value +# while retrying to find a suitable cell. +# (integer value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: Cells v1 is being replaced with Cells v2. +#scheduler_retries = 10 + +# DEPRECATED: +# Scheduler retry delay. +# +# Specifies the delay (in seconds) between scheduling retries when no +# cell can be found to place the new instance on. When the instance +# could not be scheduled to a cell after ``scheduler_retries`` in +# combination with ``scheduler_retry_delay``, then the scheduling +# of the instance failed. +# +# Possible values: +# +# * Time in seconds. +# +# Related options: +# +# * This value is used with the ``scheduler_retries`` value +# while retrying to find a suitable cell. +# (integer value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: Cells v1 is being replaced with Cells v2. +#scheduler_retry_delay = 2 + +# DEPRECATED: +# DB check interval. +# +# Cell state manager updates cell status for all cells from the DB +# only after this particular interval time is passed. Otherwise cached +# status are used. If this value is 0 or negative all cell status are +# updated from the DB whenever a state is needed. +# +# Possible values: +# +# * Interval time, in seconds. +# +# (integer value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: Cells v1 is being replaced with Cells v2. +#db_check_interval = 60 + +# DEPRECATED: +# Optional cells configuration. +# +# Configuration file from which to read cells configuration. If given, +# overrides reading cells from the database. +# +# Cells store all inter-cell communication data, including user names +# and passwords, in the database. Because the cells data is not updated +# very frequently, use this option to specify a JSON file to store +# cells data. With this configuration, the database is no longer +# consulted when reloading the cells data. The file must have columns +# present in the Cell model (excluding common database fields and the +# id column). You must specify the queue connection information through +# a transport_url field, instead of username, password, and so on. +# +# The transport_url has the following form: +# rabbit://USERNAME:PASSWORD@HOSTNAME:PORT/VIRTUAL_HOST +# +# Possible values: +# +# The scheme can be either qpid or rabbit, the following sample shows +# this optional configuration: +# +# { +# "parent": { +# "name": "parent", +# "api_url": "http://api.example.com:8774", +# "transport_url": "rabbit://rabbit.example.com", +# "weight_offset": 0.0, +# "weight_scale": 1.0, +# "is_parent": true +# }, +# "cell1": { +# "name": "cell1", +# "api_url": "http://api.example.com:8774", +# "transport_url": "rabbit://rabbit1.example.com", +# "weight_offset": 0.0, +# "weight_scale": 1.0, +# "is_parent": false +# }, +# "cell2": { +# "name": "cell2", +# "api_url": "http://api.example.com:8774", +# "transport_url": "rabbit://rabbit2.example.com", +# "weight_offset": 0.0, +# "weight_scale": 1.0, +# "is_parent": false +# } +# } +# +# (string value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: Cells v1 is being replaced with Cells v2. +#cells_config = + + +[cinder] + +# +# From nova.conf +# + +# +# Info to match when looking for cinder in the service catalog. +# +# Possible values: +# +# * Format is separated values of the form: +# :: +# +# Note: Nova does not support the Cinder v2 API since the Nova 17.0.0 Queens +# release. +# +# Related options: +# +# * endpoint_template - Setting this option will override catalog_info +# (string value) +#catalog_info = volumev3:cinderv3:publicURL + +# +# If this option is set then it will override service catalog lookup with +# this template for cinder endpoint +# +# Possible values: +# +# * URL for cinder endpoint API +# e.g. http://localhost:8776/v3/%(project_id)s +# +# Note: Nova does not support the Cinder v2 API since the Nova 17.0.0 Queens +# release. +# +# Related options: +# +# * catalog_info - If endpoint_template is not set, catalog_info will be used. +# (string value) +#endpoint_template = + +# +# Region name of this node. This is used when picking the URL in the service +# catalog. +# +# Possible values: +# +# * Any string representing region name +# (string value) +#os_region_name = + +# +# Number of times cinderclient should retry on any failed http call. +# 0 means connection is attempted only once. Setting it to any positive integer +# means that on failure connection is retried that many times e.g. setting it +# to 3 means total attempts to connect will be 4. +# +# Possible values: +# +# * Any integer value. 0 means connection is attempted only once +# (integer value) +# Minimum value: 0 +#http_retries = 3 + +# +# Allow attach between instance and volume in different availability zones. +# +# If False, volumes attached to an instance must be in the same availability +# zone in Cinder as the instance availability zone in Nova. +# This also means care should be taken when booting an instance from a volume +# where source is not "volume" because Nova will attempt to create a volume +# using +# the same availability zone as what is assigned to the instance. +# If that AZ is not in Cinder (or allow_availability_zone_fallback=False in +# cinder.conf), the volume create request will fail and the instance will fail +# the build request. +# By default there is no availability zone restriction on volume attach. +# (boolean value) +#cross_az_attach = true + +# PEM encoded Certificate Authority to use when verifying HTTPs connections. +# (string value) +#cafile = + +# PEM encoded client certificate cert file (string value) +#certfile = + +# PEM encoded client certificate key file (string value) +#keyfile = + +# Verify HTTPS connections. (boolean value) +#insecure = false + +# Timeout value for http requests (integer value) +#timeout = + +# Authentication type to load (string value) +# Deprecated group/name - [cinder]/auth_plugin +#auth_type = + +# Config Section from which to load plugin specific options (string value) +#auth_section = + +# Authentication URL (string value) +#auth_url = + +# Scope for system operations (string value) +#system_scope = + +# Domain ID to scope to (string value) +#domain_id = + +# Domain name to scope to (string value) +#domain_name = + +# Project ID to scope to (string value) +#project_id = + +# Project name to scope to (string value) +#project_name = + +# Domain ID containing project (string value) +#project_domain_id = + +# Domain name containing project (string value) +#project_domain_name = + +# Trust ID (string value) +#trust_id = + +# Optional domain ID to use with v3 and v2 parameters. It will be used for both +# the user and project domain in v3 and ignored in v2 authentication. (string +# value) +#default_domain_id = + +# Optional domain name to use with v3 API and v2 parameters. It will be used for +# both the user and project domain in v3 and ignored in v2 authentication. +# (string value) +#default_domain_name = + +# User ID (string value) +#user_id = + +# Username (string value) +# Deprecated group/name - [cinder]/user_name +#username = + +# User's domain id (string value) +#user_domain_id = + +# User's domain name (string value) +#user_domain_name = + +# User's password (string value) +#password = + +# Tenant ID (string value) +#tenant_id = + +# Tenant Name (string value) +#tenant_name = + + +[compute] + +# +# From nova.conf +# + +# +# Number of consecutive failed builds that result in disabling a compute +# service. +# +# This option will cause nova-compute to set itself to a disabled state +# if a certain number of consecutive build failures occur. This will +# prevent the scheduler from continuing to send builds to a compute node that is +# consistently failing. Note that all failures qualify and count towards this +# score, including reschedules that may have been due to racy scheduler +# behavior. +# Since the failures must be consecutive, it is unlikely that occasional +# expected +# reschedules will actually disable a compute node. +# +# Possible values: +# +# * Any positive integer representing a build failure count. +# * Zero to never auto-disable. +# (integer value) +#consecutive_build_service_disable_threshold = 10 + + +[conductor] +# +# Options under this group are used to define Conductor's communication, +# which manager should be act as a proxy between computes and database, +# and finally, how many worker processes will be used. + +# +# From nova.conf +# + +# DEPRECATED: +# Topic exchange name on which conductor nodes listen. +# (string value) +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# There is no need to let users choose the RPC topic for all services - there +# is little gain from this. Furthermore, it makes it really easy to break Nova +# by using this option. +#topic = conductor + +# +# Number of workers for OpenStack Conductor service. The default will be the +# number of CPUs available. +# (integer value) +#workers = + + +[console] +# +# Options under this group allow to tune the configuration of the console proxy +# service. +# +# Note: in configuration of every compute is a ``console_host`` option, +# which allows to select the console proxy service to connect to. + +# +# From nova.conf +# + +# +# Adds list of allowed origins to the console websocket proxy to allow +# connections from other origin hostnames. +# Websocket proxy matches the host header with the origin header to +# prevent cross-site requests. This list specifies if any there are +# values other than host are allowed in the origin header. +# +# Possible values: +# +# * A list where each element is an allowed origin hostnames, else an empty list +# (list value) +# Deprecated group/name - [DEFAULT]/console_allowed_origins +#allowed_origins = + + +[consoleauth] + +# +# From nova.conf +# + +# +# The lifetime of a console auth token (in seconds). +# +# A console auth token is used in authorizing console access for a user. +# Once the auth token time to live count has elapsed, the token is +# considered expired. Expired tokens are then deleted. +# (integer value) +# Minimum value: 0 +# Deprecated group/name - [DEFAULT]/console_token_ttl +#token_ttl = 600 + + +[cors] + +# +# From oslo.middleware +# + +# Indicate whether this resource may be shared with the domain received in the +# requests "origin" header. Format: "://[:]", no trailing +# slash. Example: https://horizon.example.com (list value) +#allowed_origin = + +# Indicate that the actual request can include user credentials (boolean value) +#allow_credentials = true + +# Indicate which headers are safe to expose to the API. Defaults to HTTP Simple +# Headers. (list value) +#expose_headers = X-Auth-Token,X-Openstack-Request-Id,X-Subject-Token,X-Service-Token + +# Maximum cache age of CORS preflight requests. (integer value) +#max_age = 3600 + +# Indicate which methods can be used during the actual request. (list value) +#allow_methods = GET,PUT,POST,DELETE,PATCH + +# Indicate which header field names may be used during the actual request. (list +# value) +#allow_headers = X-Auth-Token,X-Openstack-Request-Id,X-Identity-Status,X-Roles,X-Service-Catalog,X-User-Id,X-Tenant-Id + + +[crypto] + +# +# From nova.conf +# + +# +# Filename of root CA (Certificate Authority). This is a container format +# and includes root certificates. +# +# Possible values: +# +# * Any file name containing root CA, cacert.pem is default +# +# Related options: +# +# * ca_path +# (string value) +#ca_file = cacert.pem + +# +# Filename of a private key. +# +# Related options: +# +# * keys_path +# (string value) +#key_file = private/cakey.pem + +# +# Filename of root Certificate Revocation List (CRL). This is a list of +# certificates that have been revoked, and therefore, entities presenting +# those (revoked) certificates should no longer be trusted. +# +# Related options: +# +# * ca_path +# (string value) +#crl_file = crl.pem + +# +# Directory path where keys are located. +# +# Related options: +# +# * key_file +# (string value) +#keys_path = $state_path/keys + +# +# Directory path where root CA is located. +# +# Related options: +# +# * ca_file +# (string value) +#ca_path = $state_path/CA + +# Option to enable/disable use of CA for each project. (boolean value) +#use_project_ca = false + +# +# Subject for certificate for users, %s for +# project, user, timestamp +# (string value) +#user_cert_subject = /C=US/ST=California/O=OpenStack/OU=NovaDev/CN=%.16s-%.16s-%s + +# +# Subject for certificate for projects, %s for +# project, timestamp +# (string value) +#project_cert_subject = /C=US/ST=California/O=OpenStack/OU=NovaDev/CN=project-ca-%.16s-%s + + +[database] +connection = sqlite:////var/lib/nova/nova.sqlite + +# +# From oslo.db +# + +# If True, SQLite uses synchronous mode. (boolean value) +#sqlite_synchronous = true + +# The back end to use for the database. (string value) +# Deprecated group/name - [DEFAULT]/db_backend +#backend = sqlalchemy + +# The SQLAlchemy connection string to use to connect to the database. (string +# value) +# Deprecated group/name - [DEFAULT]/sql_connection +# Deprecated group/name - [DATABASE]/sql_connection +# Deprecated group/name - [sql]/connection +#connection = + +# The SQLAlchemy connection string to use to connect to the slave database. +# (string value) +#slave_connection = + +# The SQL mode to be used for MySQL sessions. This option, including the +# default, overrides any server-set SQL mode. To use whatever SQL mode is set by +# the server configuration, set this to no value. Example: mysql_sql_mode= +# (string value) +#mysql_sql_mode = TRADITIONAL + +# If True, transparently enables support for handling MySQL Cluster (NDB). +# (boolean value) +#mysql_enable_ndb = false + +# Connections which have been present in the connection pool longer than this +# number of seconds will be replaced with a new one the next time they are +# checked out from the pool. (integer value) +# Deprecated group/name - [DATABASE]/idle_timeout +# Deprecated group/name - [database]/idle_timeout +# Deprecated group/name - [DEFAULT]/sql_idle_timeout +# Deprecated group/name - [DATABASE]/sql_idle_timeout +# Deprecated group/name - [sql]/idle_timeout +#connection_recycle_time = 3600 + +# Minimum number of SQL connections to keep open in a pool. (integer value) +# Deprecated group/name - [DEFAULT]/sql_min_pool_size +# Deprecated group/name - [DATABASE]/sql_min_pool_size +#min_pool_size = 1 + +# Maximum number of SQL connections to keep open in a pool. Setting a value of 0 +# indicates no limit. (integer value) +# Deprecated group/name - [DEFAULT]/sql_max_pool_size +# Deprecated group/name - [DATABASE]/sql_max_pool_size +#max_pool_size = 5 + +# Maximum number of database connection retries during startup. Set to -1 to +# specify an infinite retry count. (integer value) +# Deprecated group/name - [DEFAULT]/sql_max_retries +# Deprecated group/name - [DATABASE]/sql_max_retries +#max_retries = 10 + +# Interval between retries of opening a SQL connection. (integer value) +# Deprecated group/name - [DEFAULT]/sql_retry_interval +# Deprecated group/name - [DATABASE]/reconnect_interval +#retry_interval = 10 + +# If set, use this value for max_overflow with SQLAlchemy. (integer value) +# Deprecated group/name - [DEFAULT]/sql_max_overflow +# Deprecated group/name - [DATABASE]/sqlalchemy_max_overflow +#max_overflow = 50 + +# Verbosity of SQL debugging information: 0=None, 100=Everything. (integer +# value) +# Minimum value: 0 +# Maximum value: 100 +# Deprecated group/name - [DEFAULT]/sql_connection_debug +#connection_debug = 0 + +# Add Python stack traces to SQL as comment strings. (boolean value) +# Deprecated group/name - [DEFAULT]/sql_connection_trace +#connection_trace = false + +# If set, use this value for pool_timeout with SQLAlchemy. (integer value) +# Deprecated group/name - [DATABASE]/sqlalchemy_pool_timeout +#pool_timeout = + +# Enable the experimental use of database reconnect on connection lost. (boolean +# value) +#use_db_reconnect = false + +# Seconds between retries of a database transaction. (integer value) +#db_retry_interval = 1 + +# If True, increases the interval between retries of a database operation up to +# db_max_retry_interval. (boolean value) +#db_inc_retry_interval = true + +# If db_inc_retry_interval is set, the maximum seconds between retries of a +# database operation. (integer value) +#db_max_retry_interval = 10 + +# Maximum retries in case of connection error or deadlock error before error is +# raised. Set to -1 to specify an infinite retry count. (integer value) +#db_max_retries = 20 + +# +# From oslo.db.concurrency +# + +# Enable the experimental use of thread pooling for all DB API calls (boolean +# value) +# Deprecated group/name - [DEFAULT]/dbapi_use_tpool +#use_tpool = false + + +[devices] + +# +# From nova.conf +# + +# +# A list of the vGPU types enabled in the compute node. +# +# Some pGPUs (e.g. NVIDIA GRID K1) support different vGPU types. User can use +# this option to specify a list of enabled vGPU types that may be assigned to a +# guest instance. But please note that Nova only supports a single type in the +# Queens release. If more than one vGPU type is specified (as a comma-separated +# list), only the first one will be used. An example is as the following: +# [devices] +# enabled_vgpu_types = GRID K100,Intel GVT-g,MxGPU.2,nvidia-11 +# (list value) +#enabled_vgpu_types = + + +[ephemeral_storage_encryption] + +# +# From nova.conf +# + +# +# Enables/disables LVM ephemeral storage encryption. +# (boolean value) +#enabled = false + +# +# Cipher-mode string to be used. +# +# The cipher and mode to be used to encrypt ephemeral storage. The set of +# cipher-mode combinations available depends on kernel support. According +# to the dm-crypt documentation, the cipher is expected to be in the format: +# "--". +# +# Possible values: +# +# * Any crypto option listed in ``/proc/crypto``. +# (string value) +#cipher = aes-xts-plain64 + +# +# Encryption key length in bits. +# +# The bit length of the encryption key to be used to encrypt ephemeral storage. +# In XTS mode only half of the bits are used for encryption key. +# (integer value) +# Minimum value: 1 +#key_size = 512 + + +[filter_scheduler] + +# +# From nova.conf +# + +# +# Size of subset of best hosts selected by scheduler. +# +# New instances will be scheduled on a host chosen randomly from a subset of the +# N best hosts, where N is the value set by this option. +# +# Setting this to a value greater than 1 will reduce the chance that multiple +# scheduler processes handling similar requests will select the same host, +# creating a potential race condition. By selecting a host randomly from the N +# hosts that best fit the request, the chance of a conflict is reduced. However, +# the higher you set this value, the less optimal the chosen host may be for a +# given request. +# +# This option is only used by the FilterScheduler and its subclasses; if you use +# a different scheduler, this option has no effect. +# +# Possible values: +# +# * An integer, where the integer corresponds to the size of a host subset. Any +# integer is valid, although any value less than 1 will be treated as 1 +# (integer value) +# Minimum value: 1 +# Deprecated group/name - [DEFAULT]/scheduler_host_subset_size +#host_subset_size = 1 + +# +# The number of instances that can be actively performing IO on a host. +# +# Instances performing IO includes those in the following states: build, resize, +# snapshot, migrate, rescue, unshelve. +# +# This option is only used by the FilterScheduler and its subclasses; if you use +# a different scheduler, this option has no effect. Also note that this setting +# only affects scheduling if the 'io_ops_filter' filter is enabled. +# +# Possible values: +# +# * An integer, where the integer corresponds to the max number of instances +# that can be actively performing IO on any given host. +# (integer value) +#max_io_ops_per_host = 8 + +# +# Maximum number of instances that be active on a host. +# +# If you need to limit the number of instances on any given host, set this +# option +# to the maximum number of instances you want to allow. The num_instances_filter +# will reject any host that has at least as many instances as this option's +# value. +# +# This option is only used by the FilterScheduler and its subclasses; if you use +# a different scheduler, this option has no effect. Also note that this setting +# only affects scheduling if the 'num_instances_filter' filter is enabled. +# +# Possible values: +# +# * An integer, where the integer corresponds to the max instances that can be +# scheduled on a host. +# (integer value) +# Minimum value: 1 +#max_instances_per_host = 50 + +# +# Enable querying of individual hosts for instance information. +# +# The scheduler may need information about the instances on a host in order to +# evaluate its filters and weighers. The most common need for this information +# is +# for the (anti-)affinity filters, which need to choose a host based on the +# instances already running on a host. +# +# If the configured filters and weighers do not need this information, disabling +# this option will improve performance. It may also be disabled when the +# tracking +# overhead proves too heavy, although this will cause classes requiring host +# usage data to query the database on each request instead. +# +# This option is only used by the FilterScheduler and its subclasses; if you use +# a different scheduler, this option has no effect. +# +# NOTE: In a multi-cell (v2) setup where the cell MQ is separated from the +# top-level, computes cannot directly communicate with the scheduler. Thus, +# this option cannot be enabled in that scenario. See also the +# [workarounds]/disable_group_policy_check_upcall option. +# (boolean value) +# Deprecated group/name - [DEFAULT]/scheduler_tracks_instance_changes +#track_instance_changes = true + +# +# Filters that the scheduler can use. +# +# An unordered list of the filter classes the nova scheduler may apply. Only +# the +# filters specified in the 'enabled_filters' option will be used, but +# any filter appearing in that option must also be included in this list. +# +# By default, this is set to all filters that are included with nova. +# +# This option is only used by the FilterScheduler and its subclasses; if you use +# a different scheduler, this option has no effect. +# +# Possible values: +# +# * A list of zero or more strings, where each string corresponds to the name of +# a filter that may be used for selecting a host +# +# Related options: +# +# * enabled_filters +# (multi valued) +# Deprecated group/name - [DEFAULT]/scheduler_available_filters +#available_filters = nova.scheduler.filters.all_filters + +# +# Filters that the scheduler will use. +# +# An ordered list of filter class names that will be used for filtering +# hosts. These filters will be applied in the order they are listed so +# place your most restrictive filters first to make the filtering process more +# efficient. +# +# This option is only used by the FilterScheduler and its subclasses; if you use +# a different scheduler, this option has no effect. +# +# Possible values: +# +# * A list of zero or more strings, where each string corresponds to the name of +# a filter to be used for selecting a host +# +# Related options: +# +# * All of the filters in this option *must* be present in the +# 'scheduler_available_filters' option, or a SchedulerHostFilterNotFound +# exception will be raised. +# (list value) +# Deprecated group/name - [DEFAULT]/scheduler_default_filters +#enabled_filters = RetryFilter,AvailabilityZoneFilter,ComputeFilter,ComputeCapabilitiesFilter,ImagePropertiesFilter,ServerGroupAntiAffinityFilter,ServerGroupAffinityFilter + +# DEPRECATED: +# Filters used for filtering baremetal hosts. +# +# Filters are applied in order, so place your most restrictive filters first to +# make the filtering process more efficient. +# +# This option is only used by the FilterScheduler and its subclasses; if you use +# a different scheduler, this option has no effect. +# +# Possible values: +# +# * A list of zero or more strings, where each string corresponds to the name of +# a filter to be used for selecting a baremetal host +# +# Related options: +# +# * If the 'scheduler_use_baremetal_filters' option is False, this option has +# no effect. +# (list value) +# Deprecated group/name - [DEFAULT]/baremetal_scheduler_default_filters +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: +# These filters were used to overcome some of the baremetal scheduling +# limitations in Nova prior to the use of the Placement API. Now scheduling will +# use the custom resource class defined for each baremetal node to make its +# selection. +#baremetal_enabled_filters = RetryFilter,AvailabilityZoneFilter,ComputeFilter,ComputeCapabilitiesFilter,ImagePropertiesFilter,ExactRamFilter,ExactDiskFilter,ExactCoreFilter + +# DEPRECATED: +# Enable baremetal filters. +# +# Set this to True to tell the nova scheduler that it should use the filters +# specified in the 'baremetal_enabled_filters' option. If you are not +# scheduling baremetal nodes, leave this at the default setting of False. +# +# This option is only used by the FilterScheduler and its subclasses; if you use +# a different scheduler, this option has no effect. +# +# Related options: +# +# * If this option is set to True, then the filters specified in the +# 'baremetal_enabled_filters' are used instead of the filters +# specified in 'enabled_filters'. +# (boolean value) +# Deprecated group/name - [DEFAULT]/scheduler_use_baremetal_filters +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: +# These filters were used to overcome some of the baremetal scheduling +# limitations in Nova prior to the use of the Placement API. Now scheduling will +# use the custom resource class defined for each baremetal node to make its +# selection. +#use_baremetal_filters = false + +# +# Weighers that the scheduler will use. +# +# Only hosts which pass the filters are weighed. The weight for any host starts +# at 0, and the weighers order these hosts by adding to or subtracting from the +# weight assigned by the previous weigher. Weights may become negative. An +# instance will be scheduled to one of the N most-weighted hosts, where N is +# 'scheduler_host_subset_size'. +# +# By default, this is set to all weighers that are included with Nova. +# +# This option is only used by the FilterScheduler and its subclasses; if you use +# a different scheduler, this option has no effect. +# +# Possible values: +# +# * A list of zero or more strings, where each string corresponds to the name of +# a weigher that will be used for selecting a host +# (list value) +# Deprecated group/name - [DEFAULT]/scheduler_weight_classes +#weight_classes = nova.scheduler.weights.all_weighers + +# +# Ram weight multipler ratio. +# +# This option determines how hosts with more or less available RAM are weighed. +# A +# positive value will result in the scheduler preferring hosts with more +# available RAM, and a negative number will result in the scheduler preferring +# hosts with less available RAM. Another way to look at it is that positive +# values for this option will tend to spread instances across many hosts, while +# negative values will tend to fill up (stack) hosts as much as possible before +# scheduling to a less-used host. The absolute value, whether positive or +# negative, controls how strong the RAM weigher is relative to other weighers. +# +# This option is only used by the FilterScheduler and its subclasses; if you use +# a different scheduler, this option has no effect. Also note that this setting +# only affects scheduling if the 'ram' weigher is enabled. +# +# Possible values: +# +# * An integer or float value, where the value corresponds to the multipler +# ratio for this weigher. +# (floating point value) +#ram_weight_multiplier = 1.0 + +# +# Disk weight multipler ratio. +# +# Multiplier used for weighing free disk space. Negative numbers mean to +# stack vs spread. +# +# This option is only used by the FilterScheduler and its subclasses; if you use +# a different scheduler, this option has no effect. Also note that this setting +# only affects scheduling if the 'disk' weigher is enabled. +# +# Possible values: +# +# * An integer or float value, where the value corresponds to the multipler +# ratio for this weigher. +# (floating point value) +#disk_weight_multiplier = 1.0 + +# +# IO operations weight multipler ratio. +# +# This option determines how hosts with differing workloads are weighed. +# Negative +# values, such as the default, will result in the scheduler preferring hosts +# with +# lighter workloads whereas positive values will prefer hosts with heavier +# workloads. Another way to look at it is that positive values for this option +# will tend to schedule instances onto hosts that are already busy, while +# negative values will tend to distribute the workload across more hosts. The +# absolute value, whether positive or negative, controls how strong the io_ops +# weigher is relative to other weighers. +# +# This option is only used by the FilterScheduler and its subclasses; if you use +# a different scheduler, this option has no effect. Also note that this setting +# only affects scheduling if the 'io_ops' weigher is enabled. +# +# Possible values: +# +# * An integer or float value, where the value corresponds to the multipler +# ratio for this weigher. +# (floating point value) +#io_ops_weight_multiplier = -1.0 + +# +# PCI device affinity weight multiplier. +# +# The PCI device affinity weighter computes a weighting based on the number of +# PCI devices on the host and the number of PCI devices requested by the +# instance. The ``NUMATopologyFilter`` filter must be enabled for this to have +# any significance. For more information, refer to the filter documentation: +# +# https://docs.openstack.org/nova/latest/user/filter-scheduler.html +# +# Possible values: +# +# * A positive integer or float value, where the value corresponds to the +# multiplier ratio for this weigher. +# (floating point value) +# Minimum value: 0 +#pci_weight_multiplier = 1.0 + +# +# Multiplier used for weighing hosts for group soft-affinity. +# +# Possible values: +# +# * An integer or float value, where the value corresponds to weight multiplier +# for hosts with group soft affinity. Only a positive value are meaningful, as +# negative values would make this behave as a soft anti-affinity weigher. +# (floating point value) +#soft_affinity_weight_multiplier = 1.0 + +# +# Multiplier used for weighing hosts for group soft-anti-affinity. +# +# Possible values: +# +# * An integer or float value, where the value corresponds to weight multiplier +# for hosts with group soft anti-affinity. Only a positive value are +# meaningful, as negative values would make this behave as a soft affinity +# weigher. +# (floating point value) +#soft_anti_affinity_weight_multiplier = 1.0 + +# +# Enable spreading the instances between hosts with the same best weight. +# +# Enabling it is beneficial for cases when host_subset_size is 1 +# (default), but there is a large number of hosts with same maximal weight. +# This scenario is common in Ironic deployments where there are typically many +# baremetal nodes with identical weights returned to the scheduler. +# In such case enabling this option will reduce contention and chances for +# rescheduling events. +# At the same time it will make the instance packing (even in unweighed case) +# less dense. +# (boolean value) +#shuffle_best_same_weighed_hosts = false + +# +# List of UUIDs for images that can only be run on certain hosts. +# +# If there is a need to restrict some images to only run on certain designated +# hosts, list those image UUIDs here. +# +# This option is only used by the FilterScheduler and its subclasses; if you use +# a different scheduler, this option has no effect. Also note that this setting +# only affects scheduling if the 'IsolatedHostsFilter' filter is enabled. +# +# Possible values: +# +# * A list of UUID strings, where each string corresponds to the UUID of an +# image +# +# Related options: +# +# * scheduler/isolated_hosts +# * scheduler/restrict_isolated_hosts_to_isolated_images +# (list value) +#isolated_images = + +# +# List of hosts that can only run certain images. +# +# If there is a need to restrict some images to only run on certain designated +# hosts, list those host names here. +# +# This option is only used by the FilterScheduler and its subclasses; if you use +# a different scheduler, this option has no effect. Also note that this setting +# only affects scheduling if the 'IsolatedHostsFilter' filter is enabled. +# +# Possible values: +# +# * A list of strings, where each string corresponds to the name of a host +# +# Related options: +# +# * scheduler/isolated_images +# * scheduler/restrict_isolated_hosts_to_isolated_images +# (list value) +#isolated_hosts = + +# +# Prevent non-isolated images from being built on isolated hosts. +# +# This option is only used by the FilterScheduler and its subclasses; if you use +# a different scheduler, this option has no effect. Also note that this setting +# only affects scheduling if the 'IsolatedHostsFilter' filter is enabled. Even +# then, this option doesn't affect the behavior of requests for isolated images, +# which will *always* be restricted to isolated hosts. +# +# Related options: +# +# * scheduler/isolated_images +# * scheduler/isolated_hosts +# (boolean value) +#restrict_isolated_hosts_to_isolated_images = true + +# +# Image property namespace for use in the host aggregate. +# +# Images and hosts can be configured so that certain images can only be +# scheduled +# to hosts in a particular aggregate. This is done with metadata values set on +# the host aggregate that are identified by beginning with the value of this +# option. If the host is part of an aggregate with such a metadata key, the +# image +# in the request spec must have the value of that metadata in its properties in +# order for the scheduler to consider the host as acceptable. +# +# This option is only used by the FilterScheduler and its subclasses; if you use +# a different scheduler, this option has no effect. Also note that this setting +# only affects scheduling if the 'aggregate_image_properties_isolation' filter +# is +# enabled. +# +# Possible values: +# +# * A string, where the string corresponds to an image property namespace +# +# Related options: +# +# * aggregate_image_properties_isolation_separator +# (string value) +#aggregate_image_properties_isolation_namespace = + +# +# Separator character(s) for image property namespace and name. +# +# When using the aggregate_image_properties_isolation filter, the relevant +# metadata keys are prefixed with the namespace defined in the +# aggregate_image_properties_isolation_namespace configuration option plus a +# separator. This option defines the separator to be used. +# +# This option is only used by the FilterScheduler and its subclasses; if you use +# a different scheduler, this option has no effect. Also note that this setting +# only affects scheduling if the 'aggregate_image_properties_isolation' filter +# is enabled. +# +# Possible values: +# +# * A string, where the string corresponds to an image property namespace +# separator character +# +# Related options: +# +# * aggregate_image_properties_isolation_namespace +# (string value) +#aggregate_image_properties_isolation_separator = . + + +[glance] +api_servers = http://controller:9292 +# Configuration options for the Image service + +# +# From nova.conf +# + +# +# List of glance api servers endpoints available to nova. +# +# https is used for ssl-based glance api servers. +# +# NOTE: The preferred mechanism for endpoint discovery is via keystoneauth1 +# loading options. Only use api_servers if you need multiple endpoints and are +# unable to use a load balancer for some reason. +# +# Possible values: +# +# * A list of any fully qualified url of the form +# "scheme://hostname:port[/path]" +# (i.e. "http://10.0.1.0:9292" or "https://my.glance.server/image"). +# (list value) +#api_servers = + +# +# Enable glance operation retries. +# +# Specifies the number of retries when uploading / downloading +# an image to / from glance. 0 means no retries. +# (integer value) +# Minimum value: 0 +#num_retries = 0 + +# DEPRECATED: +# List of url schemes that can be directly accessed. +# +# This option specifies a list of url schemes that can be downloaded +# directly via the direct_url. This direct_URL can be fetched from +# Image metadata which can be used by nova to get the +# image more efficiently. nova-compute could benefit from this by +# invoking a copy when it has access to the same file system as glance. +# +# Possible values: +# +# * [file], Empty list (default) +# (list value) +# This option is deprecated for removal since 17.0.0. +# Its value may be silently ignored in the future. +# Reason: +# This was originally added for the 'nova.image.download.file' FileTransfer +# extension which was removed in the 16.0.0 Pike release. The +# 'nova.image.download.modules' extension point is not maintained +# and there is no indication of its use in production clouds. +#allowed_direct_url_schemes = + +# +# Enable image signature verification. +# +# nova uses the image signature metadata from glance and verifies the signature +# of a signed image while downloading that image. If the image signature cannot +# be verified or if the image signature metadata is either incomplete or +# unavailable, then nova will not boot the image and instead will place the +# instance into an error state. This provides end users with stronger assurances +# of the integrity of the image data they are using to create servers. +# +# Related options: +# +# * The options in the `key_manager` group, as the key_manager is used +# for the signature validation. +# * Both enable_certificate_validation and default_trusted_certificate_ids +# below depend on this option being enabled. +# (boolean value) +#verify_glance_signatures = false + +# DEPRECATED: +# Enable certificate validation for image signature verification. +# +# During image signature verification nova will first verify the validity of the +# image's signing certificate using the set of trusted certificates associated +# with the instance. If certificate validation fails, signature verification +# will not be performed and the image will be placed into an error state. This +# provides end users with stronger assurances that the image data is unmodified +# and trustworthy. If left disabled, image signature verification can still +# occur but the end user will not have any assurance that the signing +# certificate used to generate the image signature is still trustworthy. +# +# Related options: +# +# * This option only takes effect if verify_glance_signatures is enabled. +# * The value of default_trusted_certificate_ids may be used when this option +# is enabled. +# (boolean value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# This option is intended to ease the transition for deployments leveraging +# image signature verification. The intended state long-term is for signature +# verification and certificate validation to always happen together. +#enable_certificate_validation = false + +# +# List of certificate IDs for certificates that should be trusted. +# +# May be used as a default list of trusted certificate IDs for certificate +# validation. The value of this option will be ignored if the user provides a +# list of trusted certificate IDs with an instance API request. The value of +# this option will be persisted with the instance data if signature verification +# and certificate validation are enabled and if the user did not provide an +# alternative list. If left empty when certificate validation is enabled the +# user must provide a list of trusted certificate IDs otherwise certificate +# validation will fail. +# +# Related options: +# +# * The value of this option may be used if both verify_glance_signatures and +# enable_certificate_validation are enabled. +# (list value) +#default_trusted_certificate_ids = + +# Enable or disable debug logging with glanceclient. (boolean value) +#debug = false + +# PEM encoded Certificate Authority to use when verifying HTTPs connections. +# (string value) +#cafile = + +# PEM encoded client certificate cert file (string value) +#certfile = + +# PEM encoded client certificate key file (string value) +#keyfile = + +# Verify HTTPS connections. (boolean value) +#insecure = false + +# Timeout value for http requests (integer value) +#timeout = + +# The default service_type for endpoint URL discovery. (string value) +#service_type = image + +# The default service_name for endpoint URL discovery. (string value) +#service_name = + +# List of interfaces, in order of preference, for endpoint URL. (list value) +#valid_interfaces = internal,public + +# The default region_name for endpoint URL discovery. (string value) +#region_name = + +# Always use this endpoint URL for requests for this client. NOTE: The +# unversioned endpoint should be specified here; to request a particular API +# version, use the `version`, `min-version`, and/or `max-version` options. +# (string value) +#endpoint_override = + + +[guestfs] +# +# libguestfs is a set of tools for accessing and modifying virtual +# machine (VM) disk images. You can use this for viewing and editing +# files inside guests, scripting changes to VMs, monitoring disk +# used/free statistics, creating guests, P2V, V2V, performing backups, +# cloning VMs, building VMs, formatting disks and resizing disks. + +# +# From nova.conf +# + +# +# Enable/disables guestfs logging. +# +# This configures guestfs to debug messages and push them to OpenStack +# logging system. When set to True, it traces libguestfs API calls and +# enable verbose debug messages. In order to use the above feature, +# "libguestfs" package must be installed. +# +# Related options: +# Since libguestfs access and modifies VM's managed by libvirt, below options +# should be set to give access to those VM's. +# * libvirt.inject_key +# * libvirt.inject_partition +# * libvirt.inject_password +# (boolean value) +#debug = false + + +[healthcheck] + +# +# From oslo.middleware +# + +# DEPRECATED: The path to respond to healtcheck requests on. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +#path = /healthcheck + +# Show more detailed information as part of the response (boolean value) +#detailed = false + +# Additional backends that can perform health checks and report that information +# back as part of a request. (list value) +#backends = + +# Check the presence of a file to determine if an application is running on a +# port. Used by DisableByFileHealthcheck plugin. (string value) +#disable_by_file_path = + +# Check the presence of a file based on a port to determine if an application is +# running on a port. Expects a "port:path" list of strings. Used by +# DisableByFilesPortsHealthcheck plugin. (list value) +#disable_by_file_paths = + + +[hyperv] +# +# The hyperv feature allows you to configure the Hyper-V hypervisor +# driver to be used within an OpenStack deployment. + +# +# From nova.conf +# + +# +# Dynamic memory ratio +# +# Enables dynamic memory allocation (ballooning) when set to a value +# greater than 1. The value expresses the ratio between the total RAM +# assigned to an instance and its startup RAM amount. For example a +# ratio of 2.0 for an instance with 1024MB of RAM implies 512MB of +# RAM allocated at startup. +# +# Possible values: +# +# * 1.0: Disables dynamic memory allocation (Default). +# * Float values greater than 1.0: Enables allocation of total implied +# RAM divided by this value for startup. +# (floating point value) +#dynamic_memory_ratio = 1.0 + +# +# Enable instance metrics collection +# +# Enables metrics collections for an instance by using Hyper-V's +# metric APIs. Collected data can be retrieved by other apps and +# services, e.g.: Ceilometer. +# (boolean value) +#enable_instance_metrics_collection = false + +# +# Instances path share +# +# The name of a Windows share mapped to the "instances_path" dir +# and used by the resize feature to copy files to the target host. +# If left blank, an administrative share (hidden network share) will +# be used, looking for the same "instances_path" used locally. +# +# Possible values: +# +# * "": An administrative share will be used (Default). +# * Name of a Windows share. +# +# Related options: +# +# * "instances_path": The directory which will be used if this option +# here is left blank. +# (string value) +#instances_path_share = + +# +# Limit CPU features +# +# This flag is needed to support live migration to hosts with +# different CPU features and checked during instance creation +# in order to limit the CPU features used by the instance. +# (boolean value) +#limit_cpu_features = false + +# +# Mounted disk query retry count +# +# The number of times to retry checking for a mounted disk. +# The query runs until the device can be found or the retry +# count is reached. +# +# Possible values: +# +# * Positive integer values. Values greater than 1 is recommended +# (Default: 10). +# +# Related options: +# +# * Time interval between disk mount retries is declared with +# "mounted_disk_query_retry_interval" option. +# (integer value) +# Minimum value: 0 +#mounted_disk_query_retry_count = 10 + +# +# Mounted disk query retry interval +# +# Interval between checks for a mounted disk, in seconds. +# +# Possible values: +# +# * Time in seconds (Default: 5). +# +# Related options: +# +# * This option is meaningful when the mounted_disk_query_retry_count +# is greater than 1. +# * The retry loop runs with mounted_disk_query_retry_count and +# mounted_disk_query_retry_interval configuration options. +# (integer value) +# Minimum value: 0 +#mounted_disk_query_retry_interval = 5 + +# +# Power state check timeframe +# +# The timeframe to be checked for instance power state changes. +# This option is used to fetch the state of the instance from Hyper-V +# through the WMI interface, within the specified timeframe. +# +# Possible values: +# +# * Timeframe in seconds (Default: 60). +# (integer value) +# Minimum value: 0 +#power_state_check_timeframe = 60 + +# +# Power state event polling interval +# +# Instance power state change event polling frequency. Sets the +# listener interval for power state events to the given value. +# This option enhances the internal lifecycle notifications of +# instances that reboot themselves. It is unlikely that an operator +# has to change this value. +# +# Possible values: +# +# * Time in seconds (Default: 2). +# (integer value) +# Minimum value: 0 +#power_state_event_polling_interval = 2 + +# +# qemu-img command +# +# qemu-img is required for some of the image related operations +# like converting between different image types. You can get it +# from here: (http://qemu.weilnetz.de/) or you can install the +# Cloudbase OpenStack Hyper-V Compute Driver +# (https://cloudbase.it/openstack-hyperv-driver/) which automatically +# sets the proper path for this config option. You can either give the +# full path of qemu-img.exe or set its path in the PATH environment +# variable and leave this option to the default value. +# +# Possible values: +# +# * Name of the qemu-img executable, in case it is in the same +# directory as the nova-compute service or its path is in the +# PATH environment variable (Default). +# * Path of qemu-img command (DRIVELETTER:\PATH\TO\QEMU-IMG\COMMAND). +# +# Related options: +# +# * If the config_drive_cdrom option is False, qemu-img will be used to +# convert the ISO to a VHD, otherwise the configuration drive will +# remain an ISO. To use configuration drive with Hyper-V, you must +# set the mkisofs_cmd value to the full path to an mkisofs.exe +# installation. +# (string value) +#qemu_img_cmd = qemu-img.exe + +# +# External virtual switch name +# +# The Hyper-V Virtual Switch is a software-based layer-2 Ethernet +# network switch that is available with the installation of the +# Hyper-V server role. The switch includes programmatically managed +# and extensible capabilities to connect virtual machines to both +# virtual networks and the physical network. In addition, Hyper-V +# Virtual Switch provides policy enforcement for security, isolation, +# and service levels. The vSwitch represented by this config option +# must be an external one (not internal or private). +# +# Possible values: +# +# * If not provided, the first of a list of available vswitches +# is used. This list is queried using WQL. +# * Virtual switch name. +# (string value) +#vswitch_name = + +# +# Wait soft reboot seconds +# +# Number of seconds to wait for instance to shut down after soft +# reboot request is made. We fall back to hard reboot if instance +# does not shutdown within this window. +# +# Possible values: +# +# * Time in seconds (Default: 60). +# (integer value) +# Minimum value: 0 +#wait_soft_reboot_seconds = 60 + +# +# Configuration drive cdrom +# +# OpenStack can be configured to write instance metadata to +# a configuration drive, which is then attached to the +# instance before it boots. The configuration drive can be +# attached as a disk drive (default) or as a CD drive. +# +# Possible values: +# +# * True: Attach the configuration drive image as a CD drive. +# * False: Attach the configuration drive image as a disk drive (Default). +# +# Related options: +# +# * This option is meaningful with force_config_drive option set to 'True' +# or when the REST API call to create an instance will have +# '--config-drive=True' flag. +# * config_drive_format option must be set to 'iso9660' in order to use +# CD drive as the configuration drive image. +# * To use configuration drive with Hyper-V, you must set the +# mkisofs_cmd value to the full path to an mkisofs.exe installation. +# Additionally, you must set the qemu_img_cmd value to the full path +# to an qemu-img command installation. +# * You can configure the Compute service to always create a configuration +# drive by setting the force_config_drive option to 'True'. +# (boolean value) +#config_drive_cdrom = false + +# +# Configuration drive inject password +# +# Enables setting the admin password in the configuration drive image. +# +# Related options: +# +# * This option is meaningful when used with other options that enable +# configuration drive usage with Hyper-V, such as force_config_drive. +# * Currently, the only accepted config_drive_format is 'iso9660'. +# (boolean value) +#config_drive_inject_password = false + +# +# Volume attach retry count +# +# The number of times to retry attaching a volume. Volume attachment +# is retried until success or the given retry count is reached. +# +# Possible values: +# +# * Positive integer values (Default: 10). +# +# Related options: +# +# * Time interval between attachment attempts is declared with +# volume_attach_retry_interval option. +# (integer value) +# Minimum value: 0 +#volume_attach_retry_count = 10 + +# +# Volume attach retry interval +# +# Interval between volume attachment attempts, in seconds. +# +# Possible values: +# +# * Time in seconds (Default: 5). +# +# Related options: +# +# * This options is meaningful when volume_attach_retry_count +# is greater than 1. +# * The retry loop runs with volume_attach_retry_count and +# volume_attach_retry_interval configuration options. +# (integer value) +# Minimum value: 0 +#volume_attach_retry_interval = 5 + +# +# Enable RemoteFX feature +# +# This requires at least one DirectX 11 capable graphics adapter for +# Windows / Hyper-V Server 2012 R2 or newer and RDS-Virtualization +# feature has to be enabled. +# +# Instances with RemoteFX can be requested with the following flavor +# extra specs: +# +# **os:resolution**. Guest VM screen resolution size. Acceptable values:: +# +# 1024x768, 1280x1024, 1600x1200, 1920x1200, 2560x1600, 3840x2160 +# +# ``3840x2160`` is only available on Windows / Hyper-V Server 2016. +# +# **os:monitors**. Guest VM number of monitors. Acceptable values:: +# +# [1, 4] - Windows / Hyper-V Server 2012 R2 +# [1, 8] - Windows / Hyper-V Server 2016 +# +# **os:vram**. Guest VM VRAM amount. Only available on +# Windows / Hyper-V Server 2016. Acceptable values:: +# +# 64, 128, 256, 512, 1024 +# (boolean value) +#enable_remotefx = false + +# +# Use multipath connections when attaching iSCSI or FC disks. +# +# This requires the Multipath IO Windows feature to be enabled. MPIO must be +# configured to claim such devices. +# (boolean value) +#use_multipath_io = false + +# +# List of iSCSI initiators that will be used for estabilishing iSCSI sessions. +# +# If none are specified, the Microsoft iSCSI initiator service will choose the +# initiator. +# (list value) +#iscsi_initiator_list = + + +[ironic] +# +# Configuration options for Ironic driver (Bare Metal). +# If using the Ironic driver following options must be set: +# * auth_type +# * auth_url +# * project_name +# * username +# * password +# * project_domain_id or project_domain_name +# * user_domain_id or user_domain_name + +# +# From nova.conf +# + +# DEPRECATED: URL override for the Ironic API endpoint. (uri value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Endpoint lookup uses the service catalog via common keystoneauth1 +# Adapter configuration options. In the current release, api_endpoint will +# override this behavior, but will be ignored and/or removed in a future +# release. To achieve the same result, use the endpoint_override option instead. +#api_endpoint = http://ironic.example.org:6385/ + +# +# The number of times to retry when a request conflicts. +# If set to 0, only try once, no retries. +# +# Related options: +# +# * api_retry_interval +# (integer value) +# Minimum value: 0 +#api_max_retries = 60 + +# +# The number of seconds to wait before retrying the request. +# +# Related options: +# +# * api_max_retries +# (integer value) +# Minimum value: 0 +#api_retry_interval = 2 + +# Timeout (seconds) to wait for node serial console state changed. Set to 0 to +# disable timeout. (integer value) +# Minimum value: 0 +#serial_console_state_timeout = 10 + +# PEM encoded Certificate Authority to use when verifying HTTPs connections. +# (string value) +#cafile = + +# PEM encoded client certificate cert file (string value) +#certfile = + +# PEM encoded client certificate key file (string value) +#keyfile = + +# Verify HTTPS connections. (boolean value) +#insecure = false + +# Timeout value for http requests (integer value) +#timeout = + +# Authentication type to load (string value) +# Deprecated group/name - [ironic]/auth_plugin +#auth_type = + +# Config Section from which to load plugin specific options (string value) +#auth_section = + +# Authentication URL (string value) +#auth_url = + +# Scope for system operations (string value) +#system_scope = + +# Domain ID to scope to (string value) +#domain_id = + +# Domain name to scope to (string value) +#domain_name = + +# Project ID to scope to (string value) +#project_id = + +# Project name to scope to (string value) +#project_name = + +# Domain ID containing project (string value) +#project_domain_id = + +# Domain name containing project (string value) +#project_domain_name = + +# Trust ID (string value) +#trust_id = + +# User ID (string value) +#user_id = + +# Username (string value) +# Deprecated group/name - [ironic]/user_name +#username = + +# User's domain id (string value) +#user_domain_id = + +# User's domain name (string value) +#user_domain_name = + +# User's password (string value) +#password = + +# The default service_type for endpoint URL discovery. (string value) +#service_type = baremetal + +# The default service_name for endpoint URL discovery. (string value) +#service_name = + +# List of interfaces, in order of preference, for endpoint URL. (list value) +#valid_interfaces = internal,public + +# The default region_name for endpoint URL discovery. (string value) +#region_name = + +# Always use this endpoint URL for requests for this client. NOTE: The +# unversioned endpoint should be specified here; to request a particular API +# version, use the `version`, `min-version`, and/or `max-version` options. +# (string value) +# Deprecated group/name - [ironic]/api_endpoint +#endpoint_override = + + +[key_manager] + +# +# From nova.conf +# + +# +# Fixed key returned by key manager, specified in hex. +# +# Possible values: +# +# * Empty string or a key in hex value +# (string value) +#fixed_key = + +# Specify the key manager implementation. Options are "barbican" and "vault". +# Default is "barbican". Will support the values earlier set using +# [key_manager]/api_class for some time. (string value) +# Deprecated group/name - [key_manager]/api_class +#backend = barbican + +# The type of authentication credential to create. Possible values are 'token', +# 'password', 'keystone_token', and 'keystone_password'. Required if no context +# is passed to the credential factory. (string value) +#auth_type = + +# Token for authentication. Required for 'token' and 'keystone_token' auth_type +# if no context is passed to the credential factory. (string value) +#token = + +# Username for authentication. Required for 'password' auth_type. Optional for +# the 'keystone_password' auth_type. (string value) +#username = + +# Password for authentication. Required for 'password' and 'keystone_password' +# auth_type. (string value) +#password = + +# Use this endpoint to connect to Keystone. (string value) +#auth_url = + +# User ID for authentication. Optional for 'keystone_token' and +# 'keystone_password' auth_type. (string value) +#user_id = + +# User's domain ID for authentication. Optional for 'keystone_token' and +# 'keystone_password' auth_type. (string value) +#user_domain_id = + +# User's domain name for authentication. Optional for 'keystone_token' and +# 'keystone_password' auth_type. (string value) +#user_domain_name = + +# Trust ID for trust scoping. Optional for 'keystone_token' and +# 'keystone_password' auth_type. (string value) +#trust_id = + +# Domain ID for domain scoping. Optional for 'keystone_token' and +# 'keystone_password' auth_type. (string value) +#domain_id = + +# Domain name for domain scoping. Optional for 'keystone_token' and +# 'keystone_password' auth_type. (string value) +#domain_name = + +# Project ID for project scoping. Optional for 'keystone_token' and +# 'keystone_password' auth_type. (string value) +#project_id = + +# Project name for project scoping. Optional for 'keystone_token' and +# 'keystone_password' auth_type. (string value) +#project_name = + +# Project's domain ID for project. Optional for 'keystone_token' and +# 'keystone_password' auth_type. (string value) +#project_domain_id = + +# Project's domain name for project. Optional for 'keystone_token' and +# 'keystone_password' auth_type. (string value) +#project_domain_name = + +# Allow fetching a new token if the current one is going to expire. Optional for +# 'keystone_token' and 'keystone_password' auth_type. (boolean value) +#reauthenticate = true + + +[keystone] +# Configuration options for the identity service + +# +# From nova.conf +# + +# PEM encoded Certificate Authority to use when verifying HTTPs connections. +# (string value) +#cafile = + +# PEM encoded client certificate cert file (string value) +#certfile = + +# PEM encoded client certificate key file (string value) +#keyfile = + +# Verify HTTPS connections. (boolean value) +#insecure = false + +# Timeout value for http requests (integer value) +#timeout = + +# The default service_type for endpoint URL discovery. (string value) +#service_type = identity + +# The default service_name for endpoint URL discovery. (string value) +#service_name = + +# List of interfaces, in order of preference, for endpoint URL. (list value) +#valid_interfaces = internal,public + +# The default region_name for endpoint URL discovery. (string value) +#region_name = + +# Always use this endpoint URL for requests for this client. NOTE: The +# unversioned endpoint should be specified here; to request a particular API +# version, use the `version`, `min-version`, and/or `max-version` options. +# (string value) +#endpoint_override = + + +[keystone_authtoken] +password = nova_user_secret +username = nova +project_name = service +user_domain_name = default +project_domain_name = default +auth_type = password +memcached_servers = controller:11211 +auth_url = http://controller:5000 +auth_uri = http://controller:5000 + +# +# From keystonemiddleware.auth_token +# + +# Complete "public" Identity API endpoint. This endpoint should not be an +# "admin" endpoint, as it should be accessible by all end users. Unauthenticated +# clients are redirected to this endpoint to authenticate. Although this +# endpoint should ideally be unversioned, client support in the wild varies. If +# you're using a versioned v2 endpoint here, then this should *not* be the same +# endpoint the service user utilizes for validating tokens, because normal end +# users may not be able to reach that endpoint. (string value) +# Deprecated group/name - [keystone_authtoken]/auth_uri +#www_authenticate_uri = + +# DEPRECATED: Complete "public" Identity API endpoint. This endpoint should not +# be an "admin" endpoint, as it should be accessible by all end users. +# Unauthenticated clients are redirected to this endpoint to authenticate. +# Although this endpoint should ideally be unversioned, client support in the +# wild varies. If you're using a versioned v2 endpoint here, then this should +# *not* be the same endpoint the service user utilizes for validating tokens, +# because normal end users may not be able to reach that endpoint. This option +# is deprecated in favor of www_authenticate_uri and will be removed in the S +# release. (string value) +# This option is deprecated for removal since Queens. +# Its value may be silently ignored in the future. +# Reason: The auth_uri option is deprecated in favor of www_authenticate_uri and +# will be removed in the S release. +#auth_uri = + +# API version of the admin Identity API endpoint. (string value) +#auth_version = + +# Do not handle authorization requests within the middleware, but delegate the +# authorization decision to downstream WSGI components. (boolean value) +#delay_auth_decision = false + +# Request timeout value for communicating with Identity API server. (integer +# value) +#http_connect_timeout = + +# How many times are we trying to reconnect when communicating with Identity API +# Server. (integer value) +#http_request_max_retries = 3 + +# Request environment key where the Swift cache object is stored. When +# auth_token middleware is deployed with a Swift cache, use this option to have +# the middleware share a caching backend with swift. Otherwise, use the +# ``memcached_servers`` option instead. (string value) +#cache = + +# Required if identity server requires client certificate (string value) +#certfile = + +# Required if identity server requires client certificate (string value) +#keyfile = + +# A PEM encoded Certificate Authority to use when verifying HTTPs connections. +# Defaults to system CAs. (string value) +#cafile = + +# Verify HTTPS connections. (boolean value) +#insecure = false + +# The region in which the identity server can be found. (string value) +#region_name = + +# DEPRECATED: Directory used to cache files related to PKI tokens. This option +# has been deprecated in the Ocata release and will be removed in the P release. +# (string value) +# This option is deprecated for removal since Ocata. +# Its value may be silently ignored in the future. +# Reason: PKI token format is no longer supported. +#signing_dir = + +# Optionally specify a list of memcached server(s) to use for caching. If left +# undefined, tokens will instead be cached in-process. (list value) +# Deprecated group/name - [keystone_authtoken]/memcache_servers +#memcached_servers = + +# In order to prevent excessive effort spent validating tokens, the middleware +# caches previously-seen tokens for a configurable duration (in seconds). Set to +# -1 to disable caching completely. (integer value) +#token_cache_time = 300 + +# DEPRECATED: Determines the frequency at which the list of revoked tokens is +# retrieved from the Identity service (in seconds). A high number of revocation +# events combined with a low cache duration may significantly reduce +# performance. Only valid for PKI tokens. This option has been deprecated in the +# Ocata release and will be removed in the P release. (integer value) +# This option is deprecated for removal since Ocata. +# Its value may be silently ignored in the future. +# Reason: PKI token format is no longer supported. +#revocation_cache_time = 10 + +# (Optional) If defined, indicate whether token data should be authenticated or +# authenticated and encrypted. If MAC, token data is authenticated (with HMAC) +# in the cache. If ENCRYPT, token data is encrypted and authenticated in the +# cache. If the value is not one of these options or empty, auth_token will +# raise an exception on initialization. (string value) +# Possible values: +# None - +# MAC - +# ENCRYPT - +#memcache_security_strategy = None + +# (Optional, mandatory if memcache_security_strategy is defined) This string is +# used for key derivation. (string value) +#memcache_secret_key = + +# (Optional) Number of seconds memcached server is considered dead before it is +# tried again. (integer value) +#memcache_pool_dead_retry = 300 + +# (Optional) Maximum total number of open connections to every memcached server. +# (integer value) +#memcache_pool_maxsize = 10 + +# (Optional) Socket timeout in seconds for communicating with a memcached +# server. (integer value) +#memcache_pool_socket_timeout = 3 + +# (Optional) Number of seconds a connection to memcached is held unused in the +# pool before it is closed. (integer value) +#memcache_pool_unused_timeout = 60 + +# (Optional) Number of seconds that an operation will wait to get a memcached +# client connection from the pool. (integer value) +#memcache_pool_conn_get_timeout = 10 + +# (Optional) Use the advanced (eventlet safe) memcached client pool. The +# advanced pool will only work under python 2.x. (boolean value) +#memcache_use_advanced_pool = false + +# (Optional) Indicate whether to set the X-Service-Catalog header. If False, +# middleware will not ask for service catalog on token validation and will not +# set the X-Service-Catalog header. (boolean value) +#include_service_catalog = true + +# Used to control the use and type of token binding. Can be set to: "disabled" +# to not check token binding. "permissive" (default) to validate binding +# information if the bind type is of a form known to the server and ignore it if +# not. "strict" like "permissive" but if the bind type is unknown the token will +# be rejected. "required" any form of token binding is needed to be allowed. +# Finally the name of a binding method that must be present in tokens. (string +# value) +#enforce_token_bind = permissive + +# DEPRECATED: If true, the revocation list will be checked for cached tokens. +# This requires that PKI tokens are configured on the identity server. (boolean +# value) +# This option is deprecated for removal since Ocata. +# Its value may be silently ignored in the future. +# Reason: PKI token format is no longer supported. +#check_revocations_for_cached = false + +# DEPRECATED: Hash algorithms to use for hashing PKI tokens. This may be a +# single algorithm or multiple. The algorithms are those supported by Python +# standard hashlib.new(). The hashes will be tried in the order given, so put +# the preferred one first for performance. The result of the first hash will be +# stored in the cache. This will typically be set to multiple values only while +# migrating from a less secure algorithm to a more secure one. Once all the old +# tokens are expired this option should be set to a single value for better +# performance. (list value) +# This option is deprecated for removal since Ocata. +# Its value may be silently ignored in the future. +# Reason: PKI token format is no longer supported. +#hash_algorithms = md5 + +# A choice of roles that must be present in a service token. Service tokens are +# allowed to request that an expired token can be used and so this check should +# tightly control that only actual services should be sending this token. Roles +# here are applied as an ANY check so any role in this list must be present. For +# backwards compatibility reasons this currently only affects the allow_expired +# check. (list value) +#service_token_roles = service + +# For backwards compatibility reasons we must let valid service tokens pass that +# don't pass the service_token_roles check as valid. Setting this true will +# become the default in a future release and should be enabled if possible. +# (boolean value) +#service_token_roles_required = false + +# Prefix to prepend at the beginning of the path. Deprecated, use identity_uri. +# (string value) +#auth_admin_prefix = + +# Host providing the admin Identity API endpoint. Deprecated, use identity_uri. +# (string value) +#auth_host = 127.0.0.1 + +# Port of the admin Identity API endpoint. Deprecated, use identity_uri. +# (integer value) +#auth_port = 35357 + +# Protocol of the admin Identity API endpoint. Deprecated, use identity_uri. +# (string value) +# Possible values: +# http - +# https - +#auth_protocol = https + +# Complete admin Identity API endpoint. This should specify the unversioned root +# endpoint e.g. https://localhost:35357/ (string value) +#identity_uri = + +# This option is deprecated and may be removed in a future release. Single +# shared secret with the Keystone configuration used for bootstrapping a +# Keystone installation, or otherwise bypassing the normal authentication +# process. This option should not be used, use `admin_user` and `admin_password` +# instead. (string value) +#admin_token = + +# Service username. (string value) +#admin_user = + +# Service user password. (string value) +#admin_password = + +# Service tenant name. (string value) +#admin_tenant_name = admin + +# Authentication type to load (string value) +# Deprecated group/name - [keystone_authtoken]/auth_plugin +#auth_type = + +# Config Section from which to load plugin specific options (string value) +#auth_section = + + +[libvirt] +# +# Libvirt options allows cloud administrator to configure related +# libvirt hypervisor driver to be used within an OpenStack deployment. +# +# Almost all of the libvirt config options are influence by ``virt_type`` config +# which describes the virtualization type (or so called domain type) libvirt +# should use for specific features such as live migration, snapshot. + +# +# From nova.conf +# + +# +# The ID of the image to boot from to rescue data from a corrupted instance. +# +# If the rescue REST API operation doesn't provide an ID of an image to +# use, the image which is referenced by this ID is used. If this +# option is not set, the image from the instance is used. +# +# Possible values: +# +# * An ID of an image or nothing. If it points to an *Amazon Machine +# Image* (AMI), consider to set the config options ``rescue_kernel_id`` +# and ``rescue_ramdisk_id`` too. If nothing is set, the image of the instance +# is used. +# +# Related options: +# +# * ``rescue_kernel_id``: If the chosen rescue image allows the separate +# definition of its kernel disk, the value of this option is used, +# if specified. This is the case when *Amazon*'s AMI/AKI/ARI image +# format is used for the rescue image. +# * ``rescue_ramdisk_id``: If the chosen rescue image allows the separate +# definition of its RAM disk, the value of this option is used if, +# specified. This is the case when *Amazon*'s AMI/AKI/ARI image +# format is used for the rescue image. +# (string value) +#rescue_image_id = + +# +# The ID of the kernel (AKI) image to use with the rescue image. +# +# If the chosen rescue image allows the separate definition of its kernel +# disk, the value of this option is used, if specified. This is the case +# when *Amazon*'s AMI/AKI/ARI image format is used for the rescue image. +# +# Possible values: +# +# * An ID of an kernel image or nothing. If nothing is specified, the kernel +# disk from the instance is used if it was launched with one. +# +# Related options: +# +# * ``rescue_image_id``: If that option points to an image in *Amazon*'s +# AMI/AKI/ARI image format, it's useful to use ``rescue_kernel_id`` too. +# (string value) +#rescue_kernel_id = + +# +# The ID of the RAM disk (ARI) image to use with the rescue image. +# +# If the chosen rescue image allows the separate definition of its RAM +# disk, the value of this option is used, if specified. This is the case +# when *Amazon*'s AMI/AKI/ARI image format is used for the rescue image. +# +# Possible values: +# +# * An ID of a RAM disk image or nothing. If nothing is specified, the RAM +# disk from the instance is used if it was launched with one. +# +# Related options: +# +# * ``rescue_image_id``: If that option points to an image in *Amazon*'s +# AMI/AKI/ARI image format, it's useful to use ``rescue_ramdisk_id`` too. +# (string value) +#rescue_ramdisk_id = + +# +# Describes the virtualization type (or so called domain type) libvirt should +# use. +# +# The choice of this type must match the underlying virtualization strategy +# you have chosen for this host. +# +# Possible values: +# +# * See the predefined set of case-sensitive values. +# +# Related options: +# +# * ``connection_uri``: depends on this +# * ``disk_prefix``: depends on this +# * ``cpu_mode``: depends on this +# * ``cpu_model``: depends on this +# (string value) +# Possible values: +# kvm - +# lxc - +# qemu - +# uml - +# xen - +# parallels - +#virt_type = kvm + +# +# Overrides the default libvirt URI of the chosen virtualization type. +# +# If set, Nova will use this URI to connect to libvirt. +# +# Possible values: +# +# * An URI like ``qemu:///system`` or ``xen+ssh://oirase/`` for example. +# This is only necessary if the URI differs to the commonly known URIs +# for the chosen virtualization type. +# +# Related options: +# +# * ``virt_type``: Influences what is used as default value here. +# (string value) +#connection_uri = + +# +# Allow the injection of an admin password for instance only at ``create`` and +# ``rebuild`` process. +# +# There is no agent needed within the image to do this. If *libguestfs* is +# available on the host, it will be used. Otherwise *nbd* is used. The file +# system of the image will be mounted and the admin password, which is provided +# in the REST API call will be injected as password for the root user. If no +# root user is available, the instance won't be launched and an error is thrown. +# Be aware that the injection is *not* possible when the instance gets launched +# from a volume. +# +# Possible values: +# +# * True: Allows the injection. +# * False (default): Disallows the injection. Any via the REST API provided +# admin password will be silently ignored. +# +# Related options: +# +# * ``inject_partition``: That option will decide about the discovery and usage +# of the file system. It also can disable the injection at all. +# (boolean value) +#inject_password = false + +# +# Allow the injection of an SSH key at boot time. +# +# There is no agent needed within the image to do this. If *libguestfs* is +# available on the host, it will be used. Otherwise *nbd* is used. The file +# system of the image will be mounted and the SSH key, which is provided +# in the REST API call will be injected as SSH key for the root user and +# appended to the ``authorized_keys`` of that user. The SELinux context will +# be set if necessary. Be aware that the injection is *not* possible when the +# instance gets launched from a volume. +# +# This config option will enable directly modifying the instance disk and does +# not affect what cloud-init may do using data from config_drive option or the +# metadata service. +# +# Related options: +# +# * ``inject_partition``: That option will decide about the discovery and usage +# of the file system. It also can disable the injection at all. +# (boolean value) +#inject_key = false + +# +# Determines the way how the file system is chosen to inject data into it. +# +# *libguestfs* will be used a first solution to inject data. If that's not +# available on the host, the image will be locally mounted on the host as a +# fallback solution. If libguestfs is not able to determine the root partition +# (because there are more or less than one root partition) or cannot mount the +# file system it will result in an error and the instance won't be boot. +# +# Possible values: +# +# * -2 => disable the injection of data. +# * -1 => find the root partition with the file system to mount with libguestfs +# * 0 => The image is not partitioned +# * >0 => The number of the partition to use for the injection +# +# Related options: +# +# * ``inject_key``: If this option allows the injection of a SSH key it depends +# on value greater or equal to -1 for ``inject_partition``. +# * ``inject_password``: If this option allows the injection of an admin +# password +# it depends on value greater or equal to -1 for ``inject_partition``. +# * ``guestfs`` You can enable the debug log level of libguestfs with this +# config option. A more verbose output will help in debugging issues. +# * ``virt_type``: If you use ``lxc`` as virt_type it will be treated as a +# single partition image +# (integer value) +# Minimum value: -2 +#inject_partition = -2 + +# DEPRECATED: +# Enable a mouse cursor within a graphical VNC or SPICE sessions. +# +# This will only be taken into account if the VM is fully virtualized and VNC +# and/or SPICE is enabled. If the node doesn't support a graphical framebuffer, +# then it is valid to set this to False. +# +# Related options: +# * ``[vnc]enabled``: If VNC is enabled, ``use_usb_tablet`` will have an effect. +# * ``[spice]enabled`` + ``[spice].agent_enabled``: If SPICE is enabled and the +# spice agent is disabled, the config value of ``use_usb_tablet`` will have +# an effect. +# (boolean value) +# This option is deprecated for removal since 14.0.0. +# Its value may be silently ignored in the future. +# Reason: This option is being replaced by the 'pointer_model' option. +#use_usb_tablet = true + +# +# The IP address or hostname to be used as the target for live migration +# traffic. +# +# If this option is set to None, the hostname of the migration target compute +# node will be used. +# +# This option is useful in environments where the live-migration traffic can +# impact the network plane significantly. A separate network for live-migration +# traffic can then use this config option and avoids the impact on the +# management network. +# +# Possible values: +# +# * A valid IP address or hostname, else None. +# +# Related options: +# +# * ``live_migration_tunnelled``: The live_migration_inbound_addr value is +# ignored if tunneling is enabled. +# (string value) +#live_migration_inbound_addr = + +# DEPRECATED: +# Live migration target URI to use. +# +# Override the default libvirt live migration target URI (which is dependent +# on virt_type). Any included "%s" is replaced with the migration target +# hostname. +# +# If this option is set to None (which is the default), Nova will automatically +# generate the `live_migration_uri` value based on only 4 supported `virt_type` +# in following list: +# +# * 'kvm': 'qemu+tcp://%s/system' +# * 'qemu': 'qemu+tcp://%s/system' +# * 'xen': 'xenmigr://%s/system' +# * 'parallels': 'parallels+tcp://%s/system' +# +# Related options: +# +# * ``live_migration_inbound_addr``: If ``live_migration_inbound_addr`` value +# is not None and ``live_migration_tunnelled`` is False, the ip/hostname +# address of target compute node is used instead of ``live_migration_uri`` as +# the uri for live migration. +# * ``live_migration_scheme``: If ``live_migration_uri`` is not set, the scheme +# used for live migration is taken from ``live_migration_scheme`` instead. +# (string value) +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# live_migration_uri is deprecated for removal in favor of two other options +# that +# allow to change live migration scheme and target URI: +# ``live_migration_scheme`` +# and ``live_migration_inbound_addr`` respectively. +#live_migration_uri = + +# +# URI scheme used for live migration. +# +# Override the default libvirt live migration scheme (which is dependent on +# virt_type). If this option is set to None, nova will automatically choose a +# sensible default based on the hypervisor. It is not recommended that you +# change +# this unless you are very sure that hypervisor supports a particular scheme. +# +# Related options: +# +# * ``virt_type``: This option is meaningful only when ``virt_type`` is set to +# `kvm` or `qemu`. +# * ``live_migration_uri``: If ``live_migration_uri`` value is not None, the +# scheme used for live migration is taken from ``live_migration_uri`` instead. +# (string value) +#live_migration_scheme = + +# +# Enable tunnelled migration. +# +# This option enables the tunnelled migration feature, where migration data is +# transported over the libvirtd connection. If enabled, we use the +# VIR_MIGRATE_TUNNELLED migration flag, avoiding the need to configure +# the network to allow direct hypervisor to hypervisor communication. +# If False, use the native transport. If not set, Nova will choose a +# sensible default based on, for example the availability of native +# encryption support in the hypervisor. Enabling this option will definitely +# impact performance massively. +# +# Note that this option is NOT compatible with use of block migration. +# +# Related options: +# +# * ``live_migration_inbound_addr``: The live_migration_inbound_addr value is +# ignored if tunneling is enabled. +# (boolean value) +#live_migration_tunnelled = false + +# +# Maximum bandwidth(in MiB/s) to be used during migration. +# +# If set to 0, the hypervisor will choose a suitable default. Some hypervisors +# do not support this feature and will return an error if bandwidth is not 0. +# Please refer to the libvirt documentation for further details. +# (integer value) +#live_migration_bandwidth = 0 + +# +# Maximum permitted downtime, in milliseconds, for live migration +# switchover. +# +# Will be rounded up to a minimum of 100ms. You can increase this value +# if you want to allow live-migrations to complete faster, or avoid +# live-migration timeout errors by allowing the guest to be paused for +# longer during the live-migration switch over. +# +# Related options: +# +# * live_migration_completion_timeout +# (integer value) +# Minimum value: 100 +#live_migration_downtime = 500 + +# +# Number of incremental steps to reach max downtime value. +# +# Will be rounded up to a minimum of 3 steps. +# (integer value) +# Minimum value: 3 +#live_migration_downtime_steps = 10 + +# +# Time to wait, in seconds, between each step increase of the migration +# downtime. +# +# Minimum delay is 3 seconds. Value is per GiB of guest RAM + disk to be +# transferred, with lower bound of a minimum of 2 GiB per device. +# (integer value) +# Minimum value: 3 +#live_migration_downtime_delay = 75 + +# +# Time to wait, in seconds, for migration to successfully complete transferring +# data before aborting the operation. +# +# Value is per GiB of guest RAM + disk to be transferred, with lower bound of +# a minimum of 2 GiB. Should usually be larger than downtime delay * downtime +# steps. Set to 0 to disable timeouts. +# +# Related options: +# +# * live_migration_downtime +# * live_migration_downtime_steps +# * live_migration_downtime_delay +# (integer value) +# Note: This option can be changed without restarting. +#live_migration_completion_timeout = 800 + +# DEPRECATED: +# Time to wait, in seconds, for migration to make forward progress in +# transferring data before aborting the operation. +# +# Set to 0 to disable timeouts. +# +# This is deprecated, and now disabled by default because we have found serious +# bugs in this feature that caused false live-migration timeout failures. This +# feature will be removed or replaced in a future release. +# (integer value) +# Note: This option can be changed without restarting. +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Serious bugs found in this feature. +#live_migration_progress_timeout = 0 + +# +# This option allows nova to switch an on-going live migration to post-copy +# mode, i.e., switch the active VM to the one on the destination node before the +# migration is complete, therefore ensuring an upper bound on the memory that +# needs to be transferred. Post-copy requires libvirt>=1.3.3 and QEMU>=2.5.0. +# +# When permitted, post-copy mode will be automatically activated if a +# live-migration memory copy iteration does not make percentage increase of at +# least 10% over the last iteration. +# +# The live-migration force complete API also uses post-copy when permitted. If +# post-copy mode is not available, force complete falls back to pausing the VM +# to ensure the live-migration operation will complete. +# +# When using post-copy mode, if the source and destination hosts loose network +# connectivity, the VM being live-migrated will need to be rebooted. For more +# details, please see the Administration guide. +# +# Related options: +# +# * live_migration_permit_auto_converge +# (boolean value) +#live_migration_permit_post_copy = false + +# +# This option allows nova to start live migration with auto converge on. +# +# Auto converge throttles down CPU if a progress of on-going live migration +# is slow. Auto converge will only be used if this flag is set to True and +# post copy is not permitted or post copy is unavailable due to the version +# of libvirt and QEMU in use. +# +# Related options: +# +# * live_migration_permit_post_copy +# (boolean value) +#live_migration_permit_auto_converge = false + +# +# Determine the snapshot image format when sending to the image service. +# +# If set, this decides what format is used when sending the snapshot to the +# image service. +# If not set, defaults to same type as source image. +# +# Possible values: +# +# * ``raw``: RAW disk format +# * ``qcow2``: KVM default disk format +# * ``vmdk``: VMWare default disk format +# * ``vdi``: VirtualBox default disk format +# * If not set, defaults to same type as source image. +# (string value) +# Possible values: +# raw - +# qcow2 - +# vmdk - +# vdi - +#snapshot_image_format = + +# +# Override the default disk prefix for the devices attached to an instance. +# +# If set, this is used to identify a free disk device name for a bus. +# +# Possible values: +# +# * Any prefix which will result in a valid disk device name like 'sda' or 'hda' +# for example. This is only necessary if the device names differ to the +# commonly known device name prefixes for a virtualization type such as: sd, +# xvd, uvd, vd. +# +# Related options: +# +# * ``virt_type``: Influences which device type is used, which determines +# the default disk prefix. +# (string value) +#disk_prefix = + +# Number of seconds to wait for instance to shut down after soft reboot request +# is made. We fall back to hard reboot if instance does not shutdown within this +# window. (integer value) +#wait_soft_reboot_seconds = 120 + +# +# Is used to set the CPU mode an instance should have. +# +# If virt_type="kvm|qemu", it will default to "host-model", otherwise it will +# default to "none". +# +# Possible values: +# +# * ``host-model``: Clones the host CPU feature flags +# * ``host-passthrough``: Use the host CPU model exactly +# * ``custom``: Use a named CPU model +# * ``none``: Don't set a specific CPU model. For instances with +# ``virt_type`` as KVM/QEMU, the default CPU model from QEMU will be used, +# which provides a basic set of CPU features that are compatible with most +# hosts. +# +# Related options: +# +# * ``cpu_model``: This should be set ONLY when ``cpu_mode`` is set to +# ``custom``. Otherwise, it would result in an error and the instance +# launch will fail. +# +# (string value) +# Possible values: +# host-model - +# host-passthrough - +# custom - +# none - +#cpu_mode = + +# +# Set the name of the libvirt CPU model the instance should use. +# +# Possible values: +# +# * The named CPU models listed in ``/usr/share/libvirt/cpu_map.xml`` +# +# Related options: +# +# * ``cpu_mode``: This should be set to ``custom`` ONLY when you want to +# configure (via ``cpu_model``) a specific named CPU model. Otherwise, it +# would result in an error and the instance launch will fail. +# +# * ``virt_type``: Only the virtualization types ``kvm`` and ``qemu`` use this. +# (string value) +#cpu_model = + +# +# This allows specifying granular CPU feature flags when specifying CPU +# models. For example, to explicitly specify the ``pcid`` +# (Process-Context ID, an Intel processor feature) flag to the "IvyBridge" +# virtual CPU model:: +# +# [libvirt] +# cpu_mode = custom +# cpu_model = IvyBridge +# cpu_model_extra_flags = pcid +# +# Currently, the choice is restricted to only one option: ``pcid`` (the +# option is case-insensitive, so ``PCID`` is also valid). This flag is +# now required to address the guest performance degradation as a result of +# applying the "Meltdown" CVE fixes on certain Intel CPU models. +# +# Note that when using this config attribute to set the 'PCID' CPU flag, +# not all virtual (i.e. libvirt / QEMU) CPU models need it: +# +# * The only virtual CPU models that include the 'PCID' capability are +# Intel "Haswell", "Broadwell", and "Skylake" variants. +# +# * The libvirt / QEMU CPU models "Nehalem", "Westmere", "SandyBridge", +# and "IvyBridge" will _not_ expose the 'PCID' capability by default, +# even if the host CPUs by the same name include it. I.e. 'PCID' needs +# to be explicitly specified when using the said virtual CPU models. +# +# For now, the ``cpu_model_extra_flags`` config attribute is valid only in +# combination with ``cpu_mode`` + ``cpu_model`` options. +# +# Besides ``custom``, the libvirt driver has two other CPU modes: The +# default, ``host-model``, tells it to do the right thing with respect to +# handling 'PCID' CPU flag for the guest -- *assuming* you are running +# updated processor microcode, host and guest kernel, libvirt, and QEMU. +# The other mode, ``host-passthrough``, checks if 'PCID' is available in +# the hardware, and if so directly passes it through to the Nova guests. +# Thus, in context of 'PCID', with either of these CPU modes +# (``host-model`` or ``host-passthrough``), there is no need to use the +# ``cpu_model_extra_flags``. +# +# Related options: +# +# * cpu_mode +# * cpu_model +# (list value) +#cpu_model_extra_flags = + +# Location where libvirt driver will store snapshots before uploading them to +# image service (string value) +#snapshots_directory = $instances_path/snapshots + +# Location where the Xen hvmloader is kept (string value) +#xen_hvmloader_path = /usr/lib/xen/boot/hvmloader + +# +# Specific cache modes to use for different disk types. +# +# For example: file=directsync,block=none,network=writeback +# +# For local or direct-attached storage, it is recommended that you use +# writethrough (default) mode, as it ensures data integrity and has acceptable +# I/O performance for applications running in the guest, especially for read +# operations. However, caching mode none is recommended for remote NFS storage, +# because direct I/O operations (O_DIRECT) perform better than synchronous I/O +# operations (with O_SYNC). Caching mode none effectively turns all guest I/O +# operations into direct I/O operations on the host, which is the NFS client in +# this environment. +# +# Possible cache modes: +# +# * default: Same as writethrough. +# * none: With caching mode set to none, the host page cache is disabled, but +# the disk write cache is enabled for the guest. In this mode, the write +# performance in the guest is optimal because write operations bypass the host +# page cache and go directly to the disk write cache. If the disk write cache +# is battery-backed, or if the applications or storage stack in the guest +# transfer data properly (either through fsync operations or file system +# barriers), then data integrity can be ensured. However, because the host +# page cache is disabled, the read performance in the guest would not be as +# good as in the modes where the host page cache is enabled, such as +# writethrough mode. Shareable disk devices, like for a multi-attachable block +# storage volume, will have their cache mode set to 'none' regardless of +# configuration. +# * writethrough: writethrough mode is the default caching mode. With +# caching set to writethrough mode, the host page cache is enabled, but the +# disk write cache is disabled for the guest. Consequently, this caching mode +# ensures data integrity even if the applications and storage stack in the +# guest do not transfer data to permanent storage properly (either through +# fsync operations or file system barriers). Because the host page cache is +# enabled in this mode, the read performance for applications running in the +# guest is generally better. However, the write performance might be reduced +# because the disk write cache is disabled. +# * writeback: With caching set to writeback mode, both the host page cache +# and the disk write cache are enabled for the guest. Because of this, the +# I/O performance for applications running in the guest is good, but the data +# is not protected in a power failure. As a result, this caching mode is +# recommended only for temporary data where potential data loss is not a +# concern. +# * directsync: Like "writethrough", but it bypasses the host page cache. +# * unsafe: Caching mode of unsafe ignores cache transfer operations +# completely. As its name implies, this caching mode should be used only for +# temporary data where data loss is not a concern. This mode can be useful for +# speeding up guest installations, but you should switch to another caching +# mode in production environments. +# (list value) +#disk_cachemodes = + +# A path to a device that will be used as source of entropy on the host. +# Permitted options are: /dev/random or /dev/hwrng (string value) +#rng_dev_path = + +# For qemu or KVM guests, set this option to specify a default machine type per +# host architecture. You can find a list of supported machine types in your +# environment by checking the output of the "virsh capabilities"command. The +# format of the value for this config option is host-arch=machine-type. For +# example: x86_64=machinetype1,armv7l=machinetype2 (list value) +#hw_machine_type = + +# The data source used to the populate the host "serial" UUID exposed to guest +# in the virtual BIOS. (string value) +# Possible values: +# none - +# os - +# hardware - +# auto - +#sysinfo_serial = auto + +# A number of seconds to memory usage statistics period. Zero or negative value +# mean to disable memory usage statistics. (integer value) +#mem_stats_period_seconds = 10 + +# List of uid targets and ranges.Syntax is guest-uid:host-uid:countMaximum of 5 +# allowed. (list value) +#uid_maps = + +# List of guid targets and ranges.Syntax is guest-gid:host-gid:countMaximum of 5 +# allowed. (list value) +#gid_maps = + +# In a realtime host context vCPUs for guest will run in that scheduling +# priority. Priority depends on the host kernel (usually 1-99) (integer value) +#realtime_scheduler_priority = 1 + +# +# This is a performance event list which could be used as monitor. These events +# will be passed to libvirt domain xml while creating a new instances. +# Then event statistics data can be collected from libvirt. The minimum +# libvirt version is 2.0.0. For more information about `Performance monitoring +# events`, refer https://libvirt.org/formatdomain.html#elementsPerf . +# +# Possible values: +# * A string list. For example: ``enabled_perf_events = cmt, mbml, mbmt`` +# The supported events list can be found in +# https://libvirt.org/html/libvirt-libvirt-domain.html , +# which you may need to search key words ``VIR_PERF_PARAM_*`` +# (list value) +#enabled_perf_events = + +# +# VM Images format. +# +# If default is specified, then use_cow_images flag is used instead of this +# one. +# +# Related options: +# +# * virt.use_cow_images +# * images_volume_group +# (string value) +# Possible values: +# raw - +# flat - +# qcow2 - +# lvm - +# rbd - +# ploop - +# default - +#images_type = default + +# +# LVM Volume Group that is used for VM images, when you specify images_type=lvm +# +# Related options: +# +# * images_type +# (string value) +#images_volume_group = + +# +# Create sparse logical volumes (with virtualsize) if this flag is set to True. +# (boolean value) +#sparse_logical_volumes = false + +# The RADOS pool in which rbd volumes are stored (string value) +#images_rbd_pool = rbd + +# Path to the ceph configuration file to use (string value) +#images_rbd_ceph_conf = + +# +# Discard option for nova managed disks. +# +# Requires: +# +# * Libvirt >= 1.0.6 +# * Qemu >= 1.5 (raw format) +# * Qemu >= 1.6 (qcow2 format) +# (string value) +# Possible values: +# ignore - +# unmap - +#hw_disk_discard = + +# DEPRECATED: Allows image information files to be stored in non-standard +# locations (string value) +# This option is deprecated for removal since 14.0.0. +# Its value may be silently ignored in the future. +# Reason: Image info files are no longer used by the image cache +#image_info_filename_pattern = $instances_path/$image_cache_subdirectory_name/%(image)s.info + +# Unused resized base images younger than this will not be removed (integer +# value) +#remove_unused_resized_minimum_age_seconds = 3600 + +# DEPRECATED: Write a checksum for files in _base to disk (boolean value) +# This option is deprecated for removal since 14.0.0. +# Its value may be silently ignored in the future. +# Reason: The image cache no longer periodically calculates checksums of stored +# images. Data integrity can be checked at the block or filesystem level. +#checksum_base_images = false + +# DEPRECATED: How frequently to checksum base images (integer value) +# This option is deprecated for removal since 14.0.0. +# Its value may be silently ignored in the future. +# Reason: The image cache no longer periodically calculates checksums of stored +# images. Data integrity can be checked at the block or filesystem level. +#checksum_interval_seconds = 3600 + +# +# Method used to wipe ephemeral disks when they are deleted. Only takes effect +# if LVM is set as backing storage. +# +# Possible values: +# +# * none - do not wipe deleted volumes +# * zero - overwrite volumes with zeroes +# * shred - overwrite volume repeatedly +# +# Related options: +# +# * images_type - must be set to ``lvm`` +# * volume_clear_size +# (string value) +# Possible values: +# none - +# zero - +# shred - +#volume_clear = zero + +# +# Size of area in MiB, counting from the beginning of the allocated volume, +# that will be cleared using method set in ``volume_clear`` option. +# +# Possible values: +# +# * 0 - clear whole volume +# * >0 - clear specified amount of MiB +# +# Related options: +# +# * images_type - must be set to ``lvm`` +# * volume_clear - must be set and the value must be different than ``none`` +# for this option to have any impact +# (integer value) +# Minimum value: 0 +#volume_clear_size = 0 + +# +# Enable snapshot compression for ``qcow2`` images. +# +# Note: you can set ``snapshot_image_format`` to ``qcow2`` to force all +# snapshots to be in ``qcow2`` format, independently from their original image +# type. +# +# Related options: +# +# * snapshot_image_format +# (boolean value) +#snapshot_compression = false + +# Use virtio for bridge interfaces with KVM/QEMU (boolean value) +#use_virtio_for_bridges = true + +# +# Use multipath connection of the iSCSI or FC volume +# +# Volumes can be connected in the LibVirt as multipath devices. This will +# provide high availability and fault tolerance. +# (boolean value) +# Deprecated group/name - [libvirt]/iscsi_use_multipath +#volume_use_multipath = false + +# +# Number of times to scan given storage protocol to find volume. +# (integer value) +# Deprecated group/name - [libvirt]/num_iscsi_scan_tries +#num_volume_scan_tries = 5 + +# +# Number of times to rediscover AoE target to find volume. +# +# Nova provides support for block storage attaching to hosts via AOE (ATA over +# Ethernet). This option allows the user to specify the maximum number of retry +# attempts that can be made to discover the AoE device. +# (integer value) +#num_aoe_discover_tries = 3 + +# +# The iSCSI transport iface to use to connect to target in case offload support +# is desired. +# +# Default format is of the form . where +# is one of (be2iscsi, bnx2i, cxgb3i, cxgb4i, qla4xxx, ocs) and +# is the MAC address of the interface and can be generated via the +# iscsiadm -m iface command. Do not confuse the iscsi_iface parameter to be +# provided here with the actual transport name. +# (string value) +# Deprecated group/name - [libvirt]/iscsi_transport +#iscsi_iface = + +# +# Number of times to scan iSER target to find volume. +# +# iSER is a server network protocol that extends iSCSI protocol to use Remote +# Direct Memory Access (RDMA). This option allows the user to specify the +# maximum +# number of scan attempts that can be made to find iSER volume. +# (integer value) +#num_iser_scan_tries = 5 + +# +# Use multipath connection of the iSER volume. +# +# iSER volumes can be connected as multipath devices. This will provide high +# availability and fault tolerance. +# (boolean value) +#iser_use_multipath = false + +# +# The RADOS client name for accessing rbd(RADOS Block Devices) volumes. +# +# Libvirt will refer to this user when connecting and authenticating with +# the Ceph RBD server. +# (string value) +#rbd_user = + +# +# The libvirt UUID of the secret for the rbd_user volumes. +# (string value) +#rbd_secret_uuid = + +# +# Directory where the NFS volume is mounted on the compute node. +# The default is 'mnt' directory of the location where nova's Python module +# is installed. +# +# NFS provides shared storage for the OpenStack Block Storage service. +# +# Possible values: +# +# * A string representing absolute path of mount point. +# (string value) +#nfs_mount_point_base = $state_path/mnt + +# +# Mount options passed to the NFS client. See section of the nfs man page +# for details. +# +# Mount options controls the way the filesystem is mounted and how the +# NFS client behaves when accessing files on this mount point. +# +# Possible values: +# +# * Any string representing mount options separated by commas. +# * Example string: vers=3,lookupcache=pos +# (string value) +#nfs_mount_options = + +# +# Directory where the Quobyte volume is mounted on the compute node. +# +# Nova supports Quobyte volume driver that enables storing Block Storage +# service volumes on a Quobyte storage back end. This Option specifies the +# path of the directory where Quobyte volume is mounted. +# +# Possible values: +# +# * A string representing absolute path of mount point. +# (string value) +#quobyte_mount_point_base = $state_path/mnt + +# Path to a Quobyte Client configuration file. (string value) +#quobyte_client_cfg = + +# +# Directory where the SMBFS shares are mounted on the compute node. +# (string value) +#smbfs_mount_point_base = $state_path/mnt + +# +# Mount options passed to the SMBFS client. +# +# Provide SMBFS options as a single string containing all parameters. +# See mount.cifs man page for details. Note that the libvirt-qemu ``uid`` +# and ``gid`` must be specified. +# (string value) +#smbfs_mount_options = + +# +# libvirt's transport method for remote file operations. +# +# Because libvirt cannot use RPC to copy files over network to/from other +# compute nodes, other method must be used for: +# +# * creating directory on remote host +# * creating file on remote host +# * removing file from remote host +# * copying file to remote host +# (string value) +# Possible values: +# ssh - +# rsync - +#remote_filesystem_transport = ssh + +# +# Directory where the Virtuozzo Storage clusters are mounted on the compute +# node. +# +# This option defines non-standard mountpoint for Vzstorage cluster. +# +# Related options: +# +# * vzstorage_mount_* group of parameters +# (string value) +#vzstorage_mount_point_base = $state_path/mnt + +# +# Mount owner user name. +# +# This option defines the owner user of Vzstorage cluster mountpoint. +# +# Related options: +# +# * vzstorage_mount_* group of parameters +# (string value) +#vzstorage_mount_user = stack + +# +# Mount owner group name. +# +# This option defines the owner group of Vzstorage cluster mountpoint. +# +# Related options: +# +# * vzstorage_mount_* group of parameters +# (string value) +#vzstorage_mount_group = qemu + +# +# Mount access mode. +# +# This option defines the access bits of Vzstorage cluster mountpoint, +# in the format similar to one of chmod(1) utility, like this: 0770. +# It consists of one to four digits ranging from 0 to 7, with missing +# lead digits assumed to be 0's. +# +# Related options: +# +# * vzstorage_mount_* group of parameters +# (string value) +#vzstorage_mount_perms = 0770 + +# +# Path to vzstorage client log. +# +# This option defines the log of cluster operations, +# it should include "%(cluster_name)s" template to separate +# logs from multiple shares. +# +# Related options: +# +# * vzstorage_mount_opts may include more detailed logging options. +# (string value) +#vzstorage_log_path = /var/log/vstorage/%(cluster_name)s/nova.log.gz + +# +# Path to the SSD cache file. +# +# You can attach an SSD drive to a client and configure the drive to store +# a local cache of frequently accessed data. By having a local cache on a +# client's SSD drive, you can increase the overall cluster performance by +# up to 10 and more times. +# WARNING! There is a lot of SSD models which are not server grade and +# may loose arbitrary set of data changes on power loss. +# Such SSDs should not be used in Vstorage and are dangerous as may lead +# to data corruptions and inconsistencies. Please consult with the manual +# on which SSD models are known to be safe or verify it using +# vstorage-hwflush-check(1) utility. +# +# This option defines the path which should include "%(cluster_name)s" +# template to separate caches from multiple shares. +# +# Related options: +# +# * vzstorage_mount_opts may include more detailed cache options. +# (string value) +#vzstorage_cache_path = + +# +# Extra mount options for pstorage-mount +# +# For full description of them, see +# https://static.openvz.org/vz-man/man1/pstorage-mount.1.gz.html +# Format is a python string representation of arguments list, like: +# "['-v', '-R', '500']" +# Shouldn't include -c, -l, -C, -u, -g and -m as those have +# explicit vzstorage_* options. +# +# Related options: +# +# * All other vzstorage_* options +# (list value) +#vzstorage_mount_opts = + + +[matchmaker_redis] + +# +# From oslo.messaging +# + +# DEPRECATED: Host to locate redis. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#host = 127.0.0.1 + +# DEPRECATED: Use this port to connect to redis host. (port value) +# Minimum value: 0 +# Maximum value: 65535 +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#port = 6379 + +# DEPRECATED: Password for Redis server (optional). (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#password = + +# DEPRECATED: List of Redis Sentinel hosts (fault tolerance mode), e.g., +# [host:port, host1:port ... ] (list value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#sentinel_hosts = + +# Redis replica set name. (string value) +#sentinel_group_name = oslo-messaging-zeromq + +# Time in ms to wait between connection attempts. (integer value) +#wait_timeout = 2000 + +# Time in ms to wait before the transaction is killed. (integer value) +#check_timeout = 20000 + +# Timeout in ms on blocking socket operations. (integer value) +#socket_timeout = 10000 + + +[metrics] +# +# Configuration options for metrics +# +# Options under this group allow to adjust how values assigned to metrics are +# calculated. + +# +# From nova.conf +# + +# +# When using metrics to weight the suitability of a host, you can use this +# option +# to change how the calculated weight influences the weight assigned to a host +# as +# follows: +# +# * >1.0: increases the effect of the metric on overall weight +# * 1.0: no change to the calculated weight +# * >0.0,<1.0: reduces the effect of the metric on overall weight +# * 0.0: the metric value is ignored, and the value of the +# 'weight_of_unavailable' option is returned instead +# * >-1.0,<0.0: the effect is reduced and reversed +# * -1.0: the effect is reversed +# * <-1.0: the effect is increased proportionally and reversed +# +# This option is only used by the FilterScheduler and its subclasses; if you use +# a different scheduler, this option has no effect. +# +# Possible values: +# +# * An integer or float value, where the value corresponds to the multipler +# ratio for this weigher. +# +# Related options: +# +# * weight_of_unavailable +# (floating point value) +#weight_multiplier = 1.0 + +# +# This setting specifies the metrics to be weighed and the relative ratios for +# each metric. This should be a single string value, consisting of a series of +# one or more 'name=ratio' pairs, separated by commas, where 'name' is the name +# of the metric to be weighed, and 'ratio' is the relative weight for that +# metric. +# +# Note that if the ratio is set to 0, the metric value is ignored, and instead +# the weight will be set to the value of the 'weight_of_unavailable' option. +# +# As an example, let's consider the case where this option is set to: +# +# ``name1=1.0, name2=-1.3`` +# +# The final weight will be: +# +# ``(name1.value * 1.0) + (name2.value * -1.3)`` +# +# This option is only used by the FilterScheduler and its subclasses; if you use +# a different scheduler, this option has no effect. +# +# Possible values: +# +# * A list of zero or more key/value pairs separated by commas, where the key is +# a string representing the name of a metric and the value is a numeric weight +# for that metric. If any value is set to 0, the value is ignored and the +# weight will be set to the value of the 'weight_of_unavailable' option. +# +# Related options: +# +# * weight_of_unavailable +# (list value) +#weight_setting = + +# +# This setting determines how any unavailable metrics are treated. If this +# option +# is set to True, any hosts for which a metric is unavailable will raise an +# exception, so it is recommended to also use the MetricFilter to filter out +# those hosts before weighing. +# +# This option is only used by the FilterScheduler and its subclasses; if you use +# a different scheduler, this option has no effect. +# +# Possible values: +# +# * True or False, where False ensures any metric being unavailable for a host +# will set the host weight to 'weight_of_unavailable'. +# +# Related options: +# +# * weight_of_unavailable +# (boolean value) +#required = true + +# +# When any of the following conditions are met, this value will be used in place +# of any actual metric value: +# +# * One of the metrics named in 'weight_setting' is not available for a host, +# and the value of 'required' is False +# * The ratio specified for a metric in 'weight_setting' is 0 +# * The 'weight_multiplier' option is set to 0 +# +# This option is only used by the FilterScheduler and its subclasses; if you use +# a different scheduler, this option has no effect. +# +# Possible values: +# +# * An integer or float value, where the value corresponds to the multipler +# ratio for this weigher. +# +# Related options: +# +# * weight_setting +# * required +# * weight_multiplier +# (floating point value) +#weight_of_unavailable = -10000.0 + + +[mks] +# +# Nova compute node uses WebMKS, a desktop sharing protocol to provide +# instance console access to VM's created by VMware hypervisors. +# +# Related options: +# Following options must be set to provide console access. +# * mksproxy_base_url +# * enabled + +# +# From nova.conf +# + +# +# Location of MKS web console proxy +# +# The URL in the response points to a WebMKS proxy which +# starts proxying between client and corresponding vCenter +# server where instance runs. In order to use the web based +# console access, WebMKS proxy should be installed and configured +# +# Possible values: +# +# * Must be a valid URL of the form:``http://host:port/`` or +# ``https://host:port/`` +# (uri value) +#mksproxy_base_url = http://127.0.0.1:6090/ + +# +# Enables graphical console access for virtual machines. +# (boolean value) +#enabled = false + + +[neutron] +password = neutron_user_secret +username = neutron +project_name = service +region_name = RegionOne +user_domain_name = default +project_domain_name = default +auth_type = password +auth_url = http://controller:5000 +url = http://controller:9696 +# +# Configuration options for neutron (network connectivity as a service). + +# +# From nova.conf +# + +# DEPRECATED: +# This option specifies the URL for connecting to Neutron. +# +# Possible values: +# +# * Any valid URL that points to the Neutron API service is appropriate here. +# This typically matches the URL returned for the 'network' service type +# from the Keystone service catalog. +# (uri value) +# This option is deprecated for removal since 17.0.0. +# Its value may be silently ignored in the future. +# Reason: Endpoint lookup uses the service catalog via common keystoneauth1 +# Adapter configuration options. In the current release, "url" will override +# this behavior, but will be ignored and/or removed in a future release. To +# achieve the same result, use the endpoint_override option instead. +#url = http://127.0.0.1:9696 + +# +# Default name for the Open vSwitch integration bridge. +# +# Specifies the name of an integration bridge interface used by OpenvSwitch. +# This option is only used if Neutron does not specify the OVS bridge name in +# port binding responses. +# (string value) +#ovs_bridge = br-int + +# +# Default name for the floating IP pool. +# +# Specifies the name of floating IP pool used for allocating floating IPs. This +# option is only used if Neutron does not specify the floating IP pool name in +# port binding reponses. +# (string value) +#default_floating_pool = nova + +# +# Integer value representing the number of seconds to wait before querying +# Neutron for extensions. After this number of seconds the next time Nova +# needs to create a resource in Neutron it will requery Neutron for the +# extensions that it has loaded. Setting value to 0 will refresh the +# extensions with no wait. +# (integer value) +# Minimum value: 0 +#extension_sync_interval = 600 + +# +# When set to True, this option indicates that Neutron will be used to proxy +# metadata requests and resolve instance ids. Otherwise, the instance ID must be +# passed to the metadata request in the 'X-Instance-ID' header. +# +# Related options: +# +# * metadata_proxy_shared_secret +# (boolean value) +#service_metadata_proxy = false + +# +# This option holds the shared secret string used to validate proxy requests to +# Neutron metadata requests. In order to be used, the +# 'X-Metadata-Provider-Signature' header must be supplied in the request. +# +# Related options: +# +# * service_metadata_proxy +# (string value) +#metadata_proxy_shared_secret = + +# PEM encoded Certificate Authority to use when verifying HTTPs connections. +# (string value) +#cafile = + +# PEM encoded client certificate cert file (string value) +#certfile = + +# PEM encoded client certificate key file (string value) +#keyfile = + +# Verify HTTPS connections. (boolean value) +#insecure = false + +# Timeout value for http requests (integer value) +#timeout = + +# Authentication type to load (string value) +# Deprecated group/name - [neutron]/auth_plugin +#auth_type = + +# Config Section from which to load plugin specific options (string value) +#auth_section = + +# Authentication URL (string value) +#auth_url = + +# Scope for system operations (string value) +#system_scope = + +# Domain ID to scope to (string value) +#domain_id = + +# Domain name to scope to (string value) +#domain_name = + +# Project ID to scope to (string value) +#project_id = + +# Project name to scope to (string value) +#project_name = + +# Domain ID containing project (string value) +#project_domain_id = + +# Domain name containing project (string value) +#project_domain_name = + +# Trust ID (string value) +#trust_id = + +# Optional domain ID to use with v3 and v2 parameters. It will be used for both +# the user and project domain in v3 and ignored in v2 authentication. (string +# value) +#default_domain_id = + +# Optional domain name to use with v3 API and v2 parameters. It will be used for +# both the user and project domain in v3 and ignored in v2 authentication. +# (string value) +#default_domain_name = + +# User ID (string value) +#user_id = + +# Username (string value) +# Deprecated group/name - [neutron]/user_name +#username = + +# User's domain id (string value) +#user_domain_id = + +# User's domain name (string value) +#user_domain_name = + +# User's password (string value) +#password = + +# Tenant ID (string value) +#tenant_id = + +# Tenant Name (string value) +#tenant_name = + +# The default service_type for endpoint URL discovery. (string value) +#service_type = network + +# The default service_name for endpoint URL discovery. (string value) +#service_name = + +# List of interfaces, in order of preference, for endpoint URL. (list value) +#valid_interfaces = internal,public + +# The default region_name for endpoint URL discovery. (string value) +#region_name = + +# Always use this endpoint URL for requests for this client. NOTE: The +# unversioned endpoint should be specified here; to request a particular API +# version, use the `version`, `min-version`, and/or `max-version` options. +# (string value) +#endpoint_override = + + +[notifications] +# +# Most of the actions in Nova which manipulate the system state generate +# notifications which are posted to the messaging component (e.g. RabbitMQ) and +# can be consumed by any service outside the OpenStack. More technical details +# at https://docs.openstack.org/nova/latest/reference/notifications.html + +# +# From nova.conf +# + +# +# If set, send compute.instance.update notifications on +# instance state changes. +# +# Please refer to +# https://docs.openstack.org/nova/latest/reference/notifications.html for +# additional information on notifications. +# +# Possible values: +# +# * None - no notifications +# * "vm_state" - notifications are sent with VM state transition information in +# the ``old_state`` and ``state`` fields. The ``old_task_state`` and +# ``new_task_state`` fields will be set to the current task_state of the +# instance. +# * "vm_and_task_state" - notifications are sent with VM and task state +# transition information. +# (string value) +# Possible values: +# - +# vm_state - +# vm_and_task_state - +#notify_on_state_change = + +# Default notification level for outgoing notifications. (string value) +# Possible values: +# DEBUG - +# INFO - +# WARN - +# ERROR - +# CRITICAL - +# Deprecated group/name - [DEFAULT]/default_notification_level +#default_level = INFO + +# DEPRECATED: +# Default publisher_id for outgoing notifications. If you consider routing +# notifications using different publisher, change this value accordingly. +# +# Possible values: +# +# * Defaults to the current hostname of this host, but it can be any valid +# oslo.messaging publisher_id +# +# Related options: +# +# * host - Hostname, FQDN or IP address of this host. +# (string value) +# This option is deprecated for removal since 17.0.0. +# Its value may be silently ignored in the future. +# Reason: +# This option is only used when ``monkey_patch=True`` and +# ``monkey_patch_modules`` is configured to specify the legacy notify_decorator. +# Since the monkey_patch and monkey_patch_modules options are deprecated, this +# option is also deprecated. +#default_publisher_id = $host + +# +# Specifies which notification format shall be used by nova. +# +# The default value is fine for most deployments and rarely needs to be changed. +# This value can be set to 'versioned' once the infrastructure moves closer to +# consuming the newer format of notifications. After this occurs, this option +# will be removed. +# +# Note that notifications can be completely disabled by setting ``driver=noop`` +# in the ``[oslo_messaging_notifications]`` group. +# +# Possible values: +# * unversioned: Only the legacy unversioned notifications are emitted. +# * versioned: Only the new versioned notifications are emitted. +# * both: Both the legacy unversioned and the new versioned notifications are +# emitted. (Default) +# +# The list of versioned notifications is visible in +# https://docs.openstack.org/nova/latest/reference/notifications.html +# (string value) +# Possible values: +# unversioned - +# versioned - +# both - +#notification_format = both + +# +# Specifies the topics for the versioned notifications issued by nova. +# +# The default value is fine for most deployments and rarely needs to be changed. +# However, if you have a third-party service that consumes versioned +# notifications, it might be worth getting a topic for that service. +# Nova will send a message containing a versioned notification payload to each +# topic queue in this list. +# +# The list of versioned notifications is visible in +# https://docs.openstack.org/nova/latest/reference/notifications.html +# (list value) +#versioned_notifications_topics = versioned_notifications + +# +# If enabled, include block device information in the versioned notification +# payload. Sending block device information is disabled by default as providing +# that information can incur some overhead on the system since the information +# may need to be loaded from the database. +# (boolean value) +#bdms_in_notifications = false + + +[osapi_v21] + +# +# From nova.conf +# + +# DEPRECATED: +# This option is a string representing a regular expression (regex) that matches +# the project_id as contained in URLs. If not set, it will match normal UUIDs +# created by keystone. +# +# Possible values: +# +# * A string representing any legal regular expression +# (string value) +# This option is deprecated for removal since 13.0.0. +# Its value may be silently ignored in the future. +# Reason: +# Recent versions of nova constrain project IDs to hexadecimal characters and +# dashes. If your installation uses IDs outside of this range, you should use +# this option to provide your own regex and give you time to migrate offending +# projects to valid IDs before the next release. +#project_id_regex = + + +[oslo_concurrency] +lock_path = /var/lib/nova/tmp + +# +# From oslo.concurrency +# + +# Enables or disables inter-process locks. (boolean value) +#disable_process_locking = false + +# Directory to use for lock files. For security, the specified directory should +# only be writable by the user running the processes that need locking. Defaults +# to environment variable OSLO_LOCK_PATH. If OSLO_LOCK_PATH is not set in the +# environment, use the Python tempfile.gettempdir function to find a suitable +# location. If external locks are used, a lock path must be set. (string value) +#lock_path = /tmp + + +[oslo_messaging_amqp] + +# +# From oslo.messaging +# + +# Name for the AMQP container. must be globally unique. Defaults to a generated +# UUID (string value) +#container_name = + +# Timeout for inactive connections (in seconds) (integer value) +#idle_timeout = 0 + +# Debug: dump AMQP frames to stdout (boolean value) +#trace = false + +# Attempt to connect via SSL. If no other ssl-related parameters are given, it +# will use the system's CA-bundle to verify the server's certificate. (boolean +# value) +#ssl = false + +# CA certificate PEM file used to verify the server's certificate (string value) +#ssl_ca_file = + +# Self-identifying certificate PEM file for client authentication (string value) +#ssl_cert_file = + +# Private key PEM file used to sign ssl_cert_file certificate (optional) (string +# value) +#ssl_key_file = + +# Password for decrypting ssl_key_file (if encrypted) (string value) +#ssl_key_password = + +# By default SSL checks that the name in the server's certificate matches the +# hostname in the transport_url. In some configurations it may be preferable to +# use the virtual hostname instead, for example if the server uses the Server +# Name Indication TLS extension (rfc6066) to provide a certificate per virtual +# host. Set ssl_verify_vhost to True if the server's SSL certificate uses the +# virtual host name instead of the DNS name. (boolean value) +#ssl_verify_vhost = false + +# DEPRECATED: Accept clients using either SSL or plain TCP (boolean value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Not applicable - not a SSL server +#allow_insecure_clients = false + +# Space separated list of acceptable SASL mechanisms (string value) +#sasl_mechanisms = + +# Path to directory that contains the SASL configuration (string value) +#sasl_config_dir = + +# Name of configuration file (without .conf suffix) (string value) +#sasl_config_name = + +# SASL realm to use if no realm present in username (string value) +#sasl_default_realm = + +# DEPRECATED: User name for message broker authentication (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Should use configuration option transport_url to provide the username. +#username = + +# DEPRECATED: Password for message broker authentication (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Should use configuration option transport_url to provide the password. +#password = + +# Seconds to pause before attempting to re-connect. (integer value) +# Minimum value: 1 +#connection_retry_interval = 1 + +# Increase the connection_retry_interval by this many seconds after each +# unsuccessful failover attempt. (integer value) +# Minimum value: 0 +#connection_retry_backoff = 2 + +# Maximum limit for connection_retry_interval + connection_retry_backoff +# (integer value) +# Minimum value: 1 +#connection_retry_interval_max = 30 + +# Time to pause between re-connecting an AMQP 1.0 link that failed due to a +# recoverable error. (integer value) +# Minimum value: 1 +#link_retry_delay = 10 + +# The maximum number of attempts to re-send a reply message which failed due to +# a recoverable error. (integer value) +# Minimum value: -1 +#default_reply_retry = 0 + +# The deadline for an rpc reply message delivery. (integer value) +# Minimum value: 5 +#default_reply_timeout = 30 + +# The deadline for an rpc cast or call message delivery. Only used when caller +# does not provide a timeout expiry. (integer value) +# Minimum value: 5 +#default_send_timeout = 30 + +# The deadline for a sent notification message delivery. Only used when caller +# does not provide a timeout expiry. (integer value) +# Minimum value: 5 +#default_notify_timeout = 30 + +# The duration to schedule a purge of idle sender links. Detach link after +# expiry. (integer value) +# Minimum value: 1 +#default_sender_link_timeout = 600 + +# Indicates the addressing mode used by the driver. +# Permitted values: +# 'legacy' - use legacy non-routable addressing +# 'routable' - use routable addresses +# 'dynamic' - use legacy addresses if the message bus does not support routing +# otherwise use routable addressing (string value) +#addressing_mode = dynamic + +# Enable virtual host support for those message buses that do not natively +# support virtual hosting (such as qpidd). When set to true the virtual host +# name will be added to all message bus addresses, effectively creating a +# private 'subnet' per virtual host. Set to False if the message bus supports +# virtual hosting using the 'hostname' field in the AMQP 1.0 Open performative +# as the name of the virtual host. (boolean value) +#pseudo_vhost = true + +# address prefix used when sending to a specific server (string value) +#server_request_prefix = exclusive + +# address prefix used when broadcasting to all servers (string value) +#broadcast_prefix = broadcast + +# address prefix when sending to any server in group (string value) +#group_request_prefix = unicast + +# Address prefix for all generated RPC addresses (string value) +#rpc_address_prefix = openstack.org/om/rpc + +# Address prefix for all generated Notification addresses (string value) +#notify_address_prefix = openstack.org/om/notify + +# Appended to the address prefix when sending a fanout message. Used by the +# message bus to identify fanout messages. (string value) +#multicast_address = multicast + +# Appended to the address prefix when sending to a particular RPC/Notification +# server. Used by the message bus to identify messages sent to a single +# destination. (string value) +#unicast_address = unicast + +# Appended to the address prefix when sending to a group of consumers. Used by +# the message bus to identify messages that should be delivered in a round-robin +# fashion across consumers. (string value) +#anycast_address = anycast + +# Exchange name used in notification addresses. +# Exchange name resolution precedence: +# Target.exchange if set +# else default_notification_exchange if set +# else control_exchange if set +# else 'notify' (string value) +#default_notification_exchange = + +# Exchange name used in RPC addresses. +# Exchange name resolution precedence: +# Target.exchange if set +# else default_rpc_exchange if set +# else control_exchange if set +# else 'rpc' (string value) +#default_rpc_exchange = + +# Window size for incoming RPC Reply messages. (integer value) +# Minimum value: 1 +#reply_link_credit = 200 + +# Window size for incoming RPC Request messages (integer value) +# Minimum value: 1 +#rpc_server_credit = 100 + +# Window size for incoming Notification messages (integer value) +# Minimum value: 1 +#notify_server_credit = 100 + +# Send messages of this type pre-settled. +# Pre-settled messages will not receive acknowledgement +# from the peer. Note well: pre-settled messages may be +# silently discarded if the delivery fails. +# Permitted values: +# 'rpc-call' - send RPC Calls pre-settled +# 'rpc-reply'- send RPC Replies pre-settled +# 'rpc-cast' - Send RPC Casts pre-settled +# 'notify' - Send Notifications pre-settled +# (multi valued) +#pre_settled = rpc-cast +#pre_settled = rpc-reply + + +[oslo_messaging_kafka] + +# +# From oslo.messaging +# + +# DEPRECATED: Default Kafka broker Host (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#kafka_default_host = localhost + +# DEPRECATED: Default Kafka broker Port (port value) +# Minimum value: 0 +# Maximum value: 65535 +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#kafka_default_port = 9092 + +# Max fetch bytes of Kafka consumer (integer value) +#kafka_max_fetch_bytes = 1048576 + +# Default timeout(s) for Kafka consumers (floating point value) +#kafka_consumer_timeout = 1.0 + +# DEPRECATED: Pool Size for Kafka Consumers (integer value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Driver no longer uses connection pool. +#pool_size = 10 + +# DEPRECATED: The pool size limit for connections expiration policy (integer +# value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Driver no longer uses connection pool. +#conn_pool_min_size = 2 + +# DEPRECATED: The time-to-live in sec of idle connections in the pool (integer +# value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Driver no longer uses connection pool. +#conn_pool_ttl = 1200 + +# Group id for Kafka consumer. Consumers in one group will coordinate message +# consumption (string value) +#consumer_group = oslo_messaging_consumer + +# Upper bound on the delay for KafkaProducer batching in seconds (floating point +# value) +#producer_batch_timeout = 0.0 + +# Size of batch for the producer async send (integer value) +#producer_batch_size = 16384 + + +[oslo_messaging_notifications] + +# +# From oslo.messaging +# + +# The Drivers(s) to handle sending notifications. Possible values are messaging, +# messagingv2, routing, log, test, noop (multi valued) +# Deprecated group/name - [DEFAULT]/notification_driver +#driver = + +# A URL representing the messaging driver to use for notifications. If not set, +# we fall back to the same configuration used for RPC. (string value) +# Deprecated group/name - [DEFAULT]/notification_transport_url +#transport_url = + +# AMQP topic used for OpenStack notifications. (list value) +# Deprecated group/name - [rpc_notifier2]/topics +# Deprecated group/name - [DEFAULT]/notification_topics +#topics = notifications + +# The maximum number of attempts to re-send a notification message which failed +# to be delivered due to a recoverable error. 0 - No retry, -1 - indefinite +# (integer value) +#retry = -1 + + +[oslo_messaging_rabbit] + +# +# From oslo.messaging +# + +# Use durable queues in AMQP. (boolean value) +# Deprecated group/name - [DEFAULT]/amqp_durable_queues +# Deprecated group/name - [DEFAULT]/rabbit_durable_queues +#amqp_durable_queues = false + +# Auto-delete queues in AMQP. (boolean value) +#amqp_auto_delete = false + +# Enable SSL (boolean value) +#ssl = + +# SSL version to use (valid only if SSL enabled). Valid values are TLSv1 and +# SSLv23. SSLv2, SSLv3, TLSv1_1, and TLSv1_2 may be available on some +# distributions. (string value) +# Deprecated group/name - [oslo_messaging_rabbit]/kombu_ssl_version +#ssl_version = + +# SSL key file (valid only if SSL enabled). (string value) +# Deprecated group/name - [oslo_messaging_rabbit]/kombu_ssl_keyfile +#ssl_key_file = + +# SSL cert file (valid only if SSL enabled). (string value) +# Deprecated group/name - [oslo_messaging_rabbit]/kombu_ssl_certfile +#ssl_cert_file = + +# SSL certification authority file (valid only if SSL enabled). (string value) +# Deprecated group/name - [oslo_messaging_rabbit]/kombu_ssl_ca_certs +#ssl_ca_file = + +# How long to wait before reconnecting in response to an AMQP consumer cancel +# notification. (floating point value) +#kombu_reconnect_delay = 1.0 + +# EXPERIMENTAL: Possible values are: gzip, bz2. If not set compression will not +# be used. This option may not be available in future versions. (string value) +#kombu_compression = + +# How long to wait a missing client before abandoning to send it its replies. +# This value should not be longer than rpc_response_timeout. (integer value) +# Deprecated group/name - [oslo_messaging_rabbit]/kombu_reconnect_timeout +#kombu_missing_consumer_retry_timeout = 60 + +# Determines how the next RabbitMQ node is chosen in case the one we are +# currently connected to becomes unavailable. Takes effect only if more than one +# RabbitMQ node is provided in config. (string value) +# Possible values: +# round-robin - +# shuffle - +#kombu_failover_strategy = round-robin + +# DEPRECATED: The RabbitMQ broker address where a single node is used. (string +# value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#rabbit_host = localhost + +# DEPRECATED: The RabbitMQ broker port where a single node is used. (port value) +# Minimum value: 0 +# Maximum value: 65535 +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#rabbit_port = 5672 + +# DEPRECATED: RabbitMQ HA cluster host:port pairs. (list value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#rabbit_hosts = $rabbit_host:$rabbit_port + +# DEPRECATED: The RabbitMQ userid. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#rabbit_userid = guest + +# DEPRECATED: The RabbitMQ password. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#rabbit_password = guest + +# The RabbitMQ login method. (string value) +# Possible values: +# PLAIN - +# AMQPLAIN - +# RABBIT-CR-DEMO - +#rabbit_login_method = AMQPLAIN + +# DEPRECATED: The RabbitMQ virtual host. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#rabbit_virtual_host = / + +# How frequently to retry connecting with RabbitMQ. (integer value) +#rabbit_retry_interval = 1 + +# How long to backoff for between retries when connecting to RabbitMQ. (integer +# value) +#rabbit_retry_backoff = 2 + +# Maximum interval of RabbitMQ connection retries. Default is 30 seconds. +# (integer value) +#rabbit_interval_max = 30 + +# DEPRECATED: Maximum number of RabbitMQ connection retries. Default is 0 +# (infinite retry count). (integer value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +#rabbit_max_retries = 0 + +# Try to use HA queues in RabbitMQ (x-ha-policy: all). If you change this +# option, you must wipe the RabbitMQ database. In RabbitMQ 3.0, queue mirroring +# is no longer controlled by the x-ha-policy argument when declaring a queue. If +# you just want to make sure that all queues (except those with auto-generated +# names) are mirrored across all nodes, run: "rabbitmqctl set_policy HA +# '^(?!amq\.).*' '{"ha-mode": "all"}' " (boolean value) +#rabbit_ha_queues = false + +# Positive integer representing duration in seconds for queue TTL (x-expires). +# Queues which are unused for the duration of the TTL are automatically deleted. +# The parameter affects only reply and fanout queues. (integer value) +# Minimum value: 1 +#rabbit_transient_queues_ttl = 1800 + +# Specifies the number of messages to prefetch. Setting to zero allows unlimited +# messages. (integer value) +#rabbit_qos_prefetch_count = 0 + +# Number of seconds after which the Rabbit broker is considered down if +# heartbeat's keep-alive fails (0 disable the heartbeat). EXPERIMENTAL (integer +# value) +#heartbeat_timeout_threshold = 60 + +# How often times during the heartbeat_timeout_threshold we check the heartbeat. +# (integer value) +#heartbeat_rate = 2 + +# Deprecated, use rpc_backend=kombu+memory or rpc_backend=fake (boolean value) +#fake_rabbit = false + +# Maximum number of channels to allow (integer value) +#channel_max = + +# The maximum byte size for an AMQP frame (integer value) +#frame_max = + +# How often to send heartbeats for consumer's connections (integer value) +#heartbeat_interval = 3 + +# Arguments passed to ssl.wrap_socket (dict value) +#ssl_options = + +# Set socket timeout in seconds for connection's socket (floating point value) +#socket_timeout = 0.25 + +# Set TCP_USER_TIMEOUT in seconds for connection's socket (floating point value) +#tcp_user_timeout = 0.25 + +# Set delay for reconnection to some host which has connection error (floating +# point value) +#host_connection_reconnect_delay = 0.25 + +# Connection factory implementation (string value) +# Possible values: +# new - +# single - +# read_write - +#connection_factory = single + +# Maximum number of connections to keep queued. (integer value) +#pool_max_size = 30 + +# Maximum number of connections to create above `pool_max_size`. (integer value) +#pool_max_overflow = 0 + +# Default number of seconds to wait for a connections to available (integer +# value) +#pool_timeout = 30 + +# Lifetime of a connection (since creation) in seconds or None for no recycling. +# Expired connections are closed on acquire. (integer value) +#pool_recycle = 600 + +# Threshold at which inactive (since release) connections are considered stale +# in seconds or None for no staleness. Stale connections are closed on acquire. +# (integer value) +#pool_stale = 60 + +# Default serialization mechanism for serializing/deserializing +# outgoing/incoming messages (string value) +# Possible values: +# json - +# msgpack - +#default_serializer_type = json + +# Persist notification messages. (boolean value) +#notification_persistence = false + +# Exchange name for sending notifications (string value) +#default_notification_exchange = ${control_exchange}_notification + +# Max number of not acknowledged message which RabbitMQ can send to notification +# listener. (integer value) +#notification_listener_prefetch_count = 100 + +# Reconnecting retry count in case of connectivity problem during sending +# notification, -1 means infinite retry. (integer value) +#default_notification_retry_attempts = -1 + +# Reconnecting retry delay in case of connectivity problem during sending +# notification message (floating point value) +#notification_retry_delay = 0.25 + +# Time to live for rpc queues without consumers in seconds. (integer value) +#rpc_queue_expiration = 60 + +# Exchange name for sending RPC messages (string value) +#default_rpc_exchange = ${control_exchange}_rpc + +# Exchange name for receiving RPC replies (string value) +#rpc_reply_exchange = ${control_exchange}_rpc_reply + +# Max number of not acknowledged message which RabbitMQ can send to rpc +# listener. (integer value) +#rpc_listener_prefetch_count = 100 + +# Max number of not acknowledged message which RabbitMQ can send to rpc reply +# listener. (integer value) +#rpc_reply_listener_prefetch_count = 100 + +# Reconnecting retry count in case of connectivity problem during sending reply. +# -1 means infinite retry during rpc_timeout (integer value) +#rpc_reply_retry_attempts = -1 + +# Reconnecting retry delay in case of connectivity problem during sending reply. +# (floating point value) +#rpc_reply_retry_delay = 0.25 + +# Reconnecting retry count in case of connectivity problem during sending RPC +# message, -1 means infinite retry. If actual retry attempts in not 0 the rpc +# request could be processed more than one time (integer value) +#default_rpc_retry_attempts = -1 + +# Reconnecting retry delay in case of connectivity problem during sending RPC +# message (floating point value) +#rpc_retry_delay = 0.25 + + +[oslo_messaging_zmq] + +# +# From oslo.messaging +# + +# ZeroMQ bind address. Should be a wildcard (*), an ethernet interface, or IP. +# The "host" option should point or resolve to this address. (string value) +#rpc_zmq_bind_address = * + +# MatchMaker driver. (string value) +# Possible values: +# redis - +# sentinel - +# dummy - +#rpc_zmq_matchmaker = redis + +# Number of ZeroMQ contexts, defaults to 1. (integer value) +#rpc_zmq_contexts = 1 + +# Maximum number of ingress messages to locally buffer per topic. Default is +# unlimited. (integer value) +#rpc_zmq_topic_backlog = + +# Directory for holding IPC sockets. (string value) +#rpc_zmq_ipc_dir = /var/run/openstack + +# Name of this node. Must be a valid hostname, FQDN, or IP address. Must match +# "host" option, if running Nova. (string value) +#rpc_zmq_host = localhost + +# Number of seconds to wait before all pending messages will be sent after +# closing a socket. The default value of -1 specifies an infinite linger period. +# The value of 0 specifies no linger period. Pending messages shall be discarded +# immediately when the socket is closed. Positive values specify an upper bound +# for the linger period. (integer value) +# Deprecated group/name - [DEFAULT]/rpc_cast_timeout +#zmq_linger = -1 + +# The default number of seconds that poll should wait. Poll raises timeout +# exception when timeout expired. (integer value) +#rpc_poll_timeout = 1 + +# Expiration timeout in seconds of a name service record about existing target ( +# < 0 means no timeout). (integer value) +#zmq_target_expire = 300 + +# Update period in seconds of a name service record about existing target. +# (integer value) +#zmq_target_update = 180 + +# Use PUB/SUB pattern for fanout methods. PUB/SUB always uses proxy. (boolean +# value) +#use_pub_sub = false + +# Use ROUTER remote proxy. (boolean value) +#use_router_proxy = false + +# This option makes direct connections dynamic or static. It makes sense only +# with use_router_proxy=False which means to use direct connections for direct +# message types (ignored otherwise). (boolean value) +#use_dynamic_connections = false + +# How many additional connections to a host will be made for failover reasons. +# This option is actual only in dynamic connections mode. (integer value) +#zmq_failover_connections = 2 + +# Minimal port number for random ports range. (port value) +# Minimum value: 0 +# Maximum value: 65535 +#rpc_zmq_min_port = 49153 + +# Maximal port number for random ports range. (integer value) +# Minimum value: 1 +# Maximum value: 65536 +#rpc_zmq_max_port = 65536 + +# Number of retries to find free port number before fail with ZMQBindError. +# (integer value) +#rpc_zmq_bind_port_retries = 100 + +# Default serialization mechanism for serializing/deserializing +# outgoing/incoming messages (string value) +# Possible values: +# json - +# msgpack - +#rpc_zmq_serialization = json + +# This option configures round-robin mode in zmq socket. True means not keeping +# a queue when server side disconnects. False means to keep queue and messages +# even if server is disconnected, when the server appears we send all +# accumulated messages to it. (boolean value) +#zmq_immediate = true + +# Enable/disable TCP keepalive (KA) mechanism. The default value of -1 (or any +# other negative value) means to skip any overrides and leave it to OS default; +# 0 and 1 (or any other positive value) mean to disable and enable the option +# respectively. (integer value) +#zmq_tcp_keepalive = -1 + +# The duration between two keepalive transmissions in idle condition. The unit +# is platform dependent, for example, seconds in Linux, milliseconds in Windows +# etc. The default value of -1 (or any other negative value and 0) means to skip +# any overrides and leave it to OS default. (integer value) +#zmq_tcp_keepalive_idle = -1 + +# The number of retransmissions to be carried out before declaring that remote +# end is not available. The default value of -1 (or any other negative value and +# 0) means to skip any overrides and leave it to OS default. (integer value) +#zmq_tcp_keepalive_cnt = -1 + +# The duration between two successive keepalive retransmissions, if +# acknowledgement to the previous keepalive transmission is not received. The +# unit is platform dependent, for example, seconds in Linux, milliseconds in +# Windows etc. The default value of -1 (or any other negative value and 0) means +# to skip any overrides and leave it to OS default. (integer value) +#zmq_tcp_keepalive_intvl = -1 + +# Maximum number of (green) threads to work concurrently. (integer value) +#rpc_thread_pool_size = 100 + +# Expiration timeout in seconds of a sent/received message after which it is not +# tracked anymore by a client/server. (integer value) +#rpc_message_ttl = 300 + +# Wait for message acknowledgements from receivers. This mechanism works only +# via proxy without PUB/SUB. (boolean value) +#rpc_use_acks = false + +# Number of seconds to wait for an ack from a cast/call. After each retry +# attempt this timeout is multiplied by some specified multiplier. (integer +# value) +#rpc_ack_timeout_base = 15 + +# Number to multiply base ack timeout by after each retry attempt. (integer +# value) +#rpc_ack_timeout_multiplier = 2 + +# Default number of message sending attempts in case of any problems occurred: +# positive value N means at most N retries, 0 means no retries, None or -1 (or +# any other negative values) mean to retry forever. This option is used only if +# acknowledgments are enabled. (integer value) +#rpc_retry_attempts = 3 + +# List of publisher hosts SubConsumer can subscribe on. This option has higher +# priority then the default publishers list taken from the matchmaker. (list +# value) +#subscribe_on = + + +[oslo_middleware] + +# +# From oslo.middleware +# + +# The maximum body size for each request, in bytes. (integer value) +# Deprecated group/name - [DEFAULT]/osapi_max_request_body_size +# Deprecated group/name - [DEFAULT]/max_request_body_size +#max_request_body_size = 114688 + +# DEPRECATED: The HTTP Header that will be used to determine what the original +# request protocol scheme was, even if it was hidden by a SSL termination proxy. +# (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +#secure_proxy_ssl_header = X-Forwarded-Proto + +# Whether the application is behind a proxy or not. This determines if the +# middleware should parse the headers or not. (boolean value) +#enable_proxy_headers_parsing = false + + +[oslo_policy] + +# +# From oslo.policy +# + +# This option controls whether or not to enforce scope when evaluating policies. +# If ``True``, the scope of the token used in the request is compared to the +# ``scope_types`` of the policy being enforced. If the scopes do not match, an +# ``InvalidScope`` exception will be raised. If ``False``, a message will be +# logged informing operators that policies are being invoked with mismatching +# scope. (boolean value) +#enforce_scope = false + +# The file that defines policies. (string value) +#policy_file = policy.json + +# Default rule. Enforced when a requested rule is not found. (string value) +#policy_default_rule = default + +# Directories where policy configuration files are stored. They can be relative +# to any directory in the search path defined by the config_dir option, or +# absolute paths. The file defined by policy_file must exist for these +# directories to be searched. Missing or empty directories are ignored. (multi +# valued) +#policy_dirs = policy.d + +# Content Type to send and receive data for REST based policy check (string +# value) +# Possible values: +# application/x-www-form-urlencoded - +# application/json - +#remote_content_type = application/x-www-form-urlencoded + +# server identity verification for REST based policy check (boolean value) +#remote_ssl_verify_server_crt = false + +# Absolute path to ca cert file for REST based policy check (string value) +#remote_ssl_ca_crt_file = + +# Absolute path to client cert for REST based policy check (string value) +#remote_ssl_client_crt_file = + +# Absolute path client key file REST based policy check (string value) +#remote_ssl_client_key_file = + + +[pci] + +# +# From nova.conf +# + +# +# An alias for a PCI passthrough device requirement. +# +# This allows users to specify the alias in the extra specs for a flavor, +# without +# needing to repeat all the PCI property requirements. +# +# Possible Values: +# +# * A list of JSON values which describe the aliases. For example:: +# +# alias = { +# "name": "QuickAssist", +# "product_id": "0443", +# "vendor_id": "8086", +# "device_type": "type-PCI", +# "numa_policy": "required" +# } +# +# This defines an alias for the Intel QuickAssist card. (multi valued). Valid +# key values are : +# +# ``name`` +# Name of the PCI alias. +# +# ``product_id`` +# Product ID of the device in hexadecimal. +# +# ``vendor_id`` +# Vendor ID of the device in hexadecimal. +# +# ``device_type`` +# Type of PCI device. Valid values are: ``type-PCI``, ``type-PF`` and +# ``type-VF``. +# +# ``numa_policy`` +# Required NUMA affinity of device. Valid values are: ``legacy``, +# ``preferred`` and ``required``. +# (multi valued) +# Deprecated group/name - [DEFAULT]/pci_alias +#alias = + +# +# White list of PCI devices available to VMs. +# +# Possible values: +# +# * A JSON dictionary which describe a whitelisted PCI device. It should take +# the following format: +# +# ["vendor_id": "",] ["product_id": "",] +# ["address": "[[[[]:]]:][][.[]]" | +# "devname": "",] +# {"": "",} +# +# Where '[' indicates zero or one occurrences, '{' indicates zero or multiple +# occurrences, and '|' mutually exclusive options. Note that any missing +# fields are automatically wildcarded. +# +# Valid key values are : +# +# * "vendor_id": Vendor ID of the device in hexadecimal. +# * "product_id": Product ID of the device in hexadecimal. +# * "address": PCI address of the device. +# * "devname": Device name of the device (for e.g. interface name). Not all +# PCI devices have a name. +# * "": Additional and used for matching PCI devices. +# Supported : "physical_network". +# +# The address key supports traditional glob style and regular expression +# syntax. Valid examples are: +# +# passthrough_whitelist = {"devname":"eth0", +# "physical_network":"physnet"} +# passthrough_whitelist = {"address":"*:0a:00.*"} +# passthrough_whitelist = {"address":":0a:00.", +# "physical_network":"physnet1"} +# passthrough_whitelist = {"vendor_id":"1137", +# "product_id":"0071"} +# passthrough_whitelist = {"vendor_id":"1137", +# "product_id":"0071", +# "address": "0000:0a:00.1", +# "physical_network":"physnet1"} +# passthrough_whitelist = {"address":{"domain": ".*", +# "bus": "02", "slot": "01", +# "function": "[2-7]"}, +# "physical_network":"physnet1"} +# passthrough_whitelist = {"address":{"domain": ".*", +# "bus": "02", "slot": "0[1-2]", +# "function": ".*"}, +# "physical_network":"physnet1"} +# +# The following are invalid, as they specify mutually exclusive options: +# +# passthrough_whitelist = {"devname":"eth0", +# "physical_network":"physnet", +# "address":"*:0a:00.*"} +# +# * A JSON list of JSON dictionaries corresponding to the above format. For +# example: +# +# passthrough_whitelist = [{"product_id":"0001", "vendor_id":"8086"}, +# {"product_id":"0002", "vendor_id":"8086"}] +# (multi valued) +# Deprecated group/name - [DEFAULT]/pci_passthrough_whitelist +#passthrough_whitelist = + + +[placement] +password = placement_user_secret +username = placement +auth_url = http://controller:5000/v3 +user_domain_name = Default +auth_type = password +project_name = service +project_domain_name = Default +os_region_name = RegionOne + +# +# From nova.conf +# + +# DEPRECATED: +# Region name of this node. This is used when picking the URL in the service +# catalog. +# +# Possible values: +# +# * Any string representing region name +# (string value) +# This option is deprecated for removal since 17.0.0. +# Its value may be silently ignored in the future. +# Reason: Endpoint lookup uses the service catalog via common keystoneauth1 +# Adapter configuration options. Use the region_name option instead. +#os_region_name = + +# DEPRECATED: +# Endpoint interface for this node. This is used when picking the URL in the +# service catalog. +# (string value) +# This option is deprecated for removal since 17.0.0. +# Its value may be silently ignored in the future. +# Reason: Endpoint lookup uses the service catalog via common keystoneauth1 +# Adapter configuration options. Use the valid_interfaces option instead. +#os_interface = + +# +# If True, when limiting allocation candidate results, the results will be +# a random sampling of the full result set. If False, allocation candidates +# are returned in a deterministic but undefined order. That is, all things +# being equal, two requests for allocation candidates will return the same +# results in the same order; but no guarantees are made as to how that order +# is determined. +# (boolean value) +#randomize_allocation_candidates = false + +# PEM encoded Certificate Authority to use when verifying HTTPs connections. +# (string value) +#cafile = + +# PEM encoded client certificate cert file (string value) +#certfile = + +# PEM encoded client certificate key file (string value) +#keyfile = + +# Verify HTTPS connections. (boolean value) +#insecure = false + +# Timeout value for http requests (integer value) +#timeout = + +# Authentication type to load (string value) +# Deprecated group/name - [placement]/auth_plugin +#auth_type = + +# Config Section from which to load plugin specific options (string value) +#auth_section = + +# Authentication URL (string value) +#auth_url = + +# Scope for system operations (string value) +#system_scope = + +# Domain ID to scope to (string value) +#domain_id = + +# Domain name to scope to (string value) +#domain_name = + +# Project ID to scope to (string value) +#project_id = + +# Project name to scope to (string value) +#project_name = + +# Domain ID containing project (string value) +#project_domain_id = + +# Domain name containing project (string value) +#project_domain_name = + +# Trust ID (string value) +#trust_id = + +# Optional domain ID to use with v3 and v2 parameters. It will be used for both +# the user and project domain in v3 and ignored in v2 authentication. (string +# value) +#default_domain_id = + +# Optional domain name to use with v3 API and v2 parameters. It will be used for +# both the user and project domain in v3 and ignored in v2 authentication. +# (string value) +#default_domain_name = + +# User ID (string value) +#user_id = + +# Username (string value) +# Deprecated group/name - [placement]/user_name +#username = + +# User's domain id (string value) +#user_domain_id = + +# User's domain name (string value) +#user_domain_name = + +# User's password (string value) +#password = + +# Tenant ID (string value) +#tenant_id = + +# Tenant Name (string value) +#tenant_name = + +# The default service_type for endpoint URL discovery. (string value) +#service_type = placement + +# The default service_name for endpoint URL discovery. (string value) +#service_name = + +# List of interfaces, in order of preference, for endpoint URL. (list value) +# Deprecated group/name - [placement]/os_interface +#valid_interfaces = internal,public + +# The default region_name for endpoint URL discovery. (string value) +# Deprecated group/name - [placement]/os_region_name +#region_name = + +# Always use this endpoint URL for requests for this client. NOTE: The +# unversioned endpoint should be specified here; to request a particular API +# version, use the `version`, `min-version`, and/or `max-version` options. +# (string value) +#endpoint_override = + + +[quota] +# +# Quota options allow to manage quotas in openstack deployment. + +# +# From nova.conf +# + +# +# The number of instances allowed per project. +# +# Possible Values +# +# * A positive integer or 0. +# * -1 to disable the quota. +# (integer value) +# Minimum value: -1 +# Deprecated group/name - [DEFAULT]/quota_instances +#instances = 10 + +# +# The number of instance cores or vCPUs allowed per project. +# +# Possible values: +# +# * A positive integer or 0. +# * -1 to disable the quota. +# (integer value) +# Minimum value: -1 +# Deprecated group/name - [DEFAULT]/quota_cores +#cores = 20 + +# +# The number of megabytes of instance RAM allowed per project. +# +# Possible values: +# +# * A positive integer or 0. +# * -1 to disable the quota. +# (integer value) +# Minimum value: -1 +# Deprecated group/name - [DEFAULT]/quota_ram +#ram = 51200 + +# DEPRECATED: +# The number of floating IPs allowed per project. +# +# Floating IPs are not allocated to instances by default. Users need to select +# them from the pool configured by the OpenStack administrator to attach to +# their +# instances. +# +# Possible values: +# +# * A positive integer or 0. +# * -1 to disable the quota. +# (integer value) +# Minimum value: -1 +# Deprecated group/name - [DEFAULT]/quota_floating_ips +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#floating_ips = 10 + +# DEPRECATED: +# The number of fixed IPs allowed per project. +# +# Unlike floating IPs, fixed IPs are allocated dynamically by the network +# component when instances boot up. This quota value should be at least the +# number of instances allowed +# +# Possible values: +# +# * A positive integer or 0. +# * -1 to disable the quota. +# (integer value) +# Minimum value: -1 +# Deprecated group/name - [DEFAULT]/quota_fixed_ips +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#fixed_ips = -1 + +# +# The number of metadata items allowed per instance. +# +# Users can associate metadata with an instance during instance creation. This +# metadata takes the form of key-value pairs. +# +# Possible values: +# +# * A positive integer or 0. +# * -1 to disable the quota. +# (integer value) +# Minimum value: -1 +# Deprecated group/name - [DEFAULT]/quota_metadata_items +#metadata_items = 128 + +# +# The number of injected files allowed. +# +# File injection allows users to customize the personality of an instance by +# injecting data into it upon boot. Only text file injection is permitted: +# binary +# or ZIP files are not accepted. During file injection, any existing files that +# match specified files are renamed to include ``.bak`` extension appended with +# a +# timestamp. +# +# Possible values: +# +# * A positive integer or 0. +# * -1 to disable the quota. +# (integer value) +# Minimum value: -1 +# Deprecated group/name - [DEFAULT]/quota_injected_files +#injected_files = 5 + +# +# The number of bytes allowed per injected file. +# +# Possible values: +# +# * A positive integer or 0. +# * -1 to disable the quota. +# (integer value) +# Minimum value: -1 +# Deprecated group/name - [DEFAULT]/quota_injected_file_content_bytes +#injected_file_content_bytes = 10240 + +# +# The maximum allowed injected file path length. +# +# Possible values: +# +# * A positive integer or 0. +# * -1 to disable the quota. +# (integer value) +# Minimum value: -1 +# Deprecated group/name - [DEFAULT]/quota_injected_file_path_length +#injected_file_path_length = 255 + +# DEPRECATED: +# The number of security groups per project. +# +# Possible values: +# +# * A positive integer or 0. +# * -1 to disable the quota. +# (integer value) +# Minimum value: -1 +# Deprecated group/name - [DEFAULT]/quota_security_groups +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#security_groups = 10 + +# DEPRECATED: +# The number of security rules per security group. +# +# The associated rules in each security group control the traffic to instances +# in +# the group. +# +# Possible values: +# +# * A positive integer or 0. +# * -1 to disable the quota. +# (integer value) +# Minimum value: -1 +# Deprecated group/name - [DEFAULT]/quota_security_group_rules +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#security_group_rules = 20 + +# +# The maximum number of key pairs allowed per user. +# +# Users can create at least one key pair for each project and use the key pair +# for multiple instances that belong to that project. +# +# Possible values: +# +# * A positive integer or 0. +# * -1 to disable the quota. +# (integer value) +# Minimum value: -1 +# Deprecated group/name - [DEFAULT]/quota_key_pairs +#key_pairs = 100 + +# +# The maxiumum number of server groups per project. +# +# Server groups are used to control the affinity and anti-affinity scheduling +# policy for a group of servers or instances. Reducing the quota will not affect +# any existing group, but new servers will not be allowed into groups that have +# become over quota. +# +# Possible values: +# +# * A positive integer or 0. +# * -1 to disable the quota. +# (integer value) +# Minimum value: -1 +# Deprecated group/name - [DEFAULT]/quota_server_groups +#server_groups = 10 + +# +# The maximum number of servers per server group. +# +# Possible values: +# +# * A positive integer or 0. +# * -1 to disable the quota. +# (integer value) +# Minimum value: -1 +# Deprecated group/name - [DEFAULT]/quota_server_group_members +#server_group_members = 10 + +# +# The number of seconds until a reservation expires. +# +# This quota represents the time period for invalidating quota reservations. +# (integer value) +#reservation_expire = 86400 + +# +# The count of reservations until usage is refreshed. +# +# This defaults to 0 (off) to avoid additional load but it is useful to turn on +# to help keep quota usage up-to-date and reduce the impact of out of sync usage +# issues. +# (integer value) +# Minimum value: 0 +#until_refresh = 0 + +# +# The number of seconds between subsequent usage refreshes. +# +# This defaults to 0 (off) to avoid additional load but it is useful to turn on +# to help keep quota usage up-to-date and reduce the impact of out of sync usage +# issues. Note that quotas are not updated on a periodic task, they will update +# on a new reservation if max_age has passed since the last reservation. +# (integer value) +# Minimum value: 0 +#max_age = 0 + +# DEPRECATED: +# The quota enforcer driver. +# +# Provides abstraction for quota checks. Users can configure a specific +# driver to use for quota checks. +# +# Possible values: +# +# * nova.quota.DbQuotaDriver (default) or any string representing fully +# qualified class name. +# (string value) +# Deprecated group/name - [DEFAULT]/quota_driver +# This option is deprecated for removal since 14.0.0. +# Its value may be silently ignored in the future. +#driver = nova.quota.DbQuotaDriver + +# +# Recheck quota after resource creation to prevent allowing quota to be +# exceeded. +# +# This defaults to True (recheck quota after resource creation) but can be set +# to +# False to avoid additional load if allowing quota to be exceeded because of +# racing requests is considered acceptable. For example, when set to False, if a +# user makes highly parallel REST API requests to create servers, it will be +# possible for them to create more servers than their allowed quota during the +# race. If their quota is 10 servers, they might be able to create 50 during the +# burst. After the burst, they will not be able to create any more servers but +# they will be able to keep their 50 servers until they delete them. +# +# The initial quota check is done before resources are created, so if multiple +# parallel requests arrive at the same time, all could pass the quota check and +# create resources, potentially exceeding quota. When recheck_quota is True, +# quota will be checked a second time after resources have been created and if +# the resource is over quota, it will be deleted and OverQuota will be raised, +# usually resulting in a 403 response to the REST API user. This makes it +# impossible for a user to exceed their quota with the caveat that it will, +# however, be possible for a REST API user to be rejected with a 403 response in +# the event of a collision close to reaching their quota limit, even if the user +# has enough quota available when they made the request. +# (boolean value) +#recheck_quota = true + + +[rdp] +# +# Options under this group enable and configure Remote Desktop Protocol ( +# RDP) related features. +# +# This group is only relevant to Hyper-V users. + +# +# From nova.conf +# + +# +# Enable Remote Desktop Protocol (RDP) related features. +# +# Hyper-V, unlike the majority of the hypervisors employed on Nova compute +# nodes, uses RDP instead of VNC and SPICE as a desktop sharing protocol to +# provide instance console access. This option enables RDP for graphical +# console access for virtual machines created by Hyper-V. +# +# **Note:** RDP should only be enabled on compute nodes that support the Hyper-V +# virtualization platform. +# +# Related options: +# +# * ``compute_driver``: Must be hyperv. +# +# (boolean value) +#enabled = false + +# +# The URL an end user would use to connect to the RDP HTML5 console proxy. +# The console proxy service is called with this token-embedded URL and +# establishes the connection to the proper instance. +# +# An RDP HTML5 console proxy service will need to be configured to listen on the +# address configured here. Typically the console proxy service would be run on a +# controller node. The localhost address used as default would only work in a +# single node environment i.e. devstack. +# +# An RDP HTML5 proxy allows a user to access via the web the text or graphical +# console of any Windows server or workstation using RDP. RDP HTML5 console +# proxy services include FreeRDP, wsgate. +# See https://github.com/FreeRDP/FreeRDP-WebConnect +# +# Possible values: +# +# * ://:/ +# +# The scheme must be identical to the scheme configured for the RDP HTML5 +# console proxy service. It is ``http`` or ``https``. +# +# The IP address must be identical to the address on which the RDP HTML5 +# console proxy service is listening. +# +# The port must be identical to the port on which the RDP HTML5 console proxy +# service is listening. +# +# Related options: +# +# * ``rdp.enabled``: Must be set to ``True`` for ``html5_proxy_base_url`` to be +# effective. +# (uri value) +#html5_proxy_base_url = http://127.0.0.1:6083/ + + +[remote_debug] + +# +# From nova.conf +# + +# +# Debug host (IP or name) to connect to. This command line parameter is used +# when +# you want to connect to a nova service via a debugger running on a different +# host. +# +# Note that using the remote debug option changes how Nova uses the eventlet +# library to support async IO. This could result in failures that do not occur +# under normal operation. Use at your own risk. +# +# Possible Values: +# +# * IP address of a remote host as a command line parameter +# to a nova service. For Example: +# +# /usr/local/bin/nova-compute --config-file /etc/nova/nova.conf +# --remote_debug-host +# (unknown value) +#host = + +# +# Debug port to connect to. This command line parameter allows you to specify +# the port you want to use to connect to a nova service via a debugger running +# on different host. +# +# Note that using the remote debug option changes how Nova uses the eventlet +# library to support async IO. This could result in failures that do not occur +# under normal operation. Use at your own risk. +# +# Possible Values: +# +# * Port number you want to use as a command line parameter +# to a nova service. For Example: +# +# /usr/local/bin/nova-compute --config-file /etc/nova/nova.conf +# --remote_debug-host +# --remote_debug-port it's listening on>. +# (port value) +# Minimum value: 0 +# Maximum value: 65535 +#port = + + +[scheduler] + +# +# From nova.conf +# + +# +# The scheduler host manager to use. +# +# The host manager manages the in-memory picture of the hosts that the scheduler +# uses. The options values are chosen from the entry points under the namespace +# 'nova.scheduler.host_manager' in 'setup.cfg'. +# +# NOTE: The "ironic_host_manager" option is deprecated as of the 17.0.0 Queens +# release. +# (string value) +# Possible values: +# host_manager - +# ironic_host_manager - +# Deprecated group/name - [DEFAULT]/scheduler_host_manager +#host_manager = host_manager + +# +# The class of the driver used by the scheduler. This should be chosen from one +# of the entrypoints under the namespace 'nova.scheduler.driver' of file +# 'setup.cfg'. If nothing is specified in this option, the 'filter_scheduler' is +# used. +# +# Other options are: +# +# * 'caching_scheduler' which aggressively caches the system state for better +# individual scheduler performance at the risk of more retries when running +# multiple schedulers. [DEPRECATED] +# * 'chance_scheduler' which simply picks a host at random. [DEPRECATED] +# * 'fake_scheduler' which is used for testing. +# +# Possible values: +# +# * Any of the drivers included in Nova: +# ** filter_scheduler +# ** caching_scheduler +# ** chance_scheduler +# ** fake_scheduler +# * You may also set this to the entry point name of a custom scheduler driver, +# but you will be responsible for creating and maintaining it in your +# setup.cfg +# file. +# (string value) +# Deprecated group/name - [DEFAULT]/scheduler_driver +#driver = filter_scheduler + +# +# Periodic task interval. +# +# This value controls how often (in seconds) to run periodic tasks in the +# scheduler. The specific tasks that are run for each period are determined by +# the particular scheduler being used. +# +# If this is larger than the nova-service 'service_down_time' setting, Nova may +# report the scheduler service as down. This is because the scheduler driver is +# responsible for sending a heartbeat and it will only do that as often as this +# option allows. As each scheduler can work a little differently than the +# others, +# be sure to test this with your selected scheduler. +# +# Possible values: +# +# * An integer, where the integer corresponds to periodic task interval in +# seconds. 0 uses the default interval (60 seconds). A negative value disables +# periodic tasks. +# +# Related options: +# +# * ``nova-service service_down_time`` +# (integer value) +# Deprecated group/name - [DEFAULT]/scheduler_driver_task_period +#periodic_task_interval = 60 + +# +# This is the maximum number of attempts that will be made for a given instance +# build/move operation. It limits the number of alternate hosts returned by the +# scheduler. When that list of hosts is exhausted, a MaxRetriesExceeded +# exception is raised and the instance is set to an error state. +# +# Possible values: +# +# * A positive integer, where the integer corresponds to the max number of +# attempts that can be made when building or moving an instance. +# (integer value) +# Minimum value: 1 +# Deprecated group/name - [DEFAULT]/scheduler_max_attempts +#max_attempts = 3 + +# +# Periodic task interval. +# +# This value controls how often (in seconds) the scheduler should attempt +# to discover new hosts that have been added to cells. If negative (the +# default), no automatic discovery will occur. +# +# Deployments where compute nodes come and go frequently may want this +# enabled, where others may prefer to manually discover hosts when one +# is added to avoid any overhead from constantly checking. If enabled, +# every time this runs, we will select any unmapped hosts out of each +# cell database on every run. +# (integer value) +# Minimum value: -1 +#discover_hosts_in_cells_interval = -1 + +# +# This setting determines the maximum limit on results received from the +# placement service during a scheduling operation. It effectively limits +# the number of hosts that may be considered for scheduling requests that +# match a large number of candidates. +# +# A value of 1 (the minimum) will effectively defer scheduling to the placement +# service strictly on "will it fit" grounds. A higher value will put an upper +# cap on the number of results the scheduler will consider during the filtering +# and weighing process. Large deployments may need to set this lower than the +# total number of hosts available to limit memory consumption, network traffic, +# etc. of the scheduler. +# +# This option is only used by the FilterScheduler; if you use a different +# scheduler, this option has no effect. +# (integer value) +# Minimum value: 1 +#max_placement_results = 1000 + + +[serial_console] +# +# The serial console feature allows you to connect to a guest in case a +# graphical console like VNC, RDP or SPICE is not available. This is only +# currently supported for the libvirt, Ironic and hyper-v drivers. + +# +# From nova.conf +# + +# +# Enable the serial console feature. +# +# In order to use this feature, the service ``nova-serialproxy`` needs to run. +# This service is typically executed on the controller node. +# (boolean value) +#enabled = false + +# +# A range of TCP ports a guest can use for its backend. +# +# Each instance which gets created will use one port out of this range. If the +# range is not big enough to provide another port for an new instance, this +# instance won't get launched. +# +# Possible values: +# +# * Each string which passes the regex ``\d+:\d+`` For example ``10000:20000``. +# Be sure that the first port number is lower than the second port number +# and that both are in range from 0 to 65535. +# (string value) +#port_range = 10000:20000 + +# +# The URL an end user would use to connect to the ``nova-serialproxy`` service. +# +# The ``nova-serialproxy`` service is called with this token enriched URL +# and establishes the connection to the proper instance. +# +# Related options: +# +# * The IP address must be identical to the address to which the +# ``nova-serialproxy`` service is listening (see option ``serialproxy_host`` +# in this section). +# * The port must be the same as in the option ``serialproxy_port`` of this +# section. +# * If you choose to use a secured websocket connection, then start this option +# with ``wss://`` instead of the unsecured ``ws://``. The options ``cert`` +# and ``key`` in the ``[DEFAULT]`` section have to be set for that. +# (uri value) +#base_url = ws://127.0.0.1:6083/ + +# +# The IP address to which proxy clients (like ``nova-serialproxy``) should +# connect to get the serial console of an instance. +# +# This is typically the IP address of the host of a ``nova-compute`` service. +# (string value) +#proxyclient_address = 127.0.0.1 + +# +# The IP address which is used by the ``nova-serialproxy`` service to listen +# for incoming requests. +# +# The ``nova-serialproxy`` service listens on this IP address for incoming +# connection requests to instances which expose serial console. +# +# Related options: +# +# * Ensure that this is the same IP address which is defined in the option +# ``base_url`` of this section or use ``0.0.0.0`` to listen on all addresses. +# (string value) +#serialproxy_host = 0.0.0.0 + +# +# The port number which is used by the ``nova-serialproxy`` service to listen +# for incoming requests. +# +# The ``nova-serialproxy`` service listens on this port number for incoming +# connection requests to instances which expose serial console. +# +# Related options: +# +# * Ensure that this is the same port number which is defined in the option +# ``base_url`` of this section. +# (port value) +# Minimum value: 0 +# Maximum value: 65535 +#serialproxy_port = 6083 + + +[service_user] +# +# Configuration options for service to service authentication using a service +# token. These options allow sending a service token along with the user's token +# when contacting external REST APIs. + +# +# From nova.conf +# + +# +# When True, if sending a user token to a REST API, also send a service token. +# +# Nova often reuses the user token provided to the nova-api to talk to other +# REST +# APIs, such as Cinder, Glance and Neutron. It is possible that while the user +# token was valid when the request was made to Nova, the token may expire before +# it reaches the other service. To avoid any failures, and to make it clear it +# is +# Nova calling the service on the user's behalf, we include a service token +# along +# with the user token. Should the user's token have expired, a valid service +# token ensures the REST API request will still be accepted by the keystone +# middleware. +# (boolean value) +#send_service_user_token = false + +# PEM encoded Certificate Authority to use when verifying HTTPs connections. +# (string value) +#cafile = + +# PEM encoded client certificate cert file (string value) +#certfile = + +# PEM encoded client certificate key file (string value) +#keyfile = + +# Verify HTTPS connections. (boolean value) +#insecure = false + +# Timeout value for http requests (integer value) +#timeout = + +# Authentication type to load (string value) +# Deprecated group/name - [service_user]/auth_plugin +#auth_type = + +# Config Section from which to load plugin specific options (string value) +#auth_section = + +# Authentication URL (string value) +#auth_url = + +# Scope for system operations (string value) +#system_scope = + +# Domain ID to scope to (string value) +#domain_id = + +# Domain name to scope to (string value) +#domain_name = + +# Project ID to scope to (string value) +#project_id = + +# Project name to scope to (string value) +#project_name = + +# Domain ID containing project (string value) +#project_domain_id = + +# Domain name containing project (string value) +#project_domain_name = + +# Trust ID (string value) +#trust_id = + +# Optional domain ID to use with v3 and v2 parameters. It will be used for both +# the user and project domain in v3 and ignored in v2 authentication. (string +# value) +#default_domain_id = + +# Optional domain name to use with v3 API and v2 parameters. It will be used for +# both the user and project domain in v3 and ignored in v2 authentication. +# (string value) +#default_domain_name = + +# User ID (string value) +#user_id = + +# Username (string value) +# Deprecated group/name - [service_user]/user_name +#username = + +# User's domain id (string value) +#user_domain_id = + +# User's domain name (string value) +#user_domain_name = + +# User's password (string value) +#password = + +# Tenant ID (string value) +#tenant_id = + +# Tenant Name (string value) +#tenant_name = + + +[spice] +# +# SPICE console feature allows you to connect to a guest virtual machine. +# SPICE is a replacement for fairly limited VNC protocol. +# +# Following requirements must be met in order to use SPICE: +# +# * Virtualization driver must be libvirt +# * spice.enabled set to True +# * vnc.enabled set to False +# * update html5proxy_base_url +# * update server_proxyclient_address + +# +# From nova.conf +# + +# +# Enable SPICE related features. +# +# Related options: +# +# * VNC must be explicitly disabled to get access to the SPICE console. Set the +# enabled option to False in the [vnc] section to disable the VNC console. +# (boolean value) +#enabled = false + +# +# Enable the SPICE guest agent support on the instances. +# +# The Spice agent works with the Spice protocol to offer a better guest console +# experience. However, the Spice console can still be used without the Spice +# Agent. With the Spice agent installed the following features are enabled: +# +# * Copy & Paste of text and images between the guest and client machine +# * Automatic adjustment of resolution when the client screen changes - e.g. +# if you make the Spice console full screen the guest resolution will adjust +# to +# match it rather than letterboxing. +# * Better mouse integration - The mouse can be captured and released without +# needing to click inside the console or press keys to release it. The +# performance of mouse movement is also improved. +# (boolean value) +#agent_enabled = true + +# +# Location of the SPICE HTML5 console proxy. +# +# End user would use this URL to connect to the `nova-spicehtml5proxy`` +# service. This service will forward request to the console of an instance. +# +# In order to use SPICE console, the service ``nova-spicehtml5proxy`` should be +# running. This service is typically launched on the controller node. +# +# Possible values: +# +# * Must be a valid URL of the form: ``http://host:port/spice_auto.html`` +# where host is the node running ``nova-spicehtml5proxy`` and the port is +# typically 6082. Consider not using default value as it is not well defined +# for any real deployment. +# +# Related options: +# +# * This option depends on ``html5proxy_host`` and ``html5proxy_port`` options. +# The access URL returned by the compute node must have the host +# and port where the ``nova-spicehtml5proxy`` service is listening. +# (uri value) +#html5proxy_base_url = http://127.0.0.1:6082/spice_auto.html + +# +# The address where the SPICE server running on the instances should listen. +# +# Typically, the ``nova-spicehtml5proxy`` proxy client runs on the controller +# node and connects over the private network to this address on the compute +# node(s). +# +# Possible values: +# +# * IP address to listen on. +# (string value) +#server_listen = 127.0.0.1 + +# +# The address used by ``nova-spicehtml5proxy`` client to connect to instance +# console. +# +# Typically, the ``nova-spicehtml5proxy`` proxy client runs on the +# controller node and connects over the private network to this address on the +# compute node(s). +# +# Possible values: +# +# * Any valid IP address on the compute node. +# +# Related options: +# +# * This option depends on the ``server_listen`` option. +# The proxy client must be able to access the address specified in +# ``server_listen`` using the value of this option. +# (string value) +#server_proxyclient_address = 127.0.0.1 + +# +# A keyboard layout which is supported by the underlying hypervisor on this +# node. +# +# Possible values: +# * This is usually an 'IETF language tag' (default is 'en-us'). If you +# use QEMU as hypervisor, you should find the list of supported keyboard +# layouts at /usr/share/qemu/keymaps. +# (string value) +#keymap = en-us + +# +# IP address or a hostname on which the ``nova-spicehtml5proxy`` service +# listens for incoming requests. +# +# Related options: +# +# * This option depends on the ``html5proxy_base_url`` option. +# The ``nova-spicehtml5proxy`` service must be listening on a host that is +# accessible from the HTML5 client. +# (unknown value) +#html5proxy_host = 0.0.0.0 + +# +# Port on which the ``nova-spicehtml5proxy`` service listens for incoming +# requests. +# +# Related options: +# +# * This option depends on the ``html5proxy_base_url`` option. +# The ``nova-spicehtml5proxy`` service must be listening on a port that is +# accessible from the HTML5 client. +# (port value) +# Minimum value: 0 +# Maximum value: 65535 +#html5proxy_port = 6082 + + +[upgrade_levels] +# +# upgrade_levels options are used to set version cap for RPC +# messages sent between different nova services. +# +# By default all services send messages using the latest version +# they know about. +# +# The compute upgrade level is an important part of rolling upgrades +# where old and new nova-compute services run side by side. +# +# The other options can largely be ignored, and are only kept to +# help with a possible future backport issue. + +# +# From nova.conf +# + +# +# Compute RPC API version cap. +# +# By default, we always send messages using the most recent version +# the client knows about. +# +# Where you have old and new compute services running, you should set +# this to the lowest deployed version. This is to guarantee that all +# services never send messages that one of the compute nodes can't +# understand. Note that we only support upgrading from release N to +# release N+1. +# +# Set this option to "auto" if you want to let the compute RPC module +# automatically determine what version to use based on the service +# versions in the deployment. +# +# Possible values: +# +# * By default send the latest version the client knows about +# * 'auto': Automatically determines what version to use based on +# the service versions in the deployment. +# * A string representing a version number in the format 'N.N'; +# for example, possible values might be '1.12' or '2.0'. +# * An OpenStack release name, in lower case, such as 'mitaka' or +# 'liberty'. +# (string value) +#compute = + +# Cells RPC API version cap (string value) +#cells = + +# Intercell RPC API version cap (string value) +#intercell = + +# Cert RPC API version cap (string value) +#cert = + +# Scheduler RPC API version cap (string value) +#scheduler = + +# Conductor RPC API version cap (string value) +#conductor = + +# Console RPC API version cap (string value) +#console = + +# Consoleauth RPC API version cap (string value) +#consoleauth = + +# Network RPC API version cap (string value) +#network = + +# Base API RPC API version cap (string value) +#baseapi = + + +[vault] + +# +# From nova.conf +# + +# root token for vault (string value) +#root_token_id = + +# Use this endpoint to connect to Vault, for example: "http://127.0.0.1:8200" +# (string value) +#vault_url = http://127.0.0.1:8200 + +# Absolute path to ca cert file (string value) +#ssl_ca_crt_file = + +# SSL Enabled/Disabled (boolean value) +#use_ssl = false + + +[vendordata_dynamic_auth] +# +# Options within this group control the authentication of the vendordata +# subsystem of the metadata API server (and config drive) with external systems. + +# +# From nova.conf +# + +# PEM encoded Certificate Authority to use when verifying HTTPs connections. +# (string value) +#cafile = + +# PEM encoded client certificate cert file (string value) +#certfile = + +# PEM encoded client certificate key file (string value) +#keyfile = + +# Verify HTTPS connections. (boolean value) +#insecure = false + +# Timeout value for http requests (integer value) +#timeout = + +# Authentication type to load (string value) +# Deprecated group/name - [vendordata_dynamic_auth]/auth_plugin +#auth_type = + +# Config Section from which to load plugin specific options (string value) +#auth_section = + +# Authentication URL (string value) +#auth_url = + +# Scope for system operations (string value) +#system_scope = + +# Domain ID to scope to (string value) +#domain_id = + +# Domain name to scope to (string value) +#domain_name = + +# Project ID to scope to (string value) +#project_id = + +# Project name to scope to (string value) +#project_name = + +# Domain ID containing project (string value) +#project_domain_id = + +# Domain name containing project (string value) +#project_domain_name = + +# Trust ID (string value) +#trust_id = + +# Optional domain ID to use with v3 and v2 parameters. It will be used for both +# the user and project domain in v3 and ignored in v2 authentication. (string +# value) +#default_domain_id = + +# Optional domain name to use with v3 API and v2 parameters. It will be used for +# both the user and project domain in v3 and ignored in v2 authentication. +# (string value) +#default_domain_name = + +# User ID (string value) +#user_id = + +# Username (string value) +# Deprecated group/name - [vendordata_dynamic_auth]/user_name +#username = + +# User's domain id (string value) +#user_domain_id = + +# User's domain name (string value) +#user_domain_name = + +# User's password (string value) +#password = + +# Tenant ID (string value) +#tenant_id = + +# Tenant Name (string value) +#tenant_name = + + +[vmware] +# +# Related options: +# Following options must be set in order to launch VMware-based +# virtual machines. +# +# * compute_driver: Must use vmwareapi.VMwareVCDriver. +# * vmware.host_username +# * vmware.host_password +# * vmware.cluster_name + +# +# From nova.conf +# + +# +# This option specifies the physical ethernet adapter name for VLAN +# networking. +# +# Set the vlan_interface configuration option to match the ESX host +# interface that handles VLAN-tagged VM traffic. +# +# Possible values: +# +# * Any valid string representing VLAN interface name +# (string value) +#vlan_interface = vmnic0 + +# +# This option should be configured only when using the NSX-MH Neutron +# plugin. This is the name of the integration bridge on the ESXi server +# or host. This should not be set for any other Neutron plugin. Hence +# the default value is not set. +# +# Possible values: +# +# * Any valid string representing the name of the integration bridge +# (string value) +#integration_bridge = + +# +# Set this value if affected by an increased network latency causing +# repeated characters when typing in a remote console. +# (integer value) +# Minimum value: 0 +#console_delay_seconds = + +# +# Identifies the remote system where the serial port traffic will +# be sent. +# +# This option adds a virtual serial port which sends console output to +# a configurable service URI. At the service URI address there will be +# virtual serial port concentrator that will collect console logs. +# If this is not set, no serial ports will be added to the created VMs. +# +# Possible values: +# +# * Any valid URI +# (string value) +#serial_port_service_uri = + +# +# Identifies a proxy service that provides network access to the +# serial_port_service_uri. +# +# Possible values: +# +# * Any valid URI (The scheme is 'telnet' or 'telnets'.) +# +# Related options: +# This option is ignored if serial_port_service_uri is not specified. +# * serial_port_service_uri +# (uri value) +#serial_port_proxy_uri = + +# +# Specifies the directory where the Virtual Serial Port Concentrator is +# storing console log files. It should match the 'serial_log_dir' config +# value of VSPC. +# (string value) +#serial_log_dir = /opt/vmware/vspc + +# +# Hostname or IP address for connection to VMware vCenter host. (unknown value) +#host_ip = + +# Port for connection to VMware vCenter host. (port value) +# Minimum value: 0 +# Maximum value: 65535 +#host_port = 443 + +# Username for connection to VMware vCenter host. (string value) +#host_username = + +# Password for connection to VMware vCenter host. (string value) +#host_password = + +# +# Specifies the CA bundle file to be used in verifying the vCenter +# server certificate. +# (string value) +#ca_file = + +# +# If true, the vCenter server certificate is not verified. If false, +# then the default CA truststore is used for verification. +# +# Related options: +# * ca_file: This option is ignored if "ca_file" is set. +# (boolean value) +#insecure = false + +# Name of a VMware Cluster ComputeResource. (string value) +#cluster_name = + +# +# Regular expression pattern to match the name of datastore. +# +# The datastore_regex setting specifies the datastores to use with +# Compute. For example, datastore_regex="nas.*" selects all the data +# stores that have a name starting with "nas". +# +# NOTE: If no regex is given, it just picks the datastore with the +# most freespace. +# +# Possible values: +# +# * Any matching regular expression to a datastore must be given +# (string value) +#datastore_regex = + +# +# Time interval in seconds to poll remote tasks invoked on +# VMware VC server. +# (floating point value) +#task_poll_interval = 0.5 + +# +# Number of times VMware vCenter server API must be retried on connection +# failures, e.g. socket error, etc. +# (integer value) +# Minimum value: 0 +#api_retry_count = 10 + +# +# This option specifies VNC starting port. +# +# Every VM created by ESX host has an option of enabling VNC client +# for remote connection. Above option 'vnc_port' helps you to set +# default starting port for the VNC client. +# +# Possible values: +# +# * Any valid port number within 5900 -(5900 + vnc_port_total) +# +# Related options: +# Below options should be set to enable VNC client. +# * vnc.enabled = True +# * vnc_port_total +# (port value) +# Minimum value: 0 +# Maximum value: 65535 +#vnc_port = 5900 + +# +# Total number of VNC ports. +# (integer value) +# Minimum value: 0 +#vnc_port_total = 10000 + +# +# This option enables/disables the use of linked clone. +# +# The ESX hypervisor requires a copy of the VMDK file in order to boot +# up a virtual machine. The compute driver must download the VMDK via +# HTTP from the OpenStack Image service to a datastore that is visible +# to the hypervisor and cache it. Subsequent virtual machines that need +# the VMDK use the cached version and don't have to copy the file again +# from the OpenStack Image service. +# +# If set to false, even with a cached VMDK, there is still a copy +# operation from the cache location to the hypervisor file directory +# in the shared datastore. If set to true, the above copy operation +# is avoided as it creates copy of the virtual machine that shares +# virtual disks with its parent VM. +# (boolean value) +#use_linked_clone = true + +# +# This option sets the http connection pool size +# +# The connection pool size is the maximum number of connections from nova to +# vSphere. It should only be increased if there are warnings indicating that +# the connection pool is full, otherwise, the default should suffice. +# (integer value) +# Minimum value: 10 +#connection_pool_size = 10 + +# +# This option enables or disables storage policy based placement +# of instances. +# +# Related options: +# +# * pbm_default_policy +# (boolean value) +#pbm_enabled = false + +# +# This option specifies the PBM service WSDL file location URL. +# +# Setting this will disable storage policy based placement +# of instances. +# +# Possible values: +# +# * Any valid file path +# e.g file:///opt/SDK/spbm/wsdl/pbmService.wsdl +# (string value) +#pbm_wsdl_location = + +# +# This option specifies the default policy to be used. +# +# If pbm_enabled is set and there is no defined storage policy for the +# specific request, then this policy will be used. +# +# Possible values: +# +# * Any valid storage policy such as VSAN default storage policy +# +# Related options: +# +# * pbm_enabled +# (string value) +#pbm_default_policy = + +# +# This option specifies the limit on the maximum number of objects to +# return in a single result. +# +# A positive value will cause the operation to suspend the retrieval +# when the count of objects reaches the specified limit. The server may +# still limit the count to something less than the configured value. +# Any remaining objects may be retrieved with additional requests. +# (integer value) +# Minimum value: 0 +#maximum_objects = 100 + +# +# This option adds a prefix to the folder where cached images are stored +# +# This is not the full path - just a folder prefix. This should only be +# used when a datastore cache is shared between compute nodes. +# +# Note: This should only be used when the compute nodes are running on same +# host or they have a shared file system. +# +# Possible values: +# +# * Any string representing the cache prefix to the folder +# (string value) +#cache_prefix = + + +[vnc] +novncproxy_base_url = http://10.0.0.11:6080/vnc_auto.html +vncserver_proxyclient_address = $my_ip +vncserver_listen = 0.0.0.0 +vnc_enabled = True +# +# Virtual Network Computer (VNC) can be used to provide remote desktop +# console access to instances for tenants and/or administrators. + +# +# From nova.conf +# + +# +# Enable VNC related features. +# +# Guests will get created with graphical devices to support this. Clients +# (for example Horizon) can then establish a VNC connection to the guest. +# (boolean value) +# Deprecated group/name - [DEFAULT]/vnc_enabled +#enabled = true + +# +# Keymap for VNC. +# +# The keyboard mapping (keymap) determines which keyboard layout a VNC +# session should use by default. +# +# Possible values: +# +# * A keyboard layout which is supported by the underlying hypervisor on +# this node. This is usually an 'IETF language tag' (for example +# 'en-us'). If you use QEMU as hypervisor, you should find the list +# of supported keyboard layouts at ``/usr/share/qemu/keymaps``. +# (string value) +# Deprecated group/name - [DEFAULT]/vnc_keymap +#keymap = en-us + +# +# The IP address or hostname on which an instance should listen to for +# incoming VNC connection requests on this node. +# (unknown value) +# Deprecated group/name - [DEFAULT]/vncserver_listen +# Deprecated group/name - [vnc]/vncserver_listen +#server_listen = 127.0.0.1 + +# +# Private, internal IP address or hostname of VNC console proxy. +# +# The VNC proxy is an OpenStack component that enables compute service +# users to access their instances through VNC clients. +# +# This option sets the private address to which proxy clients, such as +# ``nova-xvpvncproxy``, should connect to. +# (unknown value) +# Deprecated group/name - [DEFAULT]/vncserver_proxyclient_address +# Deprecated group/name - [vnc]/vncserver_proxyclient_address +#server_proxyclient_address = 127.0.0.1 + +# +# Public address of noVNC VNC console proxy. +# +# The VNC proxy is an OpenStack component that enables compute service +# users to access their instances through VNC clients. noVNC provides +# VNC support through a websocket-based client. +# +# This option sets the public base URL to which client systems will +# connect. noVNC clients can use this address to connect to the noVNC +# instance and, by extension, the VNC sessions. +# +# Related options: +# +# * novncproxy_host +# * novncproxy_port +# (uri value) +#novncproxy_base_url = http://127.0.0.1:6080/vnc_auto.html + +# +# IP address or hostname that the XVP VNC console proxy should bind to. +# +# The VNC proxy is an OpenStack component that enables compute service +# users to access their instances through VNC clients. Xen provides +# the Xenserver VNC Proxy, or XVP, as an alternative to the +# websocket-based noVNC proxy used by Libvirt. In contrast to noVNC, +# XVP clients are Java-based. +# +# This option sets the private address to which the XVP VNC console proxy +# service should bind to. +# +# Related options: +# +# * xvpvncproxy_port +# * xvpvncproxy_base_url +# (unknown value) +#xvpvncproxy_host = 0.0.0.0 + +# +# Port that the XVP VNC console proxy should bind to. +# +# The VNC proxy is an OpenStack component that enables compute service +# users to access their instances through VNC clients. Xen provides +# the Xenserver VNC Proxy, or XVP, as an alternative to the +# websocket-based noVNC proxy used by Libvirt. In contrast to noVNC, +# XVP clients are Java-based. +# +# This option sets the private port to which the XVP VNC console proxy +# service should bind to. +# +# Related options: +# +# * xvpvncproxy_host +# * xvpvncproxy_base_url +# (port value) +# Minimum value: 0 +# Maximum value: 65535 +#xvpvncproxy_port = 6081 + +# +# Public URL address of XVP VNC console proxy. +# +# The VNC proxy is an OpenStack component that enables compute service +# users to access their instances through VNC clients. Xen provides +# the Xenserver VNC Proxy, or XVP, as an alternative to the +# websocket-based noVNC proxy used by Libvirt. In contrast to noVNC, +# XVP clients are Java-based. +# +# This option sets the public base URL to which client systems will +# connect. XVP clients can use this address to connect to the XVP +# instance and, by extension, the VNC sessions. +# +# Related options: +# +# * xvpvncproxy_host +# * xvpvncproxy_port +# (uri value) +#xvpvncproxy_base_url = http://127.0.0.1:6081/console + +# +# IP address that the noVNC console proxy should bind to. +# +# The VNC proxy is an OpenStack component that enables compute service +# users to access their instances through VNC clients. noVNC provides +# VNC support through a websocket-based client. +# +# This option sets the private address to which the noVNC console proxy +# service should bind to. +# +# Related options: +# +# * novncproxy_port +# * novncproxy_base_url +# (string value) +#novncproxy_host = 0.0.0.0 + +# +# Port that the noVNC console proxy should bind to. +# +# The VNC proxy is an OpenStack component that enables compute service +# users to access their instances through VNC clients. noVNC provides +# VNC support through a websocket-based client. +# +# This option sets the private port to which the noVNC console proxy +# service should bind to. +# +# Related options: +# +# * novncproxy_host +# * novncproxy_base_url +# (port value) +# Minimum value: 0 +# Maximum value: 65535 +#novncproxy_port = 6080 + +# +# The authentication schemes to use with the compute node. +# +# Control what RFB authentication schemes are permitted for connections between +# the proxy and the compute host. If multiple schemes are enabled, the first +# matching scheme will be used, thus the strongest schemes should be listed +# first. +# +# Possible values: +# +# * ``none``: allow connection without authentication +# * ``vencrypt``: use VeNCrypt authentication scheme +# +# Related options: +# +# * ``[vnc]vencrypt_client_key``, ``[vnc]vencrypt_client_cert``: must also be +# set +# (list value) +#auth_schemes = none + +# The path to the client certificate PEM file (for x509) +# +# The fully qualified path to a PEM file containing the private key which the +# VNC +# proxy server presents to the compute node during VNC authentication. +# +# Related options: +# +# * ``vnc.auth_schemes``: must include ``vencrypt`` +# * ``vnc.vencrypt_client_cert``: must also be set +# (string value) +#vencrypt_client_key = + +# The path to the client key file (for x509) +# +# The fully qualified path to a PEM file containing the x509 certificate which +# the VNC proxy server presents to the compute node during VNC authentication. +# +# Realted options: +# +# * ``vnc.auth_schemes``: must include ``vencrypt`` +# * ``vnc.vencrypt_client_key``: must also be set +# (string value) +#vencrypt_client_cert = + +# The path to the CA certificate PEM file +# +# The fully qualified path to a PEM file containing one or more x509 +# certificates +# for the certificate authorities used by the compute node VNC server. +# +# Related options: +# +# * ``vnc.auth_schemes``: must include ``vencrypt`` +# (string value) +#vencrypt_ca_certs = + + +[workarounds] +# +# A collection of workarounds used to mitigate bugs or issues found in system +# tools (e.g. Libvirt or QEMU) or Nova itself under certain conditions. These +# should only be enabled in exceptional circumstances. All options are linked +# against bug IDs, where more information on the issue can be found. + +# +# From nova.conf +# + +# +# Use sudo instead of rootwrap. +# +# Allow fallback to sudo for performance reasons. +# +# For more information, refer to the bug report: +# +# https://bugs.launchpad.net/nova/+bug/1415106 +# +# Possible values: +# +# * True: Use sudo instead of rootwrap +# * False: Use rootwrap as usual +# +# Interdependencies to other options: +# +# * Any options that affect 'rootwrap' will be ignored. +# (boolean value) +#disable_rootwrap = false + +# +# Disable live snapshots when using the libvirt driver. +# +# Live snapshots allow the snapshot of the disk to happen without an +# interruption to the guest, using coordination with a guest agent to +# quiesce the filesystem. +# +# When using libvirt 1.2.2 live snapshots fail intermittently under load +# (likely related to concurrent libvirt/qemu operations). This config +# option provides a mechanism to disable live snapshot, in favor of cold +# snapshot, while this is resolved. Cold snapshot causes an instance +# outage while the guest is going through the snapshotting process. +# +# For more information, refer to the bug report: +# +# https://bugs.launchpad.net/nova/+bug/1334398 +# +# Possible values: +# +# * True: Live snapshot is disabled when using libvirt +# * False: Live snapshots are always used when snapshotting (as long as +# there is a new enough libvirt and the backend storage supports it) +# (boolean value) +#disable_libvirt_livesnapshot = false + +# +# Enable handling of events emitted from compute drivers. +# +# Many compute drivers emit lifecycle events, which are events that occur when, +# for example, an instance is starting or stopping. If the instance is going +# through task state changes due to an API operation, like resize, the events +# are ignored. +# +# This is an advanced feature which allows the hypervisor to signal to the +# compute service that an unexpected state change has occurred in an instance +# and that the instance can be shutdown automatically. Unfortunately, this can +# race in some conditions, for example in reboot operations or when the compute +# service or when host is rebooted (planned or due to an outage). If such races +# are common, then it is advisable to disable this feature. +# +# Care should be taken when this feature is disabled and +# 'sync_power_state_interval' is set to a negative value. In this case, any +# instances that get out of sync between the hypervisor and the Nova database +# will have to be synchronized manually. +# +# For more information, refer to the bug report: +# +# https://bugs.launchpad.net/bugs/1444630 +# +# Interdependencies to other options: +# +# * If ``sync_power_state_interval`` is negative and this feature is disabled, +# then instances that get out of sync between the hypervisor and the Nova +# database will have to be synchronized manually. +# (boolean value) +#handle_virt_lifecycle_events = true + +# +# Disable the server group policy check upcall in compute. +# +# In order to detect races with server group affinity policy, the compute +# service attempts to validate that the policy was not violated by the +# scheduler. It does this by making an upcall to the API database to list +# the instances in the server group for one that it is booting, which violates +# our api/cell isolation goals. Eventually this will be solved by proper +# affinity +# guarantees in the scheduler and placement service, but until then, this late +# check is needed to ensure proper affinity policy. +# +# Operators that desire api/cell isolation over this check should +# enable this flag, which will avoid making that upcall from compute. +# +# Related options: +# +# * [filter_scheduler]/track_instance_changes also relies on upcalls from the +# compute service to the scheduler service. +# (boolean value) +#disable_group_policy_check_upcall = false + + +[wsgi] +# +# Options under this group are used to configure WSGI (Web Server Gateway +# Interface). WSGI is used to serve API requests. + +# +# From nova.conf +# + +# +# This option represents a file name for the paste.deploy config for nova-api. +# +# Possible values: +# +# * A string representing file name for the paste.deploy config. +# (string value) +#api_paste_config = api-paste.ini + +# DEPRECATED: +# It represents a python format string that is used as the template to generate +# log lines. The following values can be formatted into it: client_ip, +# date_time, request_line, status_code, body_length, wall_seconds. +# +# This option is used for building custom request loglines when running +# nova-api under eventlet. If used under uwsgi or apache, this option +# has no effect. +# +# Possible values: +# +# * '%(client_ip)s "%(request_line)s" status: %(status_code)s' +# 'len: %(body_length)s time: %(wall_seconds).7f' (default) +# * Any formatted string formed by specific values. +# (string value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# This option only works when running nova-api under eventlet, and +# encodes very eventlet specific pieces of information. Starting in Pike +# the preferred model for running nova-api is under uwsgi or apache +# mod_wsgi. +#wsgi_log_format = %(client_ip)s "%(request_line)s" status: %(status_code)s len: %(body_length)s time: %(wall_seconds).7f + +# +# This option specifies the HTTP header used to determine the protocol scheme +# for the original request, even if it was removed by a SSL terminating proxy. +# +# Possible values: +# +# * None (default) - the request scheme is not influenced by any HTTP headers +# * Valid HTTP header, like HTTP_X_FORWARDED_PROTO +# +# WARNING: Do not set this unless you know what you are doing. +# +# Make sure ALL of the following are true before setting this (assuming the +# values from the example above): +# * Your API is behind a proxy. +# * Your proxy strips the X-Forwarded-Proto header from all incoming requests. +# In other words, if end users include that header in their requests, the +# proxy +# will discard it. +# * Your proxy sets the X-Forwarded-Proto header and sends it to API, but only +# for requests that originally come in via HTTPS. +# +# If any of those are not true, you should keep this setting set to None. +# +# (string value) +#secure_proxy_ssl_header = + +# +# This option allows setting path to the CA certificate file that should be used +# to verify connecting clients. +# +# Possible values: +# +# * String representing path to the CA certificate file. +# +# Related options: +# +# * enabled_ssl_apis +# (string value) +#ssl_ca_file = + +# +# This option allows setting path to the SSL certificate of API server. +# +# Possible values: +# +# * String representing path to the SSL certificate. +# +# Related options: +# +# * enabled_ssl_apis +# (string value) +#ssl_cert_file = + +# +# This option specifies the path to the file where SSL private key of API +# server is stored when SSL is in effect. +# +# Possible values: +# +# * String representing path to the SSL private key. +# +# Related options: +# +# * enabled_ssl_apis +# (string value) +#ssl_key_file = + +# +# This option sets the value of TCP_KEEPIDLE in seconds for each server socket. +# It specifies the duration of time to keep connection active. TCP generates a +# KEEPALIVE transmission for an application that requests to keep connection +# active. Not supported on OS X. +# +# Related options: +# +# * keep_alive +# (integer value) +# Minimum value: 0 +#tcp_keepidle = 600 + +# +# This option specifies the size of the pool of greenthreads used by wsgi. +# It is possible to limit the number of concurrent connections using this +# option. +# (integer value) +# Minimum value: 0 +# Deprecated group/name - [DEFAULT]/wsgi_default_pool_size +#default_pool_size = 1000 + +# +# This option specifies the maximum line size of message headers to be accepted. +# max_header_line may need to be increased when using large tokens (typically +# those generated by the Keystone v3 API with big service catalogs). +# +# Since TCP is a stream based protocol, in order to reuse a connection, the HTTP +# has to have a way to indicate the end of the previous response and beginning +# of the next. Hence, in a keep_alive case, all messages must have a +# self-defined message length. +# (integer value) +# Minimum value: 0 +#max_header_line = 16384 + +# +# This option allows using the same TCP connection to send and receive multiple +# HTTP requests/responses, as opposed to opening a new one for every single +# request/response pair. HTTP keep-alive indicates HTTP connection reuse. +# +# Possible values: +# +# * True : reuse HTTP connection. +# * False : closes the client socket connection explicitly. +# +# Related options: +# +# * tcp_keepidle +# (boolean value) +# Deprecated group/name - [DEFAULT]/wsgi_keep_alive +#keep_alive = true + +# +# This option specifies the timeout for client connections' socket operations. +# If an incoming connection is idle for this number of seconds it will be +# closed. It indicates timeout on individual read/writes on the socket +# connection. To wait forever set to 0. +# (integer value) +# Minimum value: 0 +#client_socket_timeout = 900 + + +[xenserver] +# +# XenServer options are used when the compute_driver is set to use +# XenServer (compute_driver=xenapi.XenAPIDriver). +# +# Must specify connection_url, connection_password and ovs_integration_bridge to +# use compute_driver=xenapi.XenAPIDriver. + +# +# From nova.conf +# + +# +# Number of seconds to wait for agent's reply to a request. +# +# Nova configures/performs certain administrative actions on a server with the +# help of an agent that's installed on the server. The communication between +# Nova and the agent is achieved via sharing messages, called records, over +# xenstore, a shared storage across all the domains on a Xenserver host. +# Operations performed by the agent on behalf of nova are: 'version',' +# key_init', +# 'password','resetnetwork','inject_file', and 'agentupdate'. +# +# To perform one of the above operations, the xapi 'agent' plugin writes the +# command and its associated parameters to a certain location known to the +# domain +# and awaits response. On being notified of the message, the agent performs +# appropriate actions on the server and writes the result back to xenstore. This +# result is then read by the xapi 'agent' plugin to determine the +# success/failure +# of the operation. +# +# This config option determines how long the xapi 'agent' plugin shall wait to +# read the response off of xenstore for a given request/command. If the agent on +# the instance fails to write the result in this time period, the operation is +# considered to have timed out. +# +# Related options: +# +# * ``agent_version_timeout`` +# * ``agent_resetnetwork_timeout`` +# +# (integer value) +# Minimum value: 0 +#agent_timeout = 30 + +# +# Number of seconds to wait for agent't reply to version request. +# +# This indicates the amount of time xapi 'agent' plugin waits for the agent to +# respond to the 'version' request specifically. The generic timeout for agent +# communication ``agent_timeout`` is ignored in this case. +# +# During the build process the 'version' request is used to determine if the +# agent is available/operational to perform other requests such as +# 'resetnetwork', 'password', 'key_init' and 'inject_file'. If the 'version' +# call +# fails, the other configuration is skipped. So, this configuration option can +# also be interpreted as time in which agent is expected to be fully +# operational. +# (integer value) +# Minimum value: 0 +#agent_version_timeout = 300 + +# +# Number of seconds to wait for agent's reply to resetnetwork +# request. +# +# This indicates the amount of time xapi 'agent' plugin waits for the agent to +# respond to the 'resetnetwork' request specifically. The generic timeout for +# agent communication ``agent_timeout`` is ignored in this case. +# (integer value) +# Minimum value: 0 +#agent_resetnetwork_timeout = 60 + +# +# Path to locate guest agent on the server. +# +# Specifies the path in which the XenAPI guest agent should be located. If the +# agent is present, network configuration is not injected into the image. +# +# Related options: +# +# For this option to have an effect: +# * ``flat_injected`` should be set to ``True`` +# * ``compute_driver`` should be set to ``xenapi.XenAPIDriver`` +# +# (string value) +#agent_path = usr/sbin/xe-update-networking + +# +# Disables the use of XenAPI agent. +# +# This configuration option suggests whether the use of agent should be enabled +# or not regardless of what image properties are present. Image properties have +# an effect only when this is set to ``True``. Read description of config option +# ``use_agent_default`` for more information. +# +# Related options: +# +# * ``use_agent_default`` +# +# (boolean value) +#disable_agent = false + +# +# Whether or not to use the agent by default when its usage is enabled but not +# indicated by the image. +# +# The use of XenAPI agent can be disabled altogether using the configuration +# option ``disable_agent``. However, if it is not disabled, the use of an agent +# can still be controlled by the image in use through one of its properties, +# ``xenapi_use_agent``. If this property is either not present or specified +# incorrectly on the image, the use of agent is determined by this configuration +# option. +# +# Note that if this configuration is set to ``True`` when the agent is not +# present, the boot times will increase significantly. +# +# Related options: +# +# * ``disable_agent`` +# +# (boolean value) +#use_agent_default = false + +# Timeout in seconds for XenAPI login. (integer value) +# Minimum value: 0 +#login_timeout = 10 + +# +# Maximum number of concurrent XenAPI connections. +# +# In nova, multiple XenAPI requests can happen at a time. +# Configuring this option will parallelize access to the XenAPI +# session, which allows you to make concurrent XenAPI connections. +# (integer value) +# Minimum value: 1 +#connection_concurrent = 5 + +# +# Cache glance images locally. +# +# The value for this option must be chosen from the choices listed +# here. Configuring a value other than these will default to 'all'. +# +# Note: There is nothing that deletes these images. +# +# Possible values: +# +# * `all`: will cache all images. +# * `some`: will only cache images that have the +# image_property `cache_in_nova=True`. +# * `none`: turns off caching entirely. +# (string value) +# Possible values: +# all - +# some - +# none - +#cache_images = all + +# +# Compression level for images. +# +# By setting this option we can configure the gzip compression level. +# This option sets GZIP environment variable before spawning tar -cz +# to force the compression level. It defaults to none, which means the +# GZIP environment variable is not set and the default (usually -6) +# is used. +# +# Possible values: +# +# * Range is 1-9, e.g., 9 for gzip -9, 9 being most +# compressed but most CPU intensive on dom0. +# * Any values out of this range will default to None. +# (integer value) +# Minimum value: 1 +# Maximum value: 9 +#image_compression_level = + +# Default OS type used when uploading an image to glance (string value) +#default_os_type = linux + +# Time in secs to wait for a block device to be created (integer value) +# Minimum value: 1 +#block_device_creation_timeout = 10 + +# +# Maximum size in bytes of kernel or ramdisk images. +# +# Specifying the maximum size of kernel or ramdisk will avoid copying +# large files to dom0 and fill up /boot/guest. +# (integer value) +#max_kernel_ramdisk_size = 16777216 + +# +# Filter for finding the SR to be used to install guest instances on. +# +# Possible values: +# +# * To use the Local Storage in default XenServer/XCP installations +# set this flag to other-config:i18n-key=local-storage. +# * To select an SR with a different matching criteria, you could +# set it to other-config:my_favorite_sr=true. +# * To fall back on the Default SR, as displayed by XenCenter, +# set this flag to: default-sr:true. +# (string value) +#sr_matching_filter = default-sr:true + +# +# Whether to use sparse_copy for copying data on a resize down. +# (False will use standard dd). This speeds up resizes down +# considerably since large runs of zeros won't have to be rsynced. +# (boolean value) +#sparse_copy = true + +# +# Maximum number of retries to unplug VBD. +# If set to 0, should try once, no retries. +# (integer value) +# Minimum value: 0 +#num_vbd_unplug_retries = 10 + +# +# Name of network to use for booting iPXE ISOs. +# +# An iPXE ISO is a specially crafted ISO which supports iPXE booting. +# This feature gives a means to roll your own image. +# +# By default this option is not set. Enable this option to +# boot an iPXE ISO. +# +# Related Options: +# +# * `ipxe_boot_menu_url` +# * `ipxe_mkisofs_cmd` +# (string value) +#ipxe_network_name = + +# +# URL to the iPXE boot menu. +# +# An iPXE ISO is a specially crafted ISO which supports iPXE booting. +# This feature gives a means to roll your own image. +# +# By default this option is not set. Enable this option to +# boot an iPXE ISO. +# +# Related Options: +# +# * `ipxe_network_name` +# * `ipxe_mkisofs_cmd` +# (string value) +#ipxe_boot_menu_url = + +# +# Name and optionally path of the tool used for ISO image creation. +# +# An iPXE ISO is a specially crafted ISO which supports iPXE booting. +# This feature gives a means to roll your own image. +# +# Note: By default `mkisofs` is not present in the Dom0, so the +# package can either be manually added to Dom0 or include the +# `mkisofs` binary in the image itself. +# +# Related Options: +# +# * `ipxe_network_name` +# * `ipxe_boot_menu_url` +# (string value) +#ipxe_mkisofs_cmd = mkisofs + +# +# URL for connection to XenServer/Xen Cloud Platform. A special value +# of unix://local can be used to connect to the local unix socket. +# +# Possible values: +# +# * Any string that represents a URL. The connection_url is +# generally the management network IP address of the XenServer. +# * This option must be set if you chose the XenServer driver. +# (string value) +#connection_url = + +# Username for connection to XenServer/Xen Cloud Platform (string value) +#connection_username = root + +# Password for connection to XenServer/Xen Cloud Platform (string value) +#connection_password = + +# +# The interval used for polling of coalescing vhds. +# +# This is the interval after which the task of coalesce VHD is +# performed, until it reaches the max attempts that is set by +# vhd_coalesce_max_attempts. +# +# Related options: +# +# * `vhd_coalesce_max_attempts` +# (floating point value) +# Minimum value: 0 +#vhd_coalesce_poll_interval = 5.0 + +# +# Ensure compute service is running on host XenAPI connects to. +# This option must be set to false if the 'independent_compute' +# option is set to true. +# +# Possible values: +# +# * Setting this option to true will make sure that compute service +# is running on the same host that is specified by connection_url. +# * Setting this option to false, doesn't perform the check. +# +# Related options: +# +# * `independent_compute` +# (boolean value) +#check_host = true + +# +# Max number of times to poll for VHD to coalesce. +# +# This option determines the maximum number of attempts that can be +# made for coalescing the VHD before giving up. +# +# Related opitons: +# +# * `vhd_coalesce_poll_interval` +# (integer value) +# Minimum value: 0 +#vhd_coalesce_max_attempts = 20 + +# Base path to the storage repository on the XenServer host. (string value) +#sr_base_path = /var/run/sr-mount + +# +# The iSCSI Target Host. +# +# This option represents the hostname or ip of the iSCSI Target. +# If the target host is not present in the connection information from +# the volume provider then the value from this option is taken. +# +# Possible values: +# +# * Any string that represents hostname/ip of Target. +# (unknown value) +#target_host = + +# +# The iSCSI Target Port. +# +# This option represents the port of the iSCSI Target. If the +# target port is not present in the connection information from the +# volume provider then the value from this option is taken. +# (port value) +# Minimum value: 0 +# Maximum value: 65535 +#target_port = 3260 + +# +# Used to prevent attempts to attach VBDs locally, so Nova can +# be run in a VM on a different host. +# +# Related options: +# +# * ``CONF.flat_injected`` (Must be False) +# * ``CONF.xenserver.check_host`` (Must be False) +# * ``CONF.default_ephemeral_format`` (Must be unset or 'ext3') +# * Joining host aggregates (will error if attempted) +# * Swap disks for Windows VMs (will error if attempted) +# * Nova-based auto_configure_disk (will error if attempted) +# (boolean value) +#independent_compute = false + +# +# Wait time for instances to go to running state. +# +# Provide an integer value representing time in seconds to set the +# wait time for an instance to go to running state. +# +# When a request to create an instance is received by nova-api and +# communicated to nova-compute, the creation of the instance occurs +# through interaction with Xen via XenAPI in the compute node. Once +# the node on which the instance(s) are to be launched is decided by +# nova-schedule and the launch is triggered, a certain amount of wait +# time is involved until the instance(s) can become available and +# 'running'. This wait time is defined by running_timeout. If the +# instances do not go to running state within this specified wait +# time, the launch expires and the instance(s) are set to 'error' +# state. +# (integer value) +# Minimum value: 0 +#running_timeout = 60 + +# DEPRECATED: +# The XenAPI VIF driver using XenServer Network APIs. +# +# Provide a string value representing the VIF XenAPI vif driver to use for +# plugging virtual network interfaces. +# +# Xen configuration uses bridging within the backend domain to allow +# all VMs to appear on the network as individual hosts. Bridge +# interfaces are used to create a XenServer VLAN network in which +# the VIFs for the VM instances are plugged. If no VIF bridge driver +# is plugged, the bridge is not made available. This configuration +# option takes in a value for the VIF driver. +# +# Possible values: +# +# * nova.virt.xenapi.vif.XenAPIOpenVswitchDriver (default) +# * nova.virt.xenapi.vif.XenAPIBridgeDriver (deprecated) +# +# Related options: +# +# * ``vlan_interface`` +# * ``ovs_integration_bridge`` +# (string value) +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# There are only two in-tree vif drivers for XenServer. XenAPIBridgeDriver is +# for +# nova-network which is deprecated and XenAPIOpenVswitchDriver is for Neutron +# which is the default configuration for Nova since the 15.0.0 Ocata release. In +# the future the "use_neutron" configuration option will be used to determine +# which vif driver to use. +#vif_driver = nova.virt.xenapi.vif.XenAPIOpenVswitchDriver + +# +# Dom0 plugin driver used to handle image uploads. +# +# Provide a string value representing a plugin driver required to +# handle the image uploading to GlanceStore. +# +# Images, and snapshots from XenServer need to be uploaded to the data +# store for use. image_upload_handler takes in a value for the Dom0 +# plugin driver. This driver is then called to uplaod images to the +# GlanceStore. +# (string value) +#image_upload_handler = nova.virt.xenapi.image.glance.GlanceStore + +# +# Number of seconds to wait for SR to settle if the VDI +# does not exist when first introduced. +# +# Some SRs, particularly iSCSI connections are slow to see the VDIs +# right after they got introduced. Setting this option to a +# time interval will make the SR to wait for that time period +# before raising VDI not found exception. +# (integer value) +# Minimum value: 0 +#introduce_vdi_retry_wait = 20 + +# +# The name of the integration Bridge that is used with xenapi +# when connecting with Open vSwitch. +# +# Note: The value of this config option is dependent on the +# environment, therefore this configuration value must be set +# accordingly if you are using XenAPI. +# +# Possible values: +# +# * Any string that represents a bridge name. +# (string value) +#ovs_integration_bridge = + +# +# When adding new host to a pool, this will append a --force flag to the +# command, forcing hosts to join a pool, even if they have different CPUs. +# +# Since XenServer version 5.6 it is possible to create a pool of hosts that have +# different CPU capabilities. To accommodate CPU differences, XenServer limited +# features it uses to determine CPU compatibility to only the ones that are +# exposed by CPU and support for CPU masking was added. +# Despite this effort to level differences between CPUs, it is still possible +# that adding new host will fail, thus option to force join was introduced. +# (boolean value) +#use_join_force = true + +# +# Publicly visible name for this console host. +# +# Possible values: +# +# * Current hostname (default) or any string representing hostname. +# (string value) +#console_public_hostname = + + +[xvp] +# +# Configuration options for XVP. +# +# xvp (Xen VNC Proxy) is a proxy server providing password-protected VNC-based +# access to the consoles of virtual machines hosted on Citrix XenServer. + +# +# From nova.conf +# + +# XVP conf template (string value) +#console_xvp_conf_template = $pybasedir/nova/console/xvp.conf.template + +# Generated XVP conf file (string value) +#console_xvp_conf = /etc/xvp.conf + +# XVP master process pid file (string value) +#console_xvp_pid = /var/run/xvp.pid + +# XVP log file (string value) +#console_xvp_log = /var/log/xvp.log + +# Port for XVP to multiplex VNC connections on (port value) +# Minimum value: 0 +# Maximum value: 65535 +#console_xvp_multiplex_port = 5900 diff --git a/openstack/openstack_conf/compute/nova/rootwrap.conf b/openstack/openstack_conf/compute/nova/rootwrap.conf new file mode 100755 index 0000000..c6fd564 --- /dev/null +++ b/openstack/openstack_conf/compute/nova/rootwrap.conf @@ -0,0 +1,27 @@ +# Configuration for nova-rootwrap +# This file should be owned by (and only-writeable by) the root user + +[DEFAULT] +# List of directories to load filter definitions from (separated by ','). +# These directories MUST all be only writeable by root ! +filters_path=/etc/nova/rootwrap.d,/usr/share/nova/rootwrap + +# List of directories to search executables in, in case filters do not +# explicitly specify a full path (separated by ',') +# If not specified, defaults to system PATH environment variable. +# These directories MUST all be only writeable by root ! +exec_dirs=/sbin,/usr/sbin,/bin,/usr/bin,/usr/local/sbin,/usr/local/bin + +# Enable logging to syslog +# Default value is False +use_syslog=False + +# Which syslog facility to use. +# Valid values include auth, authpriv, syslog, local0, local1... +# Default value is 'syslog' +syslog_log_facility=syslog + +# Which messages to log. +# INFO means log all usage +# ERROR means only log unsuccessful attempts +syslog_log_level=ERROR diff --git a/openstack/openstack_conf/compute/nova/rootwrap.d/compute.filters b/openstack/openstack_conf/compute/nova/rootwrap.d/compute.filters new file mode 100755 index 0000000..24de287 --- /dev/null +++ b/openstack/openstack_conf/compute/nova/rootwrap.d/compute.filters @@ -0,0 +1,161 @@ +# nova-rootwrap command filters for compute nodes +# This file should be owned by (and only-writeable by) the root user + +[Filters] +# nova/virt/xenapi/vm_utils.py: tune2fs, -O ^has_journal, part_path +# nova/virt/xenapi/vm_utils.py: tune2fs, -j, partition_path +tune2fs: CommandFilter, tune2fs, root + +# nova/virt/libvirt/utils.py: 'blockdev', '--getsize64', path +# nova/virt/disk/mount/nbd.py: 'blockdev', '--flushbufs', device +blockdev: RegExpFilter, blockdev, root, blockdev, (--getsize64|--flushbufs), /dev/.* + +# nova/virt/libvirt/vif.py: 'ip', 'tuntap', 'add', dev, 'mode', 'tap' +# nova/virt/libvirt/vif.py: 'ip', 'link', 'set', dev, 'up' +# nova/virt/libvirt/vif.py: 'ip', 'link', 'delete', dev +# nova/network/linux_net.py: 'ip', 'addr', 'add', str(floating_ip)+'/32'i.. +# nova/network/linux_net.py: 'ip', 'addr', 'del', str(floating_ip)+'/32'.. +# nova/network/linux_net.py: 'ip', 'addr', 'add', '169.254.169.254/32',.. +# nova/network/linux_net.py: 'ip', 'addr', 'show', 'dev', dev, 'scope',.. +# nova/network/linux_net.py: 'ip', 'addr', 'del/add', ip_params, dev) +# nova/network/linux_net.py: 'ip', 'addr', 'del', params, fields[-1] +# nova/network/linux_net.py: 'ip', 'addr', 'add', params, bridge +# nova/network/linux_net.py: 'ip', '-f', 'inet6', 'addr', 'change', .. +# nova/network/linux_net.py: 'ip', 'link', 'set', 'dev', dev, 'promisc',.. +# nova/network/linux_net.py: 'ip', 'link', 'add', 'link', bridge_if ... +# nova/network/linux_net.py: 'ip', 'link', 'set', interface, address,.. +# nova/network/linux_net.py: 'ip', 'link', 'set', interface, 'up' +# nova/network/linux_net.py: 'ip', 'link', 'set', bridge, 'up' +# nova/network/linux_net.py: 'ip', 'addr', 'show', 'dev', interface, .. +# nova/network/linux_net.py: 'ip', 'link', 'set', dev, address, .. +# nova/network/linux_net.py: 'ip', 'link', 'set', dev, 'up' +# nova/network/linux_net.py: 'ip', 'route', 'add', .. +# nova/network/linux_net.py: 'ip', 'route', 'del', . +# nova/network/linux_net.py: 'ip', 'route', 'show', 'dev', dev +ip: CommandFilter, ip, root + +# nova/virt/libvirt/vif.py: 'tunctl', '-b', '-t', dev +# nova/network/linux_net.py: 'tunctl', '-b', '-t', dev +tunctl: CommandFilter, tunctl, root + +# nova/virt/libvirt/vif.py: 'ovs-vsctl', ... +# nova/virt/libvirt/vif.py: 'ovs-vsctl', 'del-port', ... +# nova/network/linux_net.py: 'ovs-vsctl', .... +ovs-vsctl: CommandFilter, ovs-vsctl, root + +# nova/network/linux_net.py: 'ivs-ctl', .... +ivs-ctl: CommandFilter, ivs-ctl, root + +# nova/network/linux_net.py: 'ovs-ofctl', .... +ovs-ofctl: CommandFilter, ovs-ofctl, root + +# nova/virt/xenapi/volume_utils.py: 'iscsiadm', '-m', ... +iscsiadm: CommandFilter, iscsiadm, root + +# nova/virt/libvirt/volume/aoe.py: 'aoe-revalidate', aoedev +# nova/virt/libvirt/volume/aoe.py: 'aoe-discover' +aoe-revalidate: CommandFilter, aoe-revalidate, root +aoe-discover: CommandFilter, aoe-discover, root + +# nova/virt/xenapi/vm_utils.py: 'pygrub', '-qn', dev_path +pygrub: CommandFilter, pygrub, root + +# nova/virt/xenapi/vm_utils.py: fdisk %(dev_path)s +fdisk: CommandFilter, fdisk, root + +# nova/virt/xenapi/vm_utils.py: e2fsck, -f, -p, partition_path +# nova/virt/disk/api.py: e2fsck, -f, -p, image +e2fsck: CommandFilter, e2fsck, root + +# nova/virt/xenapi/vm_utils.py: resize2fs, partition_path +# nova/virt/disk/api.py: resize2fs, image +resize2fs: CommandFilter, resize2fs, root + +# nova/network/linux_net.py: 'ip[6]tables-save' % (cmd, '-t', ... +iptables-save: CommandFilter, iptables-save, root +ip6tables-save: CommandFilter, ip6tables-save, root + +# nova/network/linux_net.py: 'ip[6]tables-restore' % (cmd,) +iptables-restore: CommandFilter, iptables-restore, root +ip6tables-restore: CommandFilter, ip6tables-restore, root + +# nova/network/linux_net.py: 'arping', '-U', floating_ip, '-A', '-I', ... +# nova/network/linux_net.py: 'arping', '-U', network_ref['dhcp_server'],.. +arping: CommandFilter, arping, root + +# nova/network/linux_net.py: 'dhcp_release', dev, address, mac_address +dhcp_release: CommandFilter, dhcp_release, root + +# nova/network/linux_net.py: 'kill', '-9', pid +# nova/network/linux_net.py: 'kill', '-HUP', pid +kill_dnsmasq: KillFilter, root, /usr/sbin/dnsmasq, -9, -HUP + +# nova/network/linux_net.py: 'kill', pid +kill_radvd: KillFilter, root, /usr/sbin/radvd + +# nova/network/linux_net.py: dnsmasq call +dnsmasq: EnvFilter, env, root, CONFIG_FILE=, NETWORK_ID=, dnsmasq + +# nova/network/linux_net.py: 'radvd', '-C', '%s' % _ra_file(dev, 'conf'.. +radvd: CommandFilter, radvd, root + +# nova/network/linux_net.py: 'brctl', 'addbr', bridge +# nova/network/linux_net.py: 'brctl', 'setfd', bridge, 0 +# nova/network/linux_net.py: 'brctl', 'stp', bridge, 'off' +# nova/network/linux_net.py: 'brctl', 'addif', bridge, interface +brctl: CommandFilter, brctl, root + +# nova/virt/libvirt/utils.py: 'mkswap' +# nova/virt/xenapi/vm_utils.py: 'mkswap' +mkswap: CommandFilter, mkswap, root + +# nova/virt/xenapi/vm_utils.py: 'mkfs' +# nova/utils.py: 'mkfs', fs, path, label +mkfs: CommandFilter, mkfs, root + +# nova/virt/libvirt/utils.py: 'qemu-img' +qemu-img: CommandFilter, qemu-img, root + +# nova/virt/disk/api.py: +mkfs.ext3: CommandFilter, mkfs.ext3, root +mkfs.ext4: CommandFilter, mkfs.ext4, root +mkfs.ntfs: CommandFilter, mkfs.ntfs, root + +# os-brick needed commands +read_initiator: ReadFileFilter, /etc/iscsi/initiatorname.iscsi +multipath: CommandFilter, multipath, root +# multipathd show status +multipathd: CommandFilter, multipathd, root +systool: CommandFilter, systool, root +vgc-cluster: CommandFilter, vgc-cluster, root +# os_brick/initiator/connector.py +drv_cfg: CommandFilter, /opt/emc/scaleio/sdc/bin/drv_cfg, root, /opt/emc/scaleio/sdc/bin/drv_cfg, --query_guid + +# TODO(smcginnis) Temporary fix. +# Need to pull in os-brick os-brick.filters file instead and clean +# out stale brick values from this file. +scsi_id: CommandFilter, /lib/udev/scsi_id, root +# os_brick.privileged.default oslo.privsep context +# This line ties the superuser privs with the config files, context name, +# and (implicitly) the actual python code invoked. +privsep-rootwrap-os_brick: RegExpFilter, privsep-helper, root, privsep-helper, --config-file, /etc/(?!\.\.).*, --privsep_context, os_brick.privileged.default, --privsep_sock_path, /tmp/.* + +privsep-rootwrap-sys_admin: RegExpFilter, privsep-helper, root, privsep-helper, --config-file, /etc/(?!\.\.).*, --privsep_context, nova.privsep.sys_admin_pctxt, --privsep_sock_path, /tmp/.* + +# nova/virt/libvirt/storage/dmcrypt.py: +cryptsetup: CommandFilter, cryptsetup, root + +# nova/virt/xenapi/vm_utils.py: +xenstore-read: CommandFilter, xenstore-read, root + +# nova/virt/libvirt/utils.py: +rbd: CommandFilter, rbd, root + +# nova/virt/libvirt/volume/volume.py: 'cp', '/dev/stdin', delete_control.. +cp: CommandFilter, cp, root + +# nova/virt/xenapi/vm_utils.py: +sync: CommandFilter, sync, root + +# nova/virt/libvirt/volume/vzstorage.py +pstorage-mount: CommandFilter, pstorage-mount, root diff --git a/openstack/openstack_conf/controller/cinder/api-paste.ini b/openstack/openstack_conf/controller/cinder/api-paste.ini new file mode 100644 index 0000000..cb783b8 --- /dev/null +++ b/openstack/openstack_conf/controller/cinder/api-paste.ini @@ -0,0 +1,65 @@ +############# +# OpenStack # +############# + +[composite:osapi_volume] +use = call:cinder.api:root_app_factory +/: apiversions +/v2: openstack_volume_api_v2 +/v3: openstack_volume_api_v3 + +[composite:openstack_volume_api_v2] +use = call:cinder.api.middleware.auth:pipeline_factory +noauth = cors http_proxy_to_wsgi request_id faultwrap sizelimit osprofiler noauth apiv2 +keystone = cors http_proxy_to_wsgi request_id faultwrap sizelimit osprofiler authtoken keystonecontext apiv2 +keystone_nolimit = cors http_proxy_to_wsgi request_id faultwrap sizelimit osprofiler authtoken keystonecontext apiv2 + +[composite:openstack_volume_api_v3] +use = call:cinder.api.middleware.auth:pipeline_factory +noauth = cors http_proxy_to_wsgi request_id faultwrap sizelimit osprofiler noauth apiv3 +keystone = cors http_proxy_to_wsgi request_id faultwrap sizelimit osprofiler authtoken keystonecontext apiv3 +keystone_nolimit = cors http_proxy_to_wsgi request_id faultwrap sizelimit osprofiler authtoken keystonecontext apiv3 + +[filter:request_id] +paste.filter_factory = oslo_middleware.request_id:RequestId.factory + +[filter:http_proxy_to_wsgi] +paste.filter_factory = oslo_middleware.http_proxy_to_wsgi:HTTPProxyToWSGI.factory + +[filter:cors] +paste.filter_factory = oslo_middleware.cors:filter_factory +oslo_config_project = cinder + +[filter:faultwrap] +paste.filter_factory = cinder.api.middleware.fault:FaultWrapper.factory + +[filter:osprofiler] +paste.filter_factory = osprofiler.web:WsgiMiddleware.factory + +[filter:noauth] +paste.filter_factory = cinder.api.middleware.auth:NoAuthMiddleware.factory + +[filter:sizelimit] +paste.filter_factory = oslo_middleware.sizelimit:RequestBodySizeLimiter.factory + +[app:apiv2] +paste.app_factory = cinder.api.v2.router:APIRouter.factory + +[app:apiv3] +paste.app_factory = cinder.api.v3.router:APIRouter.factory + +[pipeline:apiversions] +pipeline = cors http_proxy_to_wsgi faultwrap osvolumeversionapp + +[app:osvolumeversionapp] +paste.app_factory = cinder.api.versions:Versions.factory + +########## +# Shared # +########## + +[filter:keystonecontext] +paste.filter_factory = cinder.api.middleware.auth:CinderKeystoneContext.factory + +[filter:authtoken] +paste.filter_factory = keystonemiddleware.auth_token:filter_factory diff --git a/openstack/openstack_conf/controller/cinder/cinder.conf b/openstack/openstack_conf/controller/cinder/cinder.conf new file mode 100644 index 0000000..10c310f --- /dev/null +++ b/openstack/openstack_conf/controller/cinder/cinder.conf @@ -0,0 +1,31 @@ +[DEFAULT] +my_ip = 10.0.0.11 +transport_url = rabbit://openstack:rabbitPass@controller +rootwrap_config = /etc/cinder/rootwrap.conf +api_paste_confg = /etc/cinder/api-paste.ini +iscsi_helper = tgtadm +volume_name_template = volume-%s +volume_group = cinder-volumes +verbose = True +auth_strategy = keystone +state_path = /var/lib/cinder +lock_path = /var/lock/cinder +volumes_dir = /var/lib/cinder/volumes +enabled_backends = lvm + +[database] +connection = mysql+pymysql://cinder:cinder_db_secret@controller/cinder + +[keystone_authtoken] +password = cinder_user_secret +username = cinder +project_name = service +user_domain_id = default +project_domain_id = default +auth_type = password +memcached_servers = controller:11211 +auth_url = http://controller:5000 +auth_uri = http://controller:5000 + +[oslo_concurrency] +lock_path = /var/lib/cinder/tmp diff --git a/openstack/openstack_conf/controller/cinder/logging.conf b/openstack/openstack_conf/controller/cinder/logging.conf new file mode 100644 index 0000000..476425b --- /dev/null +++ b/openstack/openstack_conf/controller/cinder/logging.conf @@ -0,0 +1,76 @@ +[loggers] +keys = root, cinder + +[handlers] +keys = stderr, stdout, watchedfile, syslog, null + +[formatters] +keys = legacycinder, default + +[logger_root] +level = WARNING +handlers = null + +[logger_cinder] +level = INFO +handlers = stderr +qualname = cinder + +[logger_amqplib] +level = WARNING +handlers = stderr +qualname = amqplib + +[logger_sqlalchemy] +level = WARNING +handlers = stderr +qualname = sqlalchemy +# "level = INFO" logs SQL queries. +# "level = DEBUG" logs SQL queries and results. +# "level = WARNING" logs neither. (Recommended for production systems.) + +[logger_boto] +level = WARNING +handlers = stderr +qualname = boto + +[logger_suds] +level = INFO +handlers = stderr +qualname = suds + +[logger_eventletwsgi] +level = WARNING +handlers = stderr +qualname = eventlet.wsgi.server + +[handler_stderr] +class = StreamHandler +args = (sys.stderr,) +formatter = legacycinder + +[handler_stdout] +class = StreamHandler +args = (sys.stdout,) +formatter = legacycinder + +[handler_watchedfile] +class = handlers.WatchedFileHandler +args = ('cinder.log',) +formatter = legacycinder + +[handler_syslog] +class = handlers.SysLogHandler +args = ('/dev/log', handlers.SysLogHandler.LOG_USER) +formatter = legacycinder + +[handler_null] +class = cinder.log.NullHandler +formatter = default +args = () + +[formatter_legacycinder] +class = cinder.log.LegacyCinderFormatter + +[formatter_default] +format = %(message)s diff --git a/openstack/openstack_conf/controller/cinder/rootwrap.conf b/openstack/openstack_conf/controller/cinder/rootwrap.conf new file mode 100644 index 0000000..bf41bbd --- /dev/null +++ b/openstack/openstack_conf/controller/cinder/rootwrap.conf @@ -0,0 +1,27 @@ +# Configuration for cinder-rootwrap +# This file should be owned by (and only-writeable by) the root user + +[DEFAULT] +# List of directories to load filter definitions from (separated by ','). +# These directories MUST all be only writeable by root ! +filters_path=/etc/cinder/rootwrap.d,/usr/share/cinder/rootwrap + +# List of directories to search executables in, in case filters do not +# explicitely specify a full path (separated by ',') +# If not specified, defaults to system PATH environment variable. +# These directories MUST all be only writeable by root ! +exec_dirs=/sbin,/usr/sbin,/bin,/usr/bin,/usr/local/bin,/usr/local/sbin,/usr/lpp/mmfs/bin + +# Enable logging to syslog +# Default value is False +use_syslog=False + +# Which syslog facility to use. +# Valid values include auth, authpriv, syslog, local0, local1... +# Default value is 'syslog' +syslog_log_facility=syslog + +# Which messages to log. +# INFO means log all usage +# ERROR means only log unsuccessful attempts +syslog_log_level=ERROR diff --git a/openstack/openstack_conf/controller/glance/glance-api-paste.ini b/openstack/openstack_conf/controller/glance/glance-api-paste.ini new file mode 100644 index 0000000..6879027 --- /dev/null +++ b/openstack/openstack_conf/controller/glance/glance-api-paste.ini @@ -0,0 +1,90 @@ +# Use this pipeline for no auth or image caching - DEFAULT +[pipeline:glance-api] +pipeline = cors healthcheck http_proxy_to_wsgi versionnegotiation osprofiler unauthenticated-context rootapp + +# Use this pipeline for image caching and no auth +[pipeline:glance-api-caching] +pipeline = cors healthcheck http_proxy_to_wsgi versionnegotiation osprofiler unauthenticated-context cache rootapp + +# Use this pipeline for caching w/ management interface but no auth +[pipeline:glance-api-cachemanagement] +pipeline = cors healthcheck http_proxy_to_wsgi versionnegotiation osprofiler unauthenticated-context cache cachemanage rootapp + +# Use this pipeline for keystone auth +[pipeline:glance-api-keystone] +pipeline = cors healthcheck http_proxy_to_wsgi versionnegotiation osprofiler authtoken context rootapp + +# Use this pipeline for keystone auth with image caching +[pipeline:glance-api-keystone+caching] +pipeline = cors healthcheck http_proxy_to_wsgi versionnegotiation osprofiler authtoken context cache rootapp + +# Use this pipeline for keystone auth with caching and cache management +[pipeline:glance-api-keystone+cachemanagement] +pipeline = cors healthcheck http_proxy_to_wsgi versionnegotiation osprofiler authtoken context cache cachemanage rootapp + +# Use this pipeline for authZ only. This means that the registry will treat a +# user as authenticated without making requests to keystone to reauthenticate +# the user. +[pipeline:glance-api-trusted-auth] +pipeline = cors healthcheck http_proxy_to_wsgi versionnegotiation osprofiler context rootapp + +# Use this pipeline for authZ only. This means that the registry will treat a +# user as authenticated without making requests to keystone to reauthenticate +# the user and uses cache management +[pipeline:glance-api-trusted-auth+cachemanagement] +pipeline = cors healthcheck http_proxy_to_wsgi versionnegotiation osprofiler context cache cachemanage rootapp + +[composite:rootapp] +paste.composite_factory = glance.api:root_app_factory +/: apiversions +/v1: apiv1app +/v2: apiv2app + +[app:apiversions] +paste.app_factory = glance.api.versions:create_resource + +[app:apiv1app] +paste.app_factory = glance.api.v1.router:API.factory + +[app:apiv2app] +paste.app_factory = glance.api.v2.router:API.factory + +[filter:healthcheck] +paste.filter_factory = oslo_middleware:Healthcheck.factory +backends = disable_by_file +disable_by_file_path = /etc/glance/healthcheck_disable + +[filter:versionnegotiation] +paste.filter_factory = glance.api.middleware.version_negotiation:VersionNegotiationFilter.factory + +[filter:cache] +paste.filter_factory = glance.api.middleware.cache:CacheFilter.factory + +[filter:cachemanage] +paste.filter_factory = glance.api.middleware.cache_manage:CacheManageFilter.factory + +[filter:context] +paste.filter_factory = glance.api.middleware.context:ContextMiddleware.factory + +[filter:unauthenticated-context] +paste.filter_factory = glance.api.middleware.context:UnauthenticatedContextMiddleware.factory + +[filter:authtoken] +paste.filter_factory = keystonemiddleware.auth_token:filter_factory +delay_auth_decision = true + +[filter:gzip] +paste.filter_factory = glance.api.middleware.gzip:GzipMiddleware.factory + +[filter:osprofiler] +paste.filter_factory = osprofiler.web:WsgiMiddleware.factory +hmac_keys = SECRET_KEY #DEPRECATED +enabled = yes #DEPRECATED + +[filter:cors] +paste.filter_factory = oslo_middleware.cors:filter_factory +oslo_config_project = glance +oslo_config_program = glance-api + +[filter:http_proxy_to_wsgi] +paste.filter_factory = oslo_middleware:HTTPProxyToWSGI.factory diff --git a/openstack/openstack_conf/controller/glance/glance-api.conf b/openstack/openstack_conf/controller/glance/glance-api.conf new file mode 100644 index 0000000..ae8e1f7 --- /dev/null +++ b/openstack/openstack_conf/controller/glance/glance-api.conf @@ -0,0 +1,4833 @@ +[DEFAULT] + +# +# From glance.api +# + +# +# Set the image owner to tenant or the authenticated user. +# +# Assign a boolean value to determine the owner of an image. When set to +# True, the owner of the image is the tenant. When set to False, the +# owner of the image will be the authenticated user issuing the request. +# Setting it to False makes the image private to the associated user and +# sharing with other users within the same tenant (or "project") +# requires explicit image sharing via image membership. +# +# Possible values: +# * True +# * False +# +# Related options: +# * None +# +# (boolean value) +#owner_is_tenant = true + +# +# Role used to identify an authenticated user as administrator. +# +# Provide a string value representing a Keystone role to identify an +# administrative user. Users with this role will be granted +# administrative privileges. The default value for this option is +# 'admin'. +# +# Possible values: +# * A string value which is a valid Keystone role +# +# Related options: +# * None +# +# (string value) +#admin_role = admin + +# +# Allow limited access to unauthenticated users. +# +# Assign a boolean to determine API access for unathenticated +# users. When set to False, the API cannot be accessed by +# unauthenticated users. When set to True, unauthenticated users can +# access the API with read-only privileges. This however only applies +# when using ContextMiddleware. +# +# Possible values: +# * True +# * False +# +# Related options: +# * None +# +# (boolean value) +#allow_anonymous_access = false + +# +# Limit the request ID length. +# +# Provide an integer value to limit the length of the request ID to +# the specified length. The default value is 64. Users can change this +# to any ineteger value between 0 and 16384 however keeping in mind that +# a larger value may flood the logs. +# +# Possible values: +# * Integer value between 0 and 16384 +# +# Related options: +# * None +# +# (integer value) +# Minimum value: 0 +#max_request_id_length = 64 + +# +# Public url endpoint to use for Glance versions response. +# +# This is the public url endpoint that will appear in the Glance +# "versions" response. If no value is specified, the endpoint that is +# displayed in the version's response is that of the host running the +# API service. Change the endpoint to represent the proxy URL if the +# API service is running behind a proxy. If the service is running +# behind a load balancer, add the load balancer's URL for this value. +# +# Possible values: +# * None +# * Proxy URL +# * Load balancer URL +# +# Related options: +# * None +# +# (string value) +#public_endpoint = + +# +# Allow users to add additional/custom properties to images. +# +# Glance defines a standard set of properties (in its schema) that +# appear on every image. These properties are also known as +# ``base properties``. In addition to these properties, Glance +# allows users to add custom properties to images. These are known +# as ``additional properties``. +# +# By default, this configuration option is set to ``True`` and users +# are allowed to add additional properties. The number of additional +# properties that can be added to an image can be controlled via +# ``image_property_quota`` configuration option. +# +# Possible values: +# * True +# * False +# +# Related options: +# * image_property_quota +# +# (boolean value) +#allow_additional_image_properties = true + +# +# Maximum number of image members per image. +# +# This limits the maximum of users an image can be shared with. Any negative +# value is interpreted as unlimited. +# +# Related options: +# * None +# +# (integer value) +#image_member_quota = 128 + +# +# Maximum number of properties allowed on an image. +# +# This enforces an upper limit on the number of additional properties an image +# can have. Any negative value is interpreted as unlimited. +# +# NOTE: This won't have any impact if additional properties are disabled. Please +# refer to ``allow_additional_image_properties``. +# +# Related options: +# * ``allow_additional_image_properties`` +# +# (integer value) +#image_property_quota = 128 + +# +# Maximum number of tags allowed on an image. +# +# Any negative value is interpreted as unlimited. +# +# Related options: +# * None +# +# (integer value) +#image_tag_quota = 128 + +# +# Maximum number of locations allowed on an image. +# +# Any negative value is interpreted as unlimited. +# +# Related options: +# * None +# +# (integer value) +#image_location_quota = 10 + +# DEPRECATED: +# Python module path of data access API. +# +# Specifies the path to the API to use for accessing the data model. +# This option determines how the image catalog data will be accessed. +# +# Possible values: +# * glance.db.sqlalchemy.api +# * glance.db.registry.api +# * glance.db.simple.api +# +# If this option is set to ``glance.db.sqlalchemy.api`` then the image +# catalog data is stored in and read from the database via the +# SQLAlchemy Core and ORM APIs. +# +# Setting this option to ``glance.db.registry.api`` will force all +# database access requests to be routed through the Registry service. +# This avoids data access from the Glance API nodes for an added layer +# of security, scalability and manageability. +# +# NOTE: In v2 OpenStack Images API, the registry service is optional. +# In order to use the Registry API in v2, the option +# ``enable_v2_registry`` must be set to ``True``. +# +# Finally, when this configuration option is set to +# ``glance.db.simple.api``, image catalog data is stored in and read +# from an in-memory data structure. This is primarily used for testing. +# +# Related options: +# * enable_v2_api +# * enable_v2_registry +# +# (string value) +# This option is deprecated for removal since Queens. +# Its value may be silently ignored in the future. +# Reason: +# Glance registry service is deprecated for removal. +# +# More information can be found from the spec: +# http://specs.openstack.org/openstack/glance-specs/specs/queens/approved/glance +# /deprecate-registry.html +#data_api = glance.db.sqlalchemy.api + +# +# The default number of results to return for a request. +# +# Responses to certain API requests, like list images, may return +# multiple items. The number of results returned can be explicitly +# controlled by specifying the ``limit`` parameter in the API request. +# However, if a ``limit`` parameter is not specified, this +# configuration value will be used as the default number of results to +# be returned for any API request. +# +# NOTES: +# * The value of this configuration option may not be greater than +# the value specified by ``api_limit_max``. +# * Setting this to a very large value may slow down database +# queries and increase response times. Setting this to a +# very low value may result in poor user experience. +# +# Possible values: +# * Any positive integer +# +# Related options: +# * api_limit_max +# +# (integer value) +# Minimum value: 1 +#limit_param_default = 25 + +# +# Maximum number of results that could be returned by a request. +# +# As described in the help text of ``limit_param_default``, some +# requests may return multiple results. The number of results to be +# returned are governed either by the ``limit`` parameter in the +# request or the ``limit_param_default`` configuration option. +# The value in either case, can't be greater than the absolute maximum +# defined by this configuration option. Anything greater than this +# value is trimmed down to the maximum value defined here. +# +# NOTE: Setting this to a very large value may slow down database +# queries and increase response times. Setting this to a +# very low value may result in poor user experience. +# +# Possible values: +# * Any positive integer +# +# Related options: +# * limit_param_default +# +# (integer value) +# Minimum value: 1 +#api_limit_max = 1000 + +# +# Show direct image location when returning an image. +# +# This configuration option indicates whether to show the direct image +# location when returning image details to the user. The direct image +# location is where the image data is stored in backend storage. This +# image location is shown under the image property ``direct_url``. +# +# When multiple image locations exist for an image, the best location +# is displayed based on the location strategy indicated by the +# configuration option ``location_strategy``. +# +# NOTES: +# * Revealing image locations can present a GRAVE SECURITY RISK as +# image locations can sometimes include credentials. Hence, this +# is set to ``False`` by default. Set this to ``True`` with +# EXTREME CAUTION and ONLY IF you know what you are doing! +# * If an operator wishes to avoid showing any image location(s) +# to the user, then both this option and +# ``show_multiple_locations`` MUST be set to ``False``. +# +# Possible values: +# * True +# * False +# +# Related options: +# * show_multiple_locations +# * location_strategy +# +# (boolean value) +#show_image_direct_url = false + +# DEPRECATED: +# Show all image locations when returning an image. +# +# This configuration option indicates whether to show all the image +# locations when returning image details to the user. When multiple +# image locations exist for an image, the locations are ordered based +# on the location strategy indicated by the configuration opt +# ``location_strategy``. The image locations are shown under the +# image property ``locations``. +# +# NOTES: +# * Revealing image locations can present a GRAVE SECURITY RISK as +# image locations can sometimes include credentials. Hence, this +# is set to ``False`` by default. Set this to ``True`` with +# EXTREME CAUTION and ONLY IF you know what you are doing! +# * If an operator wishes to avoid showing any image location(s) +# to the user, then both this option and +# ``show_image_direct_url`` MUST be set to ``False``. +# +# Possible values: +# * True +# * False +# +# Related options: +# * show_image_direct_url +# * location_strategy +# +# (boolean value) +# This option is deprecated for removal since Newton. +# Its value may be silently ignored in the future. +# Reason: This option will be removed in the Pike release or later because the +# same functionality can be achieved with greater granularity by using policies. +# Please see the Newton release notes for more information. +#show_multiple_locations = false + +# +# Maximum size of image a user can upload in bytes. +# +# An image upload greater than the size mentioned here would result +# in an image creation failure. This configuration option defaults to +# 1099511627776 bytes (1 TiB). +# +# NOTES: +# * This value should only be increased after careful +# consideration and must be set less than or equal to +# 8 EiB (9223372036854775808). +# * This value must be set with careful consideration of the +# backend storage capacity. Setting this to a very low value +# may result in a large number of image failures. And, setting +# this to a very large value may result in faster consumption +# of storage. Hence, this must be set according to the nature of +# images created and storage capacity available. +# +# Possible values: +# * Any positive number less than or equal to 9223372036854775808 +# +# (integer value) +# Minimum value: 1 +# Maximum value: 9223372036854775808 +#image_size_cap = 1099511627776 + +# +# Maximum amount of image storage per tenant. +# +# This enforces an upper limit on the cumulative storage consumed by all images +# of a tenant across all stores. This is a per-tenant limit. +# +# The default unit for this configuration option is Bytes. However, storage +# units can be specified using case-sensitive literals ``B``, ``KB``, ``MB``, +# ``GB`` and ``TB`` representing Bytes, KiloBytes, MegaBytes, GigaBytes and +# TeraBytes respectively. Note that there should not be any space between the +# value and unit. Value ``0`` signifies no quota enforcement. Negative values +# are invalid and result in errors. +# +# Possible values: +# * A string that is a valid concatenation of a non-negative integer +# representing the storage value and an optional string literal +# representing storage units as mentioned above. +# +# Related options: +# * None +# +# (string value) +#user_storage_quota = 0 + +# +# Deploy the v1 OpenStack Images API. +# +# When this option is set to ``True``, Glance service will respond to +# requests on registered endpoints conforming to the v1 OpenStack +# Images API. +# +# NOTES: +# * If this option is enabled, then ``enable_v1_registry`` must +# also be set to ``True`` to enable mandatory usage of Registry +# service with v1 API. +# +# * If this option is disabled, then the ``enable_v1_registry`` +# option, which is enabled by default, is also recommended +# to be disabled. +# +# * This option is separate from ``enable_v2_api``, both v1 and v2 +# OpenStack Images API can be deployed independent of each +# other. +# +# * If deploying only the v2 Images API, this option, which is +# enabled by default, should be disabled. +# +# Possible values: +# * True +# * False +# +# Related options: +# * enable_v1_registry +# * enable_v2_api +# +# (boolean value) +#enable_v1_api = true + +# +# Deploy the v2 OpenStack Images API. +# +# When this option is set to ``True``, Glance service will respond +# to requests on registered endpoints conforming to the v2 OpenStack +# Images API. +# +# NOTES: +# * If this option is disabled, then the ``enable_v2_registry`` +# option, which is enabled by default, is also recommended +# to be disabled. +# +# * This option is separate from ``enable_v1_api``, both v1 and v2 +# OpenStack Images API can be deployed independent of each +# other. +# +# * If deploying only the v1 Images API, this option, which is +# enabled by default, should be disabled. +# +# Possible values: +# * True +# * False +# +# Related options: +# * enable_v2_registry +# * enable_v1_api +# +# (boolean value) +#enable_v2_api = true + +# +# Deploy the v1 API Registry service. +# +# When this option is set to ``True``, the Registry service +# will be enabled in Glance for v1 API requests. +# +# NOTES: +# * Use of Registry is mandatory in v1 API, so this option must +# be set to ``True`` if the ``enable_v1_api`` option is enabled. +# +# * If deploying only the v2 OpenStack Images API, this option, +# which is enabled by default, should be disabled. +# +# Possible values: +# * True +# * False +# +# Related options: +# * enable_v1_api +# +# (boolean value) +#enable_v1_registry = true + +# DEPRECATED: +# Deploy the v2 API Registry service. +# +# When this option is set to ``True``, the Registry service +# will be enabled in Glance for v2 API requests. +# +# NOTES: +# * Use of Registry is optional in v2 API, so this option +# must only be enabled if both ``enable_v2_api`` is set to +# ``True`` and the ``data_api`` option is set to +# ``glance.db.registry.api``. +# +# * If deploying only the v1 OpenStack Images API, this option, +# which is enabled by default, should be disabled. +# +# Possible values: +# * True +# * False +# +# Related options: +# * enable_v2_api +# * data_api +# +# (boolean value) +# This option is deprecated for removal since Queens. +# Its value may be silently ignored in the future. +# Reason: +# Glance registry service is deprecated for removal. +# +# More information can be found from the spec: +# http://specs.openstack.org/openstack/glance-specs/specs/queens/approved/glance +# /deprecate-registry.html +#enable_v2_registry = true + +# +# Host address of the pydev server. +# +# Provide a string value representing the hostname or IP of the +# pydev server to use for debugging. The pydev server listens for +# debug connections on this address, facilitating remote debugging +# in Glance. +# +# Possible values: +# * Valid hostname +# * Valid IP address +# +# Related options: +# * None +# +# (unknown value) +#pydev_worker_debug_host = localhost + +# +# Port number that the pydev server will listen on. +# +# Provide a port number to bind the pydev server to. The pydev +# process accepts debug connections on this port and facilitates +# remote debugging in Glance. +# +# Possible values: +# * A valid port number +# +# Related options: +# * None +# +# (port value) +# Minimum value: 0 +# Maximum value: 65535 +#pydev_worker_debug_port = 5678 + +# +# AES key for encrypting store location metadata. +# +# Provide a string value representing the AES cipher to use for +# encrypting Glance store metadata. +# +# NOTE: The AES key to use must be set to a random string of length +# 16, 24 or 32 bytes. +# +# Possible values: +# * String value representing a valid AES key +# +# Related options: +# * None +# +# (string value) +#metadata_encryption_key = + +# +# Digest algorithm to use for digital signature. +# +# Provide a string value representing the digest algorithm to +# use for generating digital signatures. By default, ``sha256`` +# is used. +# +# To get a list of the available algorithms supported by the version +# of OpenSSL on your platform, run the command: +# ``openssl list-message-digest-algorithms``. +# Examples are 'sha1', 'sha256', and 'sha512'. +# +# NOTE: ``digest_algorithm`` is not related to Glance's image signing +# and verification. It is only used to sign the universally unique +# identifier (UUID) as a part of the certificate file and key file +# validation. +# +# Possible values: +# * An OpenSSL message digest algorithm identifier +# +# Relation options: +# * None +# +# (string value) +#digest_algorithm = sha256 + +# +# The URL provides location where the temporary data will be stored +# +# This option is for Glance internal use only. Glance will save the +# image data uploaded by the user to 'staging' endpoint during the +# image import process. +# +# This option does not change the 'staging' API endpoint by any means. +# +# NOTE: It is discouraged to use same path as [task]/work_dir +# +# NOTE: 'file://' is the only option +# api_image_import flow will support for now. +# +# NOTE: The staging path must be on shared filesystem available to all +# Glance API nodes. +# +# Possible values: +# * String starting with 'file://' followed by absolute FS path +# +# Related options: +# * [task]/work_dir +# * [DEFAULT]/enable_image_import (*deprecated*) +# +# (string value) +#node_staging_uri = file:///tmp/staging/ + +# DEPRECATED: +# Enables the Image Import workflow introduced in Pike +# +# As '[DEFAULT]/node_staging_uri' is required for the Image +# Import, it's disabled per default in Pike, enabled per +# default in Queens and removed in Rocky. This allows Glance to +# operate with previous version configs upon upgrade. +# +# Setting this option to False will disable the endpoints related +# to Image Import Refactoring work. +# +# Related options: +# * [DEFAULT]/node_staging_uri (boolean value) +# This option is deprecated for removal since Pike. +# Its value may be silently ignored in the future. +# Reason: +# This option is deprecated for removal in Rocky. +# +# It was introduced to make sure that the API is not enabled +# before the '[DEFAULT]/node_staging_uri' is defined and is +# long term redundant. +#enable_image_import = true + +# +# List of enabled Image Import Methods +# +# Both 'glance-direct' and 'web-download' are enabled by default. +# +# Related options: +# * [DEFAULT]/node_staging_uri +# * [DEFAULT]/enable_image_import (list value) +#enabled_import_methods = glance-direct,web-download + +# +# Strategy to determine the preference order of image locations. +# +# This configuration option indicates the strategy to determine +# the order in which an image's locations must be accessed to +# serve the image's data. Glance then retrieves the image data +# from the first responsive active location it finds in this list. +# +# This option takes one of two possible values ``location_order`` +# and ``store_type``. The default value is ``location_order``, +# which suggests that image data be served by using locations in +# the order they are stored in Glance. The ``store_type`` value +# sets the image location preference based on the order in which +# the storage backends are listed as a comma separated list for +# the configuration option ``store_type_preference``. +# +# Possible values: +# * location_order +# * store_type +# +# Related options: +# * store_type_preference +# +# (string value) +# Possible values: +# location_order - +# store_type - +#location_strategy = location_order + +# +# The location of the property protection file. +# +# Provide a valid path to the property protection file which contains +# the rules for property protections and the roles/policies associated +# with them. +# +# A property protection file, when set, restricts the Glance image +# properties to be created, read, updated and/or deleted by a specific +# set of users that are identified by either roles or policies. +# If this configuration option is not set, by default, property +# protections won't be enforced. If a value is specified and the file +# is not found, the glance-api service will fail to start. +# More information on property protections can be found at: +# https://docs.openstack.org/glance/latest/admin/property-protections.html +# +# Possible values: +# * Empty string +# * Valid path to the property protection configuration file +# +# Related options: +# * property_protection_rule_format +# +# (string value) +#property_protection_file = + +# +# Rule format for property protection. +# +# Provide the desired way to set property protection on Glance +# image properties. The two permissible values are ``roles`` +# and ``policies``. The default value is ``roles``. +# +# If the value is ``roles``, the property protection file must +# contain a comma separated list of user roles indicating +# permissions for each of the CRUD operations on each property +# being protected. If set to ``policies``, a policy defined in +# policy.json is used to express property protections for each +# of the CRUD operations. Examples of how property protections +# are enforced based on ``roles`` or ``policies`` can be found at: +# https://docs.openstack.org/glance/latest/admin/property- +# protections.html#examples +# +# Possible values: +# * roles +# * policies +# +# Related options: +# * property_protection_file +# +# (string value) +# Possible values: +# roles - +# policies - +#property_protection_rule_format = roles + +# +# List of allowed exception modules to handle RPC exceptions. +# +# Provide a comma separated list of modules whose exceptions are +# permitted to be recreated upon receiving exception data via an RPC +# call made to Glance. The default list includes +# ``glance.common.exception``, ``builtins``, and ``exceptions``. +# +# The RPC protocol permits interaction with Glance via calls across a +# network or within the same system. Including a list of exception +# namespaces with this option enables RPC to propagate the exceptions +# back to the users. +# +# Possible values: +# * A comma separated list of valid exception modules +# +# Related options: +# * None +# (list value) +#allowed_rpc_exception_modules = glance.common.exception,builtins,exceptions + +# +# IP address to bind the glance servers to. +# +# Provide an IP address to bind the glance server to. The default +# value is ``0.0.0.0``. +# +# Edit this option to enable the server to listen on one particular +# IP address on the network card. This facilitates selection of a +# particular network interface for the server. +# +# Possible values: +# * A valid IPv4 address +# * A valid IPv6 address +# +# Related options: +# * None +# +# (unknown value) +#bind_host = 0.0.0.0 + +# +# Port number on which the server will listen. +# +# Provide a valid port number to bind the server's socket to. This +# port is then set to identify processes and forward network messages +# that arrive at the server. The default bind_port value for the API +# server is 9292 and for the registry server is 9191. +# +# Possible values: +# * A valid port number (0 to 65535) +# +# Related options: +# * None +# +# (port value) +# Minimum value: 0 +# Maximum value: 65535 +#bind_port = + +# +# Number of Glance worker processes to start. +# +# Provide a non-negative integer value to set the number of child +# process workers to service requests. By default, the number of CPUs +# available is set as the value for ``workers`` limited to 8. For +# example if the processor count is 6, 6 workers will be used, if the +# processor count is 24 only 8 workers will be used. The limit will only +# apply to the default value, if 24 workers is configured, 24 is used. +# +# Each worker process is made to listen on the port set in the +# configuration file and contains a greenthread pool of size 1000. +# +# NOTE: Setting the number of workers to zero, triggers the creation +# of a single API process with a greenthread pool of size 1000. +# +# Possible values: +# * 0 +# * Positive integer value (typically equal to the number of CPUs) +# +# Related options: +# * None +# +# (integer value) +# Minimum value: 0 +#workers = + +# +# Maximum line size of message headers. +# +# Provide an integer value representing a length to limit the size of +# message headers. The default value is 16384. +# +# NOTE: ``max_header_line`` may need to be increased when using large +# tokens (typically those generated by the Keystone v3 API with big +# service catalogs). However, it is to be kept in mind that larger +# values for ``max_header_line`` would flood the logs. +# +# Setting ``max_header_line`` to 0 sets no limit for the line size of +# message headers. +# +# Possible values: +# * 0 +# * Positive integer +# +# Related options: +# * None +# +# (integer value) +# Minimum value: 0 +#max_header_line = 16384 + +# +# Set keep alive option for HTTP over TCP. +# +# Provide a boolean value to determine sending of keep alive packets. +# If set to ``False``, the server returns the header +# "Connection: close". If set to ``True``, the server returns a +# "Connection: Keep-Alive" in its responses. This enables retention of +# the same TCP connection for HTTP conversations instead of opening a +# new one with each new request. +# +# This option must be set to ``False`` if the client socket connection +# needs to be closed explicitly after the response is received and +# read successfully by the client. +# +# Possible values: +# * True +# * False +# +# Related options: +# * None +# +# (boolean value) +#http_keepalive = true + +# +# Timeout for client connections' socket operations. +# +# Provide a valid integer value representing time in seconds to set +# the period of wait before an incoming connection can be closed. The +# default value is 900 seconds. +# +# The value zero implies wait forever. +# +# Possible values: +# * Zero +# * Positive integer +# +# Related options: +# * None +# +# (integer value) +# Minimum value: 0 +#client_socket_timeout = 900 + +# +# Set the number of incoming connection requests. +# +# Provide a positive integer value to limit the number of requests in +# the backlog queue. The default queue size is 4096. +# +# An incoming connection to a TCP listener socket is queued before a +# connection can be established with the server. Setting the backlog +# for a TCP socket ensures a limited queue size for incoming traffic. +# +# Possible values: +# * Positive integer +# +# Related options: +# * None +# +# (integer value) +# Minimum value: 1 +#backlog = 4096 + +# +# Set the wait time before a connection recheck. +# +# Provide a positive integer value representing time in seconds which +# is set as the idle wait time before a TCP keep alive packet can be +# sent to the host. The default value is 600 seconds. +# +# Setting ``tcp_keepidle`` helps verify at regular intervals that a +# connection is intact and prevents frequent TCP connection +# reestablishment. +# +# Possible values: +# * Positive integer value representing time in seconds +# +# Related options: +# * None +# +# (integer value) +# Minimum value: 1 +#tcp_keepidle = 600 + +# +# Absolute path to the CA file. +# +# Provide a string value representing a valid absolute path to +# the Certificate Authority file to use for client authentication. +# +# A CA file typically contains necessary trusted certificates to +# use for the client authentication. This is essential to ensure +# that a secure connection is established to the server via the +# internet. +# +# Possible values: +# * Valid absolute path to the CA file +# +# Related options: +# * None +# +# (string value) +#ca_file = /etc/ssl/cafile + +# +# Absolute path to the certificate file. +# +# Provide a string value representing a valid absolute path to the +# certificate file which is required to start the API service +# securely. +# +# A certificate file typically is a public key container and includes +# the server's public key, server name, server information and the +# signature which was a result of the verification process using the +# CA certificate. This is required for a secure connection +# establishment. +# +# Possible values: +# * Valid absolute path to the certificate file +# +# Related options: +# * None +# +# (string value) +#cert_file = /etc/ssl/certs + +# +# Absolute path to a private key file. +# +# Provide a string value representing a valid absolute path to a +# private key file which is required to establish the client-server +# connection. +# +# Possible values: +# * Absolute path to the private key file +# +# Related options: +# * None +# +# (string value) +#key_file = /etc/ssl/key/key-file.pem + +# DEPRECATED: The HTTP header used to determine the scheme for the original +# request, even if it was removed by an SSL terminating proxy. Typical value is +# "HTTP_X_FORWARDED_PROTO". (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Use the http_proxy_to_wsgi middleware instead. +#secure_proxy_ssl_header = + +# +# The relative path to sqlite file database that will be used for image cache +# management. +# +# This is a relative path to the sqlite file database that tracks the age and +# usage statistics of image cache. The path is relative to image cache base +# directory, specified by the configuration option ``image_cache_dir``. +# +# This is a lightweight database with just one table. +# +# Possible values: +# * A valid relative path to sqlite file database +# +# Related options: +# * ``image_cache_dir`` +# +# (string value) +#image_cache_sqlite_db = cache.db + +# +# The driver to use for image cache management. +# +# This configuration option provides the flexibility to choose between the +# different image-cache drivers available. An image-cache driver is responsible +# for providing the essential functions of image-cache like write images to/read +# images from cache, track age and usage of cached images, provide a list of +# cached images, fetch size of the cache, queue images for caching and clean up +# the cache, etc. +# +# The essential functions of a driver are defined in the base class +# ``glance.image_cache.drivers.base.Driver``. All image-cache drivers (existing +# and prospective) must implement this interface. Currently available drivers +# are ``sqlite`` and ``xattr``. These drivers primarily differ in the way they +# store the information about cached images: +# * The ``sqlite`` driver uses a sqlite database (which sits on every glance +# node locally) to track the usage of cached images. +# * The ``xattr`` driver uses the extended attributes of files to store this +# information. It also requires a filesystem that sets ``atime`` on the +# files +# when accessed. +# +# Possible values: +# * sqlite +# * xattr +# +# Related options: +# * None +# +# (string value) +# Possible values: +# sqlite - +# xattr - +#image_cache_driver = sqlite + +# +# The upper limit on cache size, in bytes, after which the cache-pruner cleans +# up the image cache. +# +# NOTE: This is just a threshold for cache-pruner to act upon. It is NOT a +# hard limit beyond which the image cache would never grow. In fact, depending +# on how often the cache-pruner runs and how quickly the cache fills, the image +# cache can far exceed the size specified here very easily. Hence, care must be +# taken to appropriately schedule the cache-pruner and in setting this limit. +# +# Glance caches an image when it is downloaded. Consequently, the size of the +# image cache grows over time as the number of downloads increases. To keep the +# cache size from becoming unmanageable, it is recommended to run the +# cache-pruner as a periodic task. When the cache pruner is kicked off, it +# compares the current size of image cache and triggers a cleanup if the image +# cache grew beyond the size specified here. After the cleanup, the size of +# cache is less than or equal to size specified here. +# +# Possible values: +# * Any non-negative integer +# +# Related options: +# * None +# +# (integer value) +# Minimum value: 0 +#image_cache_max_size = 10737418240 + +# +# The amount of time, in seconds, an incomplete image remains in the cache. +# +# Incomplete images are images for which download is in progress. Please see the +# description of configuration option ``image_cache_dir`` for more detail. +# Sometimes, due to various reasons, it is possible the download may hang and +# the incompletely downloaded image remains in the ``incomplete`` directory. +# This configuration option sets a time limit on how long the incomplete images +# should remain in the ``incomplete`` directory before they are cleaned up. +# Once an incomplete image spends more time than is specified here, it'll be +# removed by cache-cleaner on its next run. +# +# It is recommended to run cache-cleaner as a periodic task on the Glance API +# nodes to keep the incomplete images from occupying disk space. +# +# Possible values: +# * Any non-negative integer +# +# Related options: +# * None +# +# (integer value) +# Minimum value: 0 +#image_cache_stall_time = 86400 + +# +# Base directory for image cache. +# +# This is the location where image data is cached and served out of. All cached +# images are stored directly under this directory. This directory also contains +# three subdirectories, namely, ``incomplete``, ``invalid`` and ``queue``. +# +# The ``incomplete`` subdirectory is the staging area for downloading images. An +# image is first downloaded to this directory. When the image download is +# successful it is moved to the base directory. However, if the download fails, +# the partially downloaded image file is moved to the ``invalid`` subdirectory. +# +# The ``queue``subdirectory is used for queuing images for download. This is +# used primarily by the cache-prefetcher, which can be scheduled as a periodic +# task like cache-pruner and cache-cleaner, to cache images ahead of their +# usage. +# Upon receiving the request to cache an image, Glance touches a file in the +# ``queue`` directory with the image id as the file name. The cache-prefetcher, +# when running, polls for the files in ``queue`` directory and starts +# downloading them in the order they were created. When the download is +# successful, the zero-sized file is deleted from the ``queue`` directory. +# If the download fails, the zero-sized file remains and it'll be retried the +# next time cache-prefetcher runs. +# +# Possible values: +# * A valid path +# +# Related options: +# * ``image_cache_sqlite_db`` +# +# (string value) +#image_cache_dir = + +# +# Default publisher_id for outgoing Glance notifications. +# +# This is the value that the notification driver will use to identify +# messages for events originating from the Glance service. Typically, +# this is the hostname of the instance that generated the message. +# +# Possible values: +# * Any reasonable instance identifier, for example: image.host1 +# +# Related options: +# * None +# +# (string value) +#default_publisher_id = image.localhost + +# +# List of notifications to be disabled. +# +# Specify a list of notifications that should not be emitted. +# A notification can be given either as a notification type to +# disable a single event notification, or as a notification group +# prefix to disable all event notifications within a group. +# +# Possible values: +# A comma-separated list of individual notification types or +# notification groups to be disabled. Currently supported groups: +# * image +# * image.member +# * task +# * metadef_namespace +# * metadef_object +# * metadef_property +# * metadef_resource_type +# * metadef_tag +# For a complete listing and description of each event refer to: +# http://docs.openstack.org/developer/glance/notifications.html +# +# The values must be specified as: . +# For example: image.create,task.success,metadef_tag +# +# Related options: +# * None +# +# (list value) +#disabled_notifications = + +# DEPRECATED: +# Address the registry server is hosted on. +# +# Possible values: +# * A valid IP or hostname +# +# Related options: +# * None +# +# (unknown value) +# This option is deprecated for removal since Queens. +# Its value may be silently ignored in the future. +# Reason: +# Glance registry service is deprecated for removal. +# +# More information can be found from the spec: +# http://specs.openstack.org/openstack/glance-specs/specs/queens/approved/glance +# /deprecate-registry.html +#registry_host = 0.0.0.0 + +# DEPRECATED: +# Port the registry server is listening on. +# +# Possible values: +# * A valid port number +# +# Related options: +# * None +# +# (port value) +# Minimum value: 0 +# Maximum value: 65535 +# This option is deprecated for removal since Queens. +# Its value may be silently ignored in the future. +# Reason: +# Glance registry service is deprecated for removal. +# +# More information can be found from the spec: +# http://specs.openstack.org/openstack/glance-specs/specs/queens/approved/glance +# /deprecate-registry.html +#registry_port = 9191 + +# DEPRECATED: Whether to pass through the user token when making requests to the +# registry. To prevent failures with token expiration during big files upload, +# it is recommended to set this parameter to False.If "use_user_token" is not in +# effect, then admin credentials can be specified. (boolean value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: This option was considered harmful and has been deprecated in M +# release. It will be removed in O release. For more information read OSSN-0060. +# Related functionality with uploading big images has been implemented with +# Keystone trusts support. +#use_user_token = true + +# DEPRECATED: The administrators user name. If "use_user_token" is not in +# effect, then admin credentials can be specified. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: This option was considered harmful and has been deprecated in M +# release. It will be removed in O release. For more information read OSSN-0060. +# Related functionality with uploading big images has been implemented with +# Keystone trusts support. +#admin_user = + +# DEPRECATED: The administrators password. If "use_user_token" is not in effect, +# then admin credentials can be specified. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: This option was considered harmful and has been deprecated in M +# release. It will be removed in O release. For more information read OSSN-0060. +# Related functionality with uploading big images has been implemented with +# Keystone trusts support. +#admin_password = + +# DEPRECATED: The tenant name of the administrative user. If "use_user_token" is +# not in effect, then admin tenant name can be specified. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: This option was considered harmful and has been deprecated in M +# release. It will be removed in O release. For more information read OSSN-0060. +# Related functionality with uploading big images has been implemented with +# Keystone trusts support. +#admin_tenant_name = + +# DEPRECATED: The URL to the keystone service. If "use_user_token" is not in +# effect and using keystone auth, then URL of keystone can be specified. (string +# value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: This option was considered harmful and has been deprecated in M +# release. It will be removed in O release. For more information read OSSN-0060. +# Related functionality with uploading big images has been implemented with +# Keystone trusts support. +#auth_url = + +# DEPRECATED: The strategy to use for authentication. If "use_user_token" is not +# in effect, then auth strategy can be specified. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: This option was considered harmful and has been deprecated in M +# release. It will be removed in O release. For more information read OSSN-0060. +# Related functionality with uploading big images has been implemented with +# Keystone trusts support. +#auth_strategy = noauth + +# DEPRECATED: The region for the authentication service. If "use_user_token" is +# not in effect and using keystone auth, then region name can be specified. +# (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: This option was considered harmful and has been deprecated in M +# release. It will be removed in O release. For more information read OSSN-0060. +# Related functionality with uploading big images has been implemented with +# Keystone trusts support. +#auth_region = + +# DEPRECATED: +# Protocol to use for communication with the registry server. +# +# Provide a string value representing the protocol to use for +# communication with the registry server. By default, this option is +# set to ``http`` and the connection is not secure. +# +# This option can be set to ``https`` to establish a secure connection +# to the registry server. In this case, provide a key to use for the +# SSL connection using the ``registry_client_key_file`` option. Also +# include the CA file and cert file using the options +# ``registry_client_ca_file`` and ``registry_client_cert_file`` +# respectively. +# +# Possible values: +# * http +# * https +# +# Related options: +# * registry_client_key_file +# * registry_client_cert_file +# * registry_client_ca_file +# +# (string value) +# Possible values: +# http - +# https - +# This option is deprecated for removal since Queens. +# Its value may be silently ignored in the future. +# Reason: +# Glance registry service is deprecated for removal. +# +# More information can be found from the spec: +# http://specs.openstack.org/openstack/glance-specs/specs/queens/approved/glance +# /deprecate-registry.html +#registry_client_protocol = http + +# DEPRECATED: +# Absolute path to the private key file. +# +# Provide a string value representing a valid absolute path to the +# private key file to use for establishing a secure connection to +# the registry server. +# +# NOTE: This option must be set if ``registry_client_protocol`` is +# set to ``https``. Alternatively, the GLANCE_CLIENT_KEY_FILE +# environment variable may be set to a filepath of the key file. +# +# Possible values: +# * String value representing a valid absolute path to the key +# file. +# +# Related options: +# * registry_client_protocol +# +# (string value) +# This option is deprecated for removal since Queens. +# Its value may be silently ignored in the future. +# Reason: +# Glance registry service is deprecated for removal. +# +# More information can be found from the spec: +# http://specs.openstack.org/openstack/glance-specs/specs/queens/approved/glance +# /deprecate-registry.html +#registry_client_key_file = /etc/ssl/key/key-file.pem + +# DEPRECATED: +# Absolute path to the certificate file. +# +# Provide a string value representing a valid absolute path to the +# certificate file to use for establishing a secure connection to +# the registry server. +# +# NOTE: This option must be set if ``registry_client_protocol`` is +# set to ``https``. Alternatively, the GLANCE_CLIENT_CERT_FILE +# environment variable may be set to a filepath of the certificate +# file. +# +# Possible values: +# * String value representing a valid absolute path to the +# certificate file. +# +# Related options: +# * registry_client_protocol +# +# (string value) +# This option is deprecated for removal since Queens. +# Its value may be silently ignored in the future. +# Reason: +# Glance registry service is deprecated for removal. +# +# More information can be found from the spec: +# http://specs.openstack.org/openstack/glance-specs/specs/queens/approved/glance +# /deprecate-registry.html +#registry_client_cert_file = /etc/ssl/certs/file.crt + +# DEPRECATED: +# Absolute path to the Certificate Authority file. +# +# Provide a string value representing a valid absolute path to the +# certificate authority file to use for establishing a secure +# connection to the registry server. +# +# NOTE: This option must be set if ``registry_client_protocol`` is +# set to ``https``. Alternatively, the GLANCE_CLIENT_CA_FILE +# environment variable may be set to a filepath of the CA file. +# This option is ignored if the ``registry_client_insecure`` option +# is set to ``True``. +# +# Possible values: +# * String value representing a valid absolute path to the CA +# file. +# +# Related options: +# * registry_client_protocol +# * registry_client_insecure +# +# (string value) +# This option is deprecated for removal since Queens. +# Its value may be silently ignored in the future. +# Reason: +# Glance registry service is deprecated for removal. +# +# More information can be found from the spec: +# http://specs.openstack.org/openstack/glance-specs/specs/queens/approved/glance +# /deprecate-registry.html +#registry_client_ca_file = /etc/ssl/cafile/file.ca + +# DEPRECATED: +# Set verification of the registry server certificate. +# +# Provide a boolean value to determine whether or not to validate +# SSL connections to the registry server. By default, this option +# is set to ``False`` and the SSL connections are validated. +# +# If set to ``True``, the connection to the registry server is not +# validated via a certifying authority and the +# ``registry_client_ca_file`` option is ignored. This is the +# registry's equivalent of specifying --insecure on the command line +# using glanceclient for the API. +# +# Possible values: +# * True +# * False +# +# Related options: +# * registry_client_protocol +# * registry_client_ca_file +# +# (boolean value) +# This option is deprecated for removal since Queens. +# Its value may be silently ignored in the future. +# Reason: +# Glance registry service is deprecated for removal. +# +# More information can be found from the spec: +# http://specs.openstack.org/openstack/glance-specs/specs/queens/approved/glance +# /deprecate-registry.html +#registry_client_insecure = false + +# DEPRECATED: +# Timeout value for registry requests. +# +# Provide an integer value representing the period of time in seconds +# that the API server will wait for a registry request to complete. +# The default value is 600 seconds. +# +# A value of 0 implies that a request will never timeout. +# +# Possible values: +# * Zero +# * Positive integer +# +# Related options: +# * None +# +# (integer value) +# Minimum value: 0 +# This option is deprecated for removal since Queens. +# Its value may be silently ignored in the future. +# Reason: +# Glance registry service is deprecated for removal. +# +# More information can be found from the spec: +# http://specs.openstack.org/openstack/glance-specs/specs/queens/approved/glance +# /deprecate-registry.html +#registry_client_timeout = 600 + +# +# Send headers received from identity when making requests to +# registry. +# +# Typically, Glance registry can be deployed in multiple flavors, +# which may or may not include authentication. For example, +# ``trusted-auth`` is a flavor that does not require the registry +# service to authenticate the requests it receives. However, the +# registry service may still need a user context to be populated to +# serve the requests. This can be achieved by the caller +# (the Glance API usually) passing through the headers it received +# from authenticating with identity for the same request. The typical +# headers sent are ``X-User-Id``, ``X-Tenant-Id``, ``X-Roles``, +# ``X-Identity-Status`` and ``X-Service-Catalog``. +# +# Provide a boolean value to determine whether to send the identity +# headers to provide tenant and user information along with the +# requests to registry service. By default, this option is set to +# ``False``, which means that user and tenant information is not +# available readily. It must be obtained by authenticating. Hence, if +# this is set to ``False``, ``flavor`` must be set to value that +# either includes authentication or authenticated user context. +# +# Possible values: +# * True +# * False +# +# Related options: +# * flavor +# +# (boolean value) +#send_identity_headers = false + +# +# The amount of time, in seconds, to delay image scrubbing. +# +# When delayed delete is turned on, an image is put into ``pending_delete`` +# state upon deletion until the scrubber deletes its image data. Typically, soon +# after the image is put into ``pending_delete`` state, it is available for +# scrubbing. However, scrubbing can be delayed until a later point using this +# configuration option. This option denotes the time period an image spends in +# ``pending_delete`` state before it is available for scrubbing. +# +# It is important to realize that this has storage implications. The larger the +# ``scrub_time``, the longer the time to reclaim backend storage from deleted +# images. +# +# Possible values: +# * Any non-negative integer +# +# Related options: +# * ``delayed_delete`` +# +# (integer value) +# Minimum value: 0 +#scrub_time = 0 + +# +# The size of thread pool to be used for scrubbing images. +# +# When there are a large number of images to scrub, it is beneficial to scrub +# images in parallel so that the scrub queue stays in control and the backend +# storage is reclaimed in a timely fashion. This configuration option denotes +# the maximum number of images to be scrubbed in parallel. The default value is +# one, which signifies serial scrubbing. Any value above one indicates parallel +# scrubbing. +# +# Possible values: +# * Any non-zero positive integer +# +# Related options: +# * ``delayed_delete`` +# +# (integer value) +# Minimum value: 1 +#scrub_pool_size = 1 + +# +# Turn on/off delayed delete. +# +# Typically when an image is deleted, the ``glance-api`` service puts the image +# into ``deleted`` state and deletes its data at the same time. Delayed delete +# is a feature in Glance that delays the actual deletion of image data until a +# later point in time (as determined by the configuration option +# ``scrub_time``). +# When delayed delete is turned on, the ``glance-api`` service puts the image +# into ``pending_delete`` state upon deletion and leaves the image data in the +# storage backend for the image scrubber to delete at a later time. The image +# scrubber will move the image into ``deleted`` state upon successful deletion +# of image data. +# +# NOTE: When delayed delete is turned on, image scrubber MUST be running as a +# periodic task to prevent the backend storage from filling up with undesired +# usage. +# +# Possible values: +# * True +# * False +# +# Related options: +# * ``scrub_time`` +# * ``wakeup_time`` +# * ``scrub_pool_size`` +# +# (boolean value) +#delayed_delete = false + +# +# From oslo.log +# + +# If set to true, the logging level will be set to DEBUG instead of the default +# INFO level. (boolean value) +# Note: This option can be changed without restarting. +#debug = false + +# The name of a logging configuration file. This file is appended to any +# existing logging configuration files. For details about logging configuration +# files, see the Python logging module documentation. Note that when logging +# configuration files are used then all logging configuration is set in the +# configuration file and other logging configuration options are ignored (for +# example, logging_context_format_string). (string value) +# Note: This option can be changed without restarting. +# Deprecated group/name - [DEFAULT]/log_config +#log_config_append = + +# Defines the format string for %%(asctime)s in log records. Default: +# %(default)s . This option is ignored if log_config_append is set. (string +# value) +#log_date_format = %Y-%m-%d %H:%M:%S + +# (Optional) Name of log file to send logging output to. If no default is set, +# logging will go to stderr as defined by use_stderr. This option is ignored if +# log_config_append is set. (string value) +# Deprecated group/name - [DEFAULT]/logfile +#log_file = + +# (Optional) The base directory used for relative log_file paths. This option +# is ignored if log_config_append is set. (string value) +# Deprecated group/name - [DEFAULT]/logdir +#log_dir = + +# Uses logging handler designed to watch file system. When log file is moved or +# removed this handler will open a new log file with specified path +# instantaneously. It makes sense only if log_file option is specified and Linux +# platform is used. This option is ignored if log_config_append is set. (boolean +# value) +#watch_log_file = false + +# Use syslog for logging. Existing syslog format is DEPRECATED and will be +# changed later to honor RFC5424. This option is ignored if log_config_append is +# set. (boolean value) +#use_syslog = false + +# Enable journald for logging. If running in a systemd environment you may wish +# to enable journal support. Doing so will use the journal native protocol which +# includes structured metadata in addition to log messages.This option is +# ignored if log_config_append is set. (boolean value) +#use_journal = false + +# Syslog facility to receive log lines. This option is ignored if +# log_config_append is set. (string value) +#syslog_log_facility = LOG_USER + +# Use JSON formatting for logging. This option is ignored if log_config_append +# is set. (boolean value) +#use_json = false + +# Log output to standard error. This option is ignored if log_config_append is +# set. (boolean value) +#use_stderr = false + +# Format string to use for log messages with context. (string value) +#logging_context_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user_identity)s] %(instance)s%(message)s + +# Format string to use for log messages when context is undefined. (string +# value) +#logging_default_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [-] %(instance)s%(message)s + +# Additional data to append to log message when logging level for the message is +# DEBUG. (string value) +#logging_debug_format_suffix = %(funcName)s %(pathname)s:%(lineno)d + +# Prefix each line of exception output with this format. (string value) +#logging_exception_prefix = %(asctime)s.%(msecs)03d %(process)d ERROR %(name)s %(instance)s + +# Defines the format string for %(user_identity)s that is used in +# logging_context_format_string. (string value) +#logging_user_identity_format = %(user)s %(tenant)s %(domain)s %(user_domain)s %(project_domain)s + +# List of package logging levels in logger=LEVEL pairs. This option is ignored +# if log_config_append is set. (list value) +#default_log_levels = amqp=WARN,amqplib=WARN,boto=WARN,qpid=WARN,sqlalchemy=WARN,suds=INFO,oslo.messaging=INFO,oslo_messaging=INFO,iso8601=WARN,requests.packages.urllib3.connectionpool=WARN,urllib3.connectionpool=WARN,websocket=WARN,requests.packages.urllib3.util.retry=WARN,urllib3.util.retry=WARN,keystonemiddleware=WARN,routes.middleware=WARN,stevedore=WARN,taskflow=WARN,keystoneauth=WARN,oslo.cache=INFO,dogpile.core.dogpile=INFO + +# Enables or disables publication of error events. (boolean value) +#publish_errors = false + +# The format for an instance that is passed with the log message. (string value) +#instance_format = "[instance: %(uuid)s] " + +# The format for an instance UUID that is passed with the log message. (string +# value) +#instance_uuid_format = "[instance: %(uuid)s] " + +# Interval, number of seconds, of log rate limiting. (integer value) +#rate_limit_interval = 0 + +# Maximum number of logged messages per rate_limit_interval. (integer value) +#rate_limit_burst = 0 + +# Log level name used by rate limiting: CRITICAL, ERROR, INFO, WARNING, DEBUG or +# empty string. Logs with level greater or equal to rate_limit_except_level are +# not filtered. An empty string means that all levels are filtered. (string +# value) +#rate_limit_except_level = CRITICAL + +# Enables or disables fatal status of deprecations. (boolean value) +#fatal_deprecations = false + +# +# From oslo.messaging +# + +# Size of RPC connection pool. (integer value) +#rpc_conn_pool_size = 30 + +# The pool size limit for connections expiration policy (integer value) +#conn_pool_min_size = 2 + +# The time-to-live in sec of idle connections in the pool (integer value) +#conn_pool_ttl = 1200 + +# ZeroMQ bind address. Should be a wildcard (*), an ethernet interface, or IP. +# The "host" option should point or resolve to this address. (string value) +#rpc_zmq_bind_address = * + +# MatchMaker driver. (string value) +# Possible values: +# redis - +# sentinel - +# dummy - +#rpc_zmq_matchmaker = redis + +# Number of ZeroMQ contexts, defaults to 1. (integer value) +#rpc_zmq_contexts = 1 + +# Maximum number of ingress messages to locally buffer per topic. Default is +# unlimited. (integer value) +#rpc_zmq_topic_backlog = + +# Directory for holding IPC sockets. (string value) +#rpc_zmq_ipc_dir = /var/run/openstack + +# Name of this node. Must be a valid hostname, FQDN, or IP address. Must match +# "host" option, if running Nova. (string value) +#rpc_zmq_host = localhost + +# Number of seconds to wait before all pending messages will be sent after +# closing a socket. The default value of -1 specifies an infinite linger period. +# The value of 0 specifies no linger period. Pending messages shall be discarded +# immediately when the socket is closed. Positive values specify an upper bound +# for the linger period. (integer value) +# Deprecated group/name - [DEFAULT]/rpc_cast_timeout +#zmq_linger = -1 + +# The default number of seconds that poll should wait. Poll raises timeout +# exception when timeout expired. (integer value) +#rpc_poll_timeout = 1 + +# Expiration timeout in seconds of a name service record about existing target ( +# < 0 means no timeout). (integer value) +#zmq_target_expire = 300 + +# Update period in seconds of a name service record about existing target. +# (integer value) +#zmq_target_update = 180 + +# Use PUB/SUB pattern for fanout methods. PUB/SUB always uses proxy. (boolean +# value) +#use_pub_sub = false + +# Use ROUTER remote proxy. (boolean value) +#use_router_proxy = false + +# This option makes direct connections dynamic or static. It makes sense only +# with use_router_proxy=False which means to use direct connections for direct +# message types (ignored otherwise). (boolean value) +#use_dynamic_connections = false + +# How many additional connections to a host will be made for failover reasons. +# This option is actual only in dynamic connections mode. (integer value) +#zmq_failover_connections = 2 + +# Minimal port number for random ports range. (port value) +# Minimum value: 0 +# Maximum value: 65535 +#rpc_zmq_min_port = 49153 + +# Maximal port number for random ports range. (integer value) +# Minimum value: 1 +# Maximum value: 65536 +#rpc_zmq_max_port = 65536 + +# Number of retries to find free port number before fail with ZMQBindError. +# (integer value) +#rpc_zmq_bind_port_retries = 100 + +# Default serialization mechanism for serializing/deserializing +# outgoing/incoming messages (string value) +# Possible values: +# json - +# msgpack - +#rpc_zmq_serialization = json + +# This option configures round-robin mode in zmq socket. True means not keeping +# a queue when server side disconnects. False means to keep queue and messages +# even if server is disconnected, when the server appears we send all +# accumulated messages to it. (boolean value) +#zmq_immediate = true + +# Enable/disable TCP keepalive (KA) mechanism. The default value of -1 (or any +# other negative value) means to skip any overrides and leave it to OS default; +# 0 and 1 (or any other positive value) mean to disable and enable the option +# respectively. (integer value) +#zmq_tcp_keepalive = -1 + +# The duration between two keepalive transmissions in idle condition. The unit +# is platform dependent, for example, seconds in Linux, milliseconds in Windows +# etc. The default value of -1 (or any other negative value and 0) means to skip +# any overrides and leave it to OS default. (integer value) +#zmq_tcp_keepalive_idle = -1 + +# The number of retransmissions to be carried out before declaring that remote +# end is not available. The default value of -1 (or any other negative value and +# 0) means to skip any overrides and leave it to OS default. (integer value) +#zmq_tcp_keepalive_cnt = -1 + +# The duration between two successive keepalive retransmissions, if +# acknowledgement to the previous keepalive transmission is not received. The +# unit is platform dependent, for example, seconds in Linux, milliseconds in +# Windows etc. The default value of -1 (or any other negative value and 0) means +# to skip any overrides and leave it to OS default. (integer value) +#zmq_tcp_keepalive_intvl = -1 + +# Maximum number of (green) threads to work concurrently. (integer value) +#rpc_thread_pool_size = 100 + +# Expiration timeout in seconds of a sent/received message after which it is not +# tracked anymore by a client/server. (integer value) +#rpc_message_ttl = 300 + +# Wait for message acknowledgements from receivers. This mechanism works only +# via proxy without PUB/SUB. (boolean value) +#rpc_use_acks = false + +# Number of seconds to wait for an ack from a cast/call. After each retry +# attempt this timeout is multiplied by some specified multiplier. (integer +# value) +#rpc_ack_timeout_base = 15 + +# Number to multiply base ack timeout by after each retry attempt. (integer +# value) +#rpc_ack_timeout_multiplier = 2 + +# Default number of message sending attempts in case of any problems occurred: +# positive value N means at most N retries, 0 means no retries, None or -1 (or +# any other negative values) mean to retry forever. This option is used only if +# acknowledgments are enabled. (integer value) +#rpc_retry_attempts = 3 + +# List of publisher hosts SubConsumer can subscribe on. This option has higher +# priority then the default publishers list taken from the matchmaker. (list +# value) +#subscribe_on = + +# Size of executor thread pool when executor is threading or eventlet. (integer +# value) +# Deprecated group/name - [DEFAULT]/rpc_thread_pool_size +#executor_thread_pool_size = 64 + +# Seconds to wait for a response from a call. (integer value) +#rpc_response_timeout = 60 + +# The network address and optional user credentials for connecting to the +# messaging backend, in URL format. The expected format is: +# +# driver://[user:pass@]host:port[,[userN:passN@]hostN:portN]/virtual_host?query +# +# Example: rabbit://rabbitmq:password@127.0.0.1:5672// +# +# For full details on the fields in the URL see the documentation of +# oslo_messaging.TransportURL at +# https://docs.openstack.org/oslo.messaging/latest/reference/transport.html +# (string value) +#transport_url = + +# DEPRECATED: The messaging driver to use, defaults to rabbit. Other drivers +# include amqp and zmq. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#rpc_backend = rabbit + +# The default exchange under which topics are scoped. May be overridden by an +# exchange name specified in the transport_url option. (string value) +#control_exchange = openstack + + +[cors] + +# +# From oslo.middleware.cors +# + +# Indicate whether this resource may be shared with the domain received in the +# requests "origin" header. Format: "://[:]", no trailing +# slash. Example: https://horizon.example.com (list value) +#allowed_origin = + +# Indicate that the actual request can include user credentials (boolean value) +#allow_credentials = true + +# Indicate which headers are safe to expose to the API. Defaults to HTTP Simple +# Headers. (list value) +#expose_headers = X-Image-Meta-Checksum,X-Auth-Token,X-Subject-Token,X-Service-Token,X-OpenStack-Request-ID + +# Maximum cache age of CORS preflight requests. (integer value) +#max_age = 3600 + +# Indicate which methods can be used during the actual request. (list value) +#allow_methods = GET,PUT,POST,DELETE,PATCH + +# Indicate which header field names may be used during the actual request. (list +# value) +#allow_headers = Content-MD5,X-Image-Meta-Checksum,X-Storage-Token,Accept-Encoding,X-Auth-Token,X-Identity-Status,X-Roles,X-Service-Catalog,X-User-Id,X-Tenant-Id,X-OpenStack-Request-ID + + +[database] +connection = mysql+pymysql://glance:glance_db_secret@controller/glance +backend = sqlalchemy + +# +# From oslo.db +# + +# If True, SQLite uses synchronous mode. (boolean value) +#sqlite_synchronous = true + +# The back end to use for the database. (string value) +# Deprecated group/name - [DEFAULT]/db_backend +#backend = sqlalchemy + +# The SQLAlchemy connection string to use to connect to the database. (string +# value) +# Deprecated group/name - [DEFAULT]/sql_connection +# Deprecated group/name - [DATABASE]/sql_connection +# Deprecated group/name - [sql]/connection +#connection = + +# The SQLAlchemy connection string to use to connect to the slave database. +# (string value) +#slave_connection = + +# The SQL mode to be used for MySQL sessions. This option, including the +# default, overrides any server-set SQL mode. To use whatever SQL mode is set by +# the server configuration, set this to no value. Example: mysql_sql_mode= +# (string value) +#mysql_sql_mode = TRADITIONAL + +# If True, transparently enables support for handling MySQL Cluster (NDB). +# (boolean value) +#mysql_enable_ndb = false + +# Connections which have been present in the connection pool longer than this +# number of seconds will be replaced with a new one the next time they are +# checked out from the pool. (integer value) +# Deprecated group/name - [DATABASE]/idle_timeout +# Deprecated group/name - [database]/idle_timeout +# Deprecated group/name - [DEFAULT]/sql_idle_timeout +# Deprecated group/name - [DATABASE]/sql_idle_timeout +# Deprecated group/name - [sql]/idle_timeout +#connection_recycle_time = 3600 + +# Minimum number of SQL connections to keep open in a pool. (integer value) +# Deprecated group/name - [DEFAULT]/sql_min_pool_size +# Deprecated group/name - [DATABASE]/sql_min_pool_size +#min_pool_size = 1 + +# Maximum number of SQL connections to keep open in a pool. Setting a value of 0 +# indicates no limit. (integer value) +# Deprecated group/name - [DEFAULT]/sql_max_pool_size +# Deprecated group/name - [DATABASE]/sql_max_pool_size +#max_pool_size = 5 + +# Maximum number of database connection retries during startup. Set to -1 to +# specify an infinite retry count. (integer value) +# Deprecated group/name - [DEFAULT]/sql_max_retries +# Deprecated group/name - [DATABASE]/sql_max_retries +#max_retries = 10 + +# Interval between retries of opening a SQL connection. (integer value) +# Deprecated group/name - [DEFAULT]/sql_retry_interval +# Deprecated group/name - [DATABASE]/reconnect_interval +#retry_interval = 10 + +# If set, use this value for max_overflow with SQLAlchemy. (integer value) +# Deprecated group/name - [DEFAULT]/sql_max_overflow +# Deprecated group/name - [DATABASE]/sqlalchemy_max_overflow +#max_overflow = 50 + +# Verbosity of SQL debugging information: 0=None, 100=Everything. (integer +# value) +# Minimum value: 0 +# Maximum value: 100 +# Deprecated group/name - [DEFAULT]/sql_connection_debug +#connection_debug = 0 + +# Add Python stack traces to SQL as comment strings. (boolean value) +# Deprecated group/name - [DEFAULT]/sql_connection_trace +#connection_trace = false + +# If set, use this value for pool_timeout with SQLAlchemy. (integer value) +# Deprecated group/name - [DATABASE]/sqlalchemy_pool_timeout +#pool_timeout = + +# Enable the experimental use of database reconnect on connection lost. (boolean +# value) +#use_db_reconnect = false + +# Seconds between retries of a database transaction. (integer value) +#db_retry_interval = 1 + +# If True, increases the interval between retries of a database operation up to +# db_max_retry_interval. (boolean value) +#db_inc_retry_interval = true + +# If db_inc_retry_interval is set, the maximum seconds between retries of a +# database operation. (integer value) +#db_max_retry_interval = 10 + +# Maximum retries in case of connection error or deadlock error before error is +# raised. Set to -1 to specify an infinite retry count. (integer value) +#db_max_retries = 20 + +# +# From oslo.db.concurrency +# + +# Enable the experimental use of thread pooling for all DB API calls (boolean +# value) +# Deprecated group/name - [DEFAULT]/dbapi_use_tpool +#use_tpool = false + + +[glance_store] +filesystem_store_datadir = /var/lib/glance/images/ +default_store = file +stores = file,http + +# +# From glance.store +# + +# +# List of enabled Glance stores. +# +# Register the storage backends to use for storing disk images +# as a comma separated list. The default stores enabled for +# storing disk images with Glance are ``file`` and ``http``. +# +# Possible values: +# * A comma separated list that could include: +# * file +# * http +# * swift +# * rbd +# * sheepdog +# * cinder +# * vmware +# +# Related Options: +# * default_store +# +# (list value) +#stores = file,http + +# +# The default scheme to use for storing images. +# +# Provide a string value representing the default scheme to use for +# storing images. If not set, Glance uses ``file`` as the default +# scheme to store images with the ``file`` store. +# +# NOTE: The value given for this configuration option must be a valid +# scheme for a store registered with the ``stores`` configuration +# option. +# +# Possible values: +# * file +# * filesystem +# * http +# * https +# * swift +# * swift+http +# * swift+https +# * swift+config +# * rbd +# * sheepdog +# * cinder +# * vsphere +# +# Related Options: +# * stores +# +# (string value) +# Possible values: +# file - +# filesystem - +# http - +# https - +# swift - +# swift+http - +# swift+https - +# swift+config - +# rbd - +# sheepdog - +# cinder - +# vsphere - +#default_store = file + +# +# Minimum interval in seconds to execute updating dynamic storage +# capabilities based on current backend status. +# +# Provide an integer value representing time in seconds to set the +# minimum interval before an update of dynamic storage capabilities +# for a storage backend can be attempted. Setting +# ``store_capabilities_update_min_interval`` does not mean updates +# occur periodically based on the set interval. Rather, the update +# is performed at the elapse of this interval set, if an operation +# of the store is triggered. +# +# By default, this option is set to zero and is disabled. Provide an +# integer value greater than zero to enable this option. +# +# NOTE: For more information on store capabilities and their updates, +# please visit: https://specs.openstack.org/openstack/glance-specs/specs/kilo +# /store-capabilities.html +# +# For more information on setting up a particular store in your +# deployment and help with the usage of this feature, please contact +# the storage driver maintainers listed here: +# http://docs.openstack.org/developer/glance_store/drivers/index.html +# +# Possible values: +# * Zero +# * Positive integer +# +# Related Options: +# * None +# +# (integer value) +# Minimum value: 0 +#store_capabilities_update_min_interval = 0 + +# +# Information to match when looking for cinder in the service catalog. +# +# When the ``cinder_endpoint_template`` is not set and any of +# ``cinder_store_auth_address``, ``cinder_store_user_name``, +# ``cinder_store_project_name``, ``cinder_store_password`` is not set, +# cinder store uses this information to lookup cinder endpoint from the service +# catalog in the current context. ``cinder_os_region_name``, if set, is taken +# into consideration to fetch the appropriate endpoint. +# +# The service catalog can be listed by the ``openstack catalog list`` command. +# +# Possible values: +# * A string of of the following form: +# ``::`` +# At least ``service_type`` and ``interface`` should be specified. +# ``service_name`` can be omitted. +# +# Related options: +# * cinder_os_region_name +# * cinder_endpoint_template +# * cinder_store_auth_address +# * cinder_store_user_name +# * cinder_store_project_name +# * cinder_store_password +# +# (string value) +#cinder_catalog_info = volumev2::publicURL + +# +# Override service catalog lookup with template for cinder endpoint. +# +# When this option is set, this value is used to generate cinder endpoint, +# instead of looking up from the service catalog. +# This value is ignored if ``cinder_store_auth_address``, +# ``cinder_store_user_name``, ``cinder_store_project_name``, and +# ``cinder_store_password`` are specified. +# +# If this configuration option is set, ``cinder_catalog_info`` will be ignored. +# +# Possible values: +# * URL template string for cinder endpoint, where ``%%(tenant)s`` is +# replaced with the current tenant (project) name. +# For example: ``http://cinder.openstack.example.org/v2/%%(tenant)s`` +# +# Related options: +# * cinder_store_auth_address +# * cinder_store_user_name +# * cinder_store_project_name +# * cinder_store_password +# * cinder_catalog_info +# +# (string value) +#cinder_endpoint_template = + +# +# Region name to lookup cinder service from the service catalog. +# +# This is used only when ``cinder_catalog_info`` is used for determining the +# endpoint. If set, the lookup for cinder endpoint by this node is filtered to +# the specified region. It is useful when multiple regions are listed in the +# catalog. If this is not set, the endpoint is looked up from every region. +# +# Possible values: +# * A string that is a valid region name. +# +# Related options: +# * cinder_catalog_info +# +# (string value) +# Deprecated group/name - [glance_store]/os_region_name +#cinder_os_region_name = + +# +# Location of a CA certificates file used for cinder client requests. +# +# The specified CA certificates file, if set, is used to verify cinder +# connections via HTTPS endpoint. If the endpoint is HTTP, this value is +# ignored. +# ``cinder_api_insecure`` must be set to ``True`` to enable the verification. +# +# Possible values: +# * Path to a ca certificates file +# +# Related options: +# * cinder_api_insecure +# +# (string value) +#cinder_ca_certificates_file = + +# +# Number of cinderclient retries on failed http calls. +# +# When a call failed by any errors, cinderclient will retry the call up to the +# specified times after sleeping a few seconds. +# +# Possible values: +# * A positive integer +# +# Related options: +# * None +# +# (integer value) +# Minimum value: 0 +#cinder_http_retries = 3 + +# +# Time period, in seconds, to wait for a cinder volume transition to +# complete. +# +# When the cinder volume is created, deleted, or attached to the glance node to +# read/write the volume data, the volume's state is changed. For example, the +# newly created volume status changes from ``creating`` to ``available`` after +# the creation process is completed. This specifies the maximum time to wait for +# the status change. If a timeout occurs while waiting, or the status is changed +# to an unexpected value (e.g. `error``), the image creation fails. +# +# Possible values: +# * A positive integer +# +# Related options: +# * None +# +# (integer value) +# Minimum value: 0 +#cinder_state_transition_timeout = 300 + +# +# Allow to perform insecure SSL requests to cinder. +# +# If this option is set to True, HTTPS endpoint connection is verified using the +# CA certificates file specified by ``cinder_ca_certificates_file`` option. +# +# Possible values: +# * True +# * False +# +# Related options: +# * cinder_ca_certificates_file +# +# (boolean value) +#cinder_api_insecure = false + +# +# The address where the cinder authentication service is listening. +# +# When all of ``cinder_store_auth_address``, ``cinder_store_user_name``, +# ``cinder_store_project_name``, and ``cinder_store_password`` options are +# specified, the specified values are always used for the authentication. +# This is useful to hide the image volumes from users by storing them in a +# project/tenant specific to the image service. It also enables users to share +# the image volume among other projects under the control of glance's ACL. +# +# If either of these options are not set, the cinder endpoint is looked up +# from the service catalog, and current context's user and project are used. +# +# Possible values: +# * A valid authentication service address, for example: +# ``http://openstack.example.org/identity/v2.0`` +# +# Related options: +# * cinder_store_user_name +# * cinder_store_password +# * cinder_store_project_name +# +# (string value) +#cinder_store_auth_address = + +# +# User name to authenticate against cinder. +# +# This must be used with all the following related options. If any of these are +# not specified, the user of the current context is used. +# +# Possible values: +# * A valid user name +# +# Related options: +# * cinder_store_auth_address +# * cinder_store_password +# * cinder_store_project_name +# +# (string value) +#cinder_store_user_name = + +# +# Password for the user authenticating against cinder. +# +# This must be used with all the following related options. If any of these are +# not specified, the user of the current context is used. +# +# Possible values: +# * A valid password for the user specified by ``cinder_store_user_name`` +# +# Related options: +# * cinder_store_auth_address +# * cinder_store_user_name +# * cinder_store_project_name +# +# (string value) +#cinder_store_password = + +# +# Project name where the image volume is stored in cinder. +# +# If this configuration option is not set, the project in current context is +# used. +# +# This must be used with all the following related options. If any of these are +# not specified, the project of the current context is used. +# +# Possible values: +# * A valid project name +# +# Related options: +# * ``cinder_store_auth_address`` +# * ``cinder_store_user_name`` +# * ``cinder_store_password`` +# +# (string value) +#cinder_store_project_name = + +# +# Path to the rootwrap configuration file to use for running commands as root. +# +# The cinder store requires root privileges to operate the image volumes (for +# connecting to iSCSI/FC volumes and reading/writing the volume data, etc.). +# The configuration file should allow the required commands by cinder store and +# os-brick library. +# +# Possible values: +# * Path to the rootwrap config file +# +# Related options: +# * None +# +# (string value) +#rootwrap_config = /etc/glance/rootwrap.conf + +# +# Volume type that will be used for volume creation in cinder. +# +# Some cinder backends can have several volume types to optimize storage usage. +# Adding this option allows an operator to choose a specific volume type +# in cinder that can be optimized for images. +# +# If this is not set, then the default volume type specified in the cinder +# configuration will be used for volume creation. +# +# Possible values: +# * A valid volume type from cinder +# +# Related options: +# * None +# +# (string value) +#cinder_volume_type = + +# +# Directory to which the filesystem backend store writes images. +# +# Upon start up, Glance creates the directory if it doesn't already +# exist and verifies write access to the user under which +# ``glance-api`` runs. If the write access isn't available, a +# ``BadStoreConfiguration`` exception is raised and the filesystem +# store may not be available for adding new images. +# +# NOTE: This directory is used only when filesystem store is used as a +# storage backend. Either ``filesystem_store_datadir`` or +# ``filesystem_store_datadirs`` option must be specified in +# ``glance-api.conf``. If both options are specified, a +# ``BadStoreConfiguration`` will be raised and the filesystem store +# may not be available for adding new images. +# +# Possible values: +# * A valid path to a directory +# +# Related options: +# * ``filesystem_store_datadirs`` +# * ``filesystem_store_file_perm`` +# +# (string value) +#filesystem_store_datadir = /var/lib/glance/images + +# +# List of directories and their priorities to which the filesystem +# backend store writes images. +# +# The filesystem store can be configured to store images in multiple +# directories as opposed to using a single directory specified by the +# ``filesystem_store_datadir`` configuration option. When using +# multiple directories, each directory can be given an optional +# priority to specify the preference order in which they should +# be used. Priority is an integer that is concatenated to the +# directory path with a colon where a higher value indicates higher +# priority. When two directories have the same priority, the directory +# with most free space is used. When no priority is specified, it +# defaults to zero. +# +# More information on configuring filesystem store with multiple store +# directories can be found at +# http://docs.openstack.org/developer/glance/configuring.html +# +# NOTE: This directory is used only when filesystem store is used as a +# storage backend. Either ``filesystem_store_datadir`` or +# ``filesystem_store_datadirs`` option must be specified in +# ``glance-api.conf``. If both options are specified, a +# ``BadStoreConfiguration`` will be raised and the filesystem store +# may not be available for adding new images. +# +# Possible values: +# * List of strings of the following form: +# * ``:`` +# +# Related options: +# * ``filesystem_store_datadir`` +# * ``filesystem_store_file_perm`` +# +# (multi valued) +#filesystem_store_datadirs = + +# +# Filesystem store metadata file. +# +# The path to a file which contains the metadata to be returned with +# any location associated with the filesystem store. The file must +# contain a valid JSON object. The object should contain the keys +# ``id`` and ``mountpoint``. The value for both keys should be a +# string. +# +# Possible values: +# * A valid path to the store metadata file +# +# Related options: +# * None +# +# (string value) +#filesystem_store_metadata_file = + +# +# File access permissions for the image files. +# +# Set the intended file access permissions for image data. This provides +# a way to enable other services, e.g. Nova, to consume images directly +# from the filesystem store. The users running the services that are +# intended to be given access to could be made a member of the group +# that owns the files created. Assigning a value less then or equal to +# zero for this configuration option signifies that no changes be made +# to the default permissions. This value will be decoded as an octal +# digit. +# +# For more information, please refer the documentation at +# http://docs.openstack.org/developer/glance/configuring.html +# +# Possible values: +# * A valid file access permission +# * Zero +# * Any negative integer +# +# Related options: +# * None +# +# (integer value) +#filesystem_store_file_perm = 0 + +# +# Path to the CA bundle file. +# +# This configuration option enables the operator to use a custom +# Certificate Authority file to verify the remote server certificate. If +# this option is set, the ``https_insecure`` option will be ignored and +# the CA file specified will be used to authenticate the server +# certificate and establish a secure connection to the server. +# +# Possible values: +# * A valid path to a CA file +# +# Related options: +# * https_insecure +# +# (string value) +#https_ca_certificates_file = + +# +# Set verification of the remote server certificate. +# +# This configuration option takes in a boolean value to determine +# whether or not to verify the remote server certificate. If set to +# True, the remote server certificate is not verified. If the option is +# set to False, then the default CA truststore is used for verification. +# +# This option is ignored if ``https_ca_certificates_file`` is set. +# The remote server certificate will then be verified using the file +# specified using the ``https_ca_certificates_file`` option. +# +# Possible values: +# * True +# * False +# +# Related options: +# * https_ca_certificates_file +# +# (boolean value) +#https_insecure = true + +# +# The http/https proxy information to be used to connect to the remote +# server. +# +# This configuration option specifies the http/https proxy information +# that should be used to connect to the remote server. The proxy +# information should be a key value pair of the scheme and proxy, for +# example, http:10.0.0.1:3128. You can also specify proxies for multiple +# schemes by separating the key value pairs with a comma, for example, +# http:10.0.0.1:3128, https:10.0.0.1:1080. +# +# Possible values: +# * A comma separated list of scheme:proxy pairs as described above +# +# Related options: +# * None +# +# (dict value) +#http_proxy_information = + +# +# Size, in megabytes, to chunk RADOS images into. +# +# Provide an integer value representing the size in megabytes to chunk +# Glance images into. The default chunk size is 8 megabytes. For optimal +# performance, the value should be a power of two. +# +# When Ceph's RBD object storage system is used as the storage backend +# for storing Glance images, the images are chunked into objects of the +# size set using this option. These chunked objects are then stored +# across the distributed block data store to use for Glance. +# +# Possible Values: +# * Any positive integer value +# +# Related options: +# * None +# +# (integer value) +# Minimum value: 1 +#rbd_store_chunk_size = 8 + +# +# RADOS pool in which images are stored. +# +# When RBD is used as the storage backend for storing Glance images, the +# images are stored by means of logical grouping of the objects (chunks +# of images) into a ``pool``. Each pool is defined with the number of +# placement groups it can contain. The default pool that is used is +# 'images'. +# +# More information on the RBD storage backend can be found here: +# http://ceph.com/planet/how-data-is-stored-in-ceph-cluster/ +# +# Possible Values: +# * A valid pool name +# +# Related options: +# * None +# +# (string value) +#rbd_store_pool = images + +# +# RADOS user to authenticate as. +# +# This configuration option takes in the RADOS user to authenticate as. +# This is only needed when RADOS authentication is enabled and is +# applicable only if the user is using Cephx authentication. If the +# value for this option is not set by the user or is set to None, a +# default value will be chosen, which will be based on the client. +# section in rbd_store_ceph_conf. +# +# Possible Values: +# * A valid RADOS user +# +# Related options: +# * rbd_store_ceph_conf +# +# (string value) +#rbd_store_user = + +# +# Ceph configuration file path. +# +# This configuration option takes in the path to the Ceph configuration +# file to be used. If the value for this option is not set by the user +# or is set to None, librados will locate the default configuration file +# which is located at /etc/ceph/ceph.conf. If using Cephx +# authentication, this file should include a reference to the right +# keyring in a client. section +# +# Possible Values: +# * A valid path to a configuration file +# +# Related options: +# * rbd_store_user +# +# (string value) +#rbd_store_ceph_conf = /etc/ceph/ceph.conf + +# +# Timeout value for connecting to Ceph cluster. +# +# This configuration option takes in the timeout value in seconds used +# when connecting to the Ceph cluster i.e. it sets the time to wait for +# glance-api before closing the connection. This prevents glance-api +# hangups during the connection to RBD. If the value for this option +# is set to less than or equal to 0, no timeout is set and the default +# librados value is used. +# +# Possible Values: +# * Any integer value +# +# Related options: +# * None +# +# (integer value) +#rados_connect_timeout = 0 + +# +# Chunk size for images to be stored in Sheepdog data store. +# +# Provide an integer value representing the size in mebibyte +# (1048576 bytes) to chunk Glance images into. The default +# chunk size is 64 mebibytes. +# +# When using Sheepdog distributed storage system, the images are +# chunked into objects of this size and then stored across the +# distributed data store to use for Glance. +# +# Chunk sizes, if a power of two, help avoid fragmentation and +# enable improved performance. +# +# Possible values: +# * Positive integer value representing size in mebibytes. +# +# Related Options: +# * None +# +# (integer value) +# Minimum value: 1 +#sheepdog_store_chunk_size = 64 + +# +# Port number on which the sheep daemon will listen. +# +# Provide an integer value representing a valid port number on +# which you want the Sheepdog daemon to listen on. The default +# port is 7000. +# +# The Sheepdog daemon, also called 'sheep', manages the storage +# in the distributed cluster by writing objects across the storage +# network. It identifies and acts on the messages it receives on +# the port number set using ``sheepdog_store_port`` option to store +# chunks of Glance images. +# +# Possible values: +# * A valid port number (0 to 65535) +# +# Related Options: +# * sheepdog_store_address +# +# (port value) +# Minimum value: 0 +# Maximum value: 65535 +#sheepdog_store_port = 7000 + +# +# Address to bind the Sheepdog daemon to. +# +# Provide a string value representing the address to bind the +# Sheepdog daemon to. The default address set for the 'sheep' +# is 127.0.0.1. +# +# The Sheepdog daemon, also called 'sheep', manages the storage +# in the distributed cluster by writing objects across the storage +# network. It identifies and acts on the messages directed to the +# address set using ``sheepdog_store_address`` option to store +# chunks of Glance images. +# +# Possible values: +# * A valid IPv4 address +# * A valid IPv6 address +# * A valid hostname +# +# Related Options: +# * sheepdog_store_port +# +# (unknown value) +#sheepdog_store_address = 127.0.0.1 + +# +# Set verification of the server certificate. +# +# This boolean determines whether or not to verify the server +# certificate. If this option is set to True, swiftclient won't check +# for a valid SSL certificate when authenticating. If the option is set +# to False, then the default CA truststore is used for verification. +# +# Possible values: +# * True +# * False +# +# Related options: +# * swift_store_cacert +# +# (boolean value) +#swift_store_auth_insecure = false + +# +# Path to the CA bundle file. +# +# This configuration option enables the operator to specify the path to +# a custom Certificate Authority file for SSL verification when +# connecting to Swift. +# +# Possible values: +# * A valid path to a CA file +# +# Related options: +# * swift_store_auth_insecure +# +# (string value) +#swift_store_cacert = /etc/ssl/certs/ca-certificates.crt + +# +# The region of Swift endpoint to use by Glance. +# +# Provide a string value representing a Swift region where Glance +# can connect to for image storage. By default, there is no region +# set. +# +# When Glance uses Swift as the storage backend to store images +# for a specific tenant that has multiple endpoints, setting of a +# Swift region with ``swift_store_region`` allows Glance to connect +# to Swift in the specified region as opposed to a single region +# connectivity. +# +# This option can be configured for both single-tenant and +# multi-tenant storage. +# +# NOTE: Setting the region with ``swift_store_region`` is +# tenant-specific and is necessary ``only if`` the tenant has +# multiple endpoints across different regions. +# +# Possible values: +# * A string value representing a valid Swift region. +# +# Related Options: +# * None +# +# (string value) +#swift_store_region = RegionTwo + +# +# The URL endpoint to use for Swift backend storage. +# +# Provide a string value representing the URL endpoint to use for +# storing Glance images in Swift store. By default, an endpoint +# is not set and the storage URL returned by ``auth`` is used. +# Setting an endpoint with ``swift_store_endpoint`` overrides the +# storage URL and is used for Glance image storage. +# +# NOTE: The URL should include the path up to, but excluding the +# container. The location of an object is obtained by appending +# the container and object to the configured URL. +# +# Possible values: +# * String value representing a valid URL path up to a Swift container +# +# Related Options: +# * None +# +# (string value) +#swift_store_endpoint = https://swift.openstack.example.org/v1/path_not_including_container_name + +# +# Endpoint Type of Swift service. +# +# This string value indicates the endpoint type to use to fetch the +# Swift endpoint. The endpoint type determines the actions the user will +# be allowed to perform, for instance, reading and writing to the Store. +# This setting is only used if swift_store_auth_version is greater than +# 1. +# +# Possible values: +# * publicURL +# * adminURL +# * internalURL +# +# Related options: +# * swift_store_endpoint +# +# (string value) +# Possible values: +# publicURL - +# adminURL - +# internalURL - +#swift_store_endpoint_type = publicURL + +# +# Type of Swift service to use. +# +# Provide a string value representing the service type to use for +# storing images while using Swift backend storage. The default +# service type is set to ``object-store``. +# +# NOTE: If ``swift_store_auth_version`` is set to 2, the value for +# this configuration option needs to be ``object-store``. If using +# a higher version of Keystone or a different auth scheme, this +# option may be modified. +# +# Possible values: +# * A string representing a valid service type for Swift storage. +# +# Related Options: +# * None +# +# (string value) +#swift_store_service_type = object-store + +# +# Name of single container to store images/name prefix for multiple containers +# +# When a single container is being used to store images, this configuration +# option indicates the container within the Glance account to be used for +# storing all images. When multiple containers are used to store images, this +# will be the name prefix for all containers. Usage of single/multiple +# containers can be controlled using the configuration option +# ``swift_store_multiple_containers_seed``. +# +# When using multiple containers, the containers will be named after the value +# set for this configuration option with the first N chars of the image UUID +# as the suffix delimited by an underscore (where N is specified by +# ``swift_store_multiple_containers_seed``). +# +# Example: if the seed is set to 3 and swift_store_container = ``glance``, then +# an image with UUID ``fdae39a1-bac5-4238-aba4-69bcc726e848`` would be placed in +# the container ``glance_fda``. All dashes in the UUID are included when +# creating the container name but do not count toward the character limit, so +# when N=10 the container name would be ``glance_fdae39a1-ba.`` +# +# Possible values: +# * If using single container, this configuration option can be any string +# that is a valid swift container name in Glance's Swift account +# * If using multiple containers, this configuration option can be any +# string as long as it satisfies the container naming rules enforced by +# Swift. The value of ``swift_store_multiple_containers_seed`` should be +# taken into account as well. +# +# Related options: +# * ``swift_store_multiple_containers_seed`` +# * ``swift_store_multi_tenant`` +# * ``swift_store_create_container_on_put`` +# +# (string value) +#swift_store_container = glance + +# +# The size threshold, in MB, after which Glance will start segmenting image +# data. +# +# Swift has an upper limit on the size of a single uploaded object. By default, +# this is 5GB. To upload objects bigger than this limit, objects are segmented +# into multiple smaller objects that are tied together with a manifest file. +# For more detail, refer to +# http://docs.openstack.org/developer/swift/overview_large_objects.html +# +# This configuration option specifies the size threshold over which the Swift +# driver will start segmenting image data into multiple smaller files. +# Currently, the Swift driver only supports creating Dynamic Large Objects. +# +# NOTE: This should be set by taking into account the large object limit +# enforced by the Swift cluster in consideration. +# +# Possible values: +# * A positive integer that is less than or equal to the large object limit +# enforced by the Swift cluster in consideration. +# +# Related options: +# * ``swift_store_large_object_chunk_size`` +# +# (integer value) +# Minimum value: 1 +#swift_store_large_object_size = 5120 + +# +# The maximum size, in MB, of the segments when image data is segmented. +# +# When image data is segmented to upload images that are larger than the limit +# enforced by the Swift cluster, image data is broken into segments that are no +# bigger than the size specified by this configuration option. +# Refer to ``swift_store_large_object_size`` for more detail. +# +# For example: if ``swift_store_large_object_size`` is 5GB and +# ``swift_store_large_object_chunk_size`` is 1GB, an image of size 6.2GB will be +# segmented into 7 segments where the first six segments will be 1GB in size and +# the seventh segment will be 0.2GB. +# +# Possible values: +# * A positive integer that is less than or equal to the large object limit +# enforced by Swift cluster in consideration. +# +# Related options: +# * ``swift_store_large_object_size`` +# +# (integer value) +# Minimum value: 1 +#swift_store_large_object_chunk_size = 200 + +# +# Create container, if it doesn't already exist, when uploading image. +# +# At the time of uploading an image, if the corresponding container doesn't +# exist, it will be created provided this configuration option is set to True. +# By default, it won't be created. This behavior is applicable for both single +# and multiple containers mode. +# +# Possible values: +# * True +# * False +# +# Related options: +# * None +# +# (boolean value) +#swift_store_create_container_on_put = false + +# +# Store images in tenant's Swift account. +# +# This enables multi-tenant storage mode which causes Glance images to be stored +# in tenant specific Swift accounts. If this is disabled, Glance stores all +# images in its own account. More details multi-tenant store can be found at +# https://wiki.openstack.org/wiki/GlanceSwiftTenantSpecificStorage +# +# NOTE: If using multi-tenant swift store, please make sure +# that you do not set a swift configuration file with the +# 'swift_store_config_file' option. +# +# Possible values: +# * True +# * False +# +# Related options: +# * swift_store_config_file +# +# (boolean value) +#swift_store_multi_tenant = false + +# +# Seed indicating the number of containers to use for storing images. +# +# When using a single-tenant store, images can be stored in one or more than one +# containers. When set to 0, all images will be stored in one single container. +# When set to an integer value between 1 and 32, multiple containers will be +# used to store images. This configuration option will determine how many +# containers are created. The total number of containers that will be used is +# equal to 16^N, so if this config option is set to 2, then 16^2=256 containers +# will be used to store images. +# +# Please refer to ``swift_store_container`` for more detail on the naming +# convention. More detail about using multiple containers can be found at +# https://specs.openstack.org/openstack/glance-specs/specs/kilo/swift-store- +# multiple-containers.html +# +# NOTE: This is used only when swift_store_multi_tenant is disabled. +# +# Possible values: +# * A non-negative integer less than or equal to 32 +# +# Related options: +# * ``swift_store_container`` +# * ``swift_store_multi_tenant`` +# * ``swift_store_create_container_on_put`` +# +# (integer value) +# Minimum value: 0 +# Maximum value: 32 +#swift_store_multiple_containers_seed = 0 + +# +# List of tenants that will be granted admin access. +# +# This is a list of tenants that will be granted read/write access on +# all Swift containers created by Glance in multi-tenant mode. The +# default value is an empty list. +# +# Possible values: +# * A comma separated list of strings representing UUIDs of Keystone +# projects/tenants +# +# Related options: +# * None +# +# (list value) +#swift_store_admin_tenants = + +# +# SSL layer compression for HTTPS Swift requests. +# +# Provide a boolean value to determine whether or not to compress +# HTTPS Swift requests for images at the SSL layer. By default, +# compression is enabled. +# +# When using Swift as the backend store for Glance image storage, +# SSL layer compression of HTTPS Swift requests can be set using +# this option. If set to False, SSL layer compression of HTTPS +# Swift requests is disabled. Disabling this option may improve +# performance for images which are already in a compressed format, +# for example, qcow2. +# +# Possible values: +# * True +# * False +# +# Related Options: +# * None +# +# (boolean value) +#swift_store_ssl_compression = true + +# +# The number of times a Swift download will be retried before the +# request fails. +# +# Provide an integer value representing the number of times an image +# download must be retried before erroring out. The default value is +# zero (no retry on a failed image download). When set to a positive +# integer value, ``swift_store_retry_get_count`` ensures that the +# download is attempted this many more times upon a download failure +# before sending an error message. +# +# Possible values: +# * Zero +# * Positive integer value +# +# Related Options: +# * None +# +# (integer value) +# Minimum value: 0 +#swift_store_retry_get_count = 0 + +# +# Time in seconds defining the size of the window in which a new +# token may be requested before the current token is due to expire. +# +# Typically, the Swift storage driver fetches a new token upon the +# expiration of the current token to ensure continued access to +# Swift. However, some Swift transactions (like uploading image +# segments) may not recover well if the token expires on the fly. +# +# Hence, by fetching a new token before the current token expiration, +# we make sure that the token does not expire or is close to expiry +# before a transaction is attempted. By default, the Swift storage +# driver requests for a new token 60 seconds or less before the +# current token expiration. +# +# Possible values: +# * Zero +# * Positive integer value +# +# Related Options: +# * None +# +# (integer value) +# Minimum value: 0 +#swift_store_expire_soon_interval = 60 + +# +# Use trusts for multi-tenant Swift store. +# +# This option instructs the Swift store to create a trust for each +# add/get request when the multi-tenant store is in use. Using trusts +# allows the Swift store to avoid problems that can be caused by an +# authentication token expiring during the upload or download of data. +# +# By default, ``swift_store_use_trusts`` is set to ``True``(use of +# trusts is enabled). If set to ``False``, a user token is used for +# the Swift connection instead, eliminating the overhead of trust +# creation. +# +# NOTE: This option is considered only when +# ``swift_store_multi_tenant`` is set to ``True`` +# +# Possible values: +# * True +# * False +# +# Related options: +# * swift_store_multi_tenant +# +# (boolean value) +#swift_store_use_trusts = true + +# +# Buffer image segments before upload to Swift. +# +# Provide a boolean value to indicate whether or not Glance should +# buffer image data to disk while uploading to swift. This enables +# Glance to resume uploads on error. +# +# NOTES: +# When enabling this option, one should take great care as this +# increases disk usage on the API node. Be aware that depending +# upon how the file system is configured, the disk space used +# for buffering may decrease the actual disk space available for +# the glance image cache. Disk utilization will cap according to +# the following equation: +# (``swift_store_large_object_chunk_size`` * ``workers`` * 1000) +# +# Possible values: +# * True +# * False +# +# Related options: +# * swift_upload_buffer_dir +# +# (boolean value) +#swift_buffer_on_upload = false + +# +# Reference to default Swift account/backing store parameters. +# +# Provide a string value representing a reference to the default set +# of parameters required for using swift account/backing store for +# image storage. The default reference value for this configuration +# option is 'ref1'. This configuration option dereferences the +# parameters and facilitates image storage in Swift storage backend +# every time a new image is added. +# +# Possible values: +# * A valid string value +# +# Related options: +# * None +# +# (string value) +#default_swift_reference = ref1 + +# DEPRECATED: Version of the authentication service to use. Valid versions are 2 +# and 3 for keystone and 1 (deprecated) for swauth and rackspace. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: +# The option 'auth_version' in the Swift back-end configuration file is +# used instead. +#swift_store_auth_version = 2 + +# DEPRECATED: The address where the Swift authentication service is listening. +# (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: +# The option 'auth_address' in the Swift back-end configuration file is +# used instead. +#swift_store_auth_address = + +# DEPRECATED: The user to authenticate against the Swift authentication service. +# (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: +# The option 'user' in the Swift back-end configuration file is set instead. +#swift_store_user = + +# DEPRECATED: Auth key for the user authenticating against the Swift +# authentication service. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: +# The option 'key' in the Swift back-end configuration file is used +# to set the authentication key instead. +#swift_store_key = + +# +# Absolute path to the file containing the swift account(s) +# configurations. +# +# Include a string value representing the path to a configuration +# file that has references for each of the configured Swift +# account(s)/backing stores. By default, no file path is specified +# and customized Swift referencing is disabled. Configuring this +# option is highly recommended while using Swift storage backend for +# image storage as it avoids storage of credentials in the database. +# +# NOTE: Please do not configure this option if you have set +# ``swift_store_multi_tenant`` to ``True``. +# +# Possible values: +# * String value representing an absolute path on the glance-api +# node +# +# Related options: +# * swift_store_multi_tenant +# +# (string value) +#swift_store_config_file = + +# +# Directory to buffer image segments before upload to Swift. +# +# Provide a string value representing the absolute path to the +# directory on the glance node where image segments will be +# buffered briefly before they are uploaded to swift. +# +# NOTES: +# * This is required only when the configuration option +# ``swift_buffer_on_upload`` is set to True. +# * This directory should be provisioned keeping in mind the +# ``swift_store_large_object_chunk_size`` and the maximum +# number of images that could be uploaded simultaneously by +# a given glance node. +# +# Possible values: +# * String value representing an absolute directory path +# +# Related options: +# * swift_buffer_on_upload +# * swift_store_large_object_chunk_size +# +# (string value) +#swift_upload_buffer_dir = + +# +# Address of the ESX/ESXi or vCenter Server target system. +# +# This configuration option sets the address of the ESX/ESXi or vCenter +# Server target system. This option is required when using the VMware +# storage backend. The address can contain an IP address (127.0.0.1) or +# a DNS name (www.my-domain.com). +# +# Possible Values: +# * A valid IPv4 or IPv6 address +# * A valid DNS name +# +# Related options: +# * vmware_server_username +# * vmware_server_password +# +# (unknown value) +#vmware_server_host = 127.0.0.1 + +# +# Server username. +# +# This configuration option takes the username for authenticating with +# the VMware ESX/ESXi or vCenter Server. This option is required when +# using the VMware storage backend. +# +# Possible Values: +# * Any string that is the username for a user with appropriate +# privileges +# +# Related options: +# * vmware_server_host +# * vmware_server_password +# +# (string value) +#vmware_server_username = root + +# +# Server password. +# +# This configuration option takes the password for authenticating with +# the VMware ESX/ESXi or vCenter Server. This option is required when +# using the VMware storage backend. +# +# Possible Values: +# * Any string that is a password corresponding to the username +# specified using the "vmware_server_username" option +# +# Related options: +# * vmware_server_host +# * vmware_server_username +# +# (string value) +#vmware_server_password = vmware + +# +# The number of VMware API retries. +# +# This configuration option specifies the number of times the VMware +# ESX/VC server API must be retried upon connection related issues or +# server API call overload. It is not possible to specify 'retry +# forever'. +# +# Possible Values: +# * Any positive integer value +# +# Related options: +# * None +# +# (integer value) +# Minimum value: 1 +#vmware_api_retry_count = 10 + +# +# Interval in seconds used for polling remote tasks invoked on VMware +# ESX/VC server. +# +# This configuration option takes in the sleep time in seconds for polling an +# on-going async task as part of the VMWare ESX/VC server API call. +# +# Possible Values: +# * Any positive integer value +# +# Related options: +# * None +# +# (integer value) +# Minimum value: 1 +#vmware_task_poll_interval = 5 + +# +# The directory where the glance images will be stored in the datastore. +# +# This configuration option specifies the path to the directory where the +# glance images will be stored in the VMware datastore. If this option +# is not set, the default directory where the glance images are stored +# is openstack_glance. +# +# Possible Values: +# * Any string that is a valid path to a directory +# +# Related options: +# * None +# +# (string value) +#vmware_store_image_dir = /openstack_glance + +# +# Set verification of the ESX/vCenter server certificate. +# +# This configuration option takes a boolean value to determine +# whether or not to verify the ESX/vCenter server certificate. If this +# option is set to True, the ESX/vCenter server certificate is not +# verified. If this option is set to False, then the default CA +# truststore is used for verification. +# +# This option is ignored if the "vmware_ca_file" option is set. In that +# case, the ESX/vCenter server certificate will then be verified using +# the file specified using the "vmware_ca_file" option . +# +# Possible Values: +# * True +# * False +# +# Related options: +# * vmware_ca_file +# +# (boolean value) +# Deprecated group/name - [glance_store]/vmware_api_insecure +#vmware_insecure = false + +# +# Absolute path to the CA bundle file. +# +# This configuration option enables the operator to use a custom +# Cerificate Authority File to verify the ESX/vCenter certificate. +# +# If this option is set, the "vmware_insecure" option will be ignored +# and the CA file specified will be used to authenticate the ESX/vCenter +# server certificate and establish a secure connection to the server. +# +# Possible Values: +# * Any string that is a valid absolute path to a CA file +# +# Related options: +# * vmware_insecure +# +# (string value) +#vmware_ca_file = /etc/ssl/certs/ca-certificates.crt + +# +# The datastores where the image can be stored. +# +# This configuration option specifies the datastores where the image can +# be stored in the VMWare store backend. This option may be specified +# multiple times for specifying multiple datastores. The datastore name +# should be specified after its datacenter path, separated by ":". An +# optional weight may be given after the datastore name, separated again +# by ":" to specify the priority. Thus, the required format becomes +# ::. +# +# When adding an image, the datastore with highest weight will be +# selected, unless there is not enough free space available in cases +# where the image size is already known. If no weight is given, it is +# assumed to be zero and the directory will be considered for selection +# last. If multiple datastores have the same weight, then the one with +# the most free space available is selected. +# +# Possible Values: +# * Any string of the format: +# :: +# +# Related options: +# * None +# +# (multi valued) +#vmware_datastores = + + +[image_format] + +# +# From glance.api +# + +# Supported values for the 'container_format' image attribute (list value) +# Deprecated group/name - [DEFAULT]/container_formats +#container_formats = ami,ari,aki,bare,ovf,ova,docker + +# Supported values for the 'disk_format' image attribute (list value) +# Deprecated group/name - [DEFAULT]/disk_formats +disk_formats = ami,ari,aki,vhd,vhdx,vmdk,raw,qcow2,vdi,iso,ploop.root-tar + + +[keystone_authtoken] +password = glance_user_secret +username = glance +project_name = service +user_domain_name = default +project_domain_name = default +auth_type = password +memcached_servers = controller:11211 +auth_url = http://controller:5000 +auth_uri = http://controller:5000 + +# +# From keystonemiddleware.auth_token +# + +# Complete "public" Identity API endpoint. This endpoint should not be an +# "admin" endpoint, as it should be accessible by all end users. Unauthenticated +# clients are redirected to this endpoint to authenticate. Although this +# endpoint should ideally be unversioned, client support in the wild varies. If +# you're using a versioned v2 endpoint here, then this should *not* be the same +# endpoint the service user utilizes for validating tokens, because normal end +# users may not be able to reach that endpoint. (string value) +# Deprecated group/name - [keystone_authtoken]/auth_uri +#www_authenticate_uri = + +# DEPRECATED: Complete "public" Identity API endpoint. This endpoint should not +# be an "admin" endpoint, as it should be accessible by all end users. +# Unauthenticated clients are redirected to this endpoint to authenticate. +# Although this endpoint should ideally be unversioned, client support in the +# wild varies. If you're using a versioned v2 endpoint here, then this should +# *not* be the same endpoint the service user utilizes for validating tokens, +# because normal end users may not be able to reach that endpoint. This option +# is deprecated in favor of www_authenticate_uri and will be removed in the S +# release. (string value) +# This option is deprecated for removal since Queens. +# Its value may be silently ignored in the future. +# Reason: The auth_uri option is deprecated in favor of www_authenticate_uri and +# will be removed in the S release. +#auth_uri = + +# API version of the admin Identity API endpoint. (string value) +#auth_version = + +# Do not handle authorization requests within the middleware, but delegate the +# authorization decision to downstream WSGI components. (boolean value) +#delay_auth_decision = false + +# Request timeout value for communicating with Identity API server. (integer +# value) +#http_connect_timeout = + +# How many times are we trying to reconnect when communicating with Identity API +# Server. (integer value) +#http_request_max_retries = 3 + +# Request environment key where the Swift cache object is stored. When +# auth_token middleware is deployed with a Swift cache, use this option to have +# the middleware share a caching backend with swift. Otherwise, use the +# ``memcached_servers`` option instead. (string value) +#cache = + +# Required if identity server requires client certificate (string value) +#certfile = + +# Required if identity server requires client certificate (string value) +#keyfile = + +# A PEM encoded Certificate Authority to use when verifying HTTPs connections. +# Defaults to system CAs. (string value) +#cafile = + +# Verify HTTPS connections. (boolean value) +#insecure = false + +# The region in which the identity server can be found. (string value) +#region_name = + +# DEPRECATED: Directory used to cache files related to PKI tokens. This option +# has been deprecated in the Ocata release and will be removed in the P release. +# (string value) +# This option is deprecated for removal since Ocata. +# Its value may be silently ignored in the future. +# Reason: PKI token format is no longer supported. +#signing_dir = + +# Optionally specify a list of memcached server(s) to use for caching. If left +# undefined, tokens will instead be cached in-process. (list value) +# Deprecated group/name - [keystone_authtoken]/memcache_servers +#memcached_servers = + +# In order to prevent excessive effort spent validating tokens, the middleware +# caches previously-seen tokens for a configurable duration (in seconds). Set to +# -1 to disable caching completely. (integer value) +#token_cache_time = 300 + +# DEPRECATED: Determines the frequency at which the list of revoked tokens is +# retrieved from the Identity service (in seconds). A high number of revocation +# events combined with a low cache duration may significantly reduce +# performance. Only valid for PKI tokens. This option has been deprecated in the +# Ocata release and will be removed in the P release. (integer value) +# This option is deprecated for removal since Ocata. +# Its value may be silently ignored in the future. +# Reason: PKI token format is no longer supported. +#revocation_cache_time = 10 + +# (Optional) If defined, indicate whether token data should be authenticated or +# authenticated and encrypted. If MAC, token data is authenticated (with HMAC) +# in the cache. If ENCRYPT, token data is encrypted and authenticated in the +# cache. If the value is not one of these options or empty, auth_token will +# raise an exception on initialization. (string value) +# Possible values: +# None - +# MAC - +# ENCRYPT - +#memcache_security_strategy = None + +# (Optional, mandatory if memcache_security_strategy is defined) This string is +# used for key derivation. (string value) +#memcache_secret_key = + +# (Optional) Number of seconds memcached server is considered dead before it is +# tried again. (integer value) +#memcache_pool_dead_retry = 300 + +# (Optional) Maximum total number of open connections to every memcached server. +# (integer value) +#memcache_pool_maxsize = 10 + +# (Optional) Socket timeout in seconds for communicating with a memcached +# server. (integer value) +#memcache_pool_socket_timeout = 3 + +# (Optional) Number of seconds a connection to memcached is held unused in the +# pool before it is closed. (integer value) +#memcache_pool_unused_timeout = 60 + +# (Optional) Number of seconds that an operation will wait to get a memcached +# client connection from the pool. (integer value) +#memcache_pool_conn_get_timeout = 10 + +# (Optional) Use the advanced (eventlet safe) memcached client pool. The +# advanced pool will only work under python 2.x. (boolean value) +#memcache_use_advanced_pool = false + +# (Optional) Indicate whether to set the X-Service-Catalog header. If False, +# middleware will not ask for service catalog on token validation and will not +# set the X-Service-Catalog header. (boolean value) +#include_service_catalog = true + +# Used to control the use and type of token binding. Can be set to: "disabled" +# to not check token binding. "permissive" (default) to validate binding +# information if the bind type is of a form known to the server and ignore it if +# not. "strict" like "permissive" but if the bind type is unknown the token will +# be rejected. "required" any form of token binding is needed to be allowed. +# Finally the name of a binding method that must be present in tokens. (string +# value) +#enforce_token_bind = permissive + +# DEPRECATED: If true, the revocation list will be checked for cached tokens. +# This requires that PKI tokens are configured on the identity server. (boolean +# value) +# This option is deprecated for removal since Ocata. +# Its value may be silently ignored in the future. +# Reason: PKI token format is no longer supported. +#check_revocations_for_cached = false + +# DEPRECATED: Hash algorithms to use for hashing PKI tokens. This may be a +# single algorithm or multiple. The algorithms are those supported by Python +# standard hashlib.new(). The hashes will be tried in the order given, so put +# the preferred one first for performance. The result of the first hash will be +# stored in the cache. This will typically be set to multiple values only while +# migrating from a less secure algorithm to a more secure one. Once all the old +# tokens are expired this option should be set to a single value for better +# performance. (list value) +# This option is deprecated for removal since Ocata. +# Its value may be silently ignored in the future. +# Reason: PKI token format is no longer supported. +#hash_algorithms = md5 + +# A choice of roles that must be present in a service token. Service tokens are +# allowed to request that an expired token can be used and so this check should +# tightly control that only actual services should be sending this token. Roles +# here are applied as an ANY check so any role in this list must be present. For +# backwards compatibility reasons this currently only affects the allow_expired +# check. (list value) +#service_token_roles = service + +# For backwards compatibility reasons we must let valid service tokens pass that +# don't pass the service_token_roles check as valid. Setting this true will +# become the default in a future release and should be enabled if possible. +# (boolean value) +#service_token_roles_required = false + +# Authentication type to load (string value) +# Deprecated group/name - [keystone_authtoken]/auth_plugin +#auth_type = + +# Config Section from which to load plugin specific options (string value) +#auth_section = + + +[matchmaker_redis] + +# +# From oslo.messaging +# + +# DEPRECATED: Host to locate redis. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#host = 127.0.0.1 + +# DEPRECATED: Use this port to connect to redis host. (port value) +# Minimum value: 0 +# Maximum value: 65535 +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#port = 6379 + +# DEPRECATED: Password for Redis server (optional). (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#password = + +# DEPRECATED: List of Redis Sentinel hosts (fault tolerance mode), e.g., +# [host:port, host1:port ... ] (list value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#sentinel_hosts = + +# Redis replica set name. (string value) +#sentinel_group_name = oslo-messaging-zeromq + +# Time in ms to wait between connection attempts. (integer value) +#wait_timeout = 2000 + +# Time in ms to wait before the transaction is killed. (integer value) +#check_timeout = 20000 + +# Timeout in ms on blocking socket operations. (integer value) +#socket_timeout = 10000 + + +[oslo_concurrency] + +# +# From oslo.concurrency +# + +# Enables or disables inter-process locks. (boolean value) +#disable_process_locking = false + +# Directory to use for lock files. For security, the specified directory should +# only be writable by the user running the processes that need locking. Defaults +# to environment variable OSLO_LOCK_PATH. If external locks are used, a lock +# path must be set. (string value) +#lock_path = + + +[oslo_messaging_amqp] + +# +# From oslo.messaging +# + +# Name for the AMQP container. must be globally unique. Defaults to a generated +# UUID (string value) +#container_name = + +# Timeout for inactive connections (in seconds) (integer value) +#idle_timeout = 0 + +# Debug: dump AMQP frames to stdout (boolean value) +#trace = false + +# Attempt to connect via SSL. If no other ssl-related parameters are given, it +# will use the system's CA-bundle to verify the server's certificate. (boolean +# value) +#ssl = false + +# CA certificate PEM file used to verify the server's certificate (string value) +#ssl_ca_file = + +# Self-identifying certificate PEM file for client authentication (string value) +#ssl_cert_file = + +# Private key PEM file used to sign ssl_cert_file certificate (optional) (string +# value) +#ssl_key_file = + +# Password for decrypting ssl_key_file (if encrypted) (string value) +#ssl_key_password = + +# By default SSL checks that the name in the server's certificate matches the +# hostname in the transport_url. In some configurations it may be preferable to +# use the virtual hostname instead, for example if the server uses the Server +# Name Indication TLS extension (rfc6066) to provide a certificate per virtual +# host. Set ssl_verify_vhost to True if the server's SSL certificate uses the +# virtual host name instead of the DNS name. (boolean value) +#ssl_verify_vhost = false + +# DEPRECATED: Accept clients using either SSL or plain TCP (boolean value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Not applicable - not a SSL server +#allow_insecure_clients = false + +# Space separated list of acceptable SASL mechanisms (string value) +#sasl_mechanisms = + +# Path to directory that contains the SASL configuration (string value) +#sasl_config_dir = + +# Name of configuration file (without .conf suffix) (string value) +#sasl_config_name = + +# SASL realm to use if no realm present in username (string value) +#sasl_default_realm = + +# DEPRECATED: User name for message broker authentication (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Should use configuration option transport_url to provide the username. +#username = + +# DEPRECATED: Password for message broker authentication (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Should use configuration option transport_url to provide the password. +#password = + +# Seconds to pause before attempting to re-connect. (integer value) +# Minimum value: 1 +#connection_retry_interval = 1 + +# Increase the connection_retry_interval by this many seconds after each +# unsuccessful failover attempt. (integer value) +# Minimum value: 0 +#connection_retry_backoff = 2 + +# Maximum limit for connection_retry_interval + connection_retry_backoff +# (integer value) +# Minimum value: 1 +#connection_retry_interval_max = 30 + +# Time to pause between re-connecting an AMQP 1.0 link that failed due to a +# recoverable error. (integer value) +# Minimum value: 1 +#link_retry_delay = 10 + +# The maximum number of attempts to re-send a reply message which failed due to +# a recoverable error. (integer value) +# Minimum value: -1 +#default_reply_retry = 0 + +# The deadline for an rpc reply message delivery. (integer value) +# Minimum value: 5 +#default_reply_timeout = 30 + +# The deadline for an rpc cast or call message delivery. Only used when caller +# does not provide a timeout expiry. (integer value) +# Minimum value: 5 +#default_send_timeout = 30 + +# The deadline for a sent notification message delivery. Only used when caller +# does not provide a timeout expiry. (integer value) +# Minimum value: 5 +#default_notify_timeout = 30 + +# The duration to schedule a purge of idle sender links. Detach link after +# expiry. (integer value) +# Minimum value: 1 +#default_sender_link_timeout = 600 + +# Indicates the addressing mode used by the driver. +# Permitted values: +# 'legacy' - use legacy non-routable addressing +# 'routable' - use routable addresses +# 'dynamic' - use legacy addresses if the message bus does not support routing +# otherwise use routable addressing (string value) +#addressing_mode = dynamic + +# Enable virtual host support for those message buses that do not natively +# support virtual hosting (such as qpidd). When set to true the virtual host +# name will be added to all message bus addresses, effectively creating a +# private 'subnet' per virtual host. Set to False if the message bus supports +# virtual hosting using the 'hostname' field in the AMQP 1.0 Open performative +# as the name of the virtual host. (boolean value) +#pseudo_vhost = true + +# address prefix used when sending to a specific server (string value) +#server_request_prefix = exclusive + +# address prefix used when broadcasting to all servers (string value) +#broadcast_prefix = broadcast + +# address prefix when sending to any server in group (string value) +#group_request_prefix = unicast + +# Address prefix for all generated RPC addresses (string value) +#rpc_address_prefix = openstack.org/om/rpc + +# Address prefix for all generated Notification addresses (string value) +#notify_address_prefix = openstack.org/om/notify + +# Appended to the address prefix when sending a fanout message. Used by the +# message bus to identify fanout messages. (string value) +#multicast_address = multicast + +# Appended to the address prefix when sending to a particular RPC/Notification +# server. Used by the message bus to identify messages sent to a single +# destination. (string value) +#unicast_address = unicast + +# Appended to the address prefix when sending to a group of consumers. Used by +# the message bus to identify messages that should be delivered in a round-robin +# fashion across consumers. (string value) +#anycast_address = anycast + +# Exchange name used in notification addresses. +# Exchange name resolution precedence: +# Target.exchange if set +# else default_notification_exchange if set +# else control_exchange if set +# else 'notify' (string value) +#default_notification_exchange = + +# Exchange name used in RPC addresses. +# Exchange name resolution precedence: +# Target.exchange if set +# else default_rpc_exchange if set +# else control_exchange if set +# else 'rpc' (string value) +#default_rpc_exchange = + +# Window size for incoming RPC Reply messages. (integer value) +# Minimum value: 1 +#reply_link_credit = 200 + +# Window size for incoming RPC Request messages (integer value) +# Minimum value: 1 +#rpc_server_credit = 100 + +# Window size for incoming Notification messages (integer value) +# Minimum value: 1 +#notify_server_credit = 100 + +# Send messages of this type pre-settled. +# Pre-settled messages will not receive acknowledgement +# from the peer. Note well: pre-settled messages may be +# silently discarded if the delivery fails. +# Permitted values: +# 'rpc-call' - send RPC Calls pre-settled +# 'rpc-reply'- send RPC Replies pre-settled +# 'rpc-cast' - Send RPC Casts pre-settled +# 'notify' - Send Notifications pre-settled +# (multi valued) +#pre_settled = rpc-cast +#pre_settled = rpc-reply + + +[oslo_messaging_kafka] + +# +# From oslo.messaging +# + +# DEPRECATED: Default Kafka broker Host (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#kafka_default_host = localhost + +# DEPRECATED: Default Kafka broker Port (port value) +# Minimum value: 0 +# Maximum value: 65535 +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#kafka_default_port = 9092 + +# Max fetch bytes of Kafka consumer (integer value) +#kafka_max_fetch_bytes = 1048576 + +# Default timeout(s) for Kafka consumers (floating point value) +#kafka_consumer_timeout = 1.0 + +# DEPRECATED: Pool Size for Kafka Consumers (integer value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Driver no longer uses connection pool. +#pool_size = 10 + +# DEPRECATED: The pool size limit for connections expiration policy (integer +# value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Driver no longer uses connection pool. +#conn_pool_min_size = 2 + +# DEPRECATED: The time-to-live in sec of idle connections in the pool (integer +# value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Driver no longer uses connection pool. +#conn_pool_ttl = 1200 + +# Group id for Kafka consumer. Consumers in one group will coordinate message +# consumption (string value) +#consumer_group = oslo_messaging_consumer + +# Upper bound on the delay for KafkaProducer batching in seconds (floating point +# value) +#producer_batch_timeout = 0.0 + +# Size of batch for the producer async send (integer value) +#producer_batch_size = 16384 + + +[oslo_messaging_notifications] + +# +# From oslo.messaging +# + +# The Drivers(s) to handle sending notifications. Possible values are messaging, +# messagingv2, routing, log, test, noop (multi valued) +# Deprecated group/name - [DEFAULT]/notification_driver +#driver = + +# A URL representing the messaging driver to use for notifications. If not set, +# we fall back to the same configuration used for RPC. (string value) +# Deprecated group/name - [DEFAULT]/notification_transport_url +#transport_url = + +# AMQP topic used for OpenStack notifications. (list value) +# Deprecated group/name - [rpc_notifier2]/topics +# Deprecated group/name - [DEFAULT]/notification_topics +#topics = notifications + +# The maximum number of attempts to re-send a notification message which failed +# to be delivered due to a recoverable error. 0 - No retry, -1 - indefinite +# (integer value) +#retry = -1 + + +[oslo_messaging_rabbit] + +# +# From oslo.messaging +# + +# Use durable queues in AMQP. (boolean value) +# Deprecated group/name - [DEFAULT]/amqp_durable_queues +# Deprecated group/name - [DEFAULT]/rabbit_durable_queues +#amqp_durable_queues = false + +# Auto-delete queues in AMQP. (boolean value) +#amqp_auto_delete = false + +# Enable SSL (boolean value) +#ssl = + +# SSL version to use (valid only if SSL enabled). Valid values are TLSv1 and +# SSLv23. SSLv2, SSLv3, TLSv1_1, and TLSv1_2 may be available on some +# distributions. (string value) +# Deprecated group/name - [oslo_messaging_rabbit]/kombu_ssl_version +#ssl_version = + +# SSL key file (valid only if SSL enabled). (string value) +# Deprecated group/name - [oslo_messaging_rabbit]/kombu_ssl_keyfile +#ssl_key_file = + +# SSL cert file (valid only if SSL enabled). (string value) +# Deprecated group/name - [oslo_messaging_rabbit]/kombu_ssl_certfile +#ssl_cert_file = + +# SSL certification authority file (valid only if SSL enabled). (string value) +# Deprecated group/name - [oslo_messaging_rabbit]/kombu_ssl_ca_certs +#ssl_ca_file = + +# How long to wait before reconnecting in response to an AMQP consumer cancel +# notification. (floating point value) +#kombu_reconnect_delay = 1.0 + +# EXPERIMENTAL: Possible values are: gzip, bz2. If not set compression will not +# be used. This option may not be available in future versions. (string value) +#kombu_compression = + +# How long to wait a missing client before abandoning to send it its replies. +# This value should not be longer than rpc_response_timeout. (integer value) +# Deprecated group/name - [oslo_messaging_rabbit]/kombu_reconnect_timeout +#kombu_missing_consumer_retry_timeout = 60 + +# Determines how the next RabbitMQ node is chosen in case the one we are +# currently connected to becomes unavailable. Takes effect only if more than one +# RabbitMQ node is provided in config. (string value) +# Possible values: +# round-robin - +# shuffle - +#kombu_failover_strategy = round-robin + +# DEPRECATED: The RabbitMQ broker address where a single node is used. (string +# value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#rabbit_host = localhost + +# DEPRECATED: The RabbitMQ broker port where a single node is used. (port value) +# Minimum value: 0 +# Maximum value: 65535 +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#rabbit_port = 5672 + +# DEPRECATED: RabbitMQ HA cluster host:port pairs. (list value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#rabbit_hosts = $rabbit_host:$rabbit_port + +# DEPRECATED: The RabbitMQ userid. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#rabbit_userid = guest + +# DEPRECATED: The RabbitMQ password. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#rabbit_password = guest + +# The RabbitMQ login method. (string value) +# Possible values: +# PLAIN - +# AMQPLAIN - +# RABBIT-CR-DEMO - +#rabbit_login_method = AMQPLAIN + +# DEPRECATED: The RabbitMQ virtual host. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#rabbit_virtual_host = / + +# How frequently to retry connecting with RabbitMQ. (integer value) +#rabbit_retry_interval = 1 + +# How long to backoff for between retries when connecting to RabbitMQ. (integer +# value) +#rabbit_retry_backoff = 2 + +# Maximum interval of RabbitMQ connection retries. Default is 30 seconds. +# (integer value) +#rabbit_interval_max = 30 + +# DEPRECATED: Maximum number of RabbitMQ connection retries. Default is 0 +# (infinite retry count). (integer value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +#rabbit_max_retries = 0 + +# Try to use HA queues in RabbitMQ (x-ha-policy: all). If you change this +# option, you must wipe the RabbitMQ database. In RabbitMQ 3.0, queue mirroring +# is no longer controlled by the x-ha-policy argument when declaring a queue. If +# you just want to make sure that all queues (except those with auto-generated +# names) are mirrored across all nodes, run: "rabbitmqctl set_policy HA +# '^(?!amq\.).*' '{"ha-mode": "all"}' " (boolean value) +#rabbit_ha_queues = false + +# Positive integer representing duration in seconds for queue TTL (x-expires). +# Queues which are unused for the duration of the TTL are automatically deleted. +# The parameter affects only reply and fanout queues. (integer value) +# Minimum value: 1 +#rabbit_transient_queues_ttl = 1800 + +# Specifies the number of messages to prefetch. Setting to zero allows unlimited +# messages. (integer value) +#rabbit_qos_prefetch_count = 0 + +# Number of seconds after which the Rabbit broker is considered down if +# heartbeat's keep-alive fails (0 disable the heartbeat). EXPERIMENTAL (integer +# value) +#heartbeat_timeout_threshold = 60 + +# How often times during the heartbeat_timeout_threshold we check the heartbeat. +# (integer value) +#heartbeat_rate = 2 + +# Deprecated, use rpc_backend=kombu+memory or rpc_backend=fake (boolean value) +#fake_rabbit = false + +# Maximum number of channels to allow (integer value) +#channel_max = + +# The maximum byte size for an AMQP frame (integer value) +#frame_max = + +# How often to send heartbeats for consumer's connections (integer value) +#heartbeat_interval = 3 + +# Arguments passed to ssl.wrap_socket (dict value) +#ssl_options = + +# Set socket timeout in seconds for connection's socket (floating point value) +#socket_timeout = 0.25 + +# Set TCP_USER_TIMEOUT in seconds for connection's socket (floating point value) +#tcp_user_timeout = 0.25 + +# Set delay for reconnection to some host which has connection error (floating +# point value) +#host_connection_reconnect_delay = 0.25 + +# Connection factory implementation (string value) +# Possible values: +# new - +# single - +# read_write - +#connection_factory = single + +# Maximum number of connections to keep queued. (integer value) +#pool_max_size = 30 + +# Maximum number of connections to create above `pool_max_size`. (integer value) +#pool_max_overflow = 0 + +# Default number of seconds to wait for a connections to available (integer +# value) +#pool_timeout = 30 + +# Lifetime of a connection (since creation) in seconds or None for no recycling. +# Expired connections are closed on acquire. (integer value) +#pool_recycle = 600 + +# Threshold at which inactive (since release) connections are considered stale +# in seconds or None for no staleness. Stale connections are closed on acquire. +# (integer value) +#pool_stale = 60 + +# Default serialization mechanism for serializing/deserializing +# outgoing/incoming messages (string value) +# Possible values: +# json - +# msgpack - +#default_serializer_type = json + +# Persist notification messages. (boolean value) +#notification_persistence = false + +# Exchange name for sending notifications (string value) +#default_notification_exchange = ${control_exchange}_notification + +# Max number of not acknowledged message which RabbitMQ can send to notification +# listener. (integer value) +#notification_listener_prefetch_count = 100 + +# Reconnecting retry count in case of connectivity problem during sending +# notification, -1 means infinite retry. (integer value) +#default_notification_retry_attempts = -1 + +# Reconnecting retry delay in case of connectivity problem during sending +# notification message (floating point value) +#notification_retry_delay = 0.25 + +# Time to live for rpc queues without consumers in seconds. (integer value) +#rpc_queue_expiration = 60 + +# Exchange name for sending RPC messages (string value) +#default_rpc_exchange = ${control_exchange}_rpc + +# Exchange name for receiving RPC replies (string value) +#rpc_reply_exchange = ${control_exchange}_rpc_reply + +# Max number of not acknowledged message which RabbitMQ can send to rpc +# listener. (integer value) +#rpc_listener_prefetch_count = 100 + +# Max number of not acknowledged message which RabbitMQ can send to rpc reply +# listener. (integer value) +#rpc_reply_listener_prefetch_count = 100 + +# Reconnecting retry count in case of connectivity problem during sending reply. +# -1 means infinite retry during rpc_timeout (integer value) +#rpc_reply_retry_attempts = -1 + +# Reconnecting retry delay in case of connectivity problem during sending reply. +# (floating point value) +#rpc_reply_retry_delay = 0.25 + +# Reconnecting retry count in case of connectivity problem during sending RPC +# message, -1 means infinite retry. If actual retry attempts in not 0 the rpc +# request could be processed more than one time (integer value) +#default_rpc_retry_attempts = -1 + +# Reconnecting retry delay in case of connectivity problem during sending RPC +# message (floating point value) +#rpc_retry_delay = 0.25 + + +[oslo_messaging_zmq] + +# +# From oslo.messaging +# + +# ZeroMQ bind address. Should be a wildcard (*), an ethernet interface, or IP. +# The "host" option should point or resolve to this address. (string value) +#rpc_zmq_bind_address = * + +# MatchMaker driver. (string value) +# Possible values: +# redis - +# sentinel - +# dummy - +#rpc_zmq_matchmaker = redis + +# Number of ZeroMQ contexts, defaults to 1. (integer value) +#rpc_zmq_contexts = 1 + +# Maximum number of ingress messages to locally buffer per topic. Default is +# unlimited. (integer value) +#rpc_zmq_topic_backlog = + +# Directory for holding IPC sockets. (string value) +#rpc_zmq_ipc_dir = /var/run/openstack + +# Name of this node. Must be a valid hostname, FQDN, or IP address. Must match +# "host" option, if running Nova. (string value) +#rpc_zmq_host = localhost + +# Number of seconds to wait before all pending messages will be sent after +# closing a socket. The default value of -1 specifies an infinite linger period. +# The value of 0 specifies no linger period. Pending messages shall be discarded +# immediately when the socket is closed. Positive values specify an upper bound +# for the linger period. (integer value) +# Deprecated group/name - [DEFAULT]/rpc_cast_timeout +#zmq_linger = -1 + +# The default number of seconds that poll should wait. Poll raises timeout +# exception when timeout expired. (integer value) +#rpc_poll_timeout = 1 + +# Expiration timeout in seconds of a name service record about existing target ( +# < 0 means no timeout). (integer value) +#zmq_target_expire = 300 + +# Update period in seconds of a name service record about existing target. +# (integer value) +#zmq_target_update = 180 + +# Use PUB/SUB pattern for fanout methods. PUB/SUB always uses proxy. (boolean +# value) +#use_pub_sub = false + +# Use ROUTER remote proxy. (boolean value) +#use_router_proxy = false + +# This option makes direct connections dynamic or static. It makes sense only +# with use_router_proxy=False which means to use direct connections for direct +# message types (ignored otherwise). (boolean value) +#use_dynamic_connections = false + +# How many additional connections to a host will be made for failover reasons. +# This option is actual only in dynamic connections mode. (integer value) +#zmq_failover_connections = 2 + +# Minimal port number for random ports range. (port value) +# Minimum value: 0 +# Maximum value: 65535 +#rpc_zmq_min_port = 49153 + +# Maximal port number for random ports range. (integer value) +# Minimum value: 1 +# Maximum value: 65536 +#rpc_zmq_max_port = 65536 + +# Number of retries to find free port number before fail with ZMQBindError. +# (integer value) +#rpc_zmq_bind_port_retries = 100 + +# Default serialization mechanism for serializing/deserializing +# outgoing/incoming messages (string value) +# Possible values: +# json - +# msgpack - +#rpc_zmq_serialization = json + +# This option configures round-robin mode in zmq socket. True means not keeping +# a queue when server side disconnects. False means to keep queue and messages +# even if server is disconnected, when the server appears we send all +# accumulated messages to it. (boolean value) +#zmq_immediate = true + +# Enable/disable TCP keepalive (KA) mechanism. The default value of -1 (or any +# other negative value) means to skip any overrides and leave it to OS default; +# 0 and 1 (or any other positive value) mean to disable and enable the option +# respectively. (integer value) +#zmq_tcp_keepalive = -1 + +# The duration between two keepalive transmissions in idle condition. The unit +# is platform dependent, for example, seconds in Linux, milliseconds in Windows +# etc. The default value of -1 (or any other negative value and 0) means to skip +# any overrides and leave it to OS default. (integer value) +#zmq_tcp_keepalive_idle = -1 + +# The number of retransmissions to be carried out before declaring that remote +# end is not available. The default value of -1 (or any other negative value and +# 0) means to skip any overrides and leave it to OS default. (integer value) +#zmq_tcp_keepalive_cnt = -1 + +# The duration between two successive keepalive retransmissions, if +# acknowledgement to the previous keepalive transmission is not received. The +# unit is platform dependent, for example, seconds in Linux, milliseconds in +# Windows etc. The default value of -1 (or any other negative value and 0) means +# to skip any overrides and leave it to OS default. (integer value) +#zmq_tcp_keepalive_intvl = -1 + +# Maximum number of (green) threads to work concurrently. (integer value) +#rpc_thread_pool_size = 100 + +# Expiration timeout in seconds of a sent/received message after which it is not +# tracked anymore by a client/server. (integer value) +#rpc_message_ttl = 300 + +# Wait for message acknowledgements from receivers. This mechanism works only +# via proxy without PUB/SUB. (boolean value) +#rpc_use_acks = false + +# Number of seconds to wait for an ack from a cast/call. After each retry +# attempt this timeout is multiplied by some specified multiplier. (integer +# value) +#rpc_ack_timeout_base = 15 + +# Number to multiply base ack timeout by after each retry attempt. (integer +# value) +#rpc_ack_timeout_multiplier = 2 + +# Default number of message sending attempts in case of any problems occurred: +# positive value N means at most N retries, 0 means no retries, None or -1 (or +# any other negative values) mean to retry forever. This option is used only if +# acknowledgments are enabled. (integer value) +#rpc_retry_attempts = 3 + +# List of publisher hosts SubConsumer can subscribe on. This option has higher +# priority then the default publishers list taken from the matchmaker. (list +# value) +#subscribe_on = + + +[oslo_middleware] + +# +# From oslo.middleware.http_proxy_to_wsgi +# + +# Whether the application is behind a proxy or not. This determines if the +# middleware should parse the headers or not. (boolean value) +#enable_proxy_headers_parsing = false + + +[oslo_policy] + +# +# From oslo.policy +# + +# This option controls whether or not to enforce scope when evaluating policies. +# If ``True``, the scope of the token used in the request is compared to the +# ``scope_types`` of the policy being enforced. If the scopes do not match, an +# ``InvalidScope`` exception will be raised. If ``False``, a message will be +# logged informing operators that policies are being invoked with mismatching +# scope. (boolean value) +#enforce_scope = false + +# The file that defines policies. (string value) +#policy_file = policy.json + +# Default rule. Enforced when a requested rule is not found. (string value) +#policy_default_rule = default + +# Directories where policy configuration files are stored. They can be relative +# to any directory in the search path defined by the config_dir option, or +# absolute paths. The file defined by policy_file must exist for these +# directories to be searched. Missing or empty directories are ignored. (multi +# valued) +#policy_dirs = policy.d + +# Content Type to send and receive data for REST based policy check (string +# value) +# Possible values: +# application/x-www-form-urlencoded - +# application/json - +#remote_content_type = application/x-www-form-urlencoded + +# server identity verification for REST based policy check (boolean value) +#remote_ssl_verify_server_crt = false + +# Absolute path to ca cert file for REST based policy check (string value) +#remote_ssl_ca_crt_file = + +# Absolute path to client cert for REST based policy check (string value) +#remote_ssl_client_crt_file = + +# Absolute path client key file REST based policy check (string value) +#remote_ssl_client_key_file = + + +[paste_deploy] +flavor = keystone + +# +# From glance.api +# + +# +# Deployment flavor to use in the server application pipeline. +# +# Provide a string value representing the appropriate deployment +# flavor used in the server application pipleline. This is typically +# the partial name of a pipeline in the paste configuration file with +# the service name removed. +# +# For example, if your paste section name in the paste configuration +# file is [pipeline:glance-api-keystone], set ``flavor`` to +# ``keystone``. +# +# Possible values: +# * String value representing a partial pipeline name. +# +# Related Options: +# * config_file +# +# (string value) +#flavor = keystone + +# +# Name of the paste configuration file. +# +# Provide a string value representing the name of the paste +# configuration file to use for configuring piplelines for +# server application deployments. +# +# NOTES: +# * Provide the name or the path relative to the glance directory +# for the paste configuration file and not the absolute path. +# * The sample paste configuration file shipped with Glance need +# not be edited in most cases as it comes with ready-made +# pipelines for all common deployment flavors. +# +# If no value is specified for this option, the ``paste.ini`` file +# with the prefix of the corresponding Glance service's configuration +# file name will be searched for in the known configuration +# directories. (For example, if this option is missing from or has no +# value set in ``glance-api.conf``, the service will look for a file +# named ``glance-api-paste.ini``.) If the paste configuration file is +# not found, the service will not start. +# +# Possible values: +# * A string value representing the name of the paste configuration +# file. +# +# Related Options: +# * flavor +# +# (string value) +#config_file = glance-api-paste.ini + + +[profiler] + +# +# From glance.api +# + +# +# Enables the profiling for all services on this node. Default value is False +# (fully disable the profiling feature). +# +# Possible values: +# +# * True: Enables the feature +# * False: Disables the feature. The profiling cannot be started via this +# project +# operations. If the profiling is triggered by another project, this project +# part +# will be empty. +# (boolean value) +# Deprecated group/name - [profiler]/profiler_enabled +#enabled = false + +# +# Enables SQL requests profiling in services. Default value is False (SQL +# requests won't be traced). +# +# Possible values: +# +# * True: Enables SQL requests profiling. Each SQL query will be part of the +# trace and can the be analyzed by how much time was spent for that. +# * False: Disables SQL requests profiling. The spent time is only shown on a +# higher level of operations. Single SQL queries cannot be analyzed this +# way. +# (boolean value) +#trace_sqlalchemy = false + +# +# Secret key(s) to use for encrypting context data for performance profiling. +# This string value should have the following format: [,,...], +# where each key is some random string. A user who triggers the profiling via +# the REST API has to set one of these keys in the headers of the REST API call +# to include profiling results of this node for this particular project. +# +# Both "enabled" flag and "hmac_keys" config options should be set to enable +# profiling. Also, to generate correct profiling information across all services +# at least one key needs to be consistent between OpenStack projects. This +# ensures it can be used from client side to generate the trace, containing +# information from all possible resources. (string value) +#hmac_keys = SECRET_KEY + +# +# Connection string for a notifier backend. Default value is messaging:// which +# sets the notifier to oslo_messaging. +# +# Examples of possible values: +# +# * messaging://: use oslo_messaging driver for sending notifications. +# * mongodb://127.0.0.1:27017 : use mongodb driver for sending notifications. +# * elasticsearch://127.0.0.1:9200 : use elasticsearch driver for sending +# notifications. +# (string value) +#connection_string = messaging:// + +# +# Document type for notification indexing in elasticsearch. +# (string value) +#es_doc_type = notification + +# +# This parameter is a time value parameter (for example: es_scroll_time=2m), +# indicating for how long the nodes that participate in the search will maintain +# relevant resources in order to continue and support it. +# (string value) +#es_scroll_time = 2m + +# +# Elasticsearch splits large requests in batches. This parameter defines +# maximum size of each batch (for example: es_scroll_size=10000). +# (integer value) +#es_scroll_size = 10000 + +# +# Redissentinel provides a timeout option on the connections. +# This parameter defines that timeout (for example: socket_timeout=0.1). +# (floating point value) +#socket_timeout = 0.1 + +# +# Redissentinel uses a service name to identify a master redis service. +# This parameter defines the name (for example: +# sentinal_service_name=mymaster). +# (string value) +#sentinel_service_name = mymaster + + +[store_type_location_strategy] + +# +# From glance.api +# + +# +# Preference order of storage backends. +# +# Provide a comma separated list of store names in the order in +# which images should be retrieved from storage backends. +# These store names must be registered with the ``stores`` +# configuration option. +# +# NOTE: The ``store_type_preference`` configuration option is applied +# only if ``store_type`` is chosen as a value for the +# ``location_strategy`` configuration option. An empty list will not +# change the location order. +# +# Possible values: +# * Empty list +# * Comma separated list of registered store names. Legal values are: +# * file +# * http +# * rbd +# * swift +# * sheepdog +# * cinder +# * vmware +# +# Related options: +# * location_strategy +# * stores +# +# (list value) +#store_type_preference = + + +[task] + +# +# From glance.api +# + +# Time in hours for which a task lives after, either succeeding or failing +# (integer value) +# Deprecated group/name - [DEFAULT]/task_time_to_live +#task_time_to_live = 48 + +# +# Task executor to be used to run task scripts. +# +# Provide a string value representing the executor to use for task +# executions. By default, ``TaskFlow`` executor is used. +# +# ``TaskFlow`` helps make task executions easy, consistent, scalable +# and reliable. It also enables creation of lightweight task objects +# and/or functions that are combined together into flows in a +# declarative manner. +# +# Possible values: +# * taskflow +# +# Related Options: +# * None +# +# (string value) +#task_executor = taskflow + +# +# Absolute path to the work directory to use for asynchronous +# task operations. +# +# The directory set here will be used to operate over images - +# normally before they are imported in the destination store. +# +# NOTE: When providing a value for ``work_dir``, please make sure +# that enough space is provided for concurrent tasks to run +# efficiently without running out of space. +# +# A rough estimation can be done by multiplying the number of +# ``max_workers`` with an average image size (e.g 500MB). The image +# size estimation should be done based on the average size in your +# deployment. Note that depending on the tasks running you may need +# to multiply this number by some factor depending on what the task +# does. For example, you may want to double the available size if +# image conversion is enabled. All this being said, remember these +# are just estimations and you should do them based on the worst +# case scenario and be prepared to act in case they were wrong. +# +# Possible values: +# * String value representing the absolute path to the working +# directory +# +# Related Options: +# * None +# +# (string value) +#work_dir = /work_dir + + +[taskflow_executor] + +# +# From glance.api +# + +# +# Set the taskflow engine mode. +# +# Provide a string type value to set the mode in which the taskflow +# engine would schedule tasks to the workers on the hosts. Based on +# this mode, the engine executes tasks either in single or multiple +# threads. The possible values for this configuration option are: +# ``serial`` and ``parallel``. When set to ``serial``, the engine runs +# all the tasks in a single thread which results in serial execution +# of tasks. Setting this to ``parallel`` makes the engine run tasks in +# multiple threads. This results in parallel execution of tasks. +# +# Possible values: +# * serial +# * parallel +# +# Related options: +# * max_workers +# +# (string value) +# Possible values: +# serial - +# parallel - +#engine_mode = parallel + +# +# Set the number of engine executable tasks. +# +# Provide an integer value to limit the number of workers that can be +# instantiated on the hosts. In other words, this number defines the +# number of parallel tasks that can be executed at the same time by +# the taskflow engine. This value can be greater than one when the +# engine mode is set to parallel. +# +# Possible values: +# * Integer value greater than or equal to 1 +# +# Related options: +# * engine_mode +# +# (integer value) +# Minimum value: 1 +# Deprecated group/name - [task]/eventlet_executor_pool_size +#max_workers = 10 + +# +# Set the desired image conversion format. +# +# Provide a valid image format to which you want images to be +# converted before they are stored for consumption by Glance. +# Appropriate image format conversions are desirable for specific +# storage backends in order to facilitate efficient handling of +# bandwidth and usage of the storage infrastructure. +# +# By default, ``conversion_format`` is not set and must be set +# explicitly in the configuration file. +# +# The allowed values for this option are ``raw``, ``qcow2`` and +# ``vmdk``. The ``raw`` format is the unstructured disk format and +# should be chosen when RBD or Ceph storage backends are used for +# image storage. ``qcow2`` is supported by the QEMU emulator that +# expands dynamically and supports Copy on Write. The ``vmdk`` is +# another common disk format supported by many common virtual machine +# monitors like VMWare Workstation. +# +# Possible values: +# * qcow2 +# * raw +# * vmdk +# +# Related options: +# * disk_formats +# +# (string value) +# Possible values: +# qcow2 - +# raw - +# vmdk - +#conversion_format = raw diff --git a/openstack/openstack_conf/controller/glance/glance-cache.conf b/openstack/openstack_conf/controller/glance/glance-cache.conf new file mode 100644 index 0000000..beaf4fa --- /dev/null +++ b/openstack/openstack_conf/controller/glance/glance-cache.conf @@ -0,0 +1,2572 @@ +[DEFAULT] + +# +# From glance.cache +# + +# +# Allow users to add additional/custom properties to images. +# +# Glance defines a standard set of properties (in its schema) that +# appear on every image. These properties are also known as +# ``base properties``. In addition to these properties, Glance +# allows users to add custom properties to images. These are known +# as ``additional properties``. +# +# By default, this configuration option is set to ``True`` and users +# are allowed to add additional properties. The number of additional +# properties that can be added to an image can be controlled via +# ``image_property_quota`` configuration option. +# +# Possible values: +# * True +# * False +# +# Related options: +# * image_property_quota +# +# (boolean value) +#allow_additional_image_properties = true + +# +# Maximum number of image members per image. +# +# This limits the maximum of users an image can be shared with. Any negative +# value is interpreted as unlimited. +# +# Related options: +# * None +# +# (integer value) +#image_member_quota = 128 + +# +# Maximum number of properties allowed on an image. +# +# This enforces an upper limit on the number of additional properties an image +# can have. Any negative value is interpreted as unlimited. +# +# NOTE: This won't have any impact if additional properties are disabled. Please +# refer to ``allow_additional_image_properties``. +# +# Related options: +# * ``allow_additional_image_properties`` +# +# (integer value) +#image_property_quota = 128 + +# +# Maximum number of tags allowed on an image. +# +# Any negative value is interpreted as unlimited. +# +# Related options: +# * None +# +# (integer value) +#image_tag_quota = 128 + +# +# Maximum number of locations allowed on an image. +# +# Any negative value is interpreted as unlimited. +# +# Related options: +# * None +# +# (integer value) +#image_location_quota = 10 + +# DEPRECATED: +# Python module path of data access API. +# +# Specifies the path to the API to use for accessing the data model. +# This option determines how the image catalog data will be accessed. +# +# Possible values: +# * glance.db.sqlalchemy.api +# * glance.db.registry.api +# * glance.db.simple.api +# +# If this option is set to ``glance.db.sqlalchemy.api`` then the image +# catalog data is stored in and read from the database via the +# SQLAlchemy Core and ORM APIs. +# +# Setting this option to ``glance.db.registry.api`` will force all +# database access requests to be routed through the Registry service. +# This avoids data access from the Glance API nodes for an added layer +# of security, scalability and manageability. +# +# NOTE: In v2 OpenStack Images API, the registry service is optional. +# In order to use the Registry API in v2, the option +# ``enable_v2_registry`` must be set to ``True``. +# +# Finally, when this configuration option is set to +# ``glance.db.simple.api``, image catalog data is stored in and read +# from an in-memory data structure. This is primarily used for testing. +# +# Related options: +# * enable_v2_api +# * enable_v2_registry +# +# (string value) +# This option is deprecated for removal since Queens. +# Its value may be silently ignored in the future. +# Reason: +# Glance registry service is deprecated for removal. +# +# More information can be found from the spec: +# http://specs.openstack.org/openstack/glance-specs/specs/queens/approved/glance +# /deprecate-registry.html +#data_api = glance.db.sqlalchemy.api + +# +# The default number of results to return for a request. +# +# Responses to certain API requests, like list images, may return +# multiple items. The number of results returned can be explicitly +# controlled by specifying the ``limit`` parameter in the API request. +# However, if a ``limit`` parameter is not specified, this +# configuration value will be used as the default number of results to +# be returned for any API request. +# +# NOTES: +# * The value of this configuration option may not be greater than +# the value specified by ``api_limit_max``. +# * Setting this to a very large value may slow down database +# queries and increase response times. Setting this to a +# very low value may result in poor user experience. +# +# Possible values: +# * Any positive integer +# +# Related options: +# * api_limit_max +# +# (integer value) +# Minimum value: 1 +#limit_param_default = 25 + +# +# Maximum number of results that could be returned by a request. +# +# As described in the help text of ``limit_param_default``, some +# requests may return multiple results. The number of results to be +# returned are governed either by the ``limit`` parameter in the +# request or the ``limit_param_default`` configuration option. +# The value in either case, can't be greater than the absolute maximum +# defined by this configuration option. Anything greater than this +# value is trimmed down to the maximum value defined here. +# +# NOTE: Setting this to a very large value may slow down database +# queries and increase response times. Setting this to a +# very low value may result in poor user experience. +# +# Possible values: +# * Any positive integer +# +# Related options: +# * limit_param_default +# +# (integer value) +# Minimum value: 1 +#api_limit_max = 1000 + +# +# Show direct image location when returning an image. +# +# This configuration option indicates whether to show the direct image +# location when returning image details to the user. The direct image +# location is where the image data is stored in backend storage. This +# image location is shown under the image property ``direct_url``. +# +# When multiple image locations exist for an image, the best location +# is displayed based on the location strategy indicated by the +# configuration option ``location_strategy``. +# +# NOTES: +# * Revealing image locations can present a GRAVE SECURITY RISK as +# image locations can sometimes include credentials. Hence, this +# is set to ``False`` by default. Set this to ``True`` with +# EXTREME CAUTION and ONLY IF you know what you are doing! +# * If an operator wishes to avoid showing any image location(s) +# to the user, then both this option and +# ``show_multiple_locations`` MUST be set to ``False``. +# +# Possible values: +# * True +# * False +# +# Related options: +# * show_multiple_locations +# * location_strategy +# +# (boolean value) +#show_image_direct_url = false + +# DEPRECATED: +# Show all image locations when returning an image. +# +# This configuration option indicates whether to show all the image +# locations when returning image details to the user. When multiple +# image locations exist for an image, the locations are ordered based +# on the location strategy indicated by the configuration opt +# ``location_strategy``. The image locations are shown under the +# image property ``locations``. +# +# NOTES: +# * Revealing image locations can present a GRAVE SECURITY RISK as +# image locations can sometimes include credentials. Hence, this +# is set to ``False`` by default. Set this to ``True`` with +# EXTREME CAUTION and ONLY IF you know what you are doing! +# * If an operator wishes to avoid showing any image location(s) +# to the user, then both this option and +# ``show_image_direct_url`` MUST be set to ``False``. +# +# Possible values: +# * True +# * False +# +# Related options: +# * show_image_direct_url +# * location_strategy +# +# (boolean value) +# This option is deprecated for removal since Newton. +# Its value may be silently ignored in the future. +# Reason: This option will be removed in the Pike release or later because the +# same functionality can be achieved with greater granularity by using policies. +# Please see the Newton release notes for more information. +#show_multiple_locations = false + +# +# Maximum size of image a user can upload in bytes. +# +# An image upload greater than the size mentioned here would result +# in an image creation failure. This configuration option defaults to +# 1099511627776 bytes (1 TiB). +# +# NOTES: +# * This value should only be increased after careful +# consideration and must be set less than or equal to +# 8 EiB (9223372036854775808). +# * This value must be set with careful consideration of the +# backend storage capacity. Setting this to a very low value +# may result in a large number of image failures. And, setting +# this to a very large value may result in faster consumption +# of storage. Hence, this must be set according to the nature of +# images created and storage capacity available. +# +# Possible values: +# * Any positive number less than or equal to 9223372036854775808 +# +# (integer value) +# Minimum value: 1 +# Maximum value: 9223372036854775808 +#image_size_cap = 1099511627776 + +# +# Maximum amount of image storage per tenant. +# +# This enforces an upper limit on the cumulative storage consumed by all images +# of a tenant across all stores. This is a per-tenant limit. +# +# The default unit for this configuration option is Bytes. However, storage +# units can be specified using case-sensitive literals ``B``, ``KB``, ``MB``, +# ``GB`` and ``TB`` representing Bytes, KiloBytes, MegaBytes, GigaBytes and +# TeraBytes respectively. Note that there should not be any space between the +# value and unit. Value ``0`` signifies no quota enforcement. Negative values +# are invalid and result in errors. +# +# Possible values: +# * A string that is a valid concatenation of a non-negative integer +# representing the storage value and an optional string literal +# representing storage units as mentioned above. +# +# Related options: +# * None +# +# (string value) +#user_storage_quota = 0 + +# +# Deploy the v1 OpenStack Images API. +# +# When this option is set to ``True``, Glance service will respond to +# requests on registered endpoints conforming to the v1 OpenStack +# Images API. +# +# NOTES: +# * If this option is enabled, then ``enable_v1_registry`` must +# also be set to ``True`` to enable mandatory usage of Registry +# service with v1 API. +# +# * If this option is disabled, then the ``enable_v1_registry`` +# option, which is enabled by default, is also recommended +# to be disabled. +# +# * This option is separate from ``enable_v2_api``, both v1 and v2 +# OpenStack Images API can be deployed independent of each +# other. +# +# * If deploying only the v2 Images API, this option, which is +# enabled by default, should be disabled. +# +# Possible values: +# * True +# * False +# +# Related options: +# * enable_v1_registry +# * enable_v2_api +# +# (boolean value) +#enable_v1_api = true + +# +# Deploy the v2 OpenStack Images API. +# +# When this option is set to ``True``, Glance service will respond +# to requests on registered endpoints conforming to the v2 OpenStack +# Images API. +# +# NOTES: +# * If this option is disabled, then the ``enable_v2_registry`` +# option, which is enabled by default, is also recommended +# to be disabled. +# +# * This option is separate from ``enable_v1_api``, both v1 and v2 +# OpenStack Images API can be deployed independent of each +# other. +# +# * If deploying only the v1 Images API, this option, which is +# enabled by default, should be disabled. +# +# Possible values: +# * True +# * False +# +# Related options: +# * enable_v2_registry +# * enable_v1_api +# +# (boolean value) +#enable_v2_api = true + +# +# Deploy the v1 API Registry service. +# +# When this option is set to ``True``, the Registry service +# will be enabled in Glance for v1 API requests. +# +# NOTES: +# * Use of Registry is mandatory in v1 API, so this option must +# be set to ``True`` if the ``enable_v1_api`` option is enabled. +# +# * If deploying only the v2 OpenStack Images API, this option, +# which is enabled by default, should be disabled. +# +# Possible values: +# * True +# * False +# +# Related options: +# * enable_v1_api +# +# (boolean value) +#enable_v1_registry = true + +# DEPRECATED: +# Deploy the v2 API Registry service. +# +# When this option is set to ``True``, the Registry service +# will be enabled in Glance for v2 API requests. +# +# NOTES: +# * Use of Registry is optional in v2 API, so this option +# must only be enabled if both ``enable_v2_api`` is set to +# ``True`` and the ``data_api`` option is set to +# ``glance.db.registry.api``. +# +# * If deploying only the v1 OpenStack Images API, this option, +# which is enabled by default, should be disabled. +# +# Possible values: +# * True +# * False +# +# Related options: +# * enable_v2_api +# * data_api +# +# (boolean value) +# This option is deprecated for removal since Queens. +# Its value may be silently ignored in the future. +# Reason: +# Glance registry service is deprecated for removal. +# +# More information can be found from the spec: +# http://specs.openstack.org/openstack/glance-specs/specs/queens/approved/glance +# /deprecate-registry.html +#enable_v2_registry = true + +# +# Host address of the pydev server. +# +# Provide a string value representing the hostname or IP of the +# pydev server to use for debugging. The pydev server listens for +# debug connections on this address, facilitating remote debugging +# in Glance. +# +# Possible values: +# * Valid hostname +# * Valid IP address +# +# Related options: +# * None +# +# (unknown value) +#pydev_worker_debug_host = localhost + +# +# Port number that the pydev server will listen on. +# +# Provide a port number to bind the pydev server to. The pydev +# process accepts debug connections on this port and facilitates +# remote debugging in Glance. +# +# Possible values: +# * A valid port number +# +# Related options: +# * None +# +# (port value) +# Minimum value: 0 +# Maximum value: 65535 +#pydev_worker_debug_port = 5678 + +# +# AES key for encrypting store location metadata. +# +# Provide a string value representing the AES cipher to use for +# encrypting Glance store metadata. +# +# NOTE: The AES key to use must be set to a random string of length +# 16, 24 or 32 bytes. +# +# Possible values: +# * String value representing a valid AES key +# +# Related options: +# * None +# +# (string value) +#metadata_encryption_key = + +# +# Digest algorithm to use for digital signature. +# +# Provide a string value representing the digest algorithm to +# use for generating digital signatures. By default, ``sha256`` +# is used. +# +# To get a list of the available algorithms supported by the version +# of OpenSSL on your platform, run the command: +# ``openssl list-message-digest-algorithms``. +# Examples are 'sha1', 'sha256', and 'sha512'. +# +# NOTE: ``digest_algorithm`` is not related to Glance's image signing +# and verification. It is only used to sign the universally unique +# identifier (UUID) as a part of the certificate file and key file +# validation. +# +# Possible values: +# * An OpenSSL message digest algorithm identifier +# +# Relation options: +# * None +# +# (string value) +#digest_algorithm = sha256 + +# +# The URL provides location where the temporary data will be stored +# +# This option is for Glance internal use only. Glance will save the +# image data uploaded by the user to 'staging' endpoint during the +# image import process. +# +# This option does not change the 'staging' API endpoint by any means. +# +# NOTE: It is discouraged to use same path as [task]/work_dir +# +# NOTE: 'file://' is the only option +# api_image_import flow will support for now. +# +# NOTE: The staging path must be on shared filesystem available to all +# Glance API nodes. +# +# Possible values: +# * String starting with 'file://' followed by absolute FS path +# +# Related options: +# * [task]/work_dir +# * [DEFAULT]/enable_image_import (*deprecated*) +# +# (string value) +#node_staging_uri = file:///tmp/staging/ + +# DEPRECATED: +# Enables the Image Import workflow introduced in Pike +# +# As '[DEFAULT]/node_staging_uri' is required for the Image +# Import, it's disabled per default in Pike, enabled per +# default in Queens and removed in Rocky. This allows Glance to +# operate with previous version configs upon upgrade. +# +# Setting this option to False will disable the endpoints related +# to Image Import Refactoring work. +# +# Related options: +# * [DEFAULT]/node_staging_uri (boolean value) +# This option is deprecated for removal since Pike. +# Its value may be silently ignored in the future. +# Reason: +# This option is deprecated for removal in Rocky. +# +# It was introduced to make sure that the API is not enabled +# before the '[DEFAULT]/node_staging_uri' is defined and is +# long term redundant. +#enable_image_import = true + +# +# List of enabled Image Import Methods +# +# Both 'glance-direct' and 'web-download' are enabled by default. +# +# Related options: +# * [DEFAULT]/node_staging_uri +# * [DEFAULT]/enable_image_import (list value) +#enabled_import_methods = glance-direct,web-download + +# +# The relative path to sqlite file database that will be used for image cache +# management. +# +# This is a relative path to the sqlite file database that tracks the age and +# usage statistics of image cache. The path is relative to image cache base +# directory, specified by the configuration option ``image_cache_dir``. +# +# This is a lightweight database with just one table. +# +# Possible values: +# * A valid relative path to sqlite file database +# +# Related options: +# * ``image_cache_dir`` +# +# (string value) +#image_cache_sqlite_db = cache.db + +# +# The driver to use for image cache management. +# +# This configuration option provides the flexibility to choose between the +# different image-cache drivers available. An image-cache driver is responsible +# for providing the essential functions of image-cache like write images to/read +# images from cache, track age and usage of cached images, provide a list of +# cached images, fetch size of the cache, queue images for caching and clean up +# the cache, etc. +# +# The essential functions of a driver are defined in the base class +# ``glance.image_cache.drivers.base.Driver``. All image-cache drivers (existing +# and prospective) must implement this interface. Currently available drivers +# are ``sqlite`` and ``xattr``. These drivers primarily differ in the way they +# store the information about cached images: +# * The ``sqlite`` driver uses a sqlite database (which sits on every glance +# node locally) to track the usage of cached images. +# * The ``xattr`` driver uses the extended attributes of files to store this +# information. It also requires a filesystem that sets ``atime`` on the +# files +# when accessed. +# +# Possible values: +# * sqlite +# * xattr +# +# Related options: +# * None +# +# (string value) +# Possible values: +# sqlite - +# xattr - +#image_cache_driver = sqlite + +# +# The upper limit on cache size, in bytes, after which the cache-pruner cleans +# up the image cache. +# +# NOTE: This is just a threshold for cache-pruner to act upon. It is NOT a +# hard limit beyond which the image cache would never grow. In fact, depending +# on how often the cache-pruner runs and how quickly the cache fills, the image +# cache can far exceed the size specified here very easily. Hence, care must be +# taken to appropriately schedule the cache-pruner and in setting this limit. +# +# Glance caches an image when it is downloaded. Consequently, the size of the +# image cache grows over time as the number of downloads increases. To keep the +# cache size from becoming unmanageable, it is recommended to run the +# cache-pruner as a periodic task. When the cache pruner is kicked off, it +# compares the current size of image cache and triggers a cleanup if the image +# cache grew beyond the size specified here. After the cleanup, the size of +# cache is less than or equal to size specified here. +# +# Possible values: +# * Any non-negative integer +# +# Related options: +# * None +# +# (integer value) +# Minimum value: 0 +#image_cache_max_size = 10737418240 + +# +# The amount of time, in seconds, an incomplete image remains in the cache. +# +# Incomplete images are images for which download is in progress. Please see the +# description of configuration option ``image_cache_dir`` for more detail. +# Sometimes, due to various reasons, it is possible the download may hang and +# the incompletely downloaded image remains in the ``incomplete`` directory. +# This configuration option sets a time limit on how long the incomplete images +# should remain in the ``incomplete`` directory before they are cleaned up. +# Once an incomplete image spends more time than is specified here, it'll be +# removed by cache-cleaner on its next run. +# +# It is recommended to run cache-cleaner as a periodic task on the Glance API +# nodes to keep the incomplete images from occupying disk space. +# +# Possible values: +# * Any non-negative integer +# +# Related options: +# * None +# +# (integer value) +# Minimum value: 0 +#image_cache_stall_time = 86400 + +# +# Base directory for image cache. +# +# This is the location where image data is cached and served out of. All cached +# images are stored directly under this directory. This directory also contains +# three subdirectories, namely, ``incomplete``, ``invalid`` and ``queue``. +# +# The ``incomplete`` subdirectory is the staging area for downloading images. An +# image is first downloaded to this directory. When the image download is +# successful it is moved to the base directory. However, if the download fails, +# the partially downloaded image file is moved to the ``invalid`` subdirectory. +# +# The ``queue``subdirectory is used for queuing images for download. This is +# used primarily by the cache-prefetcher, which can be scheduled as a periodic +# task like cache-pruner and cache-cleaner, to cache images ahead of their +# usage. +# Upon receiving the request to cache an image, Glance touches a file in the +# ``queue`` directory with the image id as the file name. The cache-prefetcher, +# when running, polls for the files in ``queue`` directory and starts +# downloading them in the order they were created. When the download is +# successful, the zero-sized file is deleted from the ``queue`` directory. +# If the download fails, the zero-sized file remains and it'll be retried the +# next time cache-prefetcher runs. +# +# Possible values: +# * A valid path +# +# Related options: +# * ``image_cache_sqlite_db`` +# +# (string value) +#image_cache_dir = + +# DEPRECATED: +# Address the registry server is hosted on. +# +# Possible values: +# * A valid IP or hostname +# +# Related options: +# * None +# +# (unknown value) +# This option is deprecated for removal since Queens. +# Its value may be silently ignored in the future. +# Reason: +# Glance registry service is deprecated for removal. +# +# More information can be found from the spec: +# http://specs.openstack.org/openstack/glance-specs/specs/queens/approved/glance +# /deprecate-registry.html +#registry_host = 0.0.0.0 + +# DEPRECATED: +# Port the registry server is listening on. +# +# Possible values: +# * A valid port number +# +# Related options: +# * None +# +# (port value) +# Minimum value: 0 +# Maximum value: 65535 +# This option is deprecated for removal since Queens. +# Its value may be silently ignored in the future. +# Reason: +# Glance registry service is deprecated for removal. +# +# More information can be found from the spec: +# http://specs.openstack.org/openstack/glance-specs/specs/queens/approved/glance +# /deprecate-registry.html +#registry_port = 9191 + +# DEPRECATED: +# Protocol to use for communication with the registry server. +# +# Provide a string value representing the protocol to use for +# communication with the registry server. By default, this option is +# set to ``http`` and the connection is not secure. +# +# This option can be set to ``https`` to establish a secure connection +# to the registry server. In this case, provide a key to use for the +# SSL connection using the ``registry_client_key_file`` option. Also +# include the CA file and cert file using the options +# ``registry_client_ca_file`` and ``registry_client_cert_file`` +# respectively. +# +# Possible values: +# * http +# * https +# +# Related options: +# * registry_client_key_file +# * registry_client_cert_file +# * registry_client_ca_file +# +# (string value) +# Possible values: +# http - +# https - +# This option is deprecated for removal since Queens. +# Its value may be silently ignored in the future. +# Reason: +# Glance registry service is deprecated for removal. +# +# More information can be found from the spec: +# http://specs.openstack.org/openstack/glance-specs/specs/queens/approved/glance +# /deprecate-registry.html +#registry_client_protocol = http + +# DEPRECATED: +# Absolute path to the private key file. +# +# Provide a string value representing a valid absolute path to the +# private key file to use for establishing a secure connection to +# the registry server. +# +# NOTE: This option must be set if ``registry_client_protocol`` is +# set to ``https``. Alternatively, the GLANCE_CLIENT_KEY_FILE +# environment variable may be set to a filepath of the key file. +# +# Possible values: +# * String value representing a valid absolute path to the key +# file. +# +# Related options: +# * registry_client_protocol +# +# (string value) +# This option is deprecated for removal since Queens. +# Its value may be silently ignored in the future. +# Reason: +# Glance registry service is deprecated for removal. +# +# More information can be found from the spec: +# http://specs.openstack.org/openstack/glance-specs/specs/queens/approved/glance +# /deprecate-registry.html +#registry_client_key_file = /etc/ssl/key/key-file.pem + +# DEPRECATED: +# Absolute path to the certificate file. +# +# Provide a string value representing a valid absolute path to the +# certificate file to use for establishing a secure connection to +# the registry server. +# +# NOTE: This option must be set if ``registry_client_protocol`` is +# set to ``https``. Alternatively, the GLANCE_CLIENT_CERT_FILE +# environment variable may be set to a filepath of the certificate +# file. +# +# Possible values: +# * String value representing a valid absolute path to the +# certificate file. +# +# Related options: +# * registry_client_protocol +# +# (string value) +# This option is deprecated for removal since Queens. +# Its value may be silently ignored in the future. +# Reason: +# Glance registry service is deprecated for removal. +# +# More information can be found from the spec: +# http://specs.openstack.org/openstack/glance-specs/specs/queens/approved/glance +# /deprecate-registry.html +#registry_client_cert_file = /etc/ssl/certs/file.crt + +# DEPRECATED: +# Absolute path to the Certificate Authority file. +# +# Provide a string value representing a valid absolute path to the +# certificate authority file to use for establishing a secure +# connection to the registry server. +# +# NOTE: This option must be set if ``registry_client_protocol`` is +# set to ``https``. Alternatively, the GLANCE_CLIENT_CA_FILE +# environment variable may be set to a filepath of the CA file. +# This option is ignored if the ``registry_client_insecure`` option +# is set to ``True``. +# +# Possible values: +# * String value representing a valid absolute path to the CA +# file. +# +# Related options: +# * registry_client_protocol +# * registry_client_insecure +# +# (string value) +# This option is deprecated for removal since Queens. +# Its value may be silently ignored in the future. +# Reason: +# Glance registry service is deprecated for removal. +# +# More information can be found from the spec: +# http://specs.openstack.org/openstack/glance-specs/specs/queens/approved/glance +# /deprecate-registry.html +#registry_client_ca_file = /etc/ssl/cafile/file.ca + +# DEPRECATED: +# Set verification of the registry server certificate. +# +# Provide a boolean value to determine whether or not to validate +# SSL connections to the registry server. By default, this option +# is set to ``False`` and the SSL connections are validated. +# +# If set to ``True``, the connection to the registry server is not +# validated via a certifying authority and the +# ``registry_client_ca_file`` option is ignored. This is the +# registry's equivalent of specifying --insecure on the command line +# using glanceclient for the API. +# +# Possible values: +# * True +# * False +# +# Related options: +# * registry_client_protocol +# * registry_client_ca_file +# +# (boolean value) +# This option is deprecated for removal since Queens. +# Its value may be silently ignored in the future. +# Reason: +# Glance registry service is deprecated for removal. +# +# More information can be found from the spec: +# http://specs.openstack.org/openstack/glance-specs/specs/queens/approved/glance +# /deprecate-registry.html +#registry_client_insecure = false + +# DEPRECATED: +# Timeout value for registry requests. +# +# Provide an integer value representing the period of time in seconds +# that the API server will wait for a registry request to complete. +# The default value is 600 seconds. +# +# A value of 0 implies that a request will never timeout. +# +# Possible values: +# * Zero +# * Positive integer +# +# Related options: +# * None +# +# (integer value) +# Minimum value: 0 +# This option is deprecated for removal since Queens. +# Its value may be silently ignored in the future. +# Reason: +# Glance registry service is deprecated for removal. +# +# More information can be found from the spec: +# http://specs.openstack.org/openstack/glance-specs/specs/queens/approved/glance +# /deprecate-registry.html +#registry_client_timeout = 600 + +# DEPRECATED: Whether to pass through the user token when making requests to the +# registry. To prevent failures with token expiration during big files upload, +# it is recommended to set this parameter to False.If "use_user_token" is not in +# effect, then admin credentials can be specified. (boolean value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: This option was considered harmful and has been deprecated in M +# release. It will be removed in O release. For more information read OSSN-0060. +# Related functionality with uploading big images has been implemented with +# Keystone trusts support. +#use_user_token = true + +# DEPRECATED: The administrators user name. If "use_user_token" is not in +# effect, then admin credentials can be specified. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: This option was considered harmful and has been deprecated in M +# release. It will be removed in O release. For more information read OSSN-0060. +# Related functionality with uploading big images has been implemented with +# Keystone trusts support. +#admin_user = + +# DEPRECATED: The administrators password. If "use_user_token" is not in effect, +# then admin credentials can be specified. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: This option was considered harmful and has been deprecated in M +# release. It will be removed in O release. For more information read OSSN-0060. +# Related functionality with uploading big images has been implemented with +# Keystone trusts support. +#admin_password = + +# DEPRECATED: The tenant name of the administrative user. If "use_user_token" is +# not in effect, then admin tenant name can be specified. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: This option was considered harmful and has been deprecated in M +# release. It will be removed in O release. For more information read OSSN-0060. +# Related functionality with uploading big images has been implemented with +# Keystone trusts support. +#admin_tenant_name = + +# DEPRECATED: The URL to the keystone service. If "use_user_token" is not in +# effect and using keystone auth, then URL of keystone can be specified. (string +# value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: This option was considered harmful and has been deprecated in M +# release. It will be removed in O release. For more information read OSSN-0060. +# Related functionality with uploading big images has been implemented with +# Keystone trusts support. +#auth_url = + +# DEPRECATED: The strategy to use for authentication. If "use_user_token" is not +# in effect, then auth strategy can be specified. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: This option was considered harmful and has been deprecated in M +# release. It will be removed in O release. For more information read OSSN-0060. +# Related functionality with uploading big images has been implemented with +# Keystone trusts support. +#auth_strategy = noauth + +# DEPRECATED: The region for the authentication service. If "use_user_token" is +# not in effect and using keystone auth, then region name can be specified. +# (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: This option was considered harmful and has been deprecated in M +# release. It will be removed in O release. For more information read OSSN-0060. +# Related functionality with uploading big images has been implemented with +# Keystone trusts support. +#auth_region = + +# +# From oslo.log +# + +# If set to true, the logging level will be set to DEBUG instead of the default +# INFO level. (boolean value) +# Note: This option can be changed without restarting. +#debug = false + +# The name of a logging configuration file. This file is appended to any +# existing logging configuration files. For details about logging configuration +# files, see the Python logging module documentation. Note that when logging +# configuration files are used then all logging configuration is set in the +# configuration file and other logging configuration options are ignored (for +# example, logging_context_format_string). (string value) +# Note: This option can be changed without restarting. +# Deprecated group/name - [DEFAULT]/log_config +#log_config_append = + +# Defines the format string for %%(asctime)s in log records. Default: +# %(default)s . This option is ignored if log_config_append is set. (string +# value) +#log_date_format = %Y-%m-%d %H:%M:%S + +# (Optional) Name of log file to send logging output to. If no default is set, +# logging will go to stderr as defined by use_stderr. This option is ignored if +# log_config_append is set. (string value) +# Deprecated group/name - [DEFAULT]/logfile +#log_file = + +# (Optional) The base directory used for relative log_file paths. This option +# is ignored if log_config_append is set. (string value) +# Deprecated group/name - [DEFAULT]/logdir +#log_dir = + +# Uses logging handler designed to watch file system. When log file is moved or +# removed this handler will open a new log file with specified path +# instantaneously. It makes sense only if log_file option is specified and Linux +# platform is used. This option is ignored if log_config_append is set. (boolean +# value) +#watch_log_file = false + +# Use syslog for logging. Existing syslog format is DEPRECATED and will be +# changed later to honor RFC5424. This option is ignored if log_config_append is +# set. (boolean value) +#use_syslog = false + +# Enable journald for logging. If running in a systemd environment you may wish +# to enable journal support. Doing so will use the journal native protocol which +# includes structured metadata in addition to log messages.This option is +# ignored if log_config_append is set. (boolean value) +#use_journal = false + +# Syslog facility to receive log lines. This option is ignored if +# log_config_append is set. (string value) +#syslog_log_facility = LOG_USER + +# Use JSON formatting for logging. This option is ignored if log_config_append +# is set. (boolean value) +#use_json = false + +# Log output to standard error. This option is ignored if log_config_append is +# set. (boolean value) +#use_stderr = false + +# Format string to use for log messages with context. (string value) +#logging_context_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user_identity)s] %(instance)s%(message)s + +# Format string to use for log messages when context is undefined. (string +# value) +#logging_default_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [-] %(instance)s%(message)s + +# Additional data to append to log message when logging level for the message is +# DEBUG. (string value) +#logging_debug_format_suffix = %(funcName)s %(pathname)s:%(lineno)d + +# Prefix each line of exception output with this format. (string value) +#logging_exception_prefix = %(asctime)s.%(msecs)03d %(process)d ERROR %(name)s %(instance)s + +# Defines the format string for %(user_identity)s that is used in +# logging_context_format_string. (string value) +#logging_user_identity_format = %(user)s %(tenant)s %(domain)s %(user_domain)s %(project_domain)s + +# List of package logging levels in logger=LEVEL pairs. This option is ignored +# if log_config_append is set. (list value) +#default_log_levels = amqp=WARN,amqplib=WARN,boto=WARN,qpid=WARN,sqlalchemy=WARN,suds=INFO,oslo.messaging=INFO,oslo_messaging=INFO,iso8601=WARN,requests.packages.urllib3.connectionpool=WARN,urllib3.connectionpool=WARN,websocket=WARN,requests.packages.urllib3.util.retry=WARN,urllib3.util.retry=WARN,keystonemiddleware=WARN,routes.middleware=WARN,stevedore=WARN,taskflow=WARN,keystoneauth=WARN,oslo.cache=INFO,dogpile.core.dogpile=INFO + +# Enables or disables publication of error events. (boolean value) +#publish_errors = false + +# The format for an instance that is passed with the log message. (string value) +#instance_format = "[instance: %(uuid)s] " + +# The format for an instance UUID that is passed with the log message. (string +# value) +#instance_uuid_format = "[instance: %(uuid)s] " + +# Interval, number of seconds, of log rate limiting. (integer value) +#rate_limit_interval = 0 + +# Maximum number of logged messages per rate_limit_interval. (integer value) +#rate_limit_burst = 0 + +# Log level name used by rate limiting: CRITICAL, ERROR, INFO, WARNING, DEBUG or +# empty string. Logs with level greater or equal to rate_limit_except_level are +# not filtered. An empty string means that all levels are filtered. (string +# value) +#rate_limit_except_level = CRITICAL + +# Enables or disables fatal status of deprecations. (boolean value) +#fatal_deprecations = false + + +[glance_store] + +# +# From glance.store +# + +# +# List of enabled Glance stores. +# +# Register the storage backends to use for storing disk images +# as a comma separated list. The default stores enabled for +# storing disk images with Glance are ``file`` and ``http``. +# +# Possible values: +# * A comma separated list that could include: +# * file +# * http +# * swift +# * rbd +# * sheepdog +# * cinder +# * vmware +# +# Related Options: +# * default_store +# +# (list value) +#stores = file,http + +# +# The default scheme to use for storing images. +# +# Provide a string value representing the default scheme to use for +# storing images. If not set, Glance uses ``file`` as the default +# scheme to store images with the ``file`` store. +# +# NOTE: The value given for this configuration option must be a valid +# scheme for a store registered with the ``stores`` configuration +# option. +# +# Possible values: +# * file +# * filesystem +# * http +# * https +# * swift +# * swift+http +# * swift+https +# * swift+config +# * rbd +# * sheepdog +# * cinder +# * vsphere +# +# Related Options: +# * stores +# +# (string value) +# Possible values: +# file - +# filesystem - +# http - +# https - +# swift - +# swift+http - +# swift+https - +# swift+config - +# rbd - +# sheepdog - +# cinder - +# vsphere - +#default_store = file + +# +# Minimum interval in seconds to execute updating dynamic storage +# capabilities based on current backend status. +# +# Provide an integer value representing time in seconds to set the +# minimum interval before an update of dynamic storage capabilities +# for a storage backend can be attempted. Setting +# ``store_capabilities_update_min_interval`` does not mean updates +# occur periodically based on the set interval. Rather, the update +# is performed at the elapse of this interval set, if an operation +# of the store is triggered. +# +# By default, this option is set to zero and is disabled. Provide an +# integer value greater than zero to enable this option. +# +# NOTE: For more information on store capabilities and their updates, +# please visit: https://specs.openstack.org/openstack/glance-specs/specs/kilo +# /store-capabilities.html +# +# For more information on setting up a particular store in your +# deployment and help with the usage of this feature, please contact +# the storage driver maintainers listed here: +# http://docs.openstack.org/developer/glance_store/drivers/index.html +# +# Possible values: +# * Zero +# * Positive integer +# +# Related Options: +# * None +# +# (integer value) +# Minimum value: 0 +#store_capabilities_update_min_interval = 0 + +# +# Information to match when looking for cinder in the service catalog. +# +# When the ``cinder_endpoint_template`` is not set and any of +# ``cinder_store_auth_address``, ``cinder_store_user_name``, +# ``cinder_store_project_name``, ``cinder_store_password`` is not set, +# cinder store uses this information to lookup cinder endpoint from the service +# catalog in the current context. ``cinder_os_region_name``, if set, is taken +# into consideration to fetch the appropriate endpoint. +# +# The service catalog can be listed by the ``openstack catalog list`` command. +# +# Possible values: +# * A string of of the following form: +# ``::`` +# At least ``service_type`` and ``interface`` should be specified. +# ``service_name`` can be omitted. +# +# Related options: +# * cinder_os_region_name +# * cinder_endpoint_template +# * cinder_store_auth_address +# * cinder_store_user_name +# * cinder_store_project_name +# * cinder_store_password +# +# (string value) +#cinder_catalog_info = volumev2::publicURL + +# +# Override service catalog lookup with template for cinder endpoint. +# +# When this option is set, this value is used to generate cinder endpoint, +# instead of looking up from the service catalog. +# This value is ignored if ``cinder_store_auth_address``, +# ``cinder_store_user_name``, ``cinder_store_project_name``, and +# ``cinder_store_password`` are specified. +# +# If this configuration option is set, ``cinder_catalog_info`` will be ignored. +# +# Possible values: +# * URL template string for cinder endpoint, where ``%%(tenant)s`` is +# replaced with the current tenant (project) name. +# For example: ``http://cinder.openstack.example.org/v2/%%(tenant)s`` +# +# Related options: +# * cinder_store_auth_address +# * cinder_store_user_name +# * cinder_store_project_name +# * cinder_store_password +# * cinder_catalog_info +# +# (string value) +#cinder_endpoint_template = + +# +# Region name to lookup cinder service from the service catalog. +# +# This is used only when ``cinder_catalog_info`` is used for determining the +# endpoint. If set, the lookup for cinder endpoint by this node is filtered to +# the specified region. It is useful when multiple regions are listed in the +# catalog. If this is not set, the endpoint is looked up from every region. +# +# Possible values: +# * A string that is a valid region name. +# +# Related options: +# * cinder_catalog_info +# +# (string value) +# Deprecated group/name - [glance_store]/os_region_name +#cinder_os_region_name = + +# +# Location of a CA certificates file used for cinder client requests. +# +# The specified CA certificates file, if set, is used to verify cinder +# connections via HTTPS endpoint. If the endpoint is HTTP, this value is +# ignored. +# ``cinder_api_insecure`` must be set to ``True`` to enable the verification. +# +# Possible values: +# * Path to a ca certificates file +# +# Related options: +# * cinder_api_insecure +# +# (string value) +#cinder_ca_certificates_file = + +# +# Number of cinderclient retries on failed http calls. +# +# When a call failed by any errors, cinderclient will retry the call up to the +# specified times after sleeping a few seconds. +# +# Possible values: +# * A positive integer +# +# Related options: +# * None +# +# (integer value) +# Minimum value: 0 +#cinder_http_retries = 3 + +# +# Time period, in seconds, to wait for a cinder volume transition to +# complete. +# +# When the cinder volume is created, deleted, or attached to the glance node to +# read/write the volume data, the volume's state is changed. For example, the +# newly created volume status changes from ``creating`` to ``available`` after +# the creation process is completed. This specifies the maximum time to wait for +# the status change. If a timeout occurs while waiting, or the status is changed +# to an unexpected value (e.g. `error``), the image creation fails. +# +# Possible values: +# * A positive integer +# +# Related options: +# * None +# +# (integer value) +# Minimum value: 0 +#cinder_state_transition_timeout = 300 + +# +# Allow to perform insecure SSL requests to cinder. +# +# If this option is set to True, HTTPS endpoint connection is verified using the +# CA certificates file specified by ``cinder_ca_certificates_file`` option. +# +# Possible values: +# * True +# * False +# +# Related options: +# * cinder_ca_certificates_file +# +# (boolean value) +#cinder_api_insecure = false + +# +# The address where the cinder authentication service is listening. +# +# When all of ``cinder_store_auth_address``, ``cinder_store_user_name``, +# ``cinder_store_project_name``, and ``cinder_store_password`` options are +# specified, the specified values are always used for the authentication. +# This is useful to hide the image volumes from users by storing them in a +# project/tenant specific to the image service. It also enables users to share +# the image volume among other projects under the control of glance's ACL. +# +# If either of these options are not set, the cinder endpoint is looked up +# from the service catalog, and current context's user and project are used. +# +# Possible values: +# * A valid authentication service address, for example: +# ``http://openstack.example.org/identity/v2.0`` +# +# Related options: +# * cinder_store_user_name +# * cinder_store_password +# * cinder_store_project_name +# +# (string value) +#cinder_store_auth_address = + +# +# User name to authenticate against cinder. +# +# This must be used with all the following related options. If any of these are +# not specified, the user of the current context is used. +# +# Possible values: +# * A valid user name +# +# Related options: +# * cinder_store_auth_address +# * cinder_store_password +# * cinder_store_project_name +# +# (string value) +#cinder_store_user_name = + +# +# Password for the user authenticating against cinder. +# +# This must be used with all the following related options. If any of these are +# not specified, the user of the current context is used. +# +# Possible values: +# * A valid password for the user specified by ``cinder_store_user_name`` +# +# Related options: +# * cinder_store_auth_address +# * cinder_store_user_name +# * cinder_store_project_name +# +# (string value) +#cinder_store_password = + +# +# Project name where the image volume is stored in cinder. +# +# If this configuration option is not set, the project in current context is +# used. +# +# This must be used with all the following related options. If any of these are +# not specified, the project of the current context is used. +# +# Possible values: +# * A valid project name +# +# Related options: +# * ``cinder_store_auth_address`` +# * ``cinder_store_user_name`` +# * ``cinder_store_password`` +# +# (string value) +#cinder_store_project_name = + +# +# Path to the rootwrap configuration file to use for running commands as root. +# +# The cinder store requires root privileges to operate the image volumes (for +# connecting to iSCSI/FC volumes and reading/writing the volume data, etc.). +# The configuration file should allow the required commands by cinder store and +# os-brick library. +# +# Possible values: +# * Path to the rootwrap config file +# +# Related options: +# * None +# +# (string value) +#rootwrap_config = /etc/glance/rootwrap.conf + +# +# Volume type that will be used for volume creation in cinder. +# +# Some cinder backends can have several volume types to optimize storage usage. +# Adding this option allows an operator to choose a specific volume type +# in cinder that can be optimized for images. +# +# If this is not set, then the default volume type specified in the cinder +# configuration will be used for volume creation. +# +# Possible values: +# * A valid volume type from cinder +# +# Related options: +# * None +# +# (string value) +#cinder_volume_type = + +# +# Directory to which the filesystem backend store writes images. +# +# Upon start up, Glance creates the directory if it doesn't already +# exist and verifies write access to the user under which +# ``glance-api`` runs. If the write access isn't available, a +# ``BadStoreConfiguration`` exception is raised and the filesystem +# store may not be available for adding new images. +# +# NOTE: This directory is used only when filesystem store is used as a +# storage backend. Either ``filesystem_store_datadir`` or +# ``filesystem_store_datadirs`` option must be specified in +# ``glance-api.conf``. If both options are specified, a +# ``BadStoreConfiguration`` will be raised and the filesystem store +# may not be available for adding new images. +# +# Possible values: +# * A valid path to a directory +# +# Related options: +# * ``filesystem_store_datadirs`` +# * ``filesystem_store_file_perm`` +# +# (string value) +#filesystem_store_datadir = /var/lib/glance/images + +# +# List of directories and their priorities to which the filesystem +# backend store writes images. +# +# The filesystem store can be configured to store images in multiple +# directories as opposed to using a single directory specified by the +# ``filesystem_store_datadir`` configuration option. When using +# multiple directories, each directory can be given an optional +# priority to specify the preference order in which they should +# be used. Priority is an integer that is concatenated to the +# directory path with a colon where a higher value indicates higher +# priority. When two directories have the same priority, the directory +# with most free space is used. When no priority is specified, it +# defaults to zero. +# +# More information on configuring filesystem store with multiple store +# directories can be found at +# http://docs.openstack.org/developer/glance/configuring.html +# +# NOTE: This directory is used only when filesystem store is used as a +# storage backend. Either ``filesystem_store_datadir`` or +# ``filesystem_store_datadirs`` option must be specified in +# ``glance-api.conf``. If both options are specified, a +# ``BadStoreConfiguration`` will be raised and the filesystem store +# may not be available for adding new images. +# +# Possible values: +# * List of strings of the following form: +# * ``:`` +# +# Related options: +# * ``filesystem_store_datadir`` +# * ``filesystem_store_file_perm`` +# +# (multi valued) +#filesystem_store_datadirs = + +# +# Filesystem store metadata file. +# +# The path to a file which contains the metadata to be returned with +# any location associated with the filesystem store. The file must +# contain a valid JSON object. The object should contain the keys +# ``id`` and ``mountpoint``. The value for both keys should be a +# string. +# +# Possible values: +# * A valid path to the store metadata file +# +# Related options: +# * None +# +# (string value) +#filesystem_store_metadata_file = + +# +# File access permissions for the image files. +# +# Set the intended file access permissions for image data. This provides +# a way to enable other services, e.g. Nova, to consume images directly +# from the filesystem store. The users running the services that are +# intended to be given access to could be made a member of the group +# that owns the files created. Assigning a value less then or equal to +# zero for this configuration option signifies that no changes be made +# to the default permissions. This value will be decoded as an octal +# digit. +# +# For more information, please refer the documentation at +# http://docs.openstack.org/developer/glance/configuring.html +# +# Possible values: +# * A valid file access permission +# * Zero +# * Any negative integer +# +# Related options: +# * None +# +# (integer value) +#filesystem_store_file_perm = 0 + +# +# Path to the CA bundle file. +# +# This configuration option enables the operator to use a custom +# Certificate Authority file to verify the remote server certificate. If +# this option is set, the ``https_insecure`` option will be ignored and +# the CA file specified will be used to authenticate the server +# certificate and establish a secure connection to the server. +# +# Possible values: +# * A valid path to a CA file +# +# Related options: +# * https_insecure +# +# (string value) +#https_ca_certificates_file = + +# +# Set verification of the remote server certificate. +# +# This configuration option takes in a boolean value to determine +# whether or not to verify the remote server certificate. If set to +# True, the remote server certificate is not verified. If the option is +# set to False, then the default CA truststore is used for verification. +# +# This option is ignored if ``https_ca_certificates_file`` is set. +# The remote server certificate will then be verified using the file +# specified using the ``https_ca_certificates_file`` option. +# +# Possible values: +# * True +# * False +# +# Related options: +# * https_ca_certificates_file +# +# (boolean value) +#https_insecure = true + +# +# The http/https proxy information to be used to connect to the remote +# server. +# +# This configuration option specifies the http/https proxy information +# that should be used to connect to the remote server. The proxy +# information should be a key value pair of the scheme and proxy, for +# example, http:10.0.0.1:3128. You can also specify proxies for multiple +# schemes by separating the key value pairs with a comma, for example, +# http:10.0.0.1:3128, https:10.0.0.1:1080. +# +# Possible values: +# * A comma separated list of scheme:proxy pairs as described above +# +# Related options: +# * None +# +# (dict value) +#http_proxy_information = + +# +# Size, in megabytes, to chunk RADOS images into. +# +# Provide an integer value representing the size in megabytes to chunk +# Glance images into. The default chunk size is 8 megabytes. For optimal +# performance, the value should be a power of two. +# +# When Ceph's RBD object storage system is used as the storage backend +# for storing Glance images, the images are chunked into objects of the +# size set using this option. These chunked objects are then stored +# across the distributed block data store to use for Glance. +# +# Possible Values: +# * Any positive integer value +# +# Related options: +# * None +# +# (integer value) +# Minimum value: 1 +#rbd_store_chunk_size = 8 + +# +# RADOS pool in which images are stored. +# +# When RBD is used as the storage backend for storing Glance images, the +# images are stored by means of logical grouping of the objects (chunks +# of images) into a ``pool``. Each pool is defined with the number of +# placement groups it can contain. The default pool that is used is +# 'images'. +# +# More information on the RBD storage backend can be found here: +# http://ceph.com/planet/how-data-is-stored-in-ceph-cluster/ +# +# Possible Values: +# * A valid pool name +# +# Related options: +# * None +# +# (string value) +#rbd_store_pool = images + +# +# RADOS user to authenticate as. +# +# This configuration option takes in the RADOS user to authenticate as. +# This is only needed when RADOS authentication is enabled and is +# applicable only if the user is using Cephx authentication. If the +# value for this option is not set by the user or is set to None, a +# default value will be chosen, which will be based on the client. +# section in rbd_store_ceph_conf. +# +# Possible Values: +# * A valid RADOS user +# +# Related options: +# * rbd_store_ceph_conf +# +# (string value) +#rbd_store_user = + +# +# Ceph configuration file path. +# +# This configuration option takes in the path to the Ceph configuration +# file to be used. If the value for this option is not set by the user +# or is set to None, librados will locate the default configuration file +# which is located at /etc/ceph/ceph.conf. If using Cephx +# authentication, this file should include a reference to the right +# keyring in a client. section +# +# Possible Values: +# * A valid path to a configuration file +# +# Related options: +# * rbd_store_user +# +# (string value) +#rbd_store_ceph_conf = /etc/ceph/ceph.conf + +# +# Timeout value for connecting to Ceph cluster. +# +# This configuration option takes in the timeout value in seconds used +# when connecting to the Ceph cluster i.e. it sets the time to wait for +# glance-api before closing the connection. This prevents glance-api +# hangups during the connection to RBD. If the value for this option +# is set to less than or equal to 0, no timeout is set and the default +# librados value is used. +# +# Possible Values: +# * Any integer value +# +# Related options: +# * None +# +# (integer value) +#rados_connect_timeout = 0 + +# +# Chunk size for images to be stored in Sheepdog data store. +# +# Provide an integer value representing the size in mebibyte +# (1048576 bytes) to chunk Glance images into. The default +# chunk size is 64 mebibytes. +# +# When using Sheepdog distributed storage system, the images are +# chunked into objects of this size and then stored across the +# distributed data store to use for Glance. +# +# Chunk sizes, if a power of two, help avoid fragmentation and +# enable improved performance. +# +# Possible values: +# * Positive integer value representing size in mebibytes. +# +# Related Options: +# * None +# +# (integer value) +# Minimum value: 1 +#sheepdog_store_chunk_size = 64 + +# +# Port number on which the sheep daemon will listen. +# +# Provide an integer value representing a valid port number on +# which you want the Sheepdog daemon to listen on. The default +# port is 7000. +# +# The Sheepdog daemon, also called 'sheep', manages the storage +# in the distributed cluster by writing objects across the storage +# network. It identifies and acts on the messages it receives on +# the port number set using ``sheepdog_store_port`` option to store +# chunks of Glance images. +# +# Possible values: +# * A valid port number (0 to 65535) +# +# Related Options: +# * sheepdog_store_address +# +# (port value) +# Minimum value: 0 +# Maximum value: 65535 +#sheepdog_store_port = 7000 + +# +# Address to bind the Sheepdog daemon to. +# +# Provide a string value representing the address to bind the +# Sheepdog daemon to. The default address set for the 'sheep' +# is 127.0.0.1. +# +# The Sheepdog daemon, also called 'sheep', manages the storage +# in the distributed cluster by writing objects across the storage +# network. It identifies and acts on the messages directed to the +# address set using ``sheepdog_store_address`` option to store +# chunks of Glance images. +# +# Possible values: +# * A valid IPv4 address +# * A valid IPv6 address +# * A valid hostname +# +# Related Options: +# * sheepdog_store_port +# +# (unknown value) +#sheepdog_store_address = 127.0.0.1 + +# +# Set verification of the server certificate. +# +# This boolean determines whether or not to verify the server +# certificate. If this option is set to True, swiftclient won't check +# for a valid SSL certificate when authenticating. If the option is set +# to False, then the default CA truststore is used for verification. +# +# Possible values: +# * True +# * False +# +# Related options: +# * swift_store_cacert +# +# (boolean value) +#swift_store_auth_insecure = false + +# +# Path to the CA bundle file. +# +# This configuration option enables the operator to specify the path to +# a custom Certificate Authority file for SSL verification when +# connecting to Swift. +# +# Possible values: +# * A valid path to a CA file +# +# Related options: +# * swift_store_auth_insecure +# +# (string value) +#swift_store_cacert = /etc/ssl/certs/ca-certificates.crt + +# +# The region of Swift endpoint to use by Glance. +# +# Provide a string value representing a Swift region where Glance +# can connect to for image storage. By default, there is no region +# set. +# +# When Glance uses Swift as the storage backend to store images +# for a specific tenant that has multiple endpoints, setting of a +# Swift region with ``swift_store_region`` allows Glance to connect +# to Swift in the specified region as opposed to a single region +# connectivity. +# +# This option can be configured for both single-tenant and +# multi-tenant storage. +# +# NOTE: Setting the region with ``swift_store_region`` is +# tenant-specific and is necessary ``only if`` the tenant has +# multiple endpoints across different regions. +# +# Possible values: +# * A string value representing a valid Swift region. +# +# Related Options: +# * None +# +# (string value) +#swift_store_region = RegionTwo + +# +# The URL endpoint to use for Swift backend storage. +# +# Provide a string value representing the URL endpoint to use for +# storing Glance images in Swift store. By default, an endpoint +# is not set and the storage URL returned by ``auth`` is used. +# Setting an endpoint with ``swift_store_endpoint`` overrides the +# storage URL and is used for Glance image storage. +# +# NOTE: The URL should include the path up to, but excluding the +# container. The location of an object is obtained by appending +# the container and object to the configured URL. +# +# Possible values: +# * String value representing a valid URL path up to a Swift container +# +# Related Options: +# * None +# +# (string value) +#swift_store_endpoint = https://swift.openstack.example.org/v1/path_not_including_container_name + +# +# Endpoint Type of Swift service. +# +# This string value indicates the endpoint type to use to fetch the +# Swift endpoint. The endpoint type determines the actions the user will +# be allowed to perform, for instance, reading and writing to the Store. +# This setting is only used if swift_store_auth_version is greater than +# 1. +# +# Possible values: +# * publicURL +# * adminURL +# * internalURL +# +# Related options: +# * swift_store_endpoint +# +# (string value) +# Possible values: +# publicURL - +# adminURL - +# internalURL - +#swift_store_endpoint_type = publicURL + +# +# Type of Swift service to use. +# +# Provide a string value representing the service type to use for +# storing images while using Swift backend storage. The default +# service type is set to ``object-store``. +# +# NOTE: If ``swift_store_auth_version`` is set to 2, the value for +# this configuration option needs to be ``object-store``. If using +# a higher version of Keystone or a different auth scheme, this +# option may be modified. +# +# Possible values: +# * A string representing a valid service type for Swift storage. +# +# Related Options: +# * None +# +# (string value) +#swift_store_service_type = object-store + +# +# Name of single container to store images/name prefix for multiple containers +# +# When a single container is being used to store images, this configuration +# option indicates the container within the Glance account to be used for +# storing all images. When multiple containers are used to store images, this +# will be the name prefix for all containers. Usage of single/multiple +# containers can be controlled using the configuration option +# ``swift_store_multiple_containers_seed``. +# +# When using multiple containers, the containers will be named after the value +# set for this configuration option with the first N chars of the image UUID +# as the suffix delimited by an underscore (where N is specified by +# ``swift_store_multiple_containers_seed``). +# +# Example: if the seed is set to 3 and swift_store_container = ``glance``, then +# an image with UUID ``fdae39a1-bac5-4238-aba4-69bcc726e848`` would be placed in +# the container ``glance_fda``. All dashes in the UUID are included when +# creating the container name but do not count toward the character limit, so +# when N=10 the container name would be ``glance_fdae39a1-ba.`` +# +# Possible values: +# * If using single container, this configuration option can be any string +# that is a valid swift container name in Glance's Swift account +# * If using multiple containers, this configuration option can be any +# string as long as it satisfies the container naming rules enforced by +# Swift. The value of ``swift_store_multiple_containers_seed`` should be +# taken into account as well. +# +# Related options: +# * ``swift_store_multiple_containers_seed`` +# * ``swift_store_multi_tenant`` +# * ``swift_store_create_container_on_put`` +# +# (string value) +#swift_store_container = glance + +# +# The size threshold, in MB, after which Glance will start segmenting image +# data. +# +# Swift has an upper limit on the size of a single uploaded object. By default, +# this is 5GB. To upload objects bigger than this limit, objects are segmented +# into multiple smaller objects that are tied together with a manifest file. +# For more detail, refer to +# http://docs.openstack.org/developer/swift/overview_large_objects.html +# +# This configuration option specifies the size threshold over which the Swift +# driver will start segmenting image data into multiple smaller files. +# Currently, the Swift driver only supports creating Dynamic Large Objects. +# +# NOTE: This should be set by taking into account the large object limit +# enforced by the Swift cluster in consideration. +# +# Possible values: +# * A positive integer that is less than or equal to the large object limit +# enforced by the Swift cluster in consideration. +# +# Related options: +# * ``swift_store_large_object_chunk_size`` +# +# (integer value) +# Minimum value: 1 +#swift_store_large_object_size = 5120 + +# +# The maximum size, in MB, of the segments when image data is segmented. +# +# When image data is segmented to upload images that are larger than the limit +# enforced by the Swift cluster, image data is broken into segments that are no +# bigger than the size specified by this configuration option. +# Refer to ``swift_store_large_object_size`` for more detail. +# +# For example: if ``swift_store_large_object_size`` is 5GB and +# ``swift_store_large_object_chunk_size`` is 1GB, an image of size 6.2GB will be +# segmented into 7 segments where the first six segments will be 1GB in size and +# the seventh segment will be 0.2GB. +# +# Possible values: +# * A positive integer that is less than or equal to the large object limit +# enforced by Swift cluster in consideration. +# +# Related options: +# * ``swift_store_large_object_size`` +# +# (integer value) +# Minimum value: 1 +#swift_store_large_object_chunk_size = 200 + +# +# Create container, if it doesn't already exist, when uploading image. +# +# At the time of uploading an image, if the corresponding container doesn't +# exist, it will be created provided this configuration option is set to True. +# By default, it won't be created. This behavior is applicable for both single +# and multiple containers mode. +# +# Possible values: +# * True +# * False +# +# Related options: +# * None +# +# (boolean value) +#swift_store_create_container_on_put = false + +# +# Store images in tenant's Swift account. +# +# This enables multi-tenant storage mode which causes Glance images to be stored +# in tenant specific Swift accounts. If this is disabled, Glance stores all +# images in its own account. More details multi-tenant store can be found at +# https://wiki.openstack.org/wiki/GlanceSwiftTenantSpecificStorage +# +# NOTE: If using multi-tenant swift store, please make sure +# that you do not set a swift configuration file with the +# 'swift_store_config_file' option. +# +# Possible values: +# * True +# * False +# +# Related options: +# * swift_store_config_file +# +# (boolean value) +#swift_store_multi_tenant = false + +# +# Seed indicating the number of containers to use for storing images. +# +# When using a single-tenant store, images can be stored in one or more than one +# containers. When set to 0, all images will be stored in one single container. +# When set to an integer value between 1 and 32, multiple containers will be +# used to store images. This configuration option will determine how many +# containers are created. The total number of containers that will be used is +# equal to 16^N, so if this config option is set to 2, then 16^2=256 containers +# will be used to store images. +# +# Please refer to ``swift_store_container`` for more detail on the naming +# convention. More detail about using multiple containers can be found at +# https://specs.openstack.org/openstack/glance-specs/specs/kilo/swift-store- +# multiple-containers.html +# +# NOTE: This is used only when swift_store_multi_tenant is disabled. +# +# Possible values: +# * A non-negative integer less than or equal to 32 +# +# Related options: +# * ``swift_store_container`` +# * ``swift_store_multi_tenant`` +# * ``swift_store_create_container_on_put`` +# +# (integer value) +# Minimum value: 0 +# Maximum value: 32 +#swift_store_multiple_containers_seed = 0 + +# +# List of tenants that will be granted admin access. +# +# This is a list of tenants that will be granted read/write access on +# all Swift containers created by Glance in multi-tenant mode. The +# default value is an empty list. +# +# Possible values: +# * A comma separated list of strings representing UUIDs of Keystone +# projects/tenants +# +# Related options: +# * None +# +# (list value) +#swift_store_admin_tenants = + +# +# SSL layer compression for HTTPS Swift requests. +# +# Provide a boolean value to determine whether or not to compress +# HTTPS Swift requests for images at the SSL layer. By default, +# compression is enabled. +# +# When using Swift as the backend store for Glance image storage, +# SSL layer compression of HTTPS Swift requests can be set using +# this option. If set to False, SSL layer compression of HTTPS +# Swift requests is disabled. Disabling this option may improve +# performance for images which are already in a compressed format, +# for example, qcow2. +# +# Possible values: +# * True +# * False +# +# Related Options: +# * None +# +# (boolean value) +#swift_store_ssl_compression = true + +# +# The number of times a Swift download will be retried before the +# request fails. +# +# Provide an integer value representing the number of times an image +# download must be retried before erroring out. The default value is +# zero (no retry on a failed image download). When set to a positive +# integer value, ``swift_store_retry_get_count`` ensures that the +# download is attempted this many more times upon a download failure +# before sending an error message. +# +# Possible values: +# * Zero +# * Positive integer value +# +# Related Options: +# * None +# +# (integer value) +# Minimum value: 0 +#swift_store_retry_get_count = 0 + +# +# Time in seconds defining the size of the window in which a new +# token may be requested before the current token is due to expire. +# +# Typically, the Swift storage driver fetches a new token upon the +# expiration of the current token to ensure continued access to +# Swift. However, some Swift transactions (like uploading image +# segments) may not recover well if the token expires on the fly. +# +# Hence, by fetching a new token before the current token expiration, +# we make sure that the token does not expire or is close to expiry +# before a transaction is attempted. By default, the Swift storage +# driver requests for a new token 60 seconds or less before the +# current token expiration. +# +# Possible values: +# * Zero +# * Positive integer value +# +# Related Options: +# * None +# +# (integer value) +# Minimum value: 0 +#swift_store_expire_soon_interval = 60 + +# +# Use trusts for multi-tenant Swift store. +# +# This option instructs the Swift store to create a trust for each +# add/get request when the multi-tenant store is in use. Using trusts +# allows the Swift store to avoid problems that can be caused by an +# authentication token expiring during the upload or download of data. +# +# By default, ``swift_store_use_trusts`` is set to ``True``(use of +# trusts is enabled). If set to ``False``, a user token is used for +# the Swift connection instead, eliminating the overhead of trust +# creation. +# +# NOTE: This option is considered only when +# ``swift_store_multi_tenant`` is set to ``True`` +# +# Possible values: +# * True +# * False +# +# Related options: +# * swift_store_multi_tenant +# +# (boolean value) +#swift_store_use_trusts = true + +# +# Buffer image segments before upload to Swift. +# +# Provide a boolean value to indicate whether or not Glance should +# buffer image data to disk while uploading to swift. This enables +# Glance to resume uploads on error. +# +# NOTES: +# When enabling this option, one should take great care as this +# increases disk usage on the API node. Be aware that depending +# upon how the file system is configured, the disk space used +# for buffering may decrease the actual disk space available for +# the glance image cache. Disk utilization will cap according to +# the following equation: +# (``swift_store_large_object_chunk_size`` * ``workers`` * 1000) +# +# Possible values: +# * True +# * False +# +# Related options: +# * swift_upload_buffer_dir +# +# (boolean value) +#swift_buffer_on_upload = false + +# +# Reference to default Swift account/backing store parameters. +# +# Provide a string value representing a reference to the default set +# of parameters required for using swift account/backing store for +# image storage. The default reference value for this configuration +# option is 'ref1'. This configuration option dereferences the +# parameters and facilitates image storage in Swift storage backend +# every time a new image is added. +# +# Possible values: +# * A valid string value +# +# Related options: +# * None +# +# (string value) +#default_swift_reference = ref1 + +# DEPRECATED: Version of the authentication service to use. Valid versions are 2 +# and 3 for keystone and 1 (deprecated) for swauth and rackspace. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: +# The option 'auth_version' in the Swift back-end configuration file is +# used instead. +#swift_store_auth_version = 2 + +# DEPRECATED: The address where the Swift authentication service is listening. +# (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: +# The option 'auth_address' in the Swift back-end configuration file is +# used instead. +#swift_store_auth_address = + +# DEPRECATED: The user to authenticate against the Swift authentication service. +# (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: +# The option 'user' in the Swift back-end configuration file is set instead. +#swift_store_user = + +# DEPRECATED: Auth key for the user authenticating against the Swift +# authentication service. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: +# The option 'key' in the Swift back-end configuration file is used +# to set the authentication key instead. +#swift_store_key = + +# +# Absolute path to the file containing the swift account(s) +# configurations. +# +# Include a string value representing the path to a configuration +# file that has references for each of the configured Swift +# account(s)/backing stores. By default, no file path is specified +# and customized Swift referencing is disabled. Configuring this +# option is highly recommended while using Swift storage backend for +# image storage as it avoids storage of credentials in the database. +# +# NOTE: Please do not configure this option if you have set +# ``swift_store_multi_tenant`` to ``True``. +# +# Possible values: +# * String value representing an absolute path on the glance-api +# node +# +# Related options: +# * swift_store_multi_tenant +# +# (string value) +#swift_store_config_file = + +# +# Directory to buffer image segments before upload to Swift. +# +# Provide a string value representing the absolute path to the +# directory on the glance node where image segments will be +# buffered briefly before they are uploaded to swift. +# +# NOTES: +# * This is required only when the configuration option +# ``swift_buffer_on_upload`` is set to True. +# * This directory should be provisioned keeping in mind the +# ``swift_store_large_object_chunk_size`` and the maximum +# number of images that could be uploaded simultaneously by +# a given glance node. +# +# Possible values: +# * String value representing an absolute directory path +# +# Related options: +# * swift_buffer_on_upload +# * swift_store_large_object_chunk_size +# +# (string value) +#swift_upload_buffer_dir = + +# +# Address of the ESX/ESXi or vCenter Server target system. +# +# This configuration option sets the address of the ESX/ESXi or vCenter +# Server target system. This option is required when using the VMware +# storage backend. The address can contain an IP address (127.0.0.1) or +# a DNS name (www.my-domain.com). +# +# Possible Values: +# * A valid IPv4 or IPv6 address +# * A valid DNS name +# +# Related options: +# * vmware_server_username +# * vmware_server_password +# +# (unknown value) +#vmware_server_host = 127.0.0.1 + +# +# Server username. +# +# This configuration option takes the username for authenticating with +# the VMware ESX/ESXi or vCenter Server. This option is required when +# using the VMware storage backend. +# +# Possible Values: +# * Any string that is the username for a user with appropriate +# privileges +# +# Related options: +# * vmware_server_host +# * vmware_server_password +# +# (string value) +#vmware_server_username = root + +# +# Server password. +# +# This configuration option takes the password for authenticating with +# the VMware ESX/ESXi or vCenter Server. This option is required when +# using the VMware storage backend. +# +# Possible Values: +# * Any string that is a password corresponding to the username +# specified using the "vmware_server_username" option +# +# Related options: +# * vmware_server_host +# * vmware_server_username +# +# (string value) +#vmware_server_password = vmware + +# +# The number of VMware API retries. +# +# This configuration option specifies the number of times the VMware +# ESX/VC server API must be retried upon connection related issues or +# server API call overload. It is not possible to specify 'retry +# forever'. +# +# Possible Values: +# * Any positive integer value +# +# Related options: +# * None +# +# (integer value) +# Minimum value: 1 +#vmware_api_retry_count = 10 + +# +# Interval in seconds used for polling remote tasks invoked on VMware +# ESX/VC server. +# +# This configuration option takes in the sleep time in seconds for polling an +# on-going async task as part of the VMWare ESX/VC server API call. +# +# Possible Values: +# * Any positive integer value +# +# Related options: +# * None +# +# (integer value) +# Minimum value: 1 +#vmware_task_poll_interval = 5 + +# +# The directory where the glance images will be stored in the datastore. +# +# This configuration option specifies the path to the directory where the +# glance images will be stored in the VMware datastore. If this option +# is not set, the default directory where the glance images are stored +# is openstack_glance. +# +# Possible Values: +# * Any string that is a valid path to a directory +# +# Related options: +# * None +# +# (string value) +#vmware_store_image_dir = /openstack_glance + +# +# Set verification of the ESX/vCenter server certificate. +# +# This configuration option takes a boolean value to determine +# whether or not to verify the ESX/vCenter server certificate. If this +# option is set to True, the ESX/vCenter server certificate is not +# verified. If this option is set to False, then the default CA +# truststore is used for verification. +# +# This option is ignored if the "vmware_ca_file" option is set. In that +# case, the ESX/vCenter server certificate will then be verified using +# the file specified using the "vmware_ca_file" option . +# +# Possible Values: +# * True +# * False +# +# Related options: +# * vmware_ca_file +# +# (boolean value) +# Deprecated group/name - [glance_store]/vmware_api_insecure +#vmware_insecure = false + +# +# Absolute path to the CA bundle file. +# +# This configuration option enables the operator to use a custom +# Cerificate Authority File to verify the ESX/vCenter certificate. +# +# If this option is set, the "vmware_insecure" option will be ignored +# and the CA file specified will be used to authenticate the ESX/vCenter +# server certificate and establish a secure connection to the server. +# +# Possible Values: +# * Any string that is a valid absolute path to a CA file +# +# Related options: +# * vmware_insecure +# +# (string value) +#vmware_ca_file = /etc/ssl/certs/ca-certificates.crt + +# +# The datastores where the image can be stored. +# +# This configuration option specifies the datastores where the image can +# be stored in the VMWare store backend. This option may be specified +# multiple times for specifying multiple datastores. The datastore name +# should be specified after its datacenter path, separated by ":". An +# optional weight may be given after the datastore name, separated again +# by ":" to specify the priority. Thus, the required format becomes +# ::. +# +# When adding an image, the datastore with highest weight will be +# selected, unless there is not enough free space available in cases +# where the image size is already known. If no weight is given, it is +# assumed to be zero and the directory will be considered for selection +# last. If multiple datastores have the same weight, then the one with +# the most free space available is selected. +# +# Possible Values: +# * Any string of the format: +# :: +# +# Related options: +# * None +# +# (multi valued) +#vmware_datastores = + + +[oslo_policy] + +# +# From oslo.policy +# + +# This option controls whether or not to enforce scope when evaluating policies. +# If ``True``, the scope of the token used in the request is compared to the +# ``scope_types`` of the policy being enforced. If the scopes do not match, an +# ``InvalidScope`` exception will be raised. If ``False``, a message will be +# logged informing operators that policies are being invoked with mismatching +# scope. (boolean value) +#enforce_scope = false + +# The file that defines policies. (string value) +#policy_file = policy.json + +# Default rule. Enforced when a requested rule is not found. (string value) +#policy_default_rule = default + +# Directories where policy configuration files are stored. They can be relative +# to any directory in the search path defined by the config_dir option, or +# absolute paths. The file defined by policy_file must exist for these +# directories to be searched. Missing or empty directories are ignored. (multi +# valued) +#policy_dirs = policy.d + +# Content Type to send and receive data for REST based policy check (string +# value) +# Possible values: +# application/x-www-form-urlencoded - +# application/json - +#remote_content_type = application/x-www-form-urlencoded + +# server identity verification for REST based policy check (boolean value) +#remote_ssl_verify_server_crt = false + +# Absolute path to ca cert file for REST based policy check (string value) +#remote_ssl_ca_crt_file = + +# Absolute path to client cert for REST based policy check (string value) +#remote_ssl_client_crt_file = + +# Absolute path client key file REST based policy check (string value) +#remote_ssl_client_key_file = diff --git a/openstack/openstack_conf/controller/glance/glance-manage.conf b/openstack/openstack_conf/controller/glance/glance-manage.conf new file mode 100644 index 0000000..6495eb6 --- /dev/null +++ b/openstack/openstack_conf/controller/glance/glance-manage.conf @@ -0,0 +1,228 @@ +[DEFAULT] + +# +# From oslo.log +# + +# If set to true, the logging level will be set to DEBUG instead of the default +# INFO level. (boolean value) +# Note: This option can be changed without restarting. +#debug = false + +# The name of a logging configuration file. This file is appended to any +# existing logging configuration files. For details about logging configuration +# files, see the Python logging module documentation. Note that when logging +# configuration files are used then all logging configuration is set in the +# configuration file and other logging configuration options are ignored (for +# example, logging_context_format_string). (string value) +# Note: This option can be changed without restarting. +# Deprecated group/name - [DEFAULT]/log_config +#log_config_append = + +# Defines the format string for %%(asctime)s in log records. Default: +# %(default)s . This option is ignored if log_config_append is set. (string +# value) +#log_date_format = %Y-%m-%d %H:%M:%S + +# (Optional) Name of log file to send logging output to. If no default is set, +# logging will go to stderr as defined by use_stderr. This option is ignored if +# log_config_append is set. (string value) +# Deprecated group/name - [DEFAULT]/logfile +#log_file = + +# (Optional) The base directory used for relative log_file paths. This option +# is ignored if log_config_append is set. (string value) +# Deprecated group/name - [DEFAULT]/logdir +#log_dir = + +# Uses logging handler designed to watch file system. When log file is moved or +# removed this handler will open a new log file with specified path +# instantaneously. It makes sense only if log_file option is specified and Linux +# platform is used. This option is ignored if log_config_append is set. (boolean +# value) +#watch_log_file = false + +# Use syslog for logging. Existing syslog format is DEPRECATED and will be +# changed later to honor RFC5424. This option is ignored if log_config_append is +# set. (boolean value) +#use_syslog = false + +# Enable journald for logging. If running in a systemd environment you may wish +# to enable journal support. Doing so will use the journal native protocol which +# includes structured metadata in addition to log messages.This option is +# ignored if log_config_append is set. (boolean value) +#use_journal = false + +# Syslog facility to receive log lines. This option is ignored if +# log_config_append is set. (string value) +#syslog_log_facility = LOG_USER + +# Use JSON formatting for logging. This option is ignored if log_config_append +# is set. (boolean value) +#use_json = false + +# Log output to standard error. This option is ignored if log_config_append is +# set. (boolean value) +#use_stderr = false + +# Format string to use for log messages with context. (string value) +#logging_context_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user_identity)s] %(instance)s%(message)s + +# Format string to use for log messages when context is undefined. (string +# value) +#logging_default_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [-] %(instance)s%(message)s + +# Additional data to append to log message when logging level for the message is +# DEBUG. (string value) +#logging_debug_format_suffix = %(funcName)s %(pathname)s:%(lineno)d + +# Prefix each line of exception output with this format. (string value) +#logging_exception_prefix = %(asctime)s.%(msecs)03d %(process)d ERROR %(name)s %(instance)s + +# Defines the format string for %(user_identity)s that is used in +# logging_context_format_string. (string value) +#logging_user_identity_format = %(user)s %(tenant)s %(domain)s %(user_domain)s %(project_domain)s + +# List of package logging levels in logger=LEVEL pairs. This option is ignored +# if log_config_append is set. (list value) +#default_log_levels = amqp=WARN,amqplib=WARN,boto=WARN,qpid=WARN,sqlalchemy=WARN,suds=INFO,oslo.messaging=INFO,oslo_messaging=INFO,iso8601=WARN,requests.packages.urllib3.connectionpool=WARN,urllib3.connectionpool=WARN,websocket=WARN,requests.packages.urllib3.util.retry=WARN,urllib3.util.retry=WARN,keystonemiddleware=WARN,routes.middleware=WARN,stevedore=WARN,taskflow=WARN,keystoneauth=WARN,oslo.cache=INFO,dogpile.core.dogpile=INFO + +# Enables or disables publication of error events. (boolean value) +#publish_errors = false + +# The format for an instance that is passed with the log message. (string value) +#instance_format = "[instance: %(uuid)s] " + +# The format for an instance UUID that is passed with the log message. (string +# value) +#instance_uuid_format = "[instance: %(uuid)s] " + +# Interval, number of seconds, of log rate limiting. (integer value) +#rate_limit_interval = 0 + +# Maximum number of logged messages per rate_limit_interval. (integer value) +#rate_limit_burst = 0 + +# Log level name used by rate limiting: CRITICAL, ERROR, INFO, WARNING, DEBUG or +# empty string. Logs with level greater or equal to rate_limit_except_level are +# not filtered. An empty string means that all levels are filtered. (string +# value) +#rate_limit_except_level = CRITICAL + +# Enables or disables fatal status of deprecations. (boolean value) +#fatal_deprecations = false + + +[database] + +# +# From oslo.db +# + +# If True, SQLite uses synchronous mode. (boolean value) +#sqlite_synchronous = true + +# The back end to use for the database. (string value) +# Deprecated group/name - [DEFAULT]/db_backend +#backend = sqlalchemy + +# The SQLAlchemy connection string to use to connect to the database. (string +# value) +# Deprecated group/name - [DEFAULT]/sql_connection +# Deprecated group/name - [DATABASE]/sql_connection +# Deprecated group/name - [sql]/connection +#connection = + +# The SQLAlchemy connection string to use to connect to the slave database. +# (string value) +#slave_connection = + +# The SQL mode to be used for MySQL sessions. This option, including the +# default, overrides any server-set SQL mode. To use whatever SQL mode is set by +# the server configuration, set this to no value. Example: mysql_sql_mode= +# (string value) +#mysql_sql_mode = TRADITIONAL + +# If True, transparently enables support for handling MySQL Cluster (NDB). +# (boolean value) +#mysql_enable_ndb = false + +# Connections which have been present in the connection pool longer than this +# number of seconds will be replaced with a new one the next time they are +# checked out from the pool. (integer value) +# Deprecated group/name - [DATABASE]/idle_timeout +# Deprecated group/name - [database]/idle_timeout +# Deprecated group/name - [DEFAULT]/sql_idle_timeout +# Deprecated group/name - [DATABASE]/sql_idle_timeout +# Deprecated group/name - [sql]/idle_timeout +#connection_recycle_time = 3600 + +# Minimum number of SQL connections to keep open in a pool. (integer value) +# Deprecated group/name - [DEFAULT]/sql_min_pool_size +# Deprecated group/name - [DATABASE]/sql_min_pool_size +#min_pool_size = 1 + +# Maximum number of SQL connections to keep open in a pool. Setting a value of 0 +# indicates no limit. (integer value) +# Deprecated group/name - [DEFAULT]/sql_max_pool_size +# Deprecated group/name - [DATABASE]/sql_max_pool_size +#max_pool_size = 5 + +# Maximum number of database connection retries during startup. Set to -1 to +# specify an infinite retry count. (integer value) +# Deprecated group/name - [DEFAULT]/sql_max_retries +# Deprecated group/name - [DATABASE]/sql_max_retries +#max_retries = 10 + +# Interval between retries of opening a SQL connection. (integer value) +# Deprecated group/name - [DEFAULT]/sql_retry_interval +# Deprecated group/name - [DATABASE]/reconnect_interval +#retry_interval = 10 + +# If set, use this value for max_overflow with SQLAlchemy. (integer value) +# Deprecated group/name - [DEFAULT]/sql_max_overflow +# Deprecated group/name - [DATABASE]/sqlalchemy_max_overflow +#max_overflow = 50 + +# Verbosity of SQL debugging information: 0=None, 100=Everything. (integer +# value) +# Minimum value: 0 +# Maximum value: 100 +# Deprecated group/name - [DEFAULT]/sql_connection_debug +#connection_debug = 0 + +# Add Python stack traces to SQL as comment strings. (boolean value) +# Deprecated group/name - [DEFAULT]/sql_connection_trace +#connection_trace = false + +# If set, use this value for pool_timeout with SQLAlchemy. (integer value) +# Deprecated group/name - [DATABASE]/sqlalchemy_pool_timeout +#pool_timeout = + +# Enable the experimental use of database reconnect on connection lost. (boolean +# value) +#use_db_reconnect = false + +# Seconds between retries of a database transaction. (integer value) +#db_retry_interval = 1 + +# If True, increases the interval between retries of a database operation up to +# db_max_retry_interval. (boolean value) +#db_inc_retry_interval = true + +# If db_inc_retry_interval is set, the maximum seconds between retries of a +# database operation. (integer value) +#db_max_retry_interval = 10 + +# Maximum retries in case of connection error or deadlock error before error is +# raised. Set to -1 to specify an infinite retry count. (integer value) +#db_max_retries = 20 + +# +# From oslo.db.concurrency +# + +# Enable the experimental use of thread pooling for all DB API calls (boolean +# value) +# Deprecated group/name - [DEFAULT]/dbapi_use_tpool +#use_tpool = false diff --git a/openstack/openstack_conf/controller/glance/glance-registry-paste.ini b/openstack/openstack_conf/controller/glance/glance-registry-paste.ini new file mode 100644 index 0000000..492dbc6 --- /dev/null +++ b/openstack/openstack_conf/controller/glance/glance-registry-paste.ini @@ -0,0 +1,35 @@ +# Use this pipeline for no auth - DEFAULT +[pipeline:glance-registry] +pipeline = healthcheck osprofiler unauthenticated-context registryapp + +# Use this pipeline for keystone auth +[pipeline:glance-registry-keystone] +pipeline = healthcheck osprofiler authtoken context registryapp + +# Use this pipeline for authZ only. This means that the registry will treat a +# user as authenticated without making requests to keystone to reauthenticate +# the user. +[pipeline:glance-registry-trusted-auth] +pipeline = healthcheck osprofiler context registryapp + +[app:registryapp] +paste.app_factory = glance.registry.api:API.factory + +[filter:healthcheck] +paste.filter_factory = oslo_middleware:Healthcheck.factory +backends = disable_by_file +disable_by_file_path = /etc/glance/healthcheck_disable + +[filter:context] +paste.filter_factory = glance.api.middleware.context:ContextMiddleware.factory + +[filter:unauthenticated-context] +paste.filter_factory = glance.api.middleware.context:UnauthenticatedContextMiddleware.factory + +[filter:authtoken] +paste.filter_factory = keystonemiddleware.auth_token:filter_factory + +[filter:osprofiler] +paste.filter_factory = osprofiler.web:WsgiMiddleware.factory +hmac_keys = SECRET_KEY #DEPRECATED +enabled = yes #DEPRECATED diff --git a/openstack/openstack_conf/controller/glance/glance-registry.conf b/openstack/openstack_conf/controller/glance/glance-registry.conf new file mode 100644 index 0000000..d655d3e --- /dev/null +++ b/openstack/openstack_conf/controller/glance/glance-registry.conf @@ -0,0 +1,2428 @@ +[DEFAULT] + +# +# From glance.registry +# + +# +# Set the image owner to tenant or the authenticated user. +# +# Assign a boolean value to determine the owner of an image. When set to +# True, the owner of the image is the tenant. When set to False, the +# owner of the image will be the authenticated user issuing the request. +# Setting it to False makes the image private to the associated user and +# sharing with other users within the same tenant (or "project") +# requires explicit image sharing via image membership. +# +# Possible values: +# * True +# * False +# +# Related options: +# * None +# +# (boolean value) +#owner_is_tenant = true + +# +# Role used to identify an authenticated user as administrator. +# +# Provide a string value representing a Keystone role to identify an +# administrative user. Users with this role will be granted +# administrative privileges. The default value for this option is +# 'admin'. +# +# Possible values: +# * A string value which is a valid Keystone role +# +# Related options: +# * None +# +# (string value) +#admin_role = admin + +# +# Allow limited access to unauthenticated users. +# +# Assign a boolean to determine API access for unathenticated +# users. When set to False, the API cannot be accessed by +# unauthenticated users. When set to True, unauthenticated users can +# access the API with read-only privileges. This however only applies +# when using ContextMiddleware. +# +# Possible values: +# * True +# * False +# +# Related options: +# * None +# +# (boolean value) +#allow_anonymous_access = false + +# +# Limit the request ID length. +# +# Provide an integer value to limit the length of the request ID to +# the specified length. The default value is 64. Users can change this +# to any ineteger value between 0 and 16384 however keeping in mind that +# a larger value may flood the logs. +# +# Possible values: +# * Integer value between 0 and 16384 +# +# Related options: +# * None +# +# (integer value) +# Minimum value: 0 +#max_request_id_length = 64 + +# +# Allow users to add additional/custom properties to images. +# +# Glance defines a standard set of properties (in its schema) that +# appear on every image. These properties are also known as +# ``base properties``. In addition to these properties, Glance +# allows users to add custom properties to images. These are known +# as ``additional properties``. +# +# By default, this configuration option is set to ``True`` and users +# are allowed to add additional properties. The number of additional +# properties that can be added to an image can be controlled via +# ``image_property_quota`` configuration option. +# +# Possible values: +# * True +# * False +# +# Related options: +# * image_property_quota +# +# (boolean value) +#allow_additional_image_properties = true + +# +# Maximum number of image members per image. +# +# This limits the maximum of users an image can be shared with. Any negative +# value is interpreted as unlimited. +# +# Related options: +# * None +# +# (integer value) +#image_member_quota = 128 + +# +# Maximum number of properties allowed on an image. +# +# This enforces an upper limit on the number of additional properties an image +# can have. Any negative value is interpreted as unlimited. +# +# NOTE: This won't have any impact if additional properties are disabled. Please +# refer to ``allow_additional_image_properties``. +# +# Related options: +# * ``allow_additional_image_properties`` +# +# (integer value) +#image_property_quota = 128 + +# +# Maximum number of tags allowed on an image. +# +# Any negative value is interpreted as unlimited. +# +# Related options: +# * None +# +# (integer value) +#image_tag_quota = 128 + +# +# Maximum number of locations allowed on an image. +# +# Any negative value is interpreted as unlimited. +# +# Related options: +# * None +# +# (integer value) +#image_location_quota = 10 + +# DEPRECATED: +# Python module path of data access API. +# +# Specifies the path to the API to use for accessing the data model. +# This option determines how the image catalog data will be accessed. +# +# Possible values: +# * glance.db.sqlalchemy.api +# * glance.db.registry.api +# * glance.db.simple.api +# +# If this option is set to ``glance.db.sqlalchemy.api`` then the image +# catalog data is stored in and read from the database via the +# SQLAlchemy Core and ORM APIs. +# +# Setting this option to ``glance.db.registry.api`` will force all +# database access requests to be routed through the Registry service. +# This avoids data access from the Glance API nodes for an added layer +# of security, scalability and manageability. +# +# NOTE: In v2 OpenStack Images API, the registry service is optional. +# In order to use the Registry API in v2, the option +# ``enable_v2_registry`` must be set to ``True``. +# +# Finally, when this configuration option is set to +# ``glance.db.simple.api``, image catalog data is stored in and read +# from an in-memory data structure. This is primarily used for testing. +# +# Related options: +# * enable_v2_api +# * enable_v2_registry +# +# (string value) +# This option is deprecated for removal since Queens. +# Its value may be silently ignored in the future. +# Reason: +# Glance registry service is deprecated for removal. +# +# More information can be found from the spec: +# http://specs.openstack.org/openstack/glance-specs/specs/queens/approved/glance +# /deprecate-registry.html +#data_api = glance.db.sqlalchemy.api + +# +# The default number of results to return for a request. +# +# Responses to certain API requests, like list images, may return +# multiple items. The number of results returned can be explicitly +# controlled by specifying the ``limit`` parameter in the API request. +# However, if a ``limit`` parameter is not specified, this +# configuration value will be used as the default number of results to +# be returned for any API request. +# +# NOTES: +# * The value of this configuration option may not be greater than +# the value specified by ``api_limit_max``. +# * Setting this to a very large value may slow down database +# queries and increase response times. Setting this to a +# very low value may result in poor user experience. +# +# Possible values: +# * Any positive integer +# +# Related options: +# * api_limit_max +# +# (integer value) +# Minimum value: 1 +#limit_param_default = 25 + +# +# Maximum number of results that could be returned by a request. +# +# As described in the help text of ``limit_param_default``, some +# requests may return multiple results. The number of results to be +# returned are governed either by the ``limit`` parameter in the +# request or the ``limit_param_default`` configuration option. +# The value in either case, can't be greater than the absolute maximum +# defined by this configuration option. Anything greater than this +# value is trimmed down to the maximum value defined here. +# +# NOTE: Setting this to a very large value may slow down database +# queries and increase response times. Setting this to a +# very low value may result in poor user experience. +# +# Possible values: +# * Any positive integer +# +# Related options: +# * limit_param_default +# +# (integer value) +# Minimum value: 1 +#api_limit_max = 1000 + +# +# Show direct image location when returning an image. +# +# This configuration option indicates whether to show the direct image +# location when returning image details to the user. The direct image +# location is where the image data is stored in backend storage. This +# image location is shown under the image property ``direct_url``. +# +# When multiple image locations exist for an image, the best location +# is displayed based on the location strategy indicated by the +# configuration option ``location_strategy``. +# +# NOTES: +# * Revealing image locations can present a GRAVE SECURITY RISK as +# image locations can sometimes include credentials. Hence, this +# is set to ``False`` by default. Set this to ``True`` with +# EXTREME CAUTION and ONLY IF you know what you are doing! +# * If an operator wishes to avoid showing any image location(s) +# to the user, then both this option and +# ``show_multiple_locations`` MUST be set to ``False``. +# +# Possible values: +# * True +# * False +# +# Related options: +# * show_multiple_locations +# * location_strategy +# +# (boolean value) +#show_image_direct_url = false + +# DEPRECATED: +# Show all image locations when returning an image. +# +# This configuration option indicates whether to show all the image +# locations when returning image details to the user. When multiple +# image locations exist for an image, the locations are ordered based +# on the location strategy indicated by the configuration opt +# ``location_strategy``. The image locations are shown under the +# image property ``locations``. +# +# NOTES: +# * Revealing image locations can present a GRAVE SECURITY RISK as +# image locations can sometimes include credentials. Hence, this +# is set to ``False`` by default. Set this to ``True`` with +# EXTREME CAUTION and ONLY IF you know what you are doing! +# * If an operator wishes to avoid showing any image location(s) +# to the user, then both this option and +# ``show_image_direct_url`` MUST be set to ``False``. +# +# Possible values: +# * True +# * False +# +# Related options: +# * show_image_direct_url +# * location_strategy +# +# (boolean value) +# This option is deprecated for removal since Newton. +# Its value may be silently ignored in the future. +# Reason: This option will be removed in the Pike release or later because the +# same functionality can be achieved with greater granularity by using policies. +# Please see the Newton release notes for more information. +#show_multiple_locations = false + +# +# Maximum size of image a user can upload in bytes. +# +# An image upload greater than the size mentioned here would result +# in an image creation failure. This configuration option defaults to +# 1099511627776 bytes (1 TiB). +# +# NOTES: +# * This value should only be increased after careful +# consideration and must be set less than or equal to +# 8 EiB (9223372036854775808). +# * This value must be set with careful consideration of the +# backend storage capacity. Setting this to a very low value +# may result in a large number of image failures. And, setting +# this to a very large value may result in faster consumption +# of storage. Hence, this must be set according to the nature of +# images created and storage capacity available. +# +# Possible values: +# * Any positive number less than or equal to 9223372036854775808 +# +# (integer value) +# Minimum value: 1 +# Maximum value: 9223372036854775808 +#image_size_cap = 1099511627776 + +# +# Maximum amount of image storage per tenant. +# +# This enforces an upper limit on the cumulative storage consumed by all images +# of a tenant across all stores. This is a per-tenant limit. +# +# The default unit for this configuration option is Bytes. However, storage +# units can be specified using case-sensitive literals ``B``, ``KB``, ``MB``, +# ``GB`` and ``TB`` representing Bytes, KiloBytes, MegaBytes, GigaBytes and +# TeraBytes respectively. Note that there should not be any space between the +# value and unit. Value ``0`` signifies no quota enforcement. Negative values +# are invalid and result in errors. +# +# Possible values: +# * A string that is a valid concatenation of a non-negative integer +# representing the storage value and an optional string literal +# representing storage units as mentioned above. +# +# Related options: +# * None +# +# (string value) +#user_storage_quota = 0 + +# +# Deploy the v1 OpenStack Images API. +# +# When this option is set to ``True``, Glance service will respond to +# requests on registered endpoints conforming to the v1 OpenStack +# Images API. +# +# NOTES: +# * If this option is enabled, then ``enable_v1_registry`` must +# also be set to ``True`` to enable mandatory usage of Registry +# service with v1 API. +# +# * If this option is disabled, then the ``enable_v1_registry`` +# option, which is enabled by default, is also recommended +# to be disabled. +# +# * This option is separate from ``enable_v2_api``, both v1 and v2 +# OpenStack Images API can be deployed independent of each +# other. +# +# * If deploying only the v2 Images API, this option, which is +# enabled by default, should be disabled. +# +# Possible values: +# * True +# * False +# +# Related options: +# * enable_v1_registry +# * enable_v2_api +# +# (boolean value) +#enable_v1_api = true + +# +# Deploy the v2 OpenStack Images API. +# +# When this option is set to ``True``, Glance service will respond +# to requests on registered endpoints conforming to the v2 OpenStack +# Images API. +# +# NOTES: +# * If this option is disabled, then the ``enable_v2_registry`` +# option, which is enabled by default, is also recommended +# to be disabled. +# +# * This option is separate from ``enable_v1_api``, both v1 and v2 +# OpenStack Images API can be deployed independent of each +# other. +# +# * If deploying only the v1 Images API, this option, which is +# enabled by default, should be disabled. +# +# Possible values: +# * True +# * False +# +# Related options: +# * enable_v2_registry +# * enable_v1_api +# +# (boolean value) +#enable_v2_api = true + +# +# Deploy the v1 API Registry service. +# +# When this option is set to ``True``, the Registry service +# will be enabled in Glance for v1 API requests. +# +# NOTES: +# * Use of Registry is mandatory in v1 API, so this option must +# be set to ``True`` if the ``enable_v1_api`` option is enabled. +# +# * If deploying only the v2 OpenStack Images API, this option, +# which is enabled by default, should be disabled. +# +# Possible values: +# * True +# * False +# +# Related options: +# * enable_v1_api +# +# (boolean value) +#enable_v1_registry = true + +# DEPRECATED: +# Deploy the v2 API Registry service. +# +# When this option is set to ``True``, the Registry service +# will be enabled in Glance for v2 API requests. +# +# NOTES: +# * Use of Registry is optional in v2 API, so this option +# must only be enabled if both ``enable_v2_api`` is set to +# ``True`` and the ``data_api`` option is set to +# ``glance.db.registry.api``. +# +# * If deploying only the v1 OpenStack Images API, this option, +# which is enabled by default, should be disabled. +# +# Possible values: +# * True +# * False +# +# Related options: +# * enable_v2_api +# * data_api +# +# (boolean value) +# This option is deprecated for removal since Queens. +# Its value may be silently ignored in the future. +# Reason: +# Glance registry service is deprecated for removal. +# +# More information can be found from the spec: +# http://specs.openstack.org/openstack/glance-specs/specs/queens/approved/glance +# /deprecate-registry.html +#enable_v2_registry = true + +# +# Host address of the pydev server. +# +# Provide a string value representing the hostname or IP of the +# pydev server to use for debugging. The pydev server listens for +# debug connections on this address, facilitating remote debugging +# in Glance. +# +# Possible values: +# * Valid hostname +# * Valid IP address +# +# Related options: +# * None +# +# (unknown value) +#pydev_worker_debug_host = localhost + +# +# Port number that the pydev server will listen on. +# +# Provide a port number to bind the pydev server to. The pydev +# process accepts debug connections on this port and facilitates +# remote debugging in Glance. +# +# Possible values: +# * A valid port number +# +# Related options: +# * None +# +# (port value) +# Minimum value: 0 +# Maximum value: 65535 +#pydev_worker_debug_port = 5678 + +# +# AES key for encrypting store location metadata. +# +# Provide a string value representing the AES cipher to use for +# encrypting Glance store metadata. +# +# NOTE: The AES key to use must be set to a random string of length +# 16, 24 or 32 bytes. +# +# Possible values: +# * String value representing a valid AES key +# +# Related options: +# * None +# +# (string value) +#metadata_encryption_key = + +# +# Digest algorithm to use for digital signature. +# +# Provide a string value representing the digest algorithm to +# use for generating digital signatures. By default, ``sha256`` +# is used. +# +# To get a list of the available algorithms supported by the version +# of OpenSSL on your platform, run the command: +# ``openssl list-message-digest-algorithms``. +# Examples are 'sha1', 'sha256', and 'sha512'. +# +# NOTE: ``digest_algorithm`` is not related to Glance's image signing +# and verification. It is only used to sign the universally unique +# identifier (UUID) as a part of the certificate file and key file +# validation. +# +# Possible values: +# * An OpenSSL message digest algorithm identifier +# +# Relation options: +# * None +# +# (string value) +#digest_algorithm = sha256 + +# +# The URL provides location where the temporary data will be stored +# +# This option is for Glance internal use only. Glance will save the +# image data uploaded by the user to 'staging' endpoint during the +# image import process. +# +# This option does not change the 'staging' API endpoint by any means. +# +# NOTE: It is discouraged to use same path as [task]/work_dir +# +# NOTE: 'file://' is the only option +# api_image_import flow will support for now. +# +# NOTE: The staging path must be on shared filesystem available to all +# Glance API nodes. +# +# Possible values: +# * String starting with 'file://' followed by absolute FS path +# +# Related options: +# * [task]/work_dir +# * [DEFAULT]/enable_image_import (*deprecated*) +# +# (string value) +#node_staging_uri = file:///tmp/staging/ + +# DEPRECATED: +# Enables the Image Import workflow introduced in Pike +# +# As '[DEFAULT]/node_staging_uri' is required for the Image +# Import, it's disabled per default in Pike, enabled per +# default in Queens and removed in Rocky. This allows Glance to +# operate with previous version configs upon upgrade. +# +# Setting this option to False will disable the endpoints related +# to Image Import Refactoring work. +# +# Related options: +# * [DEFAULT]/node_staging_uri (boolean value) +# This option is deprecated for removal since Pike. +# Its value may be silently ignored in the future. +# Reason: +# This option is deprecated for removal in Rocky. +# +# It was introduced to make sure that the API is not enabled +# before the '[DEFAULT]/node_staging_uri' is defined and is +# long term redundant. +#enable_image_import = true + +# +# List of enabled Image Import Methods +# +# Both 'glance-direct' and 'web-download' are enabled by default. +# +# Related options: +# * [DEFAULT]/node_staging_uri +# * [DEFAULT]/enable_image_import (list value) +#enabled_import_methods = glance-direct,web-download + +# +# IP address to bind the glance servers to. +# +# Provide an IP address to bind the glance server to. The default +# value is ``0.0.0.0``. +# +# Edit this option to enable the server to listen on one particular +# IP address on the network card. This facilitates selection of a +# particular network interface for the server. +# +# Possible values: +# * A valid IPv4 address +# * A valid IPv6 address +# +# Related options: +# * None +# +# (unknown value) +#bind_host = 0.0.0.0 + +# +# Port number on which the server will listen. +# +# Provide a valid port number to bind the server's socket to. This +# port is then set to identify processes and forward network messages +# that arrive at the server. The default bind_port value for the API +# server is 9292 and for the registry server is 9191. +# +# Possible values: +# * A valid port number (0 to 65535) +# +# Related options: +# * None +# +# (port value) +# Minimum value: 0 +# Maximum value: 65535 +#bind_port = + +# +# Set the number of incoming connection requests. +# +# Provide a positive integer value to limit the number of requests in +# the backlog queue. The default queue size is 4096. +# +# An incoming connection to a TCP listener socket is queued before a +# connection can be established with the server. Setting the backlog +# for a TCP socket ensures a limited queue size for incoming traffic. +# +# Possible values: +# * Positive integer +# +# Related options: +# * None +# +# (integer value) +# Minimum value: 1 +#backlog = 4096 + +# +# Set the wait time before a connection recheck. +# +# Provide a positive integer value representing time in seconds which +# is set as the idle wait time before a TCP keep alive packet can be +# sent to the host. The default value is 600 seconds. +# +# Setting ``tcp_keepidle`` helps verify at regular intervals that a +# connection is intact and prevents frequent TCP connection +# reestablishment. +# +# Possible values: +# * Positive integer value representing time in seconds +# +# Related options: +# * None +# +# (integer value) +# Minimum value: 1 +#tcp_keepidle = 600 + +# +# Absolute path to the CA file. +# +# Provide a string value representing a valid absolute path to +# the Certificate Authority file to use for client authentication. +# +# A CA file typically contains necessary trusted certificates to +# use for the client authentication. This is essential to ensure +# that a secure connection is established to the server via the +# internet. +# +# Possible values: +# * Valid absolute path to the CA file +# +# Related options: +# * None +# +# (string value) +#ca_file = /etc/ssl/cafile + +# +# Absolute path to the certificate file. +# +# Provide a string value representing a valid absolute path to the +# certificate file which is required to start the API service +# securely. +# +# A certificate file typically is a public key container and includes +# the server's public key, server name, server information and the +# signature which was a result of the verification process using the +# CA certificate. This is required for a secure connection +# establishment. +# +# Possible values: +# * Valid absolute path to the certificate file +# +# Related options: +# * None +# +# (string value) +#cert_file = /etc/ssl/certs + +# +# Absolute path to a private key file. +# +# Provide a string value representing a valid absolute path to a +# private key file which is required to establish the client-server +# connection. +# +# Possible values: +# * Absolute path to the private key file +# +# Related options: +# * None +# +# (string value) +#key_file = /etc/ssl/key/key-file.pem + +# DEPRECATED: The HTTP header used to determine the scheme for the original +# request, even if it was removed by an SSL terminating proxy. Typical value is +# "HTTP_X_FORWARDED_PROTO". (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Use the http_proxy_to_wsgi middleware instead. +#secure_proxy_ssl_header = + +# +# Number of Glance worker processes to start. +# +# Provide a non-negative integer value to set the number of child +# process workers to service requests. By default, the number of CPUs +# available is set as the value for ``workers`` limited to 8. For +# example if the processor count is 6, 6 workers will be used, if the +# processor count is 24 only 8 workers will be used. The limit will only +# apply to the default value, if 24 workers is configured, 24 is used. +# +# Each worker process is made to listen on the port set in the +# configuration file and contains a greenthread pool of size 1000. +# +# NOTE: Setting the number of workers to zero, triggers the creation +# of a single API process with a greenthread pool of size 1000. +# +# Possible values: +# * 0 +# * Positive integer value (typically equal to the number of CPUs) +# +# Related options: +# * None +# +# (integer value) +# Minimum value: 0 +#workers = + +# +# Maximum line size of message headers. +# +# Provide an integer value representing a length to limit the size of +# message headers. The default value is 16384. +# +# NOTE: ``max_header_line`` may need to be increased when using large +# tokens (typically those generated by the Keystone v3 API with big +# service catalogs). However, it is to be kept in mind that larger +# values for ``max_header_line`` would flood the logs. +# +# Setting ``max_header_line`` to 0 sets no limit for the line size of +# message headers. +# +# Possible values: +# * 0 +# * Positive integer +# +# Related options: +# * None +# +# (integer value) +# Minimum value: 0 +#max_header_line = 16384 + +# +# Set keep alive option for HTTP over TCP. +# +# Provide a boolean value to determine sending of keep alive packets. +# If set to ``False``, the server returns the header +# "Connection: close". If set to ``True``, the server returns a +# "Connection: Keep-Alive" in its responses. This enables retention of +# the same TCP connection for HTTP conversations instead of opening a +# new one with each new request. +# +# This option must be set to ``False`` if the client socket connection +# needs to be closed explicitly after the response is received and +# read successfully by the client. +# +# Possible values: +# * True +# * False +# +# Related options: +# * None +# +# (boolean value) +#http_keepalive = true + +# +# Timeout for client connections' socket operations. +# +# Provide a valid integer value representing time in seconds to set +# the period of wait before an incoming connection can be closed. The +# default value is 900 seconds. +# +# The value zero implies wait forever. +# +# Possible values: +# * Zero +# * Positive integer +# +# Related options: +# * None +# +# (integer value) +# Minimum value: 0 +#client_socket_timeout = 900 + +# +# From oslo.log +# + +# If set to true, the logging level will be set to DEBUG instead of the default +# INFO level. (boolean value) +# Note: This option can be changed without restarting. +#debug = false + +# The name of a logging configuration file. This file is appended to any +# existing logging configuration files. For details about logging configuration +# files, see the Python logging module documentation. Note that when logging +# configuration files are used then all logging configuration is set in the +# configuration file and other logging configuration options are ignored (for +# example, logging_context_format_string). (string value) +# Note: This option can be changed without restarting. +# Deprecated group/name - [DEFAULT]/log_config +#log_config_append = + +# Defines the format string for %%(asctime)s in log records. Default: +# %(default)s . This option is ignored if log_config_append is set. (string +# value) +#log_date_format = %Y-%m-%d %H:%M:%S + +# (Optional) Name of log file to send logging output to. If no default is set, +# logging will go to stderr as defined by use_stderr. This option is ignored if +# log_config_append is set. (string value) +# Deprecated group/name - [DEFAULT]/logfile +#log_file = + +# (Optional) The base directory used for relative log_file paths. This option +# is ignored if log_config_append is set. (string value) +# Deprecated group/name - [DEFAULT]/logdir +#log_dir = + +# Uses logging handler designed to watch file system. When log file is moved or +# removed this handler will open a new log file with specified path +# instantaneously. It makes sense only if log_file option is specified and Linux +# platform is used. This option is ignored if log_config_append is set. (boolean +# value) +#watch_log_file = false + +# Use syslog for logging. Existing syslog format is DEPRECATED and will be +# changed later to honor RFC5424. This option is ignored if log_config_append is +# set. (boolean value) +#use_syslog = false + +# Enable journald for logging. If running in a systemd environment you may wish +# to enable journal support. Doing so will use the journal native protocol which +# includes structured metadata in addition to log messages.This option is +# ignored if log_config_append is set. (boolean value) +#use_journal = false + +# Syslog facility to receive log lines. This option is ignored if +# log_config_append is set. (string value) +#syslog_log_facility = LOG_USER + +# Use JSON formatting for logging. This option is ignored if log_config_append +# is set. (boolean value) +#use_json = false + +# Log output to standard error. This option is ignored if log_config_append is +# set. (boolean value) +#use_stderr = false + +# Format string to use for log messages with context. (string value) +#logging_context_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user_identity)s] %(instance)s%(message)s + +# Format string to use for log messages when context is undefined. (string +# value) +#logging_default_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [-] %(instance)s%(message)s + +# Additional data to append to log message when logging level for the message is +# DEBUG. (string value) +#logging_debug_format_suffix = %(funcName)s %(pathname)s:%(lineno)d + +# Prefix each line of exception output with this format. (string value) +#logging_exception_prefix = %(asctime)s.%(msecs)03d %(process)d ERROR %(name)s %(instance)s + +# Defines the format string for %(user_identity)s that is used in +# logging_context_format_string. (string value) +#logging_user_identity_format = %(user)s %(tenant)s %(domain)s %(user_domain)s %(project_domain)s + +# List of package logging levels in logger=LEVEL pairs. This option is ignored +# if log_config_append is set. (list value) +#default_log_levels = amqp=WARN,amqplib=WARN,boto=WARN,qpid=WARN,sqlalchemy=WARN,suds=INFO,oslo.messaging=INFO,oslo_messaging=INFO,iso8601=WARN,requests.packages.urllib3.connectionpool=WARN,urllib3.connectionpool=WARN,websocket=WARN,requests.packages.urllib3.util.retry=WARN,urllib3.util.retry=WARN,keystonemiddleware=WARN,routes.middleware=WARN,stevedore=WARN,taskflow=WARN,keystoneauth=WARN,oslo.cache=INFO,dogpile.core.dogpile=INFO + +# Enables or disables publication of error events. (boolean value) +#publish_errors = false + +# The format for an instance that is passed with the log message. (string value) +#instance_format = "[instance: %(uuid)s] " + +# The format for an instance UUID that is passed with the log message. (string +# value) +#instance_uuid_format = "[instance: %(uuid)s] " + +# Interval, number of seconds, of log rate limiting. (integer value) +#rate_limit_interval = 0 + +# Maximum number of logged messages per rate_limit_interval. (integer value) +#rate_limit_burst = 0 + +# Log level name used by rate limiting: CRITICAL, ERROR, INFO, WARNING, DEBUG or +# empty string. Logs with level greater or equal to rate_limit_except_level are +# not filtered. An empty string means that all levels are filtered. (string +# value) +#rate_limit_except_level = CRITICAL + +# Enables or disables fatal status of deprecations. (boolean value) +#fatal_deprecations = false + +# +# From oslo.messaging +# + +# Size of RPC connection pool. (integer value) +#rpc_conn_pool_size = 30 + +# The pool size limit for connections expiration policy (integer value) +#conn_pool_min_size = 2 + +# The time-to-live in sec of idle connections in the pool (integer value) +#conn_pool_ttl = 1200 + +# ZeroMQ bind address. Should be a wildcard (*), an ethernet interface, or IP. +# The "host" option should point or resolve to this address. (string value) +#rpc_zmq_bind_address = * + +# MatchMaker driver. (string value) +# Possible values: +# redis - +# sentinel - +# dummy - +#rpc_zmq_matchmaker = redis + +# Number of ZeroMQ contexts, defaults to 1. (integer value) +#rpc_zmq_contexts = 1 + +# Maximum number of ingress messages to locally buffer per topic. Default is +# unlimited. (integer value) +#rpc_zmq_topic_backlog = + +# Directory for holding IPC sockets. (string value) +#rpc_zmq_ipc_dir = /var/run/openstack + +# Name of this node. Must be a valid hostname, FQDN, or IP address. Must match +# "host" option, if running Nova. (string value) +#rpc_zmq_host = localhost + +# Number of seconds to wait before all pending messages will be sent after +# closing a socket. The default value of -1 specifies an infinite linger period. +# The value of 0 specifies no linger period. Pending messages shall be discarded +# immediately when the socket is closed. Positive values specify an upper bound +# for the linger period. (integer value) +# Deprecated group/name - [DEFAULT]/rpc_cast_timeout +#zmq_linger = -1 + +# The default number of seconds that poll should wait. Poll raises timeout +# exception when timeout expired. (integer value) +#rpc_poll_timeout = 1 + +# Expiration timeout in seconds of a name service record about existing target ( +# < 0 means no timeout). (integer value) +#zmq_target_expire = 300 + +# Update period in seconds of a name service record about existing target. +# (integer value) +#zmq_target_update = 180 + +# Use PUB/SUB pattern for fanout methods. PUB/SUB always uses proxy. (boolean +# value) +#use_pub_sub = false + +# Use ROUTER remote proxy. (boolean value) +#use_router_proxy = false + +# This option makes direct connections dynamic or static. It makes sense only +# with use_router_proxy=False which means to use direct connections for direct +# message types (ignored otherwise). (boolean value) +#use_dynamic_connections = false + +# How many additional connections to a host will be made for failover reasons. +# This option is actual only in dynamic connections mode. (integer value) +#zmq_failover_connections = 2 + +# Minimal port number for random ports range. (port value) +# Minimum value: 0 +# Maximum value: 65535 +#rpc_zmq_min_port = 49153 + +# Maximal port number for random ports range. (integer value) +# Minimum value: 1 +# Maximum value: 65536 +#rpc_zmq_max_port = 65536 + +# Number of retries to find free port number before fail with ZMQBindError. +# (integer value) +#rpc_zmq_bind_port_retries = 100 + +# Default serialization mechanism for serializing/deserializing +# outgoing/incoming messages (string value) +# Possible values: +# json - +# msgpack - +#rpc_zmq_serialization = json + +# This option configures round-robin mode in zmq socket. True means not keeping +# a queue when server side disconnects. False means to keep queue and messages +# even if server is disconnected, when the server appears we send all +# accumulated messages to it. (boolean value) +#zmq_immediate = true + +# Enable/disable TCP keepalive (KA) mechanism. The default value of -1 (or any +# other negative value) means to skip any overrides and leave it to OS default; +# 0 and 1 (or any other positive value) mean to disable and enable the option +# respectively. (integer value) +#zmq_tcp_keepalive = -1 + +# The duration between two keepalive transmissions in idle condition. The unit +# is platform dependent, for example, seconds in Linux, milliseconds in Windows +# etc. The default value of -1 (or any other negative value and 0) means to skip +# any overrides and leave it to OS default. (integer value) +#zmq_tcp_keepalive_idle = -1 + +# The number of retransmissions to be carried out before declaring that remote +# end is not available. The default value of -1 (or any other negative value and +# 0) means to skip any overrides and leave it to OS default. (integer value) +#zmq_tcp_keepalive_cnt = -1 + +# The duration between two successive keepalive retransmissions, if +# acknowledgement to the previous keepalive transmission is not received. The +# unit is platform dependent, for example, seconds in Linux, milliseconds in +# Windows etc. The default value of -1 (or any other negative value and 0) means +# to skip any overrides and leave it to OS default. (integer value) +#zmq_tcp_keepalive_intvl = -1 + +# Maximum number of (green) threads to work concurrently. (integer value) +#rpc_thread_pool_size = 100 + +# Expiration timeout in seconds of a sent/received message after which it is not +# tracked anymore by a client/server. (integer value) +#rpc_message_ttl = 300 + +# Wait for message acknowledgements from receivers. This mechanism works only +# via proxy without PUB/SUB. (boolean value) +#rpc_use_acks = false + +# Number of seconds to wait for an ack from a cast/call. After each retry +# attempt this timeout is multiplied by some specified multiplier. (integer +# value) +#rpc_ack_timeout_base = 15 + +# Number to multiply base ack timeout by after each retry attempt. (integer +# value) +#rpc_ack_timeout_multiplier = 2 + +# Default number of message sending attempts in case of any problems occurred: +# positive value N means at most N retries, 0 means no retries, None or -1 (or +# any other negative values) mean to retry forever. This option is used only if +# acknowledgments are enabled. (integer value) +#rpc_retry_attempts = 3 + +# List of publisher hosts SubConsumer can subscribe on. This option has higher +# priority then the default publishers list taken from the matchmaker. (list +# value) +#subscribe_on = + +# Size of executor thread pool when executor is threading or eventlet. (integer +# value) +# Deprecated group/name - [DEFAULT]/rpc_thread_pool_size +#executor_thread_pool_size = 64 + +# Seconds to wait for a response from a call. (integer value) +#rpc_response_timeout = 60 + +# The network address and optional user credentials for connecting to the +# messaging backend, in URL format. The expected format is: +# +# driver://[user:pass@]host:port[,[userN:passN@]hostN:portN]/virtual_host?query +# +# Example: rabbit://rabbitmq:password@127.0.0.1:5672// +# +# For full details on the fields in the URL see the documentation of +# oslo_messaging.TransportURL at +# https://docs.openstack.org/oslo.messaging/latest/reference/transport.html +# (string value) +#transport_url = + +# DEPRECATED: The messaging driver to use, defaults to rabbit. Other drivers +# include amqp and zmq. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#rpc_backend = rabbit + +# The default exchange under which topics are scoped. May be overridden by an +# exchange name specified in the transport_url option. (string value) +#control_exchange = openstack + + +[database] +connection = mysql+pymysql://glance:glance_db_secret@controller/glance +backend = sqlalchemy + +# +# From oslo.db +# + +# If True, SQLite uses synchronous mode. (boolean value) +#sqlite_synchronous = true + +# The back end to use for the database. (string value) +# Deprecated group/name - [DEFAULT]/db_backend +#backend = sqlalchemy + +# The SQLAlchemy connection string to use to connect to the database. (string +# value) +# Deprecated group/name - [DEFAULT]/sql_connection +# Deprecated group/name - [DATABASE]/sql_connection +# Deprecated group/name - [sql]/connection +#connection = + +# The SQLAlchemy connection string to use to connect to the slave database. +# (string value) +#slave_connection = + +# The SQL mode to be used for MySQL sessions. This option, including the +# default, overrides any server-set SQL mode. To use whatever SQL mode is set by +# the server configuration, set this to no value. Example: mysql_sql_mode= +# (string value) +#mysql_sql_mode = TRADITIONAL + +# If True, transparently enables support for handling MySQL Cluster (NDB). +# (boolean value) +#mysql_enable_ndb = false + +# Connections which have been present in the connection pool longer than this +# number of seconds will be replaced with a new one the next time they are +# checked out from the pool. (integer value) +# Deprecated group/name - [DATABASE]/idle_timeout +# Deprecated group/name - [database]/idle_timeout +# Deprecated group/name - [DEFAULT]/sql_idle_timeout +# Deprecated group/name - [DATABASE]/sql_idle_timeout +# Deprecated group/name - [sql]/idle_timeout +#connection_recycle_time = 3600 + +# Minimum number of SQL connections to keep open in a pool. (integer value) +# Deprecated group/name - [DEFAULT]/sql_min_pool_size +# Deprecated group/name - [DATABASE]/sql_min_pool_size +#min_pool_size = 1 + +# Maximum number of SQL connections to keep open in a pool. Setting a value of 0 +# indicates no limit. (integer value) +# Deprecated group/name - [DEFAULT]/sql_max_pool_size +# Deprecated group/name - [DATABASE]/sql_max_pool_size +#max_pool_size = 5 + +# Maximum number of database connection retries during startup. Set to -1 to +# specify an infinite retry count. (integer value) +# Deprecated group/name - [DEFAULT]/sql_max_retries +# Deprecated group/name - [DATABASE]/sql_max_retries +#max_retries = 10 + +# Interval between retries of opening a SQL connection. (integer value) +# Deprecated group/name - [DEFAULT]/sql_retry_interval +# Deprecated group/name - [DATABASE]/reconnect_interval +#retry_interval = 10 + +# If set, use this value for max_overflow with SQLAlchemy. (integer value) +# Deprecated group/name - [DEFAULT]/sql_max_overflow +# Deprecated group/name - [DATABASE]/sqlalchemy_max_overflow +#max_overflow = 50 + +# Verbosity of SQL debugging information: 0=None, 100=Everything. (integer +# value) +# Minimum value: 0 +# Maximum value: 100 +# Deprecated group/name - [DEFAULT]/sql_connection_debug +#connection_debug = 0 + +# Add Python stack traces to SQL as comment strings. (boolean value) +# Deprecated group/name - [DEFAULT]/sql_connection_trace +#connection_trace = false + +# If set, use this value for pool_timeout with SQLAlchemy. (integer value) +# Deprecated group/name - [DATABASE]/sqlalchemy_pool_timeout +#pool_timeout = + +# Enable the experimental use of database reconnect on connection lost. (boolean +# value) +#use_db_reconnect = false + +# Seconds between retries of a database transaction. (integer value) +#db_retry_interval = 1 + +# If True, increases the interval between retries of a database operation up to +# db_max_retry_interval. (boolean value) +#db_inc_retry_interval = true + +# If db_inc_retry_interval is set, the maximum seconds between retries of a +# database operation. (integer value) +#db_max_retry_interval = 10 + +# Maximum retries in case of connection error or deadlock error before error is +# raised. Set to -1 to specify an infinite retry count. (integer value) +#db_max_retries = 20 + +# +# From oslo.db.concurrency +# + +# Enable the experimental use of thread pooling for all DB API calls (boolean +# value) +# Deprecated group/name - [DEFAULT]/dbapi_use_tpool +#use_tpool = false + + +[keystone_authtoken] +password = glance_user_secret +username = glance +project_name = service +user_domain_name = default +project_domain_name = default +auth_type = password +memcached_servers = controller:11211 +auth_url = http://controller:5000 +auth_uri = http://controller:5000 + +# +# From keystonemiddleware.auth_token +# + +# Complete "public" Identity API endpoint. This endpoint should not be an +# "admin" endpoint, as it should be accessible by all end users. Unauthenticated +# clients are redirected to this endpoint to authenticate. Although this +# endpoint should ideally be unversioned, client support in the wild varies. If +# you're using a versioned v2 endpoint here, then this should *not* be the same +# endpoint the service user utilizes for validating tokens, because normal end +# users may not be able to reach that endpoint. (string value) +# Deprecated group/name - [keystone_authtoken]/auth_uri +#www_authenticate_uri = + +# DEPRECATED: Complete "public" Identity API endpoint. This endpoint should not +# be an "admin" endpoint, as it should be accessible by all end users. +# Unauthenticated clients are redirected to this endpoint to authenticate. +# Although this endpoint should ideally be unversioned, client support in the +# wild varies. If you're using a versioned v2 endpoint here, then this should +# *not* be the same endpoint the service user utilizes for validating tokens, +# because normal end users may not be able to reach that endpoint. This option +# is deprecated in favor of www_authenticate_uri and will be removed in the S +# release. (string value) +# This option is deprecated for removal since Queens. +# Its value may be silently ignored in the future. +# Reason: The auth_uri option is deprecated in favor of www_authenticate_uri and +# will be removed in the S release. +#auth_uri = + +# API version of the admin Identity API endpoint. (string value) +#auth_version = + +# Do not handle authorization requests within the middleware, but delegate the +# authorization decision to downstream WSGI components. (boolean value) +#delay_auth_decision = false + +# Request timeout value for communicating with Identity API server. (integer +# value) +#http_connect_timeout = + +# How many times are we trying to reconnect when communicating with Identity API +# Server. (integer value) +#http_request_max_retries = 3 + +# Request environment key where the Swift cache object is stored. When +# auth_token middleware is deployed with a Swift cache, use this option to have +# the middleware share a caching backend with swift. Otherwise, use the +# ``memcached_servers`` option instead. (string value) +#cache = + +# Required if identity server requires client certificate (string value) +#certfile = + +# Required if identity server requires client certificate (string value) +#keyfile = + +# A PEM encoded Certificate Authority to use when verifying HTTPs connections. +# Defaults to system CAs. (string value) +#cafile = + +# Verify HTTPS connections. (boolean value) +#insecure = false + +# The region in which the identity server can be found. (string value) +#region_name = + +# DEPRECATED: Directory used to cache files related to PKI tokens. This option +# has been deprecated in the Ocata release and will be removed in the P release. +# (string value) +# This option is deprecated for removal since Ocata. +# Its value may be silently ignored in the future. +# Reason: PKI token format is no longer supported. +#signing_dir = + +# Optionally specify a list of memcached server(s) to use for caching. If left +# undefined, tokens will instead be cached in-process. (list value) +# Deprecated group/name - [keystone_authtoken]/memcache_servers +#memcached_servers = + +# In order to prevent excessive effort spent validating tokens, the middleware +# caches previously-seen tokens for a configurable duration (in seconds). Set to +# -1 to disable caching completely. (integer value) +#token_cache_time = 300 + +# DEPRECATED: Determines the frequency at which the list of revoked tokens is +# retrieved from the Identity service (in seconds). A high number of revocation +# events combined with a low cache duration may significantly reduce +# performance. Only valid for PKI tokens. This option has been deprecated in the +# Ocata release and will be removed in the P release. (integer value) +# This option is deprecated for removal since Ocata. +# Its value may be silently ignored in the future. +# Reason: PKI token format is no longer supported. +#revocation_cache_time = 10 + +# (Optional) If defined, indicate whether token data should be authenticated or +# authenticated and encrypted. If MAC, token data is authenticated (with HMAC) +# in the cache. If ENCRYPT, token data is encrypted and authenticated in the +# cache. If the value is not one of these options or empty, auth_token will +# raise an exception on initialization. (string value) +# Possible values: +# None - +# MAC - +# ENCRYPT - +#memcache_security_strategy = None + +# (Optional, mandatory if memcache_security_strategy is defined) This string is +# used for key derivation. (string value) +#memcache_secret_key = + +# (Optional) Number of seconds memcached server is considered dead before it is +# tried again. (integer value) +#memcache_pool_dead_retry = 300 + +# (Optional) Maximum total number of open connections to every memcached server. +# (integer value) +#memcache_pool_maxsize = 10 + +# (Optional) Socket timeout in seconds for communicating with a memcached +# server. (integer value) +#memcache_pool_socket_timeout = 3 + +# (Optional) Number of seconds a connection to memcached is held unused in the +# pool before it is closed. (integer value) +#memcache_pool_unused_timeout = 60 + +# (Optional) Number of seconds that an operation will wait to get a memcached +# client connection from the pool. (integer value) +#memcache_pool_conn_get_timeout = 10 + +# (Optional) Use the advanced (eventlet safe) memcached client pool. The +# advanced pool will only work under python 2.x. (boolean value) +#memcache_use_advanced_pool = false + +# (Optional) Indicate whether to set the X-Service-Catalog header. If False, +# middleware will not ask for service catalog on token validation and will not +# set the X-Service-Catalog header. (boolean value) +#include_service_catalog = true + +# Used to control the use and type of token binding. Can be set to: "disabled" +# to not check token binding. "permissive" (default) to validate binding +# information if the bind type is of a form known to the server and ignore it if +# not. "strict" like "permissive" but if the bind type is unknown the token will +# be rejected. "required" any form of token binding is needed to be allowed. +# Finally the name of a binding method that must be present in tokens. (string +# value) +#enforce_token_bind = permissive + +# DEPRECATED: If true, the revocation list will be checked for cached tokens. +# This requires that PKI tokens are configured on the identity server. (boolean +# value) +# This option is deprecated for removal since Ocata. +# Its value may be silently ignored in the future. +# Reason: PKI token format is no longer supported. +#check_revocations_for_cached = false + +# DEPRECATED: Hash algorithms to use for hashing PKI tokens. This may be a +# single algorithm or multiple. The algorithms are those supported by Python +# standard hashlib.new(). The hashes will be tried in the order given, so put +# the preferred one first for performance. The result of the first hash will be +# stored in the cache. This will typically be set to multiple values only while +# migrating from a less secure algorithm to a more secure one. Once all the old +# tokens are expired this option should be set to a single value for better +# performance. (list value) +# This option is deprecated for removal since Ocata. +# Its value may be silently ignored in the future. +# Reason: PKI token format is no longer supported. +#hash_algorithms = md5 + +# A choice of roles that must be present in a service token. Service tokens are +# allowed to request that an expired token can be used and so this check should +# tightly control that only actual services should be sending this token. Roles +# here are applied as an ANY check so any role in this list must be present. For +# backwards compatibility reasons this currently only affects the allow_expired +# check. (list value) +#service_token_roles = service + +# For backwards compatibility reasons we must let valid service tokens pass that +# don't pass the service_token_roles check as valid. Setting this true will +# become the default in a future release and should be enabled if possible. +# (boolean value) +#service_token_roles_required = false + +# Authentication type to load (string value) +# Deprecated group/name - [keystone_authtoken]/auth_plugin +#auth_type = + +# Config Section from which to load plugin specific options (string value) +#auth_section = + + +[matchmaker_redis] + +# +# From oslo.messaging +# + +# DEPRECATED: Host to locate redis. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#host = 127.0.0.1 + +# DEPRECATED: Use this port to connect to redis host. (port value) +# Minimum value: 0 +# Maximum value: 65535 +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#port = 6379 + +# DEPRECATED: Password for Redis server (optional). (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#password = + +# DEPRECATED: List of Redis Sentinel hosts (fault tolerance mode), e.g., +# [host:port, host1:port ... ] (list value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#sentinel_hosts = + +# Redis replica set name. (string value) +#sentinel_group_name = oslo-messaging-zeromq + +# Time in ms to wait between connection attempts. (integer value) +#wait_timeout = 2000 + +# Time in ms to wait before the transaction is killed. (integer value) +#check_timeout = 20000 + +# Timeout in ms on blocking socket operations. (integer value) +#socket_timeout = 10000 + + +[oslo_messaging_amqp] + +# +# From oslo.messaging +# + +# Name for the AMQP container. must be globally unique. Defaults to a generated +# UUID (string value) +#container_name = + +# Timeout for inactive connections (in seconds) (integer value) +#idle_timeout = 0 + +# Debug: dump AMQP frames to stdout (boolean value) +#trace = false + +# Attempt to connect via SSL. If no other ssl-related parameters are given, it +# will use the system's CA-bundle to verify the server's certificate. (boolean +# value) +#ssl = false + +# CA certificate PEM file used to verify the server's certificate (string value) +#ssl_ca_file = + +# Self-identifying certificate PEM file for client authentication (string value) +#ssl_cert_file = + +# Private key PEM file used to sign ssl_cert_file certificate (optional) (string +# value) +#ssl_key_file = + +# Password for decrypting ssl_key_file (if encrypted) (string value) +#ssl_key_password = + +# By default SSL checks that the name in the server's certificate matches the +# hostname in the transport_url. In some configurations it may be preferable to +# use the virtual hostname instead, for example if the server uses the Server +# Name Indication TLS extension (rfc6066) to provide a certificate per virtual +# host. Set ssl_verify_vhost to True if the server's SSL certificate uses the +# virtual host name instead of the DNS name. (boolean value) +#ssl_verify_vhost = false + +# DEPRECATED: Accept clients using either SSL or plain TCP (boolean value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Not applicable - not a SSL server +#allow_insecure_clients = false + +# Space separated list of acceptable SASL mechanisms (string value) +#sasl_mechanisms = + +# Path to directory that contains the SASL configuration (string value) +#sasl_config_dir = + +# Name of configuration file (without .conf suffix) (string value) +#sasl_config_name = + +# SASL realm to use if no realm present in username (string value) +#sasl_default_realm = + +# DEPRECATED: User name for message broker authentication (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Should use configuration option transport_url to provide the username. +#username = + +# DEPRECATED: Password for message broker authentication (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Should use configuration option transport_url to provide the password. +#password = + +# Seconds to pause before attempting to re-connect. (integer value) +# Minimum value: 1 +#connection_retry_interval = 1 + +# Increase the connection_retry_interval by this many seconds after each +# unsuccessful failover attempt. (integer value) +# Minimum value: 0 +#connection_retry_backoff = 2 + +# Maximum limit for connection_retry_interval + connection_retry_backoff +# (integer value) +# Minimum value: 1 +#connection_retry_interval_max = 30 + +# Time to pause between re-connecting an AMQP 1.0 link that failed due to a +# recoverable error. (integer value) +# Minimum value: 1 +#link_retry_delay = 10 + +# The maximum number of attempts to re-send a reply message which failed due to +# a recoverable error. (integer value) +# Minimum value: -1 +#default_reply_retry = 0 + +# The deadline for an rpc reply message delivery. (integer value) +# Minimum value: 5 +#default_reply_timeout = 30 + +# The deadline for an rpc cast or call message delivery. Only used when caller +# does not provide a timeout expiry. (integer value) +# Minimum value: 5 +#default_send_timeout = 30 + +# The deadline for a sent notification message delivery. Only used when caller +# does not provide a timeout expiry. (integer value) +# Minimum value: 5 +#default_notify_timeout = 30 + +# The duration to schedule a purge of idle sender links. Detach link after +# expiry. (integer value) +# Minimum value: 1 +#default_sender_link_timeout = 600 + +# Indicates the addressing mode used by the driver. +# Permitted values: +# 'legacy' - use legacy non-routable addressing +# 'routable' - use routable addresses +# 'dynamic' - use legacy addresses if the message bus does not support routing +# otherwise use routable addressing (string value) +#addressing_mode = dynamic + +# Enable virtual host support for those message buses that do not natively +# support virtual hosting (such as qpidd). When set to true the virtual host +# name will be added to all message bus addresses, effectively creating a +# private 'subnet' per virtual host. Set to False if the message bus supports +# virtual hosting using the 'hostname' field in the AMQP 1.0 Open performative +# as the name of the virtual host. (boolean value) +#pseudo_vhost = true + +# address prefix used when sending to a specific server (string value) +#server_request_prefix = exclusive + +# address prefix used when broadcasting to all servers (string value) +#broadcast_prefix = broadcast + +# address prefix when sending to any server in group (string value) +#group_request_prefix = unicast + +# Address prefix for all generated RPC addresses (string value) +#rpc_address_prefix = openstack.org/om/rpc + +# Address prefix for all generated Notification addresses (string value) +#notify_address_prefix = openstack.org/om/notify + +# Appended to the address prefix when sending a fanout message. Used by the +# message bus to identify fanout messages. (string value) +#multicast_address = multicast + +# Appended to the address prefix when sending to a particular RPC/Notification +# server. Used by the message bus to identify messages sent to a single +# destination. (string value) +#unicast_address = unicast + +# Appended to the address prefix when sending to a group of consumers. Used by +# the message bus to identify messages that should be delivered in a round-robin +# fashion across consumers. (string value) +#anycast_address = anycast + +# Exchange name used in notification addresses. +# Exchange name resolution precedence: +# Target.exchange if set +# else default_notification_exchange if set +# else control_exchange if set +# else 'notify' (string value) +#default_notification_exchange = + +# Exchange name used in RPC addresses. +# Exchange name resolution precedence: +# Target.exchange if set +# else default_rpc_exchange if set +# else control_exchange if set +# else 'rpc' (string value) +#default_rpc_exchange = + +# Window size for incoming RPC Reply messages. (integer value) +# Minimum value: 1 +#reply_link_credit = 200 + +# Window size for incoming RPC Request messages (integer value) +# Minimum value: 1 +#rpc_server_credit = 100 + +# Window size for incoming Notification messages (integer value) +# Minimum value: 1 +#notify_server_credit = 100 + +# Send messages of this type pre-settled. +# Pre-settled messages will not receive acknowledgement +# from the peer. Note well: pre-settled messages may be +# silently discarded if the delivery fails. +# Permitted values: +# 'rpc-call' - send RPC Calls pre-settled +# 'rpc-reply'- send RPC Replies pre-settled +# 'rpc-cast' - Send RPC Casts pre-settled +# 'notify' - Send Notifications pre-settled +# (multi valued) +#pre_settled = rpc-cast +#pre_settled = rpc-reply + + +[oslo_messaging_kafka] + +# +# From oslo.messaging +# + +# DEPRECATED: Default Kafka broker Host (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#kafka_default_host = localhost + +# DEPRECATED: Default Kafka broker Port (port value) +# Minimum value: 0 +# Maximum value: 65535 +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#kafka_default_port = 9092 + +# Max fetch bytes of Kafka consumer (integer value) +#kafka_max_fetch_bytes = 1048576 + +# Default timeout(s) for Kafka consumers (floating point value) +#kafka_consumer_timeout = 1.0 + +# DEPRECATED: Pool Size for Kafka Consumers (integer value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Driver no longer uses connection pool. +#pool_size = 10 + +# DEPRECATED: The pool size limit for connections expiration policy (integer +# value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Driver no longer uses connection pool. +#conn_pool_min_size = 2 + +# DEPRECATED: The time-to-live in sec of idle connections in the pool (integer +# value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Driver no longer uses connection pool. +#conn_pool_ttl = 1200 + +# Group id for Kafka consumer. Consumers in one group will coordinate message +# consumption (string value) +#consumer_group = oslo_messaging_consumer + +# Upper bound on the delay for KafkaProducer batching in seconds (floating point +# value) +#producer_batch_timeout = 0.0 + +# Size of batch for the producer async send (integer value) +#producer_batch_size = 16384 + + +[oslo_messaging_notifications] + +# +# From oslo.messaging +# + +# The Drivers(s) to handle sending notifications. Possible values are messaging, +# messagingv2, routing, log, test, noop (multi valued) +# Deprecated group/name - [DEFAULT]/notification_driver +#driver = + +# A URL representing the messaging driver to use for notifications. If not set, +# we fall back to the same configuration used for RPC. (string value) +# Deprecated group/name - [DEFAULT]/notification_transport_url +#transport_url = + +# AMQP topic used for OpenStack notifications. (list value) +# Deprecated group/name - [rpc_notifier2]/topics +# Deprecated group/name - [DEFAULT]/notification_topics +#topics = notifications + +# The maximum number of attempts to re-send a notification message which failed +# to be delivered due to a recoverable error. 0 - No retry, -1 - indefinite +# (integer value) +#retry = -1 + + +[oslo_messaging_rabbit] + +# +# From oslo.messaging +# + +# Use durable queues in AMQP. (boolean value) +# Deprecated group/name - [DEFAULT]/amqp_durable_queues +# Deprecated group/name - [DEFAULT]/rabbit_durable_queues +#amqp_durable_queues = false + +# Auto-delete queues in AMQP. (boolean value) +#amqp_auto_delete = false + +# Enable SSL (boolean value) +#ssl = + +# SSL version to use (valid only if SSL enabled). Valid values are TLSv1 and +# SSLv23. SSLv2, SSLv3, TLSv1_1, and TLSv1_2 may be available on some +# distributions. (string value) +# Deprecated group/name - [oslo_messaging_rabbit]/kombu_ssl_version +#ssl_version = + +# SSL key file (valid only if SSL enabled). (string value) +# Deprecated group/name - [oslo_messaging_rabbit]/kombu_ssl_keyfile +#ssl_key_file = + +# SSL cert file (valid only if SSL enabled). (string value) +# Deprecated group/name - [oslo_messaging_rabbit]/kombu_ssl_certfile +#ssl_cert_file = + +# SSL certification authority file (valid only if SSL enabled). (string value) +# Deprecated group/name - [oslo_messaging_rabbit]/kombu_ssl_ca_certs +#ssl_ca_file = + +# How long to wait before reconnecting in response to an AMQP consumer cancel +# notification. (floating point value) +#kombu_reconnect_delay = 1.0 + +# EXPERIMENTAL: Possible values are: gzip, bz2. If not set compression will not +# be used. This option may not be available in future versions. (string value) +#kombu_compression = + +# How long to wait a missing client before abandoning to send it its replies. +# This value should not be longer than rpc_response_timeout. (integer value) +# Deprecated group/name - [oslo_messaging_rabbit]/kombu_reconnect_timeout +#kombu_missing_consumer_retry_timeout = 60 + +# Determines how the next RabbitMQ node is chosen in case the one we are +# currently connected to becomes unavailable. Takes effect only if more than one +# RabbitMQ node is provided in config. (string value) +# Possible values: +# round-robin - +# shuffle - +#kombu_failover_strategy = round-robin + +# DEPRECATED: The RabbitMQ broker address where a single node is used. (string +# value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#rabbit_host = localhost + +# DEPRECATED: The RabbitMQ broker port where a single node is used. (port value) +# Minimum value: 0 +# Maximum value: 65535 +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#rabbit_port = 5672 + +# DEPRECATED: RabbitMQ HA cluster host:port pairs. (list value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#rabbit_hosts = $rabbit_host:$rabbit_port + +# DEPRECATED: The RabbitMQ userid. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#rabbit_userid = guest + +# DEPRECATED: The RabbitMQ password. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#rabbit_password = guest + +# The RabbitMQ login method. (string value) +# Possible values: +# PLAIN - +# AMQPLAIN - +# RABBIT-CR-DEMO - +#rabbit_login_method = AMQPLAIN + +# DEPRECATED: The RabbitMQ virtual host. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#rabbit_virtual_host = / + +# How frequently to retry connecting with RabbitMQ. (integer value) +#rabbit_retry_interval = 1 + +# How long to backoff for between retries when connecting to RabbitMQ. (integer +# value) +#rabbit_retry_backoff = 2 + +# Maximum interval of RabbitMQ connection retries. Default is 30 seconds. +# (integer value) +#rabbit_interval_max = 30 + +# DEPRECATED: Maximum number of RabbitMQ connection retries. Default is 0 +# (infinite retry count). (integer value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +#rabbit_max_retries = 0 + +# Try to use HA queues in RabbitMQ (x-ha-policy: all). If you change this +# option, you must wipe the RabbitMQ database. In RabbitMQ 3.0, queue mirroring +# is no longer controlled by the x-ha-policy argument when declaring a queue. If +# you just want to make sure that all queues (except those with auto-generated +# names) are mirrored across all nodes, run: "rabbitmqctl set_policy HA +# '^(?!amq\.).*' '{"ha-mode": "all"}' " (boolean value) +#rabbit_ha_queues = false + +# Positive integer representing duration in seconds for queue TTL (x-expires). +# Queues which are unused for the duration of the TTL are automatically deleted. +# The parameter affects only reply and fanout queues. (integer value) +# Minimum value: 1 +#rabbit_transient_queues_ttl = 1800 + +# Specifies the number of messages to prefetch. Setting to zero allows unlimited +# messages. (integer value) +#rabbit_qos_prefetch_count = 0 + +# Number of seconds after which the Rabbit broker is considered down if +# heartbeat's keep-alive fails (0 disable the heartbeat). EXPERIMENTAL (integer +# value) +#heartbeat_timeout_threshold = 60 + +# How often times during the heartbeat_timeout_threshold we check the heartbeat. +# (integer value) +#heartbeat_rate = 2 + +# Deprecated, use rpc_backend=kombu+memory or rpc_backend=fake (boolean value) +#fake_rabbit = false + +# Maximum number of channels to allow (integer value) +#channel_max = + +# The maximum byte size for an AMQP frame (integer value) +#frame_max = + +# How often to send heartbeats for consumer's connections (integer value) +#heartbeat_interval = 3 + +# Arguments passed to ssl.wrap_socket (dict value) +#ssl_options = + +# Set socket timeout in seconds for connection's socket (floating point value) +#socket_timeout = 0.25 + +# Set TCP_USER_TIMEOUT in seconds for connection's socket (floating point value) +#tcp_user_timeout = 0.25 + +# Set delay for reconnection to some host which has connection error (floating +# point value) +#host_connection_reconnect_delay = 0.25 + +# Connection factory implementation (string value) +# Possible values: +# new - +# single - +# read_write - +#connection_factory = single + +# Maximum number of connections to keep queued. (integer value) +#pool_max_size = 30 + +# Maximum number of connections to create above `pool_max_size`. (integer value) +#pool_max_overflow = 0 + +# Default number of seconds to wait for a connections to available (integer +# value) +#pool_timeout = 30 + +# Lifetime of a connection (since creation) in seconds or None for no recycling. +# Expired connections are closed on acquire. (integer value) +#pool_recycle = 600 + +# Threshold at which inactive (since release) connections are considered stale +# in seconds or None for no staleness. Stale connections are closed on acquire. +# (integer value) +#pool_stale = 60 + +# Default serialization mechanism for serializing/deserializing +# outgoing/incoming messages (string value) +# Possible values: +# json - +# msgpack - +#default_serializer_type = json + +# Persist notification messages. (boolean value) +#notification_persistence = false + +# Exchange name for sending notifications (string value) +#default_notification_exchange = ${control_exchange}_notification + +# Max number of not acknowledged message which RabbitMQ can send to notification +# listener. (integer value) +#notification_listener_prefetch_count = 100 + +# Reconnecting retry count in case of connectivity problem during sending +# notification, -1 means infinite retry. (integer value) +#default_notification_retry_attempts = -1 + +# Reconnecting retry delay in case of connectivity problem during sending +# notification message (floating point value) +#notification_retry_delay = 0.25 + +# Time to live for rpc queues without consumers in seconds. (integer value) +#rpc_queue_expiration = 60 + +# Exchange name for sending RPC messages (string value) +#default_rpc_exchange = ${control_exchange}_rpc + +# Exchange name for receiving RPC replies (string value) +#rpc_reply_exchange = ${control_exchange}_rpc_reply + +# Max number of not acknowledged message which RabbitMQ can send to rpc +# listener. (integer value) +#rpc_listener_prefetch_count = 100 + +# Max number of not acknowledged message which RabbitMQ can send to rpc reply +# listener. (integer value) +#rpc_reply_listener_prefetch_count = 100 + +# Reconnecting retry count in case of connectivity problem during sending reply. +# -1 means infinite retry during rpc_timeout (integer value) +#rpc_reply_retry_attempts = -1 + +# Reconnecting retry delay in case of connectivity problem during sending reply. +# (floating point value) +#rpc_reply_retry_delay = 0.25 + +# Reconnecting retry count in case of connectivity problem during sending RPC +# message, -1 means infinite retry. If actual retry attempts in not 0 the rpc +# request could be processed more than one time (integer value) +#default_rpc_retry_attempts = -1 + +# Reconnecting retry delay in case of connectivity problem during sending RPC +# message (floating point value) +#rpc_retry_delay = 0.25 + + +[oslo_messaging_zmq] + +# +# From oslo.messaging +# + +# ZeroMQ bind address. Should be a wildcard (*), an ethernet interface, or IP. +# The "host" option should point or resolve to this address. (string value) +#rpc_zmq_bind_address = * + +# MatchMaker driver. (string value) +# Possible values: +# redis - +# sentinel - +# dummy - +#rpc_zmq_matchmaker = redis + +# Number of ZeroMQ contexts, defaults to 1. (integer value) +#rpc_zmq_contexts = 1 + +# Maximum number of ingress messages to locally buffer per topic. Default is +# unlimited. (integer value) +#rpc_zmq_topic_backlog = + +# Directory for holding IPC sockets. (string value) +#rpc_zmq_ipc_dir = /var/run/openstack + +# Name of this node. Must be a valid hostname, FQDN, or IP address. Must match +# "host" option, if running Nova. (string value) +#rpc_zmq_host = localhost + +# Number of seconds to wait before all pending messages will be sent after +# closing a socket. The default value of -1 specifies an infinite linger period. +# The value of 0 specifies no linger period. Pending messages shall be discarded +# immediately when the socket is closed. Positive values specify an upper bound +# for the linger period. (integer value) +# Deprecated group/name - [DEFAULT]/rpc_cast_timeout +#zmq_linger = -1 + +# The default number of seconds that poll should wait. Poll raises timeout +# exception when timeout expired. (integer value) +#rpc_poll_timeout = 1 + +# Expiration timeout in seconds of a name service record about existing target ( +# < 0 means no timeout). (integer value) +#zmq_target_expire = 300 + +# Update period in seconds of a name service record about existing target. +# (integer value) +#zmq_target_update = 180 + +# Use PUB/SUB pattern for fanout methods. PUB/SUB always uses proxy. (boolean +# value) +#use_pub_sub = false + +# Use ROUTER remote proxy. (boolean value) +#use_router_proxy = false + +# This option makes direct connections dynamic or static. It makes sense only +# with use_router_proxy=False which means to use direct connections for direct +# message types (ignored otherwise). (boolean value) +#use_dynamic_connections = false + +# How many additional connections to a host will be made for failover reasons. +# This option is actual only in dynamic connections mode. (integer value) +#zmq_failover_connections = 2 + +# Minimal port number for random ports range. (port value) +# Minimum value: 0 +# Maximum value: 65535 +#rpc_zmq_min_port = 49153 + +# Maximal port number for random ports range. (integer value) +# Minimum value: 1 +# Maximum value: 65536 +#rpc_zmq_max_port = 65536 + +# Number of retries to find free port number before fail with ZMQBindError. +# (integer value) +#rpc_zmq_bind_port_retries = 100 + +# Default serialization mechanism for serializing/deserializing +# outgoing/incoming messages (string value) +# Possible values: +# json - +# msgpack - +#rpc_zmq_serialization = json + +# This option configures round-robin mode in zmq socket. True means not keeping +# a queue when server side disconnects. False means to keep queue and messages +# even if server is disconnected, when the server appears we send all +# accumulated messages to it. (boolean value) +#zmq_immediate = true + +# Enable/disable TCP keepalive (KA) mechanism. The default value of -1 (or any +# other negative value) means to skip any overrides and leave it to OS default; +# 0 and 1 (or any other positive value) mean to disable and enable the option +# respectively. (integer value) +#zmq_tcp_keepalive = -1 + +# The duration between two keepalive transmissions in idle condition. The unit +# is platform dependent, for example, seconds in Linux, milliseconds in Windows +# etc. The default value of -1 (or any other negative value and 0) means to skip +# any overrides and leave it to OS default. (integer value) +#zmq_tcp_keepalive_idle = -1 + +# The number of retransmissions to be carried out before declaring that remote +# end is not available. The default value of -1 (or any other negative value and +# 0) means to skip any overrides and leave it to OS default. (integer value) +#zmq_tcp_keepalive_cnt = -1 + +# The duration between two successive keepalive retransmissions, if +# acknowledgement to the previous keepalive transmission is not received. The +# unit is platform dependent, for example, seconds in Linux, milliseconds in +# Windows etc. The default value of -1 (or any other negative value and 0) means +# to skip any overrides and leave it to OS default. (integer value) +#zmq_tcp_keepalive_intvl = -1 + +# Maximum number of (green) threads to work concurrently. (integer value) +#rpc_thread_pool_size = 100 + +# Expiration timeout in seconds of a sent/received message after which it is not +# tracked anymore by a client/server. (integer value) +#rpc_message_ttl = 300 + +# Wait for message acknowledgements from receivers. This mechanism works only +# via proxy without PUB/SUB. (boolean value) +#rpc_use_acks = false + +# Number of seconds to wait for an ack from a cast/call. After each retry +# attempt this timeout is multiplied by some specified multiplier. (integer +# value) +#rpc_ack_timeout_base = 15 + +# Number to multiply base ack timeout by after each retry attempt. (integer +# value) +#rpc_ack_timeout_multiplier = 2 + +# Default number of message sending attempts in case of any problems occurred: +# positive value N means at most N retries, 0 means no retries, None or -1 (or +# any other negative values) mean to retry forever. This option is used only if +# acknowledgments are enabled. (integer value) +#rpc_retry_attempts = 3 + +# List of publisher hosts SubConsumer can subscribe on. This option has higher +# priority then the default publishers list taken from the matchmaker. (list +# value) +#subscribe_on = + + +[oslo_policy] + +# +# From oslo.policy +# + +# This option controls whether or not to enforce scope when evaluating policies. +# If ``True``, the scope of the token used in the request is compared to the +# ``scope_types`` of the policy being enforced. If the scopes do not match, an +# ``InvalidScope`` exception will be raised. If ``False``, a message will be +# logged informing operators that policies are being invoked with mismatching +# scope. (boolean value) +#enforce_scope = false + +# The file that defines policies. (string value) +#policy_file = policy.json + +# Default rule. Enforced when a requested rule is not found. (string value) +#policy_default_rule = default + +# Directories where policy configuration files are stored. They can be relative +# to any directory in the search path defined by the config_dir option, or +# absolute paths. The file defined by policy_file must exist for these +# directories to be searched. Missing or empty directories are ignored. (multi +# valued) +#policy_dirs = policy.d + +# Content Type to send and receive data for REST based policy check (string +# value) +# Possible values: +# application/x-www-form-urlencoded - +# application/json - +#remote_content_type = application/x-www-form-urlencoded + +# server identity verification for REST based policy check (boolean value) +#remote_ssl_verify_server_crt = false + +# Absolute path to ca cert file for REST based policy check (string value) +#remote_ssl_ca_crt_file = + +# Absolute path to client cert for REST based policy check (string value) +#remote_ssl_client_crt_file = + +# Absolute path client key file REST based policy check (string value) +#remote_ssl_client_key_file = + + +[paste_deploy] +flavor = keystone + +# +# From glance.registry +# + +# +# Deployment flavor to use in the server application pipeline. +# +# Provide a string value representing the appropriate deployment +# flavor used in the server application pipleline. This is typically +# the partial name of a pipeline in the paste configuration file with +# the service name removed. +# +# For example, if your paste section name in the paste configuration +# file is [pipeline:glance-api-keystone], set ``flavor`` to +# ``keystone``. +# +# Possible values: +# * String value representing a partial pipeline name. +# +# Related Options: +# * config_file +# +# (string value) +#flavor = keystone + +# +# Name of the paste configuration file. +# +# Provide a string value representing the name of the paste +# configuration file to use for configuring piplelines for +# server application deployments. +# +# NOTES: +# * Provide the name or the path relative to the glance directory +# for the paste configuration file and not the absolute path. +# * The sample paste configuration file shipped with Glance need +# not be edited in most cases as it comes with ready-made +# pipelines for all common deployment flavors. +# +# If no value is specified for this option, the ``paste.ini`` file +# with the prefix of the corresponding Glance service's configuration +# file name will be searched for in the known configuration +# directories. (For example, if this option is missing from or has no +# value set in ``glance-api.conf``, the service will look for a file +# named ``glance-api-paste.ini``.) If the paste configuration file is +# not found, the service will not start. +# +# Possible values: +# * A string value representing the name of the paste configuration +# file. +# +# Related Options: +# * flavor +# +# (string value) +#config_file = glance-api-paste.ini + + +[profiler] + +# +# From glance.registry +# + +# +# Enables the profiling for all services on this node. Default value is False +# (fully disable the profiling feature). +# +# Possible values: +# +# * True: Enables the feature +# * False: Disables the feature. The profiling cannot be started via this +# project +# operations. If the profiling is triggered by another project, this project +# part +# will be empty. +# (boolean value) +# Deprecated group/name - [profiler]/profiler_enabled +#enabled = false + +# +# Enables SQL requests profiling in services. Default value is False (SQL +# requests won't be traced). +# +# Possible values: +# +# * True: Enables SQL requests profiling. Each SQL query will be part of the +# trace and can the be analyzed by how much time was spent for that. +# * False: Disables SQL requests profiling. The spent time is only shown on a +# higher level of operations. Single SQL queries cannot be analyzed this +# way. +# (boolean value) +#trace_sqlalchemy = false + +# +# Secret key(s) to use for encrypting context data for performance profiling. +# This string value should have the following format: [,,...], +# where each key is some random string. A user who triggers the profiling via +# the REST API has to set one of these keys in the headers of the REST API call +# to include profiling results of this node for this particular project. +# +# Both "enabled" flag and "hmac_keys" config options should be set to enable +# profiling. Also, to generate correct profiling information across all services +# at least one key needs to be consistent between OpenStack projects. This +# ensures it can be used from client side to generate the trace, containing +# information from all possible resources. (string value) +#hmac_keys = SECRET_KEY + +# +# Connection string for a notifier backend. Default value is messaging:// which +# sets the notifier to oslo_messaging. +# +# Examples of possible values: +# +# * messaging://: use oslo_messaging driver for sending notifications. +# * mongodb://127.0.0.1:27017 : use mongodb driver for sending notifications. +# * elasticsearch://127.0.0.1:9200 : use elasticsearch driver for sending +# notifications. +# (string value) +#connection_string = messaging:// + +# +# Document type for notification indexing in elasticsearch. +# (string value) +#es_doc_type = notification + +# +# This parameter is a time value parameter (for example: es_scroll_time=2m), +# indicating for how long the nodes that participate in the search will maintain +# relevant resources in order to continue and support it. +# (string value) +#es_scroll_time = 2m + +# +# Elasticsearch splits large requests in batches. This parameter defines +# maximum size of each batch (for example: es_scroll_size=10000). +# (integer value) +#es_scroll_size = 10000 + +# +# Redissentinel provides a timeout option on the connections. +# This parameter defines that timeout (for example: socket_timeout=0.1). +# (floating point value) +#socket_timeout = 0.1 + +# +# Redissentinel uses a service name to identify a master redis service. +# This parameter defines the name (for example: +# sentinal_service_name=mymaster). +# (string value) +#sentinel_service_name = mymaster diff --git a/openstack/openstack_conf/controller/glance/glance-scrubber.conf b/openstack/openstack_conf/controller/glance/glance-scrubber.conf new file mode 100644 index 0000000..d77b393 --- /dev/null +++ b/openstack/openstack_conf/controller/glance/glance-scrubber.conf @@ -0,0 +1,2379 @@ +[DEFAULT] + +# +# From glance.scrubber +# + +# +# Allow users to add additional/custom properties to images. +# +# Glance defines a standard set of properties (in its schema) that +# appear on every image. These properties are also known as +# ``base properties``. In addition to these properties, Glance +# allows users to add custom properties to images. These are known +# as ``additional properties``. +# +# By default, this configuration option is set to ``True`` and users +# are allowed to add additional properties. The number of additional +# properties that can be added to an image can be controlled via +# ``image_property_quota`` configuration option. +# +# Possible values: +# * True +# * False +# +# Related options: +# * image_property_quota +# +# (boolean value) +#allow_additional_image_properties = true + +# +# Maximum number of image members per image. +# +# This limits the maximum of users an image can be shared with. Any negative +# value is interpreted as unlimited. +# +# Related options: +# * None +# +# (integer value) +#image_member_quota = 128 + +# +# Maximum number of properties allowed on an image. +# +# This enforces an upper limit on the number of additional properties an image +# can have. Any negative value is interpreted as unlimited. +# +# NOTE: This won't have any impact if additional properties are disabled. Please +# refer to ``allow_additional_image_properties``. +# +# Related options: +# * ``allow_additional_image_properties`` +# +# (integer value) +#image_property_quota = 128 + +# +# Maximum number of tags allowed on an image. +# +# Any negative value is interpreted as unlimited. +# +# Related options: +# * None +# +# (integer value) +#image_tag_quota = 128 + +# +# Maximum number of locations allowed on an image. +# +# Any negative value is interpreted as unlimited. +# +# Related options: +# * None +# +# (integer value) +#image_location_quota = 10 + +# DEPRECATED: +# Python module path of data access API. +# +# Specifies the path to the API to use for accessing the data model. +# This option determines how the image catalog data will be accessed. +# +# Possible values: +# * glance.db.sqlalchemy.api +# * glance.db.registry.api +# * glance.db.simple.api +# +# If this option is set to ``glance.db.sqlalchemy.api`` then the image +# catalog data is stored in and read from the database via the +# SQLAlchemy Core and ORM APIs. +# +# Setting this option to ``glance.db.registry.api`` will force all +# database access requests to be routed through the Registry service. +# This avoids data access from the Glance API nodes for an added layer +# of security, scalability and manageability. +# +# NOTE: In v2 OpenStack Images API, the registry service is optional. +# In order to use the Registry API in v2, the option +# ``enable_v2_registry`` must be set to ``True``. +# +# Finally, when this configuration option is set to +# ``glance.db.simple.api``, image catalog data is stored in and read +# from an in-memory data structure. This is primarily used for testing. +# +# Related options: +# * enable_v2_api +# * enable_v2_registry +# +# (string value) +# This option is deprecated for removal since Queens. +# Its value may be silently ignored in the future. +# Reason: +# Glance registry service is deprecated for removal. +# +# More information can be found from the spec: +# http://specs.openstack.org/openstack/glance-specs/specs/queens/approved/glance +# /deprecate-registry.html +#data_api = glance.db.sqlalchemy.api + +# +# The default number of results to return for a request. +# +# Responses to certain API requests, like list images, may return +# multiple items. The number of results returned can be explicitly +# controlled by specifying the ``limit`` parameter in the API request. +# However, if a ``limit`` parameter is not specified, this +# configuration value will be used as the default number of results to +# be returned for any API request. +# +# NOTES: +# * The value of this configuration option may not be greater than +# the value specified by ``api_limit_max``. +# * Setting this to a very large value may slow down database +# queries and increase response times. Setting this to a +# very low value may result in poor user experience. +# +# Possible values: +# * Any positive integer +# +# Related options: +# * api_limit_max +# +# (integer value) +# Minimum value: 1 +#limit_param_default = 25 + +# +# Maximum number of results that could be returned by a request. +# +# As described in the help text of ``limit_param_default``, some +# requests may return multiple results. The number of results to be +# returned are governed either by the ``limit`` parameter in the +# request or the ``limit_param_default`` configuration option. +# The value in either case, can't be greater than the absolute maximum +# defined by this configuration option. Anything greater than this +# value is trimmed down to the maximum value defined here. +# +# NOTE: Setting this to a very large value may slow down database +# queries and increase response times. Setting this to a +# very low value may result in poor user experience. +# +# Possible values: +# * Any positive integer +# +# Related options: +# * limit_param_default +# +# (integer value) +# Minimum value: 1 +#api_limit_max = 1000 + +# +# Show direct image location when returning an image. +# +# This configuration option indicates whether to show the direct image +# location when returning image details to the user. The direct image +# location is where the image data is stored in backend storage. This +# image location is shown under the image property ``direct_url``. +# +# When multiple image locations exist for an image, the best location +# is displayed based on the location strategy indicated by the +# configuration option ``location_strategy``. +# +# NOTES: +# * Revealing image locations can present a GRAVE SECURITY RISK as +# image locations can sometimes include credentials. Hence, this +# is set to ``False`` by default. Set this to ``True`` with +# EXTREME CAUTION and ONLY IF you know what you are doing! +# * If an operator wishes to avoid showing any image location(s) +# to the user, then both this option and +# ``show_multiple_locations`` MUST be set to ``False``. +# +# Possible values: +# * True +# * False +# +# Related options: +# * show_multiple_locations +# * location_strategy +# +# (boolean value) +#show_image_direct_url = false + +# DEPRECATED: +# Show all image locations when returning an image. +# +# This configuration option indicates whether to show all the image +# locations when returning image details to the user. When multiple +# image locations exist for an image, the locations are ordered based +# on the location strategy indicated by the configuration opt +# ``location_strategy``. The image locations are shown under the +# image property ``locations``. +# +# NOTES: +# * Revealing image locations can present a GRAVE SECURITY RISK as +# image locations can sometimes include credentials. Hence, this +# is set to ``False`` by default. Set this to ``True`` with +# EXTREME CAUTION and ONLY IF you know what you are doing! +# * If an operator wishes to avoid showing any image location(s) +# to the user, then both this option and +# ``show_image_direct_url`` MUST be set to ``False``. +# +# Possible values: +# * True +# * False +# +# Related options: +# * show_image_direct_url +# * location_strategy +# +# (boolean value) +# This option is deprecated for removal since Newton. +# Its value may be silently ignored in the future. +# Reason: This option will be removed in the Pike release or later because the +# same functionality can be achieved with greater granularity by using policies. +# Please see the Newton release notes for more information. +#show_multiple_locations = false + +# +# Maximum size of image a user can upload in bytes. +# +# An image upload greater than the size mentioned here would result +# in an image creation failure. This configuration option defaults to +# 1099511627776 bytes (1 TiB). +# +# NOTES: +# * This value should only be increased after careful +# consideration and must be set less than or equal to +# 8 EiB (9223372036854775808). +# * This value must be set with careful consideration of the +# backend storage capacity. Setting this to a very low value +# may result in a large number of image failures. And, setting +# this to a very large value may result in faster consumption +# of storage. Hence, this must be set according to the nature of +# images created and storage capacity available. +# +# Possible values: +# * Any positive number less than or equal to 9223372036854775808 +# +# (integer value) +# Minimum value: 1 +# Maximum value: 9223372036854775808 +#image_size_cap = 1099511627776 + +# +# Maximum amount of image storage per tenant. +# +# This enforces an upper limit on the cumulative storage consumed by all images +# of a tenant across all stores. This is a per-tenant limit. +# +# The default unit for this configuration option is Bytes. However, storage +# units can be specified using case-sensitive literals ``B``, ``KB``, ``MB``, +# ``GB`` and ``TB`` representing Bytes, KiloBytes, MegaBytes, GigaBytes and +# TeraBytes respectively. Note that there should not be any space between the +# value and unit. Value ``0`` signifies no quota enforcement. Negative values +# are invalid and result in errors. +# +# Possible values: +# * A string that is a valid concatenation of a non-negative integer +# representing the storage value and an optional string literal +# representing storage units as mentioned above. +# +# Related options: +# * None +# +# (string value) +#user_storage_quota = 0 + +# +# Deploy the v1 OpenStack Images API. +# +# When this option is set to ``True``, Glance service will respond to +# requests on registered endpoints conforming to the v1 OpenStack +# Images API. +# +# NOTES: +# * If this option is enabled, then ``enable_v1_registry`` must +# also be set to ``True`` to enable mandatory usage of Registry +# service with v1 API. +# +# * If this option is disabled, then the ``enable_v1_registry`` +# option, which is enabled by default, is also recommended +# to be disabled. +# +# * This option is separate from ``enable_v2_api``, both v1 and v2 +# OpenStack Images API can be deployed independent of each +# other. +# +# * If deploying only the v2 Images API, this option, which is +# enabled by default, should be disabled. +# +# Possible values: +# * True +# * False +# +# Related options: +# * enable_v1_registry +# * enable_v2_api +# +# (boolean value) +#enable_v1_api = true + +# +# Deploy the v2 OpenStack Images API. +# +# When this option is set to ``True``, Glance service will respond +# to requests on registered endpoints conforming to the v2 OpenStack +# Images API. +# +# NOTES: +# * If this option is disabled, then the ``enable_v2_registry`` +# option, which is enabled by default, is also recommended +# to be disabled. +# +# * This option is separate from ``enable_v1_api``, both v1 and v2 +# OpenStack Images API can be deployed independent of each +# other. +# +# * If deploying only the v1 Images API, this option, which is +# enabled by default, should be disabled. +# +# Possible values: +# * True +# * False +# +# Related options: +# * enable_v2_registry +# * enable_v1_api +# +# (boolean value) +#enable_v2_api = true + +# +# Deploy the v1 API Registry service. +# +# When this option is set to ``True``, the Registry service +# will be enabled in Glance for v1 API requests. +# +# NOTES: +# * Use of Registry is mandatory in v1 API, so this option must +# be set to ``True`` if the ``enable_v1_api`` option is enabled. +# +# * If deploying only the v2 OpenStack Images API, this option, +# which is enabled by default, should be disabled. +# +# Possible values: +# * True +# * False +# +# Related options: +# * enable_v1_api +# +# (boolean value) +#enable_v1_registry = true + +# DEPRECATED: +# Deploy the v2 API Registry service. +# +# When this option is set to ``True``, the Registry service +# will be enabled in Glance for v2 API requests. +# +# NOTES: +# * Use of Registry is optional in v2 API, so this option +# must only be enabled if both ``enable_v2_api`` is set to +# ``True`` and the ``data_api`` option is set to +# ``glance.db.registry.api``. +# +# * If deploying only the v1 OpenStack Images API, this option, +# which is enabled by default, should be disabled. +# +# Possible values: +# * True +# * False +# +# Related options: +# * enable_v2_api +# * data_api +# +# (boolean value) +# This option is deprecated for removal since Queens. +# Its value may be silently ignored in the future. +# Reason: +# Glance registry service is deprecated for removal. +# +# More information can be found from the spec: +# http://specs.openstack.org/openstack/glance-specs/specs/queens/approved/glance +# /deprecate-registry.html +#enable_v2_registry = true + +# +# Host address of the pydev server. +# +# Provide a string value representing the hostname or IP of the +# pydev server to use for debugging. The pydev server listens for +# debug connections on this address, facilitating remote debugging +# in Glance. +# +# Possible values: +# * Valid hostname +# * Valid IP address +# +# Related options: +# * None +# +# (unknown value) +#pydev_worker_debug_host = localhost + +# +# Port number that the pydev server will listen on. +# +# Provide a port number to bind the pydev server to. The pydev +# process accepts debug connections on this port and facilitates +# remote debugging in Glance. +# +# Possible values: +# * A valid port number +# +# Related options: +# * None +# +# (port value) +# Minimum value: 0 +# Maximum value: 65535 +#pydev_worker_debug_port = 5678 + +# +# AES key for encrypting store location metadata. +# +# Provide a string value representing the AES cipher to use for +# encrypting Glance store metadata. +# +# NOTE: The AES key to use must be set to a random string of length +# 16, 24 or 32 bytes. +# +# Possible values: +# * String value representing a valid AES key +# +# Related options: +# * None +# +# (string value) +#metadata_encryption_key = + +# +# Digest algorithm to use for digital signature. +# +# Provide a string value representing the digest algorithm to +# use for generating digital signatures. By default, ``sha256`` +# is used. +# +# To get a list of the available algorithms supported by the version +# of OpenSSL on your platform, run the command: +# ``openssl list-message-digest-algorithms``. +# Examples are 'sha1', 'sha256', and 'sha512'. +# +# NOTE: ``digest_algorithm`` is not related to Glance's image signing +# and verification. It is only used to sign the universally unique +# identifier (UUID) as a part of the certificate file and key file +# validation. +# +# Possible values: +# * An OpenSSL message digest algorithm identifier +# +# Relation options: +# * None +# +# (string value) +#digest_algorithm = sha256 + +# +# The URL provides location where the temporary data will be stored +# +# This option is for Glance internal use only. Glance will save the +# image data uploaded by the user to 'staging' endpoint during the +# image import process. +# +# This option does not change the 'staging' API endpoint by any means. +# +# NOTE: It is discouraged to use same path as [task]/work_dir +# +# NOTE: 'file://' is the only option +# api_image_import flow will support for now. +# +# NOTE: The staging path must be on shared filesystem available to all +# Glance API nodes. +# +# Possible values: +# * String starting with 'file://' followed by absolute FS path +# +# Related options: +# * [task]/work_dir +# * [DEFAULT]/enable_image_import (*deprecated*) +# +# (string value) +#node_staging_uri = file:///tmp/staging/ + +# DEPRECATED: +# Enables the Image Import workflow introduced in Pike +# +# As '[DEFAULT]/node_staging_uri' is required for the Image +# Import, it's disabled per default in Pike, enabled per +# default in Queens and removed in Rocky. This allows Glance to +# operate with previous version configs upon upgrade. +# +# Setting this option to False will disable the endpoints related +# to Image Import Refactoring work. +# +# Related options: +# * [DEFAULT]/node_staging_uri (boolean value) +# This option is deprecated for removal since Pike. +# Its value may be silently ignored in the future. +# Reason: +# This option is deprecated for removal in Rocky. +# +# It was introduced to make sure that the API is not enabled +# before the '[DEFAULT]/node_staging_uri' is defined and is +# long term redundant. +#enable_image_import = true + +# +# List of enabled Image Import Methods +# +# Both 'glance-direct' and 'web-download' are enabled by default. +# +# Related options: +# * [DEFAULT]/node_staging_uri +# * [DEFAULT]/enable_image_import (list value) +#enabled_import_methods = glance-direct,web-download + +# +# The amount of time, in seconds, to delay image scrubbing. +# +# When delayed delete is turned on, an image is put into ``pending_delete`` +# state upon deletion until the scrubber deletes its image data. Typically, soon +# after the image is put into ``pending_delete`` state, it is available for +# scrubbing. However, scrubbing can be delayed until a later point using this +# configuration option. This option denotes the time period an image spends in +# ``pending_delete`` state before it is available for scrubbing. +# +# It is important to realize that this has storage implications. The larger the +# ``scrub_time``, the longer the time to reclaim backend storage from deleted +# images. +# +# Possible values: +# * Any non-negative integer +# +# Related options: +# * ``delayed_delete`` +# +# (integer value) +# Minimum value: 0 +#scrub_time = 0 + +# +# The size of thread pool to be used for scrubbing images. +# +# When there are a large number of images to scrub, it is beneficial to scrub +# images in parallel so that the scrub queue stays in control and the backend +# storage is reclaimed in a timely fashion. This configuration option denotes +# the maximum number of images to be scrubbed in parallel. The default value is +# one, which signifies serial scrubbing. Any value above one indicates parallel +# scrubbing. +# +# Possible values: +# * Any non-zero positive integer +# +# Related options: +# * ``delayed_delete`` +# +# (integer value) +# Minimum value: 1 +#scrub_pool_size = 1 + +# +# Turn on/off delayed delete. +# +# Typically when an image is deleted, the ``glance-api`` service puts the image +# into ``deleted`` state and deletes its data at the same time. Delayed delete +# is a feature in Glance that delays the actual deletion of image data until a +# later point in time (as determined by the configuration option +# ``scrub_time``). +# When delayed delete is turned on, the ``glance-api`` service puts the image +# into ``pending_delete`` state upon deletion and leaves the image data in the +# storage backend for the image scrubber to delete at a later time. The image +# scrubber will move the image into ``deleted`` state upon successful deletion +# of image data. +# +# NOTE: When delayed delete is turned on, image scrubber MUST be running as a +# periodic task to prevent the backend storage from filling up with undesired +# usage. +# +# Possible values: +# * True +# * False +# +# Related options: +# * ``scrub_time`` +# * ``wakeup_time`` +# * ``scrub_pool_size`` +# +# (boolean value) +#delayed_delete = false + +# +# Time interval, in seconds, between scrubber runs in daemon mode. +# +# Scrubber can be run either as a cron job or daemon. When run as a daemon, this +# configuration time specifies the time period between two runs. When the +# scrubber wakes up, it fetches and scrubs all ``pending_delete`` images that +# are available for scrubbing after taking ``scrub_time`` into consideration. +# +# If the wakeup time is set to a large number, there may be a large number of +# images to be scrubbed for each run. Also, this impacts how quickly the backend +# storage is reclaimed. +# +# Possible values: +# * Any non-negative integer +# +# Related options: +# * ``daemon`` +# * ``delayed_delete`` +# +# (integer value) +# Minimum value: 0 +#wakeup_time = 300 + +# +# Run scrubber as a daemon. +# +# This boolean configuration option indicates whether scrubber should +# run as a long-running process that wakes up at regular intervals to +# scrub images. The wake up interval can be specified using the +# configuration option ``wakeup_time``. +# +# If this configuration option is set to ``False``, which is the +# default value, scrubber runs once to scrub images and exits. In this +# case, if the operator wishes to implement continuous scrubbing of +# images, scrubber needs to be scheduled as a cron job. +# +# Possible values: +# * True +# * False +# +# Related options: +# * ``wakeup_time`` +# +# (boolean value) +#daemon = false + +# +# From oslo.log +# + +# If set to true, the logging level will be set to DEBUG instead of the default +# INFO level. (boolean value) +# Note: This option can be changed without restarting. +#debug = false + +# The name of a logging configuration file. This file is appended to any +# existing logging configuration files. For details about logging configuration +# files, see the Python logging module documentation. Note that when logging +# configuration files are used then all logging configuration is set in the +# configuration file and other logging configuration options are ignored (for +# example, logging_context_format_string). (string value) +# Note: This option can be changed without restarting. +# Deprecated group/name - [DEFAULT]/log_config +#log_config_append = + +# Defines the format string for %%(asctime)s in log records. Default: +# %(default)s . This option is ignored if log_config_append is set. (string +# value) +#log_date_format = %Y-%m-%d %H:%M:%S + +# (Optional) Name of log file to send logging output to. If no default is set, +# logging will go to stderr as defined by use_stderr. This option is ignored if +# log_config_append is set. (string value) +# Deprecated group/name - [DEFAULT]/logfile +#log_file = + +# (Optional) The base directory used for relative log_file paths. This option +# is ignored if log_config_append is set. (string value) +# Deprecated group/name - [DEFAULT]/logdir +#log_dir = + +# Uses logging handler designed to watch file system. When log file is moved or +# removed this handler will open a new log file with specified path +# instantaneously. It makes sense only if log_file option is specified and Linux +# platform is used. This option is ignored if log_config_append is set. (boolean +# value) +#watch_log_file = false + +# Use syslog for logging. Existing syslog format is DEPRECATED and will be +# changed later to honor RFC5424. This option is ignored if log_config_append is +# set. (boolean value) +#use_syslog = false + +# Enable journald for logging. If running in a systemd environment you may wish +# to enable journal support. Doing so will use the journal native protocol which +# includes structured metadata in addition to log messages.This option is +# ignored if log_config_append is set. (boolean value) +#use_journal = false + +# Syslog facility to receive log lines. This option is ignored if +# log_config_append is set. (string value) +#syslog_log_facility = LOG_USER + +# Use JSON formatting for logging. This option is ignored if log_config_append +# is set. (boolean value) +#use_json = false + +# Log output to standard error. This option is ignored if log_config_append is +# set. (boolean value) +#use_stderr = false + +# Format string to use for log messages with context. (string value) +#logging_context_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user_identity)s] %(instance)s%(message)s + +# Format string to use for log messages when context is undefined. (string +# value) +#logging_default_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [-] %(instance)s%(message)s + +# Additional data to append to log message when logging level for the message is +# DEBUG. (string value) +#logging_debug_format_suffix = %(funcName)s %(pathname)s:%(lineno)d + +# Prefix each line of exception output with this format. (string value) +#logging_exception_prefix = %(asctime)s.%(msecs)03d %(process)d ERROR %(name)s %(instance)s + +# Defines the format string for %(user_identity)s that is used in +# logging_context_format_string. (string value) +#logging_user_identity_format = %(user)s %(tenant)s %(domain)s %(user_domain)s %(project_domain)s + +# List of package logging levels in logger=LEVEL pairs. This option is ignored +# if log_config_append is set. (list value) +#default_log_levels = amqp=WARN,amqplib=WARN,boto=WARN,qpid=WARN,sqlalchemy=WARN,suds=INFO,oslo.messaging=INFO,oslo_messaging=INFO,iso8601=WARN,requests.packages.urllib3.connectionpool=WARN,urllib3.connectionpool=WARN,websocket=WARN,requests.packages.urllib3.util.retry=WARN,urllib3.util.retry=WARN,keystonemiddleware=WARN,routes.middleware=WARN,stevedore=WARN,taskflow=WARN,keystoneauth=WARN,oslo.cache=INFO,dogpile.core.dogpile=INFO + +# Enables or disables publication of error events. (boolean value) +#publish_errors = false + +# The format for an instance that is passed with the log message. (string value) +#instance_format = "[instance: %(uuid)s] " + +# The format for an instance UUID that is passed with the log message. (string +# value) +#instance_uuid_format = "[instance: %(uuid)s] " + +# Interval, number of seconds, of log rate limiting. (integer value) +#rate_limit_interval = 0 + +# Maximum number of logged messages per rate_limit_interval. (integer value) +#rate_limit_burst = 0 + +# Log level name used by rate limiting: CRITICAL, ERROR, INFO, WARNING, DEBUG or +# empty string. Logs with level greater or equal to rate_limit_except_level are +# not filtered. An empty string means that all levels are filtered. (string +# value) +#rate_limit_except_level = CRITICAL + +# Enables or disables fatal status of deprecations. (boolean value) +#fatal_deprecations = false + + +[database] + +# +# From oslo.db +# + +# If True, SQLite uses synchronous mode. (boolean value) +#sqlite_synchronous = true + +# The back end to use for the database. (string value) +# Deprecated group/name - [DEFAULT]/db_backend +#backend = sqlalchemy + +# The SQLAlchemy connection string to use to connect to the database. (string +# value) +# Deprecated group/name - [DEFAULT]/sql_connection +# Deprecated group/name - [DATABASE]/sql_connection +# Deprecated group/name - [sql]/connection +#connection = + +# The SQLAlchemy connection string to use to connect to the slave database. +# (string value) +#slave_connection = + +# The SQL mode to be used for MySQL sessions. This option, including the +# default, overrides any server-set SQL mode. To use whatever SQL mode is set by +# the server configuration, set this to no value. Example: mysql_sql_mode= +# (string value) +#mysql_sql_mode = TRADITIONAL + +# If True, transparently enables support for handling MySQL Cluster (NDB). +# (boolean value) +#mysql_enable_ndb = false + +# Connections which have been present in the connection pool longer than this +# number of seconds will be replaced with a new one the next time they are +# checked out from the pool. (integer value) +# Deprecated group/name - [DATABASE]/idle_timeout +# Deprecated group/name - [database]/idle_timeout +# Deprecated group/name - [DEFAULT]/sql_idle_timeout +# Deprecated group/name - [DATABASE]/sql_idle_timeout +# Deprecated group/name - [sql]/idle_timeout +#connection_recycle_time = 3600 + +# Minimum number of SQL connections to keep open in a pool. (integer value) +# Deprecated group/name - [DEFAULT]/sql_min_pool_size +# Deprecated group/name - [DATABASE]/sql_min_pool_size +#min_pool_size = 1 + +# Maximum number of SQL connections to keep open in a pool. Setting a value of 0 +# indicates no limit. (integer value) +# Deprecated group/name - [DEFAULT]/sql_max_pool_size +# Deprecated group/name - [DATABASE]/sql_max_pool_size +#max_pool_size = 5 + +# Maximum number of database connection retries during startup. Set to -1 to +# specify an infinite retry count. (integer value) +# Deprecated group/name - [DEFAULT]/sql_max_retries +# Deprecated group/name - [DATABASE]/sql_max_retries +#max_retries = 10 + +# Interval between retries of opening a SQL connection. (integer value) +# Deprecated group/name - [DEFAULT]/sql_retry_interval +# Deprecated group/name - [DATABASE]/reconnect_interval +#retry_interval = 10 + +# If set, use this value for max_overflow with SQLAlchemy. (integer value) +# Deprecated group/name - [DEFAULT]/sql_max_overflow +# Deprecated group/name - [DATABASE]/sqlalchemy_max_overflow +#max_overflow = 50 + +# Verbosity of SQL debugging information: 0=None, 100=Everything. (integer +# value) +# Minimum value: 0 +# Maximum value: 100 +# Deprecated group/name - [DEFAULT]/sql_connection_debug +#connection_debug = 0 + +# Add Python stack traces to SQL as comment strings. (boolean value) +# Deprecated group/name - [DEFAULT]/sql_connection_trace +#connection_trace = false + +# If set, use this value for pool_timeout with SQLAlchemy. (integer value) +# Deprecated group/name - [DATABASE]/sqlalchemy_pool_timeout +#pool_timeout = + +# Enable the experimental use of database reconnect on connection lost. (boolean +# value) +#use_db_reconnect = false + +# Seconds between retries of a database transaction. (integer value) +#db_retry_interval = 1 + +# If True, increases the interval between retries of a database operation up to +# db_max_retry_interval. (boolean value) +#db_inc_retry_interval = true + +# If db_inc_retry_interval is set, the maximum seconds between retries of a +# database operation. (integer value) +#db_max_retry_interval = 10 + +# Maximum retries in case of connection error or deadlock error before error is +# raised. Set to -1 to specify an infinite retry count. (integer value) +#db_max_retries = 20 + +# +# From oslo.db.concurrency +# + +# Enable the experimental use of thread pooling for all DB API calls (boolean +# value) +# Deprecated group/name - [DEFAULT]/dbapi_use_tpool +#use_tpool = false + + +[glance_store] + +# +# From glance.store +# + +# +# List of enabled Glance stores. +# +# Register the storage backends to use for storing disk images +# as a comma separated list. The default stores enabled for +# storing disk images with Glance are ``file`` and ``http``. +# +# Possible values: +# * A comma separated list that could include: +# * file +# * http +# * swift +# * rbd +# * sheepdog +# * cinder +# * vmware +# +# Related Options: +# * default_store +# +# (list value) +#stores = file,http + +# +# The default scheme to use for storing images. +# +# Provide a string value representing the default scheme to use for +# storing images. If not set, Glance uses ``file`` as the default +# scheme to store images with the ``file`` store. +# +# NOTE: The value given for this configuration option must be a valid +# scheme for a store registered with the ``stores`` configuration +# option. +# +# Possible values: +# * file +# * filesystem +# * http +# * https +# * swift +# * swift+http +# * swift+https +# * swift+config +# * rbd +# * sheepdog +# * cinder +# * vsphere +# +# Related Options: +# * stores +# +# (string value) +# Possible values: +# file - +# filesystem - +# http - +# https - +# swift - +# swift+http - +# swift+https - +# swift+config - +# rbd - +# sheepdog - +# cinder - +# vsphere - +#default_store = file + +# +# Minimum interval in seconds to execute updating dynamic storage +# capabilities based on current backend status. +# +# Provide an integer value representing time in seconds to set the +# minimum interval before an update of dynamic storage capabilities +# for a storage backend can be attempted. Setting +# ``store_capabilities_update_min_interval`` does not mean updates +# occur periodically based on the set interval. Rather, the update +# is performed at the elapse of this interval set, if an operation +# of the store is triggered. +# +# By default, this option is set to zero and is disabled. Provide an +# integer value greater than zero to enable this option. +# +# NOTE: For more information on store capabilities and their updates, +# please visit: https://specs.openstack.org/openstack/glance-specs/specs/kilo +# /store-capabilities.html +# +# For more information on setting up a particular store in your +# deployment and help with the usage of this feature, please contact +# the storage driver maintainers listed here: +# http://docs.openstack.org/developer/glance_store/drivers/index.html +# +# Possible values: +# * Zero +# * Positive integer +# +# Related Options: +# * None +# +# (integer value) +# Minimum value: 0 +#store_capabilities_update_min_interval = 0 + +# +# Information to match when looking for cinder in the service catalog. +# +# When the ``cinder_endpoint_template`` is not set and any of +# ``cinder_store_auth_address``, ``cinder_store_user_name``, +# ``cinder_store_project_name``, ``cinder_store_password`` is not set, +# cinder store uses this information to lookup cinder endpoint from the service +# catalog in the current context. ``cinder_os_region_name``, if set, is taken +# into consideration to fetch the appropriate endpoint. +# +# The service catalog can be listed by the ``openstack catalog list`` command. +# +# Possible values: +# * A string of of the following form: +# ``::`` +# At least ``service_type`` and ``interface`` should be specified. +# ``service_name`` can be omitted. +# +# Related options: +# * cinder_os_region_name +# * cinder_endpoint_template +# * cinder_store_auth_address +# * cinder_store_user_name +# * cinder_store_project_name +# * cinder_store_password +# +# (string value) +#cinder_catalog_info = volumev2::publicURL + +# +# Override service catalog lookup with template for cinder endpoint. +# +# When this option is set, this value is used to generate cinder endpoint, +# instead of looking up from the service catalog. +# This value is ignored if ``cinder_store_auth_address``, +# ``cinder_store_user_name``, ``cinder_store_project_name``, and +# ``cinder_store_password`` are specified. +# +# If this configuration option is set, ``cinder_catalog_info`` will be ignored. +# +# Possible values: +# * URL template string for cinder endpoint, where ``%%(tenant)s`` is +# replaced with the current tenant (project) name. +# For example: ``http://cinder.openstack.example.org/v2/%%(tenant)s`` +# +# Related options: +# * cinder_store_auth_address +# * cinder_store_user_name +# * cinder_store_project_name +# * cinder_store_password +# * cinder_catalog_info +# +# (string value) +#cinder_endpoint_template = + +# +# Region name to lookup cinder service from the service catalog. +# +# This is used only when ``cinder_catalog_info`` is used for determining the +# endpoint. If set, the lookup for cinder endpoint by this node is filtered to +# the specified region. It is useful when multiple regions are listed in the +# catalog. If this is not set, the endpoint is looked up from every region. +# +# Possible values: +# * A string that is a valid region name. +# +# Related options: +# * cinder_catalog_info +# +# (string value) +# Deprecated group/name - [glance_store]/os_region_name +#cinder_os_region_name = + +# +# Location of a CA certificates file used for cinder client requests. +# +# The specified CA certificates file, if set, is used to verify cinder +# connections via HTTPS endpoint. If the endpoint is HTTP, this value is +# ignored. +# ``cinder_api_insecure`` must be set to ``True`` to enable the verification. +# +# Possible values: +# * Path to a ca certificates file +# +# Related options: +# * cinder_api_insecure +# +# (string value) +#cinder_ca_certificates_file = + +# +# Number of cinderclient retries on failed http calls. +# +# When a call failed by any errors, cinderclient will retry the call up to the +# specified times after sleeping a few seconds. +# +# Possible values: +# * A positive integer +# +# Related options: +# * None +# +# (integer value) +# Minimum value: 0 +#cinder_http_retries = 3 + +# +# Time period, in seconds, to wait for a cinder volume transition to +# complete. +# +# When the cinder volume is created, deleted, or attached to the glance node to +# read/write the volume data, the volume's state is changed. For example, the +# newly created volume status changes from ``creating`` to ``available`` after +# the creation process is completed. This specifies the maximum time to wait for +# the status change. If a timeout occurs while waiting, or the status is changed +# to an unexpected value (e.g. `error``), the image creation fails. +# +# Possible values: +# * A positive integer +# +# Related options: +# * None +# +# (integer value) +# Minimum value: 0 +#cinder_state_transition_timeout = 300 + +# +# Allow to perform insecure SSL requests to cinder. +# +# If this option is set to True, HTTPS endpoint connection is verified using the +# CA certificates file specified by ``cinder_ca_certificates_file`` option. +# +# Possible values: +# * True +# * False +# +# Related options: +# * cinder_ca_certificates_file +# +# (boolean value) +#cinder_api_insecure = false + +# +# The address where the cinder authentication service is listening. +# +# When all of ``cinder_store_auth_address``, ``cinder_store_user_name``, +# ``cinder_store_project_name``, and ``cinder_store_password`` options are +# specified, the specified values are always used for the authentication. +# This is useful to hide the image volumes from users by storing them in a +# project/tenant specific to the image service. It also enables users to share +# the image volume among other projects under the control of glance's ACL. +# +# If either of these options are not set, the cinder endpoint is looked up +# from the service catalog, and current context's user and project are used. +# +# Possible values: +# * A valid authentication service address, for example: +# ``http://openstack.example.org/identity/v2.0`` +# +# Related options: +# * cinder_store_user_name +# * cinder_store_password +# * cinder_store_project_name +# +# (string value) +#cinder_store_auth_address = + +# +# User name to authenticate against cinder. +# +# This must be used with all the following related options. If any of these are +# not specified, the user of the current context is used. +# +# Possible values: +# * A valid user name +# +# Related options: +# * cinder_store_auth_address +# * cinder_store_password +# * cinder_store_project_name +# +# (string value) +#cinder_store_user_name = + +# +# Password for the user authenticating against cinder. +# +# This must be used with all the following related options. If any of these are +# not specified, the user of the current context is used. +# +# Possible values: +# * A valid password for the user specified by ``cinder_store_user_name`` +# +# Related options: +# * cinder_store_auth_address +# * cinder_store_user_name +# * cinder_store_project_name +# +# (string value) +#cinder_store_password = + +# +# Project name where the image volume is stored in cinder. +# +# If this configuration option is not set, the project in current context is +# used. +# +# This must be used with all the following related options. If any of these are +# not specified, the project of the current context is used. +# +# Possible values: +# * A valid project name +# +# Related options: +# * ``cinder_store_auth_address`` +# * ``cinder_store_user_name`` +# * ``cinder_store_password`` +# +# (string value) +#cinder_store_project_name = + +# +# Path to the rootwrap configuration file to use for running commands as root. +# +# The cinder store requires root privileges to operate the image volumes (for +# connecting to iSCSI/FC volumes and reading/writing the volume data, etc.). +# The configuration file should allow the required commands by cinder store and +# os-brick library. +# +# Possible values: +# * Path to the rootwrap config file +# +# Related options: +# * None +# +# (string value) +#rootwrap_config = /etc/glance/rootwrap.conf + +# +# Volume type that will be used for volume creation in cinder. +# +# Some cinder backends can have several volume types to optimize storage usage. +# Adding this option allows an operator to choose a specific volume type +# in cinder that can be optimized for images. +# +# If this is not set, then the default volume type specified in the cinder +# configuration will be used for volume creation. +# +# Possible values: +# * A valid volume type from cinder +# +# Related options: +# * None +# +# (string value) +#cinder_volume_type = + +# +# Directory to which the filesystem backend store writes images. +# +# Upon start up, Glance creates the directory if it doesn't already +# exist and verifies write access to the user under which +# ``glance-api`` runs. If the write access isn't available, a +# ``BadStoreConfiguration`` exception is raised and the filesystem +# store may not be available for adding new images. +# +# NOTE: This directory is used only when filesystem store is used as a +# storage backend. Either ``filesystem_store_datadir`` or +# ``filesystem_store_datadirs`` option must be specified in +# ``glance-api.conf``. If both options are specified, a +# ``BadStoreConfiguration`` will be raised and the filesystem store +# may not be available for adding new images. +# +# Possible values: +# * A valid path to a directory +# +# Related options: +# * ``filesystem_store_datadirs`` +# * ``filesystem_store_file_perm`` +# +# (string value) +#filesystem_store_datadir = /var/lib/glance/images + +# +# List of directories and their priorities to which the filesystem +# backend store writes images. +# +# The filesystem store can be configured to store images in multiple +# directories as opposed to using a single directory specified by the +# ``filesystem_store_datadir`` configuration option. When using +# multiple directories, each directory can be given an optional +# priority to specify the preference order in which they should +# be used. Priority is an integer that is concatenated to the +# directory path with a colon where a higher value indicates higher +# priority. When two directories have the same priority, the directory +# with most free space is used. When no priority is specified, it +# defaults to zero. +# +# More information on configuring filesystem store with multiple store +# directories can be found at +# http://docs.openstack.org/developer/glance/configuring.html +# +# NOTE: This directory is used only when filesystem store is used as a +# storage backend. Either ``filesystem_store_datadir`` or +# ``filesystem_store_datadirs`` option must be specified in +# ``glance-api.conf``. If both options are specified, a +# ``BadStoreConfiguration`` will be raised and the filesystem store +# may not be available for adding new images. +# +# Possible values: +# * List of strings of the following form: +# * ``:`` +# +# Related options: +# * ``filesystem_store_datadir`` +# * ``filesystem_store_file_perm`` +# +# (multi valued) +#filesystem_store_datadirs = + +# +# Filesystem store metadata file. +# +# The path to a file which contains the metadata to be returned with +# any location associated with the filesystem store. The file must +# contain a valid JSON object. The object should contain the keys +# ``id`` and ``mountpoint``. The value for both keys should be a +# string. +# +# Possible values: +# * A valid path to the store metadata file +# +# Related options: +# * None +# +# (string value) +#filesystem_store_metadata_file = + +# +# File access permissions for the image files. +# +# Set the intended file access permissions for image data. This provides +# a way to enable other services, e.g. Nova, to consume images directly +# from the filesystem store. The users running the services that are +# intended to be given access to could be made a member of the group +# that owns the files created. Assigning a value less then or equal to +# zero for this configuration option signifies that no changes be made +# to the default permissions. This value will be decoded as an octal +# digit. +# +# For more information, please refer the documentation at +# http://docs.openstack.org/developer/glance/configuring.html +# +# Possible values: +# * A valid file access permission +# * Zero +# * Any negative integer +# +# Related options: +# * None +# +# (integer value) +#filesystem_store_file_perm = 0 + +# +# Path to the CA bundle file. +# +# This configuration option enables the operator to use a custom +# Certificate Authority file to verify the remote server certificate. If +# this option is set, the ``https_insecure`` option will be ignored and +# the CA file specified will be used to authenticate the server +# certificate and establish a secure connection to the server. +# +# Possible values: +# * A valid path to a CA file +# +# Related options: +# * https_insecure +# +# (string value) +#https_ca_certificates_file = + +# +# Set verification of the remote server certificate. +# +# This configuration option takes in a boolean value to determine +# whether or not to verify the remote server certificate. If set to +# True, the remote server certificate is not verified. If the option is +# set to False, then the default CA truststore is used for verification. +# +# This option is ignored if ``https_ca_certificates_file`` is set. +# The remote server certificate will then be verified using the file +# specified using the ``https_ca_certificates_file`` option. +# +# Possible values: +# * True +# * False +# +# Related options: +# * https_ca_certificates_file +# +# (boolean value) +#https_insecure = true + +# +# The http/https proxy information to be used to connect to the remote +# server. +# +# This configuration option specifies the http/https proxy information +# that should be used to connect to the remote server. The proxy +# information should be a key value pair of the scheme and proxy, for +# example, http:10.0.0.1:3128. You can also specify proxies for multiple +# schemes by separating the key value pairs with a comma, for example, +# http:10.0.0.1:3128, https:10.0.0.1:1080. +# +# Possible values: +# * A comma separated list of scheme:proxy pairs as described above +# +# Related options: +# * None +# +# (dict value) +#http_proxy_information = + +# +# Size, in megabytes, to chunk RADOS images into. +# +# Provide an integer value representing the size in megabytes to chunk +# Glance images into. The default chunk size is 8 megabytes. For optimal +# performance, the value should be a power of two. +# +# When Ceph's RBD object storage system is used as the storage backend +# for storing Glance images, the images are chunked into objects of the +# size set using this option. These chunked objects are then stored +# across the distributed block data store to use for Glance. +# +# Possible Values: +# * Any positive integer value +# +# Related options: +# * None +# +# (integer value) +# Minimum value: 1 +#rbd_store_chunk_size = 8 + +# +# RADOS pool in which images are stored. +# +# When RBD is used as the storage backend for storing Glance images, the +# images are stored by means of logical grouping of the objects (chunks +# of images) into a ``pool``. Each pool is defined with the number of +# placement groups it can contain. The default pool that is used is +# 'images'. +# +# More information on the RBD storage backend can be found here: +# http://ceph.com/planet/how-data-is-stored-in-ceph-cluster/ +# +# Possible Values: +# * A valid pool name +# +# Related options: +# * None +# +# (string value) +#rbd_store_pool = images + +# +# RADOS user to authenticate as. +# +# This configuration option takes in the RADOS user to authenticate as. +# This is only needed when RADOS authentication is enabled and is +# applicable only if the user is using Cephx authentication. If the +# value for this option is not set by the user or is set to None, a +# default value will be chosen, which will be based on the client. +# section in rbd_store_ceph_conf. +# +# Possible Values: +# * A valid RADOS user +# +# Related options: +# * rbd_store_ceph_conf +# +# (string value) +#rbd_store_user = + +# +# Ceph configuration file path. +# +# This configuration option takes in the path to the Ceph configuration +# file to be used. If the value for this option is not set by the user +# or is set to None, librados will locate the default configuration file +# which is located at /etc/ceph/ceph.conf. If using Cephx +# authentication, this file should include a reference to the right +# keyring in a client. section +# +# Possible Values: +# * A valid path to a configuration file +# +# Related options: +# * rbd_store_user +# +# (string value) +#rbd_store_ceph_conf = /etc/ceph/ceph.conf + +# +# Timeout value for connecting to Ceph cluster. +# +# This configuration option takes in the timeout value in seconds used +# when connecting to the Ceph cluster i.e. it sets the time to wait for +# glance-api before closing the connection. This prevents glance-api +# hangups during the connection to RBD. If the value for this option +# is set to less than or equal to 0, no timeout is set and the default +# librados value is used. +# +# Possible Values: +# * Any integer value +# +# Related options: +# * None +# +# (integer value) +#rados_connect_timeout = 0 + +# +# Chunk size for images to be stored in Sheepdog data store. +# +# Provide an integer value representing the size in mebibyte +# (1048576 bytes) to chunk Glance images into. The default +# chunk size is 64 mebibytes. +# +# When using Sheepdog distributed storage system, the images are +# chunked into objects of this size and then stored across the +# distributed data store to use for Glance. +# +# Chunk sizes, if a power of two, help avoid fragmentation and +# enable improved performance. +# +# Possible values: +# * Positive integer value representing size in mebibytes. +# +# Related Options: +# * None +# +# (integer value) +# Minimum value: 1 +#sheepdog_store_chunk_size = 64 + +# +# Port number on which the sheep daemon will listen. +# +# Provide an integer value representing a valid port number on +# which you want the Sheepdog daemon to listen on. The default +# port is 7000. +# +# The Sheepdog daemon, also called 'sheep', manages the storage +# in the distributed cluster by writing objects across the storage +# network. It identifies and acts on the messages it receives on +# the port number set using ``sheepdog_store_port`` option to store +# chunks of Glance images. +# +# Possible values: +# * A valid port number (0 to 65535) +# +# Related Options: +# * sheepdog_store_address +# +# (port value) +# Minimum value: 0 +# Maximum value: 65535 +#sheepdog_store_port = 7000 + +# +# Address to bind the Sheepdog daemon to. +# +# Provide a string value representing the address to bind the +# Sheepdog daemon to. The default address set for the 'sheep' +# is 127.0.0.1. +# +# The Sheepdog daemon, also called 'sheep', manages the storage +# in the distributed cluster by writing objects across the storage +# network. It identifies and acts on the messages directed to the +# address set using ``sheepdog_store_address`` option to store +# chunks of Glance images. +# +# Possible values: +# * A valid IPv4 address +# * A valid IPv6 address +# * A valid hostname +# +# Related Options: +# * sheepdog_store_port +# +# (unknown value) +#sheepdog_store_address = 127.0.0.1 + +# +# Set verification of the server certificate. +# +# This boolean determines whether or not to verify the server +# certificate. If this option is set to True, swiftclient won't check +# for a valid SSL certificate when authenticating. If the option is set +# to False, then the default CA truststore is used for verification. +# +# Possible values: +# * True +# * False +# +# Related options: +# * swift_store_cacert +# +# (boolean value) +#swift_store_auth_insecure = false + +# +# Path to the CA bundle file. +# +# This configuration option enables the operator to specify the path to +# a custom Certificate Authority file for SSL verification when +# connecting to Swift. +# +# Possible values: +# * A valid path to a CA file +# +# Related options: +# * swift_store_auth_insecure +# +# (string value) +#swift_store_cacert = /etc/ssl/certs/ca-certificates.crt + +# +# The region of Swift endpoint to use by Glance. +# +# Provide a string value representing a Swift region where Glance +# can connect to for image storage. By default, there is no region +# set. +# +# When Glance uses Swift as the storage backend to store images +# for a specific tenant that has multiple endpoints, setting of a +# Swift region with ``swift_store_region`` allows Glance to connect +# to Swift in the specified region as opposed to a single region +# connectivity. +# +# This option can be configured for both single-tenant and +# multi-tenant storage. +# +# NOTE: Setting the region with ``swift_store_region`` is +# tenant-specific and is necessary ``only if`` the tenant has +# multiple endpoints across different regions. +# +# Possible values: +# * A string value representing a valid Swift region. +# +# Related Options: +# * None +# +# (string value) +#swift_store_region = RegionTwo + +# +# The URL endpoint to use for Swift backend storage. +# +# Provide a string value representing the URL endpoint to use for +# storing Glance images in Swift store. By default, an endpoint +# is not set and the storage URL returned by ``auth`` is used. +# Setting an endpoint with ``swift_store_endpoint`` overrides the +# storage URL and is used for Glance image storage. +# +# NOTE: The URL should include the path up to, but excluding the +# container. The location of an object is obtained by appending +# the container and object to the configured URL. +# +# Possible values: +# * String value representing a valid URL path up to a Swift container +# +# Related Options: +# * None +# +# (string value) +#swift_store_endpoint = https://swift.openstack.example.org/v1/path_not_including_container_name + +# +# Endpoint Type of Swift service. +# +# This string value indicates the endpoint type to use to fetch the +# Swift endpoint. The endpoint type determines the actions the user will +# be allowed to perform, for instance, reading and writing to the Store. +# This setting is only used if swift_store_auth_version is greater than +# 1. +# +# Possible values: +# * publicURL +# * adminURL +# * internalURL +# +# Related options: +# * swift_store_endpoint +# +# (string value) +# Possible values: +# publicURL - +# adminURL - +# internalURL - +#swift_store_endpoint_type = publicURL + +# +# Type of Swift service to use. +# +# Provide a string value representing the service type to use for +# storing images while using Swift backend storage. The default +# service type is set to ``object-store``. +# +# NOTE: If ``swift_store_auth_version`` is set to 2, the value for +# this configuration option needs to be ``object-store``. If using +# a higher version of Keystone or a different auth scheme, this +# option may be modified. +# +# Possible values: +# * A string representing a valid service type for Swift storage. +# +# Related Options: +# * None +# +# (string value) +#swift_store_service_type = object-store + +# +# Name of single container to store images/name prefix for multiple containers +# +# When a single container is being used to store images, this configuration +# option indicates the container within the Glance account to be used for +# storing all images. When multiple containers are used to store images, this +# will be the name prefix for all containers. Usage of single/multiple +# containers can be controlled using the configuration option +# ``swift_store_multiple_containers_seed``. +# +# When using multiple containers, the containers will be named after the value +# set for this configuration option with the first N chars of the image UUID +# as the suffix delimited by an underscore (where N is specified by +# ``swift_store_multiple_containers_seed``). +# +# Example: if the seed is set to 3 and swift_store_container = ``glance``, then +# an image with UUID ``fdae39a1-bac5-4238-aba4-69bcc726e848`` would be placed in +# the container ``glance_fda``. All dashes in the UUID are included when +# creating the container name but do not count toward the character limit, so +# when N=10 the container name would be ``glance_fdae39a1-ba.`` +# +# Possible values: +# * If using single container, this configuration option can be any string +# that is a valid swift container name in Glance's Swift account +# * If using multiple containers, this configuration option can be any +# string as long as it satisfies the container naming rules enforced by +# Swift. The value of ``swift_store_multiple_containers_seed`` should be +# taken into account as well. +# +# Related options: +# * ``swift_store_multiple_containers_seed`` +# * ``swift_store_multi_tenant`` +# * ``swift_store_create_container_on_put`` +# +# (string value) +#swift_store_container = glance + +# +# The size threshold, in MB, after which Glance will start segmenting image +# data. +# +# Swift has an upper limit on the size of a single uploaded object. By default, +# this is 5GB. To upload objects bigger than this limit, objects are segmented +# into multiple smaller objects that are tied together with a manifest file. +# For more detail, refer to +# http://docs.openstack.org/developer/swift/overview_large_objects.html +# +# This configuration option specifies the size threshold over which the Swift +# driver will start segmenting image data into multiple smaller files. +# Currently, the Swift driver only supports creating Dynamic Large Objects. +# +# NOTE: This should be set by taking into account the large object limit +# enforced by the Swift cluster in consideration. +# +# Possible values: +# * A positive integer that is less than or equal to the large object limit +# enforced by the Swift cluster in consideration. +# +# Related options: +# * ``swift_store_large_object_chunk_size`` +# +# (integer value) +# Minimum value: 1 +#swift_store_large_object_size = 5120 + +# +# The maximum size, in MB, of the segments when image data is segmented. +# +# When image data is segmented to upload images that are larger than the limit +# enforced by the Swift cluster, image data is broken into segments that are no +# bigger than the size specified by this configuration option. +# Refer to ``swift_store_large_object_size`` for more detail. +# +# For example: if ``swift_store_large_object_size`` is 5GB and +# ``swift_store_large_object_chunk_size`` is 1GB, an image of size 6.2GB will be +# segmented into 7 segments where the first six segments will be 1GB in size and +# the seventh segment will be 0.2GB. +# +# Possible values: +# * A positive integer that is less than or equal to the large object limit +# enforced by Swift cluster in consideration. +# +# Related options: +# * ``swift_store_large_object_size`` +# +# (integer value) +# Minimum value: 1 +#swift_store_large_object_chunk_size = 200 + +# +# Create container, if it doesn't already exist, when uploading image. +# +# At the time of uploading an image, if the corresponding container doesn't +# exist, it will be created provided this configuration option is set to True. +# By default, it won't be created. This behavior is applicable for both single +# and multiple containers mode. +# +# Possible values: +# * True +# * False +# +# Related options: +# * None +# +# (boolean value) +#swift_store_create_container_on_put = false + +# +# Store images in tenant's Swift account. +# +# This enables multi-tenant storage mode which causes Glance images to be stored +# in tenant specific Swift accounts. If this is disabled, Glance stores all +# images in its own account. More details multi-tenant store can be found at +# https://wiki.openstack.org/wiki/GlanceSwiftTenantSpecificStorage +# +# NOTE: If using multi-tenant swift store, please make sure +# that you do not set a swift configuration file with the +# 'swift_store_config_file' option. +# +# Possible values: +# * True +# * False +# +# Related options: +# * swift_store_config_file +# +# (boolean value) +#swift_store_multi_tenant = false + +# +# Seed indicating the number of containers to use for storing images. +# +# When using a single-tenant store, images can be stored in one or more than one +# containers. When set to 0, all images will be stored in one single container. +# When set to an integer value between 1 and 32, multiple containers will be +# used to store images. This configuration option will determine how many +# containers are created. The total number of containers that will be used is +# equal to 16^N, so if this config option is set to 2, then 16^2=256 containers +# will be used to store images. +# +# Please refer to ``swift_store_container`` for more detail on the naming +# convention. More detail about using multiple containers can be found at +# https://specs.openstack.org/openstack/glance-specs/specs/kilo/swift-store- +# multiple-containers.html +# +# NOTE: This is used only when swift_store_multi_tenant is disabled. +# +# Possible values: +# * A non-negative integer less than or equal to 32 +# +# Related options: +# * ``swift_store_container`` +# * ``swift_store_multi_tenant`` +# * ``swift_store_create_container_on_put`` +# +# (integer value) +# Minimum value: 0 +# Maximum value: 32 +#swift_store_multiple_containers_seed = 0 + +# +# List of tenants that will be granted admin access. +# +# This is a list of tenants that will be granted read/write access on +# all Swift containers created by Glance in multi-tenant mode. The +# default value is an empty list. +# +# Possible values: +# * A comma separated list of strings representing UUIDs of Keystone +# projects/tenants +# +# Related options: +# * None +# +# (list value) +#swift_store_admin_tenants = + +# +# SSL layer compression for HTTPS Swift requests. +# +# Provide a boolean value to determine whether or not to compress +# HTTPS Swift requests for images at the SSL layer. By default, +# compression is enabled. +# +# When using Swift as the backend store for Glance image storage, +# SSL layer compression of HTTPS Swift requests can be set using +# this option. If set to False, SSL layer compression of HTTPS +# Swift requests is disabled. Disabling this option may improve +# performance for images which are already in a compressed format, +# for example, qcow2. +# +# Possible values: +# * True +# * False +# +# Related Options: +# * None +# +# (boolean value) +#swift_store_ssl_compression = true + +# +# The number of times a Swift download will be retried before the +# request fails. +# +# Provide an integer value representing the number of times an image +# download must be retried before erroring out. The default value is +# zero (no retry on a failed image download). When set to a positive +# integer value, ``swift_store_retry_get_count`` ensures that the +# download is attempted this many more times upon a download failure +# before sending an error message. +# +# Possible values: +# * Zero +# * Positive integer value +# +# Related Options: +# * None +# +# (integer value) +# Minimum value: 0 +#swift_store_retry_get_count = 0 + +# +# Time in seconds defining the size of the window in which a new +# token may be requested before the current token is due to expire. +# +# Typically, the Swift storage driver fetches a new token upon the +# expiration of the current token to ensure continued access to +# Swift. However, some Swift transactions (like uploading image +# segments) may not recover well if the token expires on the fly. +# +# Hence, by fetching a new token before the current token expiration, +# we make sure that the token does not expire or is close to expiry +# before a transaction is attempted. By default, the Swift storage +# driver requests for a new token 60 seconds or less before the +# current token expiration. +# +# Possible values: +# * Zero +# * Positive integer value +# +# Related Options: +# * None +# +# (integer value) +# Minimum value: 0 +#swift_store_expire_soon_interval = 60 + +# +# Use trusts for multi-tenant Swift store. +# +# This option instructs the Swift store to create a trust for each +# add/get request when the multi-tenant store is in use. Using trusts +# allows the Swift store to avoid problems that can be caused by an +# authentication token expiring during the upload or download of data. +# +# By default, ``swift_store_use_trusts`` is set to ``True``(use of +# trusts is enabled). If set to ``False``, a user token is used for +# the Swift connection instead, eliminating the overhead of trust +# creation. +# +# NOTE: This option is considered only when +# ``swift_store_multi_tenant`` is set to ``True`` +# +# Possible values: +# * True +# * False +# +# Related options: +# * swift_store_multi_tenant +# +# (boolean value) +#swift_store_use_trusts = true + +# +# Buffer image segments before upload to Swift. +# +# Provide a boolean value to indicate whether or not Glance should +# buffer image data to disk while uploading to swift. This enables +# Glance to resume uploads on error. +# +# NOTES: +# When enabling this option, one should take great care as this +# increases disk usage on the API node. Be aware that depending +# upon how the file system is configured, the disk space used +# for buffering may decrease the actual disk space available for +# the glance image cache. Disk utilization will cap according to +# the following equation: +# (``swift_store_large_object_chunk_size`` * ``workers`` * 1000) +# +# Possible values: +# * True +# * False +# +# Related options: +# * swift_upload_buffer_dir +# +# (boolean value) +#swift_buffer_on_upload = false + +# +# Reference to default Swift account/backing store parameters. +# +# Provide a string value representing a reference to the default set +# of parameters required for using swift account/backing store for +# image storage. The default reference value for this configuration +# option is 'ref1'. This configuration option dereferences the +# parameters and facilitates image storage in Swift storage backend +# every time a new image is added. +# +# Possible values: +# * A valid string value +# +# Related options: +# * None +# +# (string value) +#default_swift_reference = ref1 + +# DEPRECATED: Version of the authentication service to use. Valid versions are 2 +# and 3 for keystone and 1 (deprecated) for swauth and rackspace. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: +# The option 'auth_version' in the Swift back-end configuration file is +# used instead. +#swift_store_auth_version = 2 + +# DEPRECATED: The address where the Swift authentication service is listening. +# (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: +# The option 'auth_address' in the Swift back-end configuration file is +# used instead. +#swift_store_auth_address = + +# DEPRECATED: The user to authenticate against the Swift authentication service. +# (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: +# The option 'user' in the Swift back-end configuration file is set instead. +#swift_store_user = + +# DEPRECATED: Auth key for the user authenticating against the Swift +# authentication service. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: +# The option 'key' in the Swift back-end configuration file is used +# to set the authentication key instead. +#swift_store_key = + +# +# Absolute path to the file containing the swift account(s) +# configurations. +# +# Include a string value representing the path to a configuration +# file that has references for each of the configured Swift +# account(s)/backing stores. By default, no file path is specified +# and customized Swift referencing is disabled. Configuring this +# option is highly recommended while using Swift storage backend for +# image storage as it avoids storage of credentials in the database. +# +# NOTE: Please do not configure this option if you have set +# ``swift_store_multi_tenant`` to ``True``. +# +# Possible values: +# * String value representing an absolute path on the glance-api +# node +# +# Related options: +# * swift_store_multi_tenant +# +# (string value) +#swift_store_config_file = + +# +# Directory to buffer image segments before upload to Swift. +# +# Provide a string value representing the absolute path to the +# directory on the glance node where image segments will be +# buffered briefly before they are uploaded to swift. +# +# NOTES: +# * This is required only when the configuration option +# ``swift_buffer_on_upload`` is set to True. +# * This directory should be provisioned keeping in mind the +# ``swift_store_large_object_chunk_size`` and the maximum +# number of images that could be uploaded simultaneously by +# a given glance node. +# +# Possible values: +# * String value representing an absolute directory path +# +# Related options: +# * swift_buffer_on_upload +# * swift_store_large_object_chunk_size +# +# (string value) +#swift_upload_buffer_dir = + +# +# Address of the ESX/ESXi or vCenter Server target system. +# +# This configuration option sets the address of the ESX/ESXi or vCenter +# Server target system. This option is required when using the VMware +# storage backend. The address can contain an IP address (127.0.0.1) or +# a DNS name (www.my-domain.com). +# +# Possible Values: +# * A valid IPv4 or IPv6 address +# * A valid DNS name +# +# Related options: +# * vmware_server_username +# * vmware_server_password +# +# (unknown value) +#vmware_server_host = 127.0.0.1 + +# +# Server username. +# +# This configuration option takes the username for authenticating with +# the VMware ESX/ESXi or vCenter Server. This option is required when +# using the VMware storage backend. +# +# Possible Values: +# * Any string that is the username for a user with appropriate +# privileges +# +# Related options: +# * vmware_server_host +# * vmware_server_password +# +# (string value) +#vmware_server_username = root + +# +# Server password. +# +# This configuration option takes the password for authenticating with +# the VMware ESX/ESXi or vCenter Server. This option is required when +# using the VMware storage backend. +# +# Possible Values: +# * Any string that is a password corresponding to the username +# specified using the "vmware_server_username" option +# +# Related options: +# * vmware_server_host +# * vmware_server_username +# +# (string value) +#vmware_server_password = vmware + +# +# The number of VMware API retries. +# +# This configuration option specifies the number of times the VMware +# ESX/VC server API must be retried upon connection related issues or +# server API call overload. It is not possible to specify 'retry +# forever'. +# +# Possible Values: +# * Any positive integer value +# +# Related options: +# * None +# +# (integer value) +# Minimum value: 1 +#vmware_api_retry_count = 10 + +# +# Interval in seconds used for polling remote tasks invoked on VMware +# ESX/VC server. +# +# This configuration option takes in the sleep time in seconds for polling an +# on-going async task as part of the VMWare ESX/VC server API call. +# +# Possible Values: +# * Any positive integer value +# +# Related options: +# * None +# +# (integer value) +# Minimum value: 1 +#vmware_task_poll_interval = 5 + +# +# The directory where the glance images will be stored in the datastore. +# +# This configuration option specifies the path to the directory where the +# glance images will be stored in the VMware datastore. If this option +# is not set, the default directory where the glance images are stored +# is openstack_glance. +# +# Possible Values: +# * Any string that is a valid path to a directory +# +# Related options: +# * None +# +# (string value) +#vmware_store_image_dir = /openstack_glance + +# +# Set verification of the ESX/vCenter server certificate. +# +# This configuration option takes a boolean value to determine +# whether or not to verify the ESX/vCenter server certificate. If this +# option is set to True, the ESX/vCenter server certificate is not +# verified. If this option is set to False, then the default CA +# truststore is used for verification. +# +# This option is ignored if the "vmware_ca_file" option is set. In that +# case, the ESX/vCenter server certificate will then be verified using +# the file specified using the "vmware_ca_file" option . +# +# Possible Values: +# * True +# * False +# +# Related options: +# * vmware_ca_file +# +# (boolean value) +# Deprecated group/name - [glance_store]/vmware_api_insecure +#vmware_insecure = false + +# +# Absolute path to the CA bundle file. +# +# This configuration option enables the operator to use a custom +# Cerificate Authority File to verify the ESX/vCenter certificate. +# +# If this option is set, the "vmware_insecure" option will be ignored +# and the CA file specified will be used to authenticate the ESX/vCenter +# server certificate and establish a secure connection to the server. +# +# Possible Values: +# * Any string that is a valid absolute path to a CA file +# +# Related options: +# * vmware_insecure +# +# (string value) +#vmware_ca_file = /etc/ssl/certs/ca-certificates.crt + +# +# The datastores where the image can be stored. +# +# This configuration option specifies the datastores where the image can +# be stored in the VMWare store backend. This option may be specified +# multiple times for specifying multiple datastores. The datastore name +# should be specified after its datacenter path, separated by ":". An +# optional weight may be given after the datastore name, separated again +# by ":" to specify the priority. Thus, the required format becomes +# ::. +# +# When adding an image, the datastore with highest weight will be +# selected, unless there is not enough free space available in cases +# where the image size is already known. If no weight is given, it is +# assumed to be zero and the directory will be considered for selection +# last. If multiple datastores have the same weight, then the one with +# the most free space available is selected. +# +# Possible Values: +# * Any string of the format: +# :: +# +# Related options: +# * None +# +# (multi valued) +#vmware_datastores = + + +[oslo_concurrency] + +# +# From oslo.concurrency +# + +# Enables or disables inter-process locks. (boolean value) +#disable_process_locking = false + +# Directory to use for lock files. For security, the specified directory should +# only be writable by the user running the processes that need locking. Defaults +# to environment variable OSLO_LOCK_PATH. If external locks are used, a lock +# path must be set. (string value) +#lock_path = + + +[oslo_policy] + +# +# From oslo.policy +# + +# This option controls whether or not to enforce scope when evaluating policies. +# If ``True``, the scope of the token used in the request is compared to the +# ``scope_types`` of the policy being enforced. If the scopes do not match, an +# ``InvalidScope`` exception will be raised. If ``False``, a message will be +# logged informing operators that policies are being invoked with mismatching +# scope. (boolean value) +#enforce_scope = false + +# The file that defines policies. (string value) +#policy_file = policy.json + +# Default rule. Enforced when a requested rule is not found. (string value) +#policy_default_rule = default + +# Directories where policy configuration files are stored. They can be relative +# to any directory in the search path defined by the config_dir option, or +# absolute paths. The file defined by policy_file must exist for these +# directories to be searched. Missing or empty directories are ignored. (multi +# valued) +#policy_dirs = policy.d + +# Content Type to send and receive data for REST based policy check (string +# value) +# Possible values: +# application/x-www-form-urlencoded - +# application/json - +#remote_content_type = application/x-www-form-urlencoded + +# server identity verification for REST based policy check (boolean value) +#remote_ssl_verify_server_crt = false + +# Absolute path to ca cert file for REST based policy check (string value) +#remote_ssl_ca_crt_file = + +# Absolute path to client cert for REST based policy check (string value) +#remote_ssl_client_crt_file = + +# Absolute path client key file REST based policy check (string value) +#remote_ssl_client_key_file = diff --git a/openstack/openstack_conf/controller/glance/metadefs/README b/openstack/openstack_conf/controller/glance/metadefs/README new file mode 100644 index 0000000..39d25b3 --- /dev/null +++ b/openstack/openstack_conf/controller/glance/metadefs/README @@ -0,0 +1,4 @@ +This directory contains predefined namespaces for Glance Metadata Definitions +Catalog. Files from this directory can be loaded into the database using +db_load_metadefs command for glance-manage. Similarly you can unload the +definitions using db_unload_metadefs command. diff --git a/openstack/openstack_conf/controller/glance/metadefs/cim-processor-allocation-setting-data.json b/openstack/openstack_conf/controller/glance/metadefs/cim-processor-allocation-setting-data.json new file mode 100644 index 0000000..26f7e0d --- /dev/null +++ b/openstack/openstack_conf/controller/glance/metadefs/cim-processor-allocation-setting-data.json @@ -0,0 +1,154 @@ +{ + "namespace": "CIM::ProcessorAllocationSettingData", + "display_name": "CIM Processor Allocation Setting", + "description": "Properties related to the resource allocation settings of a processor (CPU) from Common Information Model (CIM) schema (http://www.dmtf.org/standards/cim). These are properties that identify processor setting data and may be specified to volume, image, host aggregate, flavor and Nova server as scheduler hint. For each property details, please refer to http://schemas.dmtf.org/wbem/cim-html/2/CIM_ProcessorAllocationSettingData.html.", + "visibility": "public", + "protected": true, + "resource_type_associations": [ + { + "name": "OS::Cinder::Volume", + "prefix": "CIM_PASD_", + "properties_target": "image" + }, + { + "name": "OS::Glance::Image", + "prefix": "CIM_PASD_" + }, + { + "name": "OS::Nova::Aggregate", + "prefix": "CIM_PASD_" + }, + { + "name": "OS::Nova::Flavor", + "prefix": "CIM_PASD_" + }, + { + "name": "OS::Nova::Server", + "properties_target": "scheduler_hint" + } + ], + "properties": { + "InstructionSet": { + "title": "Instruction Set", + "description": "Identifies the instruction set of the processor within a processor architecture.", + "operators": [""], + "type": "string", + "enum": [ + "x86:i386", + "x86:i486", + "x86:i586", + "x86:i686", + "x86:64", + "IA-64:IA-64", + "AS/400:TIMI", + "Power:Power_2.03", + "Power:Power_2.04", + "Power:Power_2.05", + "Power:Power_2.06", + "S/390:ESA/390", + "S/390:z/Architecture", + "S/390:z/Architecture_2", + "PA-RISC:PA-RISC_1.0", + "PA-RISC:PA-RISC_2.0", + "ARM:A32", + "ARM:A64", + "MIPS:MIPS_I", + "MIPS:MIPS_II", + "MIPS:MIPS_III", + "MIPS:MIPS_IV", + "MIPS:MIPS_V", + "MIPS:MIPS32", + "MIPS64:MIPS64", + "Alpha:Alpha", + "SPARC:SPARC_V7", + "SPARC:SPARC_V8", + "SPARC:SPARC_V9", + "SPARC:SPARC_JPS1", + "SPARC:UltraSPARC2005", + "SPARC:UltraSPARC2007", + "68k:68000", + "68k:68010", + "68k:68020", + "68k:68030", + "68k:68040", + "68k:68060" + ] + }, + "ProcessorArchitecture": { + "title": "Processor Architecture", + "description": "Identifies the processor architecture of the processor.", + "operators": [""], + "type": "string", + "enum": [ + "x86", + "IA-64", + "AS/400", + "Power", + "S/390", + "PA-RISC", + "ARM", + "MIPS", + "Alpha", + "SPARC", + "68k" + ] + }, + "InstructionSetExtensionName": { + "title": "Instruction Set Extension", + "description": "Identifies the instruction set extensions of the processor within a processor architecture.", + "operators": ["", ""], + "type": "array", + "items": { + "type": "string", + "enum": [ + "x86:3DNow", + "x86:3DNowExt", + "x86:ABM", + "x86:AES", + "x86:AVX", + "x86:AVX2", + "x86:BMI", + "x86:CX16", + "x86:F16C", + "x86:FSGSBASE", + "x86:LWP", + "x86:MMX", + "x86:PCLMUL", + "x86:RDRND", + "x86:SSE2", + "x86:SSE3", + "x86:SSSE3", + "x86:SSE4A", + "x86:SSE41", + "x86:SSE42", + "x86:FMA3", + "x86:FMA4", + "x86:XOP", + "x86:TBM", + "x86:VT-d", + "x86:VT-x", + "x86:EPT", + "x86:SVM", + "PA-RISC:MAX", + "PA-RISC:MAX2", + "ARM:DSP", + "ARM:Jazelle-DBX", + "ARM:Thumb", + "ARM:Thumb-2", + "ARM:ThumbEE)", + "ARM:VFP", + "ARM:NEON", + "ARM:TrustZone", + "MIPS:MDMX", + "MIPS:MIPS-3D", + "Alpha:BWX", + "Alpha:FIX", + "Alpha:CIX", + "Alpha:MVI" + ] + } + } + }, + "objects": [] +} + diff --git a/openstack/openstack_conf/controller/glance/metadefs/cim-resource-allocation-setting-data.json b/openstack/openstack_conf/controller/glance/metadefs/cim-resource-allocation-setting-data.json new file mode 100644 index 0000000..af800ea --- /dev/null +++ b/openstack/openstack_conf/controller/glance/metadefs/cim-resource-allocation-setting-data.json @@ -0,0 +1,178 @@ +{ + "namespace": "CIM::ResourceAllocationSettingData", + "display_name": "CIM Resource Allocation Setting Data", + "description": "Properties from Common Information Model (CIM) schema (http://www.dmtf.org/standards/cim) that represent settings specifically related to an allocated resource that are outside the scope of the CIM class typically used to represent the resource itself. These properties may be specified to volume, host aggregate and flavor. For each property details, please refer to http://schemas.dmtf.org/wbem/cim-html/2/CIM_ResourceAllocationSettingData.html.", + "visibility": "public", + "protected": true, + "resource_type_associations": [ + { + "name": "OS::Cinder::Volume", + "prefix": "CIM_RASD_", + "properties_target": "image" + }, + { + "name": "OS::Nova::Aggregate", + "prefix": "CIM_RASD_" + }, + { + "name": "OS::Nova::Flavor", + "prefix": "CIM_RASD_" + } + ], + "properties": { + "Address": { + "title": "Address", + "description": "The address of the resource.", + "type": "string" + }, + "AddressOnParent": { + "title": "Address On Parent", + "description": "Describes the address of this resource in the context of the Parent.", + "type": "string" + }, + "AllocationUnits": { + "title": "Allocation Units", + "description": "This property specifies the units of allocation used by the Reservation and Limit properties.", + "type": "string" + }, + "AutomaticAllocation": { + "title": "Automatic Allocation", + "description": "This property specifies if the resource will be automatically allocated.", + "type": "boolean" + }, + "AutomaticDeallocation": { + "title": "Automatic Deallocation", + "description": "This property specifies if the resource will be automatically de-allocated.", + "type": "boolean" + }, + "ConsumerVisibility": { + "title": "Consumer Visibility", + "description": "Describes the consumers visibility to the allocated resource.", + "operators": [""], + "type": "string", + "enum": [ + "Unknown", + "Passed-Through", + "Virtualized", + "Not represented", + "DMTF reserved", + "Vendor Reserved" + ] + }, + "Limit": { + "title": "Limit", + "description": "This property specifies the upper bound, or maximum amount of resource that will be granted for this allocation.", + "type": "string" + }, + "MappingBehavior": { + "title": "Mapping Behavior", + "description": "Specifies how this resource maps to underlying resources. If the HostResource array contains any entries, this property reflects how the resource maps to those specific resources.", + "operators": [""], + "type": "string", + "enum": [ + "Unknown", + "Not Supported", + "Dedicated", + "Soft Affinity", + "Hard Affinity", + "DMTF Reserved", + "Vendor Reserved" + ] + }, + "OtherResourceType": { + "title": "Other Resource Type", + "description": "A string that describes the resource type when a well defined value is not available and ResourceType has the value 'Other'.", + "type": "string" + }, + "Parent": { + "title": "Parent", + "description": "The Parent of the resource.", + "type": "string" + }, + "PoolID": { + "title": "Pool ID", + "description": "This property specifies which ResourcePool the resource is currently allocated from, or which ResourcePool the resource will be allocated from when the allocation occurs.", + "type": "string" + }, + "Reservation": { + "title": "Reservation", + "description": "This property specifies the amount of resource guaranteed to be available for this allocation.", + "type": "string" + }, + "ResourceSubType": { + "title": "Resource Sub Type", + "description": "A string describing an implementation specific sub-type for this resource.", + "type": "string" + }, + "ResourceType": { + "title": "Resource Type", + "description": "The type of resource this allocation setting represents.", + "operators": [""], + "type": "string", + "enum": [ + "Other", + "Computer System", + "Processor", + "Memory", + "IDE Controller", + "Parallel SCSI HBA", + "FC HBA", + "iSCSI HBA", + "IB HCA", + "Ethernet Adapter", + "Other Network Adapter", + "I/O Slot", + "I/O Device", + "Floppy Drive", + "CD Drive", + "DVD drive", + "Disk Drive", + "Tape Drive", + "Storage Extent", + "Other storage device", + "Serial port", + "Parallel port", + "USB Controller", + "Graphics controller", + "IEEE 1394 Controller", + "Partitionable Unit", + "Base Partitionable Unit", + "Power", + "Cooling Capacity", + "Ethernet Switch Port", + "Logical Disk", + "Storage Volume", + "Ethernet Connection", + "DMTF reserved", + "Vendor Reserved" + ] + }, + "VirtualQuantity": { + "title": "Virtual Quantity", + "description": "This property specifies the quantity of resources presented to the consumer.", + "type": "string" + }, + "VirtualQuantityUnits": { + "title": "Virtual Quantity Units", + "description": "This property specifies the units used by the VirtualQuantity property.", + "type": "string" + }, + "Weight": { + "title": "Weight", + "description": "This property specifies a relative priority for this allocation in relation to other allocations from the same ResourcePool.", + "type": "string" + }, + "Connection": { + "title": "Connection", + "description": "The thing to which this resource is connected.", + "type": "string" + }, + "HostResource": { + "title": "Host Resource", + "description": "This property exposes specific assignment of resources.", + "type": "string" + } + }, + "objects": [] +} + diff --git a/openstack/openstack_conf/controller/glance/metadefs/cim-storage-allocation-setting-data.json b/openstack/openstack_conf/controller/glance/metadefs/cim-storage-allocation-setting-data.json new file mode 100644 index 0000000..3c9e68e --- /dev/null +++ b/openstack/openstack_conf/controller/glance/metadefs/cim-storage-allocation-setting-data.json @@ -0,0 +1,122 @@ +{ + "namespace": "CIM::StorageAllocationSettingData", + "display_name": "CIM Storage Allocation Setting Data", + "description": "Properties related to the allocation of virtual storage from Common Information Model (CIM) schema (http://www.dmtf.org/standards/cim). These properties may be specified to volume, host aggregate and flavor. For each property details, please refer to http://schemas.dmtf.org/wbem/cim-html/2/CIM_StorageAllocationSettingData.html.", + "visibility": "public", + "protected": true, + "resource_type_associations": [ + { + "name": "OS::Cinder::Volume", + "prefix": "CIM_SASD_" + }, + { + "name": "OS::Nova::Aggregate", + "prefix": "CIM_SASD_" + }, + { + "name": "OS::Nova::Flavor", + "prefix": "CIM_SASD_" + } + ], + "properties": { + "Access": { + "title": "Access", + "description": "Access describes whether the allocated storage extent is 1 (readable), 2 (writeable), or 3 (both).", + "operators": [""], + "type": "string", + "enum": [ + "Unknown", + "Readable", + "Writeable", + "Read/Write Supported", + "DMTF Reserved" + ] + }, + "HostExtentName": { + "title": "Host Extent Name", + "description": "A unique identifier for the host extent.", + "type": "string" + }, + "HostExtentNameFormat": { + "title": "Host Extent Name Format", + "description": "The HostExtentNameFormat property identifies the format that is used for the value of the HostExtentName property.", + "operators": [""], + "type": "string", + "enum": [ + "Unknown", + "Other", + "SNVM", + "NAA", + "EUI64", + "T10VID", + "OS Device Name", + "DMTF Reserved" + ] + }, + "HostExtentNameNamespace": { + "title": "Host Extent Name Namespace", + "description": "If the host extent is a SCSI volume, then the preferred source for SCSI volume names is SCSI VPD Page 83 responses.", + "operators": [""], + "type": "string", + "enum": [ + "Unknown", + "Other", + "VPD83Type3", + "VPD83Type2", + "VPD83Type1", + "VPD80", + "NodeWWN", + "SNVM", + "OS Device Namespace", + "DMTF Reserved" + ] + }, + "HostExtentStartingAddress": { + "title": "Host Extent Starting Address", + "description": "The HostExtentStartingAddress property identifies the starting address on the host storage extent identified by the value of the HostExtentName property that is used for the allocation of the virtual storage extent.", + "type": "string" + }, + "HostResourceBlockSize": { + "title": "Host Resource Block Size", + "description": "Size in bytes of the blocks that are allocated at the host as the result of this storage resource allocation or storage resource allocation request.", + "type": "string" + }, + "Limit": { + "title": "Limit", + "description": "The maximum amount of blocks that will be granted for this storage resource allocation at the host.", + "type": "string" + }, + "OtherHostExtentNameFormat": { + "title": "Other Host Extent Name Format", + "description": "A string describing the format of the HostExtentName property if the value of the HostExtentNameFormat property is 1 (Other).", + "type": "string" + }, + "OtherHostExtentNameNamespace": { + "title": "Other Host Extent Name Namespace", + "description": "A string describing the namespace of the HostExtentName property if the value of the HostExtentNameNamespace matches 1 (Other).", + "type": "string" + }, + "Reservation": { + "title": "Reservation", + "description": "The amount of blocks that are guaranteed to be available for this storage resource allocation at the host.", + "type": "string" + }, + "VirtualQuantity": { + "title": "Virtual Quantity", + "description": "Number of blocks that are presented to the consumer.", + "type": "string" + }, + "VirtualQuantityUnits": { + "title": "Virtual Quantity Units", + "description": "This property specifies the units used by the VirtualQuantity property.", + "type": "string" + }, + "VirtualResourceBlockSize": { + "title": "Virtual Resource Block Size", + "description": "Size in bytes of the blocks that are presented to the consumer as the result of this storage resource allocation or storage resource allocation request.", + "type": "string" + } + }, + "objects": [] +} + diff --git a/openstack/openstack_conf/controller/glance/metadefs/cim-virtual-system-setting-data.json b/openstack/openstack_conf/controller/glance/metadefs/cim-virtual-system-setting-data.json new file mode 100644 index 0000000..bf04e2e --- /dev/null +++ b/openstack/openstack_conf/controller/glance/metadefs/cim-virtual-system-setting-data.json @@ -0,0 +1,127 @@ +{ + "namespace": "CIM::VirtualSystemSettingData", + "display_name": "CIM Virtual System Setting Data", + "description": "A set of virtualization specific properties from Common Information Model (CIM) schema (http://www.dmtf.org/standards/cim), which define the virtual aspects of a virtual system. These properties may be specified to host aggregate and flavor. For each property details, please refer to http://schemas.dmtf.org/wbem/cim-html/2/CIM_VirtualSystemSettingData.html.", + "visibility": "public", + "protected": true, + "resource_type_associations": [ + { + "name": "OS::Nova::Aggregate", + "prefix": "CIM_VSSD_" + }, + { + "name": "OS::Nova::Flavor", + "prefix": "CIM_VSSD_" + } + ], + "properties": { + "AutomaticRecoveryAction": { + "title": "Automatic Recovery Action", + "description": "Action to take for the virtual system when the software executed by the virtual system fails.", + "operators": [""], + "type": "string", + "enum": [ + "None", + "Restart", + "Revert to snapshot", + "DMTF Reserved" + ] + }, + "AutomaticShutdownAction": { + "title": "Automatic Shutdown Action", + "description": "Action to take for the virtual system when the host is shut down.", + "operators": [""], + "type": "string", + "enum": [ + "Turn Off", + "Save state", + "Shutdown", + "DMTF Reserved" + ] + }, + "AutomaticStartupAction": { + "title": "Automatic Startup Action", + "description": "Action to take for the virtual system when the host is started.", + "operators": [""], + "type": "string", + "enum": [ + "None", + "Restart if previously active", + "Always startup", + "DMTF Reserved" + ] + }, + "AutomaticStartupActionDelay": { + "title": "Automatic Startup Action Delay", + "description": "Delay applicable to startup action.", + "type": "string" + }, + "AutomaticStartupActionSequenceNumber": { + "title": "Automatic Startup Action Sequence Number", + "description": "Number indicating the relative sequence of virtual system activation when the host system is started.", + "type": "string" + }, + "ConfigurationDataRoot": { + "title": "Configuration Data Root", + "description": "Filepath of a directory where information about the virtual system configuration is stored.", + "type": "string" + }, + "ConfigurationFile": { + "title": "Configuration File", + "description": "Filepath of a file where information about the virtual system configuration is stored.", + "type": "string" + }, + "ConfigurationID": { + "title": "Configuration ID", + "description": "Unique id of the virtual system configuration.", + "type": "string" + }, + "CreationTime": { + "title": "Creation Time", + "description": "Time when the virtual system configuration was created.", + "type": "string" + }, + "LogDataRoot": { + "title": "Log Data Root", + "description": "Filepath of a directory where log information about the virtual system is stored.", + "type": "string" + }, + "RecoveryFile": { + "title": "Recovery File", + "description": "Filepath of a file where recovery relateded information of the virtual system is stored.", + "type": "string" + }, + "SnapshotDataRoot": { + "title": "Snapshot Data Root", + "description": "Filepath of a directory where information about virtual system snapshots is stored.", + "type": "string" + }, + "SuspendDataRoot": { + "title": "Suspend Data Root", + "description": "Filepath of a directory where suspend related information about the virtual system is stored.", + "type": "string" + }, + "SwapFileDataRoot": { + "title": "Swap File Data Root", + "description": "Filepath of a directory where swapfiles of the virtual system are stored.", + "type": "string" + }, + "VirtualSystemIdentifier": { + "title": "Virtual System Identifier", + "description": "VirtualSystemIdentifier shall reflect a unique name for the system as it is used within the virtualization platform.", + "type": "string" + }, + "VirtualSystemType": { + "title": "Virtual System Type", + "description": "VirtualSystemType shall reflect a particular type of virtual system.", + "type": "string" + }, + "Notes": { + "title": "Notes", + "description": "End-user supplied notes that are related to the virtual system.", + "type": "string" + } + }, + "objects": [] +} + diff --git a/openstack/openstack_conf/controller/glance/metadefs/compute-aggr-disk-filter.json b/openstack/openstack_conf/controller/glance/metadefs/compute-aggr-disk-filter.json new file mode 100644 index 0000000..3a1037c --- /dev/null +++ b/openstack/openstack_conf/controller/glance/metadefs/compute-aggr-disk-filter.json @@ -0,0 +1,21 @@ +{ + "namespace": "OS::Compute::AggregateDiskFilter", + "display_name": "Disk Allocation per Host", + "description": "Properties related to the Nova scheduler filter AggregateDiskFilter. Filters aggregate hosts based on the available disk space compared to the requested disk space. Hosts in the aggregate with not enough usable disk will be filtered out. The filter must be enabled in the Nova scheduler to use these properties.", + "visibility": "public", + "protected": true, + "resource_type_associations": [ + { + "name": "OS::Nova::Aggregate" + } + ], + "properties": { + "disk_allocation_ratio": { + "title": "Disk Subscription Ratio", + "description": "Allows the host to be under and over subscribed for the amount of disk space requested for an instance. A ratio greater than 1.0 allows for over subscription (hosts may have less usable disk space than requested). A ratio less than 1.0 allows for under subscription.", + "type": "number", + "readonly": false + } + }, + "objects": [] +} diff --git a/openstack/openstack_conf/controller/glance/metadefs/compute-aggr-iops-filter.json b/openstack/openstack_conf/controller/glance/metadefs/compute-aggr-iops-filter.json new file mode 100644 index 0000000..3104783 --- /dev/null +++ b/openstack/openstack_conf/controller/glance/metadefs/compute-aggr-iops-filter.json @@ -0,0 +1,23 @@ +{ + "namespace": "OS::Compute::AggregateIoOpsFilter", + "display_name": "IO Ops per Host", + "description": "Properties related to the Nova scheduler filter AggregateIoOpsFilter. Filters aggregate hosts based on the number of instances currently changing state. Hosts in the aggregate with too many instances changing state will be filtered out. The filter must be enabled in the Nova scheduler to use these properties.", + "visibility": "public", + "protected": true, + "resource_type_associations": [ + { + "name": "OS::Nova::Aggregate" + } + ], + "properties": { + "max_io_ops_per_host": { + "title": "Maximum IO Operations per Host", + "description": "Prevents hosts in the aggregate that have this many or more instances currently in build, resize, snapshot, migrate, rescue or unshelve to be scheduled for new instances.", + "type": "integer", + "readonly": false, + "default": 8, + "minimum": 1 + } + }, + "objects": [] +} diff --git a/openstack/openstack_conf/controller/glance/metadefs/compute-aggr-num-instances.json b/openstack/openstack_conf/controller/glance/metadefs/compute-aggr-num-instances.json new file mode 100644 index 0000000..3c9f678 --- /dev/null +++ b/openstack/openstack_conf/controller/glance/metadefs/compute-aggr-num-instances.json @@ -0,0 +1,21 @@ +{ + "namespace": "OS::Compute::AggregateNumInstancesFilter", + "display_name": "Instances per Host", + "description": "Properties related to the Nova scheduler filter AggregateNumInstancesFilter. Filters aggregate hosts by the number of running instances on it. Hosts in the aggregate with too many instances will be filtered out. The filter must be enabled in the Nova scheduler to use these properties.", "visibility": "public", + "protected": false, + "resource_type_associations": [ + { + "name": "OS::Nova::Aggregate" + } + ], + "properties": { + "max_instances_per_host": { + "title": "Max Instances Per Host", + "description": "Maximum number of instances allowed to run on a host in the aggregate.", + "type": "integer", + "readonly": false, + "minimum": 0 + } + }, + "objects": [] +} diff --git a/openstack/openstack_conf/controller/glance/metadefs/compute-cpu-pinning.json b/openstack/openstack_conf/controller/glance/metadefs/compute-cpu-pinning.json new file mode 100644 index 0000000..66ff825 --- /dev/null +++ b/openstack/openstack_conf/controller/glance/metadefs/compute-cpu-pinning.json @@ -0,0 +1,43 @@ +{ + "namespace": "OS::Compute::CPUPinning", + "display_name": "CPU Pinning", + "description": "This provides the preferred CPU pinning and CPU thread pinning policy to be used when pinning vCPU of the guest to pCPU of the host. See http://docs.openstack.org/admin-guide/compute-numa-cpu-pinning.html", + "visibility": "public", + "protected": true, + "resource_type_associations": [ + { + "name": "OS::Glance::Image", + "prefix": "hw_" + }, + { + "name": "OS::Cinder::Volume", + "prefix": "hw_", + "properties_target": "image" + }, + { + "name": "OS::Nova::Flavor", + "prefix": "hw:" + } + ], + "properties": { + "cpu_policy": { + "title": "CPU Pinning policy", + "description": "Type of CPU pinning policy.", + "type": "string", + "enum": [ + "shared", + "dedicated" + ] + }, + "cpu_thread_policy": { + "title": "CPU Thread Pinning Policy.", + "description": "Type of CPU thread pinning policy.", + "type": "string", + "enum": [ + "isolate", + "prefer", + "require" + ] + } + } +} diff --git a/openstack/openstack_conf/controller/glance/metadefs/compute-guest-memory-backing.json b/openstack/openstack_conf/controller/glance/metadefs/compute-guest-memory-backing.json new file mode 100644 index 0000000..f0e4e68 --- /dev/null +++ b/openstack/openstack_conf/controller/glance/metadefs/compute-guest-memory-backing.json @@ -0,0 +1,29 @@ +{ + "namespace": "OS::Compute::GuestMemoryBacking", + "display_name": "Guest Memory Backing", + "description": "This provides the preferred backing option for guest RAM. Guest's memory can be backed by hugepages to limit TLB lookups. See also: https://wiki.openstack.org/wiki/VirtDriverGuestCPUMemoryPlacement", + "visibility": "public", + "protected": true, + "resource_type_associations": [ + { + "name": "OS::Nova::Flavor", + "prefix": "hw:" + }, + { + "name": "OS::Glance::Image", + "prefix": "hw_" + }, + { + "name": "OS::Cinder::Volume", + "prefix": "hw_", + "properties_target": "image" + } + ], + "properties": { + "mem_page_size": { + "title": "Size of memory page", + "description": "Page size to be used for Guest memory backing. Value can be specified as (i.e.: 2MB, 1GB) or 'any', 'small', 'large'. If this property is set in Image metadata then only 'any' and 'large' values are accepted in Flavor metadata by Nova API.", + "type": "string" + } + } +} \ No newline at end of file diff --git a/openstack/openstack_conf/controller/glance/metadefs/compute-guest-shutdown.json b/openstack/openstack_conf/controller/glance/metadefs/compute-guest-shutdown.json new file mode 100644 index 0000000..354ee63 --- /dev/null +++ b/openstack/openstack_conf/controller/glance/metadefs/compute-guest-shutdown.json @@ -0,0 +1,21 @@ +{ + "namespace": "OS::Compute::GuestShutdownBehavior", + "display_name": "Shutdown Behavior", + "description": "These properties allow modifying the shutdown behavior for stop, rescue, resize, and shelve operations.", + "visibility": "public", + "protected": true, + "resource_type_associations": [ + { + "name": "OS::Glance::Image" + } + ], + "properties": { + "os_shutdown_timeout": { + "title": "Shutdown timeout", + "description": "By default, guests will be given 60 seconds to perform a graceful shutdown. After that, the VM is powered off. This property allows overriding the amount of time (unit: seconds) to allow a guest OS to cleanly shut down before power off. A value of 0 (zero) means the guest will be powered off immediately with no opportunity for guest OS clean-up.", + "type": "integer", + "minimum": 0 + } + }, + "objects": [] +} diff --git a/openstack/openstack_conf/controller/glance/metadefs/compute-host-capabilities.json b/openstack/openstack_conf/controller/glance/metadefs/compute-host-capabilities.json new file mode 100644 index 0000000..6e7b768 --- /dev/null +++ b/openstack/openstack_conf/controller/glance/metadefs/compute-host-capabilities.json @@ -0,0 +1,293 @@ +{ + "namespace": "OS::Compute::HostCapabilities", + "display_name": "Compute Host Capabilities", + "description": "Hardware capabilities provided by the compute host. This provides the ability to fine tune the hardware specification required when an instance is requested. The ComputeCapabilitiesFilter should be enabled in the Nova scheduler to use these properties. When enabled, this filter checks that the capabilities provided by the compute host satisfy any extra specifications requested. Only hosts that can provide the requested capabilities will be eligible for hosting the instance.", + "visibility": "public", + "protected": true, + "resource_type_associations": [ + { + "name": "OS::Nova::Flavor", + "prefix": "capabilities:" + }, + { + "name": "OS::Nova::Aggregate", + "prefix": "aggregate_instance_extra_specs:" + } + ], + "properties": { + "cpu_info:vendor": { + "title": "Vendor", + "description": "Specifies the CPU manufacturer.", + "operators": [""], + "type": "string", + "enum": [ + "Intel", + "AMD" + ] + }, + "cpu_info:model": { + "title": "Model", + "description": "Specifies the CPU model. Use this property to ensure that your vm runs on a a specific cpu model.", + "operators": [""], + "type": "string", + "enum": [ + "Conroe", + "Core2Duo", + "Penryn", + "Nehalem", + "Westmere", + "SandyBridge", + "IvyBridge", + "Haswell", + "Broadwell", + "Delhi", + "Seoul", + "Abu Dhabi", + "Interlagos", + "Kabini", + "Valencia", + "Zurich", + "Budapest", + "Barcelona", + "Suzuka", + "Shanghai", + "Istanbul", + "Lisbon", + "Magny-Cours", + "Valencia", + "Cortex-A57", + "Cortex-A53", + "Cortex-A12", + "Cortex-A17", + "Cortex-A15", + "Coretx-A7", + "X-Gene" + ] + }, + "cpu_info:arch": { + "title": "Architecture", + "description": "Specifies the CPU architecture. Use this property to specify the architecture supported by the hypervisor.", + "operators": [""], + "type": "string", + "enum": [ + "x86", + "x86_64", + "i686", + "ia64", + "ARMv8-A", + "ARMv7-A" + ] + }, + "cpu_info:topology:cores": { + "title": "cores", + "description": "Number of cores.", + "type": "integer", + "readonly": false, + "default": 1 + }, + "cpu_info:topology:threads": { + "title": "threads", + "description": "Number of threads.", + "type": "integer", + "readonly": false, + "default": 1 + }, + "cpu_info:topology:sockets": { + "title": "sockets", + "description": "Number of sockets.", + "type": "integer", + "readonly": false, + "default": 1 + }, + "cpu_info:features": { + "title": "Features", + "description": "Specifies CPU flags/features. Using this property you can specify the required set of instructions supported by a vm.", + "operators": ["", ""], + "type": "array", + "items": { + "type": "string", + "enum": [ + "fpu", + "vme", + "de", + "pse", + "tsc", + "msr", + "pae", + "mce", + "cx8", + "apic", + "sep", + "mtrr", + "pge", + "mca", + "cmov", + "pat", + "pse36", + "pn", + "clflush", + "dts", + "acpi", + "mmx", + "fxsr", + "sse", + "sse2", + "ss", + "ht", + "tm", + "ia64", + "pbe", + "syscall", + "mp", + "nx", + "mmxext", + "fxsr_opt", + "pdpe1gb", + "rdtscp", + "lm", + "3dnowext", + "3dnow", + "arch_perfmon", + "pebs", + "bts", + "rep_good", + "nopl", + "xtopology", + "tsc_reliable", + "nonstop_tsc", + "extd_apicid", + "amd_dcm", + "aperfmperf", + "eagerfpu", + "nonstop_tsc_s3", + "pni", + "pclmulqdq", + "dtes64", + "monitor", + "ds_cpl", + "vmx", + "smx", + "est", + "tm2", + "ssse3", + "cid", + "fma", + "cx16", + "xtpr", + "pdcm", + "pcid", + "dca", + "sse4_1", + "sse4_2", + "x2apic", + "movbe", + "popcnt", + "tsc_deadline_timer", + "aes", + "xsave", + "avx", + "f16c", + "rdrand", + "hypervisor", + "rng", + "rng_en", + "ace", + "ace_en", + "ace2", + "ace2_en", + "phe", + "phe_en", + "pmm", + "pmm_en", + "lahf_lm", + "cmp_legacy", + "svm", + "extapic", + "cr8_legacy", + "abm", + "sse4a", + "misalignsse", + "3dnowprefetch", + "osvw", + "ibs", + "xop", + "skinit", + "wdt", + "lwp", + "fma4", + "tce", + "nodeid_msr", + "tbm", + "topoext", + "perfctr_core", + "perfctr_nb", + "bpext", + "perfctr_l2", + "mwaitx", + "ida", + "arat", + "cpb", + "epb", + "pln", + "pts", + "dtherm", + "hw_pstate", + "proc_feedback", + "hwp", + "hwp_notify", + "hwp_act_window", + "hwp_epp", + "hwp_pkg_req", + "intel_pt", + "tpr_shadow", + "vnmi", + "flexpriority", + "ept", + "vpid", + "npt", + "lbrv", + "svm_lock", + "nrip_save", + "tsc_scale", + "vmcb_clean", + "flushbyasid", + "decodeassists", + "pausefilter", + "pfthreshold", + "vmmcall", + "fsgsbase", + "tsc_adjust", + "bmi1", + "hle", + "avx2", + "smep", + "bmi2", + "erms", + "invpcid", + "rtm", + "cqm", + "mpx", + "avx512f", + "rdseed", + "adx", + "smap", + "pcommit", + "clflushopt", + "clwb", + "avx512pf", + "avx512er", + "avx512cd", + "sha_ni", + "xsaveopt", + "xsavec", + "xgetbv1", + "xsaves", + "cqm_llc", + "cqm_occup_llc", + "clzero" + ] + } + } + }, + "objects": [] +} diff --git a/openstack/openstack_conf/controller/glance/metadefs/compute-hypervisor.json b/openstack/openstack_conf/controller/glance/metadefs/compute-hypervisor.json new file mode 100644 index 0000000..29169dc --- /dev/null +++ b/openstack/openstack_conf/controller/glance/metadefs/compute-hypervisor.json @@ -0,0 +1,42 @@ +{ + "namespace": "OS::Compute::Hypervisor", + "display_name": "Hypervisor Selection", + "description": "OpenStack Compute supports many hypervisors, although most installations use only one hypervisor. For installations with multiple supported hypervisors, you can schedule different hypervisors using the ImagePropertiesFilter. This filters compute nodes that satisfy any architecture, hypervisor type, or virtual machine mode properties specified on the instance's image properties.", + "visibility": "public", + "protected": true, + "resource_type_associations": [ + { + "name": "OS::Glance::Image" + } + ], + "properties": { + "hypervisor_type": { + "title": "Hypervisor Type", + "description": "Hypervisor type required by the image. Used with the ImagePropertiesFilter. \n\n KVM - Kernel-based Virtual Machine. LXC - Linux Containers (through libvirt). QEMU - Quick EMUlator. UML - User Mode Linux. hyperv - Microsoft® hyperv. vmware - VMware® vsphere. Baremetal - physical provisioning. VZ - Virtuozzo OS Containers and Virtual Machines (through libvirt). For more information, see: http://docs.openstack.org/trunk/config-reference/content/section_compute-hypervisors.html", + "type": "string", + "enum": [ + "baremetal", + "hyperv", + "kvm", + "lxc", + "qemu", + "uml", + "vmware", + "vz", + "xen" + ] + }, + "vm_mode": { + "title": "VM Mode", + "description": "The virtual machine mode. This represents the host/guest ABI (application binary interface) used for the virtual machine. Used with the ImagePropertiesFilter. \n\n hvm — Fully virtualized - This is the virtual machine mode (vm_mode) used by QEMU and KVM. \n\n xen - Xen 3.0 paravirtualized. \n\n uml — User Mode Linux paravirtualized. \n\n exe — Executables in containers. This is the mode used by LXC.", + "type": "string", + "enum": [ + "hvm", + "xen", + "uml", + "exe" + ] + } + }, + "objects": [] +} diff --git a/openstack/openstack_conf/controller/glance/metadefs/compute-instance-data.json b/openstack/openstack_conf/controller/glance/metadefs/compute-instance-data.json new file mode 100644 index 0000000..a419c79 --- /dev/null +++ b/openstack/openstack_conf/controller/glance/metadefs/compute-instance-data.json @@ -0,0 +1,36 @@ +{ + "namespace": "OS::Compute::InstanceData", + "display_name": "Instance Config Data", + "description": "Instances can perform self-configuration based on data made available to the running instance. These properties affect instance configuration.", + "visibility": "public", + "protected": true, + "resource_type_associations": [ + { + "name": "OS::Glance::Image" + }, + { + "name": "OS::Cinder::Volume", + "properties_target": "image" + } + ], + "properties": { + "img_config_drive": { + "title": "Config Drive", + "description": "This property specifies whether or not Nova should use a config drive when booting the image. Mandatory means that Nova will always use a config drive when booting the image. OpenStack can be configured to write metadata to a special configuration drive that will be attached to the instance when it boots. The instance can retrieve any information from the config drive. One use case for the config drive is to pass network configuration information to the instance. See also: http://docs.openstack.org/user-guide/cli_config_drive.html", + "type": "string", + "enum": [ + "optional", + "mandatory" + ] + }, + "os_require_quiesce": { + "title": "Require Quiescent File system", + "description": "This property specifies whether or not the filesystem must be quiesced during snapshot processing. For volume backed and image backed snapshots, yes means that snapshotting is aborted when quiescing fails, whereas, no means quiescing will be skipped and snapshot processing will continue after the quiesce failure.", + "type": "string", + "enum": [ + "yes", + "no" + ] + } + } +} diff --git a/openstack/openstack_conf/controller/glance/metadefs/compute-libvirt-image.json b/openstack/openstack_conf/controller/glance/metadefs/compute-libvirt-image.json new file mode 100644 index 0000000..5ef0b8c --- /dev/null +++ b/openstack/openstack_conf/controller/glance/metadefs/compute-libvirt-image.json @@ -0,0 +1,103 @@ +{ + "namespace": "OS::Compute::LibvirtImage", + "display_name": "libvirt Driver Options for Images", + "description": "The libvirt Compute Driver Options for Glance Images. \n\nThese are properties specific to compute drivers. For a list of all hypervisors, see here: https://wiki.openstack.org/wiki/HypervisorSupportMatrix.", + "visibility": "public", + "protected": true, + "resource_type_associations": [ + { + "name": "OS::Glance::Image" + } + ], + "properties": { + "hw_disk_bus": { + "title": "Disk Bus", + "description": "Specifies the type of disk controller to attach disk devices to.", + "type": "string", + "enum": [ + "scsi", + "virtio", + "uml", + "xen", + "ide", + "usb", + "fdc", + "sata" + ] + }, + "hw_rng_model": { + "title": "Random Number Generator Device", + "description": "Adds a random-number generator device to the image's instances. The cloud administrator can enable and control device behavior by configuring the instance's flavor. By default: The generator device is disabled. /dev/random is used as the default entropy source. To specify a physical HW RNG device, use the following option in the nova.conf file: rng_dev_path=/dev/hwrng", + "type": "string", + "default": "virtio" + }, + "hw_machine_type": { + "title": "Machine Type", + "description": "Enables booting an ARM system using the specified machine type. By default, if an ARM image is used and its type is not specified, Compute uses vexpress-a15 (for ARMv7) or virt (for AArch64) machine types. Valid types can be viewed by using the virsh capabilities command (machine types are displayed in the machine tag).", + "type": "string" + }, + "hw_scsi_model": { + "title": "SCSI Model", + "description": "Enables the use of VirtIO SCSI (virtio-scsi) to provide block device access for compute instances; by default, instances use VirtIO Block (virtio-blk). VirtIO SCSI is a para-virtualized SCSI controller device that provides improved scalability and performance, and supports advanced SCSI hardware.", + "type": "string", + "default": "virtio-scsi" + }, + "hw_video_model": { + "title": "Video Model", + "description": "The video image driver used.", + "type": "string", + "enum": [ + "vga", + "cirrus", + "vmvga", + "xen", + "qxl" + ] + }, + "hw_video_ram": { + "title": "Max Video Ram", + "description": "Maximum RAM (unit: MB) for the video image. Used only if a hw_video:ram_max_mb value has been set in the flavor's extra_specs and that value is higher than the value set in hw_video_ram.", + "type": "integer", + "minimum": 0 + }, + "os_command_line": { + "title": "Kernel Command Line", + "description": "The kernel command line to be used by the libvirt driver, instead of the default. For linux containers (LXC), the value is used as arguments for initialization. This key is valid only for Amazon kernel, ramdisk, or machine images (aki, ari, or ami).", + "type": "string" + }, + "hw_vif_model": { + "title": "Virtual Network Interface", + "description": "Specifies the model of virtual network interface device to use. The valid options depend on the hypervisor configuration. libvirt driver options: KVM and QEMU: e1000, ne2k_pci, pcnet, rtl8139, spapr-vlan, and virtio. Xen: e1000, netfront, ne2k_pci, pcnet, and rtl8139.", + "type": "string", + "enum": [ + "e1000", + "e1000e", + "ne2k_pci", + "netfront", + "pcnet", + "rtl8139", + "spapr-vlan", + "virtio" + ] + }, + "hw_qemu_guest_agent": { + "title": "QEMU Guest Agent", + "description": "This is a background process which helps management applications execute guest OS level commands. For example, freezing and thawing filesystems, entering suspend. However, guest agent (GA) is not bullet proof, and hostile guest OS can send spurious replies.", + "type": "string", + "enum": ["yes", "no"] + }, + "hw_pointer_model": { + "title": "Pointer Model", + "description": "Input devices allow interaction with a graphical framebuffer. For example to provide a graphic tablet for absolute cursor movement. Currently only supported by the KVM/QEMU hypervisor configuration and VNC or SPICE consoles must be enabled.", + "type": "string", + "enum": ["usbtablet"] + }, + "img_hide_hypervisor_id": { + "title": "Hide hypervisor id", + "description": "Enables hiding the host hypervisor signature in the guest OS.", + "type": "string", + "enum": ["yes", "no"] + } + }, + "objects": [] +} diff --git a/openstack/openstack_conf/controller/glance/metadefs/compute-libvirt.json b/openstack/openstack_conf/controller/glance/metadefs/compute-libvirt.json new file mode 100644 index 0000000..08fd992 --- /dev/null +++ b/openstack/openstack_conf/controller/glance/metadefs/compute-libvirt.json @@ -0,0 +1,32 @@ +{ + "namespace": "OS::Compute::Libvirt", + "display_name": "libvirt Driver Options", + "description": "The libvirt compute driver options. \n\nThese are properties that affect the libvirt compute driver and may be specified on flavors and images. For a list of all hypervisors, see here: https://wiki.openstack.org/wiki/HypervisorSupportMatrix.", + "visibility": "public", + "protected": true, + "resource_type_associations": [ + { + "name": "OS::Glance::Image", + "prefix": "hw_" + }, + { + "name": "OS::Nova::Flavor", + "prefix": "hw:" + } + ], + "properties": { + "serial_port_count": { + "title": "Serial Port Count", + "description": "Specifies the count of serial ports that should be provided. If hw:serial_port_count is not set in the flavor's extra_specs, then any count is permitted. If hw:serial_port_count is set, then this provides the default serial port count. It is permitted to override the default serial port count, but only with a lower value.", + "type": "integer", + "minimum": 0 + }, + "boot_menu": { + "title": "Boot Menu", + "description": "If true, enables the BIOS bootmenu. In cases where both the image metadata and Extra Spec are set, the Extra Spec setting is used. This allows for flexibility in setting/overriding the default behavior as needed.", + "type": "string", + "enum": ["true", "false"] + } + }, + "objects": [] +} diff --git a/openstack/openstack_conf/controller/glance/metadefs/compute-quota.json b/openstack/openstack_conf/controller/glance/metadefs/compute-quota.json new file mode 100644 index 0000000..8691057 --- /dev/null +++ b/openstack/openstack_conf/controller/glance/metadefs/compute-quota.json @@ -0,0 +1,109 @@ +{ + "namespace": "OS::Compute::Quota", + "display_name": "Flavor Quota", + "description": "Compute drivers may enable quotas on CPUs available to a VM, disk tuning, bandwidth I/O, and instance VIF traffic control. See: http://docs.openstack.org/admin-guide/compute-flavors.html", + "visibility": "public", + "protected": true, + "resource_type_associations": [ + { + "name": "OS::Nova::Flavor" + } + ], + "objects": [ + { + "name": "CPU Limits", + "description": "You can configure the CPU limits with control parameters.", + "properties": { + "quota:cpu_shares": { + "title": "Quota: CPU Shares", + "description": "Specifies the proportional weighted share for the domain. If this element is omitted, the service defaults to the OS provided defaults. There is no unit for the value; it is a relative measure based on the setting of other VMs. For example, a VM configured with value 2048 gets twice as much CPU time as a VM configured with value 1024.", + "type": "integer" + }, + "quota:cpu_period": { + "title": "Quota: CPU Period", + "description": "Specifies the enforcement interval (unit: microseconds) for QEMU and LXC hypervisors. Within a period, each VCPU of the domain is not allowed to consume more than the quota worth of runtime. The value should be in range [1000, 1000000]. A period with value 0 means no value.", + "type": "integer", + "minimum": 1000, + "maximum": 1000000 + }, + "quota:cpu_quota": { + "title": "Quota: CPU Quota", + "description": "Specifies the maximum allowed bandwidth (unit: microseconds). A domain with a negative-value quota indicates that the domain has infinite bandwidth, which means that it is not bandwidth controlled. The value should be in range [1000, 18446744073709551] or less than 0. A quota with value 0 means no value. You can use this feature to ensure that all vCPUs run at the same speed.", + "type": "integer" + } + } + }, + { + "name": "Disk QoS", + "description": "Using disk I/O quotas, you can set maximum disk write to 10 MB per second for a VM user.", + "properties": { + "quota:disk_read_bytes_sec": { + "title": "Quota: Disk read bytes / sec", + "description": "Sets disk I/O quota for disk read bytes / sec.", + "type": "integer" + }, + "quota:disk_read_iops_sec": { + "title": "Quota: Disk read IOPS / sec", + "description": "Sets disk I/O quota for disk read IOPS / sec.", + "type": "integer" + }, + "quota:disk_write_bytes_sec": { + "title": "Quota: Disk Write Bytes / sec", + "description": "Sets disk I/O quota for disk write bytes / sec.", + "type": "integer" + }, + "quota:disk_write_iops_sec": { + "title": "Quota: Disk Write IOPS / sec", + "description": "Sets disk I/O quota for disk write IOPS / sec.", + "type": "integer" + }, + "quota:disk_total_bytes_sec": { + "title": "Quota: Disk Total Bytes / sec", + "description": "Sets disk I/O quota for total disk bytes / sec.", + "type": "integer" + }, + "quota:disk_total_iops_sec": { + "title": "Quota: Disk Total IOPS / sec", + "description": "Sets disk I/O quota for disk total IOPS / sec.", + "type": "integer" + } + } + }, + { + "name": "Virtual Interface QoS", + "description": "Bandwidth QoS tuning for instance virtual interfaces (VIFs) may be specified with these properties. Incoming and outgoing traffic can be shaped independently. If not specified, no quality of service (QoS) is applied on that traffic direction. So, if you want to shape only the network's incoming traffic, use inbound only (and vice versa). The OpenStack Networking service abstracts the physical implementation of the network, allowing plugins to configure and manage physical resources. Virtual Interfaces (VIF) in the logical model are analogous to physical network interface cards (NICs). VIFs are typically owned a managed by an external service; for instance when OpenStack Networking is used for building OpenStack networks, VIFs would be created, owned, and managed in Nova. VIFs are connected to OpenStack Networking networks via ports. A port is analogous to a port on a network switch, and it has an administrative state. When a VIF is attached to a port the OpenStack Networking API creates an attachment object, which specifies the fact that a VIF with a given identifier is plugged into the port.", + "properties": { + "quota:vif_inbound_average": { + "title": "Quota: VIF Inbound Average", + "description": "Network Virtual Interface (VIF) inbound average in kilobytes per second. Specifies average bit rate on the interface being shaped.", + "type": "integer" + }, + "quota:vif_inbound_burst": { + "title": "Quota: VIF Inbound Burst", + "description": "Network Virtual Interface (VIF) inbound burst in total kilobytes. Specifies the amount of bytes that can be burst at peak speed.", + "type": "integer" + }, + "quota:vif_inbound_peak": { + "title": "Quota: VIF Inbound Peak", + "description": "Network Virtual Interface (VIF) inbound peak in kilobytes per second. Specifies maximum rate at which an interface can receive data.", + "type": "integer" + }, + "quota:vif_outbound_average": { + "title": "Quota: VIF Outbound Average", + "description": "Network Virtual Interface (VIF) outbound average in kilobytes per second. Specifies average bit rate on the interface being shaped.", + "type": "integer" + }, + "quota:vif_outbound_burst": { + "title": "Quota: VIF Outbound Burst", + "description": "Network Virtual Interface (VIF) outbound burst in total kilobytes. Specifies the amount of bytes that can be burst at peak speed.", + "type": "integer" + }, + "quota:vif_outbound_peak": { + "title": "Quota: VIF Outbound Peak", + "description": "Network Virtual Interface (VIF) outbound peak in kilobytes per second. Specifies maximum rate at which an interface can send data.", + "type": "integer" + } + } + } + ] +} diff --git a/openstack/openstack_conf/controller/glance/metadefs/compute-randomgen.json b/openstack/openstack_conf/controller/glance/metadefs/compute-randomgen.json new file mode 100644 index 0000000..2414b84 --- /dev/null +++ b/openstack/openstack_conf/controller/glance/metadefs/compute-randomgen.json @@ -0,0 +1,29 @@ +{ + "namespace": "OS::Compute::RandomNumberGenerator", + "display_name": "Random Number Generator", + "description": "If a random-number generator device has been added to the instance through its image properties, the device can be enabled and configured.", + "visibility": "public", + "protected": true, + "resource_type_associations": [ + { + "name": "OS::Nova::Flavor" + } + ], + "properties": { + "hw_rng:allowed": { + "title": "Random Number Generator Allowed", + "description": "", + "type": "boolean" + }, + "hw_rng:rate_bytes": { + "title": "Random number generator limits.", + "description": "Allowed amount of bytes that the guest can read from the host's entropy per period.", + "type": "integer" + }, + "hw_rng:rate_period": { + "title": "Random number generator read period.", + "description": "Duration of the read period in seconds.", + "type": "integer" + } + } +} \ No newline at end of file diff --git a/openstack/openstack_conf/controller/glance/metadefs/compute-trust.json b/openstack/openstack_conf/controller/glance/metadefs/compute-trust.json new file mode 100644 index 0000000..7df5691 --- /dev/null +++ b/openstack/openstack_conf/controller/glance/metadefs/compute-trust.json @@ -0,0 +1,24 @@ +{ + "namespace": "OS::Compute::Trust", + "display_name": "Trusted Compute Pools (Intel® TXT)", + "description": "Trusted compute pools with Intel® Trusted Execution Technology (Intel® TXT) support IT compliance by protecting virtualized data centers - private, public, and hybrid clouds against attacks toward hypervisor and BIOS, firmware, and other pre-launch software components. The Nova trust scheduling filter must be enabled and configured with the trust attestation service in order to use this feature.", + "visibility": "public", + "protected": true, + "resource_type_associations": [ + { + "name": "OS::Nova::Flavor" + } + ], + "properties": { + "trust:trusted_host": { + "title": "Intel® TXT attestation", + "description": "Select to ensure that node has been attested by Intel® Trusted Execution Technology (Intel® TXT). The Nova trust scheduling filter must be enabled and configured with the trust attestation service in order to use this feature.", + "type": "string", + "enum": [ + "trusted", + "untrusted", + "unknown" + ] + } + } +} \ No newline at end of file diff --git a/openstack/openstack_conf/controller/glance/metadefs/compute-vcputopology.json b/openstack/openstack_conf/controller/glance/metadefs/compute-vcputopology.json new file mode 100644 index 0000000..345a1c2 --- /dev/null +++ b/openstack/openstack_conf/controller/glance/metadefs/compute-vcputopology.json @@ -0,0 +1,54 @@ +{ + "namespace": "OS::Compute::VirtCPUTopology", + "display_name": "Virtual CPU Topology", + "description": "This provides the preferred socket/core/thread counts for the virtual CPU instance exposed to guests. This enables the ability to avoid hitting limitations on vCPU topologies that OS vendors place on their products. See also: http://git.openstack.org/cgit/openstack/nova-specs/tree/specs/juno/virt-driver-vcpu-topology.rst", + "visibility": "public", + "protected": true, + "resource_type_associations": [ + { + "name": "OS::Glance::Image", + "prefix": "hw_" + }, + { + "name": "OS::Cinder::Volume", + "prefix": "hw_", + "properties_target": "image" + }, + { + "name": "OS::Nova::Flavor", + "prefix": "hw:" + } + ], + "properties": { + "cpu_sockets": { + "title": "vCPU Sockets", + "description": "Preferred number of sockets to expose to the guest.", + "type": "integer" + }, + "cpu_cores": { + "title": "vCPU Cores", + "description": "Preferred number of cores to expose to the guest.", + "type": "integer" + }, + "cpu_threads": { + "title": " vCPU Threads", + "description": "Preferred number of threads to expose to the guest.", + "type": "integer" + }, + "cpu_maxsockets": { + "title": "Max vCPU Sockets", + "description": "Maximum number of sockets to expose to the guest.", + "type": "integer" + }, + "cpu_maxcores": { + "title": "Max vCPU Cores", + "description": "Maximum number of cores to expose to the guest.", + "type": "integer" + }, + "cpu_maxthreads": { + "title": "Max vCPU Threads", + "description": "Maximum number of threads to expose to the guest.", + "type": "integer" + } + } +} diff --git a/openstack/openstack_conf/controller/glance/metadefs/compute-vmware-flavor.json b/openstack/openstack_conf/controller/glance/metadefs/compute-vmware-flavor.json new file mode 100644 index 0000000..7c501b5 --- /dev/null +++ b/openstack/openstack_conf/controller/glance/metadefs/compute-vmware-flavor.json @@ -0,0 +1,34 @@ +{ + "namespace": "OS::Compute::VMwareFlavor", + "display_name": "VMware Driver Options for Flavors", + "description": "VMware Driver Options for Flavors may be used to customize and manage Nova Flavors. These are properties specific to VMWare compute drivers and will only have an effect if the VMWare compute driver is enabled in Nova. See: http://docs.openstack.org/admin-guide/compute-flavors.html", + "visibility": "public", + "protected": true, + "resource_type_associations": [ + { + "name": "OS::Nova::Flavor" + } + ], + "properties": { + "vmware:hw_version": { + "title": "VMware Hardware Version", + "description": "Specifies the hardware version VMware uses to create images. If the hardware version needs to be compatible with a cluster version, for backward compatibility or other circumstances, the vmware:hw_version key specifies a virtual machine hardware version. In the event that a cluster has mixed host version types, the key will enable the vCenter to place the cluster on the correct host.", + "type": "string", + "enum": [ + "vmx-13", + "vmx-11", + "vmx-10", + "vmx-09", + "vmx-08", + "vmx-07", + "vmx-04", + "vmx-03" + ] + }, + "vmware:storage_policy": { + "title": "VMware Storage Policy", + "description": "Specifies the storage policy to be applied for newly created instance. If not provided, the default storage policy specified in config file will be used. If Storage Policy Based Management (SPBM) is not enabled in config file, this value won't be used.", + "type": "string" + } + } +} diff --git a/openstack/openstack_conf/controller/glance/metadefs/compute-vmware-quota-flavor.json b/openstack/openstack_conf/controller/glance/metadefs/compute-vmware-quota-flavor.json new file mode 100644 index 0000000..7daec69 --- /dev/null +++ b/openstack/openstack_conf/controller/glance/metadefs/compute-vmware-quota-flavor.json @@ -0,0 +1,26 @@ +{ + "namespace": "OS::Compute::VMwareQuotaFlavor", + "display_name": "VMware Quota for Flavors", + "description": "The VMware compute driver allows various compute quotas to be specified on flavors. When specified, the VMWare driver will ensure that the quota is enforced. These are properties specific to VMWare compute drivers and will only have an effect if the VMWare compute driver is enabled in Nova. For a list of hypervisors, see: https://wiki.openstack.org/wiki/HypervisorSupportMatrix. For flavor customization, see: http://docs.openstack.org/admin-guide/compute-flavors.html", + "visibility": "public", + "protected": true, + "resource_type_associations": [ + { + "name": "OS::Nova::Flavor" + } + ], + "properties": { + "quota:cpu_limit": { + "title": "Quota: CPU Limit", + "description": "Specifies the upper limit for CPU allocation in MHz. This parameter ensures that a machine never uses more than the defined amount of CPU time. It can be used to enforce a limit on the machine's CPU performance. The value should be a numerical value in MHz. If zero is supplied then the cpu_limit is unlimited.", + "type": "integer", + "minimum": 0 + }, + "quota:cpu_reservation": { + "title": "Quota: CPU Reservation Limit", + "description": "Specifies the guaranteed minimum CPU reservation in MHz. This means that if needed, the machine will definitely get allocated the reserved amount of CPU cycles. The value should be a numerical value in MHz.", + "type": "integer", + "minimum": 0 + } + } +} diff --git a/openstack/openstack_conf/controller/glance/metadefs/compute-vmware.json b/openstack/openstack_conf/controller/glance/metadefs/compute-vmware.json new file mode 100644 index 0000000..51e0cce --- /dev/null +++ b/openstack/openstack_conf/controller/glance/metadefs/compute-vmware.json @@ -0,0 +1,212 @@ +{ + "namespace": "OS::Compute::VMware", + "display_name": "VMware Driver Options", + "description": "The VMware compute driver options. \n\nThese are properties specific to VMWare compute drivers and will only have an effect if the VMWare compute driver is enabled in Nova. For a list of all hypervisors, see here: https://wiki.openstack.org/wiki/HypervisorSupportMatrix.", + "visibility": "public", + "protected": true, + "resource_type_associations": [ + { + "name": "OS::Glance::Image" + } + ], + "properties": { + "img_linked_clone":{ + "title": "Linked Clone", + "description": "By default, the VMware compute driver creates linked clones when possible (though this can be turned off by the operator). You can use this image property on a per-image basis to control whether virtual machines booted from the image are treated as full clones (value: false) or linked clones (value: true). Please refer to VMware documentation for information about full vs. linked clones.", + "type": "boolean" + }, + "vmware_adaptertype": { + "title": "Disk Adapter Type", + "description": "The virtual SCSI or IDE controller used by the hypervisor.", + "type": "string", + "enum": [ + "lsiLogic", + "lsiLogicsas", + "paraVirtual", + "busLogic", + "ide" + ], + "default" : "lsiLogic" + }, + "vmware_disktype": { + "title": "Disk Provisioning Type", + "description": "When performing operations such as creating a virtual disk, cloning, or migrating, the disk provisioning type may be specified. Please refer to VMware documentation for more.", + "type": "string", + "enum": [ + "streamOptimized", + "sparse", + "preallocated" + ], + "default" : "preallocated" + }, + "vmware_ostype": { + "title": "OS Type", + "description": "A VMware GuestID which describes the operating system installed in the image. This value is passed to the hypervisor when creating a virtual machine. If not specified, the key defaults to otherGuest. See thinkvirt.com.", + "type": "string", + "enum": [ + "asianux3_64Guest", + "asianux3Guest", + "asianux4_64Guest", + "asianux4Guest", + "asianux5_64Guest", + "asianux7_64Guest", + "centos64Guest", + "centosGuest", + "centos6Guest", + "centos6_64Guest", + "centos7_64Guest", + "coreos64Guest", + "darwin10_64Guest", + "darwin10Guest", + "darwin11_64Guest", + "darwin11Guest", + "darwin12_64Guest", + "darwin13_64Guest", + "darwin14_64Guest", + "darwin15_64Guest", + "darwin16_64Guest", + "darwin64Guest", + "darwinGuest", + "debian4_64Guest", + "debian4Guest", + "debian5_64Guest", + "debian5Guest", + "debian6_64Guest", + "debian6Guest", + "debian7_64Guest", + "debian7Guest", + "debian8_64Guest", + "debian8Guest", + "debian9_64Guest", + "debian9Guest", + "debian10_64Guest", + "debian10Guest", + "dosGuest", + "eComStation2Guest", + "eComStationGuest", + "fedora64Guest", + "fedoraGuest", + "freebsd64Guest", + "freebsdGuest", + "genericLinuxGuest", + "mandrakeGuest", + "mandriva64Guest", + "mandrivaGuest", + "netware4Guest", + "netware5Guest", + "netware6Guest", + "nld9Guest", + "oesGuest", + "openServer5Guest", + "openServer6Guest", + "opensuse64Guest", + "opensuseGuest", + "oracleLinux64Guest", + "oracleLinuxGuest", + "oracleLinux6Guest", + "oracleLinux6_64Guest", + "oracleLinux7_64Guest", + "os2Guest", + "other24xLinux64Guest", + "other24xLinuxGuest", + "other26xLinux64Guest", + "other26xLinuxGuest", + "other3xLinux64Guest", + "other3xLinuxGuest", + "otherGuest", + "otherGuest64", + "otherLinux64Guest", + "otherLinuxGuest", + "redhatGuest", + "rhel2Guest", + "rhel3_64Guest", + "rhel3Guest", + "rhel4_64Guest", + "rhel4Guest", + "rhel5_64Guest", + "rhel5Guest", + "rhel6_64Guest", + "rhel6Guest", + "rhel7_64Guest", + "rhel7Guest", + "sjdsGuest", + "sles10_64Guest", + "sles10Guest", + "sles11_64Guest", + "sles11Guest", + "sles12_64Guest", + "sles12Guest", + "sles64Guest", + "slesGuest", + "solaris10_64Guest", + "solaris10Guest", + "solaris11_64Guest", + "solaris6Guest", + "solaris7Guest", + "solaris8Guest", + "solaris9Guest", + "turboLinux64Guest", + "turboLinuxGuest", + "ubuntu64Guest", + "ubuntuGuest", + "unixWare7Guest", + "vmkernel5Guest", + "vmkernel6Guest", + "vmkernel65Guest", + "vmkernelGuest", + "vmwarePhoton64Guest", + "win2000AdvServGuest", + "win2000ProGuest", + "win2000ServGuest", + "win31Guest", + "win95Guest", + "win98Guest", + "windows7_64Guest", + "windows7Guest", + "windows7Server64Guest", + "windows8_64Guest", + "windows8Guest", + "windows8Server64Guest", + "windows9_64Guest", + "windows9Guest", + "windows9Server64Guest", + "windowsHyperVGuest", + "winLonghorn64Guest", + "winLonghornGuest", + "winMeGuest", + "winNetBusinessGuest", + "winNetDatacenter64Guest", + "winNetDatacenterGuest", + "winNetEnterprise64Guest", + "winNetEnterpriseGuest", + "winNetStandard64Guest", + "winNetStandardGuest", + "winNetWebGuest", + "winNTGuest", + "winVista64Guest", + "winVistaGuest", + "winXPHomeGuest", + "winXPPro64Guest", + "winXPProGuest" + ], + "default": "otherGuest" + }, + "hw_vif_model": { + "title": "Virtual Network Interface", + "description": "Specifies the model of virtual network interface device to use. The valid options depend on the hypervisor. VMware driver supported options: e1000, e1000e, VirtualE1000, VirtualE1000e, VirtualPCNet32, VirtualSriovEthernetCard, and VirtualVmxnet.", + "type": "string", + "enum": [ + "e1000", + "e1000e", + "VirtualE1000", + "VirtualE1000e", + "VirtualPCNet32", + "VirtualSriovEthernetCard", + "VirtualVmxnet", + "VirtualVmxnet3" + ], + "default" : "e1000" + } + }, + "objects": [] +} diff --git a/openstack/openstack_conf/controller/glance/metadefs/compute-watchdog.json b/openstack/openstack_conf/controller/glance/metadefs/compute-watchdog.json new file mode 100644 index 0000000..a8e9e43 --- /dev/null +++ b/openstack/openstack_conf/controller/glance/metadefs/compute-watchdog.json @@ -0,0 +1,33 @@ +{ + "namespace": "OS::Compute::Watchdog", + "display_name": "Watchdog Behavior", + "description": "Compute drivers may enable watchdog behavior over instances. See: http://docs.openstack.org/admin-guide/compute-flavors.html", + "visibility": "public", + "protected": true, + "resource_type_associations": [ + { + "name": "OS::Glance::Image" + }, + { + "name": "OS::Cinder::Volume", + "properties_target": "image" + }, + { + "name": "OS::Nova::Flavor" + } + ], + "properties": { + "hw_watchdog_action": { + "title": "Watchdog Action", + "description": "For the libvirt driver, you can enable and set the behavior of a virtual hardware watchdog device for each flavor. Watchdog devices keep an eye on the guest server, and carry out the configured action, if the server hangs. The watchdog uses the i6300esb device (emulating a PCI Intel 6300ESB). If hw_watchdog_action is not specified, the watchdog is disabled. Watchdog behavior set using a specific image's properties will override behavior set using flavors.", + "type": "string", + "enum": [ + "disabled", + "reset", + "poweroff", + "pause", + "none" + ] + } + } +} diff --git a/openstack/openstack_conf/controller/glance/metadefs/compute-xenapi.json b/openstack/openstack_conf/controller/glance/metadefs/compute-xenapi.json new file mode 100644 index 0000000..eda7489 --- /dev/null +++ b/openstack/openstack_conf/controller/glance/metadefs/compute-xenapi.json @@ -0,0 +1,29 @@ +{ + "namespace": "OS::Compute::XenAPI", + "display_name": "XenAPI Driver Options", + "description": "The XenAPI compute driver options. \n\nThese are properties specific to compute drivers. For a list of all hypervisors, see here: https://wiki.openstack.org/wiki/HypervisorSupportMatrix.", + "visibility": "public", + "protected": true, + "resource_type_associations": [ + { + "name": "OS::Glance::Image" + } + ], + "properties": { + "os_type": { + "title": "OS Type", + "description": "The operating system installed on the image. The XenAPI driver contains logic that takes different actions depending on the value of the os_type parameter of the image. For example, for os_type=windows images, it creates a FAT32-based swap partition instead of a Linux swap partition, and it limits the injected host name to less than 16 characters.", + "type": "string", + "enum": [ + "linux", + "windows" + ] + }, + "auto_disk_config": { + "title": "Disk Adapter Type", + "description": "If true, the root partition on the disk is automatically resized before the instance boots. This value is only taken into account by the Compute service when using a Xen-based hypervisor with the XenAPI driver. The Compute service will only attempt to resize if there is a single partition on the image, and only if the partition is in ext3 or ext4 format.", + "type": "boolean" + } + }, + "objects": [] +} diff --git a/openstack/openstack_conf/controller/glance/metadefs/glance-common-image-props.json b/openstack/openstack_conf/controller/glance/metadefs/glance-common-image-props.json new file mode 100644 index 0000000..636ff3a --- /dev/null +++ b/openstack/openstack_conf/controller/glance/metadefs/glance-common-image-props.json @@ -0,0 +1,42 @@ +{ + "display_name": "Common Image Properties", + "namespace": "OS::Glance::CommonImageProperties", + "description": "When adding an image to Glance, you may specify some common image properties that may prove useful to consumers of your image.", + "protected": true, + "resource_type_associations" : [ + ], + "properties": { + "kernel_id": { + "title": "Kernel ID", + "type": "string", + "pattern": "^([0-9a-fA-F]){8}-([0-9a-fA-F]){4}-([0-9a-fA-F]){4}-([0-9a-fA-F]){4}-([0-9a-fA-F]){12}$", + "description": "ID of image stored in Glance that should be used as the kernel when booting an AMI-style image." + }, + "ramdisk_id": { + "title": "Ramdisk ID", + "type": "string", + "pattern": "^([0-9a-fA-F]){8}-([0-9a-fA-F]){4}-([0-9a-fA-F]){4}-([0-9a-fA-F]){4}-([0-9a-fA-F]){12}$", + "description": "ID of image stored in Glance that should be used as the ramdisk when booting an AMI-style image." + }, + "instance_uuid": { + "title": "Instance ID", + "type": "string", + "description": "Metadata which can be used to record which instance this image is associated with. (Informational only, does not create an instance snapshot.)" + }, + "architecture": { + "title": "CPU Architecture", + "description": "The CPU architecture that must be supported by the hypervisor. For example, x86_64, arm, or ppc64. Run uname -m to get the architecture of a machine. We strongly recommend using the architecture data vocabulary defined by the libosinfo project for this purpose.", + "type": "string" + }, + "os_distro": { + "title": "OS Distro", + "description": "The common name of the operating system distribution in lowercase (uses the same data vocabulary as the libosinfo project). Specify only a recognized value for this field. Deprecated values are listed to assist you in searching for the recognized value.", + "type": "string" + }, + "os_version": { + "title": "OS Version", + "description": "Operating system version as specified by the distributor. (for example, '11.10')", + "type": "string" + } + } +} diff --git a/openstack/openstack_conf/controller/glance/metadefs/image-signature-verification.json b/openstack/openstack_conf/controller/glance/metadefs/image-signature-verification.json new file mode 100644 index 0000000..b5ec3c7 --- /dev/null +++ b/openstack/openstack_conf/controller/glance/metadefs/image-signature-verification.json @@ -0,0 +1,50 @@ +{ + "namespace": "OS::Glance::Signatures", + "display_name": "Image Signature Verification", + "description": "Image signature verification allows the user to verify that an image has not been modified prior to booting the image.", + "visibility": "public", + "protected": false, + "resource_type_associations": [ + { + "name": "OS::Glance::Image" + } + ], + "properties": { + "img_signature": { + "title": "Image Signature", + "description": "The signature of the image data encoded in base64 format.", + "type": "string" + }, + "img_signature_certificate_uuid": { + "title": "Image Signature Certificate UUID", + "description": "The UUID used to retrieve the certificate from the key manager.", + "type": "string" + }, + "img_signature_hash_method": { + "title": "Image Signature Hash Method", + "description": "The hash method used in creating the signature.", + "type": "string", + "enum": [ + "SHA-224", + "SHA-256", + "SHA-384", + "SHA-512" + ] + }, + "img_signature_key_type": { + "title": "Image Signature Key Type", + "description": "The key type used in creating the signature.", + "type": "string", + "enum": [ + "RSA-PSS", + "DSA", + "ECC_SECT571K1", + "ECC_SECT409K1", + "ECC_SECT571R1", + "ECC_SECT409R1", + "ECC_SECP521R1", + "ECC_SECP384R1" + ] + } + } +} diff --git a/openstack/openstack_conf/controller/glance/metadefs/operating-system.json b/openstack/openstack_conf/controller/glance/metadefs/operating-system.json new file mode 100644 index 0000000..5907b5c --- /dev/null +++ b/openstack/openstack_conf/controller/glance/metadefs/operating-system.json @@ -0,0 +1,32 @@ +{ + "display_name": "Common Operating System Properties", + "namespace": "OS::OperatingSystem", + "description": "Details of the operating system contained within this image as well as common operating system properties that can be set on a VM instance created from this image.", + "protected": true, + "resource_type_associations" : [ + { + "name": "OS::Glance::Image" + }, + { + "name": "OS::Cinder::Volume", + "properties_target": "image" + } + ], + "properties": { + "os_distro": { + "title": "OS Distro", + "description": "The common name of the operating system distribution in lowercase (uses the same data vocabulary as the libosinfo project). Specify only a recognized value for this field. Deprecated values are listed to assist you in searching for the recognized value.", + "type": "string" + }, + "os_version": { + "title": "OS Version", + "description": "Operating system version as specified by the distributor. (for example, '11.10')", + "type": "string" + }, + "os_admin_user": { + "title": "OS Admin User", + "description": "The name of the user with admin privileges.", + "type": "string" + } + } +} diff --git a/openstack/openstack_conf/controller/glance/metadefs/software-databases.json b/openstack/openstack_conf/controller/glance/metadefs/software-databases.json new file mode 100644 index 0000000..973c092 --- /dev/null +++ b/openstack/openstack_conf/controller/glance/metadefs/software-databases.json @@ -0,0 +1,334 @@ +{ + "namespace": "OS::Software::DBMS", + "display_name": "Database Software", + "description": "A database is an organized collection of data. The data is typically organized to model aspects of reality in a way that supports processes requiring information. Database management systems are computer software applications that interact with the user, other applications, and the database itself to capture and analyze data. (http://en.wikipedia.org/wiki/Database)", + "visibility": "public", + "protected": true, + "resource_type_associations": [ + { + "name": "OS::Glance::Image" + }, + { + "name": "OS::Cinder::Volume", + "properties_target": "image" + }, + { + "name": "OS::Nova::Server", + "properties_target": "metadata" + }, + { + "name": "OS::Trove::Instance" + } + ], + "objects": [ + { + "name": "MySQL", + "description": "MySQL is an object-relational database management system (ORDBMS). The MySQL development project has made its source code available under the terms of the GNU General Public License, as well as under a variety of proprietary agreements. MySQL was owned and sponsored by a single for-profit firm, the Swedish company MySQL AB, now owned by Oracle Corporation. MySQL is a popular choice of database for use in web applications, and is a central component of the widely used LAMP open source web application software stack (and other 'AMP' stacks). (http://en.wikipedia.org/wiki/MySQL)", + "properties": { + "sw_database_mysql_version": { + "title": "Version", + "description": "The specific version of MySQL.", + "type": "string" + }, + "sw_database_mysql_listen_port": { + "title": "Listen Port", + "description": "The configured TCP/IP port which MySQL listens for incoming connections.", + "type": "integer", + "minimum": 1, + "maximum": 65535, + "default": 3606 + }, + "sw_database_mysql_admin": { + "title": "Admin User", + "description": "The primary user with privileges to perform administrative operations.", + "type": "string", + "default": "root" + } + } + }, + { + "name": "PostgreSQL", + "description": "PostgreSQL, often simply 'Postgres', is an object-relational database management system (ORDBMS) with an emphasis on extensibility and standards-compliance. PostgreSQL is cross-platform and runs on many operating systems. (http://en.wikipedia.org/wiki/PostgreSQL)", + "properties": { + "sw_database_postgresql_version": { + "title": "Version", + "description": "The specific version of PostgreSQL.", + "type": "string" + }, + "sw_database_postgresql_listen_port": { + "title": "Listen Port", + "description": "Specifies the TCP/IP port or local Unix domain socket file extension on which PostgreSQL is to listen for connections from client applications.", + "type": "integer", + "minimum": 1, + "maximum": 65535, + "default": 5432 + }, + "sw_database_postgresql_admin": { + "title": "Admin User", + "description": "The primary user with privileges to perform administrative operations.", + "type": "string", + "default": "postgres" + } + } + }, + { + "name": "SQL Server", + "description": "Microsoft SQL Server is a relational database management system developed by Microsoft. There are at least a dozen different editions of Microsoft SQL Server aimed at different audiences and for workloads ranging from small single-machine applications to large Internet-facing applications with many concurrent users. Its primary query languages are T-SQL and ANSI SQL. (http://en.wikipedia.org/wiki/Microsoft_SQL_Server)", + "properties": { + "sw_database_sqlserver_version": { + "title": "Version", + "description": "The specific version of Microsoft SQL Server.", + "type": "string" + }, + "sw_database_sqlserver_edition": { + "title": "Edition", + "description": "SQL Server is available in multiple editions, with different feature sets and targeting different users.", + "type": "string", + "default": "Express", + "enum": [ + "Datacenter", + "Enterprise", + "Standard", + "Web", + "Business Intelligence", + "Workgroup", + "Express", + "Compact (SQL CE)", + "Developer", + "Embedded (SSEE)", + "Express", + "Fast Track", + "LocalDB", + "Parallel Data Warehouse (PDW)", + "Business Intelligence", + "Datawarehouse Appliance Edition" + ] + }, + "sw_database_sqlserver_listen_port": { + "title": "Listen Port", + "description": "Specifies the TCP/IP port or local Unix domain socket file extension on which SQL Server is to listen for connections from client applications. The default SQL Server port is 1433, and client ports are assigned a random value between 1024 and 5000.", + "type": "integer", + "minimum": 1, + "maximum": 65535, + "default": 1433 + }, + "sw_database_postsqlserver_admin": { + "title": "Admin User", + "description": "The primary user with privileges to perform administrative operations.", + "type": "string", + "default": "sa" + } + } + }, + { + "name": "Oracle", + "description": "Oracle Database (commonly referred to as Oracle RDBMS or simply as Oracle) is an object-relational database management system produced and marketed by Oracle Corporation. (http://en.wikipedia.org/wiki/Oracle_Database)", + "properties": { + "sw_database_oracle_version": { + "title": "Version", + "description": "The specific version of Oracle.", + "type": "string" + }, + "sw_database_oracle_edition": { + "title": "Edition", + "description": "Over and above the different versions of the Oracle database management software developed over time, Oracle Corporation subdivides its product into varying editions.", + "type": "string", + "default": "Express", + "enum": [ + "Enterprise", + "Standard", + "Standard Edition One", + "Express (XE)", + "Workgroup", + "Lite" + ] + }, + "sw_database_oracle_listen_port": { + "title": "Listen Port", + "description": "Specifies the TCP/IP port or local Unix domain socket file extension on which Oracle is to listen for connections from client applications.", + "type": "integer", + "minimum": 1, + "maximum": 65535, + "default": 1521 + } + } + }, + { + "name": "DB2", + "description": "IBM DB2 is a family of database server products developed by IBM. These products all support the relational model, but in recent years some products have been extended to support object-relational features and non-relational structures, in particular XML. (http://en.wikipedia.org/wiki/IBM_DB2)", + "properties": { + "sw_database_db2_version": { + "title": "Version", + "description": "The specific version of DB2.", + "type": "string" + }, + "sw_database_db2_port": { + "title": "Listen Port", + "description": "Specifies the TCP/IP port or local Unix domain socket file extension on which DB2 is to listen for connections from client applications.", + "type": "integer", + "minimum": 1, + "maximum": 65535, + "default": 5432 + }, + "sw_database_db2_admin": { + "title": "Admin User", + "description": "The primary user with privileges to perform administrative operations.", + "type": "string" + } + } + }, + { + "name": "MongoDB", + "description": "MongoDB is a cross-platform document-oriented database. Classified as a NoSQL database, MongoDB uses JSON-like documents with dynamic schemas (MongoDB calls the format BSON), making the integration of data in certain types of applications easier and faster. Released under a combination of the GNU Affero General Public License and the Apache License, MongoDB is free and open-source software. (http://en.wikipedia.org/wiki/MongoDB)", + "properties": { + "sw_database_mongodb_version": { + "title": "Version", + "description": "The specific version of MongoDB.", + "type": "string" + }, + "sw_database_mongodb_listen_port": { + "title": "Listen Port", + "description": "Specifies the TCP/IP port or local Unix domain socket file extension on which MongoDB is to listen for connections from client applications.", + "type": "integer", + "minimum": 1, + "maximum": 65535, + "default": 27017 + }, + "sw_database_mongodb_admin": { + "title": "Admin User", + "description": "The primary user with privileges to perform administrative operations.", + "type": "string" + } + } + }, + { + "name": "Couchbase Server", + "description": "Couchbase Server, originally known as Membase, is an open source, distributed (shared-nothing architecture) NoSQL document-oriented database that is optimized for interactive applications. These applications must serve many concurrent users by creating, storing, retrieving, aggregating, manipulating and presenting data. In support of these kinds of application needs, Couchbase is designed to provide easy-to-scale key-value or document access with low latency and high sustained throughput. (http://en.wikipedia.org/wiki/Couchbase_Server)", + "properties": { + "sw_database_couchbaseserver_version": { + "title": "Version", + "description": "The specific version of Couchbase Server.", + "type": "string" + }, + "sw_database_couchbaseserver_listen_port": { + "title": "Listen Port", + "description": "Specifies the TCP/IP port or local Unix domain socket file extension on which Couchbase is to listen for connections from client applications.", + "type": "integer", + "minimum": 1, + "maximum": 65535, + "default": 11211 + }, + "sw_database_couchbaseserver_admin": { + "title": "Admin User", + "description": "The primary user with privileges to perform administrative operations.", + "type": "string", + "default": "admin" + } + } + }, + { + "name": "Redis", + "description": "Redis is a data structure server (NoSQL). It is open-source, networked, in-memory, and stores keys with optional durability. The development of Redis has been sponsored by Pivotal Software since May 2013; before that, it was sponsored by VMware. The name Redis means REmote DIctionary Server. (http://en.wikipedia.org/wiki/Redis)", + "properties": { + "sw_database_redis_version": { + "title": "Version", + "description": "The specific version of Redis.", + "type": "string" + }, + "sw_database_redis_listen_port": { + "title": "Listen Port", + "description": "Specifies the TCP/IP port or local Unix domain socket file extension on which Redis is to listen for connections from client applications.", + "type": "integer", + "minimum": 1, + "maximum": 65535, + "default": 6379 + }, + "sw_database_redis_admin": { + "title": "Admin User", + "description": "The primary user with privileges to perform administrative operations.", + "type": "string", + "default": "admin" + } + } + }, + { + "name": "CouchDB", + "description": "Apache CouchDB, commonly referred to as CouchDB, is an open source NoSQL database. It is a NoSQL database that uses JSON to store data, JavaScript as its query language using MapReduce, and HTTP for an API. One of its distinguishing features is multi-master replication. CouchDB was first released in 2005 and later became an Apache project in 2008. (http://en.wikipedia.org/wiki/CouchDB)", + "properties": { + "sw_database_couchdb_version": { + "title": "Version", + "description": "The specific version of CouchDB.", + "type": "string" + }, + "sw_database_couchdb_listen_port": { + "title": "Listen Port", + "description": "Specifies the TCP/IP port or local Unix domain socket file extension on which CouchDB is to listen for connections from client applications.", + "type": "integer", + "minimum": 1, + "maximum": 65535, + "default": 5984 + }, + "sw_database_couchdb_admin": { + "title": "Admin User", + "description": "The primary user with privileges to perform administrative operations.", + "type": "string" + } + } + }, + { + "name": "Apache Cassandra", + "description": "Apache Cassandra is an open source distributed NoSQL database management system designed to handle large amounts of data across many commodity servers, providing high availability with no single point of failure. (http://en.wikipedia.org/wiki/Apache_Cassandra)", + "properties": { + "sw_database_cassandra_version": { + "title": "Version", + "description": "The specific version of Apache Cassandra.", + "type": "string" + }, + "sw_database_cassandra_listen_port": { + "title": "Listen Port", + "description": "Specifies the TCP/IP port or local Unix domain socket file extension on which Cassandra is to listen for connections from client applications.", + "type": "integer", + "minimum": 1, + "maximum": 65535, + "default": 9160 + }, + "sw_database_cassandra_admin": { + "title": "Admin User", + "description": "The primary user with privileges to perform administrative operations.", + "type": "string", + "default": "cassandra" + } + } + }, + { + "name": "HBase", + "description": "HBase is an open source, non-relational (NoSQL), distributed database modeled after Google's BigTable and written in Java. It is developed as part of Apache Software Foundation's Apache Hadoop project and runs on top of HDFS (Hadoop Distributed Filesystem), providing BigTable-like capabilities for Hadoop. (http://en.wikipedia.org/wiki/Apache_HBase)", + "properties": { + "sw_database_hbase_version": { + "title": "Version", + "description": "The specific version of HBase.", + "type": "string" + } + } + }, + { + "name": "Hazlecast", + "description": "In computing, Hazelcast is an in-memory open source software data grid based on Java. By having multiple nodes form a cluster, data is evenly distributed among the nodes. This allows for horizontal scaling both in terms of available storage space and processing power. Backups are also distributed in a similar fashion to other nodes, based on configuration, thereby protecting against single node failure. (http://en.wikipedia.org/wiki/Hazelcast)", + "properties": { + "sw_database_hazlecast_version": { + "title": "Version", + "description": "The specific version of Hazlecast.", + "type": "string" + }, + "sw_database_hazlecast_port": { + "title": "Listen Port", + "description": "Specifies the TCP/IP port or local Unix domain socket file extension on which Hazlecast is to listen for connections between members.", + "type": "integer", + "minimum": 1, + "maximum": 65535, + "default": 5701 + } + } + } + ] +} diff --git a/openstack/openstack_conf/controller/glance/metadefs/software-runtimes.json b/openstack/openstack_conf/controller/glance/metadefs/software-runtimes.json new file mode 100644 index 0000000..7807072 --- /dev/null +++ b/openstack/openstack_conf/controller/glance/metadefs/software-runtimes.json @@ -0,0 +1,77 @@ +{ + "namespace": "OS::Software::Runtimes", + "display_name": "Runtime Environment", + "description": "Software is written in a specific programming language and the language must execute within a runtime environment. The runtime environment provides an abstraction to utilizing a computer's processor, memory (RAM), and other system resources.", + "visibility": "public", + "protected": true, + "resource_type_associations": [ + { + "name": "OS::Glance::Image" + }, + { + "name": "OS::Cinder::Volume", + "properties_target": "image" + }, + { + "name": "OS::Nova::Server", + "properties_target": "metadata" + } + ], + "objects": [ + { + "name": "PHP", + "description": "PHP is a server-side scripting language designed for web development but also used as a general-purpose programming language. PHP code can be simply mixed with HTML code, or it can be used in combination with various templating engines and web frameworks. PHP code is usually processed by a PHP interpreter, which is usually implemented as a web server's native module or a Common Gateway Interface (CGI) executable. After the PHP code is interpreted and executed, the web server sends resulting output to its client, usually in form of a part of the generated web page – for example, PHP code can generate a web page's HTML code, an image, or some other data. PHP has also evolved to include a command-line interface (CLI) capability and can be used in standalone graphical applications. (http://en.wikipedia.org/wiki/PHP)", + "properties": { + "sw_runtime_php_version": { + "title": "Version", + "description": "The specific version of PHP.", + "type": "string" + } + } + }, + { + "name": "Python", + "description": "Python is a widely used general-purpose, high-level programming language. Its design philosophy emphasizes code readability, and its syntax allows programmers to express concepts in fewer lines of code than would be possible in languages such as C++ or Java. The language provides constructs intended to enable clear programs on both a small and large scale. Python supports multiple programming paradigms, including object-oriented, imperative and functional programming or procedural styles. It features a dynamic type system and automatic memory management and has a large and comprehensive standard library. (http://en.wikipedia.org/wiki/Python_(programming_language))", + "properties": { + "sw_runtime_python_version": { + "title": "Version", + "description": "The specific version of python.", + "type": "string" + } + } + }, + { + "name": "Java", + "description": "Java is a functional computer programming language that is concurrent, class-based, object-oriented, and specifically designed to have as few implementation dependencies as possible. It is intended to let application developers write once, run anywhere (WORA), meaning that code that runs on one platform does not need to be recompiled to run on another. Java applications are typically compiled to bytecode that can run on any Java virtual machine (JVM) regardless of computer architecture. (http://en.wikipedia.org/wiki/Java_(programming_language))", + "properties": { + "sw_runtime_java_version": { + "title": "Version", + "description": "The specific version of Java.", + "type": "string" + } + } + }, + { + "name": "Ruby", + "description": "Ruby is a dynamic, reflective, object-oriented, general-purpose programming language. It was designed and developed in the mid-1990s by Yukihiro Matsumoto in Japan. According to its authors, Ruby was influenced by Perl, Smalltalk, Eiffel, Ada, and Lisp. It supports multiple programming paradigms, including functional, object-oriented, and imperative. It also has a dynamic type system and automatic memory management. (http://en.wikipedia.org/wiki/Python_(programming_language))", + "properties": { + "sw_runtime_ruby_version": { + "title": "Version", + "description": "The specific version of Ruby.", + "type": "string" + } + } + }, + { + "name": "Perl", + "description": "Perl is a family of high-level, general-purpose, interpreted, dynamic programming languages. The languages in this family include Perl 5 and Perl 6. Though Perl is not officially an acronym, there are various backronyms in use, the most well-known being Practical Extraction and Reporting Language (http://en.wikipedia.org/wiki/Perl)", + "properties": { + "sw_runtime_perl_version": { + "title": "Version", + "description": "The specific version of Perl.", + "type": "string" + } + } + } + ] +} diff --git a/openstack/openstack_conf/controller/glance/metadefs/software-webservers.json b/openstack/openstack_conf/controller/glance/metadefs/software-webservers.json new file mode 100644 index 0000000..3fd7540 --- /dev/null +++ b/openstack/openstack_conf/controller/glance/metadefs/software-webservers.json @@ -0,0 +1,103 @@ +{ + "namespace": "OS::Software::WebServers", + "display_name": "Web Servers", + "description": "A web server is a computer system that processes requests via HTTP, the basic network protocol used to distribute information on the World Wide Web. The most common use of web servers is to host websites, but there are other uses such as gaming, data storage, running enterprise applications, handling email, FTP, or other web uses. (http://en.wikipedia.org/wiki/Web_server)", + "visibility": "public", + "protected": true, + "resource_type_associations": [ + { + "name": "OS::Glance::Image" + }, + { + "name": "OS::Cinder::Volume", + "properties_target": "image" + }, + { + "name": "OS::Nova::Server", + "properties_target": "metadata" + } + ], + "objects": [ + { + "name": "Apache HTTP Server", + "description": "The Apache HTTP Server, colloquially called Apache, is a Web server application notable for playing a key role in the initial growth of the World Wide Web. Apache is developed and maintained by an open community of developers under the auspices of the Apache Software Foundation. Most commonly used on a Unix-like system, the software is available for a wide variety of operating systems, including Unix, FreeBSD, Linux, Solaris, Novell NetWare, OS X, Microsoft Windows, OS/2, TPF, OpenVMS and eComStation. Released under the Apache License, Apache is open-source software. (http://en.wikipedia.org/wiki/Apache_HTTP_Server)", + "properties": { + "sw_webserver_apache_version": { + "title": "Version", + "description": "The specific version of Apache.", + "type": "string" + }, + "sw_webserver_apache_http_port": { + "title": "HTTP Port", + "description": "The configured TCP/IP port on which the web server listens for incoming HTTP connections.", + "type": "integer", + "minimum": 1, + "maximum": 65535, + "default": 80 + }, + "sw_webserver_apache_https_port": { + "title": "HTTPS Port", + "description": "The configured TCP/IP port on which the web server listens for incoming HTTPS connections.", + "type": "integer", + "minimum": 1, + "maximum": 65535, + "default": 443 + } + } + }, + { + "name": "Nginx", + "description": "Nginx (pronounced 'engine-x') is an open source reverse proxy server for HTTP, HTTPS, SMTP, POP3, and IMAP protocols, as well as a load balancer, HTTP cache, and a web server (origin server). The nginx project started with a strong focus on high concurrency, high performance and low memory usage. It is licensed under the 2-clause BSD-like license and it runs on Linux, BSD variants, Mac OS X, Solaris, AIX, HP-UX, as well as on other *nix flavors. It also has a proof of concept port for Microsoft Windows. (http://en.wikipedia.org/wiki/Nginx)", + "properties": { + "sw_webserver_nginx_version": { + "title": "Version", + "description": "The specific version of Nginx.", + "type": "string" + }, + "sw_webserver_nginx_http_port": { + "title": "HTTP Port", + "description": "The configured TCP/IP port on which the web server listens for incoming HTTP connections.", + "type": "integer", + "minimum": 1, + "maximum": 65535, + "default": 80 + }, + "sw_webserver_nginx_https_port": { + "title": "HTTPS Port", + "description": "The configured TCP/IP port on which the web server listens for incoming HTTPS connections.", + "type": "integer", + "minimum": 1, + "maximum": 65535, + "default": 443 + } + } + }, + { + "name": "IIS", + "description": "Internet Information Services (IIS, formerly Internet Information Server) is an extensible web server created by Microsoft. IIS supports HTTP, HTTPS, FTP, FTPS, SMTP and NNTP. IIS is not turned on by default when Windows is installed. The IIS Manager is accessed through the Microsoft Management Console or Administrative Tools in the Control Panel. (http://en.wikipedia.org/wiki/Internet_Information_Services)", + "properties": { + "sw_webserver_iis_version": { + "title": "Version", + "description": "The specific version of IIS.", + "type": "string" + }, + "sw_webserver_iis_http_port": { + "title": "HTTP Port", + "description": "The configured TCP/IP port on which the web server listens for incoming HTTP connections.", + "type": "integer", + "minimum": 1, + "maximum": 65535, + "default": 80 + }, + "sw_webserver_iis_https_port": { + "title": "HTTPS Port", + "description": "The configured TCP/IP port on which the web server listens for incoming HTTPS connections.", + "type": "integer", + "minimum": 1, + "maximum": 65535, + "default": 443 + } + } + } + ] +} diff --git a/openstack/openstack_conf/controller/glance/metadefs/storage-volume-type.json b/openstack/openstack_conf/controller/glance/metadefs/storage-volume-type.json new file mode 100644 index 0000000..76d26e5 --- /dev/null +++ b/openstack/openstack_conf/controller/glance/metadefs/storage-volume-type.json @@ -0,0 +1,20 @@ +{ + "namespace": "OS::Cinder::Volumetype", + "display_name": "Cinder Volume Type", + "description": "The Cinder volume type configuration option. Volume type assignment provides a mechanism not only to provide scheduling to a specific storage back-end, but also can be used to specify specific information for a back-end storage device to act upon.", + "visibility": "public", + "protected": true, + "resource_type_associations": [ + { + "name": "OS::Glance::Image", + "prefix": "cinder_" + } + ], + "properties": { + "img_volume_type": { + "title": "Image Volume Type", + "description": "Specifies the volume type that should be applied during new volume creation with a image. This value is passed to Cinder when creating a new volume. Priority of volume type related parameters are 1.volume_type(via API or CLI), 2.cinder_img_volume_type, 3.default_volume_type(via cinder.conf). If not specified, volume_type or default_volume_type will be referred based on their priority.", + "type": "string" + } + } +} diff --git a/openstack/openstack_conf/controller/glance/policy.json b/openstack/openstack_conf/controller/glance/policy.json new file mode 100644 index 0000000..5b1f6be --- /dev/null +++ b/openstack/openstack_conf/controller/glance/policy.json @@ -0,0 +1,63 @@ +{ + "context_is_admin": "role:admin", + "default": "role:admin", + + "add_image": "", + "delete_image": "", + "get_image": "", + "get_images": "", + "modify_image": "", + "publicize_image": "role:admin", + "communitize_image": "", + "copy_from": "", + + "download_image": "", + "upload_image": "", + + "delete_image_location": "", + "get_image_location": "", + "set_image_location": "", + + "add_member": "", + "delete_member": "", + "get_member": "", + "get_members": "", + "modify_member": "", + + "manage_image_cache": "role:admin", + + "get_task": "", + "get_tasks": "", + "add_task": "", + "modify_task": "", + "tasks_api_access": "role:admin", + + "deactivate": "", + "reactivate": "", + + "get_metadef_namespace": "", + "get_metadef_namespaces":"", + "modify_metadef_namespace":"", + "add_metadef_namespace":"", + + "get_metadef_object":"", + "get_metadef_objects":"", + "modify_metadef_object":"", + "add_metadef_object":"", + + "list_metadef_resource_types":"", + "get_metadef_resource_type":"", + "add_metadef_resource_type_association":"", + + "get_metadef_property":"", + "get_metadef_properties":"", + "modify_metadef_property":"", + "add_metadef_property":"", + + "get_metadef_tag":"", + "get_metadef_tags":"", + "modify_metadef_tag":"", + "add_metadef_tag":"", + "add_metadef_tags":"" + +} diff --git a/openstack/openstack_conf/controller/glance/rootwrap.conf b/openstack/openstack_conf/controller/glance/rootwrap.conf new file mode 100644 index 0000000..421dd25 --- /dev/null +++ b/openstack/openstack_conf/controller/glance/rootwrap.conf @@ -0,0 +1,27 @@ +# Configuration for glance-rootwrap +# This file should be owned by (and only-writable by) the root user + +[DEFAULT] +# List of directories to load filter definitions from (separated by ','). +# These directories MUST all be only writeable by root ! +filters_path=/etc/glance/rootwrap.d,/usr/share/glance/rootwrap + +# List of directories to search executables in, in case filters do not +# explicitely specify a full path (separated by ',') +# If not specified, defaults to system PATH environment variable. +# These directories MUST all be only writeable by root ! +exec_dirs=/sbin,/usr/sbin,/bin,/usr/bin,/usr/local/bin,/usr/local/sbin + +# Enable logging to syslog +# Default value is False +use_syslog=False + +# Which syslog facility to use. +# Valid values include auth, authpriv, syslog, local0, local1... +# Default value is 'syslog' +syslog_log_facility=syslog + +# Which messages to log. +# INFO means log all usage +# ERROR means only log unsuccessful attempts +syslog_log_level=ERROR diff --git a/openstack/openstack_conf/controller/glance/rootwrap.d/glance_cinder_store.filters b/openstack/openstack_conf/controller/glance/rootwrap.d/glance_cinder_store.filters new file mode 100644 index 0000000..39f7de6 --- /dev/null +++ b/openstack/openstack_conf/controller/glance/rootwrap.d/glance_cinder_store.filters @@ -0,0 +1,29 @@ +# glance-rootwrap command filters for glance cinder store +# This file should be owned by (and only-writable by) the root user + +[Filters] +# cinder store driver +disk_chown: RegExpFilter, chown, root, chown, \d+, /dev/(?!.*/\.\.).* + +# os-brick +mount: CommandFilter, mount, root +blockdev: RegExpFilter, blockdev, root, blockdev, (--getsize64|--flushbufs), /dev/.* +tee: CommandFilter, tee, root +mkdir: CommandFilter, mkdir, root +chown: RegExpFilter, chown, root, chown root:root /etc/pstorage/clusters/(?!.*/\.\.).* +ip: CommandFilter, ip, root +dd: CommandFilter, dd, root +iscsiadm: CommandFilter, iscsiadm, root +aoe-revalidate: CommandFilter, aoe-revalidate, root +aoe-discover: CommandFilter, aoe-discover, root +aoe-flush: CommandFilter, aoe-flush, root +read_initiator: ReadFileFilter, /etc/iscsi/initiatorname.iscsi +multipath: CommandFilter, multipath, root +multipathd: CommandFilter, multipathd, root +systool: CommandFilter, systool, root +sg_scan: CommandFilter, sg_scan, root +cp: CommandFilter, cp, root +drv_cfg: CommandFilter, /opt/emc/scaleio/sdc/bin/drv_cfg, root, /opt/emc/scaleio/sdc/bin/drv_cfg, --query_guid +sds_cli: CommandFilter, /usr/local/bin/sds/sds_cli, root +vgc-cluster: CommandFilter, vgc-cluster, root +scsi_id: CommandFilter, /lib/udev/scsi_id, root diff --git a/openstack/openstack_conf/controller/glance/schema-image.json b/openstack/openstack_conf/controller/glance/schema-image.json new file mode 100644 index 0000000..dcd802d --- /dev/null +++ b/openstack/openstack_conf/controller/glance/schema-image.json @@ -0,0 +1,28 @@ +{ + "kernel_id": { + "type": ["null", "string"], + "pattern": "^([0-9a-fA-F]){8}-([0-9a-fA-F]){4}-([0-9a-fA-F]){4}-([0-9a-fA-F]){4}-([0-9a-fA-F]){12}$", + "description": "ID of image stored in Glance that should be used as the kernel when booting an AMI-style image." + }, + "ramdisk_id": { + "type": ["null", "string"], + "pattern": "^([0-9a-fA-F]){8}-([0-9a-fA-F]){4}-([0-9a-fA-F]){4}-([0-9a-fA-F]){4}-([0-9a-fA-F]){12}$", + "description": "ID of image stored in Glance that should be used as the ramdisk when booting an AMI-style image." + }, + "instance_uuid": { + "type": "string", + "description": "Metadata which can be used to record which instance this image is associated with. (Informational only, does not create an instance snapshot.)" + }, + "architecture": { + "description": "Operating system architecture as specified in https://docs.openstack.org/python-glanceclient/latest/cli/property-keys.html", + "type": "string" + }, + "os_distro": { + "description": "Common name of operating system distribution as specified in https://docs.openstack.org/python-glanceclient/latest/cli/property-keys.html", + "type": "string" + }, + "os_version": { + "description": "Operating system version as specified by the distributor", + "type": "string" + } +} diff --git a/openstack/openstack_conf/controller/keystone/credential-keys/0 b/openstack/openstack_conf/controller/keystone/credential-keys/0 new file mode 100755 index 0000000..f2c371a --- /dev/null +++ b/openstack/openstack_conf/controller/keystone/credential-keys/0 @@ -0,0 +1 @@ +gJtdriWV8c99gz1V9gvF20QnaHhv0lTNpv24nTaibxw= \ No newline at end of file diff --git a/openstack/openstack_conf/controller/keystone/credential-keys/1 b/openstack/openstack_conf/controller/keystone/credential-keys/1 new file mode 100755 index 0000000..3787332 --- /dev/null +++ b/openstack/openstack_conf/controller/keystone/credential-keys/1 @@ -0,0 +1 @@ +XFzzDnlkbPNLEXKdQTlprhKksDUIuO2oKeA5Qs2a1ds= \ No newline at end of file diff --git a/openstack/openstack_conf/controller/keystone/default_catalog.templates b/openstack/openstack_conf/controller/keystone/default_catalog.templates new file mode 100644 index 0000000..e885b52 --- /dev/null +++ b/openstack/openstack_conf/controller/keystone/default_catalog.templates @@ -0,0 +1,42 @@ +# config for templated.Catalog, using camelCase because I don't want to do +# translations for keystone compat +catalog.RegionOne.identity.publicURL = http://localhost:$(public_port)s/v2.0 +catalog.RegionOne.identity.adminURL = http://localhost:$(admin_port)s/v2.0 +catalog.RegionOne.identity.internalURL = http://localhost:$(public_port)s/v2.0 +catalog.RegionOne.identity.name = Identity Service + +# fake compute service for now to help novaclient tests work +catalog.RegionOne.computev21.publicURL = http://localhost:8774/v2.1/$(tenant_id)s +catalog.RegionOne.computev21.adminURL = http://localhost:8774/v2.1/$(tenant_id)s +catalog.RegionOne.computev21.internalURL = http://localhost:8774/v2.1/$(tenant_id)s +catalog.RegionOne.computev21.name = Compute Service V2.1 + +catalog.RegionOne.volumev2.publicURL = http://localhost:8776/v2/$(tenant_id)s +catalog.RegionOne.volumev2.adminURL = http://localhost:8776/v2/$(tenant_id)s +catalog.RegionOne.volumev2.internalURL = http://localhost:8776/v2/$(tenant_id)s +catalog.RegionOne.volumev2.name = Volume Service V2 + +catalog.RegionOne.ec2.publicURL = http://localhost:8773/services/Cloud +catalog.RegionOne.ec2.adminURL = http://localhost:8773/services/Admin +catalog.RegionOne.ec2.internalURL = http://localhost:8773/services/Cloud +catalog.RegionOne.ec2.name = EC2 Service + +catalog.RegionOne.image.publicURL = http://localhost:9292 +catalog.RegionOne.image.adminURL = http://localhost:9292 +catalog.RegionOne.image.internalURL = http://localhost:9292 +catalog.RegionOne.image.name = Image Service + +catalog.RegionOne.network.publicURL = http://localhost:9696 +catalog.RegionOne.network.adminURL = http://localhost:9696 +catalog.RegionOne.network.internalURL = http://localhost:9696 +catalog.RegionOne.network.name = Network Service + +catalog.RegionOne.orchestration.publicURL = http://localhost:8004/v1/$(tenant_id)s +catalog.RegionOne.orchestration.adminURL = http://localhost:8004/v1/$(tenant_id)s +catalog.RegionOne.orchestration.internalURL = http://localhost:8004/v1/$(tenant_id)s +catalog.RegionOne.orchestration.name = Orchestration Service + +catalog.RegionOne.metering.publicURL = http://localhost:8777 +catalog.RegionOne.metering.adminURL = http://localhost:8777 +catalog.RegionOne.metering.internalURL = http://localhost:8777 +catalog.RegionOne.metering.name = Telemetry Service diff --git a/openstack/openstack_conf/controller/keystone/fernet-keys/0 b/openstack/openstack_conf/controller/keystone/fernet-keys/0 new file mode 100755 index 0000000..97f2556 --- /dev/null +++ b/openstack/openstack_conf/controller/keystone/fernet-keys/0 @@ -0,0 +1 @@ +aqF-v9fByg1EgLEzkU0zEfXtckJckUGEBOPG9vSexmY= \ No newline at end of file diff --git a/openstack/openstack_conf/controller/keystone/fernet-keys/1 b/openstack/openstack_conf/controller/keystone/fernet-keys/1 new file mode 100755 index 0000000..9bcff58 --- /dev/null +++ b/openstack/openstack_conf/controller/keystone/fernet-keys/1 @@ -0,0 +1 @@ +3W1YJkyIxRiEQqQwLIw-QCESwjT06M0BBKCS9rvTVDg= \ No newline at end of file diff --git a/openstack/openstack_conf/controller/keystone/keystone-paste.ini b/openstack/openstack_conf/controller/keystone/keystone-paste.ini new file mode 100644 index 0000000..b629b48 --- /dev/null +++ b/openstack/openstack_conf/controller/keystone/keystone-paste.ini @@ -0,0 +1,92 @@ +# Keystone PasteDeploy configuration file. + +[filter:debug] +use = egg:oslo.middleware#debug + +[filter:request_id] +use = egg:oslo.middleware#request_id + +[filter:build_auth_context] +use = egg:keystone#build_auth_context + +[filter:token_auth] +use = egg:keystone#token_auth + +[filter:json_body] +use = egg:keystone#json_body + +[filter:cors] +use = egg:oslo.middleware#cors +oslo_config_project = keystone + +[filter:http_proxy_to_wsgi] +use = egg:oslo.middleware#http_proxy_to_wsgi + +[filter:healthcheck] +use = egg:oslo.middleware#healthcheck + +[filter:ec2_extension] +use = egg:keystone#ec2_extension + +[filter:ec2_extension_v3] +use = egg:keystone#ec2_extension_v3 + +[filter:s3_extension] +use = egg:keystone#s3_extension + +[filter:url_normalize] +use = egg:keystone#url_normalize + +[filter:sizelimit] +use = egg:oslo.middleware#sizelimit + +[filter:osprofiler] +use = egg:osprofiler#osprofiler + +[app:public_service] +use = egg:keystone#public_service + +[app:service_v3] +use = egg:keystone#service_v3 + +[app:admin_service] +use = egg:keystone#admin_service + +[pipeline:public_api] +# The last item in this pipeline must be public_service or an equivalent +# application. It cannot be a filter. +pipeline = healthcheck cors sizelimit http_proxy_to_wsgi osprofiler url_normalize request_id build_auth_context token_auth json_body ec2_extension public_service + +[pipeline:admin_api] +# The last item in this pipeline must be admin_service or an equivalent +# application. It cannot be a filter. +pipeline = healthcheck cors sizelimit http_proxy_to_wsgi osprofiler url_normalize request_id build_auth_context token_auth json_body ec2_extension s3_extension admin_service + +[pipeline:api_v3] +# The last item in this pipeline must be service_v3 or an equivalent +# application. It cannot be a filter. +pipeline = healthcheck cors sizelimit http_proxy_to_wsgi osprofiler url_normalize request_id build_auth_context token_auth json_body ec2_extension_v3 s3_extension service_v3 + +[app:public_version_service] +use = egg:keystone#public_version_service + +[app:admin_version_service] +use = egg:keystone#admin_version_service + +[pipeline:public_version_api] +pipeline = healthcheck cors sizelimit osprofiler url_normalize public_version_service + +[pipeline:admin_version_api] +pipeline = healthcheck cors sizelimit osprofiler url_normalize admin_version_service + +[composite:main] +use = egg:Paste#urlmap +/v2.0 = public_api +/v3 = api_v3 +/ = public_version_api + +[composite:admin] +use = egg:Paste#urlmap +/v2.0 = admin_api +/v3 = api_v3 +/ = admin_version_api diff --git a/openstack/openstack_conf/controller/keystone/keystone.conf b/openstack/openstack_conf/controller/keystone/keystone.conf new file mode 100644 index 0000000..faa5137 --- /dev/null +++ b/openstack/openstack_conf/controller/keystone/keystone.conf @@ -0,0 +1,3075 @@ +[DEFAULT] +log_dir = /var/log/keystone + +# +# From keystone +# + +# Using this feature is *NOT* recommended. Instead, use the `keystone-manage +# bootstrap` command. The value of this option is treated as a "shared secret" +# that can be used to bootstrap Keystone through the API. This "token" does not +# represent a user (it has no identity), and carries no explicit authorization +# (it effectively bypasses most authorization checks). If set to `None`, the +# value is ignored and the `admin_token` middleware is effectively disabled. +# (string value) +#admin_token = + +# The base public endpoint URL for Keystone that is advertised to clients +# (NOTE: this does NOT affect how Keystone listens for connections). Defaults +# to the base host URL of the request. For example, if keystone receives a +# request to `http://server:5000/v3/users`, then this will option will be +# automatically treated as `http://server:5000`. You should only need to set +# option if either the value of the base URL contains a path that keystone does +# not automatically infer (`/prefix/v3`), or if the endpoint should be found on +# a different host. (uri value) +#public_endpoint = + +# The base admin endpoint URL for Keystone that is advertised to clients (NOTE: +# this does NOT affect how Keystone listens for connections). Defaults to the +# base host URL of the request. For example, if keystone receives a request to +# `http://server:35357/v3/users`, then this will option will be automatically +# treated as `http://server:35357`. You should only need to set option if +# either the value of the base URL contains a path that keystone does not +# automatically infer (`/prefix/v3`), or if the endpoint should be found on a +# different host. (uri value) +#admin_endpoint = + +# Maximum depth of the project hierarchy, excluding the project acting as a +# domain at the top of the hierarchy. WARNING: Setting it to a large value may +# adversely impact performance. (integer value) +#max_project_tree_depth = 5 + +# Limit the sizes of user & project ID/names. (integer value) +#max_param_size = 64 + +# Similar to `[DEFAULT] max_param_size`, but provides an exception for token +# values. With Fernet tokens, this can be set as low as 255. With UUID tokens, +# this should be set to 32). (integer value) +#max_token_size = 255 + +# DEPRECATED: Similar to the `[DEFAULT] member_role_name` option, this +# represents the default role ID used to associate users with their default +# projects in the v2 API. This will be used as the explicit role where one is +# not specified by the v2 API. You do not need to set this value unless you +# want keystone to use an existing role with a different ID, other than the +# arbitrarily defined `_member_` role (in which case, you should set `[DEFAULT] +# member_role_name` as well). (string value) +# This option is deprecated for removal since Q. +# Its value may be silently ignored in the future. +# Reason: This option was used to create a default member role for keystone v2 +# role assignments, but with the removal of the v2 API it is no longer +# necessary to create this default role. This option is deprecated and will be +# removed in the S release. If you are depending on having a predictable role +# name and ID for this member role you will need to update your tooling. +#member_role_id = 9fe2ff9ee4384b1894a90878d3e92bab + +# DEPRECATED: This is the role name used in combination with the `[DEFAULT] +# member_role_id` option; see that option for more detail. You do not need to +# set this option unless you want keystone to use an existing role (in which +# case, you should set `[DEFAULT] member_role_id` as well). (string value) +# This option is deprecated for removal since Q. +# Its value may be silently ignored in the future. +# Reason: This option was used to create a default member role for keystone v2 +# role assignments, but with the removal of the v2 API it is no longer +# necessary to create this default role. This option is deprecated and will be +# removed in the S release. If you are depending on having a predictable role +# name and ID for this member role you will need to update your tooling. +#member_role_name = _member_ + +# The value passed as the keyword "rounds" to passlib's encrypt method. This +# option represents a trade off between security and performance. Higher values +# lead to slower performance, but higher security. Changing this option will +# only affect newly created passwords as existing password hashes already have +# a fixed number of rounds applied, so it is safe to tune this option in a +# running cluster. For more information, see +# https://pythonhosted.org/passlib/password_hash_api.html#choosing-the-right- +# rounds-value (integer value) +# Minimum value: 1000 +# Maximum value: 100000 +#crypt_strength = 10000 + +# The maximum number of entities that will be returned in a collection. This +# global limit may be then overridden for a specific driver, by specifying a +# list_limit in the appropriate section (for example, `[assignment]`). No limit +# is set by default. In larger deployments, it is recommended that you set this +# to a reasonable number to prevent operations like listing all users and +# projects from placing an unnecessary load on the system. (integer value) +#list_limit = + +# If set to true, strict password length checking is performed for password +# manipulation. If a password exceeds the maximum length, the operation will +# fail with an HTTP 403 Forbidden error. If set to false, passwords are +# automatically truncated to the maximum length. (boolean value) +#strict_password_check = false + +# DEPRECATED: The HTTP header used to determine the scheme for the original +# request, even if it was removed by an SSL terminating proxy. (string value) +# This option is deprecated for removal since N. +# Its value may be silently ignored in the future. +# Reason: This option has been deprecated in the N release and will be removed +# in the P release. Use oslo.middleware.http_proxy_to_wsgi configuration +# instead. +#secure_proxy_ssl_header = HTTP_X_FORWARDED_PROTO + +# If set to true, then the server will return information in HTTP responses +# that may allow an unauthenticated or authenticated user to get more +# information than normal, such as additional details about why authentication +# failed. This may be useful for debugging but is insecure. (boolean value) +#insecure_debug = false + +# Default `publisher_id` for outgoing notifications. If left undefined, +# Keystone will default to using the server's host name. (string value) +#default_publisher_id = + +# Define the notification format for identity service events. A `basic` +# notification only has information about the resource being operated on. A +# `cadf` notification has the same information, as well as information about +# the initiator of the event. The `cadf` option is entirely backwards +# compatible with the `basic` option, but is fully CADF-compliant, and is +# recommended for auditing use cases. (string value) +# Possible values: +# basic - +# cadf - +#notification_format = cadf + +# You can reduce the number of notifications keystone emits by explicitly +# opting out. Keystone will not emit notifications that match the patterns +# expressed in this list. Values are expected to be in the form of +# `identity..`. By default, all notifications related +# to authentication are automatically suppressed. This field can be set +# multiple times in order to opt-out of multiple notification topics. For +# example, the following suppresses notifications describing user creation or +# successful authentication events: notification_opt_out=identity.user.create +# notification_opt_out=identity.authenticate.success (multi valued) +#notification_opt_out = identity.authenticate.success +#notification_opt_out = identity.authenticate.pending +#notification_opt_out = identity.authenticate.failed + +# +# From oslo.log +# + +# If set to true, the logging level will be set to DEBUG instead of the default +# INFO level. (boolean value) +# Note: This option can be changed without restarting. +#debug = false + +# The name of a logging configuration file. This file is appended to any +# existing logging configuration files. For details about logging configuration +# files, see the Python logging module documentation. Note that when logging +# configuration files are used then all logging configuration is set in the +# configuration file and other logging configuration options are ignored (for +# example, logging_context_format_string). (string value) +# Note: This option can be changed without restarting. +# Deprecated group/name - [DEFAULT]/log_config +#log_config_append = + +# Defines the format string for %%(asctime)s in log records. Default: +# %(default)s . This option is ignored if log_config_append is set. (string +# value) +#log_date_format = %Y-%m-%d %H:%M:%S + +# (Optional) Name of log file to send logging output to. If no default is set, +# logging will go to stderr as defined by use_stderr. This option is ignored if +# log_config_append is set. (string value) +# Deprecated group/name - [DEFAULT]/logfile +#log_file = + +# (Optional) The base directory used for relative log_file paths. This option +# is ignored if log_config_append is set. (string value) +# Deprecated group/name - [DEFAULT]/logdir +#log_dir = + +# Uses logging handler designed to watch file system. When log file is moved or +# removed this handler will open a new log file with specified path +# instantaneously. It makes sense only if log_file option is specified and +# Linux platform is used. This option is ignored if log_config_append is set. +# (boolean value) +#watch_log_file = false + +# Use syslog for logging. Existing syslog format is DEPRECATED and will be +# changed later to honor RFC5424. This option is ignored if log_config_append +# is set. (boolean value) +#use_syslog = false + +# Enable journald for logging. If running in a systemd environment you may wish +# to enable journal support. Doing so will use the journal native protocol +# which includes structured metadata in addition to log messages.This option is +# ignored if log_config_append is set. (boolean value) +#use_journal = false + +# Syslog facility to receive log lines. This option is ignored if +# log_config_append is set. (string value) +#syslog_log_facility = LOG_USER + +# Use JSON formatting for logging. This option is ignored if log_config_append +# is set. (boolean value) +#use_json = false + +# Log output to standard error. This option is ignored if log_config_append is +# set. (boolean value) +#use_stderr = false + +# Format string to use for log messages with context. (string value) +#logging_context_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user_identity)s] %(instance)s%(message)s + +# Format string to use for log messages when context is undefined. (string +# value) +#logging_default_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [-] %(instance)s%(message)s + +# Additional data to append to log message when logging level for the message +# is DEBUG. (string value) +#logging_debug_format_suffix = %(funcName)s %(pathname)s:%(lineno)d + +# Prefix each line of exception output with this format. (string value) +#logging_exception_prefix = %(asctime)s.%(msecs)03d %(process)d ERROR %(name)s %(instance)s + +# Defines the format string for %(user_identity)s that is used in +# logging_context_format_string. (string value) +#logging_user_identity_format = %(user)s %(tenant)s %(domain)s %(user_domain)s %(project_domain)s + +# List of package logging levels in logger=LEVEL pairs. This option is ignored +# if log_config_append is set. (list value) +#default_log_levels = amqp=WARN,amqplib=WARN,boto=WARN,qpid=WARN,sqlalchemy=WARN,suds=INFO,oslo.messaging=INFO,oslo_messaging=INFO,iso8601=WARN,requests.packages.urllib3.connectionpool=WARN,urllib3.connectionpool=WARN,websocket=WARN,requests.packages.urllib3.util.retry=WARN,urllib3.util.retry=WARN,keystonemiddleware=WARN,routes.middleware=WARN,stevedore=WARN,taskflow=WARN,keystoneauth=WARN,oslo.cache=INFO,dogpile.core.dogpile=INFO + +# Enables or disables publication of error events. (boolean value) +#publish_errors = false + +# The format for an instance that is passed with the log message. (string +# value) +#instance_format = "[instance: %(uuid)s] " + +# The format for an instance UUID that is passed with the log message. (string +# value) +#instance_uuid_format = "[instance: %(uuid)s] " + +# Interval, number of seconds, of log rate limiting. (integer value) +#rate_limit_interval = 0 + +# Maximum number of logged messages per rate_limit_interval. (integer value) +#rate_limit_burst = 0 + +# Log level name used by rate limiting: CRITICAL, ERROR, INFO, WARNING, DEBUG +# or empty string. Logs with level greater or equal to rate_limit_except_level +# are not filtered. An empty string means that all levels are filtered. (string +# value) +#rate_limit_except_level = CRITICAL + +# Enables or disables fatal status of deprecations. (boolean value) +#fatal_deprecations = false + +# +# From oslo.messaging +# + +# Size of RPC connection pool. (integer value) +#rpc_conn_pool_size = 30 + +# The pool size limit for connections expiration policy (integer value) +#conn_pool_min_size = 2 + +# The time-to-live in sec of idle connections in the pool (integer value) +#conn_pool_ttl = 1200 + +# ZeroMQ bind address. Should be a wildcard (*), an ethernet interface, or IP. +# The "host" option should point or resolve to this address. (string value) +#rpc_zmq_bind_address = * + +# MatchMaker driver. (string value) +# Possible values: +# redis - +# sentinel - +# dummy - +#rpc_zmq_matchmaker = redis + +# Number of ZeroMQ contexts, defaults to 1. (integer value) +#rpc_zmq_contexts = 1 + +# Maximum number of ingress messages to locally buffer per topic. Default is +# unlimited. (integer value) +#rpc_zmq_topic_backlog = + +# Directory for holding IPC sockets. (string value) +#rpc_zmq_ipc_dir = /var/run/openstack + +# Name of this node. Must be a valid hostname, FQDN, or IP address. Must match +# "host" option, if running Nova. (string value) +#rpc_zmq_host = localhost + +# Number of seconds to wait before all pending messages will be sent after +# closing a socket. The default value of -1 specifies an infinite linger +# period. The value of 0 specifies no linger period. Pending messages shall be +# discarded immediately when the socket is closed. Positive values specify an +# upper bound for the linger period. (integer value) +# Deprecated group/name - [DEFAULT]/rpc_cast_timeout +#zmq_linger = -1 + +# The default number of seconds that poll should wait. Poll raises timeout +# exception when timeout expired. (integer value) +#rpc_poll_timeout = 1 + +# Expiration timeout in seconds of a name service record about existing target +# ( < 0 means no timeout). (integer value) +#zmq_target_expire = 300 + +# Update period in seconds of a name service record about existing target. +# (integer value) +#zmq_target_update = 180 + +# Use PUB/SUB pattern for fanout methods. PUB/SUB always uses proxy. (boolean +# value) +#use_pub_sub = false + +# Use ROUTER remote proxy. (boolean value) +#use_router_proxy = false + +# This option makes direct connections dynamic or static. It makes sense only +# with use_router_proxy=False which means to use direct connections for direct +# message types (ignored otherwise). (boolean value) +#use_dynamic_connections = false + +# How many additional connections to a host will be made for failover reasons. +# This option is actual only in dynamic connections mode. (integer value) +#zmq_failover_connections = 2 + +# Minimal port number for random ports range. (port value) +# Minimum value: 0 +# Maximum value: 65535 +#rpc_zmq_min_port = 49153 + +# Maximal port number for random ports range. (integer value) +# Minimum value: 1 +# Maximum value: 65536 +#rpc_zmq_max_port = 65536 + +# Number of retries to find free port number before fail with ZMQBindError. +# (integer value) +#rpc_zmq_bind_port_retries = 100 + +# Default serialization mechanism for serializing/deserializing +# outgoing/incoming messages (string value) +# Possible values: +# json - +# msgpack - +#rpc_zmq_serialization = json + +# This option configures round-robin mode in zmq socket. True means not keeping +# a queue when server side disconnects. False means to keep queue and messages +# even if server is disconnected, when the server appears we send all +# accumulated messages to it. (boolean value) +#zmq_immediate = true + +# Enable/disable TCP keepalive (KA) mechanism. The default value of -1 (or any +# other negative value) means to skip any overrides and leave it to OS default; +# 0 and 1 (or any other positive value) mean to disable and enable the option +# respectively. (integer value) +#zmq_tcp_keepalive = -1 + +# The duration between two keepalive transmissions in idle condition. The unit +# is platform dependent, for example, seconds in Linux, milliseconds in Windows +# etc. The default value of -1 (or any other negative value and 0) means to +# skip any overrides and leave it to OS default. (integer value) +#zmq_tcp_keepalive_idle = -1 + +# The number of retransmissions to be carried out before declaring that remote +# end is not available. The default value of -1 (or any other negative value +# and 0) means to skip any overrides and leave it to OS default. (integer +# value) +#zmq_tcp_keepalive_cnt = -1 + +# The duration between two successive keepalive retransmissions, if +# acknowledgement to the previous keepalive transmission is not received. The +# unit is platform dependent, for example, seconds in Linux, milliseconds in +# Windows etc. The default value of -1 (or any other negative value and 0) +# means to skip any overrides and leave it to OS default. (integer value) +#zmq_tcp_keepalive_intvl = -1 + +# Maximum number of (green) threads to work concurrently. (integer value) +#rpc_thread_pool_size = 100 + +# Expiration timeout in seconds of a sent/received message after which it is +# not tracked anymore by a client/server. (integer value) +#rpc_message_ttl = 300 + +# Wait for message acknowledgements from receivers. This mechanism works only +# via proxy without PUB/SUB. (boolean value) +#rpc_use_acks = false + +# Number of seconds to wait for an ack from a cast/call. After each retry +# attempt this timeout is multiplied by some specified multiplier. (integer +# value) +#rpc_ack_timeout_base = 15 + +# Number to multiply base ack timeout by after each retry attempt. (integer +# value) +#rpc_ack_timeout_multiplier = 2 + +# Default number of message sending attempts in case of any problems occurred: +# positive value N means at most N retries, 0 means no retries, None or -1 (or +# any other negative values) mean to retry forever. This option is used only if +# acknowledgments are enabled. (integer value) +#rpc_retry_attempts = 3 + +# List of publisher hosts SubConsumer can subscribe on. This option has higher +# priority then the default publishers list taken from the matchmaker. (list +# value) +#subscribe_on = + +# Size of executor thread pool when executor is threading or eventlet. (integer +# value) +# Deprecated group/name - [DEFAULT]/rpc_thread_pool_size +#executor_thread_pool_size = 64 + +# Seconds to wait for a response from a call. (integer value) +#rpc_response_timeout = 60 + +# The network address and optional user credentials for connecting to the +# messaging backend, in URL format. The expected format is: +# +# driver://[user:pass@]host:port[,[userN:passN@]hostN:portN]/virtual_host?query +# +# Example: rabbit://rabbitmq:password@127.0.0.1:5672// +# +# For full details on the fields in the URL see the documentation of +# oslo_messaging.TransportURL at +# https://docs.openstack.org/oslo.messaging/latest/reference/transport.html +# (string value) +#transport_url = + +# DEPRECATED: The messaging driver to use, defaults to rabbit. Other drivers +# include amqp and zmq. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#rpc_backend = rabbit + +# The default exchange under which topics are scoped. May be overridden by an +# exchange name specified in the transport_url option. (string value) +#control_exchange = keystone + + +[application_credential] + +# +# From keystone +# + +# Entry point for the application credential backend driver in the +# `keystone.application_credential` namespace. Keystone only provides a `sql` +# driver, so there is no reason to change this unless you are providing a +# custom entry point. (string value) +#driver = sql + +# Toggle for application credential caching. This has no effect unless global +# caching is enabled. (boolean value) +#caching = true + +# Time to cache application credential data in seconds. This has no effect +# unless global caching is enabled. (integer value) +#cache_time = + +# Maximum number of application credentials a user is permitted to create. A +# value of -1 means unlimited. If a limit is not set, users are permitted to +# create application credentials at will, which could lead to bloat in the +# keystone database or open keystone to a DoS attack. (integer value) +#user_limit = -1 + + +[assignment] + +# +# From keystone +# + +# Entry point for the assignment backend driver (where role assignments are +# stored) in the `keystone.assignment` namespace. Only a SQL driver is supplied +# by keystone itself. Unless you are writing proprietary drivers for keystone, +# you do not need to set this option. (string value) +#driver = sql + +# A list of role names which are prohibited from being an implied role. (list +# value) +#prohibited_implied_role = admin + + +[auth] + +# +# From keystone +# + +# Allowed authentication methods. Note: You should disable the `external` auth +# method if you are currently using federation. External auth and federation +# both use the REMOTE_USER variable. Since both the mapped and external plugin +# are being invoked to validate attributes in the request environment, it can +# cause conflicts. (list value) +#methods = external,password,token,oauth1,mapped,application_credential + +# Entry point for the password auth plugin module in the +# `keystone.auth.password` namespace. You do not need to set this unless you +# are overriding keystone's own password authentication plugin. (string value) +#password = + +# Entry point for the token auth plugin module in the `keystone.auth.token` +# namespace. You do not need to set this unless you are overriding keystone's +# own token authentication plugin. (string value) +#token = + +# Entry point for the external (`REMOTE_USER`) auth plugin module in the +# `keystone.auth.external` namespace. Supplied drivers are `DefaultDomain` and +# `Domain`. The default driver is `DefaultDomain`, which assumes that all users +# identified by the username specified to keystone in the `REMOTE_USER` +# variable exist within the context of the default domain. The `Domain` option +# expects an additional environment variable be presented to keystone, +# `REMOTE_DOMAIN`, containing the domain name of the `REMOTE_USER` (if +# `REMOTE_DOMAIN` is not set, then the default domain will be used instead). +# You do not need to set this unless you are taking advantage of "external +# authentication", where the application server (such as Apache) is handling +# authentication instead of keystone. (string value) +#external = + +# Entry point for the OAuth 1.0a auth plugin module in the +# `keystone.auth.oauth1` namespace. You do not need to set this unless you are +# overriding keystone's own `oauth1` authentication plugin. (string value) +#oauth1 = + +# Entry point for the mapped auth plugin module in the `keystone.auth.mapped` +# namespace. You do not need to set this unless you are overriding keystone's +# own `mapped` authentication plugin. (string value) +#mapped = + +# Entry point for the application_credential auth plugin module in the +# `keystone.auth.application_credential` namespace. You do not need to set this +# unless you are overriding keystone's own `application_credential` +# authentication plugin. (string value) +#application_credential = + + +[cache] + +# +# From oslo.cache +# + +# Prefix for building the configuration dictionary for the cache region. This +# should not need to be changed unless there is another dogpile.cache region +# with the same configuration name. (string value) +#config_prefix = cache.oslo + +# Default TTL, in seconds, for any cached item in the dogpile.cache region. +# This applies to any cached method that doesn't have an explicit cache +# expiration time defined for it. (integer value) +#expiration_time = 600 + +# Cache backend module. For eventlet-based or environments with hundreds of +# threaded servers, Memcache with pooling (oslo_cache.memcache_pool) is +# recommended. For environments with less than 100 threaded servers, Memcached +# (dogpile.cache.memcached) or Redis (dogpile.cache.redis) is recommended. Test +# environments with a single instance of the server can use the +# dogpile.cache.memory backend. (string value) +# Possible values: +# oslo_cache.memcache_pool - +# oslo_cache.dict - +# oslo_cache.mongo - +# oslo_cache.etcd3gw - +# dogpile.cache.memcached - +# dogpile.cache.pylibmc - +# dogpile.cache.bmemcached - +# dogpile.cache.dbm - +# dogpile.cache.redis - +# dogpile.cache.memory - +# dogpile.cache.memory_pickle - +# dogpile.cache.null - +#backend = dogpile.cache.null + +# Arguments supplied to the backend module. Specify this option once per +# argument to be passed to the dogpile.cache backend. Example format: +# ":". (multi valued) +#backend_argument = + +# Proxy classes to import that will affect the way the dogpile.cache backend +# functions. See the dogpile.cache documentation on changing-backend-behavior. +# (list value) +#proxies = + +# Global toggle for caching. (boolean value) +#enabled = true + +# Extra debugging from the cache backend (cache keys, get/set/delete/etc +# calls). This is only really useful if you need to see the specific cache- +# backend get/set/delete calls with the keys/values. Typically this should be +# left set to false. (boolean value) +#debug_cache_backend = false + +# Memcache servers in the format of "host:port". (dogpile.cache.memcache and +# oslo_cache.memcache_pool backends only). (list value) +#memcache_servers = localhost:11211 + +# Number of seconds memcached server is considered dead before it is tried +# again. (dogpile.cache.memcache and oslo_cache.memcache_pool backends only). +# (integer value) +#memcache_dead_retry = 300 + +# Timeout in seconds for every call to a server. (dogpile.cache.memcache and +# oslo_cache.memcache_pool backends only). (integer value) +#memcache_socket_timeout = 3 + +# Max total number of open connections to every memcached server. +# (oslo_cache.memcache_pool backend only). (integer value) +#memcache_pool_maxsize = 10 + +# Number of seconds a connection to memcached is held unused in the pool before +# it is closed. (oslo_cache.memcache_pool backend only). (integer value) +#memcache_pool_unused_timeout = 60 + +# Number of seconds that an operation will wait to get a memcache client +# connection. (integer value) +#memcache_pool_connection_get_timeout = 10 + + +[catalog] + +# +# From keystone +# + +# Absolute path to the file used for the templated catalog backend. This option +# is only used if the `[catalog] driver` is set to `templated`. (string value) +#template_file = default_catalog.templates + +# Entry point for the catalog driver in the `keystone.catalog` namespace. +# Keystone provides a `sql` option (which supports basic CRUD operations +# through SQL), a `templated` option (which loads the catalog from a templated +# catalog file on disk), and a `endpoint_filter.sql` option (which supports +# arbitrary service catalogs per project). (string value) +#driver = sql + +# Toggle for catalog caching. This has no effect unless global caching is +# enabled. In a typical deployment, there is no reason to disable this. +# (boolean value) +#caching = true + +# Time to cache catalog data (in seconds). This has no effect unless global and +# catalog caching are both enabled. Catalog data (services, endpoints, etc.) +# typically does not change frequently, and so a longer duration than the +# global default may be desirable. (integer value) +#cache_time = + +# Maximum number of entities that will be returned in a catalog collection. +# There is typically no reason to set this, as it would be unusual for a +# deployment to have enough services or endpoints to exceed a reasonable limit. +# (integer value) +#list_limit = + + +[cors] + +# +# From oslo.middleware +# + +# Indicate whether this resource may be shared with the domain received in the +# requests "origin" header. Format: "://[:]", no trailing +# slash. Example: https://horizon.example.com (list value) +#allowed_origin = + +# Indicate that the actual request can include user credentials (boolean value) +#allow_credentials = true + +# Indicate which headers are safe to expose to the API. Defaults to HTTP Simple +# Headers. (list value) +#expose_headers = X-Auth-Token,X-Openstack-Request-Id,X-Subject-Token + +# Maximum cache age of CORS preflight requests. (integer value) +#max_age = 3600 + +# Indicate which methods can be used during the actual request. (list value) +#allow_methods = GET,PUT,POST,DELETE,PATCH + +# Indicate which header field names may be used during the actual request. +# (list value) +#allow_headers = X-Auth-Token,X-Openstack-Request-Id,X-Subject-Token,X-Project-Id,X-Project-Name,X-Project-Domain-Id,X-Project-Domain-Name,X-Domain-Id,X-Domain-Name + + +[credential] + +# +# From keystone +# + +# Entry point for the credential backend driver in the `keystone.credential` +# namespace. Keystone only provides a `sql` driver, so there's no reason to +# change this unless you are providing a custom entry point. (string value) +#driver = sql + +# Entry point for credential encryption and decryption operations in the +# `keystone.credential.provider` namespace. Keystone only provides a `fernet` +# driver, so there's no reason to change this unless you are providing a custom +# entry point to encrypt and decrypt credentials. (string value) +#provider = fernet + +# Directory containing Fernet keys used to encrypt and decrypt credentials +# stored in the credential backend. Fernet keys used to encrypt credentials +# have no relationship to Fernet keys used to encrypt Fernet tokens. Both sets +# of keys should be managed separately and require different rotation policies. +# Do not share this repository with the repository used to manage keys for +# Fernet tokens. (string value) +#key_repository = /etc/keystone/credential-keys/ + + +[database] +connection = mysql+pymysql://keystone:keystone_db_secret@controller/keystone + +# +# From oslo.db +# + +# If True, SQLite uses synchronous mode. (boolean value) +#sqlite_synchronous = true + +# The back end to use for the database. (string value) +# Deprecated group/name - [DEFAULT]/db_backend +#backend = sqlalchemy + +# The SQLAlchemy connection string to use to connect to the database. (string +# value) +# Deprecated group/name - [DEFAULT]/sql_connection +# Deprecated group/name - [DATABASE]/sql_connection +# Deprecated group/name - [sql]/connection +#connection = + +# The SQLAlchemy connection string to use to connect to the slave database. +# (string value) +#slave_connection = + +# The SQL mode to be used for MySQL sessions. This option, including the +# default, overrides any server-set SQL mode. To use whatever SQL mode is set +# by the server configuration, set this to no value. Example: mysql_sql_mode= +# (string value) +#mysql_sql_mode = TRADITIONAL + +# If True, transparently enables support for handling MySQL Cluster (NDB). +# (boolean value) +#mysql_enable_ndb = false + +# Connections which have been present in the connection pool longer than this +# number of seconds will be replaced with a new one the next time they are +# checked out from the pool. (integer value) +# Deprecated group/name - [DATABASE]/idle_timeout +# Deprecated group/name - [database]/idle_timeout +# Deprecated group/name - [DEFAULT]/sql_idle_timeout +# Deprecated group/name - [DATABASE]/sql_idle_timeout +# Deprecated group/name - [sql]/idle_timeout +#connection_recycle_time = 3600 + +# Minimum number of SQL connections to keep open in a pool. (integer value) +# Deprecated group/name - [DEFAULT]/sql_min_pool_size +# Deprecated group/name - [DATABASE]/sql_min_pool_size +#min_pool_size = 1 + +# Maximum number of SQL connections to keep open in a pool. Setting a value of +# 0 indicates no limit. (integer value) +# Deprecated group/name - [DEFAULT]/sql_max_pool_size +# Deprecated group/name - [DATABASE]/sql_max_pool_size +#max_pool_size = 5 + +# Maximum number of database connection retries during startup. Set to -1 to +# specify an infinite retry count. (integer value) +# Deprecated group/name - [DEFAULT]/sql_max_retries +# Deprecated group/name - [DATABASE]/sql_max_retries +#max_retries = 10 + +# Interval between retries of opening a SQL connection. (integer value) +# Deprecated group/name - [DEFAULT]/sql_retry_interval +# Deprecated group/name - [DATABASE]/reconnect_interval +#retry_interval = 10 + +# If set, use this value for max_overflow with SQLAlchemy. (integer value) +# Deprecated group/name - [DEFAULT]/sql_max_overflow +# Deprecated group/name - [DATABASE]/sqlalchemy_max_overflow +#max_overflow = 50 + +# Verbosity of SQL debugging information: 0=None, 100=Everything. (integer +# value) +# Minimum value: 0 +# Maximum value: 100 +# Deprecated group/name - [DEFAULT]/sql_connection_debug +#connection_debug = 0 + +# Add Python stack traces to SQL as comment strings. (boolean value) +# Deprecated group/name - [DEFAULT]/sql_connection_trace +#connection_trace = false + +# If set, use this value for pool_timeout with SQLAlchemy. (integer value) +# Deprecated group/name - [DATABASE]/sqlalchemy_pool_timeout +#pool_timeout = + +# Enable the experimental use of database reconnect on connection lost. +# (boolean value) +#use_db_reconnect = false + +# Seconds between retries of a database transaction. (integer value) +#db_retry_interval = 1 + +# If True, increases the interval between retries of a database operation up to +# db_max_retry_interval. (boolean value) +#db_inc_retry_interval = true + +# If db_inc_retry_interval is set, the maximum seconds between retries of a +# database operation. (integer value) +#db_max_retry_interval = 10 + +# Maximum retries in case of connection error or deadlock error before error is +# raised. Set to -1 to specify an infinite retry count. (integer value) +#db_max_retries = 20 + + +[domain_config] + +# +# From keystone +# + +# Entry point for the domain-specific configuration driver in the +# `keystone.resource.domain_config` namespace. Only a `sql` option is provided +# by keystone, so there is no reason to set this unless you are providing a +# custom entry point. (string value) +#driver = sql + +# Toggle for caching of the domain-specific configuration backend. This has no +# effect unless global caching is enabled. There is normally no reason to +# disable this. (boolean value) +#caching = true + +# Time-to-live (TTL, in seconds) to cache domain-specific configuration data. +# This has no effect unless `[domain_config] caching` is enabled. (integer +# value) +#cache_time = 300 + + +[endpoint_filter] + +# +# From keystone +# + +# Entry point for the endpoint filter driver in the `keystone.endpoint_filter` +# namespace. Only a `sql` option is provided by keystone, so there is no reason +# to set this unless you are providing a custom entry point. (string value) +#driver = sql + +# This controls keystone's behavior if the configured endpoint filters do not +# result in any endpoints for a user + project pair (and therefore a +# potentially empty service catalog). If set to true, keystone will return the +# entire service catalog. If set to false, keystone will return an empty +# service catalog. (boolean value) +#return_all_endpoints_if_no_filter = true + + +[endpoint_policy] + +# +# From keystone +# + +# Entry point for the endpoint policy driver in the `keystone.endpoint_policy` +# namespace. Only a `sql` driver is provided by keystone, so there is no reason +# to set this unless you are providing a custom entry point. (string value) +#driver = sql + + +[eventlet_server] + +# +# From keystone +# + +# DEPRECATED: The IP address of the network interface for the public service to +# listen on. (unknown value) +# Deprecated group/name - [DEFAULT]/bind_host +# Deprecated group/name - [DEFAULT]/public_bind_host +# This option is deprecated for removal since K. +# Its value may be silently ignored in the future. +# Reason: Support for running keystone under eventlet has been removed in the +# Newton release. These options remain for backwards compatibility because they +# are used for URL substitutions. +#public_bind_host = 0.0.0.0 + +# DEPRECATED: The port number for the public service to listen on. (port value) +# Minimum value: 0 +# Maximum value: 65535 +# Deprecated group/name - [DEFAULT]/public_port +# This option is deprecated for removal since K. +# Its value may be silently ignored in the future. +# Reason: Support for running keystone under eventlet has been removed in the +# Newton release. These options remain for backwards compatibility because they +# are used for URL substitutions. +#public_port = 5000 + +# DEPRECATED: The IP address of the network interface for the admin service to +# listen on. (unknown value) +# Deprecated group/name - [DEFAULT]/bind_host +# Deprecated group/name - [DEFAULT]/admin_bind_host +# This option is deprecated for removal since K. +# Its value may be silently ignored in the future. +# Reason: Support for running keystone under eventlet has been removed in the +# Newton release. These options remain for backwards compatibility because they +# are used for URL substitutions. +#admin_bind_host = 0.0.0.0 + +# DEPRECATED: The port number for the admin service to listen on. (port value) +# Minimum value: 0 +# Maximum value: 65535 +# Deprecated group/name - [DEFAULT]/admin_port +# This option is deprecated for removal since K. +# Its value may be silently ignored in the future. +# Reason: Support for running keystone under eventlet has been removed in the +# Newton release. These options remain for backwards compatibility because they +# are used for URL substitutions. +#admin_port = 35357 + + +[extra_headers] + +# +# From keystone +# + +# Specifies the distribution of the keystone server. (string value) +#Distribution = Ubuntu + + +[federation] + +# +# From keystone +# + +# Entry point for the federation backend driver in the `keystone.federation` +# namespace. Keystone only provides a `sql` driver, so there is no reason to +# set this option unless you are providing a custom entry point. (string value) +#driver = sql + +# Prefix to use when filtering environment variable names for federated +# assertions. Matched variables are passed into the federated mapping engine. +# (string value) +#assertion_prefix = + +# Value to be used to obtain the entity ID of the Identity Provider from the +# environment. For `mod_shib`, this would be `Shib-Identity-Provider`. For +# `mod_auth_openidc`, this could be `HTTP_OIDC_ISS`. For `mod_auth_mellon`, +# this could be `MELLON_IDP`. (string value) +#remote_id_attribute = + +# An arbitrary domain name that is reserved to allow federated ephemeral users +# to have a domain concept. Note that an admin will not be able to create a +# domain with this name or update an existing domain to this name. You are not +# advised to change this value unless you really have to. (string value) +#federated_domain_name = Federated + +# A list of trusted dashboard hosts. Before accepting a Single Sign-On request +# to return a token, the origin host must be a member of this list. This +# configuration option may be repeated for multiple values. You must set this +# in order to use web-based SSO flows. For example: +# trusted_dashboard=https://acme.example.com/auth/websso +# trusted_dashboard=https://beta.example.com/auth/websso (multi valued) +#trusted_dashboard = + +# Absolute path to an HTML file used as a Single Sign-On callback handler. This +# page is expected to redirect the user from keystone back to a trusted +# dashboard host, by form encoding a token in a POST request. Keystone's +# default value should be sufficient for most deployments. (string value) +#sso_callback_template = /etc/keystone/sso_callback_template.html + +# Toggle for federation caching. This has no effect unless global caching is +# enabled. There is typically no reason to disable this. (boolean value) +#caching = true + + +[fernet_tokens] + +# +# From keystone +# + +# Directory containing Fernet token keys. This directory must exist before +# using `keystone-manage fernet_setup` for the first time, must be writable by +# the user running `keystone-manage fernet_setup` or `keystone-manage +# fernet_rotate`, and of course must be readable by keystone's server process. +# The repository may contain keys in one of three states: a single staged key +# (always index 0) used for token validation, a single primary key (always the +# highest index) used for token creation and validation, and any number of +# secondary keys (all other index values) used for token validation. With +# multiple keystone nodes, each node must share the same key repository +# contents, with the exception of the staged key (index 0). It is safe to run +# `keystone-manage fernet_rotate` once on any one node to promote a staged key +# (index 0) to be the new primary (incremented from the previous highest +# index), and produce a new staged key (a new key with index 0); the resulting +# repository can then be atomically replicated to other nodes without any risk +# of race conditions (for example, it is safe to run `keystone-manage +# fernet_rotate` on host A, wait any amount of time, create a tarball of the +# directory on host A, unpack it on host B to a temporary location, and +# atomically move (`mv`) the directory into place on host B). Running +# `keystone-manage fernet_rotate` *twice* on a key repository without syncing +# other nodes will result in tokens that can not be validated by all nodes. +# (string value) +#key_repository = /etc/keystone/fernet-keys/ + +# This controls how many keys are held in rotation by `keystone-manage +# fernet_rotate` before they are discarded. The default value of 3 means that +# keystone will maintain one staged key (always index 0), one primary key (the +# highest numerical index), and one secondary key (every other index). +# Increasing this value means that additional secondary keys will be kept in +# the rotation. (integer value) +# Minimum value: 1 +#max_active_keys = 3 + + +[healthcheck] + +# +# From oslo.middleware +# + +# DEPRECATED: The path to respond to healtcheck requests on. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +#path = /healthcheck + +# Show more detailed information as part of the response (boolean value) +#detailed = false + +# Additional backends that can perform health checks and report that +# information back as part of a request. (list value) +#backends = + +# Check the presence of a file to determine if an application is running on a +# port. Used by DisableByFileHealthcheck plugin. (string value) +#disable_by_file_path = + +# Check the presence of a file based on a port to determine if an application +# is running on a port. Expects a "port:path" list of strings. Used by +# DisableByFilesPortsHealthcheck plugin. (list value) +#disable_by_file_paths = + + +[identity] + +# +# From keystone +# + +# This references the domain to use for all Identity API v2 requests (which are +# not aware of domains). A domain with this ID can optionally be created for +# you by `keystone-manage bootstrap`. The domain referenced by this ID cannot +# be deleted on the v3 API, to prevent accidentally breaking the v2 API. There +# is nothing special about this domain, other than the fact that it must exist +# to order to maintain support for your v2 clients. There is typically no +# reason to change this value. (string value) +#default_domain_id = default + +# A subset (or all) of domains can have their own identity driver, each with +# their own partial configuration options, stored in either the resource +# backend or in a file in a domain configuration directory (depending on the +# setting of `[identity] domain_configurations_from_database`). Only values +# specific to the domain need to be specified in this manner. This feature is +# disabled by default, but may be enabled by default in a future release; set +# to true to enable. (boolean value) +#domain_specific_drivers_enabled = false + +# By default, domain-specific configuration data is read from files in the +# directory identified by `[identity] domain_config_dir`. Enabling this +# configuration option allows you to instead manage domain-specific +# configurations through the API, which are then persisted in the backend +# (typically, a SQL database), rather than using configuration files on disk. +# (boolean value) +#domain_configurations_from_database = false + +# Absolute path where keystone should locate domain-specific `[identity]` +# configuration files. This option has no effect unless `[identity] +# domain_specific_drivers_enabled` is set to true. There is typically no reason +# to change this value. (string value) +#domain_config_dir = /etc/keystone/domains + +# Entry point for the identity backend driver in the `keystone.identity` +# namespace. Keystone provides a `sql` and `ldap` driver. This option is also +# used as the default driver selection (along with the other configuration +# variables in this section) in the event that `[identity] +# domain_specific_drivers_enabled` is enabled, but no applicable domain- +# specific configuration is defined for the domain in question. Unless your +# deployment primarily relies on `ldap` AND is not using domain-specific +# configuration, you should typically leave this set to `sql`. (string value) +#driver = sql + +# Toggle for identity caching. This has no effect unless global caching is +# enabled. There is typically no reason to disable this. (boolean value) +#caching = true + +# Time to cache identity data (in seconds). This has no effect unless global +# and identity caching are enabled. (integer value) +#cache_time = 600 + +# Maximum allowed length for user passwords. Decrease this value to improve +# performance. Changing this value does not effect existing passwords. (integer +# value) +# Maximum value: 4096 +#max_password_length = 4096 + +# Maximum number of entities that will be returned in an identity collection. +# (integer value) +#list_limit = + +# The password hashing algorithm to use for passwords stored within keystone. +# (string value) +# Possible values: +# bcrypt - +# scrypt - +# pbkdf2_sha512 - +#password_hash_algorithm = bcrypt + +# This option represents a trade off between security and performance. Higher +# values lead to slower performance, but higher security. Changing this option +# will only affect newly created passwords as existing password hashes already +# have a fixed number of rounds applied, so it is safe to tune this option in a +# running cluster. The default for bcrypt is 12, must be between 4 and 31, +# inclusive. The default for scrypt is 16, must be within `range(1,32)`. The +# default for pbkdf_sha512 is 60000, must be within `range(1,1<<32)` WARNING: +# If using scrypt, increasing this value increases BOTH time AND memory +# requirements to hash a password. (integer value) +#password_hash_rounds = + +# Optional block size to pass to scrypt hash function (the `r` parameter). +# Useful for tuning scrypt to optimal performance for your CPU architecture. +# This option is only used when the `password_hash_algorithm` option is set to +# `scrypt`. Defaults to 8. (integer value) +#scrypt_block_size = + +# Optional parallelism to pass to scrypt hash function (the `p` parameter). +# This option is only used when the `password_hash_algorithm` option is set to +# `scrypt`. Defaults to 1. (integer value) +#scrypt_parallelism = + +# Number of bytes to use in scrypt and pbkfd2_sha512 hashing salt. Default for +# scrypt is 16 bytes. Default for pbkfd2_sha512 is 16 bytes. Limited to a +# maximum of 96 bytes due to the size of the column used to store password +# hashes. (integer value) +# Minimum value: 0 +# Maximum value: 96 +#salt_bytesize = + + +[identity_mapping] + +# +# From keystone +# + +# Entry point for the identity mapping backend driver in the +# `keystone.identity.id_mapping` namespace. Keystone only provides a `sql` +# driver, so there is no reason to change this unless you are providing a +# custom entry point. (string value) +#driver = sql + +# Entry point for the public ID generator for user and group entities in the +# `keystone.identity.id_generator` namespace. The Keystone identity mapper only +# supports generators that produce 64 bytes or less. Keystone only provides a +# `sha256` entry point, so there is no reason to change this value unless +# you're providing a custom entry point. (string value) +#generator = sha256 + +# The format of user and group IDs changed in Juno for backends that do not +# generate UUIDs (for example, LDAP), with keystone providing a hash mapping to +# the underlying attribute in LDAP. By default this mapping is disabled, which +# ensures that existing IDs will not change. Even when the mapping is enabled +# by using domain-specific drivers (`[identity] +# domain_specific_drivers_enabled`), any users and groups from the default +# domain being handled by LDAP will still not be mapped to ensure their IDs +# remain backward compatible. Setting this value to false will enable the new +# mapping for all backends, including the default LDAP driver. It is only +# guaranteed to be safe to enable this option if you do not already have +# assignments for users and groups from the default LDAP domain, and you +# consider it to be acceptable for Keystone to provide the different IDs to +# clients than it did previously (existing IDs in the API will suddenly +# change). Typically this means that the only time you can set this value to +# false is when configuring a fresh installation, although that is the +# recommended value. (boolean value) +#backward_compatible_ids = true + + +[ldap] + +# +# From keystone +# + +# URL(s) for connecting to the LDAP server. Multiple LDAP URLs may be specified +# as a comma separated string. The first URL to successfully bind is used for +# the connection. (string value) +#url = ldap://localhost + +# The user name of the administrator bind DN to use when querying the LDAP +# server, if your LDAP server requires it. (string value) +#user = + +# The password of the administrator bind DN to use when querying the LDAP +# server, if your LDAP server requires it. (string value) +#password = + +# The default LDAP server suffix to use, if a DN is not defined via either +# `[ldap] user_tree_dn` or `[ldap] group_tree_dn`. (string value) +#suffix = cn=example,cn=com + +# The search scope which defines how deep to search within the search base. A +# value of `one` (representing `oneLevel` or `singleLevel`) indicates a search +# of objects immediately below to the base object, but does not include the +# base object itself. A value of `sub` (representing `subtree` or +# `wholeSubtree`) indicates a search of both the base object itself and the +# entire subtree below it. (string value) +# Possible values: +# one - +# sub - +#query_scope = one + +# Defines the maximum number of results per page that keystone should request +# from the LDAP server when listing objects. A value of zero (`0`) disables +# paging. (integer value) +# Minimum value: 0 +#page_size = 0 + +# The LDAP dereferencing option to use for queries involving aliases. A value +# of `default` falls back to using default dereferencing behavior configured by +# your `ldap.conf`. A value of `never` prevents aliases from being dereferenced +# at all. A value of `searching` dereferences aliases only after name +# resolution. A value of `finding` dereferences aliases only during name +# resolution. A value of `always` dereferences aliases in all cases. (string +# value) +# Possible values: +# never - +# searching - +# always - +# finding - +# default - +#alias_dereferencing = default + +# Sets the LDAP debugging level for LDAP calls. A value of 0 means that +# debugging is not enabled. This value is a bitmask, consult your LDAP +# documentation for possible values. (integer value) +# Minimum value: -1 +#debug_level = + +# Sets keystone's referral chasing behavior across directory partitions. If +# left unset, the system's default behavior will be used. (boolean value) +#chase_referrals = + +# The search base to use for users. Defaults to the `[ldap] suffix` value. +# (string value) +#user_tree_dn = + +# The LDAP search filter to use for users. (string value) +#user_filter = + +# The LDAP object class to use for users. (string value) +#user_objectclass = inetOrgPerson + +# The LDAP attribute mapped to user IDs in keystone. This must NOT be a +# multivalued attribute. User IDs are expected to be globally unique across +# keystone domains and URL-safe. (string value) +#user_id_attribute = cn + +# The LDAP attribute mapped to user names in keystone. User names are expected +# to be unique only within a keystone domain and are not expected to be URL- +# safe. (string value) +#user_name_attribute = sn + +# The LDAP attribute mapped to user descriptions in keystone. (string value) +#user_description_attribute = description + +# The LDAP attribute mapped to user emails in keystone. (string value) +#user_mail_attribute = mail + +# The LDAP attribute mapped to user passwords in keystone. (string value) +#user_pass_attribute = userPassword + +# The LDAP attribute mapped to the user enabled attribute in keystone. If +# setting this option to `userAccountControl`, then you may be interested in +# setting `[ldap] user_enabled_mask` and `[ldap] user_enabled_default` as well. +# (string value) +#user_enabled_attribute = enabled + +# Logically negate the boolean value of the enabled attribute obtained from the +# LDAP server. Some LDAP servers use a boolean lock attribute where "true" +# means an account is disabled. Setting `[ldap] user_enabled_invert = true` +# will allow these lock attributes to be used. This option will have no effect +# if either the `[ldap] user_enabled_mask` or `[ldap] user_enabled_emulation` +# options are in use. (boolean value) +#user_enabled_invert = false + +# Bitmask integer to select which bit indicates the enabled value if the LDAP +# server represents "enabled" as a bit on an integer rather than as a discrete +# boolean. A value of `0` indicates that the mask is not used. If this is not +# set to `0` the typical value is `2`. This is typically used when `[ldap] +# user_enabled_attribute = userAccountControl`. Setting this option causes +# keystone to ignore the value of `[ldap] user_enabled_invert`. (integer value) +# Minimum value: 0 +#user_enabled_mask = 0 + +# The default value to enable users. This should match an appropriate integer +# value if the LDAP server uses non-boolean (bitmask) values to indicate if a +# user is enabled or disabled. If this is not set to `True`, then the typical +# value is `512`. This is typically used when `[ldap] user_enabled_attribute = +# userAccountControl`. (string value) +#user_enabled_default = True + +# List of user attributes to ignore on create and update, or whether a specific +# user attribute should be filtered for list or show user. (list value) +#user_attribute_ignore = default_project_id + +# The LDAP attribute mapped to a user's default_project_id in keystone. This is +# most commonly used when keystone has write access to LDAP. (string value) +#user_default_project_id_attribute = + +# If enabled, keystone uses an alternative method to determine if a user is +# enabled or not by checking if they are a member of the group defined by the +# `[ldap] user_enabled_emulation_dn` option. Enabling this option causes +# keystone to ignore the value of `[ldap] user_enabled_invert`. (boolean value) +#user_enabled_emulation = false + +# DN of the group entry to hold enabled users when using enabled emulation. +# Setting this option has no effect unless `[ldap] user_enabled_emulation` is +# also enabled. (string value) +#user_enabled_emulation_dn = + +# Use the `[ldap] group_member_attribute` and `[ldap] group_objectclass` +# settings to determine membership in the emulated enabled group. Enabling this +# option has no effect unless `[ldap] user_enabled_emulation` is also enabled. +# (boolean value) +#user_enabled_emulation_use_group_config = false + +# A list of LDAP attribute to keystone user attribute pairs used for mapping +# additional attributes to users in keystone. The expected format is +# `:`, where `ldap_attr` is the attribute in the LDAP +# object and `user_attr` is the attribute which should appear in the identity +# API. (list value) +#user_additional_attribute_mapping = + +# The search base to use for groups. Defaults to the `[ldap] suffix` value. +# (string value) +#group_tree_dn = + +# The LDAP search filter to use for groups. (string value) +#group_filter = + +# The LDAP object class to use for groups. If setting this option to +# `posixGroup`, you may also be interested in enabling the `[ldap] +# group_members_are_ids` option. (string value) +#group_objectclass = groupOfNames + +# The LDAP attribute mapped to group IDs in keystone. This must NOT be a +# multivalued attribute. Group IDs are expected to be globally unique across +# keystone domains and URL-safe. (string value) +#group_id_attribute = cn + +# The LDAP attribute mapped to group names in keystone. Group names are +# expected to be unique only within a keystone domain and are not expected to +# be URL-safe. (string value) +#group_name_attribute = ou + +# The LDAP attribute used to indicate that a user is a member of the group. +# (string value) +#group_member_attribute = member + +# Enable this option if the members of the group object class are keystone user +# IDs rather than LDAP DNs. This is the case when using `posixGroup` as the +# group object class in Open Directory. (boolean value) +#group_members_are_ids = false + +# The LDAP attribute mapped to group descriptions in keystone. (string value) +#group_desc_attribute = description + +# List of group attributes to ignore on create and update. or whether a +# specific group attribute should be filtered for list or show group. (list +# value) +#group_attribute_ignore = + +# A list of LDAP attribute to keystone group attribute pairs used for mapping +# additional attributes to groups in keystone. The expected format is +# `:`, where `ldap_attr` is the attribute in the LDAP +# object and `group_attr` is the attribute which should appear in the identity +# API. (list value) +#group_additional_attribute_mapping = + +# If enabled, group queries will use Active Directory specific filters for +# nested groups. (boolean value) +#group_ad_nesting = false + +# An absolute path to a CA certificate file to use when communicating with LDAP +# servers. This option will take precedence over `[ldap] tls_cacertdir`, so +# there is no reason to set both. (string value) +#tls_cacertfile = + +# An absolute path to a CA certificate directory to use when communicating with +# LDAP servers. There is no reason to set this option if you've also set +# `[ldap] tls_cacertfile`. (string value) +#tls_cacertdir = + +# Enable TLS when communicating with LDAP servers. You should also set the +# `[ldap] tls_cacertfile` and `[ldap] tls_cacertdir` options when using this +# option. Do not set this option if you are using LDAP over SSL (LDAPS) instead +# of TLS. (boolean value) +#use_tls = false + +# Specifies which checks to perform against client certificates on incoming TLS +# sessions. If set to `demand`, then a certificate will always be requested and +# required from the LDAP server. If set to `allow`, then a certificate will +# always be requested but not required from the LDAP server. If set to `never`, +# then a certificate will never be requested. (string value) +# Possible values: +# demand - +# never - +# allow - +#tls_req_cert = demand + +# The connection timeout to use with the LDAP server. A value of `-1` means +# that connections will never timeout. (integer value) +# Minimum value: -1 +#connection_timeout = -1 + +# Enable LDAP connection pooling for queries to the LDAP server. There is +# typically no reason to disable this. (boolean value) +#use_pool = true + +# The size of the LDAP connection pool. This option has no effect unless +# `[ldap] use_pool` is also enabled. (integer value) +# Minimum value: 1 +#pool_size = 10 + +# The maximum number of times to attempt reconnecting to the LDAP server before +# aborting. A value of zero prevents retries. This option has no effect unless +# `[ldap] use_pool` is also enabled. (integer value) +# Minimum value: 0 +#pool_retry_max = 3 + +# The number of seconds to wait before attempting to reconnect to the LDAP +# server. This option has no effect unless `[ldap] use_pool` is also enabled. +# (floating point value) +#pool_retry_delay = 0.1 + +# The connection timeout to use when pooling LDAP connections. A value of `-1` +# means that connections will never timeout. This option has no effect unless +# `[ldap] use_pool` is also enabled. (integer value) +# Minimum value: -1 +#pool_connection_timeout = -1 + +# The maximum connection lifetime to the LDAP server in seconds. When this +# lifetime is exceeded, the connection will be unbound and removed from the +# connection pool. This option has no effect unless `[ldap] use_pool` is also +# enabled. (integer value) +# Minimum value: 1 +#pool_connection_lifetime = 600 + +# Enable LDAP connection pooling for end user authentication. There is +# typically no reason to disable this. (boolean value) +#use_auth_pool = true + +# The size of the connection pool to use for end user authentication. This +# option has no effect unless `[ldap] use_auth_pool` is also enabled. (integer +# value) +# Minimum value: 1 +#auth_pool_size = 100 + +# The maximum end user authentication connection lifetime to the LDAP server in +# seconds. When this lifetime is exceeded, the connection will be unbound and +# removed from the connection pool. This option has no effect unless `[ldap] +# use_auth_pool` is also enabled. (integer value) +# Minimum value: 1 +#auth_pool_connection_lifetime = 60 + + +[matchmaker_redis] + +# +# From oslo.messaging +# + +# DEPRECATED: Host to locate redis. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#host = 127.0.0.1 + +# DEPRECATED: Use this port to connect to redis host. (port value) +# Minimum value: 0 +# Maximum value: 65535 +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#port = 6379 + +# DEPRECATED: Password for Redis server (optional). (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#password = + +# DEPRECATED: List of Redis Sentinel hosts (fault tolerance mode), e.g., +# [host:port, host1:port ... ] (list value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#sentinel_hosts = + +# Redis replica set name. (string value) +#sentinel_group_name = oslo-messaging-zeromq + +# Time in ms to wait between connection attempts. (integer value) +#wait_timeout = 2000 + +# Time in ms to wait before the transaction is killed. (integer value) +#check_timeout = 20000 + +# Timeout in ms on blocking socket operations. (integer value) +#socket_timeout = 10000 + + +[memcache] + +# +# From keystone +# + +# Number of seconds memcached server is considered dead before it is tried +# again. This is used by the key value store system. (integer value) +#dead_retry = 300 + +# Timeout in seconds for every call to a server. This is used by the key value +# store system. (integer value) +#socket_timeout = 3 + +# Max total number of open connections to every memcached server. This is used +# by the key value store system. (integer value) +#pool_maxsize = 10 + +# Number of seconds a connection to memcached is held unused in the pool before +# it is closed. This is used by the key value store system. (integer value) +#pool_unused_timeout = 60 + +# Number of seconds that an operation will wait to get a memcache client +# connection. This is used by the key value store system. (integer value) +#pool_connection_get_timeout = 10 + + +[oauth1] + +# +# From keystone +# + +# Entry point for the OAuth backend driver in the `keystone.oauth1` namespace. +# Typically, there is no reason to set this option unless you are providing a +# custom entry point. (string value) +#driver = sql + +# Number of seconds for the OAuth Request Token to remain valid after being +# created. This is the amount of time the user has to authorize the token. +# Setting this option to zero means that request tokens will last forever. +# (integer value) +# Minimum value: 0 +#request_token_duration = 28800 + +# Number of seconds for the OAuth Access Token to remain valid after being +# created. This is the amount of time the consumer has to interact with the +# service provider (which is typically keystone). Setting this option to zero +# means that access tokens will last forever. (integer value) +# Minimum value: 0 +#access_token_duration = 86400 + + +[oslo_messaging_amqp] + +# +# From oslo.messaging +# + +# Name for the AMQP container. must be globally unique. Defaults to a generated +# UUID (string value) +#container_name = + +# Timeout for inactive connections (in seconds) (integer value) +#idle_timeout = 0 + +# Debug: dump AMQP frames to stdout (boolean value) +#trace = false + +# Attempt to connect via SSL. If no other ssl-related parameters are given, it +# will use the system's CA-bundle to verify the server's certificate. (boolean +# value) +#ssl = false + +# CA certificate PEM file used to verify the server's certificate (string +# value) +#ssl_ca_file = + +# Self-identifying certificate PEM file for client authentication (string +# value) +#ssl_cert_file = + +# Private key PEM file used to sign ssl_cert_file certificate (optional) +# (string value) +#ssl_key_file = + +# Password for decrypting ssl_key_file (if encrypted) (string value) +#ssl_key_password = + +# By default SSL checks that the name in the server's certificate matches the +# hostname in the transport_url. In some configurations it may be preferable to +# use the virtual hostname instead, for example if the server uses the Server +# Name Indication TLS extension (rfc6066) to provide a certificate per virtual +# host. Set ssl_verify_vhost to True if the server's SSL certificate uses the +# virtual host name instead of the DNS name. (boolean value) +#ssl_verify_vhost = false + +# DEPRECATED: Accept clients using either SSL or plain TCP (boolean value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Not applicable - not a SSL server +#allow_insecure_clients = false + +# Space separated list of acceptable SASL mechanisms (string value) +#sasl_mechanisms = + +# Path to directory that contains the SASL configuration (string value) +#sasl_config_dir = + +# Name of configuration file (without .conf suffix) (string value) +#sasl_config_name = + +# SASL realm to use if no realm present in username (string value) +#sasl_default_realm = + +# DEPRECATED: User name for message broker authentication (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Should use configuration option transport_url to provide the +# username. +#username = + +# DEPRECATED: Password for message broker authentication (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Should use configuration option transport_url to provide the +# password. +#password = + +# Seconds to pause before attempting to re-connect. (integer value) +# Minimum value: 1 +#connection_retry_interval = 1 + +# Increase the connection_retry_interval by this many seconds after each +# unsuccessful failover attempt. (integer value) +# Minimum value: 0 +#connection_retry_backoff = 2 + +# Maximum limit for connection_retry_interval + connection_retry_backoff +# (integer value) +# Minimum value: 1 +#connection_retry_interval_max = 30 + +# Time to pause between re-connecting an AMQP 1.0 link that failed due to a +# recoverable error. (integer value) +# Minimum value: 1 +#link_retry_delay = 10 + +# The maximum number of attempts to re-send a reply message which failed due to +# a recoverable error. (integer value) +# Minimum value: -1 +#default_reply_retry = 0 + +# The deadline for an rpc reply message delivery. (integer value) +# Minimum value: 5 +#default_reply_timeout = 30 + +# The deadline for an rpc cast or call message delivery. Only used when caller +# does not provide a timeout expiry. (integer value) +# Minimum value: 5 +#default_send_timeout = 30 + +# The deadline for a sent notification message delivery. Only used when caller +# does not provide a timeout expiry. (integer value) +# Minimum value: 5 +#default_notify_timeout = 30 + +# The duration to schedule a purge of idle sender links. Detach link after +# expiry. (integer value) +# Minimum value: 1 +#default_sender_link_timeout = 600 + +# Indicates the addressing mode used by the driver. +# Permitted values: +# 'legacy' - use legacy non-routable addressing +# 'routable' - use routable addresses +# 'dynamic' - use legacy addresses if the message bus does not support routing +# otherwise use routable addressing (string value) +#addressing_mode = dynamic + +# Enable virtual host support for those message buses that do not natively +# support virtual hosting (such as qpidd). When set to true the virtual host +# name will be added to all message bus addresses, effectively creating a +# private 'subnet' per virtual host. Set to False if the message bus supports +# virtual hosting using the 'hostname' field in the AMQP 1.0 Open performative +# as the name of the virtual host. (boolean value) +#pseudo_vhost = true + +# address prefix used when sending to a specific server (string value) +#server_request_prefix = exclusive + +# address prefix used when broadcasting to all servers (string value) +#broadcast_prefix = broadcast + +# address prefix when sending to any server in group (string value) +#group_request_prefix = unicast + +# Address prefix for all generated RPC addresses (string value) +#rpc_address_prefix = openstack.org/om/rpc + +# Address prefix for all generated Notification addresses (string value) +#notify_address_prefix = openstack.org/om/notify + +# Appended to the address prefix when sending a fanout message. Used by the +# message bus to identify fanout messages. (string value) +#multicast_address = multicast + +# Appended to the address prefix when sending to a particular RPC/Notification +# server. Used by the message bus to identify messages sent to a single +# destination. (string value) +#unicast_address = unicast + +# Appended to the address prefix when sending to a group of consumers. Used by +# the message bus to identify messages that should be delivered in a round- +# robin fashion across consumers. (string value) +#anycast_address = anycast + +# Exchange name used in notification addresses. +# Exchange name resolution precedence: +# Target.exchange if set +# else default_notification_exchange if set +# else control_exchange if set +# else 'notify' (string value) +#default_notification_exchange = + +# Exchange name used in RPC addresses. +# Exchange name resolution precedence: +# Target.exchange if set +# else default_rpc_exchange if set +# else control_exchange if set +# else 'rpc' (string value) +#default_rpc_exchange = + +# Window size for incoming RPC Reply messages. (integer value) +# Minimum value: 1 +#reply_link_credit = 200 + +# Window size for incoming RPC Request messages (integer value) +# Minimum value: 1 +#rpc_server_credit = 100 + +# Window size for incoming Notification messages (integer value) +# Minimum value: 1 +#notify_server_credit = 100 + +# Send messages of this type pre-settled. +# Pre-settled messages will not receive acknowledgement +# from the peer. Note well: pre-settled messages may be +# silently discarded if the delivery fails. +# Permitted values: +# 'rpc-call' - send RPC Calls pre-settled +# 'rpc-reply'- send RPC Replies pre-settled +# 'rpc-cast' - Send RPC Casts pre-settled +# 'notify' - Send Notifications pre-settled +# (multi valued) +#pre_settled = rpc-cast +#pre_settled = rpc-reply + + +[oslo_messaging_kafka] + +# +# From oslo.messaging +# + +# DEPRECATED: Default Kafka broker Host (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#kafka_default_host = localhost + +# DEPRECATED: Default Kafka broker Port (port value) +# Minimum value: 0 +# Maximum value: 65535 +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#kafka_default_port = 9092 + +# Max fetch bytes of Kafka consumer (integer value) +#kafka_max_fetch_bytes = 1048576 + +# Default timeout(s) for Kafka consumers (floating point value) +#kafka_consumer_timeout = 1.0 + +# DEPRECATED: Pool Size for Kafka Consumers (integer value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Driver no longer uses connection pool. +#pool_size = 10 + +# DEPRECATED: The pool size limit for connections expiration policy (integer +# value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Driver no longer uses connection pool. +#conn_pool_min_size = 2 + +# DEPRECATED: The time-to-live in sec of idle connections in the pool (integer +# value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Driver no longer uses connection pool. +#conn_pool_ttl = 1200 + +# Group id for Kafka consumer. Consumers in one group will coordinate message +# consumption (string value) +#consumer_group = oslo_messaging_consumer + +# Upper bound on the delay for KafkaProducer batching in seconds (floating +# point value) +#producer_batch_timeout = 0.0 + +# Size of batch for the producer async send (integer value) +#producer_batch_size = 16384 + + +[oslo_messaging_notifications] + +# +# From oslo.messaging +# + +# The Drivers(s) to handle sending notifications. Possible values are +# messaging, messagingv2, routing, log, test, noop (multi valued) +# Deprecated group/name - [DEFAULT]/notification_driver +#driver = + +# A URL representing the messaging driver to use for notifications. If not set, +# we fall back to the same configuration used for RPC. (string value) +# Deprecated group/name - [DEFAULT]/notification_transport_url +#transport_url = + +# AMQP topic used for OpenStack notifications. (list value) +# Deprecated group/name - [rpc_notifier2]/topics +# Deprecated group/name - [DEFAULT]/notification_topics +#topics = notifications + +# The maximum number of attempts to re-send a notification message which failed +# to be delivered due to a recoverable error. 0 - No retry, -1 - indefinite +# (integer value) +#retry = -1 + + +[oslo_messaging_rabbit] + +# +# From oslo.messaging +# + +# Use durable queues in AMQP. (boolean value) +# Deprecated group/name - [DEFAULT]/amqp_durable_queues +# Deprecated group/name - [DEFAULT]/rabbit_durable_queues +#amqp_durable_queues = false + +# Auto-delete queues in AMQP. (boolean value) +#amqp_auto_delete = false + +# Enable SSL (boolean value) +#ssl = + +# SSL version to use (valid only if SSL enabled). Valid values are TLSv1 and +# SSLv23. SSLv2, SSLv3, TLSv1_1, and TLSv1_2 may be available on some +# distributions. (string value) +# Deprecated group/name - [oslo_messaging_rabbit]/kombu_ssl_version +#ssl_version = + +# SSL key file (valid only if SSL enabled). (string value) +# Deprecated group/name - [oslo_messaging_rabbit]/kombu_ssl_keyfile +#ssl_key_file = + +# SSL cert file (valid only if SSL enabled). (string value) +# Deprecated group/name - [oslo_messaging_rabbit]/kombu_ssl_certfile +#ssl_cert_file = + +# SSL certification authority file (valid only if SSL enabled). (string value) +# Deprecated group/name - [oslo_messaging_rabbit]/kombu_ssl_ca_certs +#ssl_ca_file = + +# How long to wait before reconnecting in response to an AMQP consumer cancel +# notification. (floating point value) +#kombu_reconnect_delay = 1.0 + +# EXPERIMENTAL: Possible values are: gzip, bz2. If not set compression will not +# be used. This option may not be available in future versions. (string value) +#kombu_compression = + +# How long to wait a missing client before abandoning to send it its replies. +# This value should not be longer than rpc_response_timeout. (integer value) +# Deprecated group/name - [oslo_messaging_rabbit]/kombu_reconnect_timeout +#kombu_missing_consumer_retry_timeout = 60 + +# Determines how the next RabbitMQ node is chosen in case the one we are +# currently connected to becomes unavailable. Takes effect only if more than +# one RabbitMQ node is provided in config. (string value) +# Possible values: +# round-robin - +# shuffle - +#kombu_failover_strategy = round-robin + +# DEPRECATED: The RabbitMQ broker address where a single node is used. (string +# value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#rabbit_host = localhost + +# DEPRECATED: The RabbitMQ broker port where a single node is used. (port +# value) +# Minimum value: 0 +# Maximum value: 65535 +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#rabbit_port = 5672 + +# DEPRECATED: RabbitMQ HA cluster host:port pairs. (list value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#rabbit_hosts = $rabbit_host:$rabbit_port + +# DEPRECATED: The RabbitMQ userid. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#rabbit_userid = guest + +# DEPRECATED: The RabbitMQ password. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#rabbit_password = guest + +# The RabbitMQ login method. (string value) +# Possible values: +# PLAIN - +# AMQPLAIN - +# RABBIT-CR-DEMO - +#rabbit_login_method = AMQPLAIN + +# DEPRECATED: The RabbitMQ virtual host. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#rabbit_virtual_host = / + +# How frequently to retry connecting with RabbitMQ. (integer value) +#rabbit_retry_interval = 1 + +# How long to backoff for between retries when connecting to RabbitMQ. (integer +# value) +#rabbit_retry_backoff = 2 + +# Maximum interval of RabbitMQ connection retries. Default is 30 seconds. +# (integer value) +#rabbit_interval_max = 30 + +# DEPRECATED: Maximum number of RabbitMQ connection retries. Default is 0 +# (infinite retry count). (integer value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +#rabbit_max_retries = 0 + +# Try to use HA queues in RabbitMQ (x-ha-policy: all). If you change this +# option, you must wipe the RabbitMQ database. In RabbitMQ 3.0, queue mirroring +# is no longer controlled by the x-ha-policy argument when declaring a queue. +# If you just want to make sure that all queues (except those with auto- +# generated names) are mirrored across all nodes, run: "rabbitmqctl set_policy +# HA '^(?!amq\.).*' '{"ha-mode": "all"}' " (boolean value) +#rabbit_ha_queues = false + +# Positive integer representing duration in seconds for queue TTL (x-expires). +# Queues which are unused for the duration of the TTL are automatically +# deleted. The parameter affects only reply and fanout queues. (integer value) +# Minimum value: 1 +#rabbit_transient_queues_ttl = 1800 + +# Specifies the number of messages to prefetch. Setting to zero allows +# unlimited messages. (integer value) +#rabbit_qos_prefetch_count = 0 + +# Number of seconds after which the Rabbit broker is considered down if +# heartbeat's keep-alive fails (0 disable the heartbeat). EXPERIMENTAL (integer +# value) +#heartbeat_timeout_threshold = 60 + +# How often times during the heartbeat_timeout_threshold we check the +# heartbeat. (integer value) +#heartbeat_rate = 2 + +# Deprecated, use rpc_backend=kombu+memory or rpc_backend=fake (boolean value) +#fake_rabbit = false + +# Maximum number of channels to allow (integer value) +#channel_max = + +# The maximum byte size for an AMQP frame (integer value) +#frame_max = + +# How often to send heartbeats for consumer's connections (integer value) +#heartbeat_interval = 3 + +# Arguments passed to ssl.wrap_socket (dict value) +#ssl_options = + +# Set socket timeout in seconds for connection's socket (floating point value) +#socket_timeout = 0.25 + +# Set TCP_USER_TIMEOUT in seconds for connection's socket (floating point +# value) +#tcp_user_timeout = 0.25 + +# Set delay for reconnection to some host which has connection error (floating +# point value) +#host_connection_reconnect_delay = 0.25 + +# Connection factory implementation (string value) +# Possible values: +# new - +# single - +# read_write - +#connection_factory = single + +# Maximum number of connections to keep queued. (integer value) +#pool_max_size = 30 + +# Maximum number of connections to create above `pool_max_size`. (integer +# value) +#pool_max_overflow = 0 + +# Default number of seconds to wait for a connections to available (integer +# value) +#pool_timeout = 30 + +# Lifetime of a connection (since creation) in seconds or None for no +# recycling. Expired connections are closed on acquire. (integer value) +#pool_recycle = 600 + +# Threshold at which inactive (since release) connections are considered stale +# in seconds or None for no staleness. Stale connections are closed on acquire. +# (integer value) +#pool_stale = 60 + +# Default serialization mechanism for serializing/deserializing +# outgoing/incoming messages (string value) +# Possible values: +# json - +# msgpack - +#default_serializer_type = json + +# Persist notification messages. (boolean value) +#notification_persistence = false + +# Exchange name for sending notifications (string value) +#default_notification_exchange = ${control_exchange}_notification + +# Max number of not acknowledged message which RabbitMQ can send to +# notification listener. (integer value) +#notification_listener_prefetch_count = 100 + +# Reconnecting retry count in case of connectivity problem during sending +# notification, -1 means infinite retry. (integer value) +#default_notification_retry_attempts = -1 + +# Reconnecting retry delay in case of connectivity problem during sending +# notification message (floating point value) +#notification_retry_delay = 0.25 + +# Time to live for rpc queues without consumers in seconds. (integer value) +#rpc_queue_expiration = 60 + +# Exchange name for sending RPC messages (string value) +#default_rpc_exchange = ${control_exchange}_rpc + +# Exchange name for receiving RPC replies (string value) +#rpc_reply_exchange = ${control_exchange}_rpc_reply + +# Max number of not acknowledged message which RabbitMQ can send to rpc +# listener. (integer value) +#rpc_listener_prefetch_count = 100 + +# Max number of not acknowledged message which RabbitMQ can send to rpc reply +# listener. (integer value) +#rpc_reply_listener_prefetch_count = 100 + +# Reconnecting retry count in case of connectivity problem during sending +# reply. -1 means infinite retry during rpc_timeout (integer value) +#rpc_reply_retry_attempts = -1 + +# Reconnecting retry delay in case of connectivity problem during sending +# reply. (floating point value) +#rpc_reply_retry_delay = 0.25 + +# Reconnecting retry count in case of connectivity problem during sending RPC +# message, -1 means infinite retry. If actual retry attempts in not 0 the rpc +# request could be processed more than one time (integer value) +#default_rpc_retry_attempts = -1 + +# Reconnecting retry delay in case of connectivity problem during sending RPC +# message (floating point value) +#rpc_retry_delay = 0.25 + + +[oslo_messaging_zmq] + +# +# From oslo.messaging +# + +# ZeroMQ bind address. Should be a wildcard (*), an ethernet interface, or IP. +# The "host" option should point or resolve to this address. (string value) +#rpc_zmq_bind_address = * + +# MatchMaker driver. (string value) +# Possible values: +# redis - +# sentinel - +# dummy - +#rpc_zmq_matchmaker = redis + +# Number of ZeroMQ contexts, defaults to 1. (integer value) +#rpc_zmq_contexts = 1 + +# Maximum number of ingress messages to locally buffer per topic. Default is +# unlimited. (integer value) +#rpc_zmq_topic_backlog = + +# Directory for holding IPC sockets. (string value) +#rpc_zmq_ipc_dir = /var/run/openstack + +# Name of this node. Must be a valid hostname, FQDN, or IP address. Must match +# "host" option, if running Nova. (string value) +#rpc_zmq_host = localhost + +# Number of seconds to wait before all pending messages will be sent after +# closing a socket. The default value of -1 specifies an infinite linger +# period. The value of 0 specifies no linger period. Pending messages shall be +# discarded immediately when the socket is closed. Positive values specify an +# upper bound for the linger period. (integer value) +# Deprecated group/name - [DEFAULT]/rpc_cast_timeout +#zmq_linger = -1 + +# The default number of seconds that poll should wait. Poll raises timeout +# exception when timeout expired. (integer value) +#rpc_poll_timeout = 1 + +# Expiration timeout in seconds of a name service record about existing target +# ( < 0 means no timeout). (integer value) +#zmq_target_expire = 300 + +# Update period in seconds of a name service record about existing target. +# (integer value) +#zmq_target_update = 180 + +# Use PUB/SUB pattern for fanout methods. PUB/SUB always uses proxy. (boolean +# value) +#use_pub_sub = false + +# Use ROUTER remote proxy. (boolean value) +#use_router_proxy = false + +# This option makes direct connections dynamic or static. It makes sense only +# with use_router_proxy=False which means to use direct connections for direct +# message types (ignored otherwise). (boolean value) +#use_dynamic_connections = false + +# How many additional connections to a host will be made for failover reasons. +# This option is actual only in dynamic connections mode. (integer value) +#zmq_failover_connections = 2 + +# Minimal port number for random ports range. (port value) +# Minimum value: 0 +# Maximum value: 65535 +#rpc_zmq_min_port = 49153 + +# Maximal port number for random ports range. (integer value) +# Minimum value: 1 +# Maximum value: 65536 +#rpc_zmq_max_port = 65536 + +# Number of retries to find free port number before fail with ZMQBindError. +# (integer value) +#rpc_zmq_bind_port_retries = 100 + +# Default serialization mechanism for serializing/deserializing +# outgoing/incoming messages (string value) +# Possible values: +# json - +# msgpack - +#rpc_zmq_serialization = json + +# This option configures round-robin mode in zmq socket. True means not keeping +# a queue when server side disconnects. False means to keep queue and messages +# even if server is disconnected, when the server appears we send all +# accumulated messages to it. (boolean value) +#zmq_immediate = true + +# Enable/disable TCP keepalive (KA) mechanism. The default value of -1 (or any +# other negative value) means to skip any overrides and leave it to OS default; +# 0 and 1 (or any other positive value) mean to disable and enable the option +# respectively. (integer value) +#zmq_tcp_keepalive = -1 + +# The duration between two keepalive transmissions in idle condition. The unit +# is platform dependent, for example, seconds in Linux, milliseconds in Windows +# etc. The default value of -1 (or any other negative value and 0) means to +# skip any overrides and leave it to OS default. (integer value) +#zmq_tcp_keepalive_idle = -1 + +# The number of retransmissions to be carried out before declaring that remote +# end is not available. The default value of -1 (or any other negative value +# and 0) means to skip any overrides and leave it to OS default. (integer +# value) +#zmq_tcp_keepalive_cnt = -1 + +# The duration between two successive keepalive retransmissions, if +# acknowledgement to the previous keepalive transmission is not received. The +# unit is platform dependent, for example, seconds in Linux, milliseconds in +# Windows etc. The default value of -1 (or any other negative value and 0) +# means to skip any overrides and leave it to OS default. (integer value) +#zmq_tcp_keepalive_intvl = -1 + +# Maximum number of (green) threads to work concurrently. (integer value) +#rpc_thread_pool_size = 100 + +# Expiration timeout in seconds of a sent/received message after which it is +# not tracked anymore by a client/server. (integer value) +#rpc_message_ttl = 300 + +# Wait for message acknowledgements from receivers. This mechanism works only +# via proxy without PUB/SUB. (boolean value) +#rpc_use_acks = false + +# Number of seconds to wait for an ack from a cast/call. After each retry +# attempt this timeout is multiplied by some specified multiplier. (integer +# value) +#rpc_ack_timeout_base = 15 + +# Number to multiply base ack timeout by after each retry attempt. (integer +# value) +#rpc_ack_timeout_multiplier = 2 + +# Default number of message sending attempts in case of any problems occurred: +# positive value N means at most N retries, 0 means no retries, None or -1 (or +# any other negative values) mean to retry forever. This option is used only if +# acknowledgments are enabled. (integer value) +#rpc_retry_attempts = 3 + +# List of publisher hosts SubConsumer can subscribe on. This option has higher +# priority then the default publishers list taken from the matchmaker. (list +# value) +#subscribe_on = + + +[oslo_middleware] + +# +# From oslo.middleware +# + +# The maximum body size for each request, in bytes. (integer value) +# Deprecated group/name - [DEFAULT]/osapi_max_request_body_size +# Deprecated group/name - [DEFAULT]/max_request_body_size +#max_request_body_size = 114688 + +# DEPRECATED: The HTTP Header that will be used to determine what the original +# request protocol scheme was, even if it was hidden by a SSL termination +# proxy. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +#secure_proxy_ssl_header = X-Forwarded-Proto + +# Whether the application is behind a proxy or not. This determines if the +# middleware should parse the headers or not. (boolean value) +#enable_proxy_headers_parsing = false + + +[oslo_policy] + +# +# From oslo.policy +# + +# This option controls whether or not to enforce scope when evaluating +# policies. If ``True``, the scope of the token used in the request is compared +# to the ``scope_types`` of the policy being enforced. If the scopes do not +# match, an ``InvalidScope`` exception will be raised. If ``False``, a message +# will be logged informing operators that policies are being invoked with +# mismatching scope. (boolean value) +#enforce_scope = false + +# The file that defines policies. (string value) +#policy_file = policy.json + +# Default rule. Enforced when a requested rule is not found. (string value) +#policy_default_rule = default + +# Directories where policy configuration files are stored. They can be relative +# to any directory in the search path defined by the config_dir option, or +# absolute paths. The file defined by policy_file must exist for these +# directories to be searched. Missing or empty directories are ignored. (multi +# valued) +#policy_dirs = policy.d + +# Content Type to send and receive data for REST based policy check (string +# value) +# Possible values: +# application/x-www-form-urlencoded - +# application/json - +#remote_content_type = application/x-www-form-urlencoded + +# server identity verification for REST based policy check (boolean value) +#remote_ssl_verify_server_crt = false + +# Absolute path to ca cert file for REST based policy check (string value) +#remote_ssl_ca_crt_file = + +# Absolute path to client cert for REST based policy check (string value) +#remote_ssl_client_crt_file = + +# Absolute path client key file REST based policy check (string value) +#remote_ssl_client_key_file = + + +[paste_deploy] + +# +# From keystone +# + +# Name of (or absolute path to) the Paste Deploy configuration file that +# composes middleware and the keystone application itself into actual WSGI +# entry points. See http://pythonpaste.org/deploy/ for additional documentation +# on the file's format. (string value) +#config_file = keystone-paste.ini + + +[policy] + +# +# From keystone +# + +# Entry point for the policy backend driver in the `keystone.policy` namespace. +# Supplied drivers are `rules` (which does not support any CRUD operations for +# the v3 policy API) and `sql`. Typically, there is no reason to set this +# option unless you are providing a custom entry point. (string value) +#driver = sql + +# Maximum number of entities that will be returned in a policy collection. +# (integer value) +#list_limit = + + +[profiler] + +# +# From osprofiler +# + +# +# Enables the profiling for all services on this node. Default value is False +# (fully disable the profiling feature). +# +# Possible values: +# +# * True: Enables the feature +# * False: Disables the feature. The profiling cannot be started via this +# project +# operations. If the profiling is triggered by another project, this project +# part +# will be empty. +# (boolean value) +# Deprecated group/name - [profiler]/profiler_enabled +#enabled = false + +# +# Enables SQL requests profiling in services. Default value is False (SQL +# requests won't be traced). +# +# Possible values: +# +# * True: Enables SQL requests profiling. Each SQL query will be part of the +# trace and can the be analyzed by how much time was spent for that. +# * False: Disables SQL requests profiling. The spent time is only shown on a +# higher level of operations. Single SQL queries cannot be analyzed this +# way. +# (boolean value) +#trace_sqlalchemy = false + +# +# Secret key(s) to use for encrypting context data for performance profiling. +# This string value should have the following format: +# [,,...], +# where each key is some random string. A user who triggers the profiling via +# the REST API has to set one of these keys in the headers of the REST API call +# to include profiling results of this node for this particular project. +# +# Both "enabled" flag and "hmac_keys" config options should be set to enable +# profiling. Also, to generate correct profiling information across all +# services +# at least one key needs to be consistent between OpenStack projects. This +# ensures it can be used from client side to generate the trace, containing +# information from all possible resources. (string value) +#hmac_keys = SECRET_KEY + +# +# Connection string for a notifier backend. Default value is messaging:// which +# sets the notifier to oslo_messaging. +# +# Examples of possible values: +# +# * messaging://: use oslo_messaging driver for sending notifications. +# * mongodb://127.0.0.1:27017 : use mongodb driver for sending notifications. +# * elasticsearch://127.0.0.1:9200 : use elasticsearch driver for sending +# notifications. +# (string value) +#connection_string = messaging:// + +# +# Document type for notification indexing in elasticsearch. +# (string value) +#es_doc_type = notification + +# +# This parameter is a time value parameter (for example: es_scroll_time=2m), +# indicating for how long the nodes that participate in the search will +# maintain +# relevant resources in order to continue and support it. +# (string value) +#es_scroll_time = 2m + +# +# Elasticsearch splits large requests in batches. This parameter defines +# maximum size of each batch (for example: es_scroll_size=10000). +# (integer value) +#es_scroll_size = 10000 + +# +# Redissentinel provides a timeout option on the connections. +# This parameter defines that timeout (for example: socket_timeout=0.1). +# (floating point value) +#socket_timeout = 0.1 + +# +# Redissentinel uses a service name to identify a master redis service. +# This parameter defines the name (for example: +# sentinal_service_name=mymaster). +# (string value) +#sentinel_service_name = mymaster + + +[resource] + +# +# From keystone +# + +# DEPRECATED: Entry point for the resource driver in the `keystone.resource` +# namespace. Only a `sql` driver is supplied by keystone. Unless you are +# writing proprietary drivers for keystone, you do not need to set this option. +# (string value) +# This option is deprecated for removal since P. +# Its value may be silently ignored in the future. +# Reason: Non-SQL resource cannot be used with SQL Identity and has been unable +# to be used since Ocata. SQL Resource backend is a requirement as of Pike. +# Setting this option no longer has an effect on how Keystone operates. +#driver = sql + +# Toggle for resource caching. This has no effect unless global caching is +# enabled. (boolean value) +# Deprecated group/name - [assignment]/caching +#caching = true + +# Time to cache resource data in seconds. This has no effect unless global +# caching is enabled. (integer value) +# Deprecated group/name - [assignment]/cache_time +#cache_time = + +# Maximum number of entities that will be returned in a resource collection. +# (integer value) +# Deprecated group/name - [assignment]/list_limit +#list_limit = + +# Name of the domain that owns the `admin_project_name`. If left unset, then +# there is no admin project. `[resource] admin_project_name` must also be set +# to use this option. (string value) +#admin_project_domain_name = + +# This is a special project which represents cloud-level administrator +# privileges across services. Tokens scoped to this project will contain a true +# `is_admin_project` attribute to indicate to policy systems that the role +# assignments on that specific project should apply equally across every +# project. If left unset, then there is no admin project, and thus no explicit +# means of cross-project role assignments. `[resource] +# admin_project_domain_name` must also be set to use this option. (string +# value) +#admin_project_name = + +# This controls whether the names of projects are restricted from containing +# URL-reserved characters. If set to `new`, attempts to create or update a +# project with a URL-unsafe name will fail. If set to `strict`, attempts to +# scope a token with a URL-unsafe project name will fail, thereby forcing all +# project names to be updated to be URL-safe. (string value) +# Possible values: +# off - +# new - +# strict - +#project_name_url_safe = off + +# This controls whether the names of domains are restricted from containing +# URL-reserved characters. If set to `new`, attempts to create or update a +# domain with a URL-unsafe name will fail. If set to `strict`, attempts to +# scope a token with a URL-unsafe domain name will fail, thereby forcing all +# domain names to be updated to be URL-safe. (string value) +# Possible values: +# off - +# new - +# strict - +#domain_name_url_safe = off + + +[revoke] + +# +# From keystone +# + +# Entry point for the token revocation backend driver in the `keystone.revoke` +# namespace. Keystone only provides a `sql` driver, so there is no reason to +# set this option unless you are providing a custom entry point. (string value) +#driver = sql + +# The number of seconds after a token has expired before a corresponding +# revocation event may be purged from the backend. (integer value) +# Minimum value: 0 +#expiration_buffer = 1800 + +# Toggle for revocation event caching. This has no effect unless global caching +# is enabled. (boolean value) +#caching = true + +# Time to cache the revocation list and the revocation events (in seconds). +# This has no effect unless global and `[revoke] caching` are both enabled. +# (integer value) +# Deprecated group/name - [token]/revocation_cache_time +#cache_time = 3600 + + +[role] + +# +# From keystone +# + +# Entry point for the role backend driver in the `keystone.role` namespace. +# Keystone only provides a `sql` driver, so there's no reason to change this +# unless you are providing a custom entry point. (string value) +#driver = + +# Toggle for role caching. This has no effect unless global caching is enabled. +# In a typical deployment, there is no reason to disable this. (boolean value) +#caching = true + +# Time to cache role data, in seconds. This has no effect unless both global +# caching and `[role] caching` are enabled. (integer value) +#cache_time = + +# Maximum number of entities that will be returned in a role collection. This +# may be useful to tune if you have a large number of discrete roles in your +# deployment. (integer value) +#list_limit = + + +[saml] + +# +# From keystone +# + +# Determines the lifetime for any SAML assertions generated by keystone, using +# `NotOnOrAfter` attributes. (integer value) +#assertion_expiration_time = 3600 + +# Name of, or absolute path to, the binary to be used for XML signing. Although +# only the XML Security Library (`xmlsec1`) is supported, it may have a non- +# standard name or path on your system. If keystone cannot find the binary +# itself, you may need to install the appropriate package, use this option to +# specify an absolute path, or adjust keystone's PATH environment variable. +# (string value) +#xmlsec1_binary = xmlsec1 + +# Absolute path to the public certificate file to use for SAML signing. The +# value cannot contain a comma (`,`). (string value) +#certfile = /etc/keystone/ssl/certs/signing_cert.pem + +# Absolute path to the private key file to use for SAML signing. The value +# cannot contain a comma (`,`). (string value) +#keyfile = /etc/keystone/ssl/private/signing_key.pem + +# This is the unique entity identifier of the identity provider (keystone) to +# use when generating SAML assertions. This value is required to generate +# identity provider metadata and must be a URI (a URL is recommended). For +# example: `https://keystone.example.com/v3/OS-FEDERATION/saml2/idp`. (uri +# value) +#idp_entity_id = + +# This is the single sign-on (SSO) service location of the identity provider +# which accepts HTTP POST requests. A value is required to generate identity +# provider metadata. For example: `https://keystone.example.com/v3/OS- +# FEDERATION/saml2/sso`. (uri value) +#idp_sso_endpoint = + +# This is the language used by the identity provider's organization. (string +# value) +#idp_lang = en + +# This is the name of the identity provider's organization. (string value) +#idp_organization_name = SAML Identity Provider + +# This is the name of the identity provider's organization to be displayed. +# (string value) +#idp_organization_display_name = OpenStack SAML Identity Provider + +# This is the URL of the identity provider's organization. The URL referenced +# here should be useful to humans. (uri value) +#idp_organization_url = https://example.com/ + +# This is the company name of the identity provider's contact person. (string +# value) +#idp_contact_company = Example, Inc. + +# This is the given name of the identity provider's contact person. (string +# value) +#idp_contact_name = SAML Identity Provider Support + +# This is the surname of the identity provider's contact person. (string value) +#idp_contact_surname = Support + +# This is the email address of the identity provider's contact person. (string +# value) +#idp_contact_email = support@example.com + +# This is the telephone number of the identity provider's contact person. +# (string value) +#idp_contact_telephone = +1 800 555 0100 + +# This is the type of contact that best describes the identity provider's +# contact person. (string value) +# Possible values: +# technical - +# support - +# administrative - +# billing - +# other - +#idp_contact_type = other + +# Absolute path to the identity provider metadata file. This file should be +# generated with the `keystone-manage saml_idp_metadata` command. There is +# typically no reason to change this value. (string value) +#idp_metadata_path = /etc/keystone/saml2_idp_metadata.xml + +# The prefix of the RelayState SAML attribute to use when generating enhanced +# client and proxy (ECP) assertions. In a typical deployment, there is no +# reason to change this value. (string value) +#relay_state_prefix = ss:mem: + + +[security_compliance] + +# +# From keystone +# + +# The maximum number of days a user can go without authenticating before being +# considered "inactive" and automatically disabled (locked). This feature is +# disabled by default; set any value to enable it. This feature depends on the +# `sql` backend for the `[identity] driver`. When a user exceeds this threshold +# and is considered "inactive", the user's `enabled` attribute in the HTTP API +# may not match the value of the user's `enabled` column in the user table. +# (integer value) +# Minimum value: 1 +#disable_user_account_days_inactive = + +# The maximum number of times that a user can fail to authenticate before the +# user account is locked for the number of seconds specified by +# `[security_compliance] lockout_duration`. This feature is disabled by +# default. If this feature is enabled and `[security_compliance] +# lockout_duration` is not set, then users may be locked out indefinitely until +# the user is explicitly enabled via the API. This feature depends on the `sql` +# backend for the `[identity] driver`. (integer value) +# Minimum value: 1 +#lockout_failure_attempts = + +# The number of seconds a user account will be locked when the maximum number +# of failed authentication attempts (as specified by `[security_compliance] +# lockout_failure_attempts`) is exceeded. Setting this option will have no +# effect unless you also set `[security_compliance] lockout_failure_attempts` +# to a non-zero value. This feature depends on the `sql` backend for the +# `[identity] driver`. (integer value) +# Minimum value: 1 +#lockout_duration = 1800 + +# The number of days for which a password will be considered valid before +# requiring it to be changed. This feature is disabled by default. If enabled, +# new password changes will have an expiration date, however existing passwords +# would not be impacted. This feature depends on the `sql` backend for the +# `[identity] driver`. (integer value) +# Minimum value: 1 +#password_expires_days = + +# This controls the number of previous user password iterations to keep in +# history, in order to enforce that newly created passwords are unique. The +# total number which includes the new password should not be greater or equal +# to this value. Setting the value to one (the default) disables this feature. +# Thus, to enable this feature, values must be greater than 1. This feature +# depends on the `sql` backend for the `[identity] driver`. (integer value) +# Minimum value: 1 +#unique_last_password_count = 1 + +# The number of days that a password must be used before the user can change +# it. This prevents users from changing their passwords immediately in order to +# wipe out their password history and reuse an old password. This feature does +# not prevent administrators from manually resetting passwords. It is disabled +# by default and allows for immediate password changes. This feature depends on +# the `sql` backend for the `[identity] driver`. Note: If +# `[security_compliance] password_expires_days` is set, then the value for this +# option should be less than the `password_expires_days`. (integer value) +# Minimum value: 0 +#minimum_password_age = 0 + +# The regular expression used to validate password strength requirements. By +# default, the regular expression will match any password. The following is an +# example of a pattern which requires at least 1 letter, 1 digit, and have a +# minimum length of 7 characters: ^(?=.*\d)(?=.*[a-zA-Z]).{7,}$ This feature +# depends on the `sql` backend for the `[identity] driver`. (string value) +#password_regex = + +# Describe your password regular expression here in language for humans. If a +# password fails to match the regular expression, the contents of this +# configuration variable will be returned to users to explain why their +# requested password was insufficient. (string value) +#password_regex_description = + +# Enabling this option requires users to change their password when the user is +# created, or upon administrative reset. Before accessing any services, +# affected users will have to change their password. To ignore this requirement +# for specific users, such as service users, set the `options` attribute +# `ignore_change_password_upon_first_use` to `True` for the desired user via +# the update user API. This feature is disabled by default. This feature is +# only applicable with the `sql` backend for the `[identity] driver`. (boolean +# value) +#change_password_upon_first_use = false + + +[shadow_users] + +# +# From keystone +# + +# Entry point for the shadow users backend driver in the +# `keystone.identity.shadow_users` namespace. This driver is used for +# persisting local user references to externally-managed identities (via +# federation, LDAP, etc). Keystone only provides a `sql` driver, so there is no +# reason to change this option unless you are providing a custom entry point. +# (string value) +#driver = sql + + +[signing] + +# +# From keystone +# + +# DEPRECATED: Absolute path to the public certificate file to use for signing +# responses to revocation lists requests. Set this together with `[signing] +# keyfile`. For non-production environments, you may be interested in using +# `keystone-manage pki_setup` to generate self-signed certificates. (string +# value) +# This option is deprecated for removal since P. +# Its value may be silently ignored in the future. +# Reason: `keystone-manage pki_setup` was deprecated in Mitaka and removed in +# Pike. These options remain for backwards compatibility. +#certfile = /etc/keystone/ssl/certs/signing_cert.pem + +# DEPRECATED: Absolute path to the private key file to use for signing +# responses to revocation lists requests. Set this together with `[signing] +# certfile`. (string value) +# This option is deprecated for removal since P. +# Its value may be silently ignored in the future. +# Reason: `keystone-manage pki_setup` was deprecated in Mitaka and removed in +# Pike. These options remain for backwards compatibility. +#keyfile = /etc/keystone/ssl/private/signing_key.pem + +# DEPRECATED: Absolute path to the public certificate authority (CA) file to +# use when creating self-signed certificates with `keystone-manage pki_setup`. +# Set this together with `[signing] ca_key`. There is no reason to set this +# option unless you are requesting revocation lists in a non-production +# environment. Use a `[signing] certfile` issued from a trusted certificate +# authority instead. (string value) +# This option is deprecated for removal since P. +# Its value may be silently ignored in the future. +# Reason: `keystone-manage pki_setup` was deprecated in Mitaka and removed in +# Pike. These options remain for backwards compatibility. +#ca_certs = /etc/keystone/ssl/certs/ca.pem + +# DEPRECATED: Absolute path to the private certificate authority (CA) key file +# to use when creating self-signed certificates with `keystone-manage +# pki_setup`. Set this together with `[signing] ca_certs`. There is no reason +# to set this option unless you are requesting revocation lists in a non- +# production environment. Use a `[signing] certfile` issued from a trusted +# certificate authority instead. (string value) +# This option is deprecated for removal since P. +# Its value may be silently ignored in the future. +# Reason: `keystone-manage pki_setup` was deprecated in Mitaka and removed in +# Pike. These options remain for backwards compatibility. +#ca_key = /etc/keystone/ssl/private/cakey.pem + +# DEPRECATED: Key size (in bits) to use when generating a self-signed token +# signing certificate. There is no reason to set this option unless you are +# requesting revocation lists in a non-production environment. Use a `[signing] +# certfile` issued from a trusted certificate authority instead. (integer +# value) +# Minimum value: 1024 +# This option is deprecated for removal since P. +# Its value may be silently ignored in the future. +# Reason: `keystone-manage pki_setup` was deprecated in Mitaka and removed in +# Pike. These options remain for backwards compatibility. +#key_size = 2048 + +# DEPRECATED: The validity period (in days) to use when generating a self- +# signed token signing certificate. There is no reason to set this option +# unless you are requesting revocation lists in a non-production environment. +# Use a `[signing] certfile` issued from a trusted certificate authority +# instead. (integer value) +# This option is deprecated for removal since P. +# Its value may be silently ignored in the future. +# Reason: `keystone-manage pki_setup` was deprecated in Mitaka and removed in +# Pike. These options remain for backwards compatibility. +#valid_days = 3650 + +# DEPRECATED: The certificate subject to use when generating a self-signed +# token signing certificate. There is no reason to set this option unless you +# are requesting revocation lists in a non-production environment. Use a +# `[signing] certfile` issued from a trusted certificate authority instead. +# (string value) +# This option is deprecated for removal since P. +# Its value may be silently ignored in the future. +# Reason: `keystone-manage pki_setup` was deprecated in Mitaka and removed in +# Pike. These options remain for backwards compatibility. +#cert_subject = /C=US/ST=Unset/L=Unset/O=Unset/CN=www.example.com + + +[token] +provider = fernet + +# +# From keystone +# + +# This is a list of external authentication mechanisms which should add token +# binding metadata to tokens, such as `kerberos` or `x509`. Binding metadata is +# enforced according to the `[token] enforce_token_bind` option. (list value) +#bind = + +# DEPRECATED: This controls the token binding enforcement policy on tokens +# presented to keystone with token binding metadata (as specified by the +# `[token] bind` option). `disabled` completely bypasses token binding +# validation. `permissive` and `strict` do not require tokens to have binding +# metadata (but will validate it if present), whereas `required` will always +# demand tokens to having binding metadata. `permissive` will allow unsupported +# binding metadata to pass through without validation (usually to be validated +# at another time by another component), whereas `strict` and `required` will +# demand that the included binding metadata be supported by keystone. (string +# value) +# This option is deprecated for removal since P. +# Its value may be silently ignored in the future. +#enforce_token_bind = permissive + +# The amount of time that a token should remain valid (in seconds). Drastically +# reducing this value may break "long-running" operations that involve multiple +# services to coordinate together, and will force users to authenticate with +# keystone more frequently. Drastically increasing this value will increase +# load on the `[token] driver`, as more tokens will be simultaneously valid. +# Keystone tokens are also bearer tokens, so a shorter duration will also +# reduce the potential security impact of a compromised token. (integer value) +# Minimum value: 0 +# Maximum value: 9223372036854775807 +#expiration = 3600 + +# Entry point for the token provider in the `keystone.token.provider` +# namespace. The token provider controls the token construction, validation, +# and revocation operations. Keystone includes `fernet` and `uuid` token +# providers. `uuid` tokens must be persisted (using the backend specified in +# the `[token] driver` option), but do not require any extra configuration or +# setup. `fernet` tokens do not need to be persisted at all, but require that +# you run `keystone-manage fernet_setup` (also see the `keystone-manage +# fernet_rotate` command). (string value) +#provider = fernet + +# DEPRECATED: Entry point for the token persistence backend driver in the +# `keystone.token.persistence` namespace. Keystone provides the `sql` driver. +# The `sql` option (default) depends on the options in your `[database]` +# section. If you're using the `fernet` `[token] provider`, this backend will +# not be utilized to persist tokens at all. (string value) +# This option is deprecated for removal since P. +# Its value may be silently ignored in the future. +#driver = sql + +# Toggle for caching token creation and validation data. This has no effect +# unless global caching is enabled. (boolean value) +#caching = true + +# The number of seconds to cache token creation and validation data. This has +# no effect unless both global and `[token] caching` are enabled. (integer +# value) +# Minimum value: 0 +# Maximum value: 9223372036854775807 +#cache_time = + +# This toggles support for revoking individual tokens by the token identifier +# and thus various token enumeration operations (such as listing all tokens +# issued to a specific user). These operations are used to determine the list +# of tokens to consider revoked. Do not disable this option if you're using the +# `kvs` `[revoke] driver`. (boolean value) +#revoke_by_id = true + +# This toggles whether scoped tokens may be re-scoped to a new project or +# domain, thereby preventing users from exchanging a scoped token (including +# those with a default project scope) for any other token. This forces users to +# either authenticate for unscoped tokens (and later exchange that unscoped +# token for tokens with a more specific scope) or to provide their credentials +# in every request for a scoped token to avoid re-scoping altogether. (boolean +# value) +#allow_rescope_scoped_token = true + +# This controls whether roles should be included with tokens that are not +# directly assigned to the token's scope, but are instead linked implicitly to +# other role assignments. (boolean value) +#infer_roles = true + +# Enable storing issued token data to token validation cache so that first +# token validation doesn't actually cause full validation cycle. This option +# has no effect unless global caching and token caching are enabled. (boolean +# value) +#cache_on_issue = true + +# This controls the number of seconds that a token can be retrieved for beyond +# the built-in expiry time. This allows long running operations to succeed. +# Defaults to two days. (integer value) +#allow_expired_window = 172800 + + +[tokenless_auth] + +# +# From keystone +# + +# The list of distinguished names which identify trusted issuers of client +# certificates allowed to use X.509 tokenless authorization. If the option is +# absent then no certificates will be allowed. The format for the values of a +# distinguished name (DN) must be separated by a comma and contain no spaces. +# Furthermore, because an individual DN may contain commas, this configuration +# option may be repeated multiple times to represent multiple values. For +# example, keystone.conf would include two consecutive lines in order to trust +# two different DNs, such as `trusted_issuer = CN=john,OU=keystone,O=openstack` +# and `trusted_issuer = CN=mary,OU=eng,O=abc`. (multi valued) +#trusted_issuer = + +# The federated protocol ID used to represent X.509 tokenless authorization. +# This is used in combination with the value of `[tokenless_auth] +# issuer_attribute` to find a corresponding federated mapping. In a typical +# deployment, there is no reason to change this value. (string value) +#protocol = x509 + +# The name of the WSGI environment variable used to pass the issuer of the +# client certificate to keystone. This attribute is used as an identity +# provider ID for the X.509 tokenless authorization along with the protocol to +# look up its corresponding mapping. In a typical deployment, there is no +# reason to change this value. (string value) +#issuer_attribute = SSL_CLIENT_I_DN + + +[trust] + +# +# From keystone +# + +# DEPRECATED: Delegation and impersonation features using trusts can be +# optionally disabled. (boolean value) +# This option is deprecated for removal since Q. +# Its value may be silently ignored in the future. +# Reason: Disabling the trusts API is deprecated. This option will be removed +# in the next release and trusts will always be enabled. +#enabled = true + +# Allows authorization to be redelegated from one user to another, effectively +# chaining trusts together. When disabled, the `remaining_uses` attribute of a +# trust is constrained to be zero. (boolean value) +#allow_redelegation = false + +# Maximum number of times that authorization can be redelegated from one user +# to another in a chain of trusts. This number may be reduced further for a +# specific trust. (integer value) +#max_redelegation_count = 3 + +# Entry point for the trust backend driver in the `keystone.trust` namespace. +# Keystone only provides a `sql` driver, so there is no reason to change this +# unless you are providing a custom entry point. (string value) +#driver = sql + + +[unified_limit] + +# +# From keystone +# + +# Entry point for the unified limit backend driver in the +# `keystone.unified_limit` namespace. Keystone only provides a `sql` driver, so +# there's no reason to change this unless you are providing a custom entry +# point. (string value) +#driver = sql + +# Toggle for unified limit caching. This has no effect unless global caching is +# enabled. In a typical deployment, there is no reason to disable this. +# (boolean value) +#caching = true + +# Time to cache unified limit data, in seconds. This has no effect unless both +# global caching and `[unified_limit] caching` are enabled. (integer value) +#cache_time = + +# Maximum number of entities that will be returned in a role collection. This +# may be useful to tune if you have a large number of unified limits in your +# deployment. (integer value) +#list_limit = diff --git a/openstack/openstack_conf/controller/keystone/keystone.policy.yaml b/openstack/openstack_conf/controller/keystone/keystone.policy.yaml new file mode 100644 index 0000000..68386d4 --- /dev/null +++ b/openstack/openstack_conf/controller/keystone/keystone.policy.yaml @@ -0,0 +1,1076 @@ +# +#"admin_required": "role:admin or is_admin:1" + +# +#"service_role": "role:service" + +# +#"service_or_admin": "rule:admin_required or rule:service_role" + +# +#"owner": "user_id:%(user_id)s" + +# +#"admin_or_owner": "rule:admin_required or rule:owner" + +# +#"token_subject": "user_id:%(target.token.user_id)s" + +# +#"admin_or_token_subject": "rule:admin_required or rule:token_subject" + +# +#"service_admin_or_token_subject": "rule:service_or_admin or rule:token_subject" + +# Show application credential details. +# GET /v3/users/{user_id}/application_credentials/{application_credential_id} +# HEAD /v3/users/{user_id}/application_credentials/{application_credential_id} +#"identity:get_application_credential": "rule:admin_or_owner" + +# List application credentials for a user. +# GET /v3/users/{user_id}/application_credentials +# HEAD /v3/users/{user_id}/application_credentials +#"identity:list_application_credentials": "rule:admin_or_owner" + +# Create an application credential. +# POST /v3/users/{user_id}/application_credentials +#"identity:create_application_credential": "rule:admin_or_owner" + +# Delete an application credential. +# DELETE /v3/users/{user_id}/application_credentials/{application_credential_id} +#"identity:delete_application_credential": "rule:admin_or_owner" + +# Authorize OAUTH1 request token. +# PUT /v3/OS-OAUTH1/authorize/{request_token_id} +# Intended scope(s): project +#"identity:authorize_request_token": "rule:admin_required" + +# Get OAUTH1 access token for user by access token ID. +# GET /v3/users/{user_id}/OS-OAUTH1/access_tokens/{access_token_id} +# Intended scope(s): project +#"identity:get_access_token": "rule:admin_required" + +# Get role for user OAUTH1 access token. +# GET /v3/users/{user_id}/OS-OAUTH1/access_tokens/{access_token_id}/roles/{role_id} +# Intended scope(s): project +#"identity:get_access_token_role": "rule:admin_required" + +# List OAUTH1 access tokens for user. +# GET /v3/users/{user_id}/OS-OAUTH1/access_tokens +# Intended scope(s): project +#"identity:list_access_tokens": "rule:admin_required" + +# List OAUTH1 access token roles. +# GET /v3/users/{user_id}/OS-OAUTH1/access_tokens/{access_token_id}/roles +# Intended scope(s): project +#"identity:list_access_token_roles": "rule:admin_required" + +# Delete OAUTH1 access token. +# DELETE /v3/users/{user_id}/OS-OAUTH1/access_tokens/{access_token_id} +# Intended scope(s): project +#"identity:delete_access_token": "rule:admin_required" + +# Get service catalog. +# GET /v3/auth/catalog +# HEAD /v3/auth/catalog +#"identity:get_auth_catalog": "" + +# List all projects a user has access to via role assignments. +# GET /v3/auth/projects +# HEAD /v3/auth/projects +#"identity:get_auth_projects": "" + +# List all domains a user has access to via role assignments. +# GET /v3/auth/domains +# HEAD /v3/auth/domains +#"identity:get_auth_domains": "" + +# List systems a user has access to via role assignments. +# GET /v3/auth/system +# HEAD /v3/auth/system +#"identity:get_auth_system": "" + +# Show OAUTH1 consumer details. +# GET /v3/OS-OAUTH1/consumers/{consumer_id} +# Intended scope(s): system +#"identity:get_consumer": "rule:admin_required" + +# List OAUTH1 consumers. +# GET /v3/OS-OAUTH1/consumers +# Intended scope(s): system +#"identity:list_consumers": "rule:admin_required" + +# Create OAUTH1 consumer. +# POST /v3/OS-OAUTH1/consumers +# Intended scope(s): system +#"identity:create_consumer": "rule:admin_required" + +# Update OAUTH1 consumer. +# PATCH /v3/OS-OAUTH1/consumers/{consumer_id} +# Intended scope(s): system +#"identity:update_consumer": "rule:admin_required" + +# Delete OAUTH1 consumer. +# DELETE /v3/OS-OAUTH1/consumers/{consumer_id} +# Intended scope(s): system +#"identity:delete_consumer": "rule:admin_required" + +# Show credentials details. +# GET /v3/credentials/{credential_id} +#"identity:get_credential": "rule:admin_required" + +# List credentials. +# GET /v3/credentials +#"identity:list_credentials": "rule:admin_required" + +# Create credential. +# POST /v3/credentials +#"identity:create_credential": "rule:admin_required" + +# Update credential. +# PATCH /v3/credentials/{credential_id} +#"identity:update_credential": "rule:admin_required" + +# Delete credential. +# DELETE /v3/credentials/{credential_id} +#"identity:delete_credential": "rule:admin_required" + +# Show domain details. +# GET /v3/domains/{domain_id} +# Intended scope(s): system +#"identity:get_domain": "rule:admin_required or token.project.domain.id:%(target.domain.id)s" + +# List domains. +# GET /v3/domains +# Intended scope(s): system +#"identity:list_domains": "rule:admin_required" + +# Create domain. +# POST /v3/domains +# Intended scope(s): system +#"identity:create_domain": "rule:admin_required" + +# Update domain. +# PATCH /v3/domains/{domain_id} +# Intended scope(s): system +#"identity:update_domain": "rule:admin_required" + +# Delete domain. +# DELETE /v3/domains/{domain_id} +# Intended scope(s): system +#"identity:delete_domain": "rule:admin_required" + +# Create domain configuration. +# PUT /v3/domains/{domain_id}/config +# Intended scope(s): system +#"identity:create_domain_config": "rule:admin_required" + +# Get the entire domain configuration for a domain, an option group +# within a domain, or a specific configuration option within a group +# for a domain. +# GET /v3/domains/{domain_id}/config +# HEAD /v3/domains/{domain_id}/config +# GET /v3/domains/{domain_id}/config/{group} +# HEAD /v3/domains/{domain_id}/config/{group} +# GET /v3/domains/{domain_id}/config/{group}/{option} +# HEAD /v3/domains/{domain_id}/config/{group}/{option} +# Intended scope(s): system +#"identity:get_domain_config": "rule:admin_required" + +# Get security compliance domain configuration for either a domain or +# a specific option in a domain. +# GET /v3/domains/{domain_id}/config/security_compliance +# HEAD /v3/domains/{domain_id}/config/security_compliance +# GET v3/domains/{domain_id}/config/security_compliance/{option} +# HEAD v3/domains/{domain_id}/config/security_compliance/{option} +# Intended scope(s): system, project +#"identity:get_security_compliance_domain_config": "" + +# Update domain configuration for either a domain, specific group or a +# specific option in a group. +# PATCH /v3/domains/{domain_id}/config +# PATCH /v3/domains/{domain_id}/config/{group} +# PATCH /v3/domains/{domain_id}/config/{group}/{option} +# Intended scope(s): system +#"identity:update_domain_config": "rule:admin_required" + +# Delete domain configuration for either a domain, specific group or a +# specific option in a group. +# DELETE /v3/domains/{domain_id}/config +# DELETE /v3/domains/{domain_id}/config/{group} +# DELETE /v3/domains/{domain_id}/config/{group}/{option} +# Intended scope(s): system +#"identity:delete_domain_config": "rule:admin_required" + +# Get domain configuration default for either a domain, specific group +# or a specific option in a group. +# GET /v3/domains/config/default +# HEAD /v3/domains/config/default +# GET /v3/domains/config/{group}/default +# HEAD /v3/domains/config/{group}/default +# GET /v3/domains/config/{group}/{option}/default +# HEAD /v3/domains/config/{group}/{option}/default +# Intended scope(s): system +#"identity:get_domain_config_default": "rule:admin_required" + +# Show ec2 credential details. +# GET /v3/users/{user_id}/credentials/OS-EC2/{credential_id} +#"identity:ec2_get_credential": "rule:admin_required or (rule:owner and user_id:%(target.credential.user_id)s)" + +# List ec2 credentials. +# GET /v3/users/{user_id}/credentials/OS-EC2 +#"identity:ec2_list_credentials": "rule:admin_or_owner" + +# Create ec2 credential. +# POST /v3/users/{user_id}/credentials/OS-EC2 +#"identity:ec2_create_credential": "rule:admin_or_owner" + +# Delete ec2 credential. +# DELETE /v3/users/{user_id}/credentials/OS-EC2/{credential_id} +#"identity:ec2_delete_credential": "rule:admin_required or (rule:owner and user_id:%(target.credential.user_id)s)" + +# Show endpoint details. +# GET /v3/endpoints/{endpoint_id} +# Intended scope(s): system +#"identity:get_endpoint": "rule:admin_required" + +# List endpoints. +# GET /v3/endpoints +# Intended scope(s): system +#"identity:list_endpoints": "rule:admin_required" + +# Create endpoint. +# POST /v3/endpoints +# Intended scope(s): system +#"identity:create_endpoint": "rule:admin_required" + +# Update endpoint. +# PATCH /v3/endpoints/{endpoint_id} +# Intended scope(s): system +#"identity:update_endpoint": "rule:admin_required" + +# Delete endpoint. +# DELETE /v3/endpoints/{endpoint_id} +# Intended scope(s): system +#"identity:delete_endpoint": "rule:admin_required" + +# Create endpoint group. +# POST /v3/OS-EP-FILTER/endpoint_groups +# Intended scope(s): system +#"identity:create_endpoint_group": "rule:admin_required" + +# List endpoint groups. +# GET /v3/OS-EP-FILTER/endpoint_groups +# Intended scope(s): system +#"identity:list_endpoint_groups": "rule:admin_required" + +# Get endpoint group. +# GET /v3/OS-EP-FILTER/endpoint_groups/{endpoint_group_id} +# HEAD /v3/OS-EP-FILTER/endpoint_groups/{endpoint_group_id} +# Intended scope(s): system +#"identity:get_endpoint_group": "rule:admin_required" + +# Update endpoint group. +# PATCH /v3/OS-EP-FILTER/endpoint_groups/{endpoint_group_id} +# Intended scope(s): system +#"identity:update_endpoint_group": "rule:admin_required" + +# Delete endpoint group. +# DELETE /v3/OS-EP-FILTER/endpoint_groups/{endpoint_group_id} +# Intended scope(s): system +#"identity:delete_endpoint_group": "rule:admin_required" + +# List all projects associated with a specific endpoint group. +# GET /v3/OS-EP-FILTER/endpoint_groups/{endpoint_group_id}/projects +# Intended scope(s): system +#"identity:list_projects_associated_with_endpoint_group": "rule:admin_required" + +# List all endpoints associated with an endpoint group. +# GET /v3/OS-EP-FILTER/endpoint_groups/{endpoint_group_id}/endpoints +# Intended scope(s): system +#"identity:list_endpoints_associated_with_endpoint_group": "rule:admin_required" + +# Check if an endpoint group is associated with a project. +# GET /v3/OS-EP-FILTER/endpoint_groups/{endpoint_group_id}/projects/{project_id} +# HEAD /v3/OS-EP-FILTER/endpoint_groups/{endpoint_group_id}/projects/{project_id} +# Intended scope(s): system +#"identity:get_endpoint_group_in_project": "rule:admin_required" + +# List endpoint groups associated with a specific project. +# GET /v3/OS-EP-FILTER/projects/{project_id}/endpoint_groups +# Intended scope(s): system +#"identity:list_endpoint_groups_for_project": "rule:admin_required" + +# Allow a project to access an endpoint group. +# PUT /v3/OS-EP-FILTER/endpoint_groups/{endpoint_group_id}/projects/{project_id} +# Intended scope(s): system +#"identity:add_endpoint_group_to_project": "rule:admin_required" + +# Remove endpoint group from project. +# DELETE /v3/OS-EP-FILTER/endpoint_groups/{endpoint_group_id}/projects/{project_id} +# Intended scope(s): system +#"identity:remove_endpoint_group_from_project": "rule:admin_required" + +# Check a role grant between a target and an actor. A target can be +# either a domain or a project. An actor can be either a user or a +# group. These terms also apply to the OS-INHERIT APIs, where grants +# on the target are inherited to all projects in the subtree, if +# applicable. +# HEAD /v3/projects/{project_id}/users/{user_id}/roles/{role_id} +# GET /v3/projects/{project_id}/users/{user_id}/roles/{role_id} +# HEAD /v3/projects/{project_id}/groups/{group_id}/roles/{role_id} +# GET /v3/projects/{project_id}/groups/{group_id}/roles/{role_id} +# HEAD /v3/domains/{domain_id}/users/{user_id}/roles/{role_id} +# GET /v3/domains/{domain_id}/users/{user_id}/roles/{role_id} +# HEAD /v3/domains/{domain_id}/groups/{group_id}/roles/{role_id} +# GET /v3/domains/{domain_id}/groups/{group_id}/roles/{role_id} +# HEAD /v3/OS-INHERIT/projects/{project_id}/users/{user_id}/roles/{role_id}/inherited_to_projects +# GET /v3/OS-INHERIT/projects/{project_id}/users/{user_id}/roles/{role_id}/inherited_to_projects +# HEAD /v3/OS-INHERIT/projects/{project_id}/groups/{group_id}/roles/{role_id}/inherited_to_projects +# GET /v3/OS-INHERIT/projects/{project_id}/groups/{group_id}/roles/{role_id}/inherited_to_projects +# HEAD /v3/OS-INHERIT/domains/{domain_id}/users/{user_id}/roles/{role_id}/inherited_to_projects +# GET /v3/OS-INHERIT/domains/{domain_id}/users/{user_id}/roles/{role_id}/inherited_to_projects +# HEAD /v3/OS-INHERIT/domains/{domain_id}/groups/{group_id}/roles/{role_id}/inherited_to_projects +# GET /v3/OS-INHERIT/domains/{domain_id}/groups/{group_id}/roles/{role_id}/inherited_to_projects +# Intended scope(s): system +#"identity:check_grant": "rule:admin_required" + +# List roles granted to an actor on a target. A target can be either a +# domain or a project. An actor can be either a user or a group. For +# the OS-INHERIT APIs, it is possible to list inherited role grants +# for actors on domains, where grants are inherited to all projects in +# the specified domain. +# GET /v3/projects/{project_id}/users/{user_id}/roles +# HEAD /v3/projects/{project_id}/users/{user_id}/roles +# GET /v3/projects/{project_id}/groups/{group_id}/roles +# HEAD /v3/projects/{project_id}/groups/{group_id}/roles +# GET /v3/domains/{domain_id}/users/{user_id}/roles +# HEAD /v3/domains/{domain_id}/users/{user_id}/roles +# GET /v3/domains/{domain_id}/groups/{group_id}/roles +# HEAD /v3/domains/{domain_id}/groups/{group_id}/roles +# GET /v3/OS-INHERIT/domains/{domain_id}/groups/{group_id}/roles/inherited_to_projects +# GET /v3/OS-INHERIT/domains/{domain_id}/users/{user_id}/roles/inherited_to_projects +# Intended scope(s): system +#"identity:list_grants": "rule:admin_required" + +# Create a role grant between a target and an actor. A target can be +# either a domain or a project. An actor can be either a user or a +# group. These terms also apply to the OS-INHERIT APIs, where grants +# on the target are inherited to all projects in the subtree, if +# applicable. +# PUT /v3/projects/{project_id}/users/{user_id}/roles/{role_id} +# PUT /v3/projects/{project_id}/groups/{group_id}/roles/{role_id} +# PUT /v3/domains/{domain_id}/users/{user_id}/roles/{role_id} +# PUT /v3/domains/{domain_id}/groups/{group_id}/roles/{role_id} +# PUT /v3/OS-INHERIT/projects/{project_id}/users/{user_id}/roles/{role_id}/inherited_to_projects +# PUT /v3/OS-INHERIT/projects/{project_id}/groups/{group_id}/roles/{role_id}/inherited_to_projects +# PUT /v3/OS-INHERIT/domains/{domain_id}/users/{user_id}/roles/{role_id}/inherited_to_projects +# PUT /v3/OS-INHERIT/domains/{domain_id}/groups/{group_id}/roles/{role_id}/inherited_to_projects +# Intended scope(s): system +#"identity:create_grant": "rule:admin_required" + +# Revoke a role grant between a target and an actor. A target can be +# either a domain or a project. An actor can be either a user or a +# group. These terms also apply to the OS-INHERIT APIs, where grants +# on the target are inherited to all projects in the subtree, if +# applicable. In that case, revoking the role grant in the target +# would remove the logical effect of inheriting it to the target's +# projects subtree. +# DELETE /v3/projects/{project_id}/users/{user_id}/roles/{role_id} +# DELETE /v3/projects/{project_id}/groups/{group_id}/roles/{role_id} +# DELETE /v3/domains/{domain_id}/users/{user_id}/roles/{role_id} +# DELETE /v3/domains/{domain_id}/groups/{group_id}/roles/{role_id} +# DELETE /v3/OS-INHERIT/projects/{project_id}/users/{user_id}/roles/{role_id}/inherited_to_projects +# DELETE /v3/OS-INHERIT/projects/{project_id}/groups/{group_id}/roles/{role_id}/inherited_to_projects +# DELETE /v3/OS-INHERIT/domains/{domain_id}/users/{user_id}/roles/{role_id}/inherited_to_projects +# DELETE /v3/OS-INHERIT/domains/{domain_id}/groups/{group_id}/roles/{role_id}/inherited_to_projects +# Intended scope(s): system +#"identity:revoke_grant": "rule:admin_required" + +# List all grants a specific user has on the system. +# ['HEAD', 'GET'] /v3/system/users/{user_id}/roles +# Intended scope(s): system +#"identity:list_system_grants_for_user": "rule:admin_required" + +# Check if a user has a role on the system. +# ['HEAD', 'GET'] /v3/system/users/{user_id}/roles/{role_id} +# Intended scope(s): system +#"identity:check_system_grant_for_user": "rule:admin_required" + +# Grant a user a role on the system. +# ['PUT'] /v3/system/users/{user_id}/roles/{role_id} +# Intended scope(s): system +#"identity:create_system_grant_for_user": "rule:admin_required" + +# Remove a role from a user on the system. +# ['DELETE'] /v3/system/users/{user_id}/roles/{role_id} +# Intended scope(s): system +#"identity:revoke_system_grant_for_user": "rule:admin_required" + +# List all grants a specific group has on the system. +# ['HEAD', 'GET'] /v3/system/groups/{group_id}/roles +# Intended scope(s): system +#"identity:list_system_grants_for_group": "rule:admin_required" + +# Check if a group has a role on the system. +# ['HEAD', 'GET'] /v3/system/groups/{group_id}/roles/{role_id} +# Intended scope(s): system +#"identity:check_system_grant_for_group": "rule:admin_required" + +# Grant a group a role on the system. +# ['PUT'] /v3/system/groups/{group_id}/roles/{role_id} +# Intended scope(s): system +#"identity:create_system_grant_for_group": "rule:admin_required" + +# Remove a role from a group on the system. +# ['DELETE'] /v3/system/groups/{group_id}/roles/{role_id} +# Intended scope(s): system +#"identity:revoke_system_grant_for_group": "rule:admin_required" + +# Show group details. +# GET /v3/groups/{group_id} +# HEAD /v3/groups/{group_id} +# Intended scope(s): system +#"identity:get_group": "rule:admin_required" + +# List groups. +# GET /v3/groups +# HEAD /v3/groups +# Intended scope(s): system +#"identity:list_groups": "rule:admin_required" + +# List groups to which a user belongs. +# GET /v3/users/{user_id}/groups +# HEAD /v3/users/{user_id}/groups +# Intended scope(s): system +#"identity:list_groups_for_user": "rule:admin_or_owner" + +# Create group. +# POST /v3/groups +# Intended scope(s): system +#"identity:create_group": "rule:admin_required" + +# Update group. +# PATCH /v3/groups/{group_id} +# Intended scope(s): system +#"identity:update_group": "rule:admin_required" + +# Delete group. +# DELETE /v3/groups/{group_id} +# Intended scope(s): system +#"identity:delete_group": "rule:admin_required" + +# List members of a specific group. +# GET /v3/groups/{group_id}/users +# HEAD /v3/groups/{group_id}/users +# Intended scope(s): system +#"identity:list_users_in_group": "rule:admin_required" + +# Remove user from group. +# DELETE /v3/groups/{group_id}/users/{user_id} +# Intended scope(s): system +#"identity:remove_user_from_group": "rule:admin_required" + +# Check whether a user is a member of a group. +# HEAD /v3/groups/{group_id}/users/{user_id} +# GET /v3/groups/{group_id}/users/{user_id} +# Intended scope(s): system +#"identity:check_user_in_group": "rule:admin_required" + +# Add user to group. +# PUT /v3/groups/{group_id}/users/{user_id} +# Intended scope(s): system +#"identity:add_user_to_group": "rule:admin_required" + +# Create identity provider. +# PUT /v3/OS-FEDERATION/identity_providers/{idp_id} +# Intended scope(s): system +#"identity:create_identity_provider": "rule:admin_required" + +# List identity providers. +# GET /v3/OS-FEDERATION/identity_providers +# HEAD /v3/OS-FEDERATION/identity_providers +# Intended scope(s): system +#"identity:list_identity_providers": "rule:admin_required" + +# Get identity provider. +# GET /v3/OS-FEDERATION/identity_providers/{idp_id} +# HEAD /v3/OS-FEDERATION/identity_providers/{idp_id} +# Intended scope(s): system +#"identity:get_identity_provider": "rule:admin_required" + +# Update identity provider. +# PATCH /v3/OS-FEDERATION/identity_providers/{idp_id} +# Intended scope(s): system +#"identity:update_identity_provider": "rule:admin_required" + +# Delete identity provider. +# DELETE /v3/OS-FEDERATION/identity_providers/{idp_id} +# Intended scope(s): system +#"identity:delete_identity_provider": "rule:admin_required" + +# Get information about an association between two roles. When a +# relationship exists between a prior role and an implied role and the +# prior role is assigned to a user, the user also assumes the implied +# role. +# GET /v3/roles/{prior_role_id}/implies/{implied_role_id} +# Intended scope(s): system +#"identity:get_implied_role": "rule:admin_required" + +# List associations between two roles. When a relationship exists +# between a prior role and an implied role and the prior role is +# assigned to a user, the user also assumes the implied role. This +# will return all the implied roles that would be assumed by the user +# who gets the specified prior role. +# GET /v3/roles/{prior_role_id}/implies +# HEAD /v3/roles/{prior_role_id}/implies +# Intended scope(s): system +#"identity:list_implied_roles": "rule:admin_required" + +# Create an association between two roles. When a relationship exists +# between a prior role and an implied role and the prior role is +# assigned to a user, the user also assumes the implied role. +# PUT /v3/roles/{prior_role_id}/implies/{implied_role_id} +# Intended scope(s): system +#"identity:create_implied_role": "rule:admin_required" + +# Delete the association between two roles. When a relationship exists +# between a prior role and an implied role and the prior role is +# assigned to a user, the user also assumes the implied role. Removing +# the association will cause that effect to be eliminated. +# DELETE /v3/roles/{prior_role_id}/implies/{implied_role_id} +# Intended scope(s): system +#"identity:delete_implied_role": "rule:admin_required" + +# List all associations between two roles in the system. When a +# relationship exists between a prior role and an implied role and the +# prior role is assigned to a user, the user also assumes the implied +# role. +# GET /v3/role_inferences +# HEAD /v3/role_inferences +# Intended scope(s): system +#"identity:list_role_inference_rules": "rule:admin_required" + +# Check an association between two roles. When a relationship exists +# between a prior role and an implied role and the prior role is +# assigned to a user, the user also assumes the implied role. +# HEAD /v3/roles/{prior_role_id}/implies/{implied_role_id} +# Intended scope(s): system +#"identity:check_implied_role": "rule:admin_required" + +# Show limit details. +# GET /v3/limits/{limit_id} +# HEAD /v3/limits/{limit_id} +# Intended scope(s): system, project +#"identity:get_limit": "" + +# List limits. +# GET /v3/limits +# HEAD /v3/limits +# Intended scope(s): system, project +#"identity:list_limits": "" + +# Create limits. +# POST /v3/limits +# Intended scope(s): system +#"identity:create_limits": "rule:admin_required" + +# Update limits. +# PUT /v3/limits/{limit_id} +# Intended scope(s): system +#"identity:update_limits": "rule:admin_required" + +# Delete limit. +# DELETE /v3/limits/{limit_id} +# Intended scope(s): system +#"identity:delete_limit": "rule:admin_required" + +# Create a new federated mapping containing one or more sets of rules. +# PUT /v3/OS-FEDERATION/mappings/{mapping_id} +# Intended scope(s): system +#"identity:create_mapping": "rule:admin_required" + +# Get a federated mapping. +# GET /v3/OS-FEDERATION/mappings/{mapping_id} +# HEAD /v3/OS-FEDERATION/mappings/{mapping_id} +# Intended scope(s): system +#"identity:get_mapping": "rule:admin_required" + +# List federated mappings. +# GET /v3/OS-FEDERATION/mappings +# HEAD /v3/OS-FEDERATION/mappings +# Intended scope(s): system +#"identity:list_mappings": "rule:admin_required" + +# Delete a federated mapping. +# DELETE /v3/OS-FEDERATION/mappings/{mapping_id} +# Intended scope(s): system +#"identity:delete_mapping": "rule:admin_required" + +# Update a federated mapping. +# PATCH /v3/OS-FEDERATION/mappings/{mapping_id} +# Intended scope(s): system +#"identity:update_mapping": "rule:admin_required" + +# Show policy details. +# GET /v3/policy/{policy_id} +# Intended scope(s): system +#"identity:get_policy": "rule:admin_required" + +# List policies. +# GET /v3/policies +# Intended scope(s): system +#"identity:list_policies": "rule:admin_required" + +# Create policy. +# POST /v3/policies +# Intended scope(s): system +#"identity:create_policy": "rule:admin_required" + +# Update policy. +# PATCH /v3/policies/{policy_id} +# Intended scope(s): system +#"identity:update_policy": "rule:admin_required" + +# Delete policy. +# DELETE /v3/policies/{policy_id} +# Intended scope(s): system +#"identity:delete_policy": "rule:admin_required" + +# Associate a policy to a specific endpoint. +# PUT /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/endpoints/{endpoint_id} +# Intended scope(s): system +#"identity:create_policy_association_for_endpoint": "rule:admin_required" + +# Check policy association for endpoint. +# GET /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/endpoints/{endpoint_id} +# HEAD /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/endpoints/{endpoint_id} +# Intended scope(s): system +#"identity:check_policy_association_for_endpoint": "rule:admin_required" + +# Delete policy association for endpoint. +# DELETE /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/endpoints/{endpoint_id} +# Intended scope(s): system +#"identity:delete_policy_association_for_endpoint": "rule:admin_required" + +# Associate a policy to a specific service. +# PUT /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/services/{service_id} +# Intended scope(s): system +#"identity:create_policy_association_for_service": "rule:admin_required" + +# Check policy association for service. +# GET /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/services/{service_id} +# HEAD /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/services/{service_id} +# Intended scope(s): system +#"identity:check_policy_association_for_service": "rule:admin_required" + +# Delete policy association for service. +# DELETE /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/services/{service_id} +# Intended scope(s): system +#"identity:delete_policy_association_for_service": "rule:admin_required" + +# Associate a policy to a specific region and service combination. +# PUT /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/services/{service_id}/regions/{region_id} +# Intended scope(s): system +#"identity:create_policy_association_for_region_and_service": "rule:admin_required" + +# Check policy association for region and service. +# GET /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/services/{service_id}/regions/{region_id} +# HEAD /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/services/{service_id}/regions/{region_id} +# Intended scope(s): system +#"identity:check_policy_association_for_region_and_service": "rule:admin_required" + +# Delete policy association for region and service. +# DELETE /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/services/{service_id}/regions/{region_id} +# Intended scope(s): system +#"identity:delete_policy_association_for_region_and_service": "rule:admin_required" + +# Get policy for endpoint. +# GET /v3/endpoints/{endpoint_id}/OS-ENDPOINT-POLICY/policy +# HEAD /v3/endpoints/{endpoint_id}/OS-ENDPOINT-POLICY/policy +# Intended scope(s): system +#"identity:get_policy_for_endpoint": "rule:admin_required" + +# List endpoints for policy. +# GET /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/endpoints +# Intended scope(s): system +#"identity:list_endpoints_for_policy": "rule:admin_required" + +# Show project details. +# GET /v3/projects/{project_id} +#"identity:get_project": "rule:admin_required or project_id:%(target.project.id)s" + +# List projects. +# GET /v3/projects +# Intended scope(s): system +#"identity:list_projects": "rule:admin_required" + +# List projects for user. +# GET /v3/users/{user_id}/projects +#"identity:list_user_projects": "rule:admin_or_owner" + +# Create project. +# POST /v3/projects +# Intended scope(s): system +#"identity:create_project": "rule:admin_required" + +# Update project. +# PATCH /v3/projects/{project_id} +# Intended scope(s): system +#"identity:update_project": "rule:admin_required" + +# Delete project. +# DELETE /v3/projects/{project_id} +# Intended scope(s): system +#"identity:delete_project": "rule:admin_required" + +# List tags for a project. +# GET /v3/projects/{project_id}/tags +# HEAD /v3/projects/{project_id}/tags +#"identity:list_project_tags": "rule:admin_required or project_id:%(target.project.id)s" + +# Check if project contains a tag. +# GET /v3/projects/{project_id}/tags/{value} +# HEAD /v3/projects/{project_id}/tags/{value} +#"identity:get_project_tag": "rule:admin_required or project_id:%(target.project.id)s" + +# Replace all tags on a project with the new set of tags. +# PUT /v3/projects/{project_id}/tags +# Intended scope(s): system +#"identity:update_project_tags": "rule:admin_required" + +# Add a single tag to a project. +# PUT /v3/projects/{project_id}/tags/{value} +# Intended scope(s): system +#"identity:create_project_tag": "rule:admin_required" + +# Remove all tags from a project. +# DELETE /v3/projects/{project_id}/tags +# Intended scope(s): system +#"identity:delete_project_tags": "rule:admin_required" + +# Delete a specified tag from project. +# DELETE /v3/projects/{project_id}/tags/{value} +# Intended scope(s): system +#"identity:delete_project_tag": "rule:admin_required" + +# List projects allowed to access an endpoint. +# GET /v3/OS-EP-FILTER/endpoints/{endpoint_id}/projects +# Intended scope(s): system +#"identity:list_projects_for_endpoint": "rule:admin_required" + +# Allow project to access an endpoint. +# PUT /v3/OS-EP-FILTER/projects/{project_id}/endpoints/{endpoint_id} +# Intended scope(s): system +#"identity:add_endpoint_to_project": "rule:admin_required" + +# Check if a project is allowed to access an endpoint. +# GET /v3/OS-EP-FILTER/projects/{project_id}/endpoints/{endpoint_id} +# HEAD /v3/OS-EP-FILTER/projects/{project_id}/endpoints/{endpoint_id} +# Intended scope(s): system +#"identity:check_endpoint_in_project": "rule:admin_required" + +# List the endpoints a project is allowed to access. +# GET /v3/OS-EP-FILTER/projects/{project_id}/endpoints +# Intended scope(s): system +#"identity:list_endpoints_for_project": "rule:admin_required" + +# Remove access to an endpoint from a project that has previously been +# given explicit access. +# DELETE /v3/OS-EP-FILTER/projects/{project_id}/endpoints/{endpoint_id} +# Intended scope(s): system +#"identity:remove_endpoint_from_project": "rule:admin_required" + +# Create federated protocol. +# PUT /v3/OS-FEDERATION/identity_providers/{idp_id}/protocols/{protocol_id} +# Intended scope(s): system +#"identity:create_protocol": "rule:admin_required" + +# Update federated protocol. +# PATCH /v3/OS-FEDERATION/identity_providers/{idp_id}/protocols/{protocol_id} +# Intended scope(s): system +#"identity:update_protocol": "rule:admin_required" + +# Get federated protocol. +# GET /v3/OS-FEDERATION/identity_providers/{idp_id}/protocols/{protocol_id} +# Intended scope(s): system +#"identity:get_protocol": "rule:admin_required" + +# List federated protocols. +# GET /v3/OS-FEDERATION/identity_providers/{idp_id}/protocols +# Intended scope(s): system +#"identity:list_protocols": "rule:admin_required" + +# Delete federated protocol. +# DELETE /v3/OS-FEDERATION/identity_providers/{idp_id}/protocols/{protocol_id} +# Intended scope(s): system +#"identity:delete_protocol": "rule:admin_required" + +# Show region details. +# GET /v3/regions/{region_id} +# HEAD /v3/regions/{region_id} +# Intended scope(s): system, project +#"identity:get_region": "" + +# List regions. +# GET /v3/regions +# HEAD /v3/regions +# Intended scope(s): system, project +#"identity:list_regions": "" + +# Create region. +# POST /v3/regions +# PUT /v3/regions/{region_id} +# Intended scope(s): system +#"identity:create_region": "rule:admin_required" + +# Update region. +# PATCH /v3/regions/{region_id} +# Intended scope(s): system +#"identity:update_region": "rule:admin_required" + +# Delete region. +# DELETE /v3/regions/{region_id} +# Intended scope(s): system +#"identity:delete_region": "rule:admin_required" + +# Show registered limit details. +# GET /v3/registered_limits/{registered_limit_id} +# HEAD /v3/registered_limits/{registered_limit_id} +# Intended scope(s): system, project +#"identity:get_registered_limit": "" + +# List registered limits. +# GET /v3/registered_limits +# HEAD /v3/registered_limits +# Intended scope(s): system, project +#"identity:list_registered_limits": "" + +# Create registered limits. +# POST /v3/registered_limits +# Intended scope(s): system +#"identity:create_registered_limits": "rule:admin_required" + +# Update registered limits. +# PUT /v3/registered_limits/{registered_limit_id} +# Intended scope(s): system +#"identity:update_registered_limits": "rule:admin_required" + +# Delete registered limit. +# DELETE /v3/registered_limits/{registered_limit_id} +# Intended scope(s): system +#"identity:delete_registered_limit": "rule:admin_required" + +# List revocation events. +# GET /v3/OS-REVOKE/events +# Intended scope(s): system +#"identity:list_revoke_events": "rule:service_or_admin" + +# Show role details. +# GET /v3/roles/{role_id} +# HEAD /v3/roles/{role_id} +# Intended scope(s): system +#"identity:get_role": "rule:admin_required" + +# List roles. +# GET /v3/roles +# HEAD /v3/roles +# Intended scope(s): system +#"identity:list_roles": "rule:admin_required" + +# Create role. +# POST /v3/roles +# Intended scope(s): system +#"identity:create_role": "rule:admin_required" + +# Update role. +# PATCH /v3/roles/{role_id} +# Intended scope(s): system +#"identity:update_role": "rule:admin_required" + +# Delete role. +# DELETE /v3/roles/{role_id} +# Intended scope(s): system +#"identity:delete_role": "rule:admin_required" + +# Show domain role. +# GET /v3/roles/{role_id} +# HEAD /v3/roles/{role_id} +# Intended scope(s): system +#"identity:get_domain_role": "rule:admin_required" + +# List domain roles. +# GET /v3/roles?domain_id={domain_id} +# HEAD /v3/roles?domain_id={domain_id} +# Intended scope(s): system +#"identity:list_domain_roles": "rule:admin_required" + +# Create domain role. +# POST /v3/roles +# Intended scope(s): system +#"identity:create_domain_role": "rule:admin_required" + +# Update domain role. +# PATCH /v3/roles/{role_id} +# Intended scope(s): system +#"identity:update_domain_role": "rule:admin_required" + +# Delete domain role. +# DELETE /v3/roles/{role_id} +# Intended scope(s): system +#"identity:delete_domain_role": "rule:admin_required" + +# List role assignments. +# GET /v3/role_assignments +# HEAD /v3/role_assignments +# Intended scope(s): system +#"identity:list_role_assignments": "rule:admin_required" + +# List all role assignments for a given tree of hierarchical projects. +# GET /v3/role_assignments?include_subtree +# HEAD /v3/role_assignments?include_subtree +# Intended scope(s): project +#"identity:list_role_assignments_for_tree": "rule:admin_required" + +# Show service details. +# GET /v3/services/{service_id} +# Intended scope(s): system +#"identity:get_service": "rule:admin_required" + +# List services. +# GET /v3/services +# Intended scope(s): system +#"identity:list_services": "rule:admin_required" + +# Create service. +# POST /v3/services +# Intended scope(s): system +#"identity:create_service": "rule:admin_required" + +# Update service. +# PATCH /v3/services/{service_id} +# Intended scope(s): system +#"identity:update_service": "rule:admin_required" + +# Delete service. +# DELETE /v3/services/{service_id} +# Intended scope(s): system +#"identity:delete_service": "rule:admin_required" + +# Create federated service provider. +# PUT /v3/OS-FEDERATION/service_providers/{service_provider_id} +# Intended scope(s): system +#"identity:create_service_provider": "rule:admin_required" + +# List federated service providers. +# GET /v3/OS-FEDERATION/service_providers +# HEAD /v3/OS-FEDERATION/service_providers +# Intended scope(s): system +#"identity:list_service_providers": "rule:admin_required" + +# Get federated service provider. +# GET /v3/OS-FEDERATION/service_providers/{service_provider_id} +# HEAD /v3/OS-FEDERATION/service_providers/{service_provider_id} +# Intended scope(s): system +#"identity:get_service_provider": "rule:admin_required" + +# Update federated service provider. +# PATCH /v3/OS-FEDERATION/service_providers/{service_provider_id} +# Intended scope(s): system +#"identity:update_service_provider": "rule:admin_required" + +# Delete federated service provider. +# DELETE /v3/OS-FEDERATION/service_providers/{service_provider_id} +# Intended scope(s): system +#"identity:delete_service_provider": "rule:admin_required" + +# List revoked PKI tokens. +# GET /v3/auth/tokens/OS-PKI/revoked +# Intended scope(s): system, project +#"identity:revocation_list": "rule:service_or_admin" + +# Check a token. +# HEAD /v3/auth/tokens +#"identity:check_token": "rule:admin_or_token_subject" + +# Validate a token. +# GET /v3/auth/tokens +# GET /v2.0/tokens/{token_id} +#"identity:validate_token": "rule:service_admin_or_token_subject" + +# Validate a token. +# HEAD /v2.0/tokens/{token_id} +#"identity:validate_token_head": "rule:service_or_admin" + +# Revoke a token. +# DELETE /v3/auth/tokens +#"identity:revoke_token": "rule:admin_or_token_subject" + +# Create trust. +# POST /v3/OS-TRUST/trusts +# Intended scope(s): project +#"identity:create_trust": "user_id:%(trust.trustor_user_id)s" + +# List trusts. +# GET /v3/OS-TRUST/trusts +# HEAD /v3/OS-TRUST/trusts +# Intended scope(s): project +#"identity:list_trusts": "" + +# List roles delegated by a trust. +# GET /v3/OS-TRUST/trusts/{trust_id}/roles +# HEAD /v3/OS-TRUST/trusts/{trust_id}/roles +# Intended scope(s): project +#"identity:list_roles_for_trust": "" + +# Check if trust delegates a particular role. +# GET /v3/OS-TRUST/trusts/{trust_id}/roles/{role_id} +# HEAD /v3/OS-TRUST/trusts/{trust_id}/roles/{role_id} +# Intended scope(s): project +#"identity:get_role_for_trust": "" + +# Revoke trust. +# DELETE /v3/OS-TRUST/trusts/{trust_id} +# Intended scope(s): project +#"identity:delete_trust": "" + +# Get trust. +# GET /v3/OS-TRUST/trusts/{trust_id} +# HEAD /v3/OS-TRUST/trusts/{trust_id} +# Intended scope(s): project +#"identity:get_trust": "" + +# Show user details. +# GET /v3/users/{user_id} +# HEAD /v3/users/{user_id} +#"identity:get_user": "rule:admin_or_owner" + +# List users. +# GET /v3/users +# HEAD /v3/users +# Intended scope(s): system +#"identity:list_users": "rule:admin_required" + +# List all projects a user has access to via role assignments. +# GET /v3/auth/projects +#"identity:list_projects_for_user": "" + +# List all domains a user has access to via role assignments. +# GET /v3/auth/domains +#"identity:list_domains_for_user": "" + +# Create a user. +# POST /v3/users +# Intended scope(s): system +#"identity:create_user": "rule:admin_required" + +# Update a user, including administrative password resets. +# PATCH /v3/users/{user_id} +# Intended scope(s): system +#"identity:update_user": "rule:admin_required" + +# Delete a user. +# DELETE /v3/users/{user_id} +# Intended scope(s): system +#"identity:delete_user": "rule:admin_required" + diff --git a/openstack/openstack_conf/controller/keystone/logging.conf b/openstack/openstack_conf/controller/keystone/logging.conf new file mode 100644 index 0000000..6cb8c42 --- /dev/null +++ b/openstack/openstack_conf/controller/keystone/logging.conf @@ -0,0 +1,65 @@ +[loggers] +keys=root,access + +[handlers] +keys=production,file,access_file,devel + +[formatters] +keys=minimal,normal,debug + + +########### +# Loggers # +########### + +[logger_root] +level=WARNING +handlers=file + +[logger_access] +level=INFO +qualname=access +handlers=access_file + + +################ +# Log Handlers # +################ + +[handler_production] +class=handlers.SysLogHandler +level=ERROR +formatter=normal +args=(('localhost', handlers.SYSLOG_UDP_PORT), handlers.SysLogHandler.LOG_USER) + +[handler_file] +class=handlers.WatchedFileHandler +level=WARNING +formatter=normal +args=('error.log',) + +[handler_access_file] +class=handlers.WatchedFileHandler +level=INFO +formatter=minimal +args=('access.log',) + +[handler_devel] +class=StreamHandler +level=NOTSET +formatter=debug +args=(sys.stdout,) + + +################## +# Log Formatters # +################## + +[formatter_minimal] +format=%(message)s + +[formatter_normal] +format=(%(name)s): %(asctime)s %(levelname)s %(message)s + +[formatter_debug] +format=(%(name)s): %(asctime)s %(levelname)s %(module)s %(funcName)s %(message)s diff --git a/openstack/openstack_conf/controller/keystone/sso_callback_template.html b/openstack/openstack_conf/controller/keystone/sso_callback_template.html new file mode 100644 index 0000000..c6997dc --- /dev/null +++ b/openstack/openstack_conf/controller/keystone/sso_callback_template.html @@ -0,0 +1,22 @@ + + + + Keystone WebSSO redirect + + +
+ Please wait... +
+ + +
+ + + \ No newline at end of file diff --git a/openstack/openstack_conf/controller/neutron/api-paste.ini b/openstack/openstack_conf/controller/neutron/api-paste.ini new file mode 100644 index 0000000..f79088c --- /dev/null +++ b/openstack/openstack_conf/controller/neutron/api-paste.ini @@ -0,0 +1,45 @@ +[composite:neutron] +use = egg:Paste#urlmap +/: neutronversions_composite +/v2.0: neutronapi_v2_0 + +[composite:neutronapi_v2_0] +use = call:neutron.auth:pipeline_factory +noauth = cors http_proxy_to_wsgi request_id catch_errors extensions neutronapiapp_v2_0 +keystone = cors http_proxy_to_wsgi request_id catch_errors authtoken keystonecontext extensions neutronapiapp_v2_0 + +[composite:neutronversions_composite] +use = call:neutron.auth:pipeline_factory +noauth = cors http_proxy_to_wsgi neutronversions +keystone = cors http_proxy_to_wsgi neutronversions + +[filter:request_id] +paste.filter_factory = oslo_middleware:RequestId.factory + +[filter:catch_errors] +paste.filter_factory = oslo_middleware:CatchErrors.factory + +[filter:cors] +paste.filter_factory = oslo_middleware.cors:filter_factory +oslo_config_project = neutron + +[filter:http_proxy_to_wsgi] +paste.filter_factory = oslo_middleware.http_proxy_to_wsgi:HTTPProxyToWSGI.factory + +[filter:keystonecontext] +paste.filter_factory = neutron.auth:NeutronKeystoneContext.factory + +[filter:authtoken] +paste.filter_factory = keystonemiddleware.auth_token:filter_factory + +[filter:extensions] +paste.filter_factory = neutron.api.extensions:plugin_aware_extension_middleware_factory + +[app:neutronversions] +paste.app_factory = neutron.pecan_wsgi.app:versions_factory + +[app:neutronapiapp_v2_0] +paste.app_factory = neutron.api.v2.router:APIRouter.factory + +[filter:osprofiler] +paste.filter_factory = osprofiler.web:WsgiMiddleware.factory diff --git a/openstack/openstack_conf/controller/neutron/dhcp_agent.ini b/openstack/openstack_conf/controller/neutron/dhcp_agent.ini new file mode 100644 index 0000000..c411827 --- /dev/null +++ b/openstack/openstack_conf/controller/neutron/dhcp_agent.ini @@ -0,0 +1,269 @@ +[DEFAULT] +dnsmasq_config_file = /etc/neutron/dnsmasq-neutron.conf +enable_isolated_metadata = true +dhcp_driver = neutron.agent.linux.dhcp.Dnsmasq +interface_driver = linuxbridge + +# +# From neutron.base.agent +# + +# Name of Open vSwitch bridge to use (string value) +#ovs_integration_bridge = br-int + +# Uses veth for an OVS interface or not. Support kernels with limited namespace +# support (e.g. RHEL 6.5) and rate limiting on router's gateway port so long as +# ovs_use_veth is set to True. (boolean value) +#ovs_use_veth = false + +# The driver used to manage the virtual interface. (string value) +#interface_driver = + +# +# From neutron.dhcp.agent +# + +# The DHCP agent will resync its state with Neutron to recover from any +# transient notification or RPC errors. The interval is number of seconds +# between attempts. (integer value) +#resync_interval = 5 + +# The driver used to manage the DHCP server. (string value) +#dhcp_driver = neutron.agent.linux.dhcp.Dnsmasq + +# The DHCP server can assist with providing metadata support on isolated +# networks. Setting this value to True will cause the DHCP server to append +# specific host routes to the DHCP request. The metadata service will only be +# activated when the subnet does not contain any router port. The guest +# instance must be configured to request host routes via DHCP (Option 121). +# This option doesn't have any effect when force_metadata is set to True. +# (boolean value) +#enable_isolated_metadata = false + +# In some cases the Neutron router is not present to provide the metadata IP +# but the DHCP server can be used to provide this info. Setting this value will +# force the DHCP server to append specific host routes to the DHCP request. If +# this option is set, then the metadata service will be activated for all the +# networks. (boolean value) +#force_metadata = false + +# Allows for serving metadata requests coming from a dedicated metadata access +# network whose CIDR is 169.254.169.254/16 (or larger prefix), and is connected +# to a Neutron router from which the VMs send metadata:1 request. In this case +# DHCP Option 121 will not be injected in VMs, as they will be able to reach +# 169.254.169.254 through a router. This option requires +# enable_isolated_metadata = True. (boolean value) +#enable_metadata_network = false + +# Number of threads to use during sync process. Should not exceed connection +# pool size configured on server. (integer value) +#num_sync_threads = 4 + +# Location to store DHCP server config files. (string value) +#dhcp_confs = $state_path/dhcp + +# Override the default dnsmasq settings with this file. (string value) +#dnsmasq_config_file = + +# Comma-separated list of the DNS servers which will be used as forwarders. +# (list value) +#dnsmasq_dns_servers = + +# Base log dir for dnsmasq logging. The log contains DHCP and DNS log +# information and is useful for debugging issues with either DHCP or DNS. If +# this section is null, disable dnsmasq log. (string value) +#dnsmasq_base_log_dir = + +# Enables the dnsmasq service to provide name resolution for instances via DNS +# resolvers on the host running the DHCP agent. Effectively removes the '--no- +# resolv' option from the dnsmasq process arguments. Adding custom DNS +# resolvers to the 'dnsmasq_dns_servers' option disables this feature. (boolean +# value) +#dnsmasq_local_resolv = false + +# Limit number of leases to prevent a denial-of-service. (integer value) +#dnsmasq_lease_max = 16777216 + +# Use broadcast in DHCP replies. (boolean value) +#dhcp_broadcast_reply = false + +# DHCP renewal time T1 (in seconds). If set to 0, it will default to half of +# the lease time. (integer value) +#dhcp_renewal_time = 0 + +# DHCP rebinding time T2 (in seconds). If set to 0, it will default to 7/8 of +# the lease time. (integer value) +#dhcp_rebinding_time = 0 + +# +# From oslo.log +# + +# If set to true, the logging level will be set to DEBUG instead of the default +# INFO level. (boolean value) +# Note: This option can be changed without restarting. +#debug = false + +# The name of a logging configuration file. This file is appended to any +# existing logging configuration files. For details about logging configuration +# files, see the Python logging module documentation. Note that when logging +# configuration files are used then all logging configuration is set in the +# configuration file and other logging configuration options are ignored (for +# example, logging_context_format_string). (string value) +# Note: This option can be changed without restarting. +# Deprecated group/name - [DEFAULT]/log_config +#log_config_append = + +# Defines the format string for %%(asctime)s in log records. Default: +# %(default)s . This option is ignored if log_config_append is set. (string +# value) +#log_date_format = %Y-%m-%d %H:%M:%S + +# (Optional) Name of log file to send logging output to. If no default is set, +# logging will go to stderr as defined by use_stderr. This option is ignored if +# log_config_append is set. (string value) +# Deprecated group/name - [DEFAULT]/logfile +#log_file = + +# (Optional) The base directory used for relative log_file paths. This option +# is ignored if log_config_append is set. (string value) +# Deprecated group/name - [DEFAULT]/logdir +#log_dir = + +# Uses logging handler designed to watch file system. When log file is moved or +# removed this handler will open a new log file with specified path +# instantaneously. It makes sense only if log_file option is specified and +# Linux platform is used. This option is ignored if log_config_append is set. +# (boolean value) +#watch_log_file = false + +# Use syslog for logging. Existing syslog format is DEPRECATED and will be +# changed later to honor RFC5424. This option is ignored if log_config_append +# is set. (boolean value) +#use_syslog = false + +# Enable journald for logging. If running in a systemd environment you may wish +# to enable journal support. Doing so will use the journal native protocol +# which includes structured metadata in addition to log messages.This option is +# ignored if log_config_append is set. (boolean value) +#use_journal = false + +# Syslog facility to receive log lines. This option is ignored if +# log_config_append is set. (string value) +#syslog_log_facility = LOG_USER + +# Use JSON formatting for logging. This option is ignored if log_config_append +# is set. (boolean value) +#use_json = false + +# Log output to standard error. This option is ignored if log_config_append is +# set. (boolean value) +#use_stderr = false + +# Format string to use for log messages with context. (string value) +#logging_context_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user_identity)s] %(instance)s%(message)s + +# Format string to use for log messages when context is undefined. (string +# value) +#logging_default_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [-] %(instance)s%(message)s + +# Additional data to append to log message when logging level for the message +# is DEBUG. (string value) +#logging_debug_format_suffix = %(funcName)s %(pathname)s:%(lineno)d + +# Prefix each line of exception output with this format. (string value) +#logging_exception_prefix = %(asctime)s.%(msecs)03d %(process)d ERROR %(name)s %(instance)s + +# Defines the format string for %(user_identity)s that is used in +# logging_context_format_string. (string value) +#logging_user_identity_format = %(user)s %(tenant)s %(domain)s %(user_domain)s %(project_domain)s + +# List of package logging levels in logger=LEVEL pairs. This option is ignored +# if log_config_append is set. (list value) +#default_log_levels = amqp=WARN,amqplib=WARN,boto=WARN,qpid=WARN,sqlalchemy=WARN,suds=INFO,oslo.messaging=INFO,oslo_messaging=INFO,iso8601=WARN,requests.packages.urllib3.connectionpool=WARN,urllib3.connectionpool=WARN,websocket=WARN,requests.packages.urllib3.util.retry=WARN,urllib3.util.retry=WARN,keystonemiddleware=WARN,routes.middleware=WARN,stevedore=WARN,taskflow=WARN,keystoneauth=WARN,oslo.cache=INFO,dogpile.core.dogpile=INFO + +# Enables or disables publication of error events. (boolean value) +#publish_errors = false + +# The format for an instance that is passed with the log message. (string +# value) +#instance_format = "[instance: %(uuid)s] " + +# The format for an instance UUID that is passed with the log message. (string +# value) +#instance_uuid_format = "[instance: %(uuid)s] " + +# Interval, number of seconds, of log rate limiting. (integer value) +#rate_limit_interval = 0 + +# Maximum number of logged messages per rate_limit_interval. (integer value) +#rate_limit_burst = 0 + +# Log level name used by rate limiting: CRITICAL, ERROR, INFO, WARNING, DEBUG +# or empty string. Logs with level greater or equal to rate_limit_except_level +# are not filtered. An empty string means that all levels are filtered. (string +# value) +#rate_limit_except_level = CRITICAL + +# Enables or disables fatal status of deprecations. (boolean value) +#fatal_deprecations = false + + +[agent] + +# +# From neutron.az.agent +# + +# Availability zone of this node (string value) +#availability_zone = nova + +# +# From neutron.base.agent +# + +# Seconds between nodes reporting state to server; should be less than +# agent_down_time, best if it is half or less than agent_down_time. (floating +# point value) +#report_interval = 30 + +# Log agent heartbeats (boolean value) +#log_agent_heartbeats = false + + +[ovs] + +# +# From neutron.base.agent +# + +# DEPRECATED: The interface for interacting with the OVSDB (string value) +# Possible values: +# vsctl - +# native - +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +#ovsdb_interface = native + +# The connection string for the OVSDB backend. Will be used by ovsdb-client +# when monitoring and used for the all ovsdb commands when native +# ovsdb_interface is enabled (string value) +#ovsdb_connection = tcp:127.0.0.1:6640 + +# The SSL private key file to use when interacting with OVSDB. Required when +# using an "ssl:" prefixed ovsdb_connection (string value) +#ssl_key_file = + +# The SSL certificate file to use when interacting with OVSDB. Required when +# using an "ssl:" prefixed ovsdb_connection (string value) +#ssl_cert_file = + +# The Certificate Authority (CA) certificate to use when interacting with +# OVSDB. Required when using an "ssl:" prefixed ovsdb_connection (string +# value) +#ssl_ca_cert_file = + +# Timeout in seconds for ovsdb commands. If the timeout expires, ovsdb commands +# will fail with ALARMCLOCK error. (integer value) +# Deprecated group/name - [DEFAULT]/ovs_vsctl_timeout +#ovsdb_timeout = 10 diff --git a/openstack/openstack_conf/controller/neutron/dnsmasq-neutron.conf b/openstack/openstack_conf/controller/neutron/dnsmasq-neutron.conf new file mode 100644 index 0000000..24b80d7 --- /dev/null +++ b/openstack/openstack_conf/controller/neutron/dnsmasq-neutron.conf @@ -0,0 +1,8 @@ +# Override --no-hosts dnsmasq option supplied by neutron +addn-hosts=/etc/hosts + +# Log dnsmasq queries to syslog +log-queries + +# Verbose logging for DHCP +log-dhcp diff --git a/openstack/openstack_conf/controller/neutron/fwaas_driver.ini b/openstack/openstack_conf/controller/neutron/fwaas_driver.ini new file mode 100644 index 0000000..a707978 --- /dev/null +++ b/openstack/openstack_conf/controller/neutron/fwaas_driver.ini @@ -0,0 +1,23 @@ +[DEFAULT] + + +[fwaas] + +# +# From firewall.agent +# + +# Name of the FWaaS Driver (string value) +#driver = + +# Enable FWaaS (boolean value) +#enabled = false + +# Firewall agent class (string value) +#agent_version = v2 + +# Name of the FWaaS Conntrack Driver (string value) +#conntrack_driver = conntrack + +# Name of the firewall l2 driver (string value) +#firewall_l2_driver = noop diff --git a/openstack/openstack_conf/controller/neutron/l3_agent.ini b/openstack/openstack_conf/controller/neutron/l3_agent.ini new file mode 100644 index 0000000..93495d0 --- /dev/null +++ b/openstack/openstack_conf/controller/neutron/l3_agent.ini @@ -0,0 +1,346 @@ +[DEFAULT] +external_network_bridge = +interface_driver = linuxbridge + +# +# From neutron.base.agent +# + +# Name of Open vSwitch bridge to use (string value) +#ovs_integration_bridge = br-int + +# Uses veth for an OVS interface or not. Support kernels with limited namespace +# support (e.g. RHEL 6.5) and rate limiting on router's gateway port so long as +# ovs_use_veth is set to True. (boolean value) +#ovs_use_veth = false + +# The driver used to manage the virtual interface. (string value) +#interface_driver = + +# +# From neutron.l3.agent +# + +# The working mode for the agent. Allowed modes are: 'legacy' - this preserves +# the existing behavior where the L3 agent is deployed on a centralized +# networking node to provide L3 services like DNAT, and SNAT. Use this mode if +# you do not want to adopt DVR. 'dvr' - this mode enables DVR functionality and +# must be used for an L3 agent that runs on a compute host. 'dvr_snat' - this +# enables centralized SNAT support in conjunction with DVR. This mode must be +# used for an L3 agent running on a centralized node (or in single-host +# deployments, e.g. devstack). 'dvr_no_external' - this mode enables only +# East/West DVR routing functionality for a L3 agent that runs on a compute +# host, the North/South functionality such as DNAT and SNAT will be provided by +# the centralized network node that is running in 'dvr_snat' mode. This mode +# should be used when there is no external network connectivity on the compute +# host. (string value) +# Possible values: +# dvr - +# dvr_snat - +# legacy - +# dvr_no_external - +#agent_mode = legacy + +# TCP Port used by Neutron metadata namespace proxy. (port value) +# Minimum value: 0 +# Maximum value: 65535 +#metadata_port = 9697 + +# Indicates that this L3 agent should also handle routers that do not have an +# external network gateway configured. This option should be True only for a +# single agent in a Neutron deployment, and may be False for all agents if all +# routers must have an external network gateway. (boolean value) +#handle_internal_only_routers = true + +# DEPRECATED: When external_network_bridge is set, each L3 agent can be +# associated with no more than one external network. This value should be set +# to the UUID of that external network. To allow L3 agent support multiple +# external networks, both the external_network_bridge and +# gateway_external_network_id must be left empty. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +#gateway_external_network_id = + +# With IPv6, the network used for the external gateway does not need to have an +# associated subnet, since the automatically assigned link-local address (LLA) +# can be used. However, an IPv6 gateway address is needed for use as the next- +# hop for the default route. If no IPv6 gateway address is configured here, +# (and only then) the neutron router will be configured to get its default +# route from router advertisements (RAs) from the upstream router; in which +# case the upstream router must also be configured to send these RAs. The +# ipv6_gateway, when configured, should be the LLA of the interface on the +# upstream router. If a next-hop using a global unique address (GUA) is +# desired, it needs to be done via a subnet allocated to the network and not +# through this parameter. (string value) +#ipv6_gateway = + +# Driver used for ipv6 prefix delegation. This needs to be an entry point +# defined in the neutron.agent.linux.pd_drivers namespace. See setup.cfg for +# entry points included with the neutron source. (string value) +#prefix_delegation_driver = dibbler + +# Allow running metadata proxy. (boolean value) +#enable_metadata_proxy = true + +# Iptables mangle mark used to mark metadata valid requests. This mark will be +# masked with 0xffff so that only the lower 16 bits will be used. (string +# value) +#metadata_access_mark = 0x1 + +# Iptables mangle mark used to mark ingress from external network. This mark +# will be masked with 0xffff so that only the lower 16 bits will be used. +# (string value) +#external_ingress_mark = 0x2 + +# DEPRECATED: Name of bridge used for external network traffic. When this +# parameter is set, the L3 agent will plug an interface directly into an +# external bridge which will not allow any wiring by the L2 agent. Using this +# will result in incorrect port statuses. This option is deprecated and will be +# removed in Ocata. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +#external_network_bridge = + +# Seconds between running periodic tasks. (integer value) +#periodic_interval = 40 + +# Number of separate API worker processes for service. If not specified, the +# default is equal to the number of CPUs available for best performance. +# (integer value) +#api_workers = + +# Number of RPC worker processes for service. (integer value) +#rpc_workers = 1 + +# Number of RPC worker processes dedicated to state reports queue. (integer +# value) +#rpc_state_report_workers = 1 + +# Range of seconds to randomly delay when starting the periodic task scheduler +# to reduce stampeding. (Disable by setting to 0) (integer value) +#periodic_fuzzy_delay = 5 + +# Location to store keepalived/conntrackd config files (string value) +#ha_confs_path = $state_path/ha_confs + +# VRRP authentication type (string value) +# Possible values: +# AH - +# PASS - +#ha_vrrp_auth_type = PASS + +# VRRP authentication password (string value) +#ha_vrrp_auth_password = + +# The advertisement interval in seconds (integer value) +#ha_vrrp_advert_int = 2 + +# Number of concurrent threads for keepalived server connection requests. More +# threads create a higher CPU load on the agent node. (integer value) +# Minimum value: 1 +#ha_keepalived_state_change_server_threads = (1 + ) / 2 + +# The VRRP health check interval in seconds. Values > 0 enable VRRP health +# checks. Setting it to 0 disables VRRP health checks. Recommended value is 5. +# This will cause pings to be sent to the gateway IP address(es) - requires +# ICMP_ECHO_REQUEST to be enabled on the gateway. If gateway fails, all routers +# will be reported as master, and master election will be repeated in round- +# robin fashion, until one of the router restore the gateway connection. +# (integer value) +#ha_vrrp_health_check_interval = 0 + +# Location to store IPv6 PD files. (string value) +#pd_confs = $state_path/pd + +# A decimal value as Vendor's Registered Private Enterprise Number as required +# by RFC3315 DUID-EN. (string value) +#vendor_pen = 8888 + +# Location to store IPv6 RA config files (string value) +#ra_confs = $state_path/ra + +# MinRtrAdvInterval setting for radvd.conf (integer value) +#min_rtr_adv_interval = 30 + +# MaxRtrAdvInterval setting for radvd.conf (integer value) +#max_rtr_adv_interval = 100 + +# +# From oslo.log +# + +# If set to true, the logging level will be set to DEBUG instead of the default +# INFO level. (boolean value) +# Note: This option can be changed without restarting. +#debug = false + +# The name of a logging configuration file. This file is appended to any +# existing logging configuration files. For details about logging configuration +# files, see the Python logging module documentation. Note that when logging +# configuration files are used then all logging configuration is set in the +# configuration file and other logging configuration options are ignored (for +# example, logging_context_format_string). (string value) +# Note: This option can be changed without restarting. +# Deprecated group/name - [DEFAULT]/log_config +#log_config_append = + +# Defines the format string for %%(asctime)s in log records. Default: +# %(default)s . This option is ignored if log_config_append is set. (string +# value) +#log_date_format = %Y-%m-%d %H:%M:%S + +# (Optional) Name of log file to send logging output to. If no default is set, +# logging will go to stderr as defined by use_stderr. This option is ignored if +# log_config_append is set. (string value) +# Deprecated group/name - [DEFAULT]/logfile +#log_file = + +# (Optional) The base directory used for relative log_file paths. This option +# is ignored if log_config_append is set. (string value) +# Deprecated group/name - [DEFAULT]/logdir +#log_dir = + +# Uses logging handler designed to watch file system. When log file is moved or +# removed this handler will open a new log file with specified path +# instantaneously. It makes sense only if log_file option is specified and +# Linux platform is used. This option is ignored if log_config_append is set. +# (boolean value) +#watch_log_file = false + +# Use syslog for logging. Existing syslog format is DEPRECATED and will be +# changed later to honor RFC5424. This option is ignored if log_config_append +# is set. (boolean value) +#use_syslog = false + +# Enable journald for logging. If running in a systemd environment you may wish +# to enable journal support. Doing so will use the journal native protocol +# which includes structured metadata in addition to log messages.This option is +# ignored if log_config_append is set. (boolean value) +#use_journal = false + +# Syslog facility to receive log lines. This option is ignored if +# log_config_append is set. (string value) +#syslog_log_facility = LOG_USER + +# Use JSON formatting for logging. This option is ignored if log_config_append +# is set. (boolean value) +#use_json = false + +# Log output to standard error. This option is ignored if log_config_append is +# set. (boolean value) +#use_stderr = false + +# Format string to use for log messages with context. (string value) +#logging_context_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user_identity)s] %(instance)s%(message)s + +# Format string to use for log messages when context is undefined. (string +# value) +#logging_default_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [-] %(instance)s%(message)s + +# Additional data to append to log message when logging level for the message +# is DEBUG. (string value) +#logging_debug_format_suffix = %(funcName)s %(pathname)s:%(lineno)d + +# Prefix each line of exception output with this format. (string value) +#logging_exception_prefix = %(asctime)s.%(msecs)03d %(process)d ERROR %(name)s %(instance)s + +# Defines the format string for %(user_identity)s that is used in +# logging_context_format_string. (string value) +#logging_user_identity_format = %(user)s %(tenant)s %(domain)s %(user_domain)s %(project_domain)s + +# List of package logging levels in logger=LEVEL pairs. This option is ignored +# if log_config_append is set. (list value) +#default_log_levels = amqp=WARN,amqplib=WARN,boto=WARN,qpid=WARN,sqlalchemy=WARN,suds=INFO,oslo.messaging=INFO,oslo_messaging=INFO,iso8601=WARN,requests.packages.urllib3.connectionpool=WARN,urllib3.connectionpool=WARN,websocket=WARN,requests.packages.urllib3.util.retry=WARN,urllib3.util.retry=WARN,keystonemiddleware=WARN,routes.middleware=WARN,stevedore=WARN,taskflow=WARN,keystoneauth=WARN,oslo.cache=INFO,dogpile.core.dogpile=INFO + +# Enables or disables publication of error events. (boolean value) +#publish_errors = false + +# The format for an instance that is passed with the log message. (string +# value) +#instance_format = "[instance: %(uuid)s] " + +# The format for an instance UUID that is passed with the log message. (string +# value) +#instance_uuid_format = "[instance: %(uuid)s] " + +# Interval, number of seconds, of log rate limiting. (integer value) +#rate_limit_interval = 0 + +# Maximum number of logged messages per rate_limit_interval. (integer value) +#rate_limit_burst = 0 + +# Log level name used by rate limiting: CRITICAL, ERROR, INFO, WARNING, DEBUG +# or empty string. Logs with level greater or equal to rate_limit_except_level +# are not filtered. An empty string means that all levels are filtered. (string +# value) +#rate_limit_except_level = CRITICAL + +# Enables or disables fatal status of deprecations. (boolean value) +#fatal_deprecations = false + + +[agent] + +# +# From neutron.az.agent +# + +# Availability zone of this node (string value) +#availability_zone = nova + +# +# From neutron.base.agent +# + +# Seconds between nodes reporting state to server; should be less than +# agent_down_time, best if it is half or less than agent_down_time. (floating +# point value) +#report_interval = 30 + +# Log agent heartbeats (boolean value) +#log_agent_heartbeats = false + +# +# From neutron.l3.agent +# + +# Extensions list to use (list value) +#extensions = + + +[ovs] + +# +# From neutron.base.agent +# + +# DEPRECATED: The interface for interacting with the OVSDB (string value) +# Possible values: +# vsctl - +# native - +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +#ovsdb_interface = native + +# The connection string for the OVSDB backend. Will be used by ovsdb-client +# when monitoring and used for the all ovsdb commands when native +# ovsdb_interface is enabled (string value) +#ovsdb_connection = tcp:127.0.0.1:6640 + +# The SSL private key file to use when interacting with OVSDB. Required when +# using an "ssl:" prefixed ovsdb_connection (string value) +#ssl_key_file = + +# The SSL certificate file to use when interacting with OVSDB. Required when +# using an "ssl:" prefixed ovsdb_connection (string value) +#ssl_cert_file = + +# The Certificate Authority (CA) certificate to use when interacting with +# OVSDB. Required when using an "ssl:" prefixed ovsdb_connection (string +# value) +#ssl_ca_cert_file = + +# Timeout in seconds for ovsdb commands. If the timeout expires, ovsdb commands +# will fail with ALARMCLOCK error. (integer value) +# Deprecated group/name - [DEFAULT]/ovs_vsctl_timeout +#ovsdb_timeout = 10 diff --git a/openstack/openstack_conf/controller/neutron/metadata_agent.ini b/openstack/openstack_conf/controller/neutron/metadata_agent.ini new file mode 100644 index 0000000..8613dc6 --- /dev/null +++ b/openstack/openstack_conf/controller/neutron/metadata_agent.ini @@ -0,0 +1,283 @@ +[DEFAULT] +metadata_proxy_shared_secret = osbash_training +nova_metadata_host = controller + +# +# From neutron.metadata.agent +# + +# Location for Metadata Proxy UNIX domain socket. (string value) +#metadata_proxy_socket = $state_path/metadata_proxy + +# User (uid or name) running metadata proxy after its initialization (if empty: +# agent effective user). (string value) +#metadata_proxy_user = + +# Group (gid or name) running metadata proxy after its initialization (if +# empty: agent effective group). (string value) +#metadata_proxy_group = + +# Certificate Authority public key (CA cert) file for ssl (string value) +#auth_ca_cert = + +# IP address or DNS name of Nova metadata server. (unknown value) +#nova_metadata_host = 127.0.0.1 + +# TCP Port used by Nova metadata server. (port value) +# Minimum value: 0 +# Maximum value: 65535 +#nova_metadata_port = 8775 + +# When proxying metadata requests, Neutron signs the Instance-ID header with a +# shared secret to prevent spoofing. You may select any string for a secret, +# but it must match here and in the configuration used by the Nova Metadata +# Server. NOTE: Nova uses the same config key, but in [neutron] section. +# (string value) +#metadata_proxy_shared_secret = + +# Protocol to access nova metadata, http or https (string value) +# Possible values: +# http - +# https - +#nova_metadata_protocol = http + +# Allow to perform insecure SSL (https) requests to nova metadata (boolean +# value) +#nova_metadata_insecure = false + +# Client certificate for nova metadata api server. (string value) +#nova_client_cert = + +# Private key of client certificate. (string value) +#nova_client_priv_key = + +# Metadata Proxy UNIX domain socket mode, 4 values allowed: 'deduce': deduce +# mode from metadata_proxy_user/group values, 'user': set metadata proxy socket +# mode to 0o644, to use when metadata_proxy_user is agent effective user or +# root, 'group': set metadata proxy socket mode to 0o664, to use when +# metadata_proxy_group is agent effective group or root, 'all': set metadata +# proxy socket mode to 0o666, to use otherwise. (string value) +# Possible values: +# deduce - +# user - +# group - +# all - +#metadata_proxy_socket_mode = deduce + +# Number of separate worker processes for metadata server (defaults to half of +# the number of CPUs) (integer value) +#metadata_workers = / 2 + +# Number of backlog requests to configure the metadata server socket with +# (integer value) +#metadata_backlog = 4096 + +# +# From oslo.log +# + +# If set to true, the logging level will be set to DEBUG instead of the default +# INFO level. (boolean value) +# Note: This option can be changed without restarting. +#debug = false + +# The name of a logging configuration file. This file is appended to any +# existing logging configuration files. For details about logging configuration +# files, see the Python logging module documentation. Note that when logging +# configuration files are used then all logging configuration is set in the +# configuration file and other logging configuration options are ignored (for +# example, logging_context_format_string). (string value) +# Note: This option can be changed without restarting. +# Deprecated group/name - [DEFAULT]/log_config +#log_config_append = + +# Defines the format string for %%(asctime)s in log records. Default: +# %(default)s . This option is ignored if log_config_append is set. (string +# value) +#log_date_format = %Y-%m-%d %H:%M:%S + +# (Optional) Name of log file to send logging output to. If no default is set, +# logging will go to stderr as defined by use_stderr. This option is ignored if +# log_config_append is set. (string value) +# Deprecated group/name - [DEFAULT]/logfile +#log_file = + +# (Optional) The base directory used for relative log_file paths. This option +# is ignored if log_config_append is set. (string value) +# Deprecated group/name - [DEFAULT]/logdir +#log_dir = + +# Uses logging handler designed to watch file system. When log file is moved or +# removed this handler will open a new log file with specified path +# instantaneously. It makes sense only if log_file option is specified and +# Linux platform is used. This option is ignored if log_config_append is set. +# (boolean value) +#watch_log_file = false + +# Use syslog for logging. Existing syslog format is DEPRECATED and will be +# changed later to honor RFC5424. This option is ignored if log_config_append +# is set. (boolean value) +#use_syslog = false + +# Enable journald for logging. If running in a systemd environment you may wish +# to enable journal support. Doing so will use the journal native protocol +# which includes structured metadata in addition to log messages.This option is +# ignored if log_config_append is set. (boolean value) +#use_journal = false + +# Syslog facility to receive log lines. This option is ignored if +# log_config_append is set. (string value) +#syslog_log_facility = LOG_USER + +# Use JSON formatting for logging. This option is ignored if log_config_append +# is set. (boolean value) +#use_json = false + +# Log output to standard error. This option is ignored if log_config_append is +# set. (boolean value) +#use_stderr = false + +# Format string to use for log messages with context. (string value) +#logging_context_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user_identity)s] %(instance)s%(message)s + +# Format string to use for log messages when context is undefined. (string +# value) +#logging_default_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [-] %(instance)s%(message)s + +# Additional data to append to log message when logging level for the message +# is DEBUG. (string value) +#logging_debug_format_suffix = %(funcName)s %(pathname)s:%(lineno)d + +# Prefix each line of exception output with this format. (string value) +#logging_exception_prefix = %(asctime)s.%(msecs)03d %(process)d ERROR %(name)s %(instance)s + +# Defines the format string for %(user_identity)s that is used in +# logging_context_format_string. (string value) +#logging_user_identity_format = %(user)s %(tenant)s %(domain)s %(user_domain)s %(project_domain)s + +# List of package logging levels in logger=LEVEL pairs. This option is ignored +# if log_config_append is set. (list value) +#default_log_levels = amqp=WARN,amqplib=WARN,boto=WARN,qpid=WARN,sqlalchemy=WARN,suds=INFO,oslo.messaging=INFO,oslo_messaging=INFO,iso8601=WARN,requests.packages.urllib3.connectionpool=WARN,urllib3.connectionpool=WARN,websocket=WARN,requests.packages.urllib3.util.retry=WARN,urllib3.util.retry=WARN,keystonemiddleware=WARN,routes.middleware=WARN,stevedore=WARN,taskflow=WARN,keystoneauth=WARN,oslo.cache=INFO,dogpile.core.dogpile=INFO + +# Enables or disables publication of error events. (boolean value) +#publish_errors = false + +# The format for an instance that is passed with the log message. (string +# value) +#instance_format = "[instance: %(uuid)s] " + +# The format for an instance UUID that is passed with the log message. (string +# value) +#instance_uuid_format = "[instance: %(uuid)s] " + +# Interval, number of seconds, of log rate limiting. (integer value) +#rate_limit_interval = 0 + +# Maximum number of logged messages per rate_limit_interval. (integer value) +#rate_limit_burst = 0 + +# Log level name used by rate limiting: CRITICAL, ERROR, INFO, WARNING, DEBUG +# or empty string. Logs with level greater or equal to rate_limit_except_level +# are not filtered. An empty string means that all levels are filtered. (string +# value) +#rate_limit_except_level = CRITICAL + +# Enables or disables fatal status of deprecations. (boolean value) +#fatal_deprecations = false + + +[agent] + +# +# From neutron.metadata.agent +# + +# Seconds between nodes reporting state to server; should be less than +# agent_down_time, best if it is half or less than agent_down_time. (floating +# point value) +#report_interval = 30 + +# Log agent heartbeats (boolean value) +#log_agent_heartbeats = false + + +[cache] + +# +# From oslo.cache +# + +# Prefix for building the configuration dictionary for the cache region. This +# should not need to be changed unless there is another dogpile.cache region +# with the same configuration name. (string value) +#config_prefix = cache.oslo + +# Default TTL, in seconds, for any cached item in the dogpile.cache region. +# This applies to any cached method that doesn't have an explicit cache +# expiration time defined for it. (integer value) +#expiration_time = 600 + +# Cache backend module. For eventlet-based or environments with hundreds of +# threaded servers, Memcache with pooling (oslo_cache.memcache_pool) is +# recommended. For environments with less than 100 threaded servers, Memcached +# (dogpile.cache.memcached) or Redis (dogpile.cache.redis) is recommended. Test +# environments with a single instance of the server can use the +# dogpile.cache.memory backend. (string value) +# Possible values: +# oslo_cache.memcache_pool - +# oslo_cache.dict - +# oslo_cache.mongo - +# oslo_cache.etcd3gw - +# dogpile.cache.memcached - +# dogpile.cache.pylibmc - +# dogpile.cache.bmemcached - +# dogpile.cache.dbm - +# dogpile.cache.redis - +# dogpile.cache.memory - +# dogpile.cache.memory_pickle - +# dogpile.cache.null - +#backend = dogpile.cache.null + +# Arguments supplied to the backend module. Specify this option once per +# argument to be passed to the dogpile.cache backend. Example format: +# ":". (multi valued) +#backend_argument = + +# Proxy classes to import that will affect the way the dogpile.cache backend +# functions. See the dogpile.cache documentation on changing-backend-behavior. +# (list value) +#proxies = + +# Global toggle for caching. (boolean value) +#enabled = false + +# Extra debugging from the cache backend (cache keys, get/set/delete/etc +# calls). This is only really useful if you need to see the specific cache- +# backend get/set/delete calls with the keys/values. Typically this should be +# left set to false. (boolean value) +#debug_cache_backend = false + +# Memcache servers in the format of "host:port". (dogpile.cache.memcache and +# oslo_cache.memcache_pool backends only). (list value) +#memcache_servers = localhost:11211 + +# Number of seconds memcached server is considered dead before it is tried +# again. (dogpile.cache.memcache and oslo_cache.memcache_pool backends only). +# (integer value) +#memcache_dead_retry = 300 + +# Timeout in seconds for every call to a server. (dogpile.cache.memcache and +# oslo_cache.memcache_pool backends only). (integer value) +#memcache_socket_timeout = 3 + +# Max total number of open connections to every memcached server. +# (oslo_cache.memcache_pool backend only). (integer value) +#memcache_pool_maxsize = 10 + +# Number of seconds a connection to memcached is held unused in the pool before +# it is closed. (oslo_cache.memcache_pool backend only). (integer value) +#memcache_pool_unused_timeout = 60 + +# Number of seconds that an operation will wait to get a memcache client +# connection. (integer value) +#memcache_pool_connection_get_timeout = 10 diff --git a/openstack/openstack_conf/controller/neutron/neutron.conf b/openstack/openstack_conf/controller/neutron/neutron.conf new file mode 100755 index 0000000..5544fb3 --- /dev/null +++ b/openstack/openstack_conf/controller/neutron/neutron.conf @@ -0,0 +1,2080 @@ +[DEFAULT] +notify_nova_on_port_data_changes = true +notify_nova_on_port_status_changes = true +auth_strategy = keystone +transport_url = rabbit://openstack:rabbitPass@controller +allow_overlapping_ips = true +service_plugins = router +core_plugin = ml2 + +# +# From neutron +# + +# Where to store Neutron state files. This directory must be writable by the +# agent. (string value) +#state_path = /var/lib/neutron + +# The host IP to bind to. (unknown value) +#bind_host = 0.0.0.0 + +# The port to bind to (port value) +# Minimum value: 0 +# Maximum value: 65535 +#bind_port = 9696 + +# The path for API extensions. Note that this can be a colon-separated list of +# paths. For example: api_extensions_path = +# extensions:/path/to/more/exts:/even/more/exts. The __path__ of +# neutron.extensions is appended to this, so if your extensions are in there +# you don't need to specify them here. (string value) +#api_extensions_path = + +# The type of authentication to use (string value) +#auth_strategy = keystone + +# The core plugin Neutron will use (string value) +#core_plugin = + +# The service plugins Neutron will use (list value) +#service_plugins = + +# The base MAC address Neutron will use for VIFs. The first 3 octets will +# remain unchanged. If the 4th octet is not 00, it will also be used. The +# others will be randomly generated. (string value) +#base_mac = fa:16:3e:00:00:00 + +# Allow the usage of the bulk API (boolean value) +#allow_bulk = true + +# The maximum number of items returned in a single response, value was +# 'infinite' or negative integer means no limit (string value) +#pagination_max_limit = -1 + +# Default value of availability zone hints. The availability zone aware +# schedulers use this when the resources availability_zone_hints is empty. +# Multiple availability zones can be specified by a comma separated string. +# This value can be empty. In this case, even if availability_zone_hints for a +# resource is empty, availability zone is considered for high availability +# while scheduling the resource. (list value) +#default_availability_zones = + +# Maximum number of DNS nameservers per subnet (integer value) +#max_dns_nameservers = 5 + +# Maximum number of host routes per subnet (integer value) +#max_subnet_host_routes = 20 + +# Enables IPv6 Prefix Delegation for automatic subnet CIDR allocation. Set to +# True to enable IPv6 Prefix Delegation for subnet allocation in a PD-capable +# environment. Users making subnet creation requests for IPv6 subnets without +# providing a CIDR or subnetpool ID will be given a CIDR via the Prefix +# Delegation mechanism. Note that enabling PD will override the behavior of the +# default IPv6 subnetpool. (boolean value) +#ipv6_pd_enabled = false + +# DHCP lease duration (in seconds). Use -1 to tell dnsmasq to use infinite +# lease times. (integer value) +#dhcp_lease_duration = 86400 + +# Domain to use for building the hostnames (string value) +#dns_domain = openstacklocal + +# Driver for external DNS integration. (string value) +#external_dns_driver = + +# Allow sending resource operation notification to DHCP agent (boolean value) +#dhcp_agent_notification = true + +# Allow overlapping IP support in Neutron. Attention: the following parameter +# MUST be set to False if Neutron is being used in conjunction with Nova +# security groups. (boolean value) +#allow_overlapping_ips = false + +# Hostname to be used by the Neutron server, agents and services running on +# this machine. All the agents and services running on this machine must use +# the same host value. (unknown value) +#host = example.domain + +# This string is prepended to the normal URL that is returned in links to the +# OpenStack Network API. If it is empty (the default), the URLs are returned +# unchanged. (string value) +#network_link_prefix = + +# Send notification to nova when port status changes (boolean value) +#notify_nova_on_port_status_changes = true + +# Send notification to nova when port data (fixed_ips/floatingip) changes so +# nova can update its cache. (boolean value) +#notify_nova_on_port_data_changes = true + +# Number of seconds between sending events to nova if there are any events to +# send. (integer value) +#send_events_interval = 2 + +# Neutron IPAM (IP address management) driver to use. By default, the reference +# implementation of the Neutron IPAM driver is used. (string value) +#ipam_driver = internal + +# If True, then allow plugins that support it to create VLAN transparent +# networks. (boolean value) +#vlan_transparent = false + +# MTU of the underlying physical network. Neutron uses this value to calculate +# MTU for all virtual network components. For flat and VLAN networks, neutron +# uses this value without modification. For overlay networks such as VXLAN, +# neutron automatically subtracts the overlay protocol overhead from this +# value. Defaults to 1500, the standard value for Ethernet. (integer value) +# Deprecated group/name - [ml2]/segment_mtu +#global_physnet_mtu = 1500 + +# Number of backlog requests to configure the socket with (integer value) +#backlog = 4096 + +# Number of seconds to keep retrying to listen (integer value) +#retry_until_window = 30 + +# Enable SSL on the API server (boolean value) +#use_ssl = false + +# Seconds between running periodic tasks. (integer value) +#periodic_interval = 40 + +# Number of separate API worker processes for service. If not specified, the +# default is equal to the number of CPUs available for best performance. +# (integer value) +#api_workers = + +# Number of RPC worker processes for service. (integer value) +#rpc_workers = 1 + +# Number of RPC worker processes dedicated to state reports queue. (integer +# value) +#rpc_state_report_workers = 1 + +# Range of seconds to randomly delay when starting the periodic task scheduler +# to reduce stampeding. (Disable by setting to 0) (integer value) +#periodic_fuzzy_delay = 5 + +# +# From neutron.agent +# + +# The driver used to manage the virtual interface. (string value) +#interface_driver = + +# Location for Metadata Proxy UNIX domain socket. (string value) +#metadata_proxy_socket = $state_path/metadata_proxy + +# User (uid or name) running metadata proxy after its initialization (if empty: +# agent effective user). (string value) +#metadata_proxy_user = + +# Group (gid or name) running metadata proxy after its initialization (if +# empty: agent effective group). (string value) +#metadata_proxy_group = + +# +# From neutron.db +# + +# Seconds to regard the agent is down; should be at least twice +# report_interval, to be sure the agent is down for good. (integer value) +#agent_down_time = 75 + +# Representing the resource type whose load is being reported by the agent. +# This can be "networks", "subnets" or "ports". When specified (Default is +# networks), the server will extract particular load sent as part of its agent +# configuration object from the agent report state, which is the number of +# resources being consumed, at every report_interval.dhcp_load_type can be used +# in combination with network_scheduler_driver = +# neutron.scheduler.dhcp_agent_scheduler.WeightScheduler When the +# network_scheduler_driver is WeightScheduler, dhcp_load_type can be configured +# to represent the choice for the resource being balanced. Example: +# dhcp_load_type=networks (string value) +# Possible values: +# networks - +# subnets - +# ports - +#dhcp_load_type = networks + +# Agent starts with admin_state_up=False when enable_new_agents=False. In the +# case, user's resources will not be scheduled automatically to the agent until +# admin changes admin_state_up to True. (boolean value) +#enable_new_agents = true + +# Maximum number of routes per router (integer value) +#max_routes = 30 + +# Define the default value of enable_snat if not provided in +# external_gateway_info. (boolean value) +#enable_snat_by_default = true + +# Driver to use for scheduling network to DHCP agent (string value) +#network_scheduler_driver = neutron.scheduler.dhcp_agent_scheduler.WeightScheduler + +# Allow auto scheduling networks to DHCP agent. (boolean value) +#network_auto_schedule = true + +# Automatically remove networks from offline DHCP agents. (boolean value) +#allow_automatic_dhcp_failover = true + +# Number of DHCP agents scheduled to host a tenant network. If this number is +# greater than 1, the scheduler automatically assigns multiple DHCP agents for +# a given tenant network, providing high availability for DHCP service. +# (integer value) +#dhcp_agents_per_network = 1 + +# Enable services on an agent with admin_state_up False. If this option is +# False, when admin_state_up of an agent is turned False, services on it will +# be disabled. Agents with admin_state_up False are not selected for automatic +# scheduling regardless of this option. But manual scheduling to such agents is +# available if this option is True. (boolean value) +#enable_services_on_agents_with_admin_state_down = false + +# The base mac address used for unique DVR instances by Neutron. The first 3 +# octets will remain unchanged. If the 4th octet is not 00, it will also be +# used. The others will be randomly generated. The 'dvr_base_mac' *must* be +# different from 'base_mac' to avoid mixing them up with MAC's allocated for +# tenant ports. A 4 octet example would be dvr_base_mac = fa:16:3f:4f:00:00. +# The default is 3 octet (string value) +#dvr_base_mac = fa:16:3f:00:00:00 + +# System-wide flag to determine the type of router that tenants can create. +# Only admin can override. (boolean value) +#router_distributed = false + +# Determine if setup is configured for DVR. If False, DVR API extension will be +# disabled. (boolean value) +#enable_dvr = true + +# Driver to use for scheduling router to a default L3 agent (string value) +#router_scheduler_driver = neutron.scheduler.l3_agent_scheduler.LeastRoutersScheduler + +# Allow auto scheduling of routers to L3 agent. (boolean value) +#router_auto_schedule = true + +# Automatically reschedule routers from offline L3 agents to online L3 agents. +# (boolean value) +#allow_automatic_l3agent_failover = false + +# Enable HA mode for virtual routers. (boolean value) +#l3_ha = false + +# Maximum number of L3 agents which a HA router will be scheduled on. If it is +# set to 0 then the router will be scheduled on every agent. (integer value) +#max_l3_agents_per_router = 3 + +# Subnet used for the l3 HA admin network. (string value) +#l3_ha_net_cidr = 169.254.192.0/18 + +# The network type to use when creating the HA network for an HA router. By +# default or if empty, the first 'tenant_network_types' is used. This is +# helpful when the VRRP traffic should use a specific network which is not the +# default one. (string value) +#l3_ha_network_type = + +# The physical network name with which the HA network can be created. (string +# value) +#l3_ha_network_physical_name = + +# +# From neutron.extensions +# + +# Maximum number of allowed address pairs (integer value) +#max_allowed_address_pair = 10 + +# +# From oslo.log +# + +# If set to true, the logging level will be set to DEBUG instead of the default +# INFO level. (boolean value) +# Note: This option can be changed without restarting. +#debug = false + +# The name of a logging configuration file. This file is appended to any +# existing logging configuration files. For details about logging configuration +# files, see the Python logging module documentation. Note that when logging +# configuration files are used then all logging configuration is set in the +# configuration file and other logging configuration options are ignored (for +# example, logging_context_format_string). (string value) +# Note: This option can be changed without restarting. +# Deprecated group/name - [DEFAULT]/log_config +#log_config_append = + +# Defines the format string for %%(asctime)s in log records. Default: +# %(default)s . This option is ignored if log_config_append is set. (string +# value) +#log_date_format = %Y-%m-%d %H:%M:%S + +# (Optional) Name of log file to send logging output to. If no default is set, +# logging will go to stderr as defined by use_stderr. This option is ignored if +# log_config_append is set. (string value) +# Deprecated group/name - [DEFAULT]/logfile +#log_file = + +# (Optional) The base directory used for relative log_file paths. This option +# is ignored if log_config_append is set. (string value) +# Deprecated group/name - [DEFAULT]/logdir +#log_dir = + +# Uses logging handler designed to watch file system. When log file is moved or +# removed this handler will open a new log file with specified path +# instantaneously. It makes sense only if log_file option is specified and +# Linux platform is used. This option is ignored if log_config_append is set. +# (boolean value) +#watch_log_file = false + +# Use syslog for logging. Existing syslog format is DEPRECATED and will be +# changed later to honor RFC5424. This option is ignored if log_config_append +# is set. (boolean value) +#use_syslog = false + +# Enable journald for logging. If running in a systemd environment you may wish +# to enable journal support. Doing so will use the journal native protocol +# which includes structured metadata in addition to log messages.This option is +# ignored if log_config_append is set. (boolean value) +#use_journal = false + +# Syslog facility to receive log lines. This option is ignored if +# log_config_append is set. (string value) +#syslog_log_facility = LOG_USER + +# Use JSON formatting for logging. This option is ignored if log_config_append +# is set. (boolean value) +#use_json = false + +# Log output to standard error. This option is ignored if log_config_append is +# set. (boolean value) +#use_stderr = false + +# Format string to use for log messages with context. (string value) +#logging_context_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user_identity)s] %(instance)s%(message)s + +# Format string to use for log messages when context is undefined. (string +# value) +#logging_default_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [-] %(instance)s%(message)s + +# Additional data to append to log message when logging level for the message +# is DEBUG. (string value) +#logging_debug_format_suffix = %(funcName)s %(pathname)s:%(lineno)d + +# Prefix each line of exception output with this format. (string value) +#logging_exception_prefix = %(asctime)s.%(msecs)03d %(process)d ERROR %(name)s %(instance)s + +# Defines the format string for %(user_identity)s that is used in +# logging_context_format_string. (string value) +#logging_user_identity_format = %(user)s %(tenant)s %(domain)s %(user_domain)s %(project_domain)s + +# List of package logging levels in logger=LEVEL pairs. This option is ignored +# if log_config_append is set. (list value) +#default_log_levels = amqp=WARN,amqplib=WARN,boto=WARN,qpid=WARN,sqlalchemy=WARN,suds=INFO,oslo.messaging=INFO,oslo_messaging=INFO,iso8601=WARN,requests.packages.urllib3.connectionpool=WARN,urllib3.connectionpool=WARN,websocket=WARN,requests.packages.urllib3.util.retry=WARN,urllib3.util.retry=WARN,keystonemiddleware=WARN,routes.middleware=WARN,stevedore=WARN,taskflow=WARN,keystoneauth=WARN,oslo.cache=INFO,dogpile.core.dogpile=INFO + +# Enables or disables publication of error events. (boolean value) +#publish_errors = false + +# The format for an instance that is passed with the log message. (string +# value) +#instance_format = "[instance: %(uuid)s] " + +# The format for an instance UUID that is passed with the log message. (string +# value) +#instance_uuid_format = "[instance: %(uuid)s] " + +# Interval, number of seconds, of log rate limiting. (integer value) +#rate_limit_interval = 0 + +# Maximum number of logged messages per rate_limit_interval. (integer value) +#rate_limit_burst = 0 + +# Log level name used by rate limiting: CRITICAL, ERROR, INFO, WARNING, DEBUG +# or empty string. Logs with level greater or equal to rate_limit_except_level +# are not filtered. An empty string means that all levels are filtered. (string +# value) +#rate_limit_except_level = CRITICAL + +# Enables or disables fatal status of deprecations. (boolean value) +#fatal_deprecations = false + +# +# From oslo.messaging +# + +# Size of RPC connection pool. (integer value) +#rpc_conn_pool_size = 30 + +# The pool size limit for connections expiration policy (integer value) +#conn_pool_min_size = 2 + +# The time-to-live in sec of idle connections in the pool (integer value) +#conn_pool_ttl = 1200 + +# ZeroMQ bind address. Should be a wildcard (*), an ethernet interface, or IP. +# The "host" option should point or resolve to this address. (string value) +#rpc_zmq_bind_address = * + +# MatchMaker driver. (string value) +# Possible values: +# redis - +# sentinel - +# dummy - +#rpc_zmq_matchmaker = redis + +# Number of ZeroMQ contexts, defaults to 1. (integer value) +#rpc_zmq_contexts = 1 + +# Maximum number of ingress messages to locally buffer per topic. Default is +# unlimited. (integer value) +#rpc_zmq_topic_backlog = + +# Directory for holding IPC sockets. (string value) +#rpc_zmq_ipc_dir = /var/run/openstack + +# Name of this node. Must be a valid hostname, FQDN, or IP address. Must match +# "host" option, if running Nova. (string value) +#rpc_zmq_host = localhost + +# Number of seconds to wait before all pending messages will be sent after +# closing a socket. The default value of -1 specifies an infinite linger +# period. The value of 0 specifies no linger period. Pending messages shall be +# discarded immediately when the socket is closed. Positive values specify an +# upper bound for the linger period. (integer value) +# Deprecated group/name - [DEFAULT]/rpc_cast_timeout +#zmq_linger = -1 + +# The default number of seconds that poll should wait. Poll raises timeout +# exception when timeout expired. (integer value) +#rpc_poll_timeout = 1 + +# Expiration timeout in seconds of a name service record about existing target +# ( < 0 means no timeout). (integer value) +#zmq_target_expire = 300 + +# Update period in seconds of a name service record about existing target. +# (integer value) +#zmq_target_update = 180 + +# Use PUB/SUB pattern for fanout methods. PUB/SUB always uses proxy. (boolean +# value) +#use_pub_sub = false + +# Use ROUTER remote proxy. (boolean value) +#use_router_proxy = false + +# This option makes direct connections dynamic or static. It makes sense only +# with use_router_proxy=False which means to use direct connections for direct +# message types (ignored otherwise). (boolean value) +#use_dynamic_connections = false + +# How many additional connections to a host will be made for failover reasons. +# This option is actual only in dynamic connections mode. (integer value) +#zmq_failover_connections = 2 + +# Minimal port number for random ports range. (port value) +# Minimum value: 0 +# Maximum value: 65535 +#rpc_zmq_min_port = 49153 + +# Maximal port number for random ports range. (integer value) +# Minimum value: 1 +# Maximum value: 65536 +#rpc_zmq_max_port = 65536 + +# Number of retries to find free port number before fail with ZMQBindError. +# (integer value) +#rpc_zmq_bind_port_retries = 100 + +# Default serialization mechanism for serializing/deserializing +# outgoing/incoming messages (string value) +# Possible values: +# json - +# msgpack - +#rpc_zmq_serialization = json + +# This option configures round-robin mode in zmq socket. True means not keeping +# a queue when server side disconnects. False means to keep queue and messages +# even if server is disconnected, when the server appears we send all +# accumulated messages to it. (boolean value) +#zmq_immediate = true + +# Enable/disable TCP keepalive (KA) mechanism. The default value of -1 (or any +# other negative value) means to skip any overrides and leave it to OS default; +# 0 and 1 (or any other positive value) mean to disable and enable the option +# respectively. (integer value) +#zmq_tcp_keepalive = -1 + +# The duration between two keepalive transmissions in idle condition. The unit +# is platform dependent, for example, seconds in Linux, milliseconds in Windows +# etc. The default value of -1 (or any other negative value and 0) means to +# skip any overrides and leave it to OS default. (integer value) +#zmq_tcp_keepalive_idle = -1 + +# The number of retransmissions to be carried out before declaring that remote +# end is not available. The default value of -1 (or any other negative value +# and 0) means to skip any overrides and leave it to OS default. (integer +# value) +#zmq_tcp_keepalive_cnt = -1 + +# The duration between two successive keepalive retransmissions, if +# acknowledgement to the previous keepalive transmission is not received. The +# unit is platform dependent, for example, seconds in Linux, milliseconds in +# Windows etc. The default value of -1 (or any other negative value and 0) +# means to skip any overrides and leave it to OS default. (integer value) +#zmq_tcp_keepalive_intvl = -1 + +# Maximum number of (green) threads to work concurrently. (integer value) +#rpc_thread_pool_size = 100 + +# Expiration timeout in seconds of a sent/received message after which it is +# not tracked anymore by a client/server. (integer value) +#rpc_message_ttl = 300 + +# Wait for message acknowledgements from receivers. This mechanism works only +# via proxy without PUB/SUB. (boolean value) +#rpc_use_acks = false + +# Number of seconds to wait for an ack from a cast/call. After each retry +# attempt this timeout is multiplied by some specified multiplier. (integer +# value) +#rpc_ack_timeout_base = 15 + +# Number to multiply base ack timeout by after each retry attempt. (integer +# value) +#rpc_ack_timeout_multiplier = 2 + +# Default number of message sending attempts in case of any problems occurred: +# positive value N means at most N retries, 0 means no retries, None or -1 (or +# any other negative values) mean to retry forever. This option is used only if +# acknowledgments are enabled. (integer value) +#rpc_retry_attempts = 3 + +# List of publisher hosts SubConsumer can subscribe on. This option has higher +# priority then the default publishers list taken from the matchmaker. (list +# value) +#subscribe_on = + +# Size of executor thread pool when executor is threading or eventlet. (integer +# value) +# Deprecated group/name - [DEFAULT]/rpc_thread_pool_size +#executor_thread_pool_size = 64 + +# Seconds to wait for a response from a call. (integer value) +#rpc_response_timeout = 60 + +# The network address and optional user credentials for connecting to the +# messaging backend, in URL format. The expected format is: +# +# driver://[user:pass@]host:port[,[userN:passN@]hostN:portN]/virtual_host?query +# +# Example: rabbit://rabbitmq:password@127.0.0.1:5672// +# +# For full details on the fields in the URL see the documentation of +# oslo_messaging.TransportURL at +# https://docs.openstack.org/oslo.messaging/latest/reference/transport.html +# (string value) +#transport_url = + +# DEPRECATED: The messaging driver to use, defaults to rabbit. Other drivers +# include amqp and zmq. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#rpc_backend = rabbit + +# The default exchange under which topics are scoped. May be overridden by an +# exchange name specified in the transport_url option. (string value) +#control_exchange = neutron + +# +# From oslo.service.wsgi +# + +# File name for the paste.deploy config for api service (string value) +#api_paste_config = api-paste.ini + +# A python format string that is used as the template to generate log lines. +# The following values can beformatted into it: client_ip, date_time, +# request_line, status_code, body_length, wall_seconds. (string value) +#wsgi_log_format = %(client_ip)s "%(request_line)s" status: %(status_code)s len: %(body_length)s time: %(wall_seconds).7f + +# Sets the value of TCP_KEEPIDLE in seconds for each server socket. Not +# supported on OS X. (integer value) +#tcp_keepidle = 600 + +# Size of the pool of greenthreads used by wsgi (integer value) +#wsgi_default_pool_size = 100 + +# Maximum line size of message headers to be accepted. max_header_line may need +# to be increased when using large tokens (typically those generated when +# keystone is configured to use PKI tokens with big service catalogs). (integer +# value) +#max_header_line = 16384 + +# If False, closes the client socket connection explicitly. (boolean value) +#wsgi_keep_alive = true + +# Timeout for client connections' socket operations. If an incoming connection +# is idle for this number of seconds it will be closed. A value of '0' means +# wait forever. (integer value) +#client_socket_timeout = 900 + + +[agent] +root_helper = "sudo /usr/bin/neutron-rootwrap /etc/neutron/rootwrap.conf" + +# +# From neutron.agent +# + +# Root helper application. Use 'sudo neutron-rootwrap +# /etc/neutron/rootwrap.conf' to use the real root filter facility. Change to +# 'sudo' to skip the filtering and just run the command directly. (string +# value) +#root_helper = sudo + +# Use the root helper when listing the namespaces on a system. This may not be +# required depending on the security configuration. If the root helper is not +# required, set this to False for a performance improvement. (boolean value) +#use_helper_for_ns_read = true + +# Root helper daemon application to use when possible. For the agent which +# needs to execute commands in Dom0 in the hypervisor of XenServer, this item +# should be set to 'xenapi_root_helper', so that it will keep a XenAPI session +# to pass commands to Dom0. (string value) +#root_helper_daemon = + +# Seconds between nodes reporting state to server; should be less than +# agent_down_time, best if it is half or less than agent_down_time. (floating +# point value) +#report_interval = 30 + +# Log agent heartbeats (boolean value) +#log_agent_heartbeats = false + +# Add comments to iptables rules. Set to false to disallow the addition of +# comments to generated iptables rules that describe each rule's purpose. +# System must support the iptables comments module for addition of comments. +# (boolean value) +#comment_iptables_rules = true + +# Duplicate every iptables difference calculation to ensure the format being +# generated matches the format of iptables-save. This option should not be +# turned on for production systems because it imposes a performance penalty. +# (boolean value) +#debug_iptables_rules = false + +# Action to be executed when a child process dies (string value) +# Possible values: +# respawn - +# exit - +#check_child_processes_action = respawn + +# Interval between checks of child process liveness (seconds), use 0 to disable +# (integer value) +#check_child_processes_interval = 60 + +# Availability zone of this node (string value) +#availability_zone = nova + + +[cors] + +# +# From oslo.middleware.cors +# + +# Indicate whether this resource may be shared with the domain received in the +# requests "origin" header. Format: "://[:]", no trailing +# slash. Example: https://horizon.example.com (list value) +#allowed_origin = + +# Indicate that the actual request can include user credentials (boolean value) +#allow_credentials = true + +# Indicate which headers are safe to expose to the API. Defaults to HTTP Simple +# Headers. (list value) +#expose_headers = X-Auth-Token,X-Subject-Token,X-Service-Token,X-OpenStack-Request-ID,OpenStack-Volume-microversion + +# Maximum cache age of CORS preflight requests. (integer value) +#max_age = 3600 + +# Indicate which methods can be used during the actual request. (list value) +#allow_methods = GET,PUT,POST,DELETE,PATCH + +# Indicate which header field names may be used during the actual request. +# (list value) +#allow_headers = X-Auth-Token,X-Identity-Status,X-Roles,X-Service-Catalog,X-User-Id,X-Tenant-Id,X-OpenStack-Request-ID + + +[database] +connection = mysql+pymysql://neutron:neutron_db_secret@controller/neutron + +# +# From neutron.db +# + +# Database engine for which script will be generated when using offline +# migration. (string value) +#engine = + +# +# From oslo.db +# + +# If True, SQLite uses synchronous mode. (boolean value) +#sqlite_synchronous = true + +# The back end to use for the database. (string value) +# Deprecated group/name - [DEFAULT]/db_backend +#backend = sqlalchemy + +# The SQLAlchemy connection string to use to connect to the database. (string +# value) +# Deprecated group/name - [DEFAULT]/sql_connection +# Deprecated group/name - [DATABASE]/sql_connection +# Deprecated group/name - [sql]/connection +#connection = + +# The SQLAlchemy connection string to use to connect to the slave database. +# (string value) +#slave_connection = + +# The SQL mode to be used for MySQL sessions. This option, including the +# default, overrides any server-set SQL mode. To use whatever SQL mode is set +# by the server configuration, set this to no value. Example: mysql_sql_mode= +# (string value) +#mysql_sql_mode = TRADITIONAL + +# If True, transparently enables support for handling MySQL Cluster (NDB). +# (boolean value) +#mysql_enable_ndb = false + +# Connections which have been present in the connection pool longer than this +# number of seconds will be replaced with a new one the next time they are +# checked out from the pool. (integer value) +# Deprecated group/name - [DATABASE]/idle_timeout +# Deprecated group/name - [database]/idle_timeout +# Deprecated group/name - [DEFAULT]/sql_idle_timeout +# Deprecated group/name - [DATABASE]/sql_idle_timeout +# Deprecated group/name - [sql]/idle_timeout +#connection_recycle_time = 3600 + +# Minimum number of SQL connections to keep open in a pool. (integer value) +# Deprecated group/name - [DEFAULT]/sql_min_pool_size +# Deprecated group/name - [DATABASE]/sql_min_pool_size +#min_pool_size = 1 + +# Maximum number of SQL connections to keep open in a pool. Setting a value of +# 0 indicates no limit. (integer value) +# Deprecated group/name - [DEFAULT]/sql_max_pool_size +# Deprecated group/name - [DATABASE]/sql_max_pool_size +#max_pool_size = 5 + +# Maximum number of database connection retries during startup. Set to -1 to +# specify an infinite retry count. (integer value) +# Deprecated group/name - [DEFAULT]/sql_max_retries +# Deprecated group/name - [DATABASE]/sql_max_retries +#max_retries = 10 + +# Interval between retries of opening a SQL connection. (integer value) +# Deprecated group/name - [DEFAULT]/sql_retry_interval +# Deprecated group/name - [DATABASE]/reconnect_interval +#retry_interval = 10 + +# If set, use this value for max_overflow with SQLAlchemy. (integer value) +# Deprecated group/name - [DEFAULT]/sql_max_overflow +# Deprecated group/name - [DATABASE]/sqlalchemy_max_overflow +#max_overflow = 50 + +# Verbosity of SQL debugging information: 0=None, 100=Everything. (integer +# value) +# Minimum value: 0 +# Maximum value: 100 +# Deprecated group/name - [DEFAULT]/sql_connection_debug +#connection_debug = 0 + +# Add Python stack traces to SQL as comment strings. (boolean value) +# Deprecated group/name - [DEFAULT]/sql_connection_trace +#connection_trace = false + +# If set, use this value for pool_timeout with SQLAlchemy. (integer value) +# Deprecated group/name - [DATABASE]/sqlalchemy_pool_timeout +#pool_timeout = + +# Enable the experimental use of database reconnect on connection lost. +# (boolean value) +#use_db_reconnect = false + +# Seconds between retries of a database transaction. (integer value) +#db_retry_interval = 1 + +# If True, increases the interval between retries of a database operation up to +# db_max_retry_interval. (boolean value) +#db_inc_retry_interval = true + +# If db_inc_retry_interval is set, the maximum seconds between retries of a +# database operation. (integer value) +#db_max_retry_interval = 10 + +# Maximum retries in case of connection error or deadlock error before error is +# raised. Set to -1 to specify an infinite retry count. (integer value) +#db_max_retries = 20 + + +[keystone_authtoken] +password = neutron_user_secret +username = neutron +project_name = service +user_domain_name = default +project_domain_name = default +auth_type = password +memcached_servers = controller:11211 +auth_url = http://controller:5000 +auth_uri = http://controller:5000 + +# +# From keystonemiddleware.auth_token +# + +# Complete "public" Identity API endpoint. This endpoint should not be an +# "admin" endpoint, as it should be accessible by all end users. +# Unauthenticated clients are redirected to this endpoint to authenticate. +# Although this endpoint should ideally be unversioned, client support in the +# wild varies. If you're using a versioned v2 endpoint here, then this should +# *not* be the same endpoint the service user utilizes for validating tokens, +# because normal end users may not be able to reach that endpoint. (string +# value) +# Deprecated group/name - [keystone_authtoken]/auth_uri +#www_authenticate_uri = + +# DEPRECATED: Complete "public" Identity API endpoint. This endpoint should not +# be an "admin" endpoint, as it should be accessible by all end users. +# Unauthenticated clients are redirected to this endpoint to authenticate. +# Although this endpoint should ideally be unversioned, client support in the +# wild varies. If you're using a versioned v2 endpoint here, then this should +# *not* be the same endpoint the service user utilizes for validating tokens, +# because normal end users may not be able to reach that endpoint. This option +# is deprecated in favor of www_authenticate_uri and will be removed in the S +# release. (string value) +# This option is deprecated for removal since Queens. +# Its value may be silently ignored in the future. +# Reason: The auth_uri option is deprecated in favor of www_authenticate_uri +# and will be removed in the S release. +#auth_uri = + +# API version of the admin Identity API endpoint. (string value) +#auth_version = + +# Do not handle authorization requests within the middleware, but delegate the +# authorization decision to downstream WSGI components. (boolean value) +#delay_auth_decision = false + +# Request timeout value for communicating with Identity API server. (integer +# value) +#http_connect_timeout = + +# How many times are we trying to reconnect when communicating with Identity +# API Server. (integer value) +#http_request_max_retries = 3 + +# Request environment key where the Swift cache object is stored. When +# auth_token middleware is deployed with a Swift cache, use this option to have +# the middleware share a caching backend with swift. Otherwise, use the +# ``memcached_servers`` option instead. (string value) +#cache = + +# Required if identity server requires client certificate (string value) +#certfile = + +# Required if identity server requires client certificate (string value) +#keyfile = + +# A PEM encoded Certificate Authority to use when verifying HTTPs connections. +# Defaults to system CAs. (string value) +#cafile = + +# Verify HTTPS connections. (boolean value) +#insecure = false + +# The region in which the identity server can be found. (string value) +#region_name = + +# DEPRECATED: Directory used to cache files related to PKI tokens. This option +# has been deprecated in the Ocata release and will be removed in the P +# release. (string value) +# This option is deprecated for removal since Ocata. +# Its value may be silently ignored in the future. +# Reason: PKI token format is no longer supported. +#signing_dir = + +# Optionally specify a list of memcached server(s) to use for caching. If left +# undefined, tokens will instead be cached in-process. (list value) +# Deprecated group/name - [keystone_authtoken]/memcache_servers +#memcached_servers = + +# In order to prevent excessive effort spent validating tokens, the middleware +# caches previously-seen tokens for a configurable duration (in seconds). Set +# to -1 to disable caching completely. (integer value) +#token_cache_time = 300 + +# DEPRECATED: Determines the frequency at which the list of revoked tokens is +# retrieved from the Identity service (in seconds). A high number of revocation +# events combined with a low cache duration may significantly reduce +# performance. Only valid for PKI tokens. This option has been deprecated in +# the Ocata release and will be removed in the P release. (integer value) +# This option is deprecated for removal since Ocata. +# Its value may be silently ignored in the future. +# Reason: PKI token format is no longer supported. +#revocation_cache_time = 10 + +# (Optional) If defined, indicate whether token data should be authenticated or +# authenticated and encrypted. If MAC, token data is authenticated (with HMAC) +# in the cache. If ENCRYPT, token data is encrypted and authenticated in the +# cache. If the value is not one of these options or empty, auth_token will +# raise an exception on initialization. (string value) +# Possible values: +# None - +# MAC - +# ENCRYPT - +#memcache_security_strategy = None + +# (Optional, mandatory if memcache_security_strategy is defined) This string is +# used for key derivation. (string value) +#memcache_secret_key = + +# (Optional) Number of seconds memcached server is considered dead before it is +# tried again. (integer value) +#memcache_pool_dead_retry = 300 + +# (Optional) Maximum total number of open connections to every memcached +# server. (integer value) +#memcache_pool_maxsize = 10 + +# (Optional) Socket timeout in seconds for communicating with a memcached +# server. (integer value) +#memcache_pool_socket_timeout = 3 + +# (Optional) Number of seconds a connection to memcached is held unused in the +# pool before it is closed. (integer value) +#memcache_pool_unused_timeout = 60 + +# (Optional) Number of seconds that an operation will wait to get a memcached +# client connection from the pool. (integer value) +#memcache_pool_conn_get_timeout = 10 + +# (Optional) Use the advanced (eventlet safe) memcached client pool. The +# advanced pool will only work under python 2.x. (boolean value) +#memcache_use_advanced_pool = false + +# (Optional) Indicate whether to set the X-Service-Catalog header. If False, +# middleware will not ask for service catalog on token validation and will not +# set the X-Service-Catalog header. (boolean value) +#include_service_catalog = true + +# Used to control the use and type of token binding. Can be set to: "disabled" +# to not check token binding. "permissive" (default) to validate binding +# information if the bind type is of a form known to the server and ignore it +# if not. "strict" like "permissive" but if the bind type is unknown the token +# will be rejected. "required" any form of token binding is needed to be +# allowed. Finally the name of a binding method that must be present in tokens. +# (string value) +#enforce_token_bind = permissive + +# DEPRECATED: If true, the revocation list will be checked for cached tokens. +# This requires that PKI tokens are configured on the identity server. (boolean +# value) +# This option is deprecated for removal since Ocata. +# Its value may be silently ignored in the future. +# Reason: PKI token format is no longer supported. +#check_revocations_for_cached = false + +# DEPRECATED: Hash algorithms to use for hashing PKI tokens. This may be a +# single algorithm or multiple. The algorithms are those supported by Python +# standard hashlib.new(). The hashes will be tried in the order given, so put +# the preferred one first for performance. The result of the first hash will be +# stored in the cache. This will typically be set to multiple values only while +# migrating from a less secure algorithm to a more secure one. Once all the old +# tokens are expired this option should be set to a single value for better +# performance. (list value) +# This option is deprecated for removal since Ocata. +# Its value may be silently ignored in the future. +# Reason: PKI token format is no longer supported. +#hash_algorithms = md5 + +# A choice of roles that must be present in a service token. Service tokens are +# allowed to request that an expired token can be used and so this check should +# tightly control that only actual services should be sending this token. Roles +# here are applied as an ANY check so any role in this list must be present. +# For backwards compatibility reasons this currently only affects the +# allow_expired check. (list value) +#service_token_roles = service + +# For backwards compatibility reasons we must let valid service tokens pass +# that don't pass the service_token_roles check as valid. Setting this true +# will become the default in a future release and should be enabled if +# possible. (boolean value) +#service_token_roles_required = false + +# Prefix to prepend at the beginning of the path. Deprecated, use identity_uri. +# (string value) +#auth_admin_prefix = + +# Host providing the admin Identity API endpoint. Deprecated, use identity_uri. +# (string value) +#auth_host = 127.0.0.1 + +# Port of the admin Identity API endpoint. Deprecated, use identity_uri. +# (integer value) +#auth_port = 35357 + +# Protocol of the admin Identity API endpoint. Deprecated, use identity_uri. +# (string value) +# Possible values: +# http - +# https - +#auth_protocol = https + +# Complete admin Identity API endpoint. This should specify the unversioned +# root endpoint e.g. https://localhost:35357/ (string value) +#identity_uri = + +# This option is deprecated and may be removed in a future release. Single +# shared secret with the Keystone configuration used for bootstrapping a +# Keystone installation, or otherwise bypassing the normal authentication +# process. This option should not be used, use `admin_user` and +# `admin_password` instead. (string value) +#admin_token = + +# Service username. (string value) +#admin_user = + +# Service user password. (string value) +#admin_password = + +# Service tenant name. (string value) +#admin_tenant_name = admin + +# Authentication type to load (string value) +# Deprecated group/name - [keystone_authtoken]/auth_plugin +#auth_type = + +# Config Section from which to load plugin specific options (string value) +#auth_section = + + +[matchmaker_redis] + +# +# From oslo.messaging +# + +# DEPRECATED: Host to locate redis. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#host = 127.0.0.1 + +# DEPRECATED: Use this port to connect to redis host. (port value) +# Minimum value: 0 +# Maximum value: 65535 +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#port = 6379 + +# DEPRECATED: Password for Redis server (optional). (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#password = + +# DEPRECATED: List of Redis Sentinel hosts (fault tolerance mode), e.g., +# [host:port, host1:port ... ] (list value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#sentinel_hosts = + +# Redis replica set name. (string value) +#sentinel_group_name = oslo-messaging-zeromq + +# Time in ms to wait between connection attempts. (integer value) +#wait_timeout = 2000 + +# Time in ms to wait before the transaction is killed. (integer value) +#check_timeout = 20000 + +# Timeout in ms on blocking socket operations. (integer value) +#socket_timeout = 10000 + + +[nova] +password = nova_user_secret +username = nova +project_name = service +region_name = RegionOne +user_domain_name = default +project_domain_name = default +auth_type = password +auth_url = http://controller:5000 + +# +# From neutron +# + +# Name of nova region to use. Useful if keystone manages more than one region. +# (string value) +#region_name = + +# Type of the nova endpoint to use. This endpoint will be looked up in the +# keystone catalog and should be one of public, internal or admin. (string +# value) +# Possible values: +# public - +# admin - +# internal - +#endpoint_type = public + +# +# From nova.auth +# + +# Authentication URL (string value) +#auth_url = + +# Authentication type to load (string value) +# Deprecated group/name - [nova]/auth_plugin +#auth_type = + +# PEM encoded Certificate Authority to use when verifying HTTPs connections. +# (string value) +#cafile = + +# PEM encoded client certificate cert file (string value) +#certfile = + +# Optional domain ID to use with v3 and v2 parameters. It will be used for both +# the user and project domain in v3 and ignored in v2 authentication. (string +# value) +#default_domain_id = + +# Optional domain name to use with v3 API and v2 parameters. It will be used +# for both the user and project domain in v3 and ignored in v2 authentication. +# (string value) +#default_domain_name = + +# Domain ID to scope to (string value) +#domain_id = + +# Domain name to scope to (string value) +#domain_name = + +# Verify HTTPS connections. (boolean value) +#insecure = false + +# PEM encoded client certificate key file (string value) +#keyfile = + +# User's password (string value) +#password = + +# Domain ID containing project (string value) +#project_domain_id = + +# Domain name containing project (string value) +#project_domain_name = + +# Project ID to scope to (string value) +# Deprecated group/name - [nova]/tenant_id +#project_id = + +# Project name to scope to (string value) +# Deprecated group/name - [nova]/tenant_name +#project_name = + +# Scope for system operations (string value) +#system_scope = + +# Tenant ID (string value) +#tenant_id = + +# Tenant Name (string value) +#tenant_name = + +# Timeout value for http requests (integer value) +#timeout = + +# Trust ID (string value) +#trust_id = + +# User's domain id (string value) +#user_domain_id = + +# User's domain name (string value) +#user_domain_name = + +# User id (string value) +#user_id = + +# Username (string value) +# Deprecated group/name - [nova]/user_name +#username = + + +[oslo_concurrency] + +# +# From oslo.concurrency +# + +# Enables or disables inter-process locks. (boolean value) +#disable_process_locking = false + +# Directory to use for lock files. For security, the specified directory +# should only be writable by the user running the processes that need locking. +# Defaults to environment variable OSLO_LOCK_PATH. If OSLO_LOCK_PATH is not set +# in the environment, use the Python tempfile.gettempdir function to find a +# suitable location. If external locks are used, a lock path must be set. +# (string value) +#lock_path = /tmp + + +[oslo_messaging_amqp] + +# +# From oslo.messaging +# + +# Name for the AMQP container. must be globally unique. Defaults to a generated +# UUID (string value) +#container_name = + +# Timeout for inactive connections (in seconds) (integer value) +#idle_timeout = 0 + +# Debug: dump AMQP frames to stdout (boolean value) +#trace = false + +# Attempt to connect via SSL. If no other ssl-related parameters are given, it +# will use the system's CA-bundle to verify the server's certificate. (boolean +# value) +#ssl = false + +# CA certificate PEM file used to verify the server's certificate (string +# value) +#ssl_ca_file = + +# Self-identifying certificate PEM file for client authentication (string +# value) +#ssl_cert_file = + +# Private key PEM file used to sign ssl_cert_file certificate (optional) +# (string value) +#ssl_key_file = + +# Password for decrypting ssl_key_file (if encrypted) (string value) +#ssl_key_password = + +# By default SSL checks that the name in the server's certificate matches the +# hostname in the transport_url. In some configurations it may be preferable to +# use the virtual hostname instead, for example if the server uses the Server +# Name Indication TLS extension (rfc6066) to provide a certificate per virtual +# host. Set ssl_verify_vhost to True if the server's SSL certificate uses the +# virtual host name instead of the DNS name. (boolean value) +#ssl_verify_vhost = false + +# DEPRECATED: Accept clients using either SSL or plain TCP (boolean value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Not applicable - not a SSL server +#allow_insecure_clients = false + +# Space separated list of acceptable SASL mechanisms (string value) +#sasl_mechanisms = + +# Path to directory that contains the SASL configuration (string value) +#sasl_config_dir = + +# Name of configuration file (without .conf suffix) (string value) +#sasl_config_name = + +# SASL realm to use if no realm present in username (string value) +#sasl_default_realm = + +# DEPRECATED: User name for message broker authentication (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Should use configuration option transport_url to provide the +# username. +#username = + +# DEPRECATED: Password for message broker authentication (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Should use configuration option transport_url to provide the +# password. +#password = + +# Seconds to pause before attempting to re-connect. (integer value) +# Minimum value: 1 +#connection_retry_interval = 1 + +# Increase the connection_retry_interval by this many seconds after each +# unsuccessful failover attempt. (integer value) +# Minimum value: 0 +#connection_retry_backoff = 2 + +# Maximum limit for connection_retry_interval + connection_retry_backoff +# (integer value) +# Minimum value: 1 +#connection_retry_interval_max = 30 + +# Time to pause between re-connecting an AMQP 1.0 link that failed due to a +# recoverable error. (integer value) +# Minimum value: 1 +#link_retry_delay = 10 + +# The maximum number of attempts to re-send a reply message which failed due to +# a recoverable error. (integer value) +# Minimum value: -1 +#default_reply_retry = 0 + +# The deadline for an rpc reply message delivery. (integer value) +# Minimum value: 5 +#default_reply_timeout = 30 + +# The deadline for an rpc cast or call message delivery. Only used when caller +# does not provide a timeout expiry. (integer value) +# Minimum value: 5 +#default_send_timeout = 30 + +# The deadline for a sent notification message delivery. Only used when caller +# does not provide a timeout expiry. (integer value) +# Minimum value: 5 +#default_notify_timeout = 30 + +# The duration to schedule a purge of idle sender links. Detach link after +# expiry. (integer value) +# Minimum value: 1 +#default_sender_link_timeout = 600 + +# Indicates the addressing mode used by the driver. +# Permitted values: +# 'legacy' - use legacy non-routable addressing +# 'routable' - use routable addresses +# 'dynamic' - use legacy addresses if the message bus does not support routing +# otherwise use routable addressing (string value) +#addressing_mode = dynamic + +# Enable virtual host support for those message buses that do not natively +# support virtual hosting (such as qpidd). When set to true the virtual host +# name will be added to all message bus addresses, effectively creating a +# private 'subnet' per virtual host. Set to False if the message bus supports +# virtual hosting using the 'hostname' field in the AMQP 1.0 Open performative +# as the name of the virtual host. (boolean value) +#pseudo_vhost = true + +# address prefix used when sending to a specific server (string value) +#server_request_prefix = exclusive + +# address prefix used when broadcasting to all servers (string value) +#broadcast_prefix = broadcast + +# address prefix when sending to any server in group (string value) +#group_request_prefix = unicast + +# Address prefix for all generated RPC addresses (string value) +#rpc_address_prefix = openstack.org/om/rpc + +# Address prefix for all generated Notification addresses (string value) +#notify_address_prefix = openstack.org/om/notify + +# Appended to the address prefix when sending a fanout message. Used by the +# message bus to identify fanout messages. (string value) +#multicast_address = multicast + +# Appended to the address prefix when sending to a particular RPC/Notification +# server. Used by the message bus to identify messages sent to a single +# destination. (string value) +#unicast_address = unicast + +# Appended to the address prefix when sending to a group of consumers. Used by +# the message bus to identify messages that should be delivered in a round- +# robin fashion across consumers. (string value) +#anycast_address = anycast + +# Exchange name used in notification addresses. +# Exchange name resolution precedence: +# Target.exchange if set +# else default_notification_exchange if set +# else control_exchange if set +# else 'notify' (string value) +#default_notification_exchange = + +# Exchange name used in RPC addresses. +# Exchange name resolution precedence: +# Target.exchange if set +# else default_rpc_exchange if set +# else control_exchange if set +# else 'rpc' (string value) +#default_rpc_exchange = + +# Window size for incoming RPC Reply messages. (integer value) +# Minimum value: 1 +#reply_link_credit = 200 + +# Window size for incoming RPC Request messages (integer value) +# Minimum value: 1 +#rpc_server_credit = 100 + +# Window size for incoming Notification messages (integer value) +# Minimum value: 1 +#notify_server_credit = 100 + +# Send messages of this type pre-settled. +# Pre-settled messages will not receive acknowledgement +# from the peer. Note well: pre-settled messages may be +# silently discarded if the delivery fails. +# Permitted values: +# 'rpc-call' - send RPC Calls pre-settled +# 'rpc-reply'- send RPC Replies pre-settled +# 'rpc-cast' - Send RPC Casts pre-settled +# 'notify' - Send Notifications pre-settled +# (multi valued) +#pre_settled = rpc-cast +#pre_settled = rpc-reply + + +[oslo_messaging_kafka] + +# +# From oslo.messaging +# + +# DEPRECATED: Default Kafka broker Host (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#kafka_default_host = localhost + +# DEPRECATED: Default Kafka broker Port (port value) +# Minimum value: 0 +# Maximum value: 65535 +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#kafka_default_port = 9092 + +# Max fetch bytes of Kafka consumer (integer value) +#kafka_max_fetch_bytes = 1048576 + +# Default timeout(s) for Kafka consumers (floating point value) +#kafka_consumer_timeout = 1.0 + +# DEPRECATED: Pool Size for Kafka Consumers (integer value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Driver no longer uses connection pool. +#pool_size = 10 + +# DEPRECATED: The pool size limit for connections expiration policy (integer +# value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Driver no longer uses connection pool. +#conn_pool_min_size = 2 + +# DEPRECATED: The time-to-live in sec of idle connections in the pool (integer +# value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Driver no longer uses connection pool. +#conn_pool_ttl = 1200 + +# Group id for Kafka consumer. Consumers in one group will coordinate message +# consumption (string value) +#consumer_group = oslo_messaging_consumer + +# Upper bound on the delay for KafkaProducer batching in seconds (floating +# point value) +#producer_batch_timeout = 0.0 + +# Size of batch for the producer async send (integer value) +#producer_batch_size = 16384 + + +[oslo_messaging_notifications] + +# +# From oslo.messaging +# + +# The Drivers(s) to handle sending notifications. Possible values are +# messaging, messagingv2, routing, log, test, noop (multi valued) +# Deprecated group/name - [DEFAULT]/notification_driver +#driver = + +# A URL representing the messaging driver to use for notifications. If not set, +# we fall back to the same configuration used for RPC. (string value) +# Deprecated group/name - [DEFAULT]/notification_transport_url +#transport_url = + +# AMQP topic used for OpenStack notifications. (list value) +# Deprecated group/name - [rpc_notifier2]/topics +# Deprecated group/name - [DEFAULT]/notification_topics +#topics = notifications + +# The maximum number of attempts to re-send a notification message which failed +# to be delivered due to a recoverable error. 0 - No retry, -1 - indefinite +# (integer value) +#retry = -1 + + +[oslo_messaging_rabbit] + +# +# From oslo.messaging +# + +# Use durable queues in AMQP. (boolean value) +# Deprecated group/name - [DEFAULT]/amqp_durable_queues +# Deprecated group/name - [DEFAULT]/rabbit_durable_queues +#amqp_durable_queues = false + +# Auto-delete queues in AMQP. (boolean value) +#amqp_auto_delete = false + +# Enable SSL (boolean value) +#ssl = + +# SSL version to use (valid only if SSL enabled). Valid values are TLSv1 and +# SSLv23. SSLv2, SSLv3, TLSv1_1, and TLSv1_2 may be available on some +# distributions. (string value) +# Deprecated group/name - [oslo_messaging_rabbit]/kombu_ssl_version +#ssl_version = + +# SSL key file (valid only if SSL enabled). (string value) +# Deprecated group/name - [oslo_messaging_rabbit]/kombu_ssl_keyfile +#ssl_key_file = + +# SSL cert file (valid only if SSL enabled). (string value) +# Deprecated group/name - [oslo_messaging_rabbit]/kombu_ssl_certfile +#ssl_cert_file = + +# SSL certification authority file (valid only if SSL enabled). (string value) +# Deprecated group/name - [oslo_messaging_rabbit]/kombu_ssl_ca_certs +#ssl_ca_file = + +# How long to wait before reconnecting in response to an AMQP consumer cancel +# notification. (floating point value) +#kombu_reconnect_delay = 1.0 + +# EXPERIMENTAL: Possible values are: gzip, bz2. If not set compression will not +# be used. This option may not be available in future versions. (string value) +#kombu_compression = + +# How long to wait a missing client before abandoning to send it its replies. +# This value should not be longer than rpc_response_timeout. (integer value) +# Deprecated group/name - [oslo_messaging_rabbit]/kombu_reconnect_timeout +#kombu_missing_consumer_retry_timeout = 60 + +# Determines how the next RabbitMQ node is chosen in case the one we are +# currently connected to becomes unavailable. Takes effect only if more than +# one RabbitMQ node is provided in config. (string value) +# Possible values: +# round-robin - +# shuffle - +#kombu_failover_strategy = round-robin + +# DEPRECATED: The RabbitMQ broker address where a single node is used. (string +# value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#rabbit_host = localhost + +# DEPRECATED: The RabbitMQ broker port where a single node is used. (port +# value) +# Minimum value: 0 +# Maximum value: 65535 +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#rabbit_port = 5672 + +# DEPRECATED: RabbitMQ HA cluster host:port pairs. (list value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#rabbit_hosts = $rabbit_host:$rabbit_port + +# DEPRECATED: The RabbitMQ userid. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#rabbit_userid = guest + +# DEPRECATED: The RabbitMQ password. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#rabbit_password = guest + +# The RabbitMQ login method. (string value) +# Possible values: +# PLAIN - +# AMQPLAIN - +# RABBIT-CR-DEMO - +#rabbit_login_method = AMQPLAIN + +# DEPRECATED: The RabbitMQ virtual host. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#rabbit_virtual_host = / + +# How frequently to retry connecting with RabbitMQ. (integer value) +#rabbit_retry_interval = 1 + +# How long to backoff for between retries when connecting to RabbitMQ. (integer +# value) +#rabbit_retry_backoff = 2 + +# Maximum interval of RabbitMQ connection retries. Default is 30 seconds. +# (integer value) +#rabbit_interval_max = 30 + +# DEPRECATED: Maximum number of RabbitMQ connection retries. Default is 0 +# (infinite retry count). (integer value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +#rabbit_max_retries = 0 + +# Try to use HA queues in RabbitMQ (x-ha-policy: all). If you change this +# option, you must wipe the RabbitMQ database. In RabbitMQ 3.0, queue mirroring +# is no longer controlled by the x-ha-policy argument when declaring a queue. +# If you just want to make sure that all queues (except those with auto- +# generated names) are mirrored across all nodes, run: "rabbitmqctl set_policy +# HA '^(?!amq\.).*' '{"ha-mode": "all"}' " (boolean value) +#rabbit_ha_queues = false + +# Positive integer representing duration in seconds for queue TTL (x-expires). +# Queues which are unused for the duration of the TTL are automatically +# deleted. The parameter affects only reply and fanout queues. (integer value) +# Minimum value: 1 +#rabbit_transient_queues_ttl = 1800 + +# Specifies the number of messages to prefetch. Setting to zero allows +# unlimited messages. (integer value) +#rabbit_qos_prefetch_count = 0 + +# Number of seconds after which the Rabbit broker is considered down if +# heartbeat's keep-alive fails (0 disable the heartbeat). EXPERIMENTAL (integer +# value) +#heartbeat_timeout_threshold = 60 + +# How often times during the heartbeat_timeout_threshold we check the +# heartbeat. (integer value) +#heartbeat_rate = 2 + +# Deprecated, use rpc_backend=kombu+memory or rpc_backend=fake (boolean value) +#fake_rabbit = false + +# Maximum number of channels to allow (integer value) +#channel_max = + +# The maximum byte size for an AMQP frame (integer value) +#frame_max = + +# How often to send heartbeats for consumer's connections (integer value) +#heartbeat_interval = 3 + +# Arguments passed to ssl.wrap_socket (dict value) +#ssl_options = + +# Set socket timeout in seconds for connection's socket (floating point value) +#socket_timeout = 0.25 + +# Set TCP_USER_TIMEOUT in seconds for connection's socket (floating point +# value) +#tcp_user_timeout = 0.25 + +# Set delay for reconnection to some host which has connection error (floating +# point value) +#host_connection_reconnect_delay = 0.25 + +# Connection factory implementation (string value) +# Possible values: +# new - +# single - +# read_write - +#connection_factory = single + +# Maximum number of connections to keep queued. (integer value) +#pool_max_size = 30 + +# Maximum number of connections to create above `pool_max_size`. (integer +# value) +#pool_max_overflow = 0 + +# Default number of seconds to wait for a connections to available (integer +# value) +#pool_timeout = 30 + +# Lifetime of a connection (since creation) in seconds or None for no +# recycling. Expired connections are closed on acquire. (integer value) +#pool_recycle = 600 + +# Threshold at which inactive (since release) connections are considered stale +# in seconds or None for no staleness. Stale connections are closed on acquire. +# (integer value) +#pool_stale = 60 + +# Default serialization mechanism for serializing/deserializing +# outgoing/incoming messages (string value) +# Possible values: +# json - +# msgpack - +#default_serializer_type = json + +# Persist notification messages. (boolean value) +#notification_persistence = false + +# Exchange name for sending notifications (string value) +#default_notification_exchange = ${control_exchange}_notification + +# Max number of not acknowledged message which RabbitMQ can send to +# notification listener. (integer value) +#notification_listener_prefetch_count = 100 + +# Reconnecting retry count in case of connectivity problem during sending +# notification, -1 means infinite retry. (integer value) +#default_notification_retry_attempts = -1 + +# Reconnecting retry delay in case of connectivity problem during sending +# notification message (floating point value) +#notification_retry_delay = 0.25 + +# Time to live for rpc queues without consumers in seconds. (integer value) +#rpc_queue_expiration = 60 + +# Exchange name for sending RPC messages (string value) +#default_rpc_exchange = ${control_exchange}_rpc + +# Exchange name for receiving RPC replies (string value) +#rpc_reply_exchange = ${control_exchange}_rpc_reply + +# Max number of not acknowledged message which RabbitMQ can send to rpc +# listener. (integer value) +#rpc_listener_prefetch_count = 100 + +# Max number of not acknowledged message which RabbitMQ can send to rpc reply +# listener. (integer value) +#rpc_reply_listener_prefetch_count = 100 + +# Reconnecting retry count in case of connectivity problem during sending +# reply. -1 means infinite retry during rpc_timeout (integer value) +#rpc_reply_retry_attempts = -1 + +# Reconnecting retry delay in case of connectivity problem during sending +# reply. (floating point value) +#rpc_reply_retry_delay = 0.25 + +# Reconnecting retry count in case of connectivity problem during sending RPC +# message, -1 means infinite retry. If actual retry attempts in not 0 the rpc +# request could be processed more than one time (integer value) +#default_rpc_retry_attempts = -1 + +# Reconnecting retry delay in case of connectivity problem during sending RPC +# message (floating point value) +#rpc_retry_delay = 0.25 + + +[oslo_messaging_zmq] + +# +# From oslo.messaging +# + +# ZeroMQ bind address. Should be a wildcard (*), an ethernet interface, or IP. +# The "host" option should point or resolve to this address. (string value) +#rpc_zmq_bind_address = * + +# MatchMaker driver. (string value) +# Possible values: +# redis - +# sentinel - +# dummy - +#rpc_zmq_matchmaker = redis + +# Number of ZeroMQ contexts, defaults to 1. (integer value) +#rpc_zmq_contexts = 1 + +# Maximum number of ingress messages to locally buffer per topic. Default is +# unlimited. (integer value) +#rpc_zmq_topic_backlog = + +# Directory for holding IPC sockets. (string value) +#rpc_zmq_ipc_dir = /var/run/openstack + +# Name of this node. Must be a valid hostname, FQDN, or IP address. Must match +# "host" option, if running Nova. (string value) +#rpc_zmq_host = localhost + +# Number of seconds to wait before all pending messages will be sent after +# closing a socket. The default value of -1 specifies an infinite linger +# period. The value of 0 specifies no linger period. Pending messages shall be +# discarded immediately when the socket is closed. Positive values specify an +# upper bound for the linger period. (integer value) +# Deprecated group/name - [DEFAULT]/rpc_cast_timeout +#zmq_linger = -1 + +# The default number of seconds that poll should wait. Poll raises timeout +# exception when timeout expired. (integer value) +#rpc_poll_timeout = 1 + +# Expiration timeout in seconds of a name service record about existing target +# ( < 0 means no timeout). (integer value) +#zmq_target_expire = 300 + +# Update period in seconds of a name service record about existing target. +# (integer value) +#zmq_target_update = 180 + +# Use PUB/SUB pattern for fanout methods. PUB/SUB always uses proxy. (boolean +# value) +#use_pub_sub = false + +# Use ROUTER remote proxy. (boolean value) +#use_router_proxy = false + +# This option makes direct connections dynamic or static. It makes sense only +# with use_router_proxy=False which means to use direct connections for direct +# message types (ignored otherwise). (boolean value) +#use_dynamic_connections = false + +# How many additional connections to a host will be made for failover reasons. +# This option is actual only in dynamic connections mode. (integer value) +#zmq_failover_connections = 2 + +# Minimal port number for random ports range. (port value) +# Minimum value: 0 +# Maximum value: 65535 +#rpc_zmq_min_port = 49153 + +# Maximal port number for random ports range. (integer value) +# Minimum value: 1 +# Maximum value: 65536 +#rpc_zmq_max_port = 65536 + +# Number of retries to find free port number before fail with ZMQBindError. +# (integer value) +#rpc_zmq_bind_port_retries = 100 + +# Default serialization mechanism for serializing/deserializing +# outgoing/incoming messages (string value) +# Possible values: +# json - +# msgpack - +#rpc_zmq_serialization = json + +# This option configures round-robin mode in zmq socket. True means not keeping +# a queue when server side disconnects. False means to keep queue and messages +# even if server is disconnected, when the server appears we send all +# accumulated messages to it. (boolean value) +#zmq_immediate = true + +# Enable/disable TCP keepalive (KA) mechanism. The default value of -1 (or any +# other negative value) means to skip any overrides and leave it to OS default; +# 0 and 1 (or any other positive value) mean to disable and enable the option +# respectively. (integer value) +#zmq_tcp_keepalive = -1 + +# The duration between two keepalive transmissions in idle condition. The unit +# is platform dependent, for example, seconds in Linux, milliseconds in Windows +# etc. The default value of -1 (or any other negative value and 0) means to +# skip any overrides and leave it to OS default. (integer value) +#zmq_tcp_keepalive_idle = -1 + +# The number of retransmissions to be carried out before declaring that remote +# end is not available. The default value of -1 (or any other negative value +# and 0) means to skip any overrides and leave it to OS default. (integer +# value) +#zmq_tcp_keepalive_cnt = -1 + +# The duration between two successive keepalive retransmissions, if +# acknowledgement to the previous keepalive transmission is not received. The +# unit is platform dependent, for example, seconds in Linux, milliseconds in +# Windows etc. The default value of -1 (or any other negative value and 0) +# means to skip any overrides and leave it to OS default. (integer value) +#zmq_tcp_keepalive_intvl = -1 + +# Maximum number of (green) threads to work concurrently. (integer value) +#rpc_thread_pool_size = 100 + +# Expiration timeout in seconds of a sent/received message after which it is +# not tracked anymore by a client/server. (integer value) +#rpc_message_ttl = 300 + +# Wait for message acknowledgements from receivers. This mechanism works only +# via proxy without PUB/SUB. (boolean value) +#rpc_use_acks = false + +# Number of seconds to wait for an ack from a cast/call. After each retry +# attempt this timeout is multiplied by some specified multiplier. (integer +# value) +#rpc_ack_timeout_base = 15 + +# Number to multiply base ack timeout by after each retry attempt. (integer +# value) +#rpc_ack_timeout_multiplier = 2 + +# Default number of message sending attempts in case of any problems occurred: +# positive value N means at most N retries, 0 means no retries, None or -1 (or +# any other negative values) mean to retry forever. This option is used only if +# acknowledgments are enabled. (integer value) +#rpc_retry_attempts = 3 + +# List of publisher hosts SubConsumer can subscribe on. This option has higher +# priority then the default publishers list taken from the matchmaker. (list +# value) +#subscribe_on = + + +[oslo_middleware] + +# +# From oslo.middleware.http_proxy_to_wsgi +# + +# Whether the application is behind a proxy or not. This determines if the +# middleware should parse the headers or not. (boolean value) +#enable_proxy_headers_parsing = false + + +[oslo_policy] + +# +# From oslo.policy +# + +# This option controls whether or not to enforce scope when evaluating +# policies. If ``True``, the scope of the token used in the request is compared +# to the ``scope_types`` of the policy being enforced. If the scopes do not +# match, an ``InvalidScope`` exception will be raised. If ``False``, a message +# will be logged informing operators that policies are being invoked with +# mismatching scope. (boolean value) +#enforce_scope = false + +# The file that defines policies. (string value) +#policy_file = policy.json + +# Default rule. Enforced when a requested rule is not found. (string value) +#policy_default_rule = default + +# Directories where policy configuration files are stored. They can be relative +# to any directory in the search path defined by the config_dir option, or +# absolute paths. The file defined by policy_file must exist for these +# directories to be searched. Missing or empty directories are ignored. (multi +# valued) +#policy_dirs = policy.d + +# Content Type to send and receive data for REST based policy check (string +# value) +# Possible values: +# application/x-www-form-urlencoded - +# application/json - +#remote_content_type = application/x-www-form-urlencoded + +# server identity verification for REST based policy check (boolean value) +#remote_ssl_verify_server_crt = false + +# Absolute path to ca cert file for REST based policy check (string value) +#remote_ssl_ca_crt_file = + +# Absolute path to client cert for REST based policy check (string value) +#remote_ssl_client_crt_file = + +# Absolute path client key file REST based policy check (string value) +#remote_ssl_client_key_file = + + +[quotas] + +# +# From neutron +# + +# Default number of resource allowed per tenant. A negative value means +# unlimited. (integer value) +#default_quota = -1 + +# Number of networks allowed per tenant. A negative value means unlimited. +# (integer value) +#quota_network = 100 + +# Number of subnets allowed per tenant, A negative value means unlimited. +# (integer value) +#quota_subnet = 100 + +# Number of ports allowed per tenant. A negative value means unlimited. +# (integer value) +#quota_port = 500 + +# Default driver to use for quota checks. (string value) +#quota_driver = neutron.db.quota.driver.DbQuotaDriver + +# Keep in track in the database of current resource quota usage. Plugins which +# do not leverage the neutron database should set this flag to False. (boolean +# value) +#track_quota_usage = true + +# +# From neutron.extensions +# + +# Number of routers allowed per tenant. A negative value means unlimited. +# (integer value) +#quota_router = 10 + +# Number of floating IPs allowed per tenant. A negative value means unlimited. +# (integer value) +#quota_floatingip = 50 + +# Number of security groups allowed per tenant. A negative value means +# unlimited. (integer value) +#quota_security_group = 10 + +# Number of security rules allowed per tenant. A negative value means +# unlimited. (integer value) +#quota_security_group_rule = 100 + + +[ssl] + +# +# From oslo.service.sslutils +# + +# CA certificate file to use to verify connecting clients. (string value) +# Deprecated group/name - [DEFAULT]/ssl_ca_file +#ca_file = + +# Certificate file to use when starting the server securely. (string value) +# Deprecated group/name - [DEFAULT]/ssl_cert_file +#cert_file = + +# Private key file to use when starting the server securely. (string value) +# Deprecated group/name - [DEFAULT]/ssl_key_file +#key_file = + +# SSL version to use (valid only if SSL enabled). Valid values are TLSv1 and +# SSLv23. SSLv2, SSLv3, TLSv1_1, and TLSv1_2 may be available on some +# distributions. (string value) +#version = + +# Sets the list of available ciphers. value should be a string in the OpenSSL +# cipher list format. (string value) +#ciphers = diff --git a/openstack/openstack_conf/controller/neutron/plugins/ml2/linuxbridge_agent.ini b/openstack/openstack_conf/controller/neutron/plugins/ml2/linuxbridge_agent.ini new file mode 100644 index 0000000..93e6c9b --- /dev/null +++ b/openstack/openstack_conf/controller/neutron/plugins/ml2/linuxbridge_agent.ini @@ -0,0 +1,275 @@ +[DEFAULT] + +# +# From oslo.log +# + +# If set to true, the logging level will be set to DEBUG instead of the default +# INFO level. (boolean value) +# Note: This option can be changed without restarting. +#debug = false + +# The name of a logging configuration file. This file is appended to any +# existing logging configuration files. For details about logging configuration +# files, see the Python logging module documentation. Note that when logging +# configuration files are used then all logging configuration is set in the +# configuration file and other logging configuration options are ignored (for +# example, logging_context_format_string). (string value) +# Note: This option can be changed without restarting. +# Deprecated group/name - [DEFAULT]/log_config +#log_config_append = + +# Defines the format string for %%(asctime)s in log records. Default: +# %(default)s . This option is ignored if log_config_append is set. (string +# value) +#log_date_format = %Y-%m-%d %H:%M:%S + +# (Optional) Name of log file to send logging output to. If no default is set, +# logging will go to stderr as defined by use_stderr. This option is ignored if +# log_config_append is set. (string value) +# Deprecated group/name - [DEFAULT]/logfile +#log_file = + +# (Optional) The base directory used for relative log_file paths. This option +# is ignored if log_config_append is set. (string value) +# Deprecated group/name - [DEFAULT]/logdir +#log_dir = + +# Uses logging handler designed to watch file system. When log file is moved or +# removed this handler will open a new log file with specified path +# instantaneously. It makes sense only if log_file option is specified and +# Linux platform is used. This option is ignored if log_config_append is set. +# (boolean value) +#watch_log_file = false + +# Use syslog for logging. Existing syslog format is DEPRECATED and will be +# changed later to honor RFC5424. This option is ignored if log_config_append +# is set. (boolean value) +#use_syslog = false + +# Enable journald for logging. If running in a systemd environment you may wish +# to enable journal support. Doing so will use the journal native protocol +# which includes structured metadata in addition to log messages.This option is +# ignored if log_config_append is set. (boolean value) +#use_journal = false + +# Syslog facility to receive log lines. This option is ignored if +# log_config_append is set. (string value) +#syslog_log_facility = LOG_USER + +# Use JSON formatting for logging. This option is ignored if log_config_append +# is set. (boolean value) +#use_json = false + +# Log output to standard error. This option is ignored if log_config_append is +# set. (boolean value) +#use_stderr = false + +# Format string to use for log messages with context. (string value) +#logging_context_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user_identity)s] %(instance)s%(message)s + +# Format string to use for log messages when context is undefined. (string +# value) +#logging_default_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [-] %(instance)s%(message)s + +# Additional data to append to log message when logging level for the message +# is DEBUG. (string value) +#logging_debug_format_suffix = %(funcName)s %(pathname)s:%(lineno)d + +# Prefix each line of exception output with this format. (string value) +#logging_exception_prefix = %(asctime)s.%(msecs)03d %(process)d ERROR %(name)s %(instance)s + +# Defines the format string for %(user_identity)s that is used in +# logging_context_format_string. (string value) +#logging_user_identity_format = %(user)s %(tenant)s %(domain)s %(user_domain)s %(project_domain)s + +# List of package logging levels in logger=LEVEL pairs. This option is ignored +# if log_config_append is set. (list value) +#default_log_levels = amqp=WARN,amqplib=WARN,boto=WARN,qpid=WARN,sqlalchemy=WARN,suds=INFO,oslo.messaging=INFO,oslo_messaging=INFO,iso8601=WARN,requests.packages.urllib3.connectionpool=WARN,urllib3.connectionpool=WARN,websocket=WARN,requests.packages.urllib3.util.retry=WARN,urllib3.util.retry=WARN,keystonemiddleware=WARN,routes.middleware=WARN,stevedore=WARN,taskflow=WARN,keystoneauth=WARN,oslo.cache=INFO,dogpile.core.dogpile=INFO + +# Enables or disables publication of error events. (boolean value) +#publish_errors = false + +# The format for an instance that is passed with the log message. (string +# value) +#instance_format = "[instance: %(uuid)s] " + +# The format for an instance UUID that is passed with the log message. (string +# value) +#instance_uuid_format = "[instance: %(uuid)s] " + +# Interval, number of seconds, of log rate limiting. (integer value) +#rate_limit_interval = 0 + +# Maximum number of logged messages per rate_limit_interval. (integer value) +#rate_limit_burst = 0 + +# Log level name used by rate limiting: CRITICAL, ERROR, INFO, WARNING, DEBUG +# or empty string. Logs with level greater or equal to rate_limit_except_level +# are not filtered. An empty string means that all levels are filtered. (string +# value) +#rate_limit_except_level = CRITICAL + +# Enables or disables fatal status of deprecations. (boolean value) +#fatal_deprecations = false + + +[agent] + +# +# From neutron.ml2.linuxbridge.agent +# + +# The number of seconds the agent will wait between polling for local device +# changes. (integer value) +#polling_interval = 2 + +# Set new timeout in seconds for new rpc calls after agent receives SIGTERM. If +# value is set to 0, rpc timeout won't be changed (integer value) +#quitting_rpc_timeout = 10 + +# The DSCP value to use for outer headers during tunnel encapsulation. (integer +# value) +# Minimum value: 0 +# Maximum value: 63 +#dscp = + +# If set to True, the DSCP value of tunnel interfaces is overwritten and set to +# inherit. The DSCP value of the inner header is then copied to the outer +# header. (boolean value) +#dscp_inherit = false + +# Extensions list to use (list value) +#extensions = + + +[linux_bridge] +physical_interface_mappings = provider:enp0s9 + +# +# From neutron.ml2.linuxbridge.agent +# + +# Comma-separated list of : tuples +# mapping physical network names to the agent's node-specific physical network +# interfaces to be used for flat and VLAN networks. All physical networks +# listed in network_vlan_ranges on the server should have mappings to +# appropriate interfaces on each agent. (list value) +#physical_interface_mappings = + +# List of : (list value) +#bridge_mappings = + + +[network_log] + +# +# From neutron.ml2.linuxbridge.agent +# + +# Maximum packets logging per second. (integer value) +# Minimum value: 100 +#rate_limit = 100 + +# Maximum number of packets per rate_limit. (integer value) +# Minimum value: 25 +#burst_limit = 25 + +# Output logfile path on agent side, default syslog file. (string value) +#local_output_log_base = + + +[securitygroup] +firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver +enable_security_group = true + +# +# From neutron.ml2.linuxbridge.agent +# + +# Driver for security groups firewall in the L2 agent (string value) +#firewall_driver = + +# Controls whether the neutron security group API is enabled in the server. It +# should be false when using no security groups or using the nova security +# group API. (boolean value) +#enable_security_group = true + +# Use ipset to speed-up the iptables based security groups. Enabling ipset +# support requires that ipset is installed on L2 agent node. (boolean value) +#enable_ipset = true + + +[vxlan] +l2_population = true +local_ip = 10.0.0.11 +enable_vxlan = true + +# +# From neutron.ml2.linuxbridge.agent +# + +# Enable VXLAN on the agent. Can be enabled when agent is managed by ml2 plugin +# using linuxbridge mechanism driver (boolean value) +#enable_vxlan = true + +# TTL for vxlan interface protocol packets. (integer value) +#ttl = + +# DEPRECATED: TOS for vxlan interface protocol packets. This option is +# deprecated in favor of the dscp option in the AGENT section and will be +# removed in a future release. To convert the TOS value to DSCP, divide by 4. +# (integer value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +#tos = + +# Multicast group(s) for vxlan interface. A range of group addresses may be +# specified by using CIDR notation. Specifying a range allows different VNIs to +# use different group addresses, reducing or eliminating spurious broadcast +# traffic to the tunnel endpoints. To reserve a unique group for each possible +# (24-bit) VNI, use a /8 such as 239.0.0.0/8. This setting must be the same on +# all the agents. (string value) +#vxlan_group = 224.0.0.1 + +# IP address of local overlay (tunnel) network endpoint. Use either an IPv4 or +# IPv6 address that resides on one of the host network interfaces. The IP +# version of this value must match the value of the 'overlay_ip_version' option +# in the ML2 plug-in configuration file on the neutron server node(s). (IP +# address value) +#local_ip = + +# The minimum of the UDP source port range used for VXLAN communication. (port +# value) +# Minimum value: 0 +# Maximum value: 65535 +#udp_srcport_min = 0 + +# The maximum of the UDP source port range used for VXLAN communication. (port +# value) +# Minimum value: 0 +# Maximum value: 65535 +#udp_srcport_max = 0 + +# The UDP port used for VXLAN communication. By default, the Linux kernel +# doesn't use the IANA assigned standard value, so if you want to use it, this +# option must be set to 4789. It is not set by default because of backward +# compatibiltiy. (port value) +# Minimum value: 0 +# Maximum value: 65535 +#udp_dstport = + +# Extension to use alongside ml2 plugin's l2population mechanism driver. It +# enables the plugin to populate VXLAN forwarding table. (boolean value) +#l2_population = false + +# Enable local ARP responder which provides local responses instead of +# performing ARP broadcast into the overlay. Enabling local ARP responder is +# not fully compatible with the allowed-address-pairs extension. (boolean +# value) +#arp_responder = false + +# Optional comma-separated list of :: +# triples describing how to assign a multicast address to VXLAN according to +# its VNI ID. (list value) +#multicast_ranges = diff --git a/openstack/openstack_conf/controller/neutron/plugins/ml2/ml2_conf.ini b/openstack/openstack_conf/controller/neutron/plugins/ml2/ml2_conf.ini new file mode 100644 index 0000000..2789ac0 --- /dev/null +++ b/openstack/openstack_conf/controller/neutron/plugins/ml2/ml2_conf.ini @@ -0,0 +1,270 @@ +[DEFAULT] + +# +# From oslo.log +# + +# If set to true, the logging level will be set to DEBUG instead of the default +# INFO level. (boolean value) +# Note: This option can be changed without restarting. +#debug = false + +# The name of a logging configuration file. This file is appended to any +# existing logging configuration files. For details about logging configuration +# files, see the Python logging module documentation. Note that when logging +# configuration files are used then all logging configuration is set in the +# configuration file and other logging configuration options are ignored (for +# example, logging_context_format_string). (string value) +# Note: This option can be changed without restarting. +# Deprecated group/name - [DEFAULT]/log_config +#log_config_append = + +# Defines the format string for %%(asctime)s in log records. Default: +# %(default)s . This option is ignored if log_config_append is set. (string +# value) +#log_date_format = %Y-%m-%d %H:%M:%S + +# (Optional) Name of log file to send logging output to. If no default is set, +# logging will go to stderr as defined by use_stderr. This option is ignored if +# log_config_append is set. (string value) +# Deprecated group/name - [DEFAULT]/logfile +#log_file = + +# (Optional) The base directory used for relative log_file paths. This option +# is ignored if log_config_append is set. (string value) +# Deprecated group/name - [DEFAULT]/logdir +#log_dir = + +# Uses logging handler designed to watch file system. When log file is moved or +# removed this handler will open a new log file with specified path +# instantaneously. It makes sense only if log_file option is specified and +# Linux platform is used. This option is ignored if log_config_append is set. +# (boolean value) +#watch_log_file = false + +# Use syslog for logging. Existing syslog format is DEPRECATED and will be +# changed later to honor RFC5424. This option is ignored if log_config_append +# is set. (boolean value) +#use_syslog = false + +# Enable journald for logging. If running in a systemd environment you may wish +# to enable journal support. Doing so will use the journal native protocol +# which includes structured metadata in addition to log messages.This option is +# ignored if log_config_append is set. (boolean value) +#use_journal = false + +# Syslog facility to receive log lines. This option is ignored if +# log_config_append is set. (string value) +#syslog_log_facility = LOG_USER + +# Use JSON formatting for logging. This option is ignored if log_config_append +# is set. (boolean value) +#use_json = false + +# Log output to standard error. This option is ignored if log_config_append is +# set. (boolean value) +#use_stderr = false + +# Format string to use for log messages with context. (string value) +#logging_context_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user_identity)s] %(instance)s%(message)s + +# Format string to use for log messages when context is undefined. (string +# value) +#logging_default_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [-] %(instance)s%(message)s + +# Additional data to append to log message when logging level for the message +# is DEBUG. (string value) +#logging_debug_format_suffix = %(funcName)s %(pathname)s:%(lineno)d + +# Prefix each line of exception output with this format. (string value) +#logging_exception_prefix = %(asctime)s.%(msecs)03d %(process)d ERROR %(name)s %(instance)s + +# Defines the format string for %(user_identity)s that is used in +# logging_context_format_string. (string value) +#logging_user_identity_format = %(user)s %(tenant)s %(domain)s %(user_domain)s %(project_domain)s + +# List of package logging levels in logger=LEVEL pairs. This option is ignored +# if log_config_append is set. (list value) +#default_log_levels = amqp=WARN,amqplib=WARN,boto=WARN,qpid=WARN,sqlalchemy=WARN,suds=INFO,oslo.messaging=INFO,oslo_messaging=INFO,iso8601=WARN,requests.packages.urllib3.connectionpool=WARN,urllib3.connectionpool=WARN,websocket=WARN,requests.packages.urllib3.util.retry=WARN,urllib3.util.retry=WARN,keystonemiddleware=WARN,routes.middleware=WARN,stevedore=WARN,taskflow=WARN,keystoneauth=WARN,oslo.cache=INFO,dogpile.core.dogpile=INFO + +# Enables or disables publication of error events. (boolean value) +#publish_errors = false + +# The format for an instance that is passed with the log message. (string +# value) +#instance_format = "[instance: %(uuid)s] " + +# The format for an instance UUID that is passed with the log message. (string +# value) +#instance_uuid_format = "[instance: %(uuid)s] " + +# Interval, number of seconds, of log rate limiting. (integer value) +#rate_limit_interval = 0 + +# Maximum number of logged messages per rate_limit_interval. (integer value) +#rate_limit_burst = 0 + +# Log level name used by rate limiting: CRITICAL, ERROR, INFO, WARNING, DEBUG +# or empty string. Logs with level greater or equal to rate_limit_except_level +# are not filtered. An empty string means that all levels are filtered. (string +# value) +#rate_limit_except_level = CRITICAL + +# Enables or disables fatal status of deprecations. (boolean value) +#fatal_deprecations = false + + +[l2pop] + +# +# From neutron.ml2 +# + +# Delay within which agent is expected to update existing ports when it +# restarts (integer value) +#agent_boot_time = 180 + + +[ml2] +extension_drivers = port_security +mechanism_drivers = linuxbridge,l2population +tenant_network_types = vxlan +type_drivers = flat,vlan,vxlan + +# +# From neutron.ml2 +# + +# List of network type driver entrypoints to be loaded from the +# neutron.ml2.type_drivers namespace. (list value) +#type_drivers = local,flat,vlan,gre,vxlan,geneve + +# Ordered list of network_types to allocate as tenant networks. The default +# value 'local' is useful for single-box testing but provides no connectivity +# between hosts. (list value) +#tenant_network_types = local + +# An ordered list of networking mechanism driver entrypoints to be loaded from +# the neutron.ml2.mechanism_drivers namespace. (list value) +#mechanism_drivers = + +# An ordered list of extension driver entrypoints to be loaded from the +# neutron.ml2.extension_drivers namespace. For example: extension_drivers = +# port_security,qos (list value) +#extension_drivers = + +# Maximum size of an IP packet (MTU) that can traverse the underlying physical +# network infrastructure without fragmentation when using an overlay/tunnel +# protocol. This option allows specifying a physical network MTU value that +# differs from the default global_physnet_mtu value. (integer value) +#path_mtu = 0 + +# A list of mappings of physical networks to MTU values. The format of the +# mapping is :. This mapping allows specifying a physical +# network MTU value that differs from the default global_physnet_mtu value. +# (list value) +#physical_network_mtus = + +# Default network type for external networks when no provider attributes are +# specified. By default it is None, which means that if provider attributes are +# not specified while creating external networks then they will have the same +# type as tenant networks. Allowed values for external_network_type config +# option depend on the network type values configured in type_drivers config +# option. (string value) +#external_network_type = + +# IP version of all overlay (tunnel) network endpoints. Use a value of 4 for +# IPv4 or 6 for IPv6. (integer value) +#overlay_ip_version = 4 + + +[ml2_type_flat] +flat_networks = provider + +# +# From neutron.ml2 +# + +# List of physical_network names with which flat networks can be created. Use +# default '*' to allow flat networks with arbitrary physical_network names. Use +# an empty list to disable flat networks. (list value) +#flat_networks = * + + +[ml2_type_geneve] + +# +# From neutron.ml2 +# + +# Comma-separated list of : tuples enumerating ranges of +# Geneve VNI IDs that are available for tenant network allocation (list value) +#vni_ranges = + +# Geneve encapsulation header size is dynamic, this value is used to calculate +# the maximum MTU for the driver. This is the sum of the sizes of the outer ETH +# + IP + UDP + GENEVE header sizes. The default size for this field is 50, +# which is the size of the Geneve header without any additional option headers. +# (integer value) +#max_header_size = 30 + + +[ml2_type_gre] + +# +# From neutron.ml2 +# + +# Comma-separated list of : tuples enumerating ranges of GRE +# tunnel IDs that are available for tenant network allocation (list value) +#tunnel_id_ranges = + + +[ml2_type_vlan] + +# +# From neutron.ml2 +# + +# List of :: or +# specifying physical_network names usable for VLAN provider and tenant +# networks, as well as ranges of VLAN tags on each available for allocation to +# tenant networks. (list value) +#network_vlan_ranges = + + +[ml2_type_vxlan] +vni_ranges = 1:1000 + +# +# From neutron.ml2 +# + +# Comma-separated list of : tuples enumerating ranges of +# VXLAN VNI IDs that are available for tenant network allocation (list value) +#vni_ranges = + +# Multicast group for VXLAN. When configured, will enable sending all broadcast +# traffic to this multicast group. When left unconfigured, will disable +# multicast VXLAN mode. (string value) +#vxlan_group = + + +[securitygroup] +enable_ipset = true + +# +# From neutron.ml2 +# + +# Driver for security groups firewall in the L2 agent (string value) +#firewall_driver = + +# Controls whether the neutron security group API is enabled in the server. It +# should be false when using no security groups or using the nova security +# group API. (boolean value) +#enable_security_group = true + +# Use ipset to speed-up the iptables based security groups. Enabling ipset +# support requires that ipset is installed on L2 agent node. (boolean value) +#enable_ipset = true diff --git a/openstack/openstack_conf/controller/neutron/policy.json b/openstack/openstack_conf/controller/neutron/policy.json new file mode 100644 index 0000000..bd7630c --- /dev/null +++ b/openstack/openstack_conf/controller/neutron/policy.json @@ -0,0 +1,235 @@ +{ + "context_is_admin": "role:admin", + "owner": "tenant_id:%(tenant_id)s", + "admin_or_owner": "rule:context_is_admin or rule:owner", + "context_is_advsvc": "role:advsvc", + "admin_or_network_owner": "rule:context_is_admin or tenant_id:%(network:tenant_id)s", + "admin_owner_or_network_owner": "rule:owner or rule:admin_or_network_owner", + "admin_only": "rule:context_is_admin", + "regular_user": "", + "admin_or_data_plane_int": "rule:context_is_admin or role:data_plane_integrator", + "shared": "field:networks:shared=True", + "shared_subnetpools": "field:subnetpools:shared=True", + "shared_address_scopes": "field:address_scopes:shared=True", + "external": "field:networks:router:external=True", + "default": "rule:admin_or_owner", + + "create_subnet": "rule:admin_or_network_owner", + "create_subnet:segment_id": "rule:admin_only", + "create_subnet:service_types": "rule:admin_only", + "get_subnet": "rule:admin_or_owner or rule:shared", + "get_subnet:segment_id": "rule:admin_only", + "update_subnet": "rule:admin_or_network_owner", + "update_subnet:service_types": "rule:admin_only", + "delete_subnet": "rule:admin_or_network_owner", + + "create_subnetpool": "", + "create_subnetpool:shared": "rule:admin_only", + "create_subnetpool:is_default": "rule:admin_only", + "get_subnetpool": "rule:admin_or_owner or rule:shared_subnetpools", + "update_subnetpool": "rule:admin_or_owner", + "update_subnetpool:is_default": "rule:admin_only", + "delete_subnetpool": "rule:admin_or_owner", + + "create_address_scope": "", + "create_address_scope:shared": "rule:admin_only", + "get_address_scope": "rule:admin_or_owner or rule:shared_address_scopes", + "update_address_scope": "rule:admin_or_owner", + "update_address_scope:shared": "rule:admin_only", + "delete_address_scope": "rule:admin_or_owner", + + "create_network": "", + "get_network": "rule:admin_or_owner or rule:shared or rule:external or rule:context_is_advsvc", + "get_network:router:external": "rule:regular_user", + "get_network:segments": "rule:admin_only", + "get_network:provider:network_type": "rule:admin_only", + "get_network:provider:physical_network": "rule:admin_only", + "get_network:provider:segmentation_id": "rule:admin_only", + "get_network:queue_id": "rule:admin_only", + "get_network_ip_availabilities": "rule:admin_only", + "get_network_ip_availability": "rule:admin_only", + "create_network:shared": "rule:admin_only", + "create_network:router:external": "rule:admin_only", + "create_network:is_default": "rule:admin_only", + "create_network:segments": "rule:admin_only", + "create_network:provider:network_type": "rule:admin_only", + "create_network:provider:physical_network": "rule:admin_only", + "create_network:provider:segmentation_id": "rule:admin_only", + "update_network": "rule:admin_or_owner", + "update_network:segments": "rule:admin_only", + "update_network:shared": "rule:admin_only", + "update_network:provider:network_type": "rule:admin_only", + "update_network:provider:physical_network": "rule:admin_only", + "update_network:provider:segmentation_id": "rule:admin_only", + "update_network:router:external": "rule:admin_only", + "delete_network": "rule:admin_or_owner", + + "create_segment": "rule:admin_only", + "get_segment": "rule:admin_only", + "update_segment": "rule:admin_only", + "delete_segment": "rule:admin_only", + + "network_device": "field:port:device_owner=~^network:", + "create_port": "", + "create_port:device_owner": "not rule:network_device or rule:context_is_advsvc or rule:admin_or_network_owner", + "create_port:mac_address": "rule:context_is_advsvc or rule:admin_or_network_owner", + "create_port:fixed_ips:ip_address": "rule:context_is_advsvc or rule:admin_or_network_owner", + "create_port:fixed_ips:subnet_id": "rule:context_is_advsvc or rule:admin_or_network_owner or rule:shared", + "create_port:port_security_enabled": "rule:context_is_advsvc or rule:admin_or_network_owner", + "create_port:binding:host_id": "rule:admin_only", + "create_port:binding:profile": "rule:admin_only", + "create_port:mac_learning_enabled": "rule:context_is_advsvc or rule:admin_or_network_owner", + "create_port:allowed_address_pairs": "rule:admin_or_network_owner", + "get_port": "rule:context_is_advsvc or rule:admin_owner_or_network_owner", + "get_port:queue_id": "rule:admin_only", + "get_port:binding:vif_type": "rule:admin_only", + "get_port:binding:vif_details": "rule:admin_only", + "get_port:binding:host_id": "rule:admin_only", + "get_port:binding:profile": "rule:admin_only", + "update_port": "rule:admin_or_owner or rule:context_is_advsvc", + "update_port:device_owner": "not rule:network_device or rule:context_is_advsvc or rule:admin_or_network_owner", + "update_port:mac_address": "rule:admin_only or rule:context_is_advsvc", + "update_port:fixed_ips:ip_address": "rule:context_is_advsvc or rule:admin_or_network_owner", + "update_port:fixed_ips:subnet_id": "rule:context_is_advsvc or rule:admin_or_network_owner or rule:shared", + "update_port:port_security_enabled": "rule:context_is_advsvc or rule:admin_or_network_owner", + "update_port:binding:host_id": "rule:admin_only", + "update_port:binding:profile": "rule:admin_only", + "update_port:mac_learning_enabled": "rule:context_is_advsvc or rule:admin_or_network_owner", + "update_port:allowed_address_pairs": "rule:admin_or_network_owner", + "update_port:data_plane_status": "rule:admin_or_data_plane_int", + "delete_port": "rule:context_is_advsvc or rule:admin_owner_or_network_owner", + + "get_router:ha": "rule:admin_only", + "create_router": "rule:regular_user", + "create_router:external_gateway_info:enable_snat": "rule:admin_only", + "create_router:distributed": "rule:admin_only", + "create_router:ha": "rule:admin_only", + "get_router": "rule:admin_or_owner", + "get_router:distributed": "rule:admin_only", + "update_router": "rule:admin_or_owner", + "update_router:external_gateway_info": "rule:admin_or_owner", + "update_router:external_gateway_info:network_id": "rule:admin_or_owner", + "update_router:external_gateway_info:enable_snat": "rule:admin_only", + "update_router:distributed": "rule:admin_only", + "update_router:ha": "rule:admin_only", + "delete_router": "rule:admin_or_owner", + + "add_router_interface": "rule:admin_or_owner", + "remove_router_interface": "rule:admin_or_owner", + + "create_router:external_gateway_info:external_fixed_ips": "rule:admin_only", + "update_router:external_gateway_info:external_fixed_ips": "rule:admin_only", + + "create_qos_queue": "rule:admin_only", + "get_qos_queue": "rule:admin_only", + + "update_agent": "rule:admin_only", + "delete_agent": "rule:admin_only", + "get_agent": "rule:admin_only", + + "create_dhcp-network": "rule:admin_only", + "delete_dhcp-network": "rule:admin_only", + "get_dhcp-networks": "rule:admin_only", + "create_l3-router": "rule:admin_only", + "delete_l3-router": "rule:admin_only", + "get_l3-routers": "rule:admin_only", + "get_dhcp-agents": "rule:admin_only", + "get_l3-agents": "rule:admin_only", + "get_loadbalancer-agent": "rule:admin_only", + "get_loadbalancer-pools": "rule:admin_only", + "get_agent-loadbalancers": "rule:admin_only", + "get_loadbalancer-hosting-agent": "rule:admin_only", + + "create_floatingip": "rule:regular_user", + "create_floatingip:floating_ip_address": "rule:admin_only", + "update_floatingip": "rule:admin_or_owner", + "delete_floatingip": "rule:admin_or_owner", + "get_floatingip": "rule:admin_or_owner", + + "create_network_profile": "rule:admin_only", + "update_network_profile": "rule:admin_only", + "delete_network_profile": "rule:admin_only", + "get_network_profiles": "", + "get_network_profile": "", + "update_policy_profiles": "rule:admin_only", + "get_policy_profiles": "", + "get_policy_profile": "", + + "create_metering_label": "rule:admin_only", + "delete_metering_label": "rule:admin_only", + "get_metering_label": "rule:admin_only", + + "create_metering_label_rule": "rule:admin_only", + "delete_metering_label_rule": "rule:admin_only", + "get_metering_label_rule": "rule:admin_only", + + "get_service_provider": "rule:regular_user", + "get_lsn": "rule:admin_only", + "create_lsn": "rule:admin_only", + + "create_flavor": "rule:admin_only", + "update_flavor": "rule:admin_only", + "delete_flavor": "rule:admin_only", + "get_flavors": "rule:regular_user", + "get_flavor": "rule:regular_user", + "create_service_profile": "rule:admin_only", + "update_service_profile": "rule:admin_only", + "delete_service_profile": "rule:admin_only", + "get_service_profiles": "rule:admin_only", + "get_service_profile": "rule:admin_only", + + "get_policy": "rule:regular_user", + "create_policy": "rule:admin_only", + "update_policy": "rule:admin_only", + "delete_policy": "rule:admin_only", + "get_policy_bandwidth_limit_rule": "rule:regular_user", + "create_policy_bandwidth_limit_rule": "rule:admin_only", + "delete_policy_bandwidth_limit_rule": "rule:admin_only", + "update_policy_bandwidth_limit_rule": "rule:admin_only", + "get_policy_dscp_marking_rule": "rule:regular_user", + "create_policy_dscp_marking_rule": "rule:admin_only", + "delete_policy_dscp_marking_rule": "rule:admin_only", + "update_policy_dscp_marking_rule": "rule:admin_only", + "get_rule_type": "rule:regular_user", + "get_policy_minimum_bandwidth_rule": "rule:regular_user", + "create_policy_minimum_bandwidth_rule": "rule:admin_only", + "delete_policy_minimum_bandwidth_rule": "rule:admin_only", + "update_policy_minimum_bandwidth_rule": "rule:admin_only", + + "restrict_wildcard": "(not field:rbac_policy:target_tenant=*) or rule:admin_only", + "create_rbac_policy": "", + "create_rbac_policy:target_tenant": "rule:restrict_wildcard", + "update_rbac_policy": "rule:admin_or_owner", + "update_rbac_policy:target_tenant": "rule:restrict_wildcard and rule:admin_or_owner", + "get_rbac_policy": "rule:admin_or_owner", + "delete_rbac_policy": "rule:admin_or_owner", + + "create_flavor_service_profile": "rule:admin_only", + "delete_flavor_service_profile": "rule:admin_only", + "get_flavor_service_profile": "rule:regular_user", + "get_auto_allocated_topology": "rule:admin_or_owner", + + "create_trunk": "rule:regular_user", + "get_trunk": "rule:admin_or_owner", + "delete_trunk": "rule:admin_or_owner", + "get_subports": "", + "add_subports": "rule:admin_or_owner", + "remove_subports": "rule:admin_or_owner", + + "get_security_groups": "rule:admin_or_owner", + "get_security_group": "rule:admin_or_owner", + "create_security_group": "rule:admin_or_owner", + "update_security_group": "rule:admin_or_owner", + "delete_security_group": "rule:admin_or_owner", + "get_security_group_rules": "rule:admin_or_owner", + "get_security_group_rule": "rule:admin_or_owner", + "create_security_group_rule": "rule:admin_or_owner", + "delete_security_group_rule": "rule:admin_or_owner", + + "get_loggable_resources": "rule:admin_only", + "create_log": "rule:admin_only", + "update_log": "rule:admin_only", + "delete_log": "rule:admin_only", + "get_logs": "rule:admin_only", + "get_log": "rule:admin_only" +} diff --git a/openstack/openstack_conf/controller/neutron/rootwrap.conf b/openstack/openstack_conf/controller/neutron/rootwrap.conf new file mode 100644 index 0000000..3a6b11f --- /dev/null +++ b/openstack/openstack_conf/controller/neutron/rootwrap.conf @@ -0,0 +1,34 @@ +# Configuration for neutron-rootwrap +# This file should be owned by (and only-writeable by) the root user + +[DEFAULT] +# List of directories to load filter definitions from (separated by ','). +# These directories MUST all be only writeable by root ! +filters_path=/etc/neutron/rootwrap.d,/usr/share/neutron/rootwrap + +# List of directories to search executables in, in case filters do not +# explicitely specify a full path (separated by ',') +# If not specified, defaults to system PATH environment variable. +# These directories MUST all be only writeable by root ! +exec_dirs=/sbin,/usr/sbin,/bin,/usr/bin,/usr/local/bin,/usr/local/sbin + +# Enable logging to syslog +# Default value is False +use_syslog=False + +# Which syslog facility to use. +# Valid values include auth, authpriv, syslog, local0, local1... +# Default value is 'syslog' +syslog_log_facility=syslog + +# Which messages to log. +# INFO means log all usage +# ERROR means only log unsuccessful attempts +syslog_log_level=ERROR + +[xenapi] +# XenAPI configuration is only required by the L2 agent if it is to +# target a XenServer/XCP compute host's dom0. +xenapi_connection_url= +xenapi_connection_username=root +xenapi_connection_password= diff --git a/openstack/openstack_conf/controller/neutron/rootwrap.d/debug.filters b/openstack/openstack_conf/controller/neutron/rootwrap.d/debug.filters new file mode 100644 index 0000000..8d72ce2 --- /dev/null +++ b/openstack/openstack_conf/controller/neutron/rootwrap.d/debug.filters @@ -0,0 +1,18 @@ +# neutron-rootwrap command filters for nodes on which neutron is +# expected to control network +# +# This file should be owned by (and only-writeable by) the root user + +# format seems to be +# cmd-name: filter-name, raw-command, user, args + +[Filters] + +# This is needed because we should ping +# from inside a namespace which requires root +# _alt variants allow to match -c and -w in any order +# (used by NeutronDebugAgent.ping_all) +ping: RegExpFilter, ping, root, ping, -w, \d+, -c, \d+, [0-9\.]+ +ping_alt: RegExpFilter, ping, root, ping, -c, \d+, -w, \d+, [0-9\.]+ +ping6: RegExpFilter, ping6, root, ping6, -w, \d+, -c, \d+, [0-9A-Fa-f:]+ +ping6_alt: RegExpFilter, ping6, root, ping6, -c, \d+, -w, \d+, [0-9A-Fa-f:]+ \ No newline at end of file diff --git a/openstack/openstack_conf/controller/neutron/rootwrap.d/dhcp.filters b/openstack/openstack_conf/controller/neutron/rootwrap.d/dhcp.filters new file mode 100644 index 0000000..d48d2ea --- /dev/null +++ b/openstack/openstack_conf/controller/neutron/rootwrap.d/dhcp.filters @@ -0,0 +1,39 @@ +# neutron-rootwrap command filters for nodes on which neutron is +# expected to control network +# +# This file should be owned by (and only-writeable by) the root user + +# format seems to be +# cmd-name: filter-name, raw-command, user, args + +[Filters] + +# dhcp-agent +dnsmasq: CommandFilter, dnsmasq, root +# dhcp-agent uses kill as well, that's handled by the generic KillFilter +# it looks like these are the only signals needed, per +# neutron/agent/linux/dhcp.py +kill_dnsmasq: KillFilter, root, /sbin/dnsmasq, -9, -HUP, -15 +kill_dnsmasq_usr: KillFilter, root, /usr/sbin/dnsmasq, -9, -HUP, -15 + +ovs-vsctl: CommandFilter, ovs-vsctl, root +ivs-ctl: CommandFilter, ivs-ctl, root +mm-ctl: CommandFilter, mm-ctl, root +dhcp_release: CommandFilter, dhcp_release, root +dhcp_release6: CommandFilter, dhcp_release6, root + +# haproxy +haproxy: RegExpFilter, haproxy, root, haproxy, -f, .* +kill_haproxy: KillFilter, root, haproxy, -15, -9, -HUP +# RHEL invocation of the metadata proxy will report /usr/bin/python +# TODO(dalvarez): Remove kill_metadata* filters in Q release since +# neutron-ns-metadata-proxy is now replaced by haproxy. We keep them for now +# for the migration process +kill_metadata: KillFilter, root, python, -9 +kill_metadata7: KillFilter, root, python2.7, -9 +kill_metadata35: KillFilter, root, python3.5, -9 + +# ip_lib +ip: IpFilter, ip, root +find: RegExpFilter, find, root, find, /sys/class/net, -maxdepth, 1, -type, l, -printf, %.* +ip_exec: IpNetnsExecFilter, ip, root diff --git a/openstack/openstack_conf/controller/neutron/rootwrap.d/dibbler.filters b/openstack/openstack_conf/controller/neutron/rootwrap.d/dibbler.filters new file mode 100644 index 0000000..7ba7015 --- /dev/null +++ b/openstack/openstack_conf/controller/neutron/rootwrap.d/dibbler.filters @@ -0,0 +1,17 @@ +# neutron-rootwrap command filters for nodes on which neutron is +# expected to control network +# +# This file should be owned by (and only-writeable by) the root user + +# format seems to be +# cmd-name: filter-name, raw-command, user, args + +[Filters] + +# Filters for the dibbler-based reference implementation of the pluggable +# Prefix Delegation driver. Other implementations using an alternative agent +# should include a similar filter in this folder. + +# prefix_delegation_agent +dibbler-client: CommandFilter, dibbler-client, root +kill_dibbler-client: KillFilter, root, dibbler-client, -9 diff --git a/openstack/openstack_conf/controller/neutron/rootwrap.d/ebtables.filters b/openstack/openstack_conf/controller/neutron/rootwrap.d/ebtables.filters new file mode 100644 index 0000000..8e810e7 --- /dev/null +++ b/openstack/openstack_conf/controller/neutron/rootwrap.d/ebtables.filters @@ -0,0 +1,11 @@ +# neutron-rootwrap command filters for nodes on which neutron is +# expected to control network +# +# This file should be owned by (and only-writeable by) the root user + +# format seems to be +# cmd-name: filter-name, raw-command, user, args + +[Filters] + +ebtables: CommandFilter, ebtables, root diff --git a/openstack/openstack_conf/controller/neutron/rootwrap.d/ipset-firewall.filters b/openstack/openstack_conf/controller/neutron/rootwrap.d/ipset-firewall.filters new file mode 100644 index 0000000..52c6637 --- /dev/null +++ b/openstack/openstack_conf/controller/neutron/rootwrap.d/ipset-firewall.filters @@ -0,0 +1,12 @@ +# neutron-rootwrap command filters for nodes on which neutron is +# expected to control network +# +# This file should be owned by (and only-writeable by) the root user + +# format seems to be +# cmd-name: filter-name, raw-command, user, args + +[Filters] +# neutron/agent/linux/iptables_firewall.py +# "ipset", "-A", ... +ipset: CommandFilter, ipset, root diff --git a/openstack/openstack_conf/controller/neutron/rootwrap.d/iptables-firewall.filters b/openstack/openstack_conf/controller/neutron/rootwrap.d/iptables-firewall.filters new file mode 100644 index 0000000..3960a78 --- /dev/null +++ b/openstack/openstack_conf/controller/neutron/rootwrap.d/iptables-firewall.filters @@ -0,0 +1,24 @@ +# neutron-rootwrap command filters for nodes on which neutron is +# expected to control network +# +# This file should be owned by (and only-writeable by) the root user + +# format seems to be +# cmd-name: filter-name, raw-command, user, args + +[Filters] + +# neutron/agent/linux/iptables_firewall.py +# "iptables-save", ... +iptables-save: CommandFilter, iptables-save, root +iptables-restore: CommandFilter, iptables-restore, root +ip6tables-save: CommandFilter, ip6tables-save, root +ip6tables-restore: CommandFilter, ip6tables-restore, root + +# neutron/agent/linux/iptables_firewall.py +# "iptables", "-A", ... +iptables: CommandFilter, iptables, root +ip6tables: CommandFilter, ip6tables, root + +# neutron/agent/linux/ip_conntrack.py +conntrack: CommandFilter, conntrack, root diff --git a/openstack/openstack_conf/controller/neutron/rootwrap.d/l3.filters b/openstack/openstack_conf/controller/neutron/rootwrap.d/l3.filters new file mode 100644 index 0000000..ea18b1c --- /dev/null +++ b/openstack/openstack_conf/controller/neutron/rootwrap.d/l3.filters @@ -0,0 +1,66 @@ +# neutron-rootwrap command filters for nodes on which neutron is +# expected to control network +# +# This file should be owned by (and only-writeable by) the root user + +# format seems to be +# cmd-name: filter-name, raw-command, user, args + +[Filters] + +# arping +arping: CommandFilter, arping, root + +# l3_agent +sysctl: CommandFilter, sysctl, root +route: CommandFilter, route, root +radvd: CommandFilter, radvd, root + +# haproxy +haproxy: RegExpFilter, haproxy, root, haproxy, -f, .* +kill_haproxy: KillFilter, root, haproxy, -15, -9, -HUP +# RHEL invocation of the metadata proxy will report /usr/bin/python +# TODO(dalvarez): Remove kill_metadata* filters in Q release since +# neutron-ns-metadata-proxy is now replaced by haproxy. We keep them for now +# for the migration process +kill_metadata: KillFilter, root, python, -15, -9 +kill_metadata7: KillFilter, root, python2.7, -15, -9 +kill_metadata35: KillFilter, root, python3.5, -15, -9 +kill_radvd_usr: KillFilter, root, /usr/sbin/radvd, -15, -9, -HUP +kill_radvd: KillFilter, root, /sbin/radvd, -15, -9, -HUP + +# ip_lib +ip: IpFilter, ip, root +find: RegExpFilter, find, root, find, /sys/class/net, -maxdepth, 1, -type, l, -printf, %.* +ip_exec: IpNetnsExecFilter, ip, root + +# l3_tc_lib +l3_tc_show_qdisc: RegExpFilter, tc, root, tc, qdisc, show, dev, .+ +l3_tc_add_qdisc_ingress: RegExpFilter, tc, root, tc, qdisc, add, dev, .+, ingress +l3_tc_add_qdisc_egress: RegExpFilter, tc, root, tc, qdisc, add, dev, .+, root, handle, 1:, htb +l3_tc_show_filters: RegExpFilter, tc, root, tc, -p, -s, -d, filter, show, dev, .+, parent, .+, prio, 1 +l3_tc_delete_filters: RegExpFilter, tc, root, tc, filter, del, dev, .+, parent, .+, prio, 1, handle, .+, u32 +l3_tc_add_filter_ingress: RegExpFilter, tc, root, tc, filter, add, dev, .+, parent, .+, protocol, ip, prio, 1, u32, match, ip, dst, .+, police, rate, .+, burst, .+, drop, flowid, :1 +l3_tc_add_filter_egress: RegExpFilter, tc, root, tc, filter, add, dev, .+, parent, .+, protocol, ip, prio, 1, u32, match, ip, src, .+, police, rate, .+, burst, .+, drop, flowid, :1 + +# For ip monitor +kill_ip_monitor: KillFilter, root, ip, -9 + +# ovs_lib (if OVSInterfaceDriver is used) +ovs-vsctl: CommandFilter, ovs-vsctl, root + +# iptables_manager +iptables-save: CommandFilter, iptables-save, root +iptables-restore: CommandFilter, iptables-restore, root +ip6tables-save: CommandFilter, ip6tables-save, root +ip6tables-restore: CommandFilter, ip6tables-restore, root + +# Keepalived +keepalived: CommandFilter, keepalived, root +kill_keepalived: KillFilter, root, /usr/sbin/keepalived, -HUP, -15, -9 + +# l3 agent to delete floatingip's conntrack state +conntrack: CommandFilter, conntrack, root + +# keepalived state change monitor +keepalived_state_change: CommandFilter, neutron-keepalived-state-change, root diff --git a/openstack/openstack_conf/controller/neutron/rootwrap.d/linuxbridge-plugin.filters b/openstack/openstack_conf/controller/neutron/rootwrap.d/linuxbridge-plugin.filters new file mode 100644 index 0000000..298b807 --- /dev/null +++ b/openstack/openstack_conf/controller/neutron/rootwrap.d/linuxbridge-plugin.filters @@ -0,0 +1,29 @@ +# neutron-rootwrap command filters for nodes on which neutron is +# expected to control network +# +# This file should be owned by (and only-writeable by) the root user + +# format seems to be +# cmd-name: filter-name, raw-command, user, args + +[Filters] + +# linuxbridge-agent +# unclear whether both variants are necessary, but I'm transliterating +# from the old mechanism +brctl: CommandFilter, brctl, root +bridge: CommandFilter, bridge, root +sysctl: CommandFilter, sysctl, root + +# ip_lib +ip: IpFilter, ip, root +find: RegExpFilter, find, root, find, /sys/class/net, -maxdepth, 1, -type, l, -printf, %.* +ip_exec: IpNetnsExecFilter, ip, root + +# tc commands needed for QoS support +tc_replace_tbf: RegExpFilter, tc, root, tc, qdisc, replace, dev, .+, root, tbf, rate, .+, latency, .+, burst, .+ +tc_add_ingress: RegExpFilter, tc, root, tc, qdisc, add, dev, .+, ingress, handle, .+ +tc_delete: RegExpFilter, tc, root, tc, qdisc, del, dev, .+, .+ +tc_show_qdisc: RegExpFilter, tc, root, tc, qdisc, show, dev, .+ +tc_show_filters: RegExpFilter, tc, root, tc, filter, show, dev, .+, parent, .+ +tc_add_filter: RegExpFilter, tc, root, tc, filter, add, dev, .+, parent, .+, protocol, all, prio, .+, basic, police, rate, .+, burst, .+, mtu, .+, drop diff --git a/openstack/openstack_conf/controller/nova/api-paste.ini b/openstack/openstack_conf/controller/nova/api-paste.ini new file mode 100755 index 0000000..8bde418 --- /dev/null +++ b/openstack/openstack_conf/controller/nova/api-paste.ini @@ -0,0 +1,84 @@ +############ +# Metadata # +############ +[composite:metadata] +use = egg:Paste#urlmap +/: meta + +[pipeline:meta] +pipeline = cors metaapp + +[app:metaapp] +paste.app_factory = nova.api.metadata.handler:MetadataRequestHandler.factory + +############# +# OpenStack # +############# + +[composite:osapi_compute] +use = call:nova.api.openstack.urlmap:urlmap_factory +/: oscomputeversions +# v21 is an exactly feature match for v2, except it has more stringent +# input validation on the wsgi surface (prevents fuzzing early on the +# API). It also provides new features via API microversions which are +# opt into for clients. Unaware clients will receive the same frozen +# v2 API feature set, but with some relaxed validation +/v2: openstack_compute_api_v21_legacy_v2_compatible +/v2.1: openstack_compute_api_v21 + +[composite:openstack_compute_api_v21] +use = call:nova.api.auth:pipeline_factory_v21 +noauth2 = cors http_proxy_to_wsgi compute_req_id faultwrap request_log sizelimit osprofiler noauth2 osapi_compute_app_v21 +keystone = cors http_proxy_to_wsgi compute_req_id faultwrap request_log sizelimit osprofiler authtoken keystonecontext osapi_compute_app_v21 + +[composite:openstack_compute_api_v21_legacy_v2_compatible] +use = call:nova.api.auth:pipeline_factory_v21 +noauth2 = cors http_proxy_to_wsgi compute_req_id faultwrap request_log sizelimit osprofiler noauth2 legacy_v2_compatible osapi_compute_app_v21 +keystone = cors http_proxy_to_wsgi compute_req_id faultwrap request_log sizelimit osprofiler authtoken keystonecontext legacy_v2_compatible osapi_compute_app_v21 + +[filter:request_log] +paste.filter_factory = nova.api.openstack.requestlog:RequestLog.factory + +[filter:compute_req_id] +paste.filter_factory = nova.api.compute_req_id:ComputeReqIdMiddleware.factory + +[filter:faultwrap] +paste.filter_factory = nova.api.openstack:FaultWrapper.factory + +[filter:noauth2] +paste.filter_factory = nova.api.openstack.auth:NoAuthMiddleware.factory + +[filter:osprofiler] +paste.filter_factory = nova.profiler:WsgiMiddleware.factory + +[filter:sizelimit] +paste.filter_factory = oslo_middleware:RequestBodySizeLimiter.factory + +[filter:http_proxy_to_wsgi] +paste.filter_factory = oslo_middleware.http_proxy_to_wsgi:HTTPProxyToWSGI.factory + +[filter:legacy_v2_compatible] +paste.filter_factory = nova.api.openstack:LegacyV2CompatibleWrapper.factory + +[app:osapi_compute_app_v21] +paste.app_factory = nova.api.openstack.compute:APIRouterV21.factory + +[pipeline:oscomputeversions] +pipeline = cors faultwrap request_log http_proxy_to_wsgi oscomputeversionapp + +[app:oscomputeversionapp] +paste.app_factory = nova.api.openstack.compute.versions:Versions.factory + +########## +# Shared # +########## + +[filter:cors] +paste.filter_factory = oslo_middleware.cors:filter_factory +oslo_config_project = nova + +[filter:keystonecontext] +paste.filter_factory = nova.api.auth:NovaKeystoneContext.factory + +[filter:authtoken] +paste.filter_factory = keystonemiddleware.auth_token:filter_factory diff --git a/openstack/openstack_conf/controller/nova/logging.conf b/openstack/openstack_conf/controller/nova/logging.conf new file mode 100644 index 0000000..6841819 --- /dev/null +++ b/openstack/openstack_conf/controller/nova/logging.conf @@ -0,0 +1,84 @@ +[loggers] +keys = root, nova + +[handlers] +keys = stderr, stdout, watchedfile, syslog, null + +[formatters] +keys = context, default + +[logger_root] +level = WARNING +handlers = null + +[logger_nova] +level = INFO +handlers = stderr +qualname = nova + +[logger_amqp] +level = WARNING +handlers = stderr +qualname = amqp + +[logger_amqplib] +level = WARNING +handlers = stderr +qualname = amqplib + +[logger_sqlalchemy] +level = WARNING +handlers = stderr +qualname = sqlalchemy +# "level = INFO" logs SQL queries. +# "level = DEBUG" logs SQL queries and results. +# "level = WARNING" logs neither. (Recommended for production systems.) + +[logger_boto] +level = WARNING +handlers = stderr +qualname = boto + +# NOTE(mikal): suds is used by the vmware driver, removing this will +# cause many extraneous log lines for their tempest runs. Refer to +# https://review.openstack.org/#/c/219225/ for details. +[logger_suds] +level = INFO +handlers = stderr +qualname = suds + +[logger_eventletwsgi] +level = WARNING +handlers = stderr +qualname = eventlet.wsgi.server + +[handler_stderr] +class = StreamHandler +args = (sys.stderr,) +formatter = context + +[handler_stdout] +class = StreamHandler +args = (sys.stdout,) +formatter = context + +[handler_watchedfile] +class = handlers.WatchedFileHandler +args = ('nova.log',) +formatter = context + +[handler_syslog] +class = handlers.SysLogHandler +args = ('/dev/log', handlers.SysLogHandler.LOG_USER) +formatter = context + +[handler_null] +class = logging.NullHandler +formatter = default +args = () + +[formatter_context] +class = oslo_log.formatters.ContextFormatter + +[formatter_default] +format = %(message)s diff --git a/openstack/openstack_conf/controller/nova/nova.conf b/openstack/openstack_conf/controller/nova/nova.conf new file mode 100755 index 0000000..172bf73 --- /dev/null +++ b/openstack/openstack_conf/controller/nova/nova.conf @@ -0,0 +1,11229 @@ +[DEFAULT] +firewall_driver = nova.virt.firewall.NoopFirewallDriver +use_neutron = True +my_ip = 10.0.0.11 +transport_url = rabbit://openstack:rabbitPass@controller +lock_path = /var/lock/nova +state_path = /var/lib/nova + +# +# From nova.conf +# + +# +# Availability zone for internal services. +# +# This option determines the availability zone for the various internal nova +# services, such as 'nova-scheduler', 'nova-conductor', etc. +# +# Possible values: +# +# * Any string representing an existing availability zone name. +# (string value) +#internal_service_availability_zone = internal + +# +# Default availability zone for compute services. +# +# This option determines the default availability zone for 'nova-compute' +# services, which will be used if the service(s) do not belong to aggregates +# with +# availability zone metadata. +# +# Possible values: +# +# * Any string representing an existing availability zone name. +# (string value) +#default_availability_zone = nova + +# +# Default availability zone for instances. +# +# This option determines the default availability zone for instances, which will +# be used when a user does not specify one when creating an instance. The +# instance(s) will be bound to this availability zone for their lifetime. +# +# Possible values: +# +# * Any string representing an existing availability zone name. +# * None, which means that the instance can move from one availability zone to +# another during its lifetime if it is moved from one compute node to another. +# (string value) +#default_schedule_zone = + +# Length of generated instance admin passwords. (integer value) +# Minimum value: 0 +#password_length = 12 + +# +# Time period to generate instance usages for. It is possible to define optional +# offset to given period by appending @ character followed by a number defining +# offset. +# +# Possible values: +# +# * period, example: ``hour``, ``day``, ``month` or ``year`` +# * period with offset, example: ``month@15`` will result in monthly audits +# starting on 15th day of month. +# (string value) +#instance_usage_audit_period = month + +# +# Start and use a daemon that can run the commands that need to be run with +# root privileges. This option is usually enabled on nodes that run nova compute +# processes. +# (boolean value) +#use_rootwrap_daemon = false + +# +# Path to the rootwrap configuration file. +# +# Goal of the root wrapper is to allow a service-specific unprivileged user to +# run a number of actions as the root user in the safest manner possible. +# The configuration file used here must match the one defined in the sudoers +# entry. +# (string value) +#rootwrap_config = /etc/nova/rootwrap.conf + +# Explicitly specify the temporary working directory. (string value) +#tempdir = + +# DEPRECATED: +# Determine if monkey patching should be applied. +# +# Related options: +# +# * ``monkey_patch_modules``: This must have values set for this option to +# have any effect +# (boolean value) +# This option is deprecated for removal since 17.0.0. +# Its value may be silently ignored in the future. +# Reason: +# Monkey patching nova is not tested, not supported, and is a barrier +# for interoperability. +#monkey_patch = false + +# DEPRECATED: +# List of modules/decorators to monkey patch. +# +# This option allows you to patch a decorator for all functions in specified +# modules. +# +# Possible values: +# +# * nova.compute.api:nova.notifications.notify_decorator +# * [...] +# +# Related options: +# +# * ``monkey_patch``: This must be set to ``True`` for this option to +# have any effect +# (list value) +# This option is deprecated for removal since 17.0.0. +# Its value may be silently ignored in the future. +# Reason: +# Monkey patching nova is not tested, not supported, and is a barrier +# for interoperability. +#monkey_patch_modules = nova.compute.api:nova.notifications.notify_decorator + +# +# Defines which driver to use for controlling virtualization. +# +# Possible values: +# +# * ``libvirt.LibvirtDriver`` +# * ``xenapi.XenAPIDriver`` +# * ``fake.FakeDriver`` +# * ``ironic.IronicDriver`` +# * ``vmwareapi.VMwareVCDriver`` +# * ``hyperv.HyperVDriver`` +# * ``powervm.PowerVMDriver`` +# (string value) +#compute_driver = + +# +# Allow destination machine to match source for resize. Useful when +# testing in single-host environments. By default it is not allowed +# to resize to the same host. Setting this option to true will add +# the same host to the destination options. Also set to true +# if you allow the ServerGroupAffinityFilter and need to resize. +# (boolean value) +#allow_resize_to_same_host = false + +# +# Image properties that should not be inherited from the instance +# when taking a snapshot. +# +# This option gives an opportunity to select which image-properties +# should not be inherited by newly created snapshots. +# +# Possible values: +# +# * A comma-separated list whose item is an image property. Usually only +# the image properties that are only needed by base images can be included +# here, since the snapshots that are created from the base images don't +# need them. +# * Default list: cache_in_nova, bittorrent, img_signature_hash_method, +# img_signature, img_signature_key_type, +# img_signature_certificate_uuid +# +# (list value) +#non_inheritable_image_properties = cache_in_nova,bittorrent,img_signature_hash_method,img_signature,img_signature_key_type,img_signature_certificate_uuid + +# DEPRECATED: +# When creating multiple instances with a single request using the +# os-multiple-create API extension, this template will be used to build +# the display name for each instance. The benefit is that the instances +# end up with different hostnames. Example display names when creating +# two VM's: name-1, name-2. +# +# Possible values: +# +# * Valid keys for the template are: name, uuid, count. +# (string value) +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# This config changes API behaviour. All changes in API behaviour should be +# discoverable. +#multi_instance_display_name_template = %(name)s-%(count)d + +# +# Maximum number of devices that will result in a local image being +# created on the hypervisor node. +# +# A negative number means unlimited. Setting max_local_block_devices +# to 0 means that any request that attempts to create a local disk +# will fail. This option is meant to limit the number of local discs +# (so root local disc that is the result of --image being used, and +# any other ephemeral and swap disks). 0 does not mean that images +# will be automatically converted to volumes and boot instances from +# volumes - it just means that all requests that attempt to create a +# local disk will fail. +# +# Possible values: +# +# * 0: Creating a local disk is not allowed. +# * Negative number: Allows unlimited number of local discs. +# * Positive number: Allows only these many number of local discs. +# (Default value is 3). +# (integer value) +#max_local_block_devices = 3 + +# +# A comma-separated list of monitors that can be used for getting +# compute metrics. You can use the alias/name from the setuptools +# entry points for nova.compute.monitors.* namespaces. If no +# namespace is supplied, the "cpu." namespace is assumed for +# backwards-compatibility. +# +# NOTE: Only one monitor per namespace (For example: cpu) can be loaded at +# a time. +# +# Possible values: +# +# * An empty list will disable the feature (Default). +# * An example value that would enable both the CPU and NUMA memory +# bandwidth monitors that use the virt driver variant: +# +# compute_monitors = cpu.virt_driver, numa_mem_bw.virt_driver +# (list value) +#compute_monitors = + +# +# The default format an ephemeral_volume will be formatted with on creation. +# +# Possible values: +# +# * ``ext2`` +# * ``ext3`` +# * ``ext4`` +# * ``xfs`` +# * ``ntfs`` (only for Windows guests) +# (string value) +#default_ephemeral_format = + +# +# Determine if instance should boot or fail on VIF plugging timeout. +# +# Nova sends a port update to Neutron after an instance has been scheduled, +# providing Neutron with the necessary information to finish setup of the port. +# Once completed, Neutron notifies Nova that it has finished setting up the +# port, at which point Nova resumes the boot of the instance since network +# connectivity is now supposed to be present. A timeout will occur if the reply +# is not received after a given interval. +# +# This option determines what Nova does when the VIF plugging timeout event +# happens. When enabled, the instance will error out. When disabled, the +# instance will continue to boot on the assumption that the port is ready. +# +# Possible values: +# +# * True: Instances should fail after VIF plugging timeout +# * False: Instances should continue booting after VIF plugging timeout +# (boolean value) +#vif_plugging_is_fatal = true + +# +# Timeout for Neutron VIF plugging event message arrival. +# +# Number of seconds to wait for Neutron vif plugging events to +# arrive before continuing or failing (see 'vif_plugging_is_fatal'). +# +# Related options: +# +# * vif_plugging_is_fatal - If ``vif_plugging_timeout`` is set to zero and +# ``vif_plugging_is_fatal`` is False, events should not be expected to +# arrive at all. +# (integer value) +# Minimum value: 0 +#vif_plugging_timeout = 300 + +# Path to '/etc/network/interfaces' template. +# +# The path to a template file for the '/etc/network/interfaces'-style file, +# which +# will be populated by nova and subsequently used by cloudinit. This provides a +# method to configure network connectivity in environments without a DHCP +# server. +# +# The template will be rendered using Jinja2 template engine, and receive a +# top-level key called ``interfaces``. This key will contain a list of +# dictionaries, one for each interface. +# +# Refer to the cloudinit documentaion for more information: +# +# https://cloudinit.readthedocs.io/en/latest/topics/datasources.html +# +# Possible values: +# +# * A path to a Jinja2-formatted template for a Debian '/etc/network/interfaces' +# file. This applies even if using a non Debian-derived guest. +# +# Related options: +# +# * ``flat_inject``: This must be set to ``True`` to ensure nova embeds network +# configuration information in the metadata provided through the config drive. +# (string value) +#injected_network_template = $pybasedir/nova/virt/interfaces.template + +# +# The image preallocation mode to use. +# +# Image preallocation allows storage for instance images to be allocated up +# front +# when the instance is initially provisioned. This ensures immediate feedback is +# given if enough space isn't available. In addition, it should significantly +# improve performance on writes to new blocks and may even improve I/O +# performance to prewritten blocks due to reduced fragmentation. +# +# Possible values: +# +# * "none" => no storage provisioning is done up front +# * "space" => storage is fully allocated at instance start +# (string value) +# Possible values: +# none - +# space - +#preallocate_images = none + +# +# Enable use of copy-on-write (cow) images. +# +# QEMU/KVM allow the use of qcow2 as backing files. By disabling this, +# backing files will not be used. +# (boolean value) +#use_cow_images = true + +# +# Force conversion of backing images to raw format. +# +# Possible values: +# +# * True: Backing image files will be converted to raw image format +# * False: Backing image files will not be converted +# +# Related options: +# +# * ``compute_driver``: Only the libvirt driver uses this option. +# (boolean value) +#force_raw_images = true + +# +# Name of the mkfs commands for ephemeral device. +# +# The format is = +# (multi valued) +#virt_mkfs = + +# +# Enable resizing of filesystems via a block device. +# +# If enabled, attempt to resize the filesystem by accessing the image over a +# block device. This is done by the host and may not be necessary if the image +# contains a recent version of cloud-init. Possible mechanisms require the nbd +# driver (for qcow and raw), or loop (for raw). +# (boolean value) +#resize_fs_using_block_device = false + +# Amount of time, in seconds, to wait for NBD device start up. (integer value) +# Minimum value: 0 +#timeout_nbd = 10 + +# +# Location of cached images. +# +# This is NOT the full path - just a folder name relative to '$instances_path'. +# For per-compute-host cached images, set to '_base_$my_ip' +# (string value) +#image_cache_subdirectory_name = _base + +# Should unused base images be removed? (boolean value) +#remove_unused_base_images = true + +# +# Unused unresized base images younger than this will not be removed. +# (integer value) +#remove_unused_original_minimum_age_seconds = 86400 + +# +# Generic property to specify the pointer type. +# +# Input devices allow interaction with a graphical framebuffer. For +# example to provide a graphic tablet for absolute cursor movement. +# +# If set, the 'hw_pointer_model' image property takes precedence over +# this configuration option. +# +# Possible values: +# +# * None: Uses default behavior provided by drivers (mouse on PS2 for +# libvirt x86) +# * ps2mouse: Uses relative movement. Mouse connected by PS2 +# * usbtablet: Uses absolute movement. Tablet connect by USB +# +# Related options: +# +# * usbtablet must be configured with VNC enabled or SPICE enabled and SPICE +# agent disabled. When used with libvirt the instance mode should be +# configured as HVM. +# (string value) +# Possible values: +# - +# ps2mouse - +# usbtablet - +#pointer_model = usbtablet + +# +# Defines which physical CPUs (pCPUs) can be used by instance +# virtual CPUs (vCPUs). +# +# Possible values: +# +# * A comma-separated list of physical CPU numbers that virtual CPUs can be +# allocated to by default. Each element should be either a single CPU number, +# a range of CPU numbers, or a caret followed by a CPU number to be +# excluded from a previous range. For example: +# +# vcpu_pin_set = "4-12,^8,15" +# (string value) +#vcpu_pin_set = + +# +# Number of huge/large memory pages to reserved per NUMA host cell. +# +# Possible values: +# +# * A list of valid key=value which reflect NUMA node ID, page size +# (Default unit is KiB) and number of pages to be reserved. +# +# reserved_huge_pages = node:0,size:2048,count:64 +# reserved_huge_pages = node:1,size:1GB,count:1 +# +# In this example we are reserving on NUMA node 0 64 pages of 2MiB +# and on NUMA node 1 1 page of 1GiB. +# (dict value) +#reserved_huge_pages = + +# +# Amount of disk resources in MB to make them always available to host. The +# disk usage gets reported back to the scheduler from nova-compute running +# on the compute nodes. To prevent the disk resources from being considered +# as available, this option can be used to reserve disk space for that host. +# +# Possible values: +# +# * Any positive integer representing amount of disk in MB to reserve +# for the host. +# (integer value) +# Minimum value: 0 +#reserved_host_disk_mb = 0 + +# +# Amount of memory in MB to reserve for the host so that it is always available +# to host processes. The host resources usage is reported back to the scheduler +# continuously from nova-compute running on the compute node. To prevent the +# host +# memory from being considered as available, this option is used to reserve +# memory for the host. +# +# Possible values: +# +# * Any positive integer representing amount of memory in MB to reserve +# for the host. +# (integer value) +# Minimum value: 0 +#reserved_host_memory_mb = 512 + +# +# Number of physical CPUs to reserve for the host. The host resources usage is +# reported back to the scheduler continuously from nova-compute running on the +# compute node. To prevent the host CPU from being considered as available, +# this option is used to reserve random pCPU(s) for the host. +# +# Possible values: +# +# * Any positive integer representing number of physical CPUs to reserve +# for the host. +# (integer value) +# Minimum value: 0 +#reserved_host_cpus = 0 + +# +# This option helps you specify virtual CPU to physical CPU allocation ratio. +# +# From Ocata (15.0.0) this is used to influence the hosts selected by +# the Placement API. Note that when Placement is used, the CoreFilter +# is redundant, because the Placement API will have already filtered +# out hosts that would have failed the CoreFilter. +# +# This configuration specifies ratio for CoreFilter which can be set +# per compute node. For AggregateCoreFilter, it will fall back to this +# configuration value if no per-aggregate setting is found. +# +# NOTE: This can be set per-compute, or if set to 0.0, the value +# set on the scheduler node(s) or compute node(s) will be used +# and defaulted to 16.0. +# +# NOTE: As of the 16.0.0 Pike release, this configuration option is ignored +# for the ironic.IronicDriver compute driver and is hardcoded to 1.0. +# +# Possible values: +# +# * Any valid positive integer or float value +# (floating point value) +# Minimum value: 0 +#cpu_allocation_ratio = 0.0 + +# +# This option helps you specify virtual RAM to physical RAM +# allocation ratio. +# +# From Ocata (15.0.0) this is used to influence the hosts selected by +# the Placement API. Note that when Placement is used, the RamFilter +# is redundant, because the Placement API will have already filtered +# out hosts that would have failed the RamFilter. +# +# This configuration specifies ratio for RamFilter which can be set +# per compute node. For AggregateRamFilter, it will fall back to this +# configuration value if no per-aggregate setting found. +# +# NOTE: This can be set per-compute, or if set to 0.0, the value +# set on the scheduler node(s) or compute node(s) will be used and +# defaulted to 1.5. +# +# NOTE: As of the 16.0.0 Pike release, this configuration option is ignored +# for the ironic.IronicDriver compute driver and is hardcoded to 1.0. +# +# Possible values: +# +# * Any valid positive integer or float value +# (floating point value) +# Minimum value: 0 +#ram_allocation_ratio = 0.0 + +# +# This option helps you specify virtual disk to physical disk +# allocation ratio. +# +# From Ocata (15.0.0) this is used to influence the hosts selected by +# the Placement API. Note that when Placement is used, the DiskFilter +# is redundant, because the Placement API will have already filtered +# out hosts that would have failed the DiskFilter. +# +# A ratio greater than 1.0 will result in over-subscription of the +# available physical disk, which can be useful for more +# efficiently packing instances created with images that do not +# use the entire virtual disk, such as sparse or compressed +# images. It can be set to a value between 0.0 and 1.0 in order +# to preserve a percentage of the disk for uses other than +# instances. +# +# NOTE: This can be set per-compute, or if set to 0.0, the value +# set on the scheduler node(s) or compute node(s) will be used and +# defaulted to 1.0. +# +# NOTE: As of the 16.0.0 Pike release, this configuration option is ignored +# for the ironic.IronicDriver compute driver and is hardcoded to 1.0. +# +# Possible values: +# +# * Any valid positive integer or float value +# (floating point value) +# Minimum value: 0 +#disk_allocation_ratio = 0.0 + +# +# Console proxy host to be used to connect to instances on this host. It is the +# publicly visible name for the console host. +# +# Possible values: +# +# * Current hostname (default) or any string representing hostname. +# (string value) +#console_host = + +# +# Name of the network to be used to set access IPs for instances. If there are +# multiple IPs to choose from, an arbitrary one will be chosen. +# +# Possible values: +# +# * None (default) +# * Any string representing network name. +# (string value) +#default_access_ip_network_name = + +# +# Whether to batch up the application of IPTables rules during a host restart +# and apply all at the end of the init phase. +# (boolean value) +#defer_iptables_apply = false + +# +# Specifies where instances are stored on the hypervisor's disk. +# It can point to locally attached storage or a directory on NFS. +# +# Possible values: +# +# * $state_path/instances where state_path is a config option that specifies +# the top-level directory for maintaining nova's state. (default) or +# Any string representing directory path. +# (string value) +#instances_path = $state_path/instances + +# +# This option enables periodic compute.instance.exists notifications. Each +# compute node must be configured to generate system usage data. These +# notifications are consumed by OpenStack Telemetry service. +# (boolean value) +#instance_usage_audit = false + +# +# Maximum number of 1 second retries in live_migration. It specifies number +# of retries to iptables when it complains. It happens when an user continuously +# sends live-migration request to same host leading to concurrent request +# to iptables. +# +# Possible values: +# +# * Any positive integer representing retry count. +# (integer value) +# Minimum value: 0 +#live_migration_retry_count = 30 + +# +# This option specifies whether to start guests that were running before the +# host rebooted. It ensures that all of the instances on a Nova compute node +# resume their state each time the compute node boots or restarts. +# (boolean value) +#resume_guests_state_on_host_boot = false + +# +# Number of times to retry network allocation. It is required to attempt network +# allocation retries if the virtual interface plug fails. +# +# Possible values: +# +# * Any positive integer representing retry count. +# (integer value) +# Minimum value: 0 +#network_allocate_retries = 0 + +# +# Limits the maximum number of instance builds to run concurrently by +# nova-compute. Compute service can attempt to build an infinite number of +# instances, if asked to do so. This limit is enforced to avoid building +# unlimited instance concurrently on a compute node. This value can be set +# per compute node. +# +# Possible Values: +# +# * 0 : treated as unlimited. +# * Any positive integer representing maximum concurrent builds. +# (integer value) +# Minimum value: 0 +#max_concurrent_builds = 10 + +# +# Maximum number of live migrations to run concurrently. This limit is enforced +# to avoid outbound live migrations overwhelming the host/network and causing +# failures. It is not recommended that you change this unless you are very sure +# that doing so is safe and stable in your environment. +# +# Possible values: +# +# * 0 : treated as unlimited. +# * Negative value defaults to 0. +# * Any positive integer representing maximum number of live migrations +# to run concurrently. +# (integer value) +#max_concurrent_live_migrations = 1 + +# +# Number of times to retry block device allocation on failures. Starting with +# Liberty, Cinder can use image volume cache. This may help with block device +# allocation performance. Look at the cinder image_volume_cache_enabled +# configuration option. +# +# Possible values: +# +# * 60 (default) +# * If value is 0, then one attempt is made. +# * Any negative value is treated as 0. +# * For any value > 0, total attempts are (value + 1) +# (integer value) +#block_device_allocate_retries = 60 + +# +# Number of greenthreads available for use to sync power states. +# +# This option can be used to reduce the number of concurrent requests +# made to the hypervisor or system with real instance power states +# for performance reasons, for example, with Ironic. +# +# Possible values: +# +# * Any positive integer representing greenthreads count. +# (integer value) +#sync_power_state_pool_size = 1000 + +# +# Number of seconds to wait between runs of the image cache manager. +# +# Possible values: +# * 0: run at the default rate. +# * -1: disable +# * Any other value +# (integer value) +# Minimum value: -1 +#image_cache_manager_interval = 2400 + +# +# Interval to pull network bandwidth usage info. +# +# Not supported on all hypervisors. If a hypervisor doesn't support bandwidth +# usage, it will not get the info in the usage events. +# +# Possible values: +# +# * 0: Will run at the default periodic interval. +# * Any value < 0: Disables the option. +# * Any positive integer in seconds. +# (integer value) +#bandwidth_poll_interval = 600 + +# +# Interval to sync power states between the database and the hypervisor. +# +# The interval that Nova checks the actual virtual machine power state +# and the power state that Nova has in its database. If a user powers +# down their VM, Nova updates the API to report the VM has been +# powered down. Should something turn on the VM unexpectedly, +# Nova will turn the VM back off to keep the system in the expected +# state. +# +# Possible values: +# +# * 0: Will run at the default periodic interval. +# * Any value < 0: Disables the option. +# * Any positive integer in seconds. +# +# Related options: +# +# * If ``handle_virt_lifecycle_events`` in workarounds_group is +# false and this option is negative, then instances that get out +# of sync between the hypervisor and the Nova database will have +# to be synchronized manually. +# (integer value) +#sync_power_state_interval = 600 + +# +# Interval between instance network information cache updates. +# +# Number of seconds after which each compute node runs the task of +# querying Neutron for all of its instances networking information, +# then updates the Nova db with that information. Nova will never +# update it's cache if this option is set to 0. If we don't update the +# cache, the metadata service and nova-api endpoints will be proxying +# incorrect network data about the instance. So, it is not recommended +# to set this option to 0. +# +# Possible values: +# +# * Any positive integer in seconds. +# * Any value <=0 will disable the sync. This is not recommended. +# (integer value) +#heal_instance_info_cache_interval = 60 + +# +# Interval for reclaiming deleted instances. +# +# A value greater than 0 will enable SOFT_DELETE of instances. +# This option decides whether the server to be deleted will be put into +# the SOFT_DELETED state. If this value is greater than 0, the deleted +# server will not be deleted immediately, instead it will be put into +# a queue until it's too old (deleted time greater than the value of +# reclaim_instance_interval). The server can be recovered from the +# delete queue by using the restore action. If the deleted server remains +# longer than the value of reclaim_instance_interval, it will be +# deleted by a periodic task in the compute service automatically. +# +# Note that this option is read from both the API and compute nodes, and +# must be set globally otherwise servers could be put into a soft deleted +# state in the API and never actually reclaimed (deleted) on the compute +# node. +# +# Possible values: +# +# * Any positive integer(in seconds) greater than 0 will enable +# this option. +# * Any value <=0 will disable the option. +# (integer value) +#reclaim_instance_interval = 0 + +# +# Interval for gathering volume usages. +# +# This option updates the volume usage cache for every +# volume_usage_poll_interval number of seconds. +# +# Possible values: +# +# * Any positive integer(in seconds) greater than 0 will enable +# this option. +# * Any value <=0 will disable the option. +# (integer value) +#volume_usage_poll_interval = 0 + +# +# Interval for polling shelved instances to offload. +# +# The periodic task runs for every shelved_poll_interval number +# of seconds and checks if there are any shelved instances. If it +# finds a shelved instance, based on the 'shelved_offload_time' config +# value it offloads the shelved instances. Check 'shelved_offload_time' +# config option description for details. +# +# Possible values: +# +# * Any value <= 0: Disables the option. +# * Any positive integer in seconds. +# +# Related options: +# +# * ``shelved_offload_time`` +# (integer value) +#shelved_poll_interval = 3600 + +# +# Time before a shelved instance is eligible for removal from a host. +# +# By default this option is set to 0 and the shelved instance will be +# removed from the hypervisor immediately after shelve operation. +# Otherwise, the instance will be kept for the value of +# shelved_offload_time(in seconds) so that during the time period the +# unshelve action will be faster, then the periodic task will remove +# the instance from hypervisor after shelved_offload_time passes. +# +# Possible values: +# +# * 0: Instance will be immediately offloaded after being +# shelved. +# * Any value < 0: An instance will never offload. +# * Any positive integer in seconds: The instance will exist for +# the specified number of seconds before being offloaded. +# (integer value) +#shelved_offload_time = 0 + +# +# Interval for retrying failed instance file deletes. +# +# This option depends on 'maximum_instance_delete_attempts'. +# This option specifies how often to retry deletes whereas +# 'maximum_instance_delete_attempts' specifies the maximum number +# of retry attempts that can be made. +# +# Possible values: +# +# * 0: Will run at the default periodic interval. +# * Any value < 0: Disables the option. +# * Any positive integer in seconds. +# +# Related options: +# +# * ``maximum_instance_delete_attempts`` from instance_cleaning_opts +# group. +# (integer value) +#instance_delete_interval = 300 + +# +# Interval (in seconds) between block device allocation retries on failures. +# +# This option allows the user to specify the time interval between +# consecutive retries. 'block_device_allocate_retries' option specifies +# the maximum number of retries. +# +# Possible values: +# +# * 0: Disables the option. +# * Any positive integer in seconds enables the option. +# +# Related options: +# +# * ``block_device_allocate_retries`` in compute_manager_opts group. +# (integer value) +# Minimum value: 0 +#block_device_allocate_retries_interval = 3 + +# +# Interval between sending the scheduler a list of current instance UUIDs to +# verify that its view of instances is in sync with nova. +# +# If the CONF option 'scheduler_tracks_instance_changes' is +# False, the sync calls will not be made. So, changing this option will +# have no effect. +# +# If the out of sync situations are not very common, this interval +# can be increased to lower the number of RPC messages being sent. +# Likewise, if sync issues turn out to be a problem, the interval +# can be lowered to check more frequently. +# +# Possible values: +# +# * 0: Will run at the default periodic interval. +# * Any value < 0: Disables the option. +# * Any positive integer in seconds. +# +# Related options: +# +# * This option has no impact if ``scheduler_tracks_instance_changes`` +# is set to False. +# (integer value) +#scheduler_instance_sync_interval = 120 + +# +# Interval for updating compute resources. +# +# This option specifies how often the update_available_resources +# periodic task should run. A number less than 0 means to disable the +# task completely. Leaving this at the default of 0 will cause this to +# run at the default periodic interval. Setting it to any positive +# value will cause it to run at approximately that number of seconds. +# +# Possible values: +# +# * 0: Will run at the default periodic interval. +# * Any value < 0: Disables the option. +# * Any positive integer in seconds. +# (integer value) +#update_resources_interval = 0 + +# +# Time interval after which an instance is hard rebooted automatically. +# +# When doing a soft reboot, it is possible that a guest kernel is +# completely hung in a way that causes the soft reboot task +# to not ever finish. Setting this option to a time period in seconds +# will automatically hard reboot an instance if it has been stuck +# in a rebooting state longer than N seconds. +# +# Possible values: +# +# * 0: Disables the option (default). +# * Any positive integer in seconds: Enables the option. +# (integer value) +# Minimum value: 0 +#reboot_timeout = 0 + +# +# Maximum time in seconds that an instance can take to build. +# +# If this timer expires, instance status will be changed to ERROR. +# Enabling this option will make sure an instance will not be stuck +# in BUILD state for a longer period. +# +# Possible values: +# +# * 0: Disables the option (default) +# * Any positive integer in seconds: Enables the option. +# (integer value) +# Minimum value: 0 +#instance_build_timeout = 0 + +# +# Interval to wait before un-rescuing an instance stuck in RESCUE. +# +# Possible values: +# +# * 0: Disables the option (default) +# * Any positive integer in seconds: Enables the option. +# (integer value) +# Minimum value: 0 +#rescue_timeout = 0 + +# +# Automatically confirm resizes after N seconds. +# +# Resize functionality will save the existing server before resizing. +# After the resize completes, user is requested to confirm the resize. +# The user has the opportunity to either confirm or revert all +# changes. Confirm resize removes the original server and changes +# server status from resized to active. Setting this option to a time +# period (in seconds) will automatically confirm the resize if the +# server is in resized state longer than that time. +# +# Possible values: +# +# * 0: Disables the option (default) +# * Any positive integer in seconds: Enables the option. +# (integer value) +# Minimum value: 0 +#resize_confirm_window = 0 + +# +# Total time to wait in seconds for an instance toperform a clean +# shutdown. +# +# It determines the overall period (in seconds) a VM is allowed to +# perform a clean shutdown. While performing stop, rescue and shelve, +# rebuild operations, configuring this option gives the VM a chance +# to perform a controlled shutdown before the instance is powered off. +# The default timeout is 60 seconds. +# +# The timeout value can be overridden on a per image basis by means +# of os_shutdown_timeout that is an image metadata setting allowing +# different types of operating systems to specify how much time they +# need to shut down cleanly. +# +# Possible values: +# +# * Any positive integer in seconds (default value is 60). +# (integer value) +# Minimum value: 1 +#shutdown_timeout = 60 + +# +# The compute service periodically checks for instances that have been +# deleted in the database but remain running on the compute node. The +# above option enables action to be taken when such instances are +# identified. +# +# Possible values: +# +# * reap: Powers down the instances and deletes them(default) +# * log: Logs warning message about deletion of the resource +# * shutdown: Powers down instances and marks them as non- +# bootable which can be later used for debugging/analysis +# * noop: Takes no action +# +# Related options: +# +# * running_deleted_instance_poll_interval +# * running_deleted_instance_timeout +# (string value) +# Possible values: +# noop - +# log - +# shutdown - +# reap - +#running_deleted_instance_action = reap + +# +# Time interval in seconds to wait between runs for the clean up action. +# If set to 0, above check will be disabled. If "running_deleted_instance +# _action" is set to "log" or "reap", a value greater than 0 must be set. +# +# Possible values: +# +# * Any positive integer in seconds enables the option. +# * 0: Disables the option. +# * 1800: Default value. +# +# Related options: +# +# * running_deleted_instance_action +# (integer value) +#running_deleted_instance_poll_interval = 1800 + +# +# Time interval in seconds to wait for the instances that have +# been marked as deleted in database to be eligible for cleanup. +# +# Possible values: +# +# * Any positive integer in seconds(default is 0). +# +# Related options: +# +# * "running_deleted_instance_action" +# (integer value) +#running_deleted_instance_timeout = 0 + +# +# The number of times to attempt to reap an instance's files. +# +# This option specifies the maximum number of retry attempts +# that can be made. +# +# Possible values: +# +# * Any positive integer defines how many attempts are made. +# * Any value <=0 means no delete attempts occur, but you should use +# ``instance_delete_interval`` to disable the delete attempts. +# +# Related options: +# * ``instance_delete_interval`` in interval_opts group can be used to disable +# this option. +# (integer value) +#maximum_instance_delete_attempts = 5 + +# +# Sets the scope of the check for unique instance names. +# +# The default doesn't check for unique names. If a scope for the name check is +# set, a launch of a new instance or an update of an existing instance with a +# duplicate name will result in an ''InstanceExists'' error. The uniqueness is +# case-insensitive. Setting this option can increase the usability for end +# users as they don't have to distinguish among instances with the same name +# by their IDs. +# +# Possible values: +# +# * '': An empty value means that no uniqueness check is done and duplicate +# names are possible. +# * "project": The instance name check is done only for instances within the +# same project. +# * "global": The instance name check is done for all instances regardless of +# the project. +# (string value) +# Possible values: +# '' - +# project - +# global - +#osapi_compute_unique_server_name_scope = + +# +# Enable new nova-compute services on this host automatically. +# +# When a new nova-compute service starts up, it gets +# registered in the database as an enabled service. Sometimes it can be useful +# to register new compute services in disabled state and then enabled them at a +# later point in time. This option only sets this behavior for nova-compute +# services, it does not auto-disable other services like nova-conductor, +# nova-scheduler, nova-consoleauth, or nova-osapi_compute. +# +# Possible values: +# +# * ``True``: Each new compute service is enabled as soon as it registers +# itself. +# * ``False``: Compute services must be enabled via an os-services REST API call +# or with the CLI with ``nova service-enable ``, otherwise +# they are not ready to use. +# (boolean value) +#enable_new_services = true + +# +# Template string to be used to generate instance names. +# +# This template controls the creation of the database name of an instance. This +# is *not* the display name you enter when creating an instance (via Horizon +# or CLI). For a new deployment it is advisable to change the default value +# (which uses the database autoincrement) to another value which makes use +# of the attributes of an instance, like ``instance-%(uuid)s``. If you +# already have instances in your deployment when you change this, your +# deployment will break. +# +# Possible values: +# +# * A string which either uses the instance database ID (like the +# default) +# * A string with a list of named database columns, for example ``%(id)d`` +# or ``%(uuid)s`` or ``%(hostname)s``. +# +# Related options: +# +# * not to be confused with: ``multi_instance_display_name_template`` +# (string value) +#instance_name_template = instance-%08x + +# +# Number of times to retry live-migration before failing. +# +# Possible values: +# +# * If == -1, try until out of hosts (default) +# * If == 0, only try once, no retries +# * Integer greater than 0 +# (integer value) +# Minimum value: -1 +#migrate_max_retries = -1 + +# +# Configuration drive format +# +# Configuration drive format that will contain metadata attached to the +# instance when it boots. +# +# Possible values: +# +# * iso9660: A file system image standard that is widely supported across +# operating systems. NOTE: Mind the libvirt bug +# (https://bugs.launchpad.net/nova/+bug/1246201) - If your hypervisor +# driver is libvirt, and you want live migrate to work without shared storage, +# then use VFAT. +# * vfat: For legacy reasons, you can configure the configuration drive to +# use VFAT format instead of ISO 9660. +# +# Related options: +# +# * This option is meaningful when one of the following alternatives occur: +# 1. force_config_drive option set to 'true' +# 2. the REST API call to create the instance contains an enable flag for +# config drive option +# 3. the image used to create the instance requires a config drive, +# this is defined by img_config_drive property for that image. +# * A compute node running Hyper-V hypervisor can be configured to attach +# configuration drive as a CD drive. To attach the configuration drive as a CD +# drive, set config_drive_cdrom option at hyperv section, to true. +# (string value) +# Possible values: +# iso9660 - +# vfat - +#config_drive_format = iso9660 + +# +# Force injection to take place on a config drive +# +# When this option is set to true configuration drive functionality will be +# forced enabled by default, otherwise user can still enable configuration +# drives via the REST API or image metadata properties. +# +# Possible values: +# +# * True: Force to use of configuration drive regardless the user's input in the +# REST API call. +# * False: Do not force use of configuration drive. Config drives can still be +# enabled via the REST API or image metadata properties. +# +# Related options: +# +# * Use the 'mkisofs_cmd' flag to set the path where you install the +# genisoimage program. If genisoimage is in same path as the +# nova-compute service, you do not need to set this flag. +# * To use configuration drive with Hyper-V, you must set the +# 'mkisofs_cmd' value to the full path to an mkisofs.exe installation. +# Additionally, you must set the qemu_img_cmd value in the hyperv +# configuration section to the full path to an qemu-img command +# installation. +# (boolean value) +#force_config_drive = false + +# +# Name or path of the tool used for ISO image creation +# +# Use the mkisofs_cmd flag to set the path where you install the genisoimage +# program. If genisoimage is on the system path, you do not need to change +# the default value. +# +# To use configuration drive with Hyper-V, you must set the mkisofs_cmd value +# to the full path to an mkisofs.exe installation. Additionally, you must set +# the qemu_img_cmd value in the hyperv configuration section to the full path +# to an qemu-img command installation. +# +# Possible values: +# +# * Name of the ISO image creator program, in case it is in the same directory +# as the nova-compute service +# * Path to ISO image creator program +# +# Related options: +# +# * This option is meaningful when config drives are enabled. +# * To use configuration drive with Hyper-V, you must set the qemu_img_cmd +# value in the hyperv configuration section to the full path to an qemu-img +# command installation. +# (string value) +#mkisofs_cmd = genisoimage + +# DEPRECATED: The driver to use for database access (string value) +# This option is deprecated for removal since 13.0.0. +# Its value may be silently ignored in the future. +#db_driver = nova.db + +# DEPRECATED: +# Default flavor to use for the EC2 API only. +# The Nova API does not support a default flavor. +# (string value) +# This option is deprecated for removal since 14.0.0. +# Its value may be silently ignored in the future. +# Reason: The EC2 API is deprecated. +#default_flavor = m1.small + +# +# The IP address which the host is using to connect to the management network. +# +# Possible values: +# +# * String with valid IP address. Default is IPv4 address of this host. +# +# Related options: +# +# * metadata_host +# * my_block_storage_ip +# * routing_source_ip +# * vpn_ip +# (string value) +#my_ip = + +# +# The IP address which is used to connect to the block storage network. +# +# Possible values: +# +# * String with valid IP address. Default is IP address of this host. +# +# Related options: +# +# * my_ip - if my_block_storage_ip is not set, then my_ip value is used. +# (string value) +#my_block_storage_ip = $my_ip + +# +# Hostname, FQDN or IP address of this host. +# +# Used as: +# +# * the oslo.messaging queue name for nova-compute worker +# * we use this value for the binding_host sent to neutron. This means if you +# use +# a neutron agent, it should have the same value for host. +# * cinder host attachment information +# +# Must be valid within AMQP key. +# +# Possible values: +# +# * String with hostname, FQDN or IP address. Default is hostname of this host. +# (string value) +#host = + +# DEPRECATED: +# This option is a list of full paths to one or more configuration files for +# dhcpbridge. In most cases the default path of '/etc/nova/nova-dhcpbridge.conf' +# should be sufficient, but if you have special needs for configuring +# dhcpbridge, +# you can change or add to this list. +# +# Possible values +# +# * A list of strings, where each string is the full path to a dhcpbridge +# configuration file. +# (multi valued) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#dhcpbridge_flagfile = /etc/nova/nova-dhcpbridge.conf + +# DEPRECATED: +# The location where the network configuration files will be kept. The default +# is +# the 'networks' directory off of the location where nova's Python module is +# installed. +# +# Possible values +# +# * A string containing the full path to the desired configuration directory +# (string value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#networks_path = $state_path/networks + +# DEPRECATED: +# This is the name of the network interface for public IP addresses. The default +# is 'eth0'. +# +# Possible values: +# +# * Any string representing a network interface name +# (string value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#public_interface = eth0 + +# DEPRECATED: +# The location of the binary nova-dhcpbridge. By default it is the binary named +# 'nova-dhcpbridge' that is installed with all the other nova binaries. +# +# Possible values: +# +# * Any string representing the full path to the binary for dhcpbridge +# (string value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#dhcpbridge = $bindir/nova-dhcpbridge + +# DEPRECATED: +# The public IP address of the network host. +# +# This is used when creating an SNAT rule. +# +# Possible values: +# +# * Any valid IP address +# +# Related options: +# +# * ``force_snat_range`` +# (string value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#routing_source_ip = $my_ip + +# DEPRECATED: +# The lifetime of a DHCP lease, in seconds. The default is 86400 (one day). +# +# Possible values: +# +# * Any positive integer value. +# (integer value) +# Minimum value: 1 +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#dhcp_lease_time = 86400 + +# DEPRECATED: +# Despite the singular form of the name of this option, it is actually a list of +# zero or more server addresses that dnsmasq will use for DNS nameservers. If +# this is not empty, dnsmasq will not read /etc/resolv.conf, but will only use +# the servers specified in this option. If the option use_network_dns_servers is +# True, the dns1 and dns2 servers from the network will be appended to this +# list, +# and will be used as DNS servers, too. +# +# Possible values: +# +# * A list of strings, where each string is either an IP address or a FQDN. +# +# Related options: +# +# * ``use_network_dns_servers`` +# (multi valued) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#dns_server = + +# DEPRECATED: +# When this option is set to True, the dns1 and dns2 servers for the network +# specified by the user on boot will be used for DNS, as well as any specified +# in +# the `dns_server` option. +# +# Related options: +# +# * ``dns_server`` +# (boolean value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#use_network_dns_servers = false + +# DEPRECATED: +# This option is a list of zero or more IP address ranges in your network's DMZ +# that should be accepted. +# +# Possible values: +# +# * A list of strings, each of which should be a valid CIDR. +# (list value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#dmz_cidr = + +# DEPRECATED: +# This is a list of zero or more IP ranges that traffic from the +# `routing_source_ip` will be SNATted to. If the list is empty, then no SNAT +# rules are created. +# +# Possible values: +# +# * A list of strings, each of which should be a valid CIDR. +# +# Related options: +# +# * ``routing_source_ip`` +# (multi valued) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#force_snat_range = + +# DEPRECATED: +# The path to the custom dnsmasq configuration file, if any. +# +# Possible values: +# +# * The full path to the configuration file, or an empty string if there is no +# custom dnsmasq configuration file. +# (string value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#dnsmasq_config_file = + +# DEPRECATED: +# This is the class used as the ethernet device driver for linuxnet bridge +# operations. The default value should be all you need for most cases, but if +# you +# wish to use a customized class, set this option to the full dot-separated +# import path for that class. +# +# Possible values: +# +# * Any string representing a dot-separated class path that Nova can import. +# (string value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#linuxnet_interface_driver = nova.network.linux_net.LinuxBridgeInterfaceDriver + +# DEPRECATED: +# The name of the Open vSwitch bridge that is used with linuxnet when connecting +# with Open vSwitch." +# +# Possible values: +# +# * Any string representing a valid bridge name. +# (string value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#linuxnet_ovs_integration_bridge = br-int + +# +# When True, when a device starts up, and upon binding floating IP addresses, +# arp +# messages will be sent to ensure that the arp caches on the compute hosts are +# up-to-date. +# +# Related options: +# +# * ``send_arp_for_ha_count`` +# (boolean value) +#send_arp_for_ha = false + +# +# When arp messages are configured to be sent, they will be sent with the count +# set to the value of this option. Of course, if this is set to zero, no arp +# messages will be sent. +# +# Possible values: +# +# * Any integer greater than or equal to 0 +# +# Related options: +# +# * ``send_arp_for_ha`` +# (integer value) +#send_arp_for_ha_count = 3 + +# DEPRECATED: +# When set to True, only the firt nic of a VM will get its default gateway from +# the DHCP server. +# (boolean value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#use_single_default_gateway = false + +# DEPRECATED: +# One or more interfaces that bridges can forward traffic to. If any of the +# items +# in this list is the special keyword 'all', then all traffic will be forwarded. +# +# Possible values: +# +# * A list of zero or more interface names, or the word 'all'. +# (multi valued) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#forward_bridge_interface = all + +# +# This option determines the IP address for the network metadata API server. +# +# This is really the client side of the metadata host equation that allows +# nova-network to find the metadata server when doing a default multi host +# networking. +# +# Possible values: +# +# * Any valid IP address. The default is the address of the Nova API server. +# +# Related options: +# +# * ``metadata_port`` +# (string value) +#metadata_host = $my_ip + +# DEPRECATED: +# This option determines the port used for the metadata API server. +# +# Related options: +# +# * ``metadata_host`` +# (port value) +# Minimum value: 0 +# Maximum value: 65535 +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#metadata_port = 8775 + +# DEPRECATED: +# This expression, if defined, will select any matching iptables rules and place +# them at the top when applying metadata changes to the rules. +# +# Possible values: +# +# * Any string representing a valid regular expression, or an empty string +# +# Related options: +# +# * ``iptables_bottom_regex`` +# (string value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#iptables_top_regex = + +# DEPRECATED: +# This expression, if defined, will select any matching iptables rules and place +# them at the bottom when applying metadata changes to the rules. +# +# Possible values: +# +# * Any string representing a valid regular expression, or an empty string +# +# Related options: +# +# * iptables_top_regex +# (string value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#iptables_bottom_regex = + +# DEPRECATED: +# By default, packets that do not pass the firewall are DROPped. In many cases, +# though, an operator may find it more useful to change this from DROP to +# REJECT, +# so that the user issuing those packets may have a better idea as to what's +# going on, or LOGDROP in order to record the blocked traffic before DROPping. +# +# Possible values: +# +# * A string representing an iptables chain. The default is DROP. +# (string value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#iptables_drop_action = DROP + +# DEPRECATED: +# This option represents the period of time, in seconds, that the ovs_vsctl +# calls +# will wait for a response from the database before timing out. A setting of 0 +# means that the utility should wait forever for a response. +# +# Possible values: +# +# * Any positive integer if a limited timeout is desired, or zero if the calls +# should wait forever for a response. +# (integer value) +# Minimum value: 0 +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#ovs_vsctl_timeout = 120 + +# DEPRECATED: +# This option is used mainly in testing to avoid calls to the underlying network +# utilities. +# (boolean value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#fake_network = false + +# DEPRECATED: +# This option determines the number of times to retry ebtables commands before +# giving up. The minimum number of retries is 1. +# +# Possible values: +# +# * Any positive integer +# +# Related options: +# +# * ``ebtables_retry_interval`` +# (integer value) +# Minimum value: 1 +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#ebtables_exec_attempts = 3 + +# DEPRECATED: +# This option determines the time, in seconds, that the system will sleep in +# between ebtables retries. Note that each successive retry waits a multiple of +# this value, so for example, if this is set to the default of 1.0 seconds, and +# ebtables_exec_attempts is 4, after the first failure, the system will sleep +# for +# 1 * 1.0 seconds, after the second failure it will sleep 2 * 1.0 seconds, and +# after the third failure it will sleep 3 * 1.0 seconds. +# +# Possible values: +# +# * Any non-negative float or integer. Setting this to zero will result in no +# waiting between attempts. +# +# Related options: +# +# * ebtables_exec_attempts +# (floating point value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#ebtables_retry_interval = 1.0 + +# DEPRECATED: +# Enable neutron as the backend for networking. +# +# Determine whether to use Neutron or Nova Network as the back end. Set to true +# to use neutron. +# (boolean value) +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#use_neutron = true + +# +# This option determines whether the network setup information is injected into +# the VM before it is booted. While it was originally designed to be used only +# by nova-network, it is also used by the vmware and xenapi virt drivers to +# control whether network information is injected into a VM. The libvirt virt +# driver also uses it when we use config_drive to configure network to control +# whether network information is injected into a VM. +# (boolean value) +#flat_injected = false + +# DEPRECATED: +# This option determines the bridge used for simple network interfaces when no +# bridge is specified in the VM creation request. +# +# Please note that this option is only used when using nova-network instead of +# Neutron in your deployment. +# +# Possible values: +# +# * Any string representing a valid network bridge, such as 'br100' +# +# Related options: +# +# * ``use_neutron`` +# (string value) +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#flat_network_bridge = + +# DEPRECATED: +# This is the address of the DNS server for a simple network. If this option is +# not specified, the default of '8.8.4.4' is used. +# +# Please note that this option is only used when using nova-network instead of +# Neutron in your deployment. +# +# Possible values: +# +# * Any valid IP address. +# +# Related options: +# +# * ``use_neutron`` +# (string value) +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#flat_network_dns = 8.8.4.4 + +# DEPRECATED: +# This option is the name of the virtual interface of the VM on which the bridge +# will be built. While it was originally designed to be used only by +# nova-network, it is also used by libvirt for the bridge interface name. +# +# Possible values: +# +# * Any valid virtual interface name, such as 'eth0' +# (string value) +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#flat_interface = + +# DEPRECATED: +# This is the VLAN number used for private networks. Note that the when creating +# the networks, if the specified number has already been assigned, nova-network +# will increment this number until it finds an available VLAN. +# +# Please note that this option is only used when using nova-network instead of +# Neutron in your deployment. It also will be ignored if the configuration +# option +# for `network_manager` is not set to the default of +# 'nova.network.manager.VlanManager'. +# +# Possible values: +# +# * Any integer between 1 and 4094. Values outside of that range will raise a +# ValueError exception. +# +# Related options: +# +# * ``network_manager`` +# * ``use_neutron`` +# (integer value) +# Minimum value: 1 +# Maximum value: 4094 +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#vlan_start = 100 + +# DEPRECATED: +# This option is the name of the virtual interface of the VM on which the VLAN +# bridge will be built. While it was originally designed to be used only by +# nova-network, it is also used by libvirt and xenapi for the bridge interface +# name. +# +# Please note that this setting will be ignored in nova-network if the +# configuration option for `network_manager` is not set to the default of +# 'nova.network.manager.VlanManager'. +# +# Possible values: +# +# * Any valid virtual interface name, such as 'eth0' +# (string value) +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. While +# this option has an effect when using neutron, it incorrectly override the +# value +# provided by neutron and should therefore not be used. +#vlan_interface = + +# DEPRECATED: +# This option represents the number of networks to create if not explicitly +# specified when the network is created. The only time this is used is if a CIDR +# is specified, but an explicit network_size is not. In that case, the subnets +# are created by diving the IP address space of the CIDR by num_networks. The +# resulting subnet sizes cannot be larger than the configuration option +# `network_size`; in that event, they are reduced to `network_size`, and a +# warning is logged. +# +# Please note that this option is only used when using nova-network instead of +# Neutron in your deployment. +# +# Possible values: +# +# * Any positive integer is technically valid, although there are practical +# limits based upon available IP address space and virtual interfaces. +# +# Related options: +# +# * ``use_neutron`` +# * ``network_size`` +# (integer value) +# Minimum value: 1 +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#num_networks = 1 + +# DEPRECATED: +# This option is no longer used since the /os-cloudpipe API was removed in the +# 16.0.0 Pike release. This is the public IP address for the cloudpipe VPN +# servers. It defaults to the IP address of the host. +# +# Please note that this option is only used when using nova-network instead of +# Neutron in your deployment. It also will be ignored if the configuration +# option +# for `network_manager` is not set to the default of +# 'nova.network.manager.VlanManager'. +# +# Possible values: +# +# * Any valid IP address. The default is ``$my_ip``, the IP address of the VM. +# +# Related options: +# +# * ``network_manager`` +# * ``use_neutron`` +# * ``vpn_start`` +# (string value) +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#vpn_ip = $my_ip + +# DEPRECATED: +# This is the port number to use as the first VPN port for private networks. +# +# Please note that this option is only used when using nova-network instead of +# Neutron in your deployment. It also will be ignored if the configuration +# option +# for `network_manager` is not set to the default of +# 'nova.network.manager.VlanManager', or if you specify a value the 'vpn_start' +# parameter when creating a network. +# +# Possible values: +# +# * Any integer representing a valid port number. The default is 1000. +# +# Related options: +# +# * ``use_neutron`` +# * ``vpn_ip`` +# * ``network_manager`` +# (port value) +# Minimum value: 0 +# Maximum value: 65535 +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#vpn_start = 1000 + +# DEPRECATED: +# This option determines the number of addresses in each private subnet. +# +# Please note that this option is only used when using nova-network instead of +# Neutron in your deployment. +# +# Possible values: +# +# * Any positive integer that is less than or equal to the available network +# size. Note that if you are creating multiple networks, they must all fit in +# the available IP address space. The default is 256. +# +# Related options: +# +# * ``use_neutron`` +# * ``num_networks`` +# (integer value) +# Minimum value: 1 +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#network_size = 256 + +# DEPRECATED: +# This option determines the fixed IPv6 address block when creating a network. +# +# Please note that this option is only used when using nova-network instead of +# Neutron in your deployment. +# +# Possible values: +# +# * Any valid IPv6 CIDR +# +# Related options: +# +# * ``use_neutron`` +# (string value) +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#fixed_range_v6 = fd00::/48 + +# DEPRECATED: +# This is the default IPv4 gateway. It is used only in the testing suite. +# +# Please note that this option is only used when using nova-network instead of +# Neutron in your deployment. +# +# Possible values: +# +# * Any valid IP address. +# +# Related options: +# +# * ``use_neutron`` +# * ``gateway_v6`` +# (string value) +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#gateway = + +# DEPRECATED: +# This is the default IPv6 gateway. It is used only in the testing suite. +# +# Please note that this option is only used when using nova-network instead of +# Neutron in your deployment. +# +# Possible values: +# +# * Any valid IP address. +# +# Related options: +# +# * ``use_neutron`` +# * ``gateway`` +# (string value) +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#gateway_v6 = + +# DEPRECATED: +# This option represents the number of IP addresses to reserve at the top of the +# address range for VPN clients. It also will be ignored if the configuration +# option for `network_manager` is not set to the default of +# 'nova.network.manager.VlanManager'. +# +# Possible values: +# +# * Any integer, 0 or greater. +# +# Related options: +# +# * ``use_neutron`` +# * ``network_manager`` +# (integer value) +# Minimum value: 0 +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#cnt_vpn_clients = 0 + +# DEPRECATED: +# This is the number of seconds to wait before disassociating a deallocated +# fixed +# IP address. This is only used with the nova-network service, and has no effect +# when using neutron for networking. +# +# Possible values: +# +# * Any integer, zero or greater. +# +# Related options: +# +# * ``use_neutron`` +# (integer value) +# Minimum value: 0 +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#fixed_ip_disassociate_timeout = 600 + +# DEPRECATED: +# This option determines how many times nova-network will attempt to create a +# unique MAC address before giving up and raising a +# `VirtualInterfaceMacAddressException` error. +# +# Possible values: +# +# * Any positive integer. The default is 5. +# +# Related options: +# +# * ``use_neutron`` +# (integer value) +# Minimum value: 1 +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#create_unique_mac_address_attempts = 5 + +# DEPRECATED: +# Determines whether unused gateway devices, both VLAN and bridge, are deleted +# if +# the network is in nova-network VLAN mode and is multi-hosted. +# +# Related options: +# +# * ``use_neutron`` +# * ``vpn_ip`` +# * ``fake_network`` +# (boolean value) +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#teardown_unused_network_gateway = false + +# DEPRECATED: +# When this option is True, a call is made to release the DHCP for the instance +# when that instance is terminated. +# +# Related options: +# +# * ``use_neutron`` +# (boolean value) +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#force_dhcp_release = true + +# DEPRECATED: +# When this option is True, whenever a DNS entry must be updated, a fanout cast +# message is sent to all network hosts to update their DNS entries in multi-host +# mode. +# +# Related options: +# +# * ``use_neutron`` +# (boolean value) +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#update_dns_entries = false + +# DEPRECATED: +# This option determines the time, in seconds, to wait between refreshing DNS +# entries for the network. +# +# Possible values: +# +# * A positive integer +# * -1 to disable updates +# +# Related options: +# +# * ``use_neutron`` +# (integer value) +# Minimum value: -1 +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#dns_update_periodic_interval = -1 + +# DEPRECATED: +# This option allows you to specify the domain for the DHCP server. +# +# Possible values: +# +# * Any string that is a valid domain name. +# +# Related options: +# +# * ``use_neutron`` +# (string value) +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#dhcp_domain = novalocal + +# DEPRECATED: +# This option allows you to specify the L3 management library to be used. +# +# Possible values: +# +# * Any dot-separated string that represents the import path to an L3 networking +# library. +# +# Related options: +# +# * ``use_neutron`` +# (string value) +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#l3_lib = nova.network.l3.LinuxNetL3 + +# DEPRECATED: +# THIS VALUE SHOULD BE SET WHEN CREATING THE NETWORK. +# +# If True in multi_host mode, all compute hosts share the same dhcp address. The +# same IP address used for DHCP will be added on each nova-network node which is +# only visible to the VMs on the same host. +# +# The use of this configuration has been deprecated and may be removed in any +# release after Mitaka. It is recommended that instead of relying on this +# option, +# an explicit value should be passed to 'create_networks()' as a keyword +# argument +# with the name 'share_address'. +# (boolean value) +# This option is deprecated for removal since 2014.2. +# Its value may be silently ignored in the future. +#share_dhcp_address = false + +# DEPRECATED: +# URL for LDAP server which will store DNS entries +# +# Possible values: +# +# * A valid LDAP URL representing the server +# (uri value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#ldap_dns_url = ldap://ldap.example.com:389 + +# DEPRECATED: Bind user for LDAP server (string value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#ldap_dns_user = uid=admin,ou=people,dc=example,dc=org + +# DEPRECATED: Bind user's password for LDAP server (string value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#ldap_dns_password = password + +# DEPRECATED: +# Hostmaster for LDAP DNS driver Statement of Authority +# +# Possible values: +# +# * Any valid string representing LDAP DNS hostmaster. +# (string value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#ldap_dns_soa_hostmaster = hostmaster@example.org + +# DEPRECATED: +# DNS Servers for LDAP DNS driver +# +# Possible values: +# +# * A valid URL representing a DNS server +# (multi valued) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#ldap_dns_servers = dns.example.org + +# DEPRECATED: +# Base distinguished name for the LDAP search query +# +# This option helps to decide where to look up the host in LDAP. +# (string value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#ldap_dns_base_dn = ou=hosts,dc=example,dc=org + +# DEPRECATED: +# Refresh interval (in seconds) for LDAP DNS driver Start of Authority +# +# Time interval, a secondary/slave DNS server waits before requesting for +# primary DNS server's current SOA record. If the records are different, +# secondary DNS server will request a zone transfer from primary. +# +# NOTE: Lower values would cause more traffic. +# (integer value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#ldap_dns_soa_refresh = 1800 + +# DEPRECATED: +# Retry interval (in seconds) for LDAP DNS driver Start of Authority +# +# Time interval, a secondary/slave DNS server should wait, if an +# attempt to transfer zone failed during the previous refresh interval. +# (integer value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#ldap_dns_soa_retry = 3600 + +# DEPRECATED: +# Expiry interval (in seconds) for LDAP DNS driver Start of Authority +# +# Time interval, a secondary/slave DNS server holds the information +# before it is no longer considered authoritative. +# (integer value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#ldap_dns_soa_expiry = 86400 + +# DEPRECATED: +# Minimum interval (in seconds) for LDAP DNS driver Start of Authority +# +# It is Minimum time-to-live applies for all resource records in the +# zone file. This value is supplied to other servers how long they +# should keep the data in cache. +# (integer value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#ldap_dns_soa_minimum = 7200 + +# DEPRECATED: +# Default value for multi_host in networks. +# +# nova-network service can operate in a multi-host or single-host mode. +# In multi-host mode each compute node runs a copy of nova-network and the +# instances on that compute node use the compute node as a gateway to the +# Internet. Where as in single-host mode, a central server runs the nova-network +# service. All compute nodes forward traffic from the instances to the +# cloud controller which then forwards traffic to the Internet. +# +# If this options is set to true, some rpc network calls will be sent directly +# to host. +# +# Note that this option is only used when using nova-network instead of +# Neutron in your deployment. +# +# Related options: +# +# * ``use_neutron`` +# (boolean value) +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#multi_host = false + +# DEPRECATED: +# Driver to use for network creation. +# +# Network driver initializes (creates bridges and so on) only when the +# first VM lands on a host node. All network managers configure the +# network using network drivers. The driver is not tied to any particular +# network manager. +# +# The default Linux driver implements vlans, bridges, and iptables rules +# using linux utilities. +# +# Note that this option is only used when using nova-network instead +# of Neutron in your deployment. +# +# Related options: +# +# * ``use_neutron`` +# (string value) +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#network_driver = nova.network.linux_net + +# DEPRECATED: +# Firewall driver to use with ``nova-network`` service. +# +# This option only applies when using the ``nova-network`` service. When using +# another networking services, such as Neutron, this should be to set to the +# ``nova.virt.firewall.NoopFirewallDriver``. +# +# Possible values: +# +# * ``nova.virt.firewall.IptablesFirewallDriver`` +# * ``nova.virt.firewall.NoopFirewallDriver`` +# * ``nova.virt.libvirt.firewall.IptablesFirewallDriver`` +# * [...] +# +# Related options: +# +# * ``use_neutron``: This must be set to ``False`` to enable ``nova-network`` +# networking +# (string value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#firewall_driver = nova.virt.firewall.NoopFirewallDriver + +# DEPRECATED: +# Determine whether to allow network traffic from same network. +# +# When set to true, hosts on the same subnet are not filtered and are allowed +# to pass all types of traffic between them. On a flat network, this allows +# all instances from all projects unfiltered communication. With VLAN +# networking, this allows access between instances within the same project. +# +# This option only applies when using the ``nova-network`` service. When using +# another networking services, such as Neutron, security groups or other +# approaches should be used. +# +# Possible values: +# +# * True: Network traffic should be allowed pass between all instances on the +# same network, regardless of their tenant and security policies +# * False: Network traffic should not be allowed pass between instances unless +# it is unblocked in a security group +# +# Related options: +# +# * ``use_neutron``: This must be set to ``False`` to enable ``nova-network`` +# networking +# * ``firewall_driver``: This must be set to +# ``nova.virt.libvirt.firewall.IptablesFirewallDriver`` to ensure the +# libvirt firewall driver is enabled. +# (boolean value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#allow_same_net_traffic = true + +# DEPRECATED: +# Default pool for floating IPs. +# +# This option specifies the default floating IP pool for allocating floating +# IPs. +# +# While allocating a floating ip, users can optionally pass in the name of the +# pool they want to allocate from, otherwise it will be pulled from the +# default pool. +# +# If this option is not set, then 'nova' is used as default floating pool. +# +# Possible values: +# +# * Any string representing a floating IP pool name +# (string value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# This option was used for two purposes: to set the floating IP pool name for +# nova-network and to do the same for neutron. nova-network is deprecated, as +# are +# any related configuration options. Users of neutron, meanwhile, should use the +# 'default_floating_pool' option in the '[neutron]' group. +#default_floating_pool = nova + +# DEPRECATED: +# Autoassigning floating IP to VM +# +# When set to True, floating IP is auto allocated and associated +# to the VM upon creation. +# +# Related options: +# +# * use_neutron: this options only works with nova-network. +# (boolean value) +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#auto_assign_floating_ip = false + +# DEPRECATED: +# Full class name for the DNS Manager for floating IPs. +# +# This option specifies the class of the driver that provides functionality +# to manage DNS entries associated with floating IPs. +# +# When a user adds a DNS entry for a specified domain to a floating IP, +# nova will add a DNS entry using the specified floating DNS driver. +# When a floating IP is deallocated, its DNS entry will automatically be +# deleted. +# +# Possible values: +# +# * Full Python path to the class to be used +# +# Related options: +# +# * use_neutron: this options only works with nova-network. +# (string value) +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#floating_ip_dns_manager = nova.network.noop_dns_driver.NoopDNSDriver + +# DEPRECATED: +# Full class name for the DNS Manager for instance IPs. +# +# This option specifies the class of the driver that provides functionality +# to manage DNS entries for instances. +# +# On instance creation, nova will add DNS entries for the instance name and +# id, using the specified instance DNS driver and domain. On instance deletion, +# nova will remove the DNS entries. +# +# Possible values: +# +# * Full Python path to the class to be used +# +# Related options: +# +# * use_neutron: this options only works with nova-network. +# (string value) +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#instance_dns_manager = nova.network.noop_dns_driver.NoopDNSDriver + +# DEPRECATED: +# If specified, Nova checks if the availability_zone of every instance matches +# what the database says the availability_zone should be for the specified +# dns_domain. +# +# Related options: +# +# * use_neutron: this options only works with nova-network. +# (string value) +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#instance_dns_domain = + +# DEPRECATED: +# Assign IPv6 and IPv4 addresses when creating instances. +# +# Related options: +# +# * use_neutron: this only works with nova-network. +# (boolean value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#use_ipv6 = false + +# DEPRECATED: +# Abstracts out IPv6 address generation to pluggable backends. +# +# nova-network can be put into dual-stack mode, so that it uses +# both IPv4 and IPv6 addresses. In dual-stack mode, by default, instances +# acquire IPv6 global unicast addresses with the help of stateless address +# auto-configuration mechanism. +# +# Related options: +# +# * use_neutron: this option only works with nova-network. +# * use_ipv6: this option only works if ipv6 is enabled for nova-network. +# (string value) +# Possible values: +# rfc2462 - +# account_identifier - +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#ipv6_backend = rfc2462 + +# DEPRECATED: +# This option is used to enable or disable quota checking for tenant networks. +# +# Related options: +# +# * quota_networks +# (boolean value) +# This option is deprecated for removal since 14.0.0. +# Its value may be silently ignored in the future. +# Reason: +# CRUD operations on tenant networks are only available when using nova-network +# and nova-network is itself deprecated. +#enable_network_quota = false + +# DEPRECATED: +# This option controls the number of private networks that can be created per +# project (or per tenant). +# +# Related options: +# +# * enable_network_quota +# (integer value) +# Minimum value: 0 +# This option is deprecated for removal since 14.0.0. +# Its value may be silently ignored in the future. +# Reason: +# CRUD operations on tenant networks are only available when using nova-network +# and nova-network is itself deprecated. +#quota_networks = 3 + +# +# Filename that will be used for storing websocket frames received +# and sent by a proxy service (like VNC, spice, serial) running on this host. +# If this is not set, no recording will be done. +# (string value) +#record = + +# Run as a background process. (boolean value) +#daemon = false + +# Disallow non-encrypted connections. (boolean value) +#ssl_only = false + +# Set to True if source host is addressed with IPv6. (boolean value) +#source_is_ipv6 = false + +# Path to SSL certificate file. (string value) +#cert = self.pem + +# SSL key file (if separate from cert). (string value) +#key = + +# +# Path to directory with content which will be served by a web server. +# (string value) +#web = /usr/share/spice-html5 + +# +# The directory where the Nova python modules are installed. +# +# This directory is used to store template files for networking and remote +# console access. It is also the default path for other config options which +# need to persist Nova internal data. It is very unlikely that you need to +# change this option from its default value. +# +# Possible values: +# +# * The full path to a directory. +# +# Related options: +# +# * ``state_path`` +# (string value) +#pybasedir = /build/nova-jVS_4e/nova-17.0.3 + +# +# The directory where the Nova binaries are installed. +# +# This option is only relevant if the networking capabilities from Nova are +# used (see services below). Nova's networking capabilities are targeted to +# be fully replaced by Neutron in the future. It is very unlikely that you need +# to change this option from its default value. +# +# Possible values: +# +# * The full path to a directory. +# (string value) +#bindir = /usr/local/bin + +# +# The top-level directory for maintaining Nova's state. +# +# This directory is used to store Nova's internal state. It is used by a +# variety of other config options which derive from this. In some scenarios +# (for example migrations) it makes sense to use a storage location which is +# shared between multiple compute hosts (for example via NFS). Unless the +# option ``instances_path`` gets overwritten, this directory can grow very +# large. +# +# Possible values: +# +# * The full path to a directory. Defaults to value provided in ``pybasedir``. +# (string value) +#state_path = $pybasedir + +# +# Number of seconds indicating how frequently the state of services on a +# given hypervisor is reported. Nova needs to know this to determine the +# overall health of the deployment. +# +# Related Options: +# +# * service_down_time +# report_interval should be less than service_down_time. If service_down_time +# is less than report_interval, services will routinely be considered down, +# because they report in too rarely. +# (integer value) +#report_interval = 10 + +# +# Maximum time in seconds since last check-in for up service +# +# Each compute node periodically updates their database status based on the +# specified report interval. If the compute node hasn't updated the status +# for more than service_down_time, then the compute node is considered down. +# +# Related Options: +# +# * report_interval (service_down_time should not be less than report_interval) +# (integer value) +#service_down_time = 60 + +# +# Enable periodic tasks. +# +# If set to true, this option allows services to periodically run tasks +# on the manager. +# +# In case of running multiple schedulers or conductors you may want to run +# periodic tasks on only one host - in this case disable this option for all +# hosts but one. +# (boolean value) +#periodic_enable = true + +# +# Number of seconds to randomly delay when starting the periodic task +# scheduler to reduce stampeding. +# +# When compute workers are restarted in unison across a cluster, +# they all end up running the periodic tasks at the same time +# causing problems for the external services. To mitigate this +# behavior, periodic_fuzzy_delay option allows you to introduce a +# random initial delay when starting the periodic task scheduler. +# +# Possible Values: +# +# * Any positive integer (in seconds) +# * 0 : disable the random delay +# (integer value) +# Minimum value: 0 +#periodic_fuzzy_delay = 60 + +# List of APIs to be enabled by default. (list value) +#enabled_apis = osapi_compute,metadata + +# +# List of APIs with enabled SSL. +# +# Nova provides SSL support for the API servers. enabled_ssl_apis option +# allows configuring the SSL support. +# (list value) +#enabled_ssl_apis = + +# +# IP address on which the OpenStack API will listen. +# +# The OpenStack API service listens on this IP address for incoming +# requests. +# (string value) +#osapi_compute_listen = 0.0.0.0 + +# +# Port on which the OpenStack API will listen. +# +# The OpenStack API service listens on this port number for incoming +# requests. +# (port value) +# Minimum value: 0 +# Maximum value: 65535 +#osapi_compute_listen_port = 8774 + +# +# Number of workers for OpenStack API service. The default will be the number +# of CPUs available. +# +# OpenStack API services can be configured to run as multi-process (workers). +# This overcomes the problem of reduction in throughput when API request +# concurrency increases. OpenStack API service will run in the specified +# number of processes. +# +# Possible Values: +# +# * Any positive integer +# * None (default value) +# (integer value) +# Minimum value: 1 +#osapi_compute_workers = + +# +# IP address on which the metadata API will listen. +# +# The metadata API service listens on this IP address for incoming +# requests. +# (string value) +#metadata_listen = 0.0.0.0 + +# +# Port on which the metadata API will listen. +# +# The metadata API service listens on this port number for incoming +# requests. +# (port value) +# Minimum value: 0 +# Maximum value: 65535 +#metadata_listen_port = 8775 + +# +# Number of workers for metadata service. If not specified the number of +# available CPUs will be used. +# +# The metadata service can be configured to run as multi-process (workers). +# This overcomes the problem of reduction in throughput when API request +# concurrency increases. The metadata service will run in the specified +# number of processes. +# +# Possible Values: +# +# * Any positive integer +# * None (default value) +# (integer value) +# Minimum value: 1 +#metadata_workers = + +# Full class name for the Manager for network (string value) +# Possible values: +# nova.network.manager.FlatManager - +# nova.network.manager.FlatDHCPManager - +# nova.network.manager.VlanManager - +#network_manager = nova.network.manager.VlanManager + +# +# This option specifies the driver to be used for the servicegroup service. +# +# ServiceGroup API in nova enables checking status of a compute node. When a +# compute worker running the nova-compute daemon starts, it calls the join API +# to join the compute group. Services like nova scheduler can query the +# ServiceGroup API to check if a node is alive. Internally, the ServiceGroup +# client driver automatically updates the compute worker status. There are +# multiple backend implementations for this service: Database ServiceGroup +# driver +# and Memcache ServiceGroup driver. +# +# Possible Values: +# +# * db : Database ServiceGroup driver +# * mc : Memcache ServiceGroup driver +# +# Related Options: +# +# * service_down_time (maximum time since last check-in for up service) +# (string value) +# Possible values: +# db - +# mc - +#servicegroup_driver = db + +# +# From oslo.log +# + +# If set to true, the logging level will be set to DEBUG instead of the default +# INFO level. (boolean value) +# Note: This option can be changed without restarting. +#debug = false + +# The name of a logging configuration file. This file is appended to any +# existing logging configuration files. For details about logging configuration +# files, see the Python logging module documentation. Note that when logging +# configuration files are used then all logging configuration is set in the +# configuration file and other logging configuration options are ignored (for +# example, logging_context_format_string). (string value) +# Note: This option can be changed without restarting. +# Deprecated group/name - [DEFAULT]/log_config +#log_config_append = + +# Defines the format string for %%(asctime)s in log records. Default: +# %(default)s . This option is ignored if log_config_append is set. (string +# value) +#log_date_format = %Y-%m-%d %H:%M:%S + +# (Optional) Name of log file to send logging output to. If no default is set, +# logging will go to stderr as defined by use_stderr. This option is ignored if +# log_config_append is set. (string value) +# Deprecated group/name - [DEFAULT]/logfile +#log_file = + +# (Optional) The base directory used for relative log_file paths. This option +# is ignored if log_config_append is set. (string value) +# Deprecated group/name - [DEFAULT]/logdir +#log_dir = + +# Uses logging handler designed to watch file system. When log file is moved or +# removed this handler will open a new log file with specified path +# instantaneously. It makes sense only if log_file option is specified and Linux +# platform is used. This option is ignored if log_config_append is set. (boolean +# value) +#watch_log_file = false + +# Use syslog for logging. Existing syslog format is DEPRECATED and will be +# changed later to honor RFC5424. This option is ignored if log_config_append is +# set. (boolean value) +#use_syslog = false + +# Enable journald for logging. If running in a systemd environment you may wish +# to enable journal support. Doing so will use the journal native protocol which +# includes structured metadata in addition to log messages.This option is +# ignored if log_config_append is set. (boolean value) +#use_journal = false + +# Syslog facility to receive log lines. This option is ignored if +# log_config_append is set. (string value) +#syslog_log_facility = LOG_USER + +# Use JSON formatting for logging. This option is ignored if log_config_append +# is set. (boolean value) +#use_json = false + +# Log output to standard error. This option is ignored if log_config_append is +# set. (boolean value) +#use_stderr = false + +# Format string to use for log messages with context. (string value) +#logging_context_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user_identity)s] %(instance)s%(message)s + +# Format string to use for log messages when context is undefined. (string +# value) +#logging_default_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [-] %(instance)s%(message)s + +# Additional data to append to log message when logging level for the message is +# DEBUG. (string value) +#logging_debug_format_suffix = %(funcName)s %(pathname)s:%(lineno)d + +# Prefix each line of exception output with this format. (string value) +#logging_exception_prefix = %(asctime)s.%(msecs)03d %(process)d ERROR %(name)s %(instance)s + +# Defines the format string for %(user_identity)s that is used in +# logging_context_format_string. (string value) +#logging_user_identity_format = %(user)s %(tenant)s %(domain)s %(user_domain)s %(project_domain)s + +# List of package logging levels in logger=LEVEL pairs. This option is ignored +# if log_config_append is set. (list value) +#default_log_levels = amqp=WARN,amqplib=WARN,boto=WARN,qpid=WARN,sqlalchemy=WARN,suds=INFO,oslo.messaging=INFO,oslo_messaging=INFO,iso8601=WARN,requests.packages.urllib3.connectionpool=WARN,urllib3.connectionpool=WARN,websocket=WARN,requests.packages.urllib3.util.retry=WARN,urllib3.util.retry=WARN,keystonemiddleware=WARN,routes.middleware=WARN,stevedore=WARN,taskflow=WARN,keystoneauth=WARN,oslo.cache=INFO,dogpile.core.dogpile=INFO + +# Enables or disables publication of error events. (boolean value) +#publish_errors = false + +# The format for an instance that is passed with the log message. (string value) +#instance_format = "[instance: %(uuid)s] " + +# The format for an instance UUID that is passed with the log message. (string +# value) +#instance_uuid_format = "[instance: %(uuid)s] " + +# Interval, number of seconds, of log rate limiting. (integer value) +#rate_limit_interval = 0 + +# Maximum number of logged messages per rate_limit_interval. (integer value) +#rate_limit_burst = 0 + +# Log level name used by rate limiting: CRITICAL, ERROR, INFO, WARNING, DEBUG or +# empty string. Logs with level greater or equal to rate_limit_except_level are +# not filtered. An empty string means that all levels are filtered. (string +# value) +#rate_limit_except_level = CRITICAL + +# Enables or disables fatal status of deprecations. (boolean value) +#fatal_deprecations = false + +# +# From oslo.messaging +# + +# Size of RPC connection pool. (integer value) +#rpc_conn_pool_size = 30 + +# The pool size limit for connections expiration policy (integer value) +#conn_pool_min_size = 2 + +# The time-to-live in sec of idle connections in the pool (integer value) +#conn_pool_ttl = 1200 + +# ZeroMQ bind address. Should be a wildcard (*), an ethernet interface, or IP. +# The "host" option should point or resolve to this address. (string value) +#rpc_zmq_bind_address = * + +# MatchMaker driver. (string value) +# Possible values: +# redis - +# sentinel - +# dummy - +#rpc_zmq_matchmaker = redis + +# Number of ZeroMQ contexts, defaults to 1. (integer value) +#rpc_zmq_contexts = 1 + +# Maximum number of ingress messages to locally buffer per topic. Default is +# unlimited. (integer value) +#rpc_zmq_topic_backlog = + +# Directory for holding IPC sockets. (string value) +#rpc_zmq_ipc_dir = /var/run/openstack + +# Name of this node. Must be a valid hostname, FQDN, or IP address. Must match +# "host" option, if running Nova. (string value) +#rpc_zmq_host = localhost + +# Number of seconds to wait before all pending messages will be sent after +# closing a socket. The default value of -1 specifies an infinite linger period. +# The value of 0 specifies no linger period. Pending messages shall be discarded +# immediately when the socket is closed. Positive values specify an upper bound +# for the linger period. (integer value) +# Deprecated group/name - [DEFAULT]/rpc_cast_timeout +#zmq_linger = -1 + +# The default number of seconds that poll should wait. Poll raises timeout +# exception when timeout expired. (integer value) +#rpc_poll_timeout = 1 + +# Expiration timeout in seconds of a name service record about existing target ( +# < 0 means no timeout). (integer value) +#zmq_target_expire = 300 + +# Update period in seconds of a name service record about existing target. +# (integer value) +#zmq_target_update = 180 + +# Use PUB/SUB pattern for fanout methods. PUB/SUB always uses proxy. (boolean +# value) +#use_pub_sub = false + +# Use ROUTER remote proxy. (boolean value) +#use_router_proxy = false + +# This option makes direct connections dynamic or static. It makes sense only +# with use_router_proxy=False which means to use direct connections for direct +# message types (ignored otherwise). (boolean value) +#use_dynamic_connections = false + +# How many additional connections to a host will be made for failover reasons. +# This option is actual only in dynamic connections mode. (integer value) +#zmq_failover_connections = 2 + +# Minimal port number for random ports range. (port value) +# Minimum value: 0 +# Maximum value: 65535 +#rpc_zmq_min_port = 49153 + +# Maximal port number for random ports range. (integer value) +# Minimum value: 1 +# Maximum value: 65536 +#rpc_zmq_max_port = 65536 + +# Number of retries to find free port number before fail with ZMQBindError. +# (integer value) +#rpc_zmq_bind_port_retries = 100 + +# Default serialization mechanism for serializing/deserializing +# outgoing/incoming messages (string value) +# Possible values: +# json - +# msgpack - +#rpc_zmq_serialization = json + +# This option configures round-robin mode in zmq socket. True means not keeping +# a queue when server side disconnects. False means to keep queue and messages +# even if server is disconnected, when the server appears we send all +# accumulated messages to it. (boolean value) +#zmq_immediate = true + +# Enable/disable TCP keepalive (KA) mechanism. The default value of -1 (or any +# other negative value) means to skip any overrides and leave it to OS default; +# 0 and 1 (or any other positive value) mean to disable and enable the option +# respectively. (integer value) +#zmq_tcp_keepalive = -1 + +# The duration between two keepalive transmissions in idle condition. The unit +# is platform dependent, for example, seconds in Linux, milliseconds in Windows +# etc. The default value of -1 (or any other negative value and 0) means to skip +# any overrides and leave it to OS default. (integer value) +#zmq_tcp_keepalive_idle = -1 + +# The number of retransmissions to be carried out before declaring that remote +# end is not available. The default value of -1 (or any other negative value and +# 0) means to skip any overrides and leave it to OS default. (integer value) +#zmq_tcp_keepalive_cnt = -1 + +# The duration between two successive keepalive retransmissions, if +# acknowledgement to the previous keepalive transmission is not received. The +# unit is platform dependent, for example, seconds in Linux, milliseconds in +# Windows etc. The default value of -1 (or any other negative value and 0) means +# to skip any overrides and leave it to OS default. (integer value) +#zmq_tcp_keepalive_intvl = -1 + +# Maximum number of (green) threads to work concurrently. (integer value) +#rpc_thread_pool_size = 100 + +# Expiration timeout in seconds of a sent/received message after which it is not +# tracked anymore by a client/server. (integer value) +#rpc_message_ttl = 300 + +# Wait for message acknowledgements from receivers. This mechanism works only +# via proxy without PUB/SUB. (boolean value) +#rpc_use_acks = false + +# Number of seconds to wait for an ack from a cast/call. After each retry +# attempt this timeout is multiplied by some specified multiplier. (integer +# value) +#rpc_ack_timeout_base = 15 + +# Number to multiply base ack timeout by after each retry attempt. (integer +# value) +#rpc_ack_timeout_multiplier = 2 + +# Default number of message sending attempts in case of any problems occurred: +# positive value N means at most N retries, 0 means no retries, None or -1 (or +# any other negative values) mean to retry forever. This option is used only if +# acknowledgments are enabled. (integer value) +#rpc_retry_attempts = 3 + +# List of publisher hosts SubConsumer can subscribe on. This option has higher +# priority then the default publishers list taken from the matchmaker. (list +# value) +#subscribe_on = + +# Size of executor thread pool when executor is threading or eventlet. (integer +# value) +# Deprecated group/name - [DEFAULT]/rpc_thread_pool_size +#executor_thread_pool_size = 64 + +# Seconds to wait for a response from a call. (integer value) +#rpc_response_timeout = 60 + +# The network address and optional user credentials for connecting to the +# messaging backend, in URL format. The expected format is: +# +# driver://[user:pass@]host:port[,[userN:passN@]hostN:portN]/virtual_host?query +# +# Example: rabbit://rabbitmq:password@127.0.0.1:5672// +# +# For full details on the fields in the URL see the documentation of +# oslo_messaging.TransportURL at +# https://docs.openstack.org/oslo.messaging/latest/reference/transport.html +# (string value) +#transport_url = + +# DEPRECATED: The messaging driver to use, defaults to rabbit. Other drivers +# include amqp and zmq. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#rpc_backend = rabbit + +# The default exchange under which topics are scoped. May be overridden by an +# exchange name specified in the transport_url option. (string value) +#control_exchange = openstack + +# +# From oslo.service.periodic_task +# + +# Some periodic tasks can be run in a separate process. Should we run them here? +# (boolean value) +#run_external_periodic_tasks = true + +# +# From oslo.service.service +# + +# Enable eventlet backdoor. Acceptable values are 0, , and :, +# where 0 results in listening on a random tcp port number; results in +# listening on the specified port number (and not enabling backdoor if that port +# is in use); and : results in listening on the smallest unused port +# number within the specified range of port numbers. The chosen port is +# displayed in the service's log file. (string value) +#backdoor_port = + +# Enable eventlet backdoor, using the provided path as a unix socket that can +# receive connections. This option is mutually exclusive with 'backdoor_port' in +# that only one should be provided. If both are provided then the existence of +# this option overrides the usage of that option. (string value) +#backdoor_socket = + +# Enables or disables logging values of all registered options when starting a +# service (at DEBUG level). (boolean value) +#log_options = true + +# Specify a timeout after which a gracefully shutdown server will exit. Zero +# value means endless wait. (integer value) +#graceful_shutdown_timeout = 60 + + +[api] +auth_strategy = keystone +# +# Options under this group are used to define Nova API. + +# +# From nova.conf +# + +# +# This determines the strategy to use for authentication: keystone or noauth2. +# 'noauth2' is designed for testing only, as it does no actual credential +# checking. 'noauth2' provides administrative credentials only if 'admin' is +# specified as the username. +# (string value) +# Possible values: +# keystone - +# noauth2 - +#auth_strategy = keystone + +# +# When True, the 'X-Forwarded-For' header is treated as the canonical remote +# address. When False (the default), the 'remote_address' header is used. +# +# You should only enable this if you have an HTML sanitizing proxy. +# (boolean value) +#use_forwarded_for = false + +# +# When gathering the existing metadata for a config drive, the EC2-style +# metadata is returned for all versions that don't appear in this option. +# As of the Liberty release, the available versions are: +# +# * 1.0 +# * 2007-01-19 +# * 2007-03-01 +# * 2007-08-29 +# * 2007-10-10 +# * 2007-12-15 +# * 2008-02-01 +# * 2008-09-01 +# * 2009-04-04 +# +# The option is in the format of a single string, with each version separated +# by a space. +# +# Possible values: +# +# * Any string that represents zero or more versions, separated by spaces. +# (string value) +#config_drive_skip_versions = 1.0 2007-01-19 2007-03-01 2007-08-29 2007-10-10 2007-12-15 2008-02-01 2008-09-01 + +# +# A list of vendordata providers. +# +# vendordata providers are how deployers can provide metadata via configdrive +# and metadata that is specific to their deployment. There are currently two +# supported providers: StaticJSON and DynamicJSON. +# +# StaticJSON reads a JSON file configured by the flag vendordata_jsonfile_path +# and places the JSON from that file into vendor_data.json and +# vendor_data2.json. +# +# DynamicJSON is configured via the vendordata_dynamic_targets flag, which is +# documented separately. For each of the endpoints specified in that flag, a +# section is added to the vendor_data2.json. +# +# For more information on the requirements for implementing a vendordata +# dynamic endpoint, please see the vendordata.rst file in the nova developer +# reference. +# +# Possible values: +# +# * A list of vendordata providers, with StaticJSON and DynamicJSON being +# current options. +# +# Related options: +# +# * vendordata_dynamic_targets +# * vendordata_dynamic_ssl_certfile +# * vendordata_dynamic_connect_timeout +# * vendordata_dynamic_read_timeout +# * vendordata_dynamic_failure_fatal +# (list value) +#vendordata_providers = StaticJSON + +# +# A list of targets for the dynamic vendordata provider. These targets are of +# the form @. +# +# The dynamic vendordata provider collects metadata by contacting external REST +# services and querying them for information about the instance. This behaviour +# is documented in the vendordata.rst file in the nova developer reference. +# (list value) +#vendordata_dynamic_targets = + +# +# Path to an optional certificate file or CA bundle to verify dynamic +# vendordata REST services ssl certificates against. +# +# Possible values: +# +# * An empty string, or a path to a valid certificate file +# +# Related options: +# +# * vendordata_providers +# * vendordata_dynamic_targets +# * vendordata_dynamic_connect_timeout +# * vendordata_dynamic_read_timeout +# * vendordata_dynamic_failure_fatal +# (string value) +#vendordata_dynamic_ssl_certfile = + +# +# Maximum wait time for an external REST service to connect. +# +# Possible values: +# +# * Any integer with a value greater than three (the TCP packet retransmission +# timeout). Note that instance start may be blocked during this wait time, +# so this value should be kept small. +# +# Related options: +# +# * vendordata_providers +# * vendordata_dynamic_targets +# * vendordata_dynamic_ssl_certfile +# * vendordata_dynamic_read_timeout +# * vendordata_dynamic_failure_fatal +# (integer value) +# Minimum value: 3 +#vendordata_dynamic_connect_timeout = 5 + +# +# Maximum wait time for an external REST service to return data once connected. +# +# Possible values: +# +# * Any integer. Note that instance start is blocked during this wait time, +# so this value should be kept small. +# +# Related options: +# +# * vendordata_providers +# * vendordata_dynamic_targets +# * vendordata_dynamic_ssl_certfile +# * vendordata_dynamic_connect_timeout +# * vendordata_dynamic_failure_fatal +# (integer value) +# Minimum value: 0 +#vendordata_dynamic_read_timeout = 5 + +# +# Should failures to fetch dynamic vendordata be fatal to instance boot? +# +# Related options: +# +# * vendordata_providers +# * vendordata_dynamic_targets +# * vendordata_dynamic_ssl_certfile +# * vendordata_dynamic_connect_timeout +# * vendordata_dynamic_read_timeout +# (boolean value) +#vendordata_dynamic_failure_fatal = false + +# +# This option is the time (in seconds) to cache metadata. When set to 0, +# metadata caching is disabled entirely; this is generally not recommended for +# performance reasons. Increasing this setting should improve response times +# of the metadata API when under heavy load. Higher values may increase memory +# usage, and result in longer times for host metadata changes to take effect. +# (integer value) +# Minimum value: 0 +#metadata_cache_expiration = 15 + +# +# Cloud providers may store custom data in vendor data file that will then be +# available to the instances via the metadata service, and to the rendering of +# config-drive. The default class for this, JsonFileVendorData, loads this +# information from a JSON file, whose path is configured by this option. If +# there is no path set by this option, the class returns an empty dictionary. +# +# Possible values: +# +# * Any string representing the path to the data file, or an empty string +# (default). +# (string value) +#vendordata_jsonfile_path = + +# +# As a query can potentially return many thousands of items, you can limit the +# maximum number of items in a single response by setting this option. +# (integer value) +# Minimum value: 0 +# Deprecated group/name - [DEFAULT]/osapi_max_limit +#max_limit = 1000 + +# +# This string is prepended to the normal URL that is returned in links to the +# OpenStack Compute API. If it is empty (the default), the URLs are returned +# unchanged. +# +# Possible values: +# +# * Any string, including an empty string (the default). +# (string value) +# Deprecated group/name - [DEFAULT]/osapi_compute_link_prefix +#compute_link_prefix = + +# +# This string is prepended to the normal URL that is returned in links to +# Glance resources. If it is empty (the default), the URLs are returned +# unchanged. +# +# Possible values: +# +# * Any string, including an empty string (the default). +# (string value) +# Deprecated group/name - [DEFAULT]/osapi_glance_link_prefix +#glance_link_prefix = + +# DEPRECATED: +# Operators can turn off the ability for a user to take snapshots of their +# instances by setting this option to False. When disabled, any attempt to +# take a snapshot will result in a HTTP 400 response ("Bad Request"). +# (boolean value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: This option disables the createImage server action API in a non- +# discoverable way and is thus a barrier to interoperability. Also, it is not +# used for other APIs that create snapshots like shelve or createBackup. +# Disabling snapshots should be done via policy if so desired. +#allow_instance_snapshots = true + +# DEPRECATED: +# This option is a list of all instance states for which network address +# information should not be returned from the API. +# +# Possible values: +# +# A list of strings, where each string is a valid VM state, as defined in +# nova/compute/vm_states.py. As of the Newton release, they are: +# +# * "active" +# * "building" +# * "paused" +# * "suspended" +# * "stopped" +# * "rescued" +# * "resized" +# * "soft-delete" +# * "deleted" +# * "error" +# * "shelved" +# * "shelved_offloaded" +# (list value) +# Deprecated group/name - [DEFAULT]/osapi_hide_server_address_states +# This option is deprecated for removal since 17.0.0. +# Its value may be silently ignored in the future. +# Reason: This option hide the server address in server representation for +# configured server states. Which makes GET server API controlled by this config +# options. Due to this config options, user would not be able to discover the +# API behavior on different clouds which leads to the interop issue. +#hide_server_address_states = building + +# The full path to the fping binary. (string value) +#fping_path = /usr/sbin/fping + +# +# When True, the TenantNetworkController will query the Neutron API to get the +# default networks to use. +# +# Related options: +# +# * neutron_default_tenant_id +# (boolean value) +#use_neutron_default_nets = false + +# +# Tenant ID for getting the default network from Neutron API (also referred in +# some places as the 'project ID') to use. +# +# Related options: +# +# * use_neutron_default_nets +# (string value) +#neutron_default_tenant_id = default + +# +# Enables returning of the instance password by the relevant server API calls +# such as create, rebuild, evacuate, or rescue. If the hypervisor does not +# support password injection, then the password returned will not be correct, +# so if your hypervisor does not support password injection, set this to False. +# (boolean value) +#enable_instance_password = true + + +[api_database] +connection = mysql+pymysql://nova:nova_db_secret@controller/nova_api +# +# The *Nova API Database* is a separate database which is used for information +# which is used across *cells*. This database is mandatory since the Mitaka +# release (13.0.0). + +# +# From nova.conf +# + +# The SQLAlchemy connection string to use to connect to the database. (string +# value) +#connection = + +# If True, SQLite uses synchronous mode. (boolean value) +#sqlite_synchronous = true + +# The SQLAlchemy connection string to use to connect to the slave database. +# (string value) +#slave_connection = + +# The SQL mode to be used for MySQL sessions. This option, including the +# default, overrides any server-set SQL mode. To use whatever SQL mode is set by +# the server configuration, set this to no value. Example: mysql_sql_mode= +# (string value) +#mysql_sql_mode = TRADITIONAL + +# Connections which have been present in the connection pool longer than this +# number of seconds will be replaced with a new one the next time they are +# checked out from the pool. (integer value) +# Deprecated group/name - [api_database]/idle_timeout +#connection_recycle_time = 3600 + +# Maximum number of SQL connections to keep open in a pool. Setting a value of 0 +# indicates no limit. (integer value) +#max_pool_size = + +# Maximum number of database connection retries during startup. Set to -1 to +# specify an infinite retry count. (integer value) +#max_retries = 10 + +# Interval between retries of opening a SQL connection. (integer value) +#retry_interval = 10 + +# If set, use this value for max_overflow with SQLAlchemy. (integer value) +#max_overflow = + +# Verbosity of SQL debugging information: 0=None, 100=Everything. (integer +# value) +#connection_debug = 0 + +# Add Python stack traces to SQL as comment strings. (boolean value) +#connection_trace = false + +# If set, use this value for pool_timeout with SQLAlchemy. (integer value) +#pool_timeout = + + +[barbican] + +# +# From nova.conf +# + +# Use this endpoint to connect to Barbican, for example: +# "http://localhost:9311/" (string value) +#barbican_endpoint = + +# Version of the Barbican API, for example: "v1" (string value) +#barbican_api_version = + +# Use this endpoint to connect to Keystone (string value) +# Deprecated group/name - [key_manager]/auth_url +#auth_endpoint = http://localhost/identity/v3 + +# Number of seconds to wait before retrying poll for key creation completion +# (integer value) +#retry_delay = 1 + +# Number of times to retry poll for key creation completion (integer value) +#number_of_retries = 60 + +# Specifies if insecure TLS (https) requests. If False, the server's certificate +# will not be validated (boolean value) +#verify_ssl = true + + +[cache] + +# +# From nova.conf +# + +# Prefix for building the configuration dictionary for the cache region. This +# should not need to be changed unless there is another dogpile.cache region +# with the same configuration name. (string value) +#config_prefix = cache.oslo + +# Default TTL, in seconds, for any cached item in the dogpile.cache region. This +# applies to any cached method that doesn't have an explicit cache expiration +# time defined for it. (integer value) +#expiration_time = 600 + +# Cache backend module. For eventlet-based or environments with hundreds of +# threaded servers, Memcache with pooling (oslo_cache.memcache_pool) is +# recommended. For environments with less than 100 threaded servers, Memcached +# (dogpile.cache.memcached) or Redis (dogpile.cache.redis) is recommended. Test +# environments with a single instance of the server can use the +# dogpile.cache.memory backend. (string value) +# Possible values: +# oslo_cache.memcache_pool - +# oslo_cache.dict - +# oslo_cache.mongo - +# oslo_cache.etcd3gw - +# dogpile.cache.memcached - +# dogpile.cache.pylibmc - +# dogpile.cache.bmemcached - +# dogpile.cache.dbm - +# dogpile.cache.redis - +# dogpile.cache.memory - +# dogpile.cache.memory_pickle - +# dogpile.cache.null - +#backend = dogpile.cache.null + +# Arguments supplied to the backend module. Specify this option once per +# argument to be passed to the dogpile.cache backend. Example format: +# ":". (multi valued) +#backend_argument = + +# Proxy classes to import that will affect the way the dogpile.cache backend +# functions. See the dogpile.cache documentation on changing-backend-behavior. +# (list value) +#proxies = + +# Global toggle for caching. (boolean value) +#enabled = false + +# Extra debugging from the cache backend (cache keys, get/set/delete/etc calls). +# This is only really useful if you need to see the specific cache-backend +# get/set/delete calls with the keys/values. Typically this should be left set +# to false. (boolean value) +#debug_cache_backend = false + +# Memcache servers in the format of "host:port". (dogpile.cache.memcache and +# oslo_cache.memcache_pool backends only). (list value) +#memcache_servers = localhost:11211 + +# Number of seconds memcached server is considered dead before it is tried +# again. (dogpile.cache.memcache and oslo_cache.memcache_pool backends only). +# (integer value) +#memcache_dead_retry = 300 + +# Timeout in seconds for every call to a server. (dogpile.cache.memcache and +# oslo_cache.memcache_pool backends only). (integer value) +#memcache_socket_timeout = 3 + +# Max total number of open connections to every memcached server. +# (oslo_cache.memcache_pool backend only). (integer value) +#memcache_pool_maxsize = 10 + +# Number of seconds a connection to memcached is held unused in the pool before +# it is closed. (oslo_cache.memcache_pool backend only). (integer value) +#memcache_pool_unused_timeout = 60 + +# Number of seconds that an operation will wait to get a memcache client +# connection. (integer value) +#memcache_pool_connection_get_timeout = 10 + + +[cells] +enable = False +# +# DEPRECATED: Cells options allow you to use cells v1 functionality in an +# OpenStack deployment. +# +# Note that the options in this group are only for cells v1 functionality, which +# is considered experimental and not recommended for new deployments. Cells v1 +# is being replaced with cells v2, which starting in the 15.0.0 Ocata release is +# required and all Nova deployments will be at least a cells v2 cell of one. +# + +# +# From nova.conf +# + +# DEPRECATED: +# Enable cell v1 functionality. +# +# Note that cells v1 is considered experimental and not recommended for new +# Nova deployments. Cells v1 is being replaced by cells v2 which starting in +# the 15.0.0 Ocata release, all Nova deployments are at least a cells v2 cell +# of one. Setting this option, or any other options in the [cells] group, is +# not required for cells v2. +# +# When this functionality is enabled, it lets you to scale an OpenStack +# Compute cloud in a more distributed fashion without having to use +# complicated technologies like database and message queue clustering. +# Cells are configured as a tree. The top-level cell should have a host +# that runs a nova-api service, but no nova-compute services. Each +# child cell should run all of the typical nova-* services in a regular +# Compute cloud except for nova-api. You can think of cells as a normal +# Compute deployment in that each cell has its own database server and +# message queue broker. +# +# Related options: +# +# * name: A unique cell name must be given when this functionality +# is enabled. +# * cell_type: Cell type should be defined for all cells. +# (boolean value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: Cells v1 is being replaced with Cells v2. +#enable = false + +# DEPRECATED: +# Name of the current cell. +# +# This value must be unique for each cell. Name of a cell is used as +# its id, leaving this option unset or setting the same name for +# two or more cells may cause unexpected behaviour. +# +# Related options: +# +# * enabled: This option is meaningful only when cells service +# is enabled +# (string value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: Cells v1 is being replaced with Cells v2. +#name = nova + +# DEPRECATED: +# Cell capabilities. +# +# List of arbitrary key=value pairs defining capabilities of the +# current cell to be sent to the parent cells. These capabilities +# are intended to be used in cells scheduler filters/weighers. +# +# Possible values: +# +# * key=value pairs list for example; +# ``hypervisor=xenserver;kvm,os=linux;windows`` +# (list value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: Cells v1 is being replaced with Cells v2. +#capabilities = hypervisor=xenserver;kvm,os=linux;windows + +# DEPRECATED: +# Call timeout. +# +# Cell messaging module waits for response(s) to be put into the +# eventlet queue. This option defines the seconds waited for +# response from a call to a cell. +# +# Possible values: +# +# * An integer, corresponding to the interval time in seconds. +# (integer value) +# Minimum value: 0 +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: Cells v1 is being replaced with Cells v2. +#call_timeout = 60 + +# DEPRECATED: +# Reserve percentage +# +# Percentage of cell capacity to hold in reserve, so the minimum +# amount of free resource is considered to be; +# +# min_free = total * (reserve_percent / 100.0) +# +# This option affects both memory and disk utilization. +# +# The primary purpose of this reserve is to ensure some space is +# available for users who want to resize their instance to be larger. +# Note that currently once the capacity expands into this reserve +# space this option is ignored. +# +# Possible values: +# +# * An integer or float, corresponding to the percentage of cell capacity to +# be held in reserve. +# (floating point value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: Cells v1 is being replaced with Cells v2. +#reserve_percent = 10.0 + +# DEPRECATED: +# Type of cell. +# +# When cells feature is enabled the hosts in the OpenStack Compute +# cloud are partitioned into groups. Cells are configured as a tree. +# The top-level cell's cell_type must be set to ``api``. All other +# cells are defined as a ``compute cell`` by default. +# +# Related option: +# +# * quota_driver: Disable quota checking for the child cells. +# (nova.quota.NoopQuotaDriver) +# (string value) +# Possible values: +# api - +# compute - +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: Cells v1 is being replaced with Cells v2. +#cell_type = compute + +# DEPRECATED: +# Mute child interval. +# +# Number of seconds after which a lack of capability and capacity +# update the child cell is to be treated as a mute cell. Then the +# child cell will be weighed as recommend highly that it be skipped. +# +# Possible values: +# +# * An integer, corresponding to the interval time in seconds. +# (integer value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: Cells v1 is being replaced with Cells v2. +#mute_child_interval = 300 + +# DEPRECATED: +# Bandwidth update interval. +# +# Seconds between bandwidth usage cache updates for cells. +# +# Possible values: +# +# * An integer, corresponding to the interval time in seconds. +# (integer value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: Cells v1 is being replaced with Cells v2. +#bandwidth_update_interval = 600 + +# DEPRECATED: +# Instance update sync database limit. +# +# Number of instances to pull from the database at one time for +# a sync. If there are more instances to update the results will +# be paged through. +# +# Possible values: +# +# * An integer, corresponding to a number of instances. +# (integer value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: Cells v1 is being replaced with Cells v2. +#instance_update_sync_database_limit = 100 + +# DEPRECATED: +# Mute weight multiplier. +# +# Multiplier used to weigh mute children. Mute children cells are +# recommended to be skipped so their weight is multiplied by this +# negative value. +# +# Possible values: +# +# * Negative numeric number +# (floating point value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: Cells v1 is being replaced with Cells v2. +#mute_weight_multiplier = -10000.0 + +# DEPRECATED: +# Ram weight multiplier. +# +# Multiplier used for weighing ram. Negative numbers indicate that +# Compute should stack VMs on one host instead of spreading out new +# VMs to more hosts in the cell. +# +# Possible values: +# +# * Numeric multiplier +# (floating point value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: Cells v1 is being replaced with Cells v2. +#ram_weight_multiplier = 10.0 + +# DEPRECATED: +# Offset weight multiplier +# +# Multiplier used to weigh offset weigher. Cells with higher +# weight_offsets in the DB will be preferred. The weight_offset +# is a property of a cell stored in the database. It can be used +# by a deployer to have scheduling decisions favor or disfavor +# cells based on the setting. +# +# Possible values: +# +# * Numeric multiplier +# (floating point value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: Cells v1 is being replaced with Cells v2. +#offset_weight_multiplier = 1.0 + +# DEPRECATED: +# Instance updated at threshold +# +# Number of seconds after an instance was updated or deleted to +# continue to update cells. This option lets cells manager to only +# attempt to sync instances that have been updated recently. +# i.e., a threshold of 3600 means to only update instances that +# have modified in the last hour. +# +# Possible values: +# +# * Threshold in seconds +# +# Related options: +# +# * This value is used with the ``instance_update_num_instances`` +# value in a periodic task run. +# (integer value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: Cells v1 is being replaced with Cells v2. +#instance_updated_at_threshold = 3600 + +# DEPRECATED: +# Instance update num instances +# +# On every run of the periodic task, nova cells manager will attempt to +# sync instance_updated_at_threshold number of instances. When the +# manager gets the list of instances, it shuffles them so that multiple +# nova-cells services do not attempt to sync the same instances in +# lockstep. +# +# Possible values: +# +# * Positive integer number +# +# Related options: +# +# * This value is used with the ``instance_updated_at_threshold`` +# value in a periodic task run. +# (integer value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: Cells v1 is being replaced with Cells v2. +#instance_update_num_instances = 1 + +# DEPRECATED: +# Maximum hop count +# +# When processing a targeted message, if the local cell is not the +# target, a route is defined between neighbouring cells. And the +# message is processed across the whole routing path. This option +# defines the maximum hop counts until reaching the target. +# +# Possible values: +# +# * Positive integer value +# (integer value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: Cells v1 is being replaced with Cells v2. +#max_hop_count = 10 + +# DEPRECATED: +# Cells scheduler. +# +# The class of the driver used by the cells scheduler. This should be +# the full Python path to the class to be used. If nothing is specified +# in this option, the CellsScheduler is used. +# (string value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: Cells v1 is being replaced with Cells v2. +#scheduler = nova.cells.scheduler.CellsScheduler + +# DEPRECATED: +# RPC driver queue base. +# +# When sending a message to another cell by JSON-ifying the message +# and making an RPC cast to 'process_message', a base queue is used. +# This option defines the base queue name to be used when communicating +# between cells. Various topics by message type will be appended to this. +# +# Possible values: +# +# * The base queue name to be used when communicating between cells. +# (string value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: Cells v1 is being replaced with Cells v2. +#rpc_driver_queue_base = cells.intercell + +# DEPRECATED: +# Scheduler filter classes. +# +# Filter classes the cells scheduler should use. An entry of +# "nova.cells.filters.all_filters" maps to all cells filters +# included with nova. As of the Mitaka release the following +# filter classes are available: +# +# Different cell filter: A scheduler hint of 'different_cell' +# with a value of a full cell name may be specified to route +# a build away from a particular cell. +# +# Image properties filter: Image metadata named +# 'hypervisor_version_requires' with a version specification +# may be specified to ensure the build goes to a cell which +# has hypervisors of the required version. If either the version +# requirement on the image or the hypervisor capability of the +# cell is not present, this filter returns without filtering out +# the cells. +# +# Target cell filter: A scheduler hint of 'target_cell' with a +# value of a full cell name may be specified to route a build to +# a particular cell. No error handling is done as there's no way +# to know whether the full path is a valid. +# +# As an admin user, you can also add a filter that directs builds +# to a particular cell. +# +# (list value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: Cells v1 is being replaced with Cells v2. +#scheduler_filter_classes = nova.cells.filters.all_filters + +# DEPRECATED: +# Scheduler weight classes. +# +# Weigher classes the cells scheduler should use. An entry of +# "nova.cells.weights.all_weighers" maps to all cell weighers +# included with nova. As of the Mitaka release the following +# weight classes are available: +# +# mute_child: Downgrades the likelihood of child cells being +# chosen for scheduling requests, which haven't sent capacity +# or capability updates in a while. Options include +# mute_weight_multiplier (multiplier for mute children; value +# should be negative). +# +# ram_by_instance_type: Select cells with the most RAM capacity +# for the instance type being requested. Because higher weights +# win, Compute returns the number of available units for the +# instance type requested. The ram_weight_multiplier option defaults +# to 10.0 that adds to the weight by a factor of 10. Use a negative +# number to stack VMs on one host instead of spreading out new VMs +# to more hosts in the cell. +# +# weight_offset: Allows modifying the database to weight a particular +# cell. The highest weight will be the first cell to be scheduled for +# launching an instance. When the weight_offset of a cell is set to 0, +# it is unlikely to be picked but it could be picked if other cells +# have a lower weight, like if they're full. And when the weight_offset +# is set to a very high value (for example, '999999999999999'), it is +# likely to be picked if another cell do not have a higher weight. +# (list value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: Cells v1 is being replaced with Cells v2. +#scheduler_weight_classes = nova.cells.weights.all_weighers + +# DEPRECATED: +# Scheduler retries. +# +# How many retries when no cells are available. Specifies how many +# times the scheduler tries to launch a new instance when no cells +# are available. +# +# Possible values: +# +# * Positive integer value +# +# Related options: +# +# * This value is used with the ``scheduler_retry_delay`` value +# while retrying to find a suitable cell. +# (integer value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: Cells v1 is being replaced with Cells v2. +#scheduler_retries = 10 + +# DEPRECATED: +# Scheduler retry delay. +# +# Specifies the delay (in seconds) between scheduling retries when no +# cell can be found to place the new instance on. When the instance +# could not be scheduled to a cell after ``scheduler_retries`` in +# combination with ``scheduler_retry_delay``, then the scheduling +# of the instance failed. +# +# Possible values: +# +# * Time in seconds. +# +# Related options: +# +# * This value is used with the ``scheduler_retries`` value +# while retrying to find a suitable cell. +# (integer value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: Cells v1 is being replaced with Cells v2. +#scheduler_retry_delay = 2 + +# DEPRECATED: +# DB check interval. +# +# Cell state manager updates cell status for all cells from the DB +# only after this particular interval time is passed. Otherwise cached +# status are used. If this value is 0 or negative all cell status are +# updated from the DB whenever a state is needed. +# +# Possible values: +# +# * Interval time, in seconds. +# +# (integer value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: Cells v1 is being replaced with Cells v2. +#db_check_interval = 60 + +# DEPRECATED: +# Optional cells configuration. +# +# Configuration file from which to read cells configuration. If given, +# overrides reading cells from the database. +# +# Cells store all inter-cell communication data, including user names +# and passwords, in the database. Because the cells data is not updated +# very frequently, use this option to specify a JSON file to store +# cells data. With this configuration, the database is no longer +# consulted when reloading the cells data. The file must have columns +# present in the Cell model (excluding common database fields and the +# id column). You must specify the queue connection information through +# a transport_url field, instead of username, password, and so on. +# +# The transport_url has the following form: +# rabbit://USERNAME:PASSWORD@HOSTNAME:PORT/VIRTUAL_HOST +# +# Possible values: +# +# The scheme can be either qpid or rabbit, the following sample shows +# this optional configuration: +# +# { +# "parent": { +# "name": "parent", +# "api_url": "http://api.example.com:8774", +# "transport_url": "rabbit://rabbit.example.com", +# "weight_offset": 0.0, +# "weight_scale": 1.0, +# "is_parent": true +# }, +# "cell1": { +# "name": "cell1", +# "api_url": "http://api.example.com:8774", +# "transport_url": "rabbit://rabbit1.example.com", +# "weight_offset": 0.0, +# "weight_scale": 1.0, +# "is_parent": false +# }, +# "cell2": { +# "name": "cell2", +# "api_url": "http://api.example.com:8774", +# "transport_url": "rabbit://rabbit2.example.com", +# "weight_offset": 0.0, +# "weight_scale": 1.0, +# "is_parent": false +# } +# } +# +# (string value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: Cells v1 is being replaced with Cells v2. +#cells_config = + + +[cinder] +os_region_name = RegionOne + +# +# From nova.conf +# + +# +# Info to match when looking for cinder in the service catalog. +# +# Possible values: +# +# * Format is separated values of the form: +# :: +# +# Note: Nova does not support the Cinder v2 API since the Nova 17.0.0 Queens +# release. +# +# Related options: +# +# * endpoint_template - Setting this option will override catalog_info +# (string value) +#catalog_info = volumev3:cinderv3:publicURL + +# +# If this option is set then it will override service catalog lookup with +# this template for cinder endpoint +# +# Possible values: +# +# * URL for cinder endpoint API +# e.g. http://localhost:8776/v3/%(project_id)s +# +# Note: Nova does not support the Cinder v2 API since the Nova 17.0.0 Queens +# release. +# +# Related options: +# +# * catalog_info - If endpoint_template is not set, catalog_info will be used. +# (string value) +#endpoint_template = + +# +# Region name of this node. This is used when picking the URL in the service +# catalog. +# +# Possible values: +# +# * Any string representing region name +# (string value) +#os_region_name = + +# +# Number of times cinderclient should retry on any failed http call. +# 0 means connection is attempted only once. Setting it to any positive integer +# means that on failure connection is retried that many times e.g. setting it +# to 3 means total attempts to connect will be 4. +# +# Possible values: +# +# * Any integer value. 0 means connection is attempted only once +# (integer value) +# Minimum value: 0 +#http_retries = 3 + +# +# Allow attach between instance and volume in different availability zones. +# +# If False, volumes attached to an instance must be in the same availability +# zone in Cinder as the instance availability zone in Nova. +# This also means care should be taken when booting an instance from a volume +# where source is not "volume" because Nova will attempt to create a volume +# using +# the same availability zone as what is assigned to the instance. +# If that AZ is not in Cinder (or allow_availability_zone_fallback=False in +# cinder.conf), the volume create request will fail and the instance will fail +# the build request. +# By default there is no availability zone restriction on volume attach. +# (boolean value) +#cross_az_attach = true + +# PEM encoded Certificate Authority to use when verifying HTTPs connections. +# (string value) +#cafile = + +# PEM encoded client certificate cert file (string value) +#certfile = + +# PEM encoded client certificate key file (string value) +#keyfile = + +# Verify HTTPS connections. (boolean value) +#insecure = false + +# Timeout value for http requests (integer value) +#timeout = + +# Authentication type to load (string value) +# Deprecated group/name - [cinder]/auth_plugin +#auth_type = + +# Config Section from which to load plugin specific options (string value) +#auth_section = + +# Authentication URL (string value) +#auth_url = + +# Scope for system operations (string value) +#system_scope = + +# Domain ID to scope to (string value) +#domain_id = + +# Domain name to scope to (string value) +#domain_name = + +# Project ID to scope to (string value) +#project_id = + +# Project name to scope to (string value) +#project_name = + +# Domain ID containing project (string value) +#project_domain_id = + +# Domain name containing project (string value) +#project_domain_name = + +# Trust ID (string value) +#trust_id = + +# Optional domain ID to use with v3 and v2 parameters. It will be used for both +# the user and project domain in v3 and ignored in v2 authentication. (string +# value) +#default_domain_id = + +# Optional domain name to use with v3 API and v2 parameters. It will be used for +# both the user and project domain in v3 and ignored in v2 authentication. +# (string value) +#default_domain_name = + +# User ID (string value) +#user_id = + +# Username (string value) +# Deprecated group/name - [cinder]/user_name +#username = + +# User's domain id (string value) +#user_domain_id = + +# User's domain name (string value) +#user_domain_name = + +# User's password (string value) +#password = + +# Tenant ID (string value) +#tenant_id = + +# Tenant Name (string value) +#tenant_name = + + +[compute] + +# +# From nova.conf +# + +# +# Number of consecutive failed builds that result in disabling a compute +# service. +# +# This option will cause nova-compute to set itself to a disabled state +# if a certain number of consecutive build failures occur. This will +# prevent the scheduler from continuing to send builds to a compute node that is +# consistently failing. Note that all failures qualify and count towards this +# score, including reschedules that may have been due to racy scheduler +# behavior. +# Since the failures must be consecutive, it is unlikely that occasional +# expected +# reschedules will actually disable a compute node. +# +# Possible values: +# +# * Any positive integer representing a build failure count. +# * Zero to never auto-disable. +# (integer value) +#consecutive_build_service_disable_threshold = 10 + + +[conductor] +# +# Options under this group are used to define Conductor's communication, +# which manager should be act as a proxy between computes and database, +# and finally, how many worker processes will be used. + +# +# From nova.conf +# + +# DEPRECATED: +# Topic exchange name on which conductor nodes listen. +# (string value) +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# There is no need to let users choose the RPC topic for all services - there +# is little gain from this. Furthermore, it makes it really easy to break Nova +# by using this option. +#topic = conductor + +# +# Number of workers for OpenStack Conductor service. The default will be the +# number of CPUs available. +# (integer value) +#workers = + + +[console] +# +# Options under this group allow to tune the configuration of the console proxy +# service. +# +# Note: in configuration of every compute is a ``console_host`` option, +# which allows to select the console proxy service to connect to. + +# +# From nova.conf +# + +# +# Adds list of allowed origins to the console websocket proxy to allow +# connections from other origin hostnames. +# Websocket proxy matches the host header with the origin header to +# prevent cross-site requests. This list specifies if any there are +# values other than host are allowed in the origin header. +# +# Possible values: +# +# * A list where each element is an allowed origin hostnames, else an empty list +# (list value) +# Deprecated group/name - [DEFAULT]/console_allowed_origins +#allowed_origins = + + +[consoleauth] + +# +# From nova.conf +# + +# +# The lifetime of a console auth token (in seconds). +# +# A console auth token is used in authorizing console access for a user. +# Once the auth token time to live count has elapsed, the token is +# considered expired. Expired tokens are then deleted. +# (integer value) +# Minimum value: 0 +# Deprecated group/name - [DEFAULT]/console_token_ttl +#token_ttl = 600 + + +[cors] + +# +# From oslo.middleware +# + +# Indicate whether this resource may be shared with the domain received in the +# requests "origin" header. Format: "://[:]", no trailing +# slash. Example: https://horizon.example.com (list value) +#allowed_origin = + +# Indicate that the actual request can include user credentials (boolean value) +#allow_credentials = true + +# Indicate which headers are safe to expose to the API. Defaults to HTTP Simple +# Headers. (list value) +#expose_headers = X-Auth-Token,X-Openstack-Request-Id,X-Subject-Token,X-Service-Token + +# Maximum cache age of CORS preflight requests. (integer value) +#max_age = 3600 + +# Indicate which methods can be used during the actual request. (list value) +#allow_methods = GET,PUT,POST,DELETE,PATCH + +# Indicate which header field names may be used during the actual request. (list +# value) +#allow_headers = X-Auth-Token,X-Openstack-Request-Id,X-Identity-Status,X-Roles,X-Service-Catalog,X-User-Id,X-Tenant-Id + + +[crypto] + +# +# From nova.conf +# + +# +# Filename of root CA (Certificate Authority). This is a container format +# and includes root certificates. +# +# Possible values: +# +# * Any file name containing root CA, cacert.pem is default +# +# Related options: +# +# * ca_path +# (string value) +#ca_file = cacert.pem + +# +# Filename of a private key. +# +# Related options: +# +# * keys_path +# (string value) +#key_file = private/cakey.pem + +# +# Filename of root Certificate Revocation List (CRL). This is a list of +# certificates that have been revoked, and therefore, entities presenting +# those (revoked) certificates should no longer be trusted. +# +# Related options: +# +# * ca_path +# (string value) +#crl_file = crl.pem + +# +# Directory path where keys are located. +# +# Related options: +# +# * key_file +# (string value) +#keys_path = $state_path/keys + +# +# Directory path where root CA is located. +# +# Related options: +# +# * ca_file +# (string value) +#ca_path = $state_path/CA + +# Option to enable/disable use of CA for each project. (boolean value) +#use_project_ca = false + +# +# Subject for certificate for users, %s for +# project, user, timestamp +# (string value) +#user_cert_subject = /C=US/ST=California/O=OpenStack/OU=NovaDev/CN=%.16s-%.16s-%s + +# +# Subject for certificate for projects, %s for +# project, timestamp +# (string value) +#project_cert_subject = /C=US/ST=California/O=OpenStack/OU=NovaDev/CN=project-ca-%.16s-%s + + +[database] +connection = mysql+pymysql://nova:nova_db_secret@controller/nova + +# +# From oslo.db +# + +# If True, SQLite uses synchronous mode. (boolean value) +#sqlite_synchronous = true + +# The back end to use for the database. (string value) +# Deprecated group/name - [DEFAULT]/db_backend +#backend = sqlalchemy + +# The SQLAlchemy connection string to use to connect to the database. (string +# value) +# Deprecated group/name - [DEFAULT]/sql_connection +# Deprecated group/name - [DATABASE]/sql_connection +# Deprecated group/name - [sql]/connection +#connection = + +# The SQLAlchemy connection string to use to connect to the slave database. +# (string value) +#slave_connection = + +# The SQL mode to be used for MySQL sessions. This option, including the +# default, overrides any server-set SQL mode. To use whatever SQL mode is set by +# the server configuration, set this to no value. Example: mysql_sql_mode= +# (string value) +#mysql_sql_mode = TRADITIONAL + +# If True, transparently enables support for handling MySQL Cluster (NDB). +# (boolean value) +#mysql_enable_ndb = false + +# Connections which have been present in the connection pool longer than this +# number of seconds will be replaced with a new one the next time they are +# checked out from the pool. (integer value) +# Deprecated group/name - [DATABASE]/idle_timeout +# Deprecated group/name - [database]/idle_timeout +# Deprecated group/name - [DEFAULT]/sql_idle_timeout +# Deprecated group/name - [DATABASE]/sql_idle_timeout +# Deprecated group/name - [sql]/idle_timeout +#connection_recycle_time = 3600 + +# Minimum number of SQL connections to keep open in a pool. (integer value) +# Deprecated group/name - [DEFAULT]/sql_min_pool_size +# Deprecated group/name - [DATABASE]/sql_min_pool_size +#min_pool_size = 1 + +# Maximum number of SQL connections to keep open in a pool. Setting a value of 0 +# indicates no limit. (integer value) +# Deprecated group/name - [DEFAULT]/sql_max_pool_size +# Deprecated group/name - [DATABASE]/sql_max_pool_size +#max_pool_size = 5 + +# Maximum number of database connection retries during startup. Set to -1 to +# specify an infinite retry count. (integer value) +# Deprecated group/name - [DEFAULT]/sql_max_retries +# Deprecated group/name - [DATABASE]/sql_max_retries +#max_retries = 10 + +# Interval between retries of opening a SQL connection. (integer value) +# Deprecated group/name - [DEFAULT]/sql_retry_interval +# Deprecated group/name - [DATABASE]/reconnect_interval +#retry_interval = 10 + +# If set, use this value for max_overflow with SQLAlchemy. (integer value) +# Deprecated group/name - [DEFAULT]/sql_max_overflow +# Deprecated group/name - [DATABASE]/sqlalchemy_max_overflow +#max_overflow = 50 + +# Verbosity of SQL debugging information: 0=None, 100=Everything. (integer +# value) +# Minimum value: 0 +# Maximum value: 100 +# Deprecated group/name - [DEFAULT]/sql_connection_debug +#connection_debug = 0 + +# Add Python stack traces to SQL as comment strings. (boolean value) +# Deprecated group/name - [DEFAULT]/sql_connection_trace +#connection_trace = false + +# If set, use this value for pool_timeout with SQLAlchemy. (integer value) +# Deprecated group/name - [DATABASE]/sqlalchemy_pool_timeout +#pool_timeout = + +# Enable the experimental use of database reconnect on connection lost. (boolean +# value) +#use_db_reconnect = false + +# Seconds between retries of a database transaction. (integer value) +#db_retry_interval = 1 + +# If True, increases the interval between retries of a database operation up to +# db_max_retry_interval. (boolean value) +#db_inc_retry_interval = true + +# If db_inc_retry_interval is set, the maximum seconds between retries of a +# database operation. (integer value) +#db_max_retry_interval = 10 + +# Maximum retries in case of connection error or deadlock error before error is +# raised. Set to -1 to specify an infinite retry count. (integer value) +#db_max_retries = 20 + +# +# From oslo.db.concurrency +# + +# Enable the experimental use of thread pooling for all DB API calls (boolean +# value) +# Deprecated group/name - [DEFAULT]/dbapi_use_tpool +#use_tpool = false + + +[devices] + +# +# From nova.conf +# + +# +# A list of the vGPU types enabled in the compute node. +# +# Some pGPUs (e.g. NVIDIA GRID K1) support different vGPU types. User can use +# this option to specify a list of enabled vGPU types that may be assigned to a +# guest instance. But please note that Nova only supports a single type in the +# Queens release. If more than one vGPU type is specified (as a comma-separated +# list), only the first one will be used. An example is as the following: +# [devices] +# enabled_vgpu_types = GRID K100,Intel GVT-g,MxGPU.2,nvidia-11 +# (list value) +#enabled_vgpu_types = + + +[ephemeral_storage_encryption] + +# +# From nova.conf +# + +# +# Enables/disables LVM ephemeral storage encryption. +# (boolean value) +#enabled = false + +# +# Cipher-mode string to be used. +# +# The cipher and mode to be used to encrypt ephemeral storage. The set of +# cipher-mode combinations available depends on kernel support. According +# to the dm-crypt documentation, the cipher is expected to be in the format: +# "--". +# +# Possible values: +# +# * Any crypto option listed in ``/proc/crypto``. +# (string value) +#cipher = aes-xts-plain64 + +# +# Encryption key length in bits. +# +# The bit length of the encryption key to be used to encrypt ephemeral storage. +# In XTS mode only half of the bits are used for encryption key. +# (integer value) +# Minimum value: 1 +#key_size = 512 + + +[filter_scheduler] + +# +# From nova.conf +# + +# +# Size of subset of best hosts selected by scheduler. +# +# New instances will be scheduled on a host chosen randomly from a subset of the +# N best hosts, where N is the value set by this option. +# +# Setting this to a value greater than 1 will reduce the chance that multiple +# scheduler processes handling similar requests will select the same host, +# creating a potential race condition. By selecting a host randomly from the N +# hosts that best fit the request, the chance of a conflict is reduced. However, +# the higher you set this value, the less optimal the chosen host may be for a +# given request. +# +# This option is only used by the FilterScheduler and its subclasses; if you use +# a different scheduler, this option has no effect. +# +# Possible values: +# +# * An integer, where the integer corresponds to the size of a host subset. Any +# integer is valid, although any value less than 1 will be treated as 1 +# (integer value) +# Minimum value: 1 +# Deprecated group/name - [DEFAULT]/scheduler_host_subset_size +#host_subset_size = 1 + +# +# The number of instances that can be actively performing IO on a host. +# +# Instances performing IO includes those in the following states: build, resize, +# snapshot, migrate, rescue, unshelve. +# +# This option is only used by the FilterScheduler and its subclasses; if you use +# a different scheduler, this option has no effect. Also note that this setting +# only affects scheduling if the 'io_ops_filter' filter is enabled. +# +# Possible values: +# +# * An integer, where the integer corresponds to the max number of instances +# that can be actively performing IO on any given host. +# (integer value) +#max_io_ops_per_host = 8 + +# +# Maximum number of instances that be active on a host. +# +# If you need to limit the number of instances on any given host, set this +# option +# to the maximum number of instances you want to allow. The num_instances_filter +# will reject any host that has at least as many instances as this option's +# value. +# +# This option is only used by the FilterScheduler and its subclasses; if you use +# a different scheduler, this option has no effect. Also note that this setting +# only affects scheduling if the 'num_instances_filter' filter is enabled. +# +# Possible values: +# +# * An integer, where the integer corresponds to the max instances that can be +# scheduled on a host. +# (integer value) +# Minimum value: 1 +#max_instances_per_host = 50 + +# +# Enable querying of individual hosts for instance information. +# +# The scheduler may need information about the instances on a host in order to +# evaluate its filters and weighers. The most common need for this information +# is +# for the (anti-)affinity filters, which need to choose a host based on the +# instances already running on a host. +# +# If the configured filters and weighers do not need this information, disabling +# this option will improve performance. It may also be disabled when the +# tracking +# overhead proves too heavy, although this will cause classes requiring host +# usage data to query the database on each request instead. +# +# This option is only used by the FilterScheduler and its subclasses; if you use +# a different scheduler, this option has no effect. +# +# NOTE: In a multi-cell (v2) setup where the cell MQ is separated from the +# top-level, computes cannot directly communicate with the scheduler. Thus, +# this option cannot be enabled in that scenario. See also the +# [workarounds]/disable_group_policy_check_upcall option. +# (boolean value) +# Deprecated group/name - [DEFAULT]/scheduler_tracks_instance_changes +#track_instance_changes = true + +# +# Filters that the scheduler can use. +# +# An unordered list of the filter classes the nova scheduler may apply. Only +# the +# filters specified in the 'enabled_filters' option will be used, but +# any filter appearing in that option must also be included in this list. +# +# By default, this is set to all filters that are included with nova. +# +# This option is only used by the FilterScheduler and its subclasses; if you use +# a different scheduler, this option has no effect. +# +# Possible values: +# +# * A list of zero or more strings, where each string corresponds to the name of +# a filter that may be used for selecting a host +# +# Related options: +# +# * enabled_filters +# (multi valued) +# Deprecated group/name - [DEFAULT]/scheduler_available_filters +#available_filters = nova.scheduler.filters.all_filters + +# +# Filters that the scheduler will use. +# +# An ordered list of filter class names that will be used for filtering +# hosts. These filters will be applied in the order they are listed so +# place your most restrictive filters first to make the filtering process more +# efficient. +# +# This option is only used by the FilterScheduler and its subclasses; if you use +# a different scheduler, this option has no effect. +# +# Possible values: +# +# * A list of zero or more strings, where each string corresponds to the name of +# a filter to be used for selecting a host +# +# Related options: +# +# * All of the filters in this option *must* be present in the +# 'scheduler_available_filters' option, or a SchedulerHostFilterNotFound +# exception will be raised. +# (list value) +# Deprecated group/name - [DEFAULT]/scheduler_default_filters +#enabled_filters = RetryFilter,AvailabilityZoneFilter,ComputeFilter,ComputeCapabilitiesFilter,ImagePropertiesFilter,ServerGroupAntiAffinityFilter,ServerGroupAffinityFilter + +# DEPRECATED: +# Filters used for filtering baremetal hosts. +# +# Filters are applied in order, so place your most restrictive filters first to +# make the filtering process more efficient. +# +# This option is only used by the FilterScheduler and its subclasses; if you use +# a different scheduler, this option has no effect. +# +# Possible values: +# +# * A list of zero or more strings, where each string corresponds to the name of +# a filter to be used for selecting a baremetal host +# +# Related options: +# +# * If the 'scheduler_use_baremetal_filters' option is False, this option has +# no effect. +# (list value) +# Deprecated group/name - [DEFAULT]/baremetal_scheduler_default_filters +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: +# These filters were used to overcome some of the baremetal scheduling +# limitations in Nova prior to the use of the Placement API. Now scheduling will +# use the custom resource class defined for each baremetal node to make its +# selection. +#baremetal_enabled_filters = RetryFilter,AvailabilityZoneFilter,ComputeFilter,ComputeCapabilitiesFilter,ImagePropertiesFilter,ExactRamFilter,ExactDiskFilter,ExactCoreFilter + +# DEPRECATED: +# Enable baremetal filters. +# +# Set this to True to tell the nova scheduler that it should use the filters +# specified in the 'baremetal_enabled_filters' option. If you are not +# scheduling baremetal nodes, leave this at the default setting of False. +# +# This option is only used by the FilterScheduler and its subclasses; if you use +# a different scheduler, this option has no effect. +# +# Related options: +# +# * If this option is set to True, then the filters specified in the +# 'baremetal_enabled_filters' are used instead of the filters +# specified in 'enabled_filters'. +# (boolean value) +# Deprecated group/name - [DEFAULT]/scheduler_use_baremetal_filters +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: +# These filters were used to overcome some of the baremetal scheduling +# limitations in Nova prior to the use of the Placement API. Now scheduling will +# use the custom resource class defined for each baremetal node to make its +# selection. +#use_baremetal_filters = false + +# +# Weighers that the scheduler will use. +# +# Only hosts which pass the filters are weighed. The weight for any host starts +# at 0, and the weighers order these hosts by adding to or subtracting from the +# weight assigned by the previous weigher. Weights may become negative. An +# instance will be scheduled to one of the N most-weighted hosts, where N is +# 'scheduler_host_subset_size'. +# +# By default, this is set to all weighers that are included with Nova. +# +# This option is only used by the FilterScheduler and its subclasses; if you use +# a different scheduler, this option has no effect. +# +# Possible values: +# +# * A list of zero or more strings, where each string corresponds to the name of +# a weigher that will be used for selecting a host +# (list value) +# Deprecated group/name - [DEFAULT]/scheduler_weight_classes +#weight_classes = nova.scheduler.weights.all_weighers + +# +# Ram weight multipler ratio. +# +# This option determines how hosts with more or less available RAM are weighed. +# A +# positive value will result in the scheduler preferring hosts with more +# available RAM, and a negative number will result in the scheduler preferring +# hosts with less available RAM. Another way to look at it is that positive +# values for this option will tend to spread instances across many hosts, while +# negative values will tend to fill up (stack) hosts as much as possible before +# scheduling to a less-used host. The absolute value, whether positive or +# negative, controls how strong the RAM weigher is relative to other weighers. +# +# This option is only used by the FilterScheduler and its subclasses; if you use +# a different scheduler, this option has no effect. Also note that this setting +# only affects scheduling if the 'ram' weigher is enabled. +# +# Possible values: +# +# * An integer or float value, where the value corresponds to the multipler +# ratio for this weigher. +# (floating point value) +#ram_weight_multiplier = 1.0 + +# +# Disk weight multipler ratio. +# +# Multiplier used for weighing free disk space. Negative numbers mean to +# stack vs spread. +# +# This option is only used by the FilterScheduler and its subclasses; if you use +# a different scheduler, this option has no effect. Also note that this setting +# only affects scheduling if the 'disk' weigher is enabled. +# +# Possible values: +# +# * An integer or float value, where the value corresponds to the multipler +# ratio for this weigher. +# (floating point value) +#disk_weight_multiplier = 1.0 + +# +# IO operations weight multipler ratio. +# +# This option determines how hosts with differing workloads are weighed. +# Negative +# values, such as the default, will result in the scheduler preferring hosts +# with +# lighter workloads whereas positive values will prefer hosts with heavier +# workloads. Another way to look at it is that positive values for this option +# will tend to schedule instances onto hosts that are already busy, while +# negative values will tend to distribute the workload across more hosts. The +# absolute value, whether positive or negative, controls how strong the io_ops +# weigher is relative to other weighers. +# +# This option is only used by the FilterScheduler and its subclasses; if you use +# a different scheduler, this option has no effect. Also note that this setting +# only affects scheduling if the 'io_ops' weigher is enabled. +# +# Possible values: +# +# * An integer or float value, where the value corresponds to the multipler +# ratio for this weigher. +# (floating point value) +#io_ops_weight_multiplier = -1.0 + +# +# PCI device affinity weight multiplier. +# +# The PCI device affinity weighter computes a weighting based on the number of +# PCI devices on the host and the number of PCI devices requested by the +# instance. The ``NUMATopologyFilter`` filter must be enabled for this to have +# any significance. For more information, refer to the filter documentation: +# +# https://docs.openstack.org/nova/latest/user/filter-scheduler.html +# +# Possible values: +# +# * A positive integer or float value, where the value corresponds to the +# multiplier ratio for this weigher. +# (floating point value) +# Minimum value: 0 +#pci_weight_multiplier = 1.0 + +# +# Multiplier used for weighing hosts for group soft-affinity. +# +# Possible values: +# +# * An integer or float value, where the value corresponds to weight multiplier +# for hosts with group soft affinity. Only a positive value are meaningful, as +# negative values would make this behave as a soft anti-affinity weigher. +# (floating point value) +#soft_affinity_weight_multiplier = 1.0 + +# +# Multiplier used for weighing hosts for group soft-anti-affinity. +# +# Possible values: +# +# * An integer or float value, where the value corresponds to weight multiplier +# for hosts with group soft anti-affinity. Only a positive value are +# meaningful, as negative values would make this behave as a soft affinity +# weigher. +# (floating point value) +#soft_anti_affinity_weight_multiplier = 1.0 + +# +# Enable spreading the instances between hosts with the same best weight. +# +# Enabling it is beneficial for cases when host_subset_size is 1 +# (default), but there is a large number of hosts with same maximal weight. +# This scenario is common in Ironic deployments where there are typically many +# baremetal nodes with identical weights returned to the scheduler. +# In such case enabling this option will reduce contention and chances for +# rescheduling events. +# At the same time it will make the instance packing (even in unweighed case) +# less dense. +# (boolean value) +#shuffle_best_same_weighed_hosts = false + +# +# List of UUIDs for images that can only be run on certain hosts. +# +# If there is a need to restrict some images to only run on certain designated +# hosts, list those image UUIDs here. +# +# This option is only used by the FilterScheduler and its subclasses; if you use +# a different scheduler, this option has no effect. Also note that this setting +# only affects scheduling if the 'IsolatedHostsFilter' filter is enabled. +# +# Possible values: +# +# * A list of UUID strings, where each string corresponds to the UUID of an +# image +# +# Related options: +# +# * scheduler/isolated_hosts +# * scheduler/restrict_isolated_hosts_to_isolated_images +# (list value) +#isolated_images = + +# +# List of hosts that can only run certain images. +# +# If there is a need to restrict some images to only run on certain designated +# hosts, list those host names here. +# +# This option is only used by the FilterScheduler and its subclasses; if you use +# a different scheduler, this option has no effect. Also note that this setting +# only affects scheduling if the 'IsolatedHostsFilter' filter is enabled. +# +# Possible values: +# +# * A list of strings, where each string corresponds to the name of a host +# +# Related options: +# +# * scheduler/isolated_images +# * scheduler/restrict_isolated_hosts_to_isolated_images +# (list value) +#isolated_hosts = + +# +# Prevent non-isolated images from being built on isolated hosts. +# +# This option is only used by the FilterScheduler and its subclasses; if you use +# a different scheduler, this option has no effect. Also note that this setting +# only affects scheduling if the 'IsolatedHostsFilter' filter is enabled. Even +# then, this option doesn't affect the behavior of requests for isolated images, +# which will *always* be restricted to isolated hosts. +# +# Related options: +# +# * scheduler/isolated_images +# * scheduler/isolated_hosts +# (boolean value) +#restrict_isolated_hosts_to_isolated_images = true + +# +# Image property namespace for use in the host aggregate. +# +# Images and hosts can be configured so that certain images can only be +# scheduled +# to hosts in a particular aggregate. This is done with metadata values set on +# the host aggregate that are identified by beginning with the value of this +# option. If the host is part of an aggregate with such a metadata key, the +# image +# in the request spec must have the value of that metadata in its properties in +# order for the scheduler to consider the host as acceptable. +# +# This option is only used by the FilterScheduler and its subclasses; if you use +# a different scheduler, this option has no effect. Also note that this setting +# only affects scheduling if the 'aggregate_image_properties_isolation' filter +# is +# enabled. +# +# Possible values: +# +# * A string, where the string corresponds to an image property namespace +# +# Related options: +# +# * aggregate_image_properties_isolation_separator +# (string value) +#aggregate_image_properties_isolation_namespace = + +# +# Separator character(s) for image property namespace and name. +# +# When using the aggregate_image_properties_isolation filter, the relevant +# metadata keys are prefixed with the namespace defined in the +# aggregate_image_properties_isolation_namespace configuration option plus a +# separator. This option defines the separator to be used. +# +# This option is only used by the FilterScheduler and its subclasses; if you use +# a different scheduler, this option has no effect. Also note that this setting +# only affects scheduling if the 'aggregate_image_properties_isolation' filter +# is enabled. +# +# Possible values: +# +# * A string, where the string corresponds to an image property namespace +# separator character +# +# Related options: +# +# * aggregate_image_properties_isolation_namespace +# (string value) +#aggregate_image_properties_isolation_separator = . + + +[glance] +api_servers = http://controller:9292 +# Configuration options for the Image service + +# +# From nova.conf +# + +# +# List of glance api servers endpoints available to nova. +# +# https is used for ssl-based glance api servers. +# +# NOTE: The preferred mechanism for endpoint discovery is via keystoneauth1 +# loading options. Only use api_servers if you need multiple endpoints and are +# unable to use a load balancer for some reason. +# +# Possible values: +# +# * A list of any fully qualified url of the form +# "scheme://hostname:port[/path]" +# (i.e. "http://10.0.1.0:9292" or "https://my.glance.server/image"). +# (list value) +#api_servers = + +# +# Enable glance operation retries. +# +# Specifies the number of retries when uploading / downloading +# an image to / from glance. 0 means no retries. +# (integer value) +# Minimum value: 0 +#num_retries = 0 + +# DEPRECATED: +# List of url schemes that can be directly accessed. +# +# This option specifies a list of url schemes that can be downloaded +# directly via the direct_url. This direct_URL can be fetched from +# Image metadata which can be used by nova to get the +# image more efficiently. nova-compute could benefit from this by +# invoking a copy when it has access to the same file system as glance. +# +# Possible values: +# +# * [file], Empty list (default) +# (list value) +# This option is deprecated for removal since 17.0.0. +# Its value may be silently ignored in the future. +# Reason: +# This was originally added for the 'nova.image.download.file' FileTransfer +# extension which was removed in the 16.0.0 Pike release. The +# 'nova.image.download.modules' extension point is not maintained +# and there is no indication of its use in production clouds. +#allowed_direct_url_schemes = + +# +# Enable image signature verification. +# +# nova uses the image signature metadata from glance and verifies the signature +# of a signed image while downloading that image. If the image signature cannot +# be verified or if the image signature metadata is either incomplete or +# unavailable, then nova will not boot the image and instead will place the +# instance into an error state. This provides end users with stronger assurances +# of the integrity of the image data they are using to create servers. +# +# Related options: +# +# * The options in the `key_manager` group, as the key_manager is used +# for the signature validation. +# * Both enable_certificate_validation and default_trusted_certificate_ids +# below depend on this option being enabled. +# (boolean value) +#verify_glance_signatures = false + +# DEPRECATED: +# Enable certificate validation for image signature verification. +# +# During image signature verification nova will first verify the validity of the +# image's signing certificate using the set of trusted certificates associated +# with the instance. If certificate validation fails, signature verification +# will not be performed and the image will be placed into an error state. This +# provides end users with stronger assurances that the image data is unmodified +# and trustworthy. If left disabled, image signature verification can still +# occur but the end user will not have any assurance that the signing +# certificate used to generate the image signature is still trustworthy. +# +# Related options: +# +# * This option only takes effect if verify_glance_signatures is enabled. +# * The value of default_trusted_certificate_ids may be used when this option +# is enabled. +# (boolean value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# This option is intended to ease the transition for deployments leveraging +# image signature verification. The intended state long-term is for signature +# verification and certificate validation to always happen together. +#enable_certificate_validation = false + +# +# List of certificate IDs for certificates that should be trusted. +# +# May be used as a default list of trusted certificate IDs for certificate +# validation. The value of this option will be ignored if the user provides a +# list of trusted certificate IDs with an instance API request. The value of +# this option will be persisted with the instance data if signature verification +# and certificate validation are enabled and if the user did not provide an +# alternative list. If left empty when certificate validation is enabled the +# user must provide a list of trusted certificate IDs otherwise certificate +# validation will fail. +# +# Related options: +# +# * The value of this option may be used if both verify_glance_signatures and +# enable_certificate_validation are enabled. +# (list value) +#default_trusted_certificate_ids = + +# Enable or disable debug logging with glanceclient. (boolean value) +#debug = false + +# PEM encoded Certificate Authority to use when verifying HTTPs connections. +# (string value) +#cafile = + +# PEM encoded client certificate cert file (string value) +#certfile = + +# PEM encoded client certificate key file (string value) +#keyfile = + +# Verify HTTPS connections. (boolean value) +#insecure = false + +# Timeout value for http requests (integer value) +#timeout = + +# The default service_type for endpoint URL discovery. (string value) +#service_type = image + +# The default service_name for endpoint URL discovery. (string value) +#service_name = + +# List of interfaces, in order of preference, for endpoint URL. (list value) +#valid_interfaces = internal,public + +# The default region_name for endpoint URL discovery. (string value) +#region_name = + +# Always use this endpoint URL for requests for this client. NOTE: The +# unversioned endpoint should be specified here; to request a particular API +# version, use the `version`, `min-version`, and/or `max-version` options. +# (string value) +#endpoint_override = + + +[guestfs] +# +# libguestfs is a set of tools for accessing and modifying virtual +# machine (VM) disk images. You can use this for viewing and editing +# files inside guests, scripting changes to VMs, monitoring disk +# used/free statistics, creating guests, P2V, V2V, performing backups, +# cloning VMs, building VMs, formatting disks and resizing disks. + +# +# From nova.conf +# + +# +# Enable/disables guestfs logging. +# +# This configures guestfs to debug messages and push them to OpenStack +# logging system. When set to True, it traces libguestfs API calls and +# enable verbose debug messages. In order to use the above feature, +# "libguestfs" package must be installed. +# +# Related options: +# Since libguestfs access and modifies VM's managed by libvirt, below options +# should be set to give access to those VM's. +# * libvirt.inject_key +# * libvirt.inject_partition +# * libvirt.inject_password +# (boolean value) +#debug = false + + +[healthcheck] + +# +# From oslo.middleware +# + +# DEPRECATED: The path to respond to healtcheck requests on. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +#path = /healthcheck + +# Show more detailed information as part of the response (boolean value) +#detailed = false + +# Additional backends that can perform health checks and report that information +# back as part of a request. (list value) +#backends = + +# Check the presence of a file to determine if an application is running on a +# port. Used by DisableByFileHealthcheck plugin. (string value) +#disable_by_file_path = + +# Check the presence of a file based on a port to determine if an application is +# running on a port. Expects a "port:path" list of strings. Used by +# DisableByFilesPortsHealthcheck plugin. (list value) +#disable_by_file_paths = + + +[hyperv] +# +# The hyperv feature allows you to configure the Hyper-V hypervisor +# driver to be used within an OpenStack deployment. + +# +# From nova.conf +# + +# +# Dynamic memory ratio +# +# Enables dynamic memory allocation (ballooning) when set to a value +# greater than 1. The value expresses the ratio between the total RAM +# assigned to an instance and its startup RAM amount. For example a +# ratio of 2.0 for an instance with 1024MB of RAM implies 512MB of +# RAM allocated at startup. +# +# Possible values: +# +# * 1.0: Disables dynamic memory allocation (Default). +# * Float values greater than 1.0: Enables allocation of total implied +# RAM divided by this value for startup. +# (floating point value) +#dynamic_memory_ratio = 1.0 + +# +# Enable instance metrics collection +# +# Enables metrics collections for an instance by using Hyper-V's +# metric APIs. Collected data can be retrieved by other apps and +# services, e.g.: Ceilometer. +# (boolean value) +#enable_instance_metrics_collection = false + +# +# Instances path share +# +# The name of a Windows share mapped to the "instances_path" dir +# and used by the resize feature to copy files to the target host. +# If left blank, an administrative share (hidden network share) will +# be used, looking for the same "instances_path" used locally. +# +# Possible values: +# +# * "": An administrative share will be used (Default). +# * Name of a Windows share. +# +# Related options: +# +# * "instances_path": The directory which will be used if this option +# here is left blank. +# (string value) +#instances_path_share = + +# +# Limit CPU features +# +# This flag is needed to support live migration to hosts with +# different CPU features and checked during instance creation +# in order to limit the CPU features used by the instance. +# (boolean value) +#limit_cpu_features = false + +# +# Mounted disk query retry count +# +# The number of times to retry checking for a mounted disk. +# The query runs until the device can be found or the retry +# count is reached. +# +# Possible values: +# +# * Positive integer values. Values greater than 1 is recommended +# (Default: 10). +# +# Related options: +# +# * Time interval between disk mount retries is declared with +# "mounted_disk_query_retry_interval" option. +# (integer value) +# Minimum value: 0 +#mounted_disk_query_retry_count = 10 + +# +# Mounted disk query retry interval +# +# Interval between checks for a mounted disk, in seconds. +# +# Possible values: +# +# * Time in seconds (Default: 5). +# +# Related options: +# +# * This option is meaningful when the mounted_disk_query_retry_count +# is greater than 1. +# * The retry loop runs with mounted_disk_query_retry_count and +# mounted_disk_query_retry_interval configuration options. +# (integer value) +# Minimum value: 0 +#mounted_disk_query_retry_interval = 5 + +# +# Power state check timeframe +# +# The timeframe to be checked for instance power state changes. +# This option is used to fetch the state of the instance from Hyper-V +# through the WMI interface, within the specified timeframe. +# +# Possible values: +# +# * Timeframe in seconds (Default: 60). +# (integer value) +# Minimum value: 0 +#power_state_check_timeframe = 60 + +# +# Power state event polling interval +# +# Instance power state change event polling frequency. Sets the +# listener interval for power state events to the given value. +# This option enhances the internal lifecycle notifications of +# instances that reboot themselves. It is unlikely that an operator +# has to change this value. +# +# Possible values: +# +# * Time in seconds (Default: 2). +# (integer value) +# Minimum value: 0 +#power_state_event_polling_interval = 2 + +# +# qemu-img command +# +# qemu-img is required for some of the image related operations +# like converting between different image types. You can get it +# from here: (http://qemu.weilnetz.de/) or you can install the +# Cloudbase OpenStack Hyper-V Compute Driver +# (https://cloudbase.it/openstack-hyperv-driver/) which automatically +# sets the proper path for this config option. You can either give the +# full path of qemu-img.exe or set its path in the PATH environment +# variable and leave this option to the default value. +# +# Possible values: +# +# * Name of the qemu-img executable, in case it is in the same +# directory as the nova-compute service or its path is in the +# PATH environment variable (Default). +# * Path of qemu-img command (DRIVELETTER:\PATH\TO\QEMU-IMG\COMMAND). +# +# Related options: +# +# * If the config_drive_cdrom option is False, qemu-img will be used to +# convert the ISO to a VHD, otherwise the configuration drive will +# remain an ISO. To use configuration drive with Hyper-V, you must +# set the mkisofs_cmd value to the full path to an mkisofs.exe +# installation. +# (string value) +#qemu_img_cmd = qemu-img.exe + +# +# External virtual switch name +# +# The Hyper-V Virtual Switch is a software-based layer-2 Ethernet +# network switch that is available with the installation of the +# Hyper-V server role. The switch includes programmatically managed +# and extensible capabilities to connect virtual machines to both +# virtual networks and the physical network. In addition, Hyper-V +# Virtual Switch provides policy enforcement for security, isolation, +# and service levels. The vSwitch represented by this config option +# must be an external one (not internal or private). +# +# Possible values: +# +# * If not provided, the first of a list of available vswitches +# is used. This list is queried using WQL. +# * Virtual switch name. +# (string value) +#vswitch_name = + +# +# Wait soft reboot seconds +# +# Number of seconds to wait for instance to shut down after soft +# reboot request is made. We fall back to hard reboot if instance +# does not shutdown within this window. +# +# Possible values: +# +# * Time in seconds (Default: 60). +# (integer value) +# Minimum value: 0 +#wait_soft_reboot_seconds = 60 + +# +# Configuration drive cdrom +# +# OpenStack can be configured to write instance metadata to +# a configuration drive, which is then attached to the +# instance before it boots. The configuration drive can be +# attached as a disk drive (default) or as a CD drive. +# +# Possible values: +# +# * True: Attach the configuration drive image as a CD drive. +# * False: Attach the configuration drive image as a disk drive (Default). +# +# Related options: +# +# * This option is meaningful with force_config_drive option set to 'True' +# or when the REST API call to create an instance will have +# '--config-drive=True' flag. +# * config_drive_format option must be set to 'iso9660' in order to use +# CD drive as the configuration drive image. +# * To use configuration drive with Hyper-V, you must set the +# mkisofs_cmd value to the full path to an mkisofs.exe installation. +# Additionally, you must set the qemu_img_cmd value to the full path +# to an qemu-img command installation. +# * You can configure the Compute service to always create a configuration +# drive by setting the force_config_drive option to 'True'. +# (boolean value) +#config_drive_cdrom = false + +# +# Configuration drive inject password +# +# Enables setting the admin password in the configuration drive image. +# +# Related options: +# +# * This option is meaningful when used with other options that enable +# configuration drive usage with Hyper-V, such as force_config_drive. +# * Currently, the only accepted config_drive_format is 'iso9660'. +# (boolean value) +#config_drive_inject_password = false + +# +# Volume attach retry count +# +# The number of times to retry attaching a volume. Volume attachment +# is retried until success or the given retry count is reached. +# +# Possible values: +# +# * Positive integer values (Default: 10). +# +# Related options: +# +# * Time interval between attachment attempts is declared with +# volume_attach_retry_interval option. +# (integer value) +# Minimum value: 0 +#volume_attach_retry_count = 10 + +# +# Volume attach retry interval +# +# Interval between volume attachment attempts, in seconds. +# +# Possible values: +# +# * Time in seconds (Default: 5). +# +# Related options: +# +# * This options is meaningful when volume_attach_retry_count +# is greater than 1. +# * The retry loop runs with volume_attach_retry_count and +# volume_attach_retry_interval configuration options. +# (integer value) +# Minimum value: 0 +#volume_attach_retry_interval = 5 + +# +# Enable RemoteFX feature +# +# This requires at least one DirectX 11 capable graphics adapter for +# Windows / Hyper-V Server 2012 R2 or newer and RDS-Virtualization +# feature has to be enabled. +# +# Instances with RemoteFX can be requested with the following flavor +# extra specs: +# +# **os:resolution**. Guest VM screen resolution size. Acceptable values:: +# +# 1024x768, 1280x1024, 1600x1200, 1920x1200, 2560x1600, 3840x2160 +# +# ``3840x2160`` is only available on Windows / Hyper-V Server 2016. +# +# **os:monitors**. Guest VM number of monitors. Acceptable values:: +# +# [1, 4] - Windows / Hyper-V Server 2012 R2 +# [1, 8] - Windows / Hyper-V Server 2016 +# +# **os:vram**. Guest VM VRAM amount. Only available on +# Windows / Hyper-V Server 2016. Acceptable values:: +# +# 64, 128, 256, 512, 1024 +# (boolean value) +#enable_remotefx = false + +# +# Use multipath connections when attaching iSCSI or FC disks. +# +# This requires the Multipath IO Windows feature to be enabled. MPIO must be +# configured to claim such devices. +# (boolean value) +#use_multipath_io = false + +# +# List of iSCSI initiators that will be used for estabilishing iSCSI sessions. +# +# If none are specified, the Microsoft iSCSI initiator service will choose the +# initiator. +# (list value) +#iscsi_initiator_list = + + +[ironic] +# +# Configuration options for Ironic driver (Bare Metal). +# If using the Ironic driver following options must be set: +# * auth_type +# * auth_url +# * project_name +# * username +# * password +# * project_domain_id or project_domain_name +# * user_domain_id or user_domain_name + +# +# From nova.conf +# + +# DEPRECATED: URL override for the Ironic API endpoint. (uri value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Endpoint lookup uses the service catalog via common keystoneauth1 +# Adapter configuration options. In the current release, api_endpoint will +# override this behavior, but will be ignored and/or removed in a future +# release. To achieve the same result, use the endpoint_override option instead. +#api_endpoint = http://ironic.example.org:6385/ + +# +# The number of times to retry when a request conflicts. +# If set to 0, only try once, no retries. +# +# Related options: +# +# * api_retry_interval +# (integer value) +# Minimum value: 0 +#api_max_retries = 60 + +# +# The number of seconds to wait before retrying the request. +# +# Related options: +# +# * api_max_retries +# (integer value) +# Minimum value: 0 +#api_retry_interval = 2 + +# Timeout (seconds) to wait for node serial console state changed. Set to 0 to +# disable timeout. (integer value) +# Minimum value: 0 +#serial_console_state_timeout = 10 + +# PEM encoded Certificate Authority to use when verifying HTTPs connections. +# (string value) +#cafile = + +# PEM encoded client certificate cert file (string value) +#certfile = + +# PEM encoded client certificate key file (string value) +#keyfile = + +# Verify HTTPS connections. (boolean value) +#insecure = false + +# Timeout value for http requests (integer value) +#timeout = + +# Authentication type to load (string value) +# Deprecated group/name - [ironic]/auth_plugin +#auth_type = + +# Config Section from which to load plugin specific options (string value) +#auth_section = + +# Authentication URL (string value) +#auth_url = + +# Scope for system operations (string value) +#system_scope = + +# Domain ID to scope to (string value) +#domain_id = + +# Domain name to scope to (string value) +#domain_name = + +# Project ID to scope to (string value) +#project_id = + +# Project name to scope to (string value) +#project_name = + +# Domain ID containing project (string value) +#project_domain_id = + +# Domain name containing project (string value) +#project_domain_name = + +# Trust ID (string value) +#trust_id = + +# User ID (string value) +#user_id = + +# Username (string value) +# Deprecated group/name - [ironic]/user_name +#username = + +# User's domain id (string value) +#user_domain_id = + +# User's domain name (string value) +#user_domain_name = + +# User's password (string value) +#password = + +# The default service_type for endpoint URL discovery. (string value) +#service_type = baremetal + +# The default service_name for endpoint URL discovery. (string value) +#service_name = + +# List of interfaces, in order of preference, for endpoint URL. (list value) +#valid_interfaces = internal,public + +# The default region_name for endpoint URL discovery. (string value) +#region_name = + +# Always use this endpoint URL for requests for this client. NOTE: The +# unversioned endpoint should be specified here; to request a particular API +# version, use the `version`, `min-version`, and/or `max-version` options. +# (string value) +# Deprecated group/name - [ironic]/api_endpoint +#endpoint_override = + + +[key_manager] + +# +# From nova.conf +# + +# +# Fixed key returned by key manager, specified in hex. +# +# Possible values: +# +# * Empty string or a key in hex value +# (string value) +#fixed_key = + +# Specify the key manager implementation. Options are "barbican" and "vault". +# Default is "barbican". Will support the values earlier set using +# [key_manager]/api_class for some time. (string value) +# Deprecated group/name - [key_manager]/api_class +#backend = barbican + +# The type of authentication credential to create. Possible values are 'token', +# 'password', 'keystone_token', and 'keystone_password'. Required if no context +# is passed to the credential factory. (string value) +#auth_type = + +# Token for authentication. Required for 'token' and 'keystone_token' auth_type +# if no context is passed to the credential factory. (string value) +#token = + +# Username for authentication. Required for 'password' auth_type. Optional for +# the 'keystone_password' auth_type. (string value) +#username = + +# Password for authentication. Required for 'password' and 'keystone_password' +# auth_type. (string value) +#password = + +# Use this endpoint to connect to Keystone. (string value) +#auth_url = + +# User ID for authentication. Optional for 'keystone_token' and +# 'keystone_password' auth_type. (string value) +#user_id = + +# User's domain ID for authentication. Optional for 'keystone_token' and +# 'keystone_password' auth_type. (string value) +#user_domain_id = + +# User's domain name for authentication. Optional for 'keystone_token' and +# 'keystone_password' auth_type. (string value) +#user_domain_name = + +# Trust ID for trust scoping. Optional for 'keystone_token' and +# 'keystone_password' auth_type. (string value) +#trust_id = + +# Domain ID for domain scoping. Optional for 'keystone_token' and +# 'keystone_password' auth_type. (string value) +#domain_id = + +# Domain name for domain scoping. Optional for 'keystone_token' and +# 'keystone_password' auth_type. (string value) +#domain_name = + +# Project ID for project scoping. Optional for 'keystone_token' and +# 'keystone_password' auth_type. (string value) +#project_id = + +# Project name for project scoping. Optional for 'keystone_token' and +# 'keystone_password' auth_type. (string value) +#project_name = + +# Project's domain ID for project. Optional for 'keystone_token' and +# 'keystone_password' auth_type. (string value) +#project_domain_id = + +# Project's domain name for project. Optional for 'keystone_token' and +# 'keystone_password' auth_type. (string value) +#project_domain_name = + +# Allow fetching a new token if the current one is going to expire. Optional for +# 'keystone_token' and 'keystone_password' auth_type. (boolean value) +#reauthenticate = true + + +[keystone] +# Configuration options for the identity service + +# +# From nova.conf +# + +# PEM encoded Certificate Authority to use when verifying HTTPs connections. +# (string value) +#cafile = + +# PEM encoded client certificate cert file (string value) +#certfile = + +# PEM encoded client certificate key file (string value) +#keyfile = + +# Verify HTTPS connections. (boolean value) +#insecure = false + +# Timeout value for http requests (integer value) +#timeout = + +# The default service_type for endpoint URL discovery. (string value) +#service_type = identity + +# The default service_name for endpoint URL discovery. (string value) +#service_name = + +# List of interfaces, in order of preference, for endpoint URL. (list value) +#valid_interfaces = internal,public + +# The default region_name for endpoint URL discovery. (string value) +#region_name = + +# Always use this endpoint URL for requests for this client. NOTE: The +# unversioned endpoint should be specified here; to request a particular API +# version, use the `version`, `min-version`, and/or `max-version` options. +# (string value) +#endpoint_override = + + +[keystone_authtoken] +password = nova_user_secret +username = nova +project_name = service +user_domain_name = default +project_domain_name = default +auth_type = password +memcached_servers = controller:11211 +auth_url = http://controller:5000 +auth_uri = http://controller:5000 + +# +# From keystonemiddleware.auth_token +# + +# Complete "public" Identity API endpoint. This endpoint should not be an +# "admin" endpoint, as it should be accessible by all end users. Unauthenticated +# clients are redirected to this endpoint to authenticate. Although this +# endpoint should ideally be unversioned, client support in the wild varies. If +# you're using a versioned v2 endpoint here, then this should *not* be the same +# endpoint the service user utilizes for validating tokens, because normal end +# users may not be able to reach that endpoint. (string value) +# Deprecated group/name - [keystone_authtoken]/auth_uri +#www_authenticate_uri = + +# DEPRECATED: Complete "public" Identity API endpoint. This endpoint should not +# be an "admin" endpoint, as it should be accessible by all end users. +# Unauthenticated clients are redirected to this endpoint to authenticate. +# Although this endpoint should ideally be unversioned, client support in the +# wild varies. If you're using a versioned v2 endpoint here, then this should +# *not* be the same endpoint the service user utilizes for validating tokens, +# because normal end users may not be able to reach that endpoint. This option +# is deprecated in favor of www_authenticate_uri and will be removed in the S +# release. (string value) +# This option is deprecated for removal since Queens. +# Its value may be silently ignored in the future. +# Reason: The auth_uri option is deprecated in favor of www_authenticate_uri and +# will be removed in the S release. +#auth_uri = + +# API version of the admin Identity API endpoint. (string value) +#auth_version = + +# Do not handle authorization requests within the middleware, but delegate the +# authorization decision to downstream WSGI components. (boolean value) +#delay_auth_decision = false + +# Request timeout value for communicating with Identity API server. (integer +# value) +#http_connect_timeout = + +# How many times are we trying to reconnect when communicating with Identity API +# Server. (integer value) +#http_request_max_retries = 3 + +# Request environment key where the Swift cache object is stored. When +# auth_token middleware is deployed with a Swift cache, use this option to have +# the middleware share a caching backend with swift. Otherwise, use the +# ``memcached_servers`` option instead. (string value) +#cache = + +# Required if identity server requires client certificate (string value) +#certfile = + +# Required if identity server requires client certificate (string value) +#keyfile = + +# A PEM encoded Certificate Authority to use when verifying HTTPs connections. +# Defaults to system CAs. (string value) +#cafile = + +# Verify HTTPS connections. (boolean value) +#insecure = false + +# The region in which the identity server can be found. (string value) +#region_name = + +# DEPRECATED: Directory used to cache files related to PKI tokens. This option +# has been deprecated in the Ocata release and will be removed in the P release. +# (string value) +# This option is deprecated for removal since Ocata. +# Its value may be silently ignored in the future. +# Reason: PKI token format is no longer supported. +#signing_dir = + +# Optionally specify a list of memcached server(s) to use for caching. If left +# undefined, tokens will instead be cached in-process. (list value) +# Deprecated group/name - [keystone_authtoken]/memcache_servers +#memcached_servers = + +# In order to prevent excessive effort spent validating tokens, the middleware +# caches previously-seen tokens for a configurable duration (in seconds). Set to +# -1 to disable caching completely. (integer value) +#token_cache_time = 300 + +# DEPRECATED: Determines the frequency at which the list of revoked tokens is +# retrieved from the Identity service (in seconds). A high number of revocation +# events combined with a low cache duration may significantly reduce +# performance. Only valid for PKI tokens. This option has been deprecated in the +# Ocata release and will be removed in the P release. (integer value) +# This option is deprecated for removal since Ocata. +# Its value may be silently ignored in the future. +# Reason: PKI token format is no longer supported. +#revocation_cache_time = 10 + +# (Optional) If defined, indicate whether token data should be authenticated or +# authenticated and encrypted. If MAC, token data is authenticated (with HMAC) +# in the cache. If ENCRYPT, token data is encrypted and authenticated in the +# cache. If the value is not one of these options or empty, auth_token will +# raise an exception on initialization. (string value) +# Possible values: +# None - +# MAC - +# ENCRYPT - +#memcache_security_strategy = None + +# (Optional, mandatory if memcache_security_strategy is defined) This string is +# used for key derivation. (string value) +#memcache_secret_key = + +# (Optional) Number of seconds memcached server is considered dead before it is +# tried again. (integer value) +#memcache_pool_dead_retry = 300 + +# (Optional) Maximum total number of open connections to every memcached server. +# (integer value) +#memcache_pool_maxsize = 10 + +# (Optional) Socket timeout in seconds for communicating with a memcached +# server. (integer value) +#memcache_pool_socket_timeout = 3 + +# (Optional) Number of seconds a connection to memcached is held unused in the +# pool before it is closed. (integer value) +#memcache_pool_unused_timeout = 60 + +# (Optional) Number of seconds that an operation will wait to get a memcached +# client connection from the pool. (integer value) +#memcache_pool_conn_get_timeout = 10 + +# (Optional) Use the advanced (eventlet safe) memcached client pool. The +# advanced pool will only work under python 2.x. (boolean value) +#memcache_use_advanced_pool = false + +# (Optional) Indicate whether to set the X-Service-Catalog header. If False, +# middleware will not ask for service catalog on token validation and will not +# set the X-Service-Catalog header. (boolean value) +#include_service_catalog = true + +# Used to control the use and type of token binding. Can be set to: "disabled" +# to not check token binding. "permissive" (default) to validate binding +# information if the bind type is of a form known to the server and ignore it if +# not. "strict" like "permissive" but if the bind type is unknown the token will +# be rejected. "required" any form of token binding is needed to be allowed. +# Finally the name of a binding method that must be present in tokens. (string +# value) +#enforce_token_bind = permissive + +# DEPRECATED: If true, the revocation list will be checked for cached tokens. +# This requires that PKI tokens are configured on the identity server. (boolean +# value) +# This option is deprecated for removal since Ocata. +# Its value may be silently ignored in the future. +# Reason: PKI token format is no longer supported. +#check_revocations_for_cached = false + +# DEPRECATED: Hash algorithms to use for hashing PKI tokens. This may be a +# single algorithm or multiple. The algorithms are those supported by Python +# standard hashlib.new(). The hashes will be tried in the order given, so put +# the preferred one first for performance. The result of the first hash will be +# stored in the cache. This will typically be set to multiple values only while +# migrating from a less secure algorithm to a more secure one. Once all the old +# tokens are expired this option should be set to a single value for better +# performance. (list value) +# This option is deprecated for removal since Ocata. +# Its value may be silently ignored in the future. +# Reason: PKI token format is no longer supported. +#hash_algorithms = md5 + +# A choice of roles that must be present in a service token. Service tokens are +# allowed to request that an expired token can be used and so this check should +# tightly control that only actual services should be sending this token. Roles +# here are applied as an ANY check so any role in this list must be present. For +# backwards compatibility reasons this currently only affects the allow_expired +# check. (list value) +#service_token_roles = service + +# For backwards compatibility reasons we must let valid service tokens pass that +# don't pass the service_token_roles check as valid. Setting this true will +# become the default in a future release and should be enabled if possible. +# (boolean value) +#service_token_roles_required = false + +# Prefix to prepend at the beginning of the path. Deprecated, use identity_uri. +# (string value) +#auth_admin_prefix = + +# Host providing the admin Identity API endpoint. Deprecated, use identity_uri. +# (string value) +#auth_host = 127.0.0.1 + +# Port of the admin Identity API endpoint. Deprecated, use identity_uri. +# (integer value) +#auth_port = 35357 + +# Protocol of the admin Identity API endpoint. Deprecated, use identity_uri. +# (string value) +# Possible values: +# http - +# https - +#auth_protocol = https + +# Complete admin Identity API endpoint. This should specify the unversioned root +# endpoint e.g. https://localhost:35357/ (string value) +#identity_uri = + +# This option is deprecated and may be removed in a future release. Single +# shared secret with the Keystone configuration used for bootstrapping a +# Keystone installation, or otherwise bypassing the normal authentication +# process. This option should not be used, use `admin_user` and `admin_password` +# instead. (string value) +#admin_token = + +# Service username. (string value) +#admin_user = + +# Service user password. (string value) +#admin_password = + +# Service tenant name. (string value) +#admin_tenant_name = admin + +# Authentication type to load (string value) +# Deprecated group/name - [keystone_authtoken]/auth_plugin +#auth_type = + +# Config Section from which to load plugin specific options (string value) +#auth_section = + + +[libvirt] +# +# Libvirt options allows cloud administrator to configure related +# libvirt hypervisor driver to be used within an OpenStack deployment. +# +# Almost all of the libvirt config options are influence by ``virt_type`` config +# which describes the virtualization type (or so called domain type) libvirt +# should use for specific features such as live migration, snapshot. + +# +# From nova.conf +# + +# +# The ID of the image to boot from to rescue data from a corrupted instance. +# +# If the rescue REST API operation doesn't provide an ID of an image to +# use, the image which is referenced by this ID is used. If this +# option is not set, the image from the instance is used. +# +# Possible values: +# +# * An ID of an image or nothing. If it points to an *Amazon Machine +# Image* (AMI), consider to set the config options ``rescue_kernel_id`` +# and ``rescue_ramdisk_id`` too. If nothing is set, the image of the instance +# is used. +# +# Related options: +# +# * ``rescue_kernel_id``: If the chosen rescue image allows the separate +# definition of its kernel disk, the value of this option is used, +# if specified. This is the case when *Amazon*'s AMI/AKI/ARI image +# format is used for the rescue image. +# * ``rescue_ramdisk_id``: If the chosen rescue image allows the separate +# definition of its RAM disk, the value of this option is used if, +# specified. This is the case when *Amazon*'s AMI/AKI/ARI image +# format is used for the rescue image. +# (string value) +#rescue_image_id = + +# +# The ID of the kernel (AKI) image to use with the rescue image. +# +# If the chosen rescue image allows the separate definition of its kernel +# disk, the value of this option is used, if specified. This is the case +# when *Amazon*'s AMI/AKI/ARI image format is used for the rescue image. +# +# Possible values: +# +# * An ID of an kernel image or nothing. If nothing is specified, the kernel +# disk from the instance is used if it was launched with one. +# +# Related options: +# +# * ``rescue_image_id``: If that option points to an image in *Amazon*'s +# AMI/AKI/ARI image format, it's useful to use ``rescue_kernel_id`` too. +# (string value) +#rescue_kernel_id = + +# +# The ID of the RAM disk (ARI) image to use with the rescue image. +# +# If the chosen rescue image allows the separate definition of its RAM +# disk, the value of this option is used, if specified. This is the case +# when *Amazon*'s AMI/AKI/ARI image format is used for the rescue image. +# +# Possible values: +# +# * An ID of a RAM disk image or nothing. If nothing is specified, the RAM +# disk from the instance is used if it was launched with one. +# +# Related options: +# +# * ``rescue_image_id``: If that option points to an image in *Amazon*'s +# AMI/AKI/ARI image format, it's useful to use ``rescue_ramdisk_id`` too. +# (string value) +#rescue_ramdisk_id = + +# +# Describes the virtualization type (or so called domain type) libvirt should +# use. +# +# The choice of this type must match the underlying virtualization strategy +# you have chosen for this host. +# +# Possible values: +# +# * See the predefined set of case-sensitive values. +# +# Related options: +# +# * ``connection_uri``: depends on this +# * ``disk_prefix``: depends on this +# * ``cpu_mode``: depends on this +# * ``cpu_model``: depends on this +# (string value) +# Possible values: +# kvm - +# lxc - +# qemu - +# uml - +# xen - +# parallels - +#virt_type = kvm + +# +# Overrides the default libvirt URI of the chosen virtualization type. +# +# If set, Nova will use this URI to connect to libvirt. +# +# Possible values: +# +# * An URI like ``qemu:///system`` or ``xen+ssh://oirase/`` for example. +# This is only necessary if the URI differs to the commonly known URIs +# for the chosen virtualization type. +# +# Related options: +# +# * ``virt_type``: Influences what is used as default value here. +# (string value) +#connection_uri = + +# +# Allow the injection of an admin password for instance only at ``create`` and +# ``rebuild`` process. +# +# There is no agent needed within the image to do this. If *libguestfs* is +# available on the host, it will be used. Otherwise *nbd* is used. The file +# system of the image will be mounted and the admin password, which is provided +# in the REST API call will be injected as password for the root user. If no +# root user is available, the instance won't be launched and an error is thrown. +# Be aware that the injection is *not* possible when the instance gets launched +# from a volume. +# +# Possible values: +# +# * True: Allows the injection. +# * False (default): Disallows the injection. Any via the REST API provided +# admin password will be silently ignored. +# +# Related options: +# +# * ``inject_partition``: That option will decide about the discovery and usage +# of the file system. It also can disable the injection at all. +# (boolean value) +#inject_password = false + +# +# Allow the injection of an SSH key at boot time. +# +# There is no agent needed within the image to do this. If *libguestfs* is +# available on the host, it will be used. Otherwise *nbd* is used. The file +# system of the image will be mounted and the SSH key, which is provided +# in the REST API call will be injected as SSH key for the root user and +# appended to the ``authorized_keys`` of that user. The SELinux context will +# be set if necessary. Be aware that the injection is *not* possible when the +# instance gets launched from a volume. +# +# This config option will enable directly modifying the instance disk and does +# not affect what cloud-init may do using data from config_drive option or the +# metadata service. +# +# Related options: +# +# * ``inject_partition``: That option will decide about the discovery and usage +# of the file system. It also can disable the injection at all. +# (boolean value) +#inject_key = false + +# +# Determines the way how the file system is chosen to inject data into it. +# +# *libguestfs* will be used a first solution to inject data. If that's not +# available on the host, the image will be locally mounted on the host as a +# fallback solution. If libguestfs is not able to determine the root partition +# (because there are more or less than one root partition) or cannot mount the +# file system it will result in an error and the instance won't be boot. +# +# Possible values: +# +# * -2 => disable the injection of data. +# * -1 => find the root partition with the file system to mount with libguestfs +# * 0 => The image is not partitioned +# * >0 => The number of the partition to use for the injection +# +# Related options: +# +# * ``inject_key``: If this option allows the injection of a SSH key it depends +# on value greater or equal to -1 for ``inject_partition``. +# * ``inject_password``: If this option allows the injection of an admin +# password +# it depends on value greater or equal to -1 for ``inject_partition``. +# * ``guestfs`` You can enable the debug log level of libguestfs with this +# config option. A more verbose output will help in debugging issues. +# * ``virt_type``: If you use ``lxc`` as virt_type it will be treated as a +# single partition image +# (integer value) +# Minimum value: -2 +#inject_partition = -2 + +# DEPRECATED: +# Enable a mouse cursor within a graphical VNC or SPICE sessions. +# +# This will only be taken into account if the VM is fully virtualized and VNC +# and/or SPICE is enabled. If the node doesn't support a graphical framebuffer, +# then it is valid to set this to False. +# +# Related options: +# * ``[vnc]enabled``: If VNC is enabled, ``use_usb_tablet`` will have an effect. +# * ``[spice]enabled`` + ``[spice].agent_enabled``: If SPICE is enabled and the +# spice agent is disabled, the config value of ``use_usb_tablet`` will have +# an effect. +# (boolean value) +# This option is deprecated for removal since 14.0.0. +# Its value may be silently ignored in the future. +# Reason: This option is being replaced by the 'pointer_model' option. +#use_usb_tablet = true + +# +# The IP address or hostname to be used as the target for live migration +# traffic. +# +# If this option is set to None, the hostname of the migration target compute +# node will be used. +# +# This option is useful in environments where the live-migration traffic can +# impact the network plane significantly. A separate network for live-migration +# traffic can then use this config option and avoids the impact on the +# management network. +# +# Possible values: +# +# * A valid IP address or hostname, else None. +# +# Related options: +# +# * ``live_migration_tunnelled``: The live_migration_inbound_addr value is +# ignored if tunneling is enabled. +# (string value) +#live_migration_inbound_addr = + +# DEPRECATED: +# Live migration target URI to use. +# +# Override the default libvirt live migration target URI (which is dependent +# on virt_type). Any included "%s" is replaced with the migration target +# hostname. +# +# If this option is set to None (which is the default), Nova will automatically +# generate the `live_migration_uri` value based on only 4 supported `virt_type` +# in following list: +# +# * 'kvm': 'qemu+tcp://%s/system' +# * 'qemu': 'qemu+tcp://%s/system' +# * 'xen': 'xenmigr://%s/system' +# * 'parallels': 'parallels+tcp://%s/system' +# +# Related options: +# +# * ``live_migration_inbound_addr``: If ``live_migration_inbound_addr`` value +# is not None and ``live_migration_tunnelled`` is False, the ip/hostname +# address of target compute node is used instead of ``live_migration_uri`` as +# the uri for live migration. +# * ``live_migration_scheme``: If ``live_migration_uri`` is not set, the scheme +# used for live migration is taken from ``live_migration_scheme`` instead. +# (string value) +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# live_migration_uri is deprecated for removal in favor of two other options +# that +# allow to change live migration scheme and target URI: +# ``live_migration_scheme`` +# and ``live_migration_inbound_addr`` respectively. +#live_migration_uri = + +# +# URI scheme used for live migration. +# +# Override the default libvirt live migration scheme (which is dependent on +# virt_type). If this option is set to None, nova will automatically choose a +# sensible default based on the hypervisor. It is not recommended that you +# change +# this unless you are very sure that hypervisor supports a particular scheme. +# +# Related options: +# +# * ``virt_type``: This option is meaningful only when ``virt_type`` is set to +# `kvm` or `qemu`. +# * ``live_migration_uri``: If ``live_migration_uri`` value is not None, the +# scheme used for live migration is taken from ``live_migration_uri`` instead. +# (string value) +#live_migration_scheme = + +# +# Enable tunnelled migration. +# +# This option enables the tunnelled migration feature, where migration data is +# transported over the libvirtd connection. If enabled, we use the +# VIR_MIGRATE_TUNNELLED migration flag, avoiding the need to configure +# the network to allow direct hypervisor to hypervisor communication. +# If False, use the native transport. If not set, Nova will choose a +# sensible default based on, for example the availability of native +# encryption support in the hypervisor. Enabling this option will definitely +# impact performance massively. +# +# Note that this option is NOT compatible with use of block migration. +# +# Related options: +# +# * ``live_migration_inbound_addr``: The live_migration_inbound_addr value is +# ignored if tunneling is enabled. +# (boolean value) +#live_migration_tunnelled = false + +# +# Maximum bandwidth(in MiB/s) to be used during migration. +# +# If set to 0, the hypervisor will choose a suitable default. Some hypervisors +# do not support this feature and will return an error if bandwidth is not 0. +# Please refer to the libvirt documentation for further details. +# (integer value) +#live_migration_bandwidth = 0 + +# +# Maximum permitted downtime, in milliseconds, for live migration +# switchover. +# +# Will be rounded up to a minimum of 100ms. You can increase this value +# if you want to allow live-migrations to complete faster, or avoid +# live-migration timeout errors by allowing the guest to be paused for +# longer during the live-migration switch over. +# +# Related options: +# +# * live_migration_completion_timeout +# (integer value) +# Minimum value: 100 +#live_migration_downtime = 500 + +# +# Number of incremental steps to reach max downtime value. +# +# Will be rounded up to a minimum of 3 steps. +# (integer value) +# Minimum value: 3 +#live_migration_downtime_steps = 10 + +# +# Time to wait, in seconds, between each step increase of the migration +# downtime. +# +# Minimum delay is 3 seconds. Value is per GiB of guest RAM + disk to be +# transferred, with lower bound of a minimum of 2 GiB per device. +# (integer value) +# Minimum value: 3 +#live_migration_downtime_delay = 75 + +# +# Time to wait, in seconds, for migration to successfully complete transferring +# data before aborting the operation. +# +# Value is per GiB of guest RAM + disk to be transferred, with lower bound of +# a minimum of 2 GiB. Should usually be larger than downtime delay * downtime +# steps. Set to 0 to disable timeouts. +# +# Related options: +# +# * live_migration_downtime +# * live_migration_downtime_steps +# * live_migration_downtime_delay +# (integer value) +# Note: This option can be changed without restarting. +#live_migration_completion_timeout = 800 + +# DEPRECATED: +# Time to wait, in seconds, for migration to make forward progress in +# transferring data before aborting the operation. +# +# Set to 0 to disable timeouts. +# +# This is deprecated, and now disabled by default because we have found serious +# bugs in this feature that caused false live-migration timeout failures. This +# feature will be removed or replaced in a future release. +# (integer value) +# Note: This option can be changed without restarting. +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Serious bugs found in this feature. +#live_migration_progress_timeout = 0 + +# +# This option allows nova to switch an on-going live migration to post-copy +# mode, i.e., switch the active VM to the one on the destination node before the +# migration is complete, therefore ensuring an upper bound on the memory that +# needs to be transferred. Post-copy requires libvirt>=1.3.3 and QEMU>=2.5.0. +# +# When permitted, post-copy mode will be automatically activated if a +# live-migration memory copy iteration does not make percentage increase of at +# least 10% over the last iteration. +# +# The live-migration force complete API also uses post-copy when permitted. If +# post-copy mode is not available, force complete falls back to pausing the VM +# to ensure the live-migration operation will complete. +# +# When using post-copy mode, if the source and destination hosts loose network +# connectivity, the VM being live-migrated will need to be rebooted. For more +# details, please see the Administration guide. +# +# Related options: +# +# * live_migration_permit_auto_converge +# (boolean value) +#live_migration_permit_post_copy = false + +# +# This option allows nova to start live migration with auto converge on. +# +# Auto converge throttles down CPU if a progress of on-going live migration +# is slow. Auto converge will only be used if this flag is set to True and +# post copy is not permitted or post copy is unavailable due to the version +# of libvirt and QEMU in use. +# +# Related options: +# +# * live_migration_permit_post_copy +# (boolean value) +#live_migration_permit_auto_converge = false + +# +# Determine the snapshot image format when sending to the image service. +# +# If set, this decides what format is used when sending the snapshot to the +# image service. +# If not set, defaults to same type as source image. +# +# Possible values: +# +# * ``raw``: RAW disk format +# * ``qcow2``: KVM default disk format +# * ``vmdk``: VMWare default disk format +# * ``vdi``: VirtualBox default disk format +# * If not set, defaults to same type as source image. +# (string value) +# Possible values: +# raw - +# qcow2 - +# vmdk - +# vdi - +#snapshot_image_format = + +# +# Override the default disk prefix for the devices attached to an instance. +# +# If set, this is used to identify a free disk device name for a bus. +# +# Possible values: +# +# * Any prefix which will result in a valid disk device name like 'sda' or 'hda' +# for example. This is only necessary if the device names differ to the +# commonly known device name prefixes for a virtualization type such as: sd, +# xvd, uvd, vd. +# +# Related options: +# +# * ``virt_type``: Influences which device type is used, which determines +# the default disk prefix. +# (string value) +#disk_prefix = + +# Number of seconds to wait for instance to shut down after soft reboot request +# is made. We fall back to hard reboot if instance does not shutdown within this +# window. (integer value) +#wait_soft_reboot_seconds = 120 + +# +# Is used to set the CPU mode an instance should have. +# +# If virt_type="kvm|qemu", it will default to "host-model", otherwise it will +# default to "none". +# +# Possible values: +# +# * ``host-model``: Clones the host CPU feature flags +# * ``host-passthrough``: Use the host CPU model exactly +# * ``custom``: Use a named CPU model +# * ``none``: Don't set a specific CPU model. For instances with +# ``virt_type`` as KVM/QEMU, the default CPU model from QEMU will be used, +# which provides a basic set of CPU features that are compatible with most +# hosts. +# +# Related options: +# +# * ``cpu_model``: This should be set ONLY when ``cpu_mode`` is set to +# ``custom``. Otherwise, it would result in an error and the instance +# launch will fail. +# +# (string value) +# Possible values: +# host-model - +# host-passthrough - +# custom - +# none - +#cpu_mode = + +# +# Set the name of the libvirt CPU model the instance should use. +# +# Possible values: +# +# * The named CPU models listed in ``/usr/share/libvirt/cpu_map.xml`` +# +# Related options: +# +# * ``cpu_mode``: This should be set to ``custom`` ONLY when you want to +# configure (via ``cpu_model``) a specific named CPU model. Otherwise, it +# would result in an error and the instance launch will fail. +# +# * ``virt_type``: Only the virtualization types ``kvm`` and ``qemu`` use this. +# (string value) +#cpu_model = + +# +# This allows specifying granular CPU feature flags when specifying CPU +# models. For example, to explicitly specify the ``pcid`` +# (Process-Context ID, an Intel processor feature) flag to the "IvyBridge" +# virtual CPU model:: +# +# [libvirt] +# cpu_mode = custom +# cpu_model = IvyBridge +# cpu_model_extra_flags = pcid +# +# Currently, the choice is restricted to only one option: ``pcid`` (the +# option is case-insensitive, so ``PCID`` is also valid). This flag is +# now required to address the guest performance degradation as a result of +# applying the "Meltdown" CVE fixes on certain Intel CPU models. +# +# Note that when using this config attribute to set the 'PCID' CPU flag, +# not all virtual (i.e. libvirt / QEMU) CPU models need it: +# +# * The only virtual CPU models that include the 'PCID' capability are +# Intel "Haswell", "Broadwell", and "Skylake" variants. +# +# * The libvirt / QEMU CPU models "Nehalem", "Westmere", "SandyBridge", +# and "IvyBridge" will _not_ expose the 'PCID' capability by default, +# even if the host CPUs by the same name include it. I.e. 'PCID' needs +# to be explicitly specified when using the said virtual CPU models. +# +# For now, the ``cpu_model_extra_flags`` config attribute is valid only in +# combination with ``cpu_mode`` + ``cpu_model`` options. +# +# Besides ``custom``, the libvirt driver has two other CPU modes: The +# default, ``host-model``, tells it to do the right thing with respect to +# handling 'PCID' CPU flag for the guest -- *assuming* you are running +# updated processor microcode, host and guest kernel, libvirt, and QEMU. +# The other mode, ``host-passthrough``, checks if 'PCID' is available in +# the hardware, and if so directly passes it through to the Nova guests. +# Thus, in context of 'PCID', with either of these CPU modes +# (``host-model`` or ``host-passthrough``), there is no need to use the +# ``cpu_model_extra_flags``. +# +# Related options: +# +# * cpu_mode +# * cpu_model +# (list value) +#cpu_model_extra_flags = + +# Location where libvirt driver will store snapshots before uploading them to +# image service (string value) +#snapshots_directory = $instances_path/snapshots + +# Location where the Xen hvmloader is kept (string value) +#xen_hvmloader_path = /usr/lib/xen/boot/hvmloader + +# +# Specific cache modes to use for different disk types. +# +# For example: file=directsync,block=none,network=writeback +# +# For local or direct-attached storage, it is recommended that you use +# writethrough (default) mode, as it ensures data integrity and has acceptable +# I/O performance for applications running in the guest, especially for read +# operations. However, caching mode none is recommended for remote NFS storage, +# because direct I/O operations (O_DIRECT) perform better than synchronous I/O +# operations (with O_SYNC). Caching mode none effectively turns all guest I/O +# operations into direct I/O operations on the host, which is the NFS client in +# this environment. +# +# Possible cache modes: +# +# * default: Same as writethrough. +# * none: With caching mode set to none, the host page cache is disabled, but +# the disk write cache is enabled for the guest. In this mode, the write +# performance in the guest is optimal because write operations bypass the host +# page cache and go directly to the disk write cache. If the disk write cache +# is battery-backed, or if the applications or storage stack in the guest +# transfer data properly (either through fsync operations or file system +# barriers), then data integrity can be ensured. However, because the host +# page cache is disabled, the read performance in the guest would not be as +# good as in the modes where the host page cache is enabled, such as +# writethrough mode. Shareable disk devices, like for a multi-attachable block +# storage volume, will have their cache mode set to 'none' regardless of +# configuration. +# * writethrough: writethrough mode is the default caching mode. With +# caching set to writethrough mode, the host page cache is enabled, but the +# disk write cache is disabled for the guest. Consequently, this caching mode +# ensures data integrity even if the applications and storage stack in the +# guest do not transfer data to permanent storage properly (either through +# fsync operations or file system barriers). Because the host page cache is +# enabled in this mode, the read performance for applications running in the +# guest is generally better. However, the write performance might be reduced +# because the disk write cache is disabled. +# * writeback: With caching set to writeback mode, both the host page cache +# and the disk write cache are enabled for the guest. Because of this, the +# I/O performance for applications running in the guest is good, but the data +# is not protected in a power failure. As a result, this caching mode is +# recommended only for temporary data where potential data loss is not a +# concern. +# * directsync: Like "writethrough", but it bypasses the host page cache. +# * unsafe: Caching mode of unsafe ignores cache transfer operations +# completely. As its name implies, this caching mode should be used only for +# temporary data where data loss is not a concern. This mode can be useful for +# speeding up guest installations, but you should switch to another caching +# mode in production environments. +# (list value) +#disk_cachemodes = + +# A path to a device that will be used as source of entropy on the host. +# Permitted options are: /dev/random or /dev/hwrng (string value) +#rng_dev_path = + +# For qemu or KVM guests, set this option to specify a default machine type per +# host architecture. You can find a list of supported machine types in your +# environment by checking the output of the "virsh capabilities"command. The +# format of the value for this config option is host-arch=machine-type. For +# example: x86_64=machinetype1,armv7l=machinetype2 (list value) +#hw_machine_type = + +# The data source used to the populate the host "serial" UUID exposed to guest +# in the virtual BIOS. (string value) +# Possible values: +# none - +# os - +# hardware - +# auto - +#sysinfo_serial = auto + +# A number of seconds to memory usage statistics period. Zero or negative value +# mean to disable memory usage statistics. (integer value) +#mem_stats_period_seconds = 10 + +# List of uid targets and ranges.Syntax is guest-uid:host-uid:countMaximum of 5 +# allowed. (list value) +#uid_maps = + +# List of guid targets and ranges.Syntax is guest-gid:host-gid:countMaximum of 5 +# allowed. (list value) +#gid_maps = + +# In a realtime host context vCPUs for guest will run in that scheduling +# priority. Priority depends on the host kernel (usually 1-99) (integer value) +#realtime_scheduler_priority = 1 + +# +# This is a performance event list which could be used as monitor. These events +# will be passed to libvirt domain xml while creating a new instances. +# Then event statistics data can be collected from libvirt. The minimum +# libvirt version is 2.0.0. For more information about `Performance monitoring +# events`, refer https://libvirt.org/formatdomain.html#elementsPerf . +# +# Possible values: +# * A string list. For example: ``enabled_perf_events = cmt, mbml, mbmt`` +# The supported events list can be found in +# https://libvirt.org/html/libvirt-libvirt-domain.html , +# which you may need to search key words ``VIR_PERF_PARAM_*`` +# (list value) +#enabled_perf_events = + +# +# VM Images format. +# +# If default is specified, then use_cow_images flag is used instead of this +# one. +# +# Related options: +# +# * virt.use_cow_images +# * images_volume_group +# (string value) +# Possible values: +# raw - +# flat - +# qcow2 - +# lvm - +# rbd - +# ploop - +# default - +#images_type = default + +# +# LVM Volume Group that is used for VM images, when you specify images_type=lvm +# +# Related options: +# +# * images_type +# (string value) +#images_volume_group = + +# +# Create sparse logical volumes (with virtualsize) if this flag is set to True. +# (boolean value) +#sparse_logical_volumes = false + +# The RADOS pool in which rbd volumes are stored (string value) +#images_rbd_pool = rbd + +# Path to the ceph configuration file to use (string value) +#images_rbd_ceph_conf = + +# +# Discard option for nova managed disks. +# +# Requires: +# +# * Libvirt >= 1.0.6 +# * Qemu >= 1.5 (raw format) +# * Qemu >= 1.6 (qcow2 format) +# (string value) +# Possible values: +# ignore - +# unmap - +#hw_disk_discard = + +# DEPRECATED: Allows image information files to be stored in non-standard +# locations (string value) +# This option is deprecated for removal since 14.0.0. +# Its value may be silently ignored in the future. +# Reason: Image info files are no longer used by the image cache +#image_info_filename_pattern = $instances_path/$image_cache_subdirectory_name/%(image)s.info + +# Unused resized base images younger than this will not be removed (integer +# value) +#remove_unused_resized_minimum_age_seconds = 3600 + +# DEPRECATED: Write a checksum for files in _base to disk (boolean value) +# This option is deprecated for removal since 14.0.0. +# Its value may be silently ignored in the future. +# Reason: The image cache no longer periodically calculates checksums of stored +# images. Data integrity can be checked at the block or filesystem level. +#checksum_base_images = false + +# DEPRECATED: How frequently to checksum base images (integer value) +# This option is deprecated for removal since 14.0.0. +# Its value may be silently ignored in the future. +# Reason: The image cache no longer periodically calculates checksums of stored +# images. Data integrity can be checked at the block or filesystem level. +#checksum_interval_seconds = 3600 + +# +# Method used to wipe ephemeral disks when they are deleted. Only takes effect +# if LVM is set as backing storage. +# +# Possible values: +# +# * none - do not wipe deleted volumes +# * zero - overwrite volumes with zeroes +# * shred - overwrite volume repeatedly +# +# Related options: +# +# * images_type - must be set to ``lvm`` +# * volume_clear_size +# (string value) +# Possible values: +# none - +# zero - +# shred - +#volume_clear = zero + +# +# Size of area in MiB, counting from the beginning of the allocated volume, +# that will be cleared using method set in ``volume_clear`` option. +# +# Possible values: +# +# * 0 - clear whole volume +# * >0 - clear specified amount of MiB +# +# Related options: +# +# * images_type - must be set to ``lvm`` +# * volume_clear - must be set and the value must be different than ``none`` +# for this option to have any impact +# (integer value) +# Minimum value: 0 +#volume_clear_size = 0 + +# +# Enable snapshot compression for ``qcow2`` images. +# +# Note: you can set ``snapshot_image_format`` to ``qcow2`` to force all +# snapshots to be in ``qcow2`` format, independently from their original image +# type. +# +# Related options: +# +# * snapshot_image_format +# (boolean value) +#snapshot_compression = false + +# Use virtio for bridge interfaces with KVM/QEMU (boolean value) +#use_virtio_for_bridges = true + +# +# Use multipath connection of the iSCSI or FC volume +# +# Volumes can be connected in the LibVirt as multipath devices. This will +# provide high availability and fault tolerance. +# (boolean value) +# Deprecated group/name - [libvirt]/iscsi_use_multipath +#volume_use_multipath = false + +# +# Number of times to scan given storage protocol to find volume. +# (integer value) +# Deprecated group/name - [libvirt]/num_iscsi_scan_tries +#num_volume_scan_tries = 5 + +# +# Number of times to rediscover AoE target to find volume. +# +# Nova provides support for block storage attaching to hosts via AOE (ATA over +# Ethernet). This option allows the user to specify the maximum number of retry +# attempts that can be made to discover the AoE device. +# (integer value) +#num_aoe_discover_tries = 3 + +# +# The iSCSI transport iface to use to connect to target in case offload support +# is desired. +# +# Default format is of the form . where +# is one of (be2iscsi, bnx2i, cxgb3i, cxgb4i, qla4xxx, ocs) and +# is the MAC address of the interface and can be generated via the +# iscsiadm -m iface command. Do not confuse the iscsi_iface parameter to be +# provided here with the actual transport name. +# (string value) +# Deprecated group/name - [libvirt]/iscsi_transport +#iscsi_iface = + +# +# Number of times to scan iSER target to find volume. +# +# iSER is a server network protocol that extends iSCSI protocol to use Remote +# Direct Memory Access (RDMA). This option allows the user to specify the +# maximum +# number of scan attempts that can be made to find iSER volume. +# (integer value) +#num_iser_scan_tries = 5 + +# +# Use multipath connection of the iSER volume. +# +# iSER volumes can be connected as multipath devices. This will provide high +# availability and fault tolerance. +# (boolean value) +#iser_use_multipath = false + +# +# The RADOS client name for accessing rbd(RADOS Block Devices) volumes. +# +# Libvirt will refer to this user when connecting and authenticating with +# the Ceph RBD server. +# (string value) +#rbd_user = + +# +# The libvirt UUID of the secret for the rbd_user volumes. +# (string value) +#rbd_secret_uuid = + +# +# Directory where the NFS volume is mounted on the compute node. +# The default is 'mnt' directory of the location where nova's Python module +# is installed. +# +# NFS provides shared storage for the OpenStack Block Storage service. +# +# Possible values: +# +# * A string representing absolute path of mount point. +# (string value) +#nfs_mount_point_base = $state_path/mnt + +# +# Mount options passed to the NFS client. See section of the nfs man page +# for details. +# +# Mount options controls the way the filesystem is mounted and how the +# NFS client behaves when accessing files on this mount point. +# +# Possible values: +# +# * Any string representing mount options separated by commas. +# * Example string: vers=3,lookupcache=pos +# (string value) +#nfs_mount_options = + +# +# Directory where the Quobyte volume is mounted on the compute node. +# +# Nova supports Quobyte volume driver that enables storing Block Storage +# service volumes on a Quobyte storage back end. This Option specifies the +# path of the directory where Quobyte volume is mounted. +# +# Possible values: +# +# * A string representing absolute path of mount point. +# (string value) +#quobyte_mount_point_base = $state_path/mnt + +# Path to a Quobyte Client configuration file. (string value) +#quobyte_client_cfg = + +# +# Directory where the SMBFS shares are mounted on the compute node. +# (string value) +#smbfs_mount_point_base = $state_path/mnt + +# +# Mount options passed to the SMBFS client. +# +# Provide SMBFS options as a single string containing all parameters. +# See mount.cifs man page for details. Note that the libvirt-qemu ``uid`` +# and ``gid`` must be specified. +# (string value) +#smbfs_mount_options = + +# +# libvirt's transport method for remote file operations. +# +# Because libvirt cannot use RPC to copy files over network to/from other +# compute nodes, other method must be used for: +# +# * creating directory on remote host +# * creating file on remote host +# * removing file from remote host +# * copying file to remote host +# (string value) +# Possible values: +# ssh - +# rsync - +#remote_filesystem_transport = ssh + +# +# Directory where the Virtuozzo Storage clusters are mounted on the compute +# node. +# +# This option defines non-standard mountpoint for Vzstorage cluster. +# +# Related options: +# +# * vzstorage_mount_* group of parameters +# (string value) +#vzstorage_mount_point_base = $state_path/mnt + +# +# Mount owner user name. +# +# This option defines the owner user of Vzstorage cluster mountpoint. +# +# Related options: +# +# * vzstorage_mount_* group of parameters +# (string value) +#vzstorage_mount_user = stack + +# +# Mount owner group name. +# +# This option defines the owner group of Vzstorage cluster mountpoint. +# +# Related options: +# +# * vzstorage_mount_* group of parameters +# (string value) +#vzstorage_mount_group = qemu + +# +# Mount access mode. +# +# This option defines the access bits of Vzstorage cluster mountpoint, +# in the format similar to one of chmod(1) utility, like this: 0770. +# It consists of one to four digits ranging from 0 to 7, with missing +# lead digits assumed to be 0's. +# +# Related options: +# +# * vzstorage_mount_* group of parameters +# (string value) +#vzstorage_mount_perms = 0770 + +# +# Path to vzstorage client log. +# +# This option defines the log of cluster operations, +# it should include "%(cluster_name)s" template to separate +# logs from multiple shares. +# +# Related options: +# +# * vzstorage_mount_opts may include more detailed logging options. +# (string value) +#vzstorage_log_path = /var/log/vstorage/%(cluster_name)s/nova.log.gz + +# +# Path to the SSD cache file. +# +# You can attach an SSD drive to a client and configure the drive to store +# a local cache of frequently accessed data. By having a local cache on a +# client's SSD drive, you can increase the overall cluster performance by +# up to 10 and more times. +# WARNING! There is a lot of SSD models which are not server grade and +# may loose arbitrary set of data changes on power loss. +# Such SSDs should not be used in Vstorage and are dangerous as may lead +# to data corruptions and inconsistencies. Please consult with the manual +# on which SSD models are known to be safe or verify it using +# vstorage-hwflush-check(1) utility. +# +# This option defines the path which should include "%(cluster_name)s" +# template to separate caches from multiple shares. +# +# Related options: +# +# * vzstorage_mount_opts may include more detailed cache options. +# (string value) +#vzstorage_cache_path = + +# +# Extra mount options for pstorage-mount +# +# For full description of them, see +# https://static.openvz.org/vz-man/man1/pstorage-mount.1.gz.html +# Format is a python string representation of arguments list, like: +# "['-v', '-R', '500']" +# Shouldn't include -c, -l, -C, -u, -g and -m as those have +# explicit vzstorage_* options. +# +# Related options: +# +# * All other vzstorage_* options +# (list value) +#vzstorage_mount_opts = + + +[matchmaker_redis] + +# +# From oslo.messaging +# + +# DEPRECATED: Host to locate redis. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#host = 127.0.0.1 + +# DEPRECATED: Use this port to connect to redis host. (port value) +# Minimum value: 0 +# Maximum value: 65535 +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#port = 6379 + +# DEPRECATED: Password for Redis server (optional). (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#password = + +# DEPRECATED: List of Redis Sentinel hosts (fault tolerance mode), e.g., +# [host:port, host1:port ... ] (list value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#sentinel_hosts = + +# Redis replica set name. (string value) +#sentinel_group_name = oslo-messaging-zeromq + +# Time in ms to wait between connection attempts. (integer value) +#wait_timeout = 2000 + +# Time in ms to wait before the transaction is killed. (integer value) +#check_timeout = 20000 + +# Timeout in ms on blocking socket operations. (integer value) +#socket_timeout = 10000 + + +[metrics] +# +# Configuration options for metrics +# +# Options under this group allow to adjust how values assigned to metrics are +# calculated. + +# +# From nova.conf +# + +# +# When using metrics to weight the suitability of a host, you can use this +# option +# to change how the calculated weight influences the weight assigned to a host +# as +# follows: +# +# * >1.0: increases the effect of the metric on overall weight +# * 1.0: no change to the calculated weight +# * >0.0,<1.0: reduces the effect of the metric on overall weight +# * 0.0: the metric value is ignored, and the value of the +# 'weight_of_unavailable' option is returned instead +# * >-1.0,<0.0: the effect is reduced and reversed +# * -1.0: the effect is reversed +# * <-1.0: the effect is increased proportionally and reversed +# +# This option is only used by the FilterScheduler and its subclasses; if you use +# a different scheduler, this option has no effect. +# +# Possible values: +# +# * An integer or float value, where the value corresponds to the multipler +# ratio for this weigher. +# +# Related options: +# +# * weight_of_unavailable +# (floating point value) +#weight_multiplier = 1.0 + +# +# This setting specifies the metrics to be weighed and the relative ratios for +# each metric. This should be a single string value, consisting of a series of +# one or more 'name=ratio' pairs, separated by commas, where 'name' is the name +# of the metric to be weighed, and 'ratio' is the relative weight for that +# metric. +# +# Note that if the ratio is set to 0, the metric value is ignored, and instead +# the weight will be set to the value of the 'weight_of_unavailable' option. +# +# As an example, let's consider the case where this option is set to: +# +# ``name1=1.0, name2=-1.3`` +# +# The final weight will be: +# +# ``(name1.value * 1.0) + (name2.value * -1.3)`` +# +# This option is only used by the FilterScheduler and its subclasses; if you use +# a different scheduler, this option has no effect. +# +# Possible values: +# +# * A list of zero or more key/value pairs separated by commas, where the key is +# a string representing the name of a metric and the value is a numeric weight +# for that metric. If any value is set to 0, the value is ignored and the +# weight will be set to the value of the 'weight_of_unavailable' option. +# +# Related options: +# +# * weight_of_unavailable +# (list value) +#weight_setting = + +# +# This setting determines how any unavailable metrics are treated. If this +# option +# is set to True, any hosts for which a metric is unavailable will raise an +# exception, so it is recommended to also use the MetricFilter to filter out +# those hosts before weighing. +# +# This option is only used by the FilterScheduler and its subclasses; if you use +# a different scheduler, this option has no effect. +# +# Possible values: +# +# * True or False, where False ensures any metric being unavailable for a host +# will set the host weight to 'weight_of_unavailable'. +# +# Related options: +# +# * weight_of_unavailable +# (boolean value) +#required = true + +# +# When any of the following conditions are met, this value will be used in place +# of any actual metric value: +# +# * One of the metrics named in 'weight_setting' is not available for a host, +# and the value of 'required' is False +# * The ratio specified for a metric in 'weight_setting' is 0 +# * The 'weight_multiplier' option is set to 0 +# +# This option is only used by the FilterScheduler and its subclasses; if you use +# a different scheduler, this option has no effect. +# +# Possible values: +# +# * An integer or float value, where the value corresponds to the multipler +# ratio for this weigher. +# +# Related options: +# +# * weight_setting +# * required +# * weight_multiplier +# (floating point value) +#weight_of_unavailable = -10000.0 + + +[mks] +# +# Nova compute node uses WebMKS, a desktop sharing protocol to provide +# instance console access to VM's created by VMware hypervisors. +# +# Related options: +# Following options must be set to provide console access. +# * mksproxy_base_url +# * enabled + +# +# From nova.conf +# + +# +# Location of MKS web console proxy +# +# The URL in the response points to a WebMKS proxy which +# starts proxying between client and corresponding vCenter +# server where instance runs. In order to use the web based +# console access, WebMKS proxy should be installed and configured +# +# Possible values: +# +# * Must be a valid URL of the form:``http://host:port/`` or +# ``https://host:port/`` +# (uri value) +#mksproxy_base_url = http://127.0.0.1:6090/ + +# +# Enables graphical console access for virtual machines. +# (boolean value) +#enabled = false + + +[neutron] +metadata_proxy_shared_secret = osbash_training +service_metadata_proxy = true +password = neutron_user_secret +username = neutron +project_name = service +region_name = RegionOne +user_domain_name = default +project_domain_name = default +auth_type = password +auth_url = http://controller:5000 +url = http://controller:9696 +# +# Configuration options for neutron (network connectivity as a service). + +# +# From nova.conf +# + +# DEPRECATED: +# This option specifies the URL for connecting to Neutron. +# +# Possible values: +# +# * Any valid URL that points to the Neutron API service is appropriate here. +# This typically matches the URL returned for the 'network' service type +# from the Keystone service catalog. +# (uri value) +# This option is deprecated for removal since 17.0.0. +# Its value may be silently ignored in the future. +# Reason: Endpoint lookup uses the service catalog via common keystoneauth1 +# Adapter configuration options. In the current release, "url" will override +# this behavior, but will be ignored and/or removed in a future release. To +# achieve the same result, use the endpoint_override option instead. +#url = http://127.0.0.1:9696 + +# +# Default name for the Open vSwitch integration bridge. +# +# Specifies the name of an integration bridge interface used by OpenvSwitch. +# This option is only used if Neutron does not specify the OVS bridge name in +# port binding responses. +# (string value) +#ovs_bridge = br-int + +# +# Default name for the floating IP pool. +# +# Specifies the name of floating IP pool used for allocating floating IPs. This +# option is only used if Neutron does not specify the floating IP pool name in +# port binding reponses. +# (string value) +#default_floating_pool = nova + +# +# Integer value representing the number of seconds to wait before querying +# Neutron for extensions. After this number of seconds the next time Nova +# needs to create a resource in Neutron it will requery Neutron for the +# extensions that it has loaded. Setting value to 0 will refresh the +# extensions with no wait. +# (integer value) +# Minimum value: 0 +#extension_sync_interval = 600 + +# +# When set to True, this option indicates that Neutron will be used to proxy +# metadata requests and resolve instance ids. Otherwise, the instance ID must be +# passed to the metadata request in the 'X-Instance-ID' header. +# +# Related options: +# +# * metadata_proxy_shared_secret +# (boolean value) +#service_metadata_proxy = false + +# +# This option holds the shared secret string used to validate proxy requests to +# Neutron metadata requests. In order to be used, the +# 'X-Metadata-Provider-Signature' header must be supplied in the request. +# +# Related options: +# +# * service_metadata_proxy +# (string value) +#metadata_proxy_shared_secret = + +# PEM encoded Certificate Authority to use when verifying HTTPs connections. +# (string value) +#cafile = + +# PEM encoded client certificate cert file (string value) +#certfile = + +# PEM encoded client certificate key file (string value) +#keyfile = + +# Verify HTTPS connections. (boolean value) +#insecure = false + +# Timeout value for http requests (integer value) +#timeout = + +# Authentication type to load (string value) +# Deprecated group/name - [neutron]/auth_plugin +#auth_type = + +# Config Section from which to load plugin specific options (string value) +#auth_section = + +# Authentication URL (string value) +#auth_url = + +# Scope for system operations (string value) +#system_scope = + +# Domain ID to scope to (string value) +#domain_id = + +# Domain name to scope to (string value) +#domain_name = + +# Project ID to scope to (string value) +#project_id = + +# Project name to scope to (string value) +#project_name = + +# Domain ID containing project (string value) +#project_domain_id = + +# Domain name containing project (string value) +#project_domain_name = + +# Trust ID (string value) +#trust_id = + +# Optional domain ID to use with v3 and v2 parameters. It will be used for both +# the user and project domain in v3 and ignored in v2 authentication. (string +# value) +#default_domain_id = + +# Optional domain name to use with v3 API and v2 parameters. It will be used for +# both the user and project domain in v3 and ignored in v2 authentication. +# (string value) +#default_domain_name = + +# User ID (string value) +#user_id = + +# Username (string value) +# Deprecated group/name - [neutron]/user_name +#username = + +# User's domain id (string value) +#user_domain_id = + +# User's domain name (string value) +#user_domain_name = + +# User's password (string value) +#password = + +# Tenant ID (string value) +#tenant_id = + +# Tenant Name (string value) +#tenant_name = + +# The default service_type for endpoint URL discovery. (string value) +#service_type = network + +# The default service_name for endpoint URL discovery. (string value) +#service_name = + +# List of interfaces, in order of preference, for endpoint URL. (list value) +#valid_interfaces = internal,public + +# The default region_name for endpoint URL discovery. (string value) +#region_name = + +# Always use this endpoint URL for requests for this client. NOTE: The +# unversioned endpoint should be specified here; to request a particular API +# version, use the `version`, `min-version`, and/or `max-version` options. +# (string value) +#endpoint_override = + + +[notifications] +# +# Most of the actions in Nova which manipulate the system state generate +# notifications which are posted to the messaging component (e.g. RabbitMQ) and +# can be consumed by any service outside the OpenStack. More technical details +# at https://docs.openstack.org/nova/latest/reference/notifications.html + +# +# From nova.conf +# + +# +# If set, send compute.instance.update notifications on +# instance state changes. +# +# Please refer to +# https://docs.openstack.org/nova/latest/reference/notifications.html for +# additional information on notifications. +# +# Possible values: +# +# * None - no notifications +# * "vm_state" - notifications are sent with VM state transition information in +# the ``old_state`` and ``state`` fields. The ``old_task_state`` and +# ``new_task_state`` fields will be set to the current task_state of the +# instance. +# * "vm_and_task_state" - notifications are sent with VM and task state +# transition information. +# (string value) +# Possible values: +# - +# vm_state - +# vm_and_task_state - +#notify_on_state_change = + +# Default notification level for outgoing notifications. (string value) +# Possible values: +# DEBUG - +# INFO - +# WARN - +# ERROR - +# CRITICAL - +# Deprecated group/name - [DEFAULT]/default_notification_level +#default_level = INFO + +# DEPRECATED: +# Default publisher_id for outgoing notifications. If you consider routing +# notifications using different publisher, change this value accordingly. +# +# Possible values: +# +# * Defaults to the current hostname of this host, but it can be any valid +# oslo.messaging publisher_id +# +# Related options: +# +# * host - Hostname, FQDN or IP address of this host. +# (string value) +# This option is deprecated for removal since 17.0.0. +# Its value may be silently ignored in the future. +# Reason: +# This option is only used when ``monkey_patch=True`` and +# ``monkey_patch_modules`` is configured to specify the legacy notify_decorator. +# Since the monkey_patch and monkey_patch_modules options are deprecated, this +# option is also deprecated. +#default_publisher_id = $host + +# +# Specifies which notification format shall be used by nova. +# +# The default value is fine for most deployments and rarely needs to be changed. +# This value can be set to 'versioned' once the infrastructure moves closer to +# consuming the newer format of notifications. After this occurs, this option +# will be removed. +# +# Note that notifications can be completely disabled by setting ``driver=noop`` +# in the ``[oslo_messaging_notifications]`` group. +# +# Possible values: +# * unversioned: Only the legacy unversioned notifications are emitted. +# * versioned: Only the new versioned notifications are emitted. +# * both: Both the legacy unversioned and the new versioned notifications are +# emitted. (Default) +# +# The list of versioned notifications is visible in +# https://docs.openstack.org/nova/latest/reference/notifications.html +# (string value) +# Possible values: +# unversioned - +# versioned - +# both - +#notification_format = both + +# +# Specifies the topics for the versioned notifications issued by nova. +# +# The default value is fine for most deployments and rarely needs to be changed. +# However, if you have a third-party service that consumes versioned +# notifications, it might be worth getting a topic for that service. +# Nova will send a message containing a versioned notification payload to each +# topic queue in this list. +# +# The list of versioned notifications is visible in +# https://docs.openstack.org/nova/latest/reference/notifications.html +# (list value) +#versioned_notifications_topics = versioned_notifications + +# +# If enabled, include block device information in the versioned notification +# payload. Sending block device information is disabled by default as providing +# that information can incur some overhead on the system since the information +# may need to be loaded from the database. +# (boolean value) +#bdms_in_notifications = false + + +[osapi_v21] + +# +# From nova.conf +# + +# DEPRECATED: +# This option is a string representing a regular expression (regex) that matches +# the project_id as contained in URLs. If not set, it will match normal UUIDs +# created by keystone. +# +# Possible values: +# +# * A string representing any legal regular expression +# (string value) +# This option is deprecated for removal since 13.0.0. +# Its value may be silently ignored in the future. +# Reason: +# Recent versions of nova constrain project IDs to hexadecimal characters and +# dashes. If your installation uses IDs outside of this range, you should use +# this option to provide your own regex and give you time to migrate offending +# projects to valid IDs before the next release. +#project_id_regex = + + +[oslo_concurrency] +lock_path = /var/lib/nova/tmp + +# +# From oslo.concurrency +# + +# Enables or disables inter-process locks. (boolean value) +#disable_process_locking = false + +# Directory to use for lock files. For security, the specified directory should +# only be writable by the user running the processes that need locking. Defaults +# to environment variable OSLO_LOCK_PATH. If OSLO_LOCK_PATH is not set in the +# environment, use the Python tempfile.gettempdir function to find a suitable +# location. If external locks are used, a lock path must be set. (string value) +#lock_path = /tmp + + +[oslo_messaging_amqp] + +# +# From oslo.messaging +# + +# Name for the AMQP container. must be globally unique. Defaults to a generated +# UUID (string value) +#container_name = + +# Timeout for inactive connections (in seconds) (integer value) +#idle_timeout = 0 + +# Debug: dump AMQP frames to stdout (boolean value) +#trace = false + +# Attempt to connect via SSL. If no other ssl-related parameters are given, it +# will use the system's CA-bundle to verify the server's certificate. (boolean +# value) +#ssl = false + +# CA certificate PEM file used to verify the server's certificate (string value) +#ssl_ca_file = + +# Self-identifying certificate PEM file for client authentication (string value) +#ssl_cert_file = + +# Private key PEM file used to sign ssl_cert_file certificate (optional) (string +# value) +#ssl_key_file = + +# Password for decrypting ssl_key_file (if encrypted) (string value) +#ssl_key_password = + +# By default SSL checks that the name in the server's certificate matches the +# hostname in the transport_url. In some configurations it may be preferable to +# use the virtual hostname instead, for example if the server uses the Server +# Name Indication TLS extension (rfc6066) to provide a certificate per virtual +# host. Set ssl_verify_vhost to True if the server's SSL certificate uses the +# virtual host name instead of the DNS name. (boolean value) +#ssl_verify_vhost = false + +# DEPRECATED: Accept clients using either SSL or plain TCP (boolean value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Not applicable - not a SSL server +#allow_insecure_clients = false + +# Space separated list of acceptable SASL mechanisms (string value) +#sasl_mechanisms = + +# Path to directory that contains the SASL configuration (string value) +#sasl_config_dir = + +# Name of configuration file (without .conf suffix) (string value) +#sasl_config_name = + +# SASL realm to use if no realm present in username (string value) +#sasl_default_realm = + +# DEPRECATED: User name for message broker authentication (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Should use configuration option transport_url to provide the username. +#username = + +# DEPRECATED: Password for message broker authentication (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Should use configuration option transport_url to provide the password. +#password = + +# Seconds to pause before attempting to re-connect. (integer value) +# Minimum value: 1 +#connection_retry_interval = 1 + +# Increase the connection_retry_interval by this many seconds after each +# unsuccessful failover attempt. (integer value) +# Minimum value: 0 +#connection_retry_backoff = 2 + +# Maximum limit for connection_retry_interval + connection_retry_backoff +# (integer value) +# Minimum value: 1 +#connection_retry_interval_max = 30 + +# Time to pause between re-connecting an AMQP 1.0 link that failed due to a +# recoverable error. (integer value) +# Minimum value: 1 +#link_retry_delay = 10 + +# The maximum number of attempts to re-send a reply message which failed due to +# a recoverable error. (integer value) +# Minimum value: -1 +#default_reply_retry = 0 + +# The deadline for an rpc reply message delivery. (integer value) +# Minimum value: 5 +#default_reply_timeout = 30 + +# The deadline for an rpc cast or call message delivery. Only used when caller +# does not provide a timeout expiry. (integer value) +# Minimum value: 5 +#default_send_timeout = 30 + +# The deadline for a sent notification message delivery. Only used when caller +# does not provide a timeout expiry. (integer value) +# Minimum value: 5 +#default_notify_timeout = 30 + +# The duration to schedule a purge of idle sender links. Detach link after +# expiry. (integer value) +# Minimum value: 1 +#default_sender_link_timeout = 600 + +# Indicates the addressing mode used by the driver. +# Permitted values: +# 'legacy' - use legacy non-routable addressing +# 'routable' - use routable addresses +# 'dynamic' - use legacy addresses if the message bus does not support routing +# otherwise use routable addressing (string value) +#addressing_mode = dynamic + +# Enable virtual host support for those message buses that do not natively +# support virtual hosting (such as qpidd). When set to true the virtual host +# name will be added to all message bus addresses, effectively creating a +# private 'subnet' per virtual host. Set to False if the message bus supports +# virtual hosting using the 'hostname' field in the AMQP 1.0 Open performative +# as the name of the virtual host. (boolean value) +#pseudo_vhost = true + +# address prefix used when sending to a specific server (string value) +#server_request_prefix = exclusive + +# address prefix used when broadcasting to all servers (string value) +#broadcast_prefix = broadcast + +# address prefix when sending to any server in group (string value) +#group_request_prefix = unicast + +# Address prefix for all generated RPC addresses (string value) +#rpc_address_prefix = openstack.org/om/rpc + +# Address prefix for all generated Notification addresses (string value) +#notify_address_prefix = openstack.org/om/notify + +# Appended to the address prefix when sending a fanout message. Used by the +# message bus to identify fanout messages. (string value) +#multicast_address = multicast + +# Appended to the address prefix when sending to a particular RPC/Notification +# server. Used by the message bus to identify messages sent to a single +# destination. (string value) +#unicast_address = unicast + +# Appended to the address prefix when sending to a group of consumers. Used by +# the message bus to identify messages that should be delivered in a round-robin +# fashion across consumers. (string value) +#anycast_address = anycast + +# Exchange name used in notification addresses. +# Exchange name resolution precedence: +# Target.exchange if set +# else default_notification_exchange if set +# else control_exchange if set +# else 'notify' (string value) +#default_notification_exchange = + +# Exchange name used in RPC addresses. +# Exchange name resolution precedence: +# Target.exchange if set +# else default_rpc_exchange if set +# else control_exchange if set +# else 'rpc' (string value) +#default_rpc_exchange = + +# Window size for incoming RPC Reply messages. (integer value) +# Minimum value: 1 +#reply_link_credit = 200 + +# Window size for incoming RPC Request messages (integer value) +# Minimum value: 1 +#rpc_server_credit = 100 + +# Window size for incoming Notification messages (integer value) +# Minimum value: 1 +#notify_server_credit = 100 + +# Send messages of this type pre-settled. +# Pre-settled messages will not receive acknowledgement +# from the peer. Note well: pre-settled messages may be +# silently discarded if the delivery fails. +# Permitted values: +# 'rpc-call' - send RPC Calls pre-settled +# 'rpc-reply'- send RPC Replies pre-settled +# 'rpc-cast' - Send RPC Casts pre-settled +# 'notify' - Send Notifications pre-settled +# (multi valued) +#pre_settled = rpc-cast +#pre_settled = rpc-reply + + +[oslo_messaging_kafka] + +# +# From oslo.messaging +# + +# DEPRECATED: Default Kafka broker Host (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#kafka_default_host = localhost + +# DEPRECATED: Default Kafka broker Port (port value) +# Minimum value: 0 +# Maximum value: 65535 +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#kafka_default_port = 9092 + +# Max fetch bytes of Kafka consumer (integer value) +#kafka_max_fetch_bytes = 1048576 + +# Default timeout(s) for Kafka consumers (floating point value) +#kafka_consumer_timeout = 1.0 + +# DEPRECATED: Pool Size for Kafka Consumers (integer value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Driver no longer uses connection pool. +#pool_size = 10 + +# DEPRECATED: The pool size limit for connections expiration policy (integer +# value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Driver no longer uses connection pool. +#conn_pool_min_size = 2 + +# DEPRECATED: The time-to-live in sec of idle connections in the pool (integer +# value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Driver no longer uses connection pool. +#conn_pool_ttl = 1200 + +# Group id for Kafka consumer. Consumers in one group will coordinate message +# consumption (string value) +#consumer_group = oslo_messaging_consumer + +# Upper bound on the delay for KafkaProducer batching in seconds (floating point +# value) +#producer_batch_timeout = 0.0 + +# Size of batch for the producer async send (integer value) +#producer_batch_size = 16384 + + +[oslo_messaging_notifications] + +# +# From oslo.messaging +# + +# The Drivers(s) to handle sending notifications. Possible values are messaging, +# messagingv2, routing, log, test, noop (multi valued) +# Deprecated group/name - [DEFAULT]/notification_driver +#driver = + +# A URL representing the messaging driver to use for notifications. If not set, +# we fall back to the same configuration used for RPC. (string value) +# Deprecated group/name - [DEFAULT]/notification_transport_url +#transport_url = + +# AMQP topic used for OpenStack notifications. (list value) +# Deprecated group/name - [rpc_notifier2]/topics +# Deprecated group/name - [DEFAULT]/notification_topics +#topics = notifications + +# The maximum number of attempts to re-send a notification message which failed +# to be delivered due to a recoverable error. 0 - No retry, -1 - indefinite +# (integer value) +#retry = -1 + + +[oslo_messaging_rabbit] + +# +# From oslo.messaging +# + +# Use durable queues in AMQP. (boolean value) +# Deprecated group/name - [DEFAULT]/amqp_durable_queues +# Deprecated group/name - [DEFAULT]/rabbit_durable_queues +#amqp_durable_queues = false + +# Auto-delete queues in AMQP. (boolean value) +#amqp_auto_delete = false + +# Enable SSL (boolean value) +#ssl = + +# SSL version to use (valid only if SSL enabled). Valid values are TLSv1 and +# SSLv23. SSLv2, SSLv3, TLSv1_1, and TLSv1_2 may be available on some +# distributions. (string value) +# Deprecated group/name - [oslo_messaging_rabbit]/kombu_ssl_version +#ssl_version = + +# SSL key file (valid only if SSL enabled). (string value) +# Deprecated group/name - [oslo_messaging_rabbit]/kombu_ssl_keyfile +#ssl_key_file = + +# SSL cert file (valid only if SSL enabled). (string value) +# Deprecated group/name - [oslo_messaging_rabbit]/kombu_ssl_certfile +#ssl_cert_file = + +# SSL certification authority file (valid only if SSL enabled). (string value) +# Deprecated group/name - [oslo_messaging_rabbit]/kombu_ssl_ca_certs +#ssl_ca_file = + +# How long to wait before reconnecting in response to an AMQP consumer cancel +# notification. (floating point value) +#kombu_reconnect_delay = 1.0 + +# EXPERIMENTAL: Possible values are: gzip, bz2. If not set compression will not +# be used. This option may not be available in future versions. (string value) +#kombu_compression = + +# How long to wait a missing client before abandoning to send it its replies. +# This value should not be longer than rpc_response_timeout. (integer value) +# Deprecated group/name - [oslo_messaging_rabbit]/kombu_reconnect_timeout +#kombu_missing_consumer_retry_timeout = 60 + +# Determines how the next RabbitMQ node is chosen in case the one we are +# currently connected to becomes unavailable. Takes effect only if more than one +# RabbitMQ node is provided in config. (string value) +# Possible values: +# round-robin - +# shuffle - +#kombu_failover_strategy = round-robin + +# DEPRECATED: The RabbitMQ broker address where a single node is used. (string +# value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#rabbit_host = localhost + +# DEPRECATED: The RabbitMQ broker port where a single node is used. (port value) +# Minimum value: 0 +# Maximum value: 65535 +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#rabbit_port = 5672 + +# DEPRECATED: RabbitMQ HA cluster host:port pairs. (list value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#rabbit_hosts = $rabbit_host:$rabbit_port + +# DEPRECATED: The RabbitMQ userid. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#rabbit_userid = guest + +# DEPRECATED: The RabbitMQ password. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#rabbit_password = guest + +# The RabbitMQ login method. (string value) +# Possible values: +# PLAIN - +# AMQPLAIN - +# RABBIT-CR-DEMO - +#rabbit_login_method = AMQPLAIN + +# DEPRECATED: The RabbitMQ virtual host. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Replaced by [DEFAULT]/transport_url +#rabbit_virtual_host = / + +# How frequently to retry connecting with RabbitMQ. (integer value) +#rabbit_retry_interval = 1 + +# How long to backoff for between retries when connecting to RabbitMQ. (integer +# value) +#rabbit_retry_backoff = 2 + +# Maximum interval of RabbitMQ connection retries. Default is 30 seconds. +# (integer value) +#rabbit_interval_max = 30 + +# DEPRECATED: Maximum number of RabbitMQ connection retries. Default is 0 +# (infinite retry count). (integer value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +#rabbit_max_retries = 0 + +# Try to use HA queues in RabbitMQ (x-ha-policy: all). If you change this +# option, you must wipe the RabbitMQ database. In RabbitMQ 3.0, queue mirroring +# is no longer controlled by the x-ha-policy argument when declaring a queue. If +# you just want to make sure that all queues (except those with auto-generated +# names) are mirrored across all nodes, run: "rabbitmqctl set_policy HA +# '^(?!amq\.).*' '{"ha-mode": "all"}' " (boolean value) +#rabbit_ha_queues = false + +# Positive integer representing duration in seconds for queue TTL (x-expires). +# Queues which are unused for the duration of the TTL are automatically deleted. +# The parameter affects only reply and fanout queues. (integer value) +# Minimum value: 1 +#rabbit_transient_queues_ttl = 1800 + +# Specifies the number of messages to prefetch. Setting to zero allows unlimited +# messages. (integer value) +#rabbit_qos_prefetch_count = 0 + +# Number of seconds after which the Rabbit broker is considered down if +# heartbeat's keep-alive fails (0 disable the heartbeat). EXPERIMENTAL (integer +# value) +#heartbeat_timeout_threshold = 60 + +# How often times during the heartbeat_timeout_threshold we check the heartbeat. +# (integer value) +#heartbeat_rate = 2 + +# Deprecated, use rpc_backend=kombu+memory or rpc_backend=fake (boolean value) +#fake_rabbit = false + +# Maximum number of channels to allow (integer value) +#channel_max = + +# The maximum byte size for an AMQP frame (integer value) +#frame_max = + +# How often to send heartbeats for consumer's connections (integer value) +#heartbeat_interval = 3 + +# Arguments passed to ssl.wrap_socket (dict value) +#ssl_options = + +# Set socket timeout in seconds for connection's socket (floating point value) +#socket_timeout = 0.25 + +# Set TCP_USER_TIMEOUT in seconds for connection's socket (floating point value) +#tcp_user_timeout = 0.25 + +# Set delay for reconnection to some host which has connection error (floating +# point value) +#host_connection_reconnect_delay = 0.25 + +# Connection factory implementation (string value) +# Possible values: +# new - +# single - +# read_write - +#connection_factory = single + +# Maximum number of connections to keep queued. (integer value) +#pool_max_size = 30 + +# Maximum number of connections to create above `pool_max_size`. (integer value) +#pool_max_overflow = 0 + +# Default number of seconds to wait for a connections to available (integer +# value) +#pool_timeout = 30 + +# Lifetime of a connection (since creation) in seconds or None for no recycling. +# Expired connections are closed on acquire. (integer value) +#pool_recycle = 600 + +# Threshold at which inactive (since release) connections are considered stale +# in seconds or None for no staleness. Stale connections are closed on acquire. +# (integer value) +#pool_stale = 60 + +# Default serialization mechanism for serializing/deserializing +# outgoing/incoming messages (string value) +# Possible values: +# json - +# msgpack - +#default_serializer_type = json + +# Persist notification messages. (boolean value) +#notification_persistence = false + +# Exchange name for sending notifications (string value) +#default_notification_exchange = ${control_exchange}_notification + +# Max number of not acknowledged message which RabbitMQ can send to notification +# listener. (integer value) +#notification_listener_prefetch_count = 100 + +# Reconnecting retry count in case of connectivity problem during sending +# notification, -1 means infinite retry. (integer value) +#default_notification_retry_attempts = -1 + +# Reconnecting retry delay in case of connectivity problem during sending +# notification message (floating point value) +#notification_retry_delay = 0.25 + +# Time to live for rpc queues without consumers in seconds. (integer value) +#rpc_queue_expiration = 60 + +# Exchange name for sending RPC messages (string value) +#default_rpc_exchange = ${control_exchange}_rpc + +# Exchange name for receiving RPC replies (string value) +#rpc_reply_exchange = ${control_exchange}_rpc_reply + +# Max number of not acknowledged message which RabbitMQ can send to rpc +# listener. (integer value) +#rpc_listener_prefetch_count = 100 + +# Max number of not acknowledged message which RabbitMQ can send to rpc reply +# listener. (integer value) +#rpc_reply_listener_prefetch_count = 100 + +# Reconnecting retry count in case of connectivity problem during sending reply. +# -1 means infinite retry during rpc_timeout (integer value) +#rpc_reply_retry_attempts = -1 + +# Reconnecting retry delay in case of connectivity problem during sending reply. +# (floating point value) +#rpc_reply_retry_delay = 0.25 + +# Reconnecting retry count in case of connectivity problem during sending RPC +# message, -1 means infinite retry. If actual retry attempts in not 0 the rpc +# request could be processed more than one time (integer value) +#default_rpc_retry_attempts = -1 + +# Reconnecting retry delay in case of connectivity problem during sending RPC +# message (floating point value) +#rpc_retry_delay = 0.25 + + +[oslo_messaging_zmq] + +# +# From oslo.messaging +# + +# ZeroMQ bind address. Should be a wildcard (*), an ethernet interface, or IP. +# The "host" option should point or resolve to this address. (string value) +#rpc_zmq_bind_address = * + +# MatchMaker driver. (string value) +# Possible values: +# redis - +# sentinel - +# dummy - +#rpc_zmq_matchmaker = redis + +# Number of ZeroMQ contexts, defaults to 1. (integer value) +#rpc_zmq_contexts = 1 + +# Maximum number of ingress messages to locally buffer per topic. Default is +# unlimited. (integer value) +#rpc_zmq_topic_backlog = + +# Directory for holding IPC sockets. (string value) +#rpc_zmq_ipc_dir = /var/run/openstack + +# Name of this node. Must be a valid hostname, FQDN, or IP address. Must match +# "host" option, if running Nova. (string value) +#rpc_zmq_host = localhost + +# Number of seconds to wait before all pending messages will be sent after +# closing a socket. The default value of -1 specifies an infinite linger period. +# The value of 0 specifies no linger period. Pending messages shall be discarded +# immediately when the socket is closed. Positive values specify an upper bound +# for the linger period. (integer value) +# Deprecated group/name - [DEFAULT]/rpc_cast_timeout +#zmq_linger = -1 + +# The default number of seconds that poll should wait. Poll raises timeout +# exception when timeout expired. (integer value) +#rpc_poll_timeout = 1 + +# Expiration timeout in seconds of a name service record about existing target ( +# < 0 means no timeout). (integer value) +#zmq_target_expire = 300 + +# Update period in seconds of a name service record about existing target. +# (integer value) +#zmq_target_update = 180 + +# Use PUB/SUB pattern for fanout methods. PUB/SUB always uses proxy. (boolean +# value) +#use_pub_sub = false + +# Use ROUTER remote proxy. (boolean value) +#use_router_proxy = false + +# This option makes direct connections dynamic or static. It makes sense only +# with use_router_proxy=False which means to use direct connections for direct +# message types (ignored otherwise). (boolean value) +#use_dynamic_connections = false + +# How many additional connections to a host will be made for failover reasons. +# This option is actual only in dynamic connections mode. (integer value) +#zmq_failover_connections = 2 + +# Minimal port number for random ports range. (port value) +# Minimum value: 0 +# Maximum value: 65535 +#rpc_zmq_min_port = 49153 + +# Maximal port number for random ports range. (integer value) +# Minimum value: 1 +# Maximum value: 65536 +#rpc_zmq_max_port = 65536 + +# Number of retries to find free port number before fail with ZMQBindError. +# (integer value) +#rpc_zmq_bind_port_retries = 100 + +# Default serialization mechanism for serializing/deserializing +# outgoing/incoming messages (string value) +# Possible values: +# json - +# msgpack - +#rpc_zmq_serialization = json + +# This option configures round-robin mode in zmq socket. True means not keeping +# a queue when server side disconnects. False means to keep queue and messages +# even if server is disconnected, when the server appears we send all +# accumulated messages to it. (boolean value) +#zmq_immediate = true + +# Enable/disable TCP keepalive (KA) mechanism. The default value of -1 (or any +# other negative value) means to skip any overrides and leave it to OS default; +# 0 and 1 (or any other positive value) mean to disable and enable the option +# respectively. (integer value) +#zmq_tcp_keepalive = -1 + +# The duration between two keepalive transmissions in idle condition. The unit +# is platform dependent, for example, seconds in Linux, milliseconds in Windows +# etc. The default value of -1 (or any other negative value and 0) means to skip +# any overrides and leave it to OS default. (integer value) +#zmq_tcp_keepalive_idle = -1 + +# The number of retransmissions to be carried out before declaring that remote +# end is not available. The default value of -1 (or any other negative value and +# 0) means to skip any overrides and leave it to OS default. (integer value) +#zmq_tcp_keepalive_cnt = -1 + +# The duration between two successive keepalive retransmissions, if +# acknowledgement to the previous keepalive transmission is not received. The +# unit is platform dependent, for example, seconds in Linux, milliseconds in +# Windows etc. The default value of -1 (or any other negative value and 0) means +# to skip any overrides and leave it to OS default. (integer value) +#zmq_tcp_keepalive_intvl = -1 + +# Maximum number of (green) threads to work concurrently. (integer value) +#rpc_thread_pool_size = 100 + +# Expiration timeout in seconds of a sent/received message after which it is not +# tracked anymore by a client/server. (integer value) +#rpc_message_ttl = 300 + +# Wait for message acknowledgements from receivers. This mechanism works only +# via proxy without PUB/SUB. (boolean value) +#rpc_use_acks = false + +# Number of seconds to wait for an ack from a cast/call. After each retry +# attempt this timeout is multiplied by some specified multiplier. (integer +# value) +#rpc_ack_timeout_base = 15 + +# Number to multiply base ack timeout by after each retry attempt. (integer +# value) +#rpc_ack_timeout_multiplier = 2 + +# Default number of message sending attempts in case of any problems occurred: +# positive value N means at most N retries, 0 means no retries, None or -1 (or +# any other negative values) mean to retry forever. This option is used only if +# acknowledgments are enabled. (integer value) +#rpc_retry_attempts = 3 + +# List of publisher hosts SubConsumer can subscribe on. This option has higher +# priority then the default publishers list taken from the matchmaker. (list +# value) +#subscribe_on = + + +[oslo_middleware] + +# +# From oslo.middleware +# + +# The maximum body size for each request, in bytes. (integer value) +# Deprecated group/name - [DEFAULT]/osapi_max_request_body_size +# Deprecated group/name - [DEFAULT]/max_request_body_size +#max_request_body_size = 114688 + +# DEPRECATED: The HTTP Header that will be used to determine what the original +# request protocol scheme was, even if it was hidden by a SSL termination proxy. +# (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +#secure_proxy_ssl_header = X-Forwarded-Proto + +# Whether the application is behind a proxy or not. This determines if the +# middleware should parse the headers or not. (boolean value) +#enable_proxy_headers_parsing = false + + +[oslo_policy] + +# +# From oslo.policy +# + +# This option controls whether or not to enforce scope when evaluating policies. +# If ``True``, the scope of the token used in the request is compared to the +# ``scope_types`` of the policy being enforced. If the scopes do not match, an +# ``InvalidScope`` exception will be raised. If ``False``, a message will be +# logged informing operators that policies are being invoked with mismatching +# scope. (boolean value) +#enforce_scope = false + +# The file that defines policies. (string value) +#policy_file = policy.json + +# Default rule. Enforced when a requested rule is not found. (string value) +#policy_default_rule = default + +# Directories where policy configuration files are stored. They can be relative +# to any directory in the search path defined by the config_dir option, or +# absolute paths. The file defined by policy_file must exist for these +# directories to be searched. Missing or empty directories are ignored. (multi +# valued) +#policy_dirs = policy.d + +# Content Type to send and receive data for REST based policy check (string +# value) +# Possible values: +# application/x-www-form-urlencoded - +# application/json - +#remote_content_type = application/x-www-form-urlencoded + +# server identity verification for REST based policy check (boolean value) +#remote_ssl_verify_server_crt = false + +# Absolute path to ca cert file for REST based policy check (string value) +#remote_ssl_ca_crt_file = + +# Absolute path to client cert for REST based policy check (string value) +#remote_ssl_client_crt_file = + +# Absolute path client key file REST based policy check (string value) +#remote_ssl_client_key_file = + + +[pci] + +# +# From nova.conf +# + +# +# An alias for a PCI passthrough device requirement. +# +# This allows users to specify the alias in the extra specs for a flavor, +# without +# needing to repeat all the PCI property requirements. +# +# Possible Values: +# +# * A list of JSON values which describe the aliases. For example:: +# +# alias = { +# "name": "QuickAssist", +# "product_id": "0443", +# "vendor_id": "8086", +# "device_type": "type-PCI", +# "numa_policy": "required" +# } +# +# This defines an alias for the Intel QuickAssist card. (multi valued). Valid +# key values are : +# +# ``name`` +# Name of the PCI alias. +# +# ``product_id`` +# Product ID of the device in hexadecimal. +# +# ``vendor_id`` +# Vendor ID of the device in hexadecimal. +# +# ``device_type`` +# Type of PCI device. Valid values are: ``type-PCI``, ``type-PF`` and +# ``type-VF``. +# +# ``numa_policy`` +# Required NUMA affinity of device. Valid values are: ``legacy``, +# ``preferred`` and ``required``. +# (multi valued) +# Deprecated group/name - [DEFAULT]/pci_alias +#alias = + +# +# White list of PCI devices available to VMs. +# +# Possible values: +# +# * A JSON dictionary which describe a whitelisted PCI device. It should take +# the following format: +# +# ["vendor_id": "",] ["product_id": "",] +# ["address": "[[[[]:]]:][][.[]]" | +# "devname": "",] +# {"": "",} +# +# Where '[' indicates zero or one occurrences, '{' indicates zero or multiple +# occurrences, and '|' mutually exclusive options. Note that any missing +# fields are automatically wildcarded. +# +# Valid key values are : +# +# * "vendor_id": Vendor ID of the device in hexadecimal. +# * "product_id": Product ID of the device in hexadecimal. +# * "address": PCI address of the device. +# * "devname": Device name of the device (for e.g. interface name). Not all +# PCI devices have a name. +# * "": Additional and used for matching PCI devices. +# Supported : "physical_network". +# +# The address key supports traditional glob style and regular expression +# syntax. Valid examples are: +# +# passthrough_whitelist = {"devname":"eth0", +# "physical_network":"physnet"} +# passthrough_whitelist = {"address":"*:0a:00.*"} +# passthrough_whitelist = {"address":":0a:00.", +# "physical_network":"physnet1"} +# passthrough_whitelist = {"vendor_id":"1137", +# "product_id":"0071"} +# passthrough_whitelist = {"vendor_id":"1137", +# "product_id":"0071", +# "address": "0000:0a:00.1", +# "physical_network":"physnet1"} +# passthrough_whitelist = {"address":{"domain": ".*", +# "bus": "02", "slot": "01", +# "function": "[2-7]"}, +# "physical_network":"physnet1"} +# passthrough_whitelist = {"address":{"domain": ".*", +# "bus": "02", "slot": "0[1-2]", +# "function": ".*"}, +# "physical_network":"physnet1"} +# +# The following are invalid, as they specify mutually exclusive options: +# +# passthrough_whitelist = {"devname":"eth0", +# "physical_network":"physnet", +# "address":"*:0a:00.*"} +# +# * A JSON list of JSON dictionaries corresponding to the above format. For +# example: +# +# passthrough_whitelist = [{"product_id":"0001", "vendor_id":"8086"}, +# {"product_id":"0002", "vendor_id":"8086"}] +# (multi valued) +# Deprecated group/name - [DEFAULT]/pci_passthrough_whitelist +#passthrough_whitelist = + + +[placement] +password = placement_user_secret +username = placement +auth_url = http://controller:5000/v3 +user_domain_name = Default +auth_type = password +project_name = service +project_domain_name = Default +os_region_name = RegionOne + +# +# From nova.conf +# + +# DEPRECATED: +# Region name of this node. This is used when picking the URL in the service +# catalog. +# +# Possible values: +# +# * Any string representing region name +# (string value) +# This option is deprecated for removal since 17.0.0. +# Its value may be silently ignored in the future. +# Reason: Endpoint lookup uses the service catalog via common keystoneauth1 +# Adapter configuration options. Use the region_name option instead. +#os_region_name = + +# DEPRECATED: +# Endpoint interface for this node. This is used when picking the URL in the +# service catalog. +# (string value) +# This option is deprecated for removal since 17.0.0. +# Its value may be silently ignored in the future. +# Reason: Endpoint lookup uses the service catalog via common keystoneauth1 +# Adapter configuration options. Use the valid_interfaces option instead. +#os_interface = + +# +# If True, when limiting allocation candidate results, the results will be +# a random sampling of the full result set. If False, allocation candidates +# are returned in a deterministic but undefined order. That is, all things +# being equal, two requests for allocation candidates will return the same +# results in the same order; but no guarantees are made as to how that order +# is determined. +# (boolean value) +#randomize_allocation_candidates = false + +# PEM encoded Certificate Authority to use when verifying HTTPs connections. +# (string value) +#cafile = + +# PEM encoded client certificate cert file (string value) +#certfile = + +# PEM encoded client certificate key file (string value) +#keyfile = + +# Verify HTTPS connections. (boolean value) +#insecure = false + +# Timeout value for http requests (integer value) +#timeout = + +# Authentication type to load (string value) +# Deprecated group/name - [placement]/auth_plugin +#auth_type = + +# Config Section from which to load plugin specific options (string value) +#auth_section = + +# Authentication URL (string value) +#auth_url = + +# Scope for system operations (string value) +#system_scope = + +# Domain ID to scope to (string value) +#domain_id = + +# Domain name to scope to (string value) +#domain_name = + +# Project ID to scope to (string value) +#project_id = + +# Project name to scope to (string value) +#project_name = + +# Domain ID containing project (string value) +#project_domain_id = + +# Domain name containing project (string value) +#project_domain_name = + +# Trust ID (string value) +#trust_id = + +# Optional domain ID to use with v3 and v2 parameters. It will be used for both +# the user and project domain in v3 and ignored in v2 authentication. (string +# value) +#default_domain_id = + +# Optional domain name to use with v3 API and v2 parameters. It will be used for +# both the user and project domain in v3 and ignored in v2 authentication. +# (string value) +#default_domain_name = + +# User ID (string value) +#user_id = + +# Username (string value) +# Deprecated group/name - [placement]/user_name +#username = + +# User's domain id (string value) +#user_domain_id = + +# User's domain name (string value) +#user_domain_name = + +# User's password (string value) +#password = + +# Tenant ID (string value) +#tenant_id = + +# Tenant Name (string value) +#tenant_name = + +# The default service_type for endpoint URL discovery. (string value) +#service_type = placement + +# The default service_name for endpoint URL discovery. (string value) +#service_name = + +# List of interfaces, in order of preference, for endpoint URL. (list value) +# Deprecated group/name - [placement]/os_interface +#valid_interfaces = internal,public + +# The default region_name for endpoint URL discovery. (string value) +# Deprecated group/name - [placement]/os_region_name +#region_name = + +# Always use this endpoint URL for requests for this client. NOTE: The +# unversioned endpoint should be specified here; to request a particular API +# version, use the `version`, `min-version`, and/or `max-version` options. +# (string value) +#endpoint_override = + + +[quota] +# +# Quota options allow to manage quotas in openstack deployment. + +# +# From nova.conf +# + +# +# The number of instances allowed per project. +# +# Possible Values +# +# * A positive integer or 0. +# * -1 to disable the quota. +# (integer value) +# Minimum value: -1 +# Deprecated group/name - [DEFAULT]/quota_instances +#instances = 10 + +# +# The number of instance cores or vCPUs allowed per project. +# +# Possible values: +# +# * A positive integer or 0. +# * -1 to disable the quota. +# (integer value) +# Minimum value: -1 +# Deprecated group/name - [DEFAULT]/quota_cores +#cores = 20 + +# +# The number of megabytes of instance RAM allowed per project. +# +# Possible values: +# +# * A positive integer or 0. +# * -1 to disable the quota. +# (integer value) +# Minimum value: -1 +# Deprecated group/name - [DEFAULT]/quota_ram +#ram = 51200 + +# DEPRECATED: +# The number of floating IPs allowed per project. +# +# Floating IPs are not allocated to instances by default. Users need to select +# them from the pool configured by the OpenStack administrator to attach to +# their +# instances. +# +# Possible values: +# +# * A positive integer or 0. +# * -1 to disable the quota. +# (integer value) +# Minimum value: -1 +# Deprecated group/name - [DEFAULT]/quota_floating_ips +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#floating_ips = 10 + +# DEPRECATED: +# The number of fixed IPs allowed per project. +# +# Unlike floating IPs, fixed IPs are allocated dynamically by the network +# component when instances boot up. This quota value should be at least the +# number of instances allowed +# +# Possible values: +# +# * A positive integer or 0. +# * -1 to disable the quota. +# (integer value) +# Minimum value: -1 +# Deprecated group/name - [DEFAULT]/quota_fixed_ips +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#fixed_ips = -1 + +# +# The number of metadata items allowed per instance. +# +# Users can associate metadata with an instance during instance creation. This +# metadata takes the form of key-value pairs. +# +# Possible values: +# +# * A positive integer or 0. +# * -1 to disable the quota. +# (integer value) +# Minimum value: -1 +# Deprecated group/name - [DEFAULT]/quota_metadata_items +#metadata_items = 128 + +# +# The number of injected files allowed. +# +# File injection allows users to customize the personality of an instance by +# injecting data into it upon boot. Only text file injection is permitted: +# binary +# or ZIP files are not accepted. During file injection, any existing files that +# match specified files are renamed to include ``.bak`` extension appended with +# a +# timestamp. +# +# Possible values: +# +# * A positive integer or 0. +# * -1 to disable the quota. +# (integer value) +# Minimum value: -1 +# Deprecated group/name - [DEFAULT]/quota_injected_files +#injected_files = 5 + +# +# The number of bytes allowed per injected file. +# +# Possible values: +# +# * A positive integer or 0. +# * -1 to disable the quota. +# (integer value) +# Minimum value: -1 +# Deprecated group/name - [DEFAULT]/quota_injected_file_content_bytes +#injected_file_content_bytes = 10240 + +# +# The maximum allowed injected file path length. +# +# Possible values: +# +# * A positive integer or 0. +# * -1 to disable the quota. +# (integer value) +# Minimum value: -1 +# Deprecated group/name - [DEFAULT]/quota_injected_file_path_length +#injected_file_path_length = 255 + +# DEPRECATED: +# The number of security groups per project. +# +# Possible values: +# +# * A positive integer or 0. +# * -1 to disable the quota. +# (integer value) +# Minimum value: -1 +# Deprecated group/name - [DEFAULT]/quota_security_groups +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#security_groups = 10 + +# DEPRECATED: +# The number of security rules per security group. +# +# The associated rules in each security group control the traffic to instances +# in +# the group. +# +# Possible values: +# +# * A positive integer or 0. +# * -1 to disable the quota. +# (integer value) +# Minimum value: -1 +# Deprecated group/name - [DEFAULT]/quota_security_group_rules +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# nova-network is deprecated, as are any related configuration options. +#security_group_rules = 20 + +# +# The maximum number of key pairs allowed per user. +# +# Users can create at least one key pair for each project and use the key pair +# for multiple instances that belong to that project. +# +# Possible values: +# +# * A positive integer or 0. +# * -1 to disable the quota. +# (integer value) +# Minimum value: -1 +# Deprecated group/name - [DEFAULT]/quota_key_pairs +#key_pairs = 100 + +# +# The maxiumum number of server groups per project. +# +# Server groups are used to control the affinity and anti-affinity scheduling +# policy for a group of servers or instances. Reducing the quota will not affect +# any existing group, but new servers will not be allowed into groups that have +# become over quota. +# +# Possible values: +# +# * A positive integer or 0. +# * -1 to disable the quota. +# (integer value) +# Minimum value: -1 +# Deprecated group/name - [DEFAULT]/quota_server_groups +#server_groups = 10 + +# +# The maximum number of servers per server group. +# +# Possible values: +# +# * A positive integer or 0. +# * -1 to disable the quota. +# (integer value) +# Minimum value: -1 +# Deprecated group/name - [DEFAULT]/quota_server_group_members +#server_group_members = 10 + +# +# The number of seconds until a reservation expires. +# +# This quota represents the time period for invalidating quota reservations. +# (integer value) +#reservation_expire = 86400 + +# +# The count of reservations until usage is refreshed. +# +# This defaults to 0 (off) to avoid additional load but it is useful to turn on +# to help keep quota usage up-to-date and reduce the impact of out of sync usage +# issues. +# (integer value) +# Minimum value: 0 +#until_refresh = 0 + +# +# The number of seconds between subsequent usage refreshes. +# +# This defaults to 0 (off) to avoid additional load but it is useful to turn on +# to help keep quota usage up-to-date and reduce the impact of out of sync usage +# issues. Note that quotas are not updated on a periodic task, they will update +# on a new reservation if max_age has passed since the last reservation. +# (integer value) +# Minimum value: 0 +#max_age = 0 + +# DEPRECATED: +# The quota enforcer driver. +# +# Provides abstraction for quota checks. Users can configure a specific +# driver to use for quota checks. +# +# Possible values: +# +# * nova.quota.DbQuotaDriver (default) or any string representing fully +# qualified class name. +# (string value) +# Deprecated group/name - [DEFAULT]/quota_driver +# This option is deprecated for removal since 14.0.0. +# Its value may be silently ignored in the future. +#driver = nova.quota.DbQuotaDriver + +# +# Recheck quota after resource creation to prevent allowing quota to be +# exceeded. +# +# This defaults to True (recheck quota after resource creation) but can be set +# to +# False to avoid additional load if allowing quota to be exceeded because of +# racing requests is considered acceptable. For example, when set to False, if a +# user makes highly parallel REST API requests to create servers, it will be +# possible for them to create more servers than their allowed quota during the +# race. If their quota is 10 servers, they might be able to create 50 during the +# burst. After the burst, they will not be able to create any more servers but +# they will be able to keep their 50 servers until they delete them. +# +# The initial quota check is done before resources are created, so if multiple +# parallel requests arrive at the same time, all could pass the quota check and +# create resources, potentially exceeding quota. When recheck_quota is True, +# quota will be checked a second time after resources have been created and if +# the resource is over quota, it will be deleted and OverQuota will be raised, +# usually resulting in a 403 response to the REST API user. This makes it +# impossible for a user to exceed their quota with the caveat that it will, +# however, be possible for a REST API user to be rejected with a 403 response in +# the event of a collision close to reaching their quota limit, even if the user +# has enough quota available when they made the request. +# (boolean value) +#recheck_quota = true + + +[rdp] +# +# Options under this group enable and configure Remote Desktop Protocol ( +# RDP) related features. +# +# This group is only relevant to Hyper-V users. + +# +# From nova.conf +# + +# +# Enable Remote Desktop Protocol (RDP) related features. +# +# Hyper-V, unlike the majority of the hypervisors employed on Nova compute +# nodes, uses RDP instead of VNC and SPICE as a desktop sharing protocol to +# provide instance console access. This option enables RDP for graphical +# console access for virtual machines created by Hyper-V. +# +# **Note:** RDP should only be enabled on compute nodes that support the Hyper-V +# virtualization platform. +# +# Related options: +# +# * ``compute_driver``: Must be hyperv. +# +# (boolean value) +#enabled = false + +# +# The URL an end user would use to connect to the RDP HTML5 console proxy. +# The console proxy service is called with this token-embedded URL and +# establishes the connection to the proper instance. +# +# An RDP HTML5 console proxy service will need to be configured to listen on the +# address configured here. Typically the console proxy service would be run on a +# controller node. The localhost address used as default would only work in a +# single node environment i.e. devstack. +# +# An RDP HTML5 proxy allows a user to access via the web the text or graphical +# console of any Windows server or workstation using RDP. RDP HTML5 console +# proxy services include FreeRDP, wsgate. +# See https://github.com/FreeRDP/FreeRDP-WebConnect +# +# Possible values: +# +# * ://:/ +# +# The scheme must be identical to the scheme configured for the RDP HTML5 +# console proxy service. It is ``http`` or ``https``. +# +# The IP address must be identical to the address on which the RDP HTML5 +# console proxy service is listening. +# +# The port must be identical to the port on which the RDP HTML5 console proxy +# service is listening. +# +# Related options: +# +# * ``rdp.enabled``: Must be set to ``True`` for ``html5_proxy_base_url`` to be +# effective. +# (uri value) +#html5_proxy_base_url = http://127.0.0.1:6083/ + + +[remote_debug] + +# +# From nova.conf +# + +# +# Debug host (IP or name) to connect to. This command line parameter is used +# when +# you want to connect to a nova service via a debugger running on a different +# host. +# +# Note that using the remote debug option changes how Nova uses the eventlet +# library to support async IO. This could result in failures that do not occur +# under normal operation. Use at your own risk. +# +# Possible Values: +# +# * IP address of a remote host as a command line parameter +# to a nova service. For Example: +# +# /usr/local/bin/nova-compute --config-file /etc/nova/nova.conf +# --remote_debug-host +# (unknown value) +#host = + +# +# Debug port to connect to. This command line parameter allows you to specify +# the port you want to use to connect to a nova service via a debugger running +# on different host. +# +# Note that using the remote debug option changes how Nova uses the eventlet +# library to support async IO. This could result in failures that do not occur +# under normal operation. Use at your own risk. +# +# Possible Values: +# +# * Port number you want to use as a command line parameter +# to a nova service. For Example: +# +# /usr/local/bin/nova-compute --config-file /etc/nova/nova.conf +# --remote_debug-host +# --remote_debug-port it's listening on>. +# (port value) +# Minimum value: 0 +# Maximum value: 65535 +#port = + + +[scheduler] + +# +# From nova.conf +# + +# +# The scheduler host manager to use. +# +# The host manager manages the in-memory picture of the hosts that the scheduler +# uses. The options values are chosen from the entry points under the namespace +# 'nova.scheduler.host_manager' in 'setup.cfg'. +# +# NOTE: The "ironic_host_manager" option is deprecated as of the 17.0.0 Queens +# release. +# (string value) +# Possible values: +# host_manager - +# ironic_host_manager - +# Deprecated group/name - [DEFAULT]/scheduler_host_manager +#host_manager = host_manager + +# +# The class of the driver used by the scheduler. This should be chosen from one +# of the entrypoints under the namespace 'nova.scheduler.driver' of file +# 'setup.cfg'. If nothing is specified in this option, the 'filter_scheduler' is +# used. +# +# Other options are: +# +# * 'caching_scheduler' which aggressively caches the system state for better +# individual scheduler performance at the risk of more retries when running +# multiple schedulers. [DEPRECATED] +# * 'chance_scheduler' which simply picks a host at random. [DEPRECATED] +# * 'fake_scheduler' which is used for testing. +# +# Possible values: +# +# * Any of the drivers included in Nova: +# ** filter_scheduler +# ** caching_scheduler +# ** chance_scheduler +# ** fake_scheduler +# * You may also set this to the entry point name of a custom scheduler driver, +# but you will be responsible for creating and maintaining it in your +# setup.cfg +# file. +# (string value) +# Deprecated group/name - [DEFAULT]/scheduler_driver +#driver = filter_scheduler + +# +# Periodic task interval. +# +# This value controls how often (in seconds) to run periodic tasks in the +# scheduler. The specific tasks that are run for each period are determined by +# the particular scheduler being used. +# +# If this is larger than the nova-service 'service_down_time' setting, Nova may +# report the scheduler service as down. This is because the scheduler driver is +# responsible for sending a heartbeat and it will only do that as often as this +# option allows. As each scheduler can work a little differently than the +# others, +# be sure to test this with your selected scheduler. +# +# Possible values: +# +# * An integer, where the integer corresponds to periodic task interval in +# seconds. 0 uses the default interval (60 seconds). A negative value disables +# periodic tasks. +# +# Related options: +# +# * ``nova-service service_down_time`` +# (integer value) +# Deprecated group/name - [DEFAULT]/scheduler_driver_task_period +#periodic_task_interval = 60 + +# +# This is the maximum number of attempts that will be made for a given instance +# build/move operation. It limits the number of alternate hosts returned by the +# scheduler. When that list of hosts is exhausted, a MaxRetriesExceeded +# exception is raised and the instance is set to an error state. +# +# Possible values: +# +# * A positive integer, where the integer corresponds to the max number of +# attempts that can be made when building or moving an instance. +# (integer value) +# Minimum value: 1 +# Deprecated group/name - [DEFAULT]/scheduler_max_attempts +#max_attempts = 3 + +# +# Periodic task interval. +# +# This value controls how often (in seconds) the scheduler should attempt +# to discover new hosts that have been added to cells. If negative (the +# default), no automatic discovery will occur. +# +# Deployments where compute nodes come and go frequently may want this +# enabled, where others may prefer to manually discover hosts when one +# is added to avoid any overhead from constantly checking. If enabled, +# every time this runs, we will select any unmapped hosts out of each +# cell database on every run. +# (integer value) +# Minimum value: -1 +#discover_hosts_in_cells_interval = -1 + +# +# This setting determines the maximum limit on results received from the +# placement service during a scheduling operation. It effectively limits +# the number of hosts that may be considered for scheduling requests that +# match a large number of candidates. +# +# A value of 1 (the minimum) will effectively defer scheduling to the placement +# service strictly on "will it fit" grounds. A higher value will put an upper +# cap on the number of results the scheduler will consider during the filtering +# and weighing process. Large deployments may need to set this lower than the +# total number of hosts available to limit memory consumption, network traffic, +# etc. of the scheduler. +# +# This option is only used by the FilterScheduler; if you use a different +# scheduler, this option has no effect. +# (integer value) +# Minimum value: 1 +#max_placement_results = 1000 + + +[serial_console] +# +# The serial console feature allows you to connect to a guest in case a +# graphical console like VNC, RDP or SPICE is not available. This is only +# currently supported for the libvirt, Ironic and hyper-v drivers. + +# +# From nova.conf +# + +# +# Enable the serial console feature. +# +# In order to use this feature, the service ``nova-serialproxy`` needs to run. +# This service is typically executed on the controller node. +# (boolean value) +#enabled = false + +# +# A range of TCP ports a guest can use for its backend. +# +# Each instance which gets created will use one port out of this range. If the +# range is not big enough to provide another port for an new instance, this +# instance won't get launched. +# +# Possible values: +# +# * Each string which passes the regex ``\d+:\d+`` For example ``10000:20000``. +# Be sure that the first port number is lower than the second port number +# and that both are in range from 0 to 65535. +# (string value) +#port_range = 10000:20000 + +# +# The URL an end user would use to connect to the ``nova-serialproxy`` service. +# +# The ``nova-serialproxy`` service is called with this token enriched URL +# and establishes the connection to the proper instance. +# +# Related options: +# +# * The IP address must be identical to the address to which the +# ``nova-serialproxy`` service is listening (see option ``serialproxy_host`` +# in this section). +# * The port must be the same as in the option ``serialproxy_port`` of this +# section. +# * If you choose to use a secured websocket connection, then start this option +# with ``wss://`` instead of the unsecured ``ws://``. The options ``cert`` +# and ``key`` in the ``[DEFAULT]`` section have to be set for that. +# (uri value) +#base_url = ws://127.0.0.1:6083/ + +# +# The IP address to which proxy clients (like ``nova-serialproxy``) should +# connect to get the serial console of an instance. +# +# This is typically the IP address of the host of a ``nova-compute`` service. +# (string value) +#proxyclient_address = 127.0.0.1 + +# +# The IP address which is used by the ``nova-serialproxy`` service to listen +# for incoming requests. +# +# The ``nova-serialproxy`` service listens on this IP address for incoming +# connection requests to instances which expose serial console. +# +# Related options: +# +# * Ensure that this is the same IP address which is defined in the option +# ``base_url`` of this section or use ``0.0.0.0`` to listen on all addresses. +# (string value) +#serialproxy_host = 0.0.0.0 + +# +# The port number which is used by the ``nova-serialproxy`` service to listen +# for incoming requests. +# +# The ``nova-serialproxy`` service listens on this port number for incoming +# connection requests to instances which expose serial console. +# +# Related options: +# +# * Ensure that this is the same port number which is defined in the option +# ``base_url`` of this section. +# (port value) +# Minimum value: 0 +# Maximum value: 65535 +#serialproxy_port = 6083 + + +[service_user] +# +# Configuration options for service to service authentication using a service +# token. These options allow sending a service token along with the user's token +# when contacting external REST APIs. + +# +# From nova.conf +# + +# +# When True, if sending a user token to a REST API, also send a service token. +# +# Nova often reuses the user token provided to the nova-api to talk to other +# REST +# APIs, such as Cinder, Glance and Neutron. It is possible that while the user +# token was valid when the request was made to Nova, the token may expire before +# it reaches the other service. To avoid any failures, and to make it clear it +# is +# Nova calling the service on the user's behalf, we include a service token +# along +# with the user token. Should the user's token have expired, a valid service +# token ensures the REST API request will still be accepted by the keystone +# middleware. +# (boolean value) +#send_service_user_token = false + +# PEM encoded Certificate Authority to use when verifying HTTPs connections. +# (string value) +#cafile = + +# PEM encoded client certificate cert file (string value) +#certfile = + +# PEM encoded client certificate key file (string value) +#keyfile = + +# Verify HTTPS connections. (boolean value) +#insecure = false + +# Timeout value for http requests (integer value) +#timeout = + +# Authentication type to load (string value) +# Deprecated group/name - [service_user]/auth_plugin +#auth_type = + +# Config Section from which to load plugin specific options (string value) +#auth_section = + +# Authentication URL (string value) +#auth_url = + +# Scope for system operations (string value) +#system_scope = + +# Domain ID to scope to (string value) +#domain_id = + +# Domain name to scope to (string value) +#domain_name = + +# Project ID to scope to (string value) +#project_id = + +# Project name to scope to (string value) +#project_name = + +# Domain ID containing project (string value) +#project_domain_id = + +# Domain name containing project (string value) +#project_domain_name = + +# Trust ID (string value) +#trust_id = + +# Optional domain ID to use with v3 and v2 parameters. It will be used for both +# the user and project domain in v3 and ignored in v2 authentication. (string +# value) +#default_domain_id = + +# Optional domain name to use with v3 API and v2 parameters. It will be used for +# both the user and project domain in v3 and ignored in v2 authentication. +# (string value) +#default_domain_name = + +# User ID (string value) +#user_id = + +# Username (string value) +# Deprecated group/name - [service_user]/user_name +#username = + +# User's domain id (string value) +#user_domain_id = + +# User's domain name (string value) +#user_domain_name = + +# User's password (string value) +#password = + +# Tenant ID (string value) +#tenant_id = + +# Tenant Name (string value) +#tenant_name = + + +[spice] +# +# SPICE console feature allows you to connect to a guest virtual machine. +# SPICE is a replacement for fairly limited VNC protocol. +# +# Following requirements must be met in order to use SPICE: +# +# * Virtualization driver must be libvirt +# * spice.enabled set to True +# * vnc.enabled set to False +# * update html5proxy_base_url +# * update server_proxyclient_address + +# +# From nova.conf +# + +# +# Enable SPICE related features. +# +# Related options: +# +# * VNC must be explicitly disabled to get access to the SPICE console. Set the +# enabled option to False in the [vnc] section to disable the VNC console. +# (boolean value) +#enabled = false + +# +# Enable the SPICE guest agent support on the instances. +# +# The Spice agent works with the Spice protocol to offer a better guest console +# experience. However, the Spice console can still be used without the Spice +# Agent. With the Spice agent installed the following features are enabled: +# +# * Copy & Paste of text and images between the guest and client machine +# * Automatic adjustment of resolution when the client screen changes - e.g. +# if you make the Spice console full screen the guest resolution will adjust +# to +# match it rather than letterboxing. +# * Better mouse integration - The mouse can be captured and released without +# needing to click inside the console or press keys to release it. The +# performance of mouse movement is also improved. +# (boolean value) +#agent_enabled = true + +# +# Location of the SPICE HTML5 console proxy. +# +# End user would use this URL to connect to the `nova-spicehtml5proxy`` +# service. This service will forward request to the console of an instance. +# +# In order to use SPICE console, the service ``nova-spicehtml5proxy`` should be +# running. This service is typically launched on the controller node. +# +# Possible values: +# +# * Must be a valid URL of the form: ``http://host:port/spice_auto.html`` +# where host is the node running ``nova-spicehtml5proxy`` and the port is +# typically 6082. Consider not using default value as it is not well defined +# for any real deployment. +# +# Related options: +# +# * This option depends on ``html5proxy_host`` and ``html5proxy_port`` options. +# The access URL returned by the compute node must have the host +# and port where the ``nova-spicehtml5proxy`` service is listening. +# (uri value) +#html5proxy_base_url = http://127.0.0.1:6082/spice_auto.html + +# +# The address where the SPICE server running on the instances should listen. +# +# Typically, the ``nova-spicehtml5proxy`` proxy client runs on the controller +# node and connects over the private network to this address on the compute +# node(s). +# +# Possible values: +# +# * IP address to listen on. +# (string value) +#server_listen = 127.0.0.1 + +# +# The address used by ``nova-spicehtml5proxy`` client to connect to instance +# console. +# +# Typically, the ``nova-spicehtml5proxy`` proxy client runs on the +# controller node and connects over the private network to this address on the +# compute node(s). +# +# Possible values: +# +# * Any valid IP address on the compute node. +# +# Related options: +# +# * This option depends on the ``server_listen`` option. +# The proxy client must be able to access the address specified in +# ``server_listen`` using the value of this option. +# (string value) +#server_proxyclient_address = 127.0.0.1 + +# +# A keyboard layout which is supported by the underlying hypervisor on this +# node. +# +# Possible values: +# * This is usually an 'IETF language tag' (default is 'en-us'). If you +# use QEMU as hypervisor, you should find the list of supported keyboard +# layouts at /usr/share/qemu/keymaps. +# (string value) +#keymap = en-us + +# +# IP address or a hostname on which the ``nova-spicehtml5proxy`` service +# listens for incoming requests. +# +# Related options: +# +# * This option depends on the ``html5proxy_base_url`` option. +# The ``nova-spicehtml5proxy`` service must be listening on a host that is +# accessible from the HTML5 client. +# (unknown value) +#html5proxy_host = 0.0.0.0 + +# +# Port on which the ``nova-spicehtml5proxy`` service listens for incoming +# requests. +# +# Related options: +# +# * This option depends on the ``html5proxy_base_url`` option. +# The ``nova-spicehtml5proxy`` service must be listening on a port that is +# accessible from the HTML5 client. +# (port value) +# Minimum value: 0 +# Maximum value: 65535 +#html5proxy_port = 6082 + + +[upgrade_levels] +# +# upgrade_levels options are used to set version cap for RPC +# messages sent between different nova services. +# +# By default all services send messages using the latest version +# they know about. +# +# The compute upgrade level is an important part of rolling upgrades +# where old and new nova-compute services run side by side. +# +# The other options can largely be ignored, and are only kept to +# help with a possible future backport issue. + +# +# From nova.conf +# + +# +# Compute RPC API version cap. +# +# By default, we always send messages using the most recent version +# the client knows about. +# +# Where you have old and new compute services running, you should set +# this to the lowest deployed version. This is to guarantee that all +# services never send messages that one of the compute nodes can't +# understand. Note that we only support upgrading from release N to +# release N+1. +# +# Set this option to "auto" if you want to let the compute RPC module +# automatically determine what version to use based on the service +# versions in the deployment. +# +# Possible values: +# +# * By default send the latest version the client knows about +# * 'auto': Automatically determines what version to use based on +# the service versions in the deployment. +# * A string representing a version number in the format 'N.N'; +# for example, possible values might be '1.12' or '2.0'. +# * An OpenStack release name, in lower case, such as 'mitaka' or +# 'liberty'. +# (string value) +#compute = + +# Cells RPC API version cap (string value) +#cells = + +# Intercell RPC API version cap (string value) +#intercell = + +# Cert RPC API version cap (string value) +#cert = + +# Scheduler RPC API version cap (string value) +#scheduler = + +# Conductor RPC API version cap (string value) +#conductor = + +# Console RPC API version cap (string value) +#console = + +# Consoleauth RPC API version cap (string value) +#consoleauth = + +# Network RPC API version cap (string value) +#network = + +# Base API RPC API version cap (string value) +#baseapi = + + +[vault] + +# +# From nova.conf +# + +# root token for vault (string value) +#root_token_id = + +# Use this endpoint to connect to Vault, for example: "http://127.0.0.1:8200" +# (string value) +#vault_url = http://127.0.0.1:8200 + +# Absolute path to ca cert file (string value) +#ssl_ca_crt_file = + +# SSL Enabled/Disabled (boolean value) +#use_ssl = false + + +[vendordata_dynamic_auth] +# +# Options within this group control the authentication of the vendordata +# subsystem of the metadata API server (and config drive) with external systems. + +# +# From nova.conf +# + +# PEM encoded Certificate Authority to use when verifying HTTPs connections. +# (string value) +#cafile = + +# PEM encoded client certificate cert file (string value) +#certfile = + +# PEM encoded client certificate key file (string value) +#keyfile = + +# Verify HTTPS connections. (boolean value) +#insecure = false + +# Timeout value for http requests (integer value) +#timeout = + +# Authentication type to load (string value) +# Deprecated group/name - [vendordata_dynamic_auth]/auth_plugin +#auth_type = + +# Config Section from which to load plugin specific options (string value) +#auth_section = + +# Authentication URL (string value) +#auth_url = + +# Scope for system operations (string value) +#system_scope = + +# Domain ID to scope to (string value) +#domain_id = + +# Domain name to scope to (string value) +#domain_name = + +# Project ID to scope to (string value) +#project_id = + +# Project name to scope to (string value) +#project_name = + +# Domain ID containing project (string value) +#project_domain_id = + +# Domain name containing project (string value) +#project_domain_name = + +# Trust ID (string value) +#trust_id = + +# Optional domain ID to use with v3 and v2 parameters. It will be used for both +# the user and project domain in v3 and ignored in v2 authentication. (string +# value) +#default_domain_id = + +# Optional domain name to use with v3 API and v2 parameters. It will be used for +# both the user and project domain in v3 and ignored in v2 authentication. +# (string value) +#default_domain_name = + +# User ID (string value) +#user_id = + +# Username (string value) +# Deprecated group/name - [vendordata_dynamic_auth]/user_name +#username = + +# User's domain id (string value) +#user_domain_id = + +# User's domain name (string value) +#user_domain_name = + +# User's password (string value) +#password = + +# Tenant ID (string value) +#tenant_id = + +# Tenant Name (string value) +#tenant_name = + + +[vmware] +# +# Related options: +# Following options must be set in order to launch VMware-based +# virtual machines. +# +# * compute_driver: Must use vmwareapi.VMwareVCDriver. +# * vmware.host_username +# * vmware.host_password +# * vmware.cluster_name + +# +# From nova.conf +# + +# +# This option specifies the physical ethernet adapter name for VLAN +# networking. +# +# Set the vlan_interface configuration option to match the ESX host +# interface that handles VLAN-tagged VM traffic. +# +# Possible values: +# +# * Any valid string representing VLAN interface name +# (string value) +#vlan_interface = vmnic0 + +# +# This option should be configured only when using the NSX-MH Neutron +# plugin. This is the name of the integration bridge on the ESXi server +# or host. This should not be set for any other Neutron plugin. Hence +# the default value is not set. +# +# Possible values: +# +# * Any valid string representing the name of the integration bridge +# (string value) +#integration_bridge = + +# +# Set this value if affected by an increased network latency causing +# repeated characters when typing in a remote console. +# (integer value) +# Minimum value: 0 +#console_delay_seconds = + +# +# Identifies the remote system where the serial port traffic will +# be sent. +# +# This option adds a virtual serial port which sends console output to +# a configurable service URI. At the service URI address there will be +# virtual serial port concentrator that will collect console logs. +# If this is not set, no serial ports will be added to the created VMs. +# +# Possible values: +# +# * Any valid URI +# (string value) +#serial_port_service_uri = + +# +# Identifies a proxy service that provides network access to the +# serial_port_service_uri. +# +# Possible values: +# +# * Any valid URI (The scheme is 'telnet' or 'telnets'.) +# +# Related options: +# This option is ignored if serial_port_service_uri is not specified. +# * serial_port_service_uri +# (uri value) +#serial_port_proxy_uri = + +# +# Specifies the directory where the Virtual Serial Port Concentrator is +# storing console log files. It should match the 'serial_log_dir' config +# value of VSPC. +# (string value) +#serial_log_dir = /opt/vmware/vspc + +# +# Hostname or IP address for connection to VMware vCenter host. (unknown value) +#host_ip = + +# Port for connection to VMware vCenter host. (port value) +# Minimum value: 0 +# Maximum value: 65535 +#host_port = 443 + +# Username for connection to VMware vCenter host. (string value) +#host_username = + +# Password for connection to VMware vCenter host. (string value) +#host_password = + +# +# Specifies the CA bundle file to be used in verifying the vCenter +# server certificate. +# (string value) +#ca_file = + +# +# If true, the vCenter server certificate is not verified. If false, +# then the default CA truststore is used for verification. +# +# Related options: +# * ca_file: This option is ignored if "ca_file" is set. +# (boolean value) +#insecure = false + +# Name of a VMware Cluster ComputeResource. (string value) +#cluster_name = + +# +# Regular expression pattern to match the name of datastore. +# +# The datastore_regex setting specifies the datastores to use with +# Compute. For example, datastore_regex="nas.*" selects all the data +# stores that have a name starting with "nas". +# +# NOTE: If no regex is given, it just picks the datastore with the +# most freespace. +# +# Possible values: +# +# * Any matching regular expression to a datastore must be given +# (string value) +#datastore_regex = + +# +# Time interval in seconds to poll remote tasks invoked on +# VMware VC server. +# (floating point value) +#task_poll_interval = 0.5 + +# +# Number of times VMware vCenter server API must be retried on connection +# failures, e.g. socket error, etc. +# (integer value) +# Minimum value: 0 +#api_retry_count = 10 + +# +# This option specifies VNC starting port. +# +# Every VM created by ESX host has an option of enabling VNC client +# for remote connection. Above option 'vnc_port' helps you to set +# default starting port for the VNC client. +# +# Possible values: +# +# * Any valid port number within 5900 -(5900 + vnc_port_total) +# +# Related options: +# Below options should be set to enable VNC client. +# * vnc.enabled = True +# * vnc_port_total +# (port value) +# Minimum value: 0 +# Maximum value: 65535 +#vnc_port = 5900 + +# +# Total number of VNC ports. +# (integer value) +# Minimum value: 0 +#vnc_port_total = 10000 + +# +# This option enables/disables the use of linked clone. +# +# The ESX hypervisor requires a copy of the VMDK file in order to boot +# up a virtual machine. The compute driver must download the VMDK via +# HTTP from the OpenStack Image service to a datastore that is visible +# to the hypervisor and cache it. Subsequent virtual machines that need +# the VMDK use the cached version and don't have to copy the file again +# from the OpenStack Image service. +# +# If set to false, even with a cached VMDK, there is still a copy +# operation from the cache location to the hypervisor file directory +# in the shared datastore. If set to true, the above copy operation +# is avoided as it creates copy of the virtual machine that shares +# virtual disks with its parent VM. +# (boolean value) +#use_linked_clone = true + +# +# This option sets the http connection pool size +# +# The connection pool size is the maximum number of connections from nova to +# vSphere. It should only be increased if there are warnings indicating that +# the connection pool is full, otherwise, the default should suffice. +# (integer value) +# Minimum value: 10 +#connection_pool_size = 10 + +# +# This option enables or disables storage policy based placement +# of instances. +# +# Related options: +# +# * pbm_default_policy +# (boolean value) +#pbm_enabled = false + +# +# This option specifies the PBM service WSDL file location URL. +# +# Setting this will disable storage policy based placement +# of instances. +# +# Possible values: +# +# * Any valid file path +# e.g file:///opt/SDK/spbm/wsdl/pbmService.wsdl +# (string value) +#pbm_wsdl_location = + +# +# This option specifies the default policy to be used. +# +# If pbm_enabled is set and there is no defined storage policy for the +# specific request, then this policy will be used. +# +# Possible values: +# +# * Any valid storage policy such as VSAN default storage policy +# +# Related options: +# +# * pbm_enabled +# (string value) +#pbm_default_policy = + +# +# This option specifies the limit on the maximum number of objects to +# return in a single result. +# +# A positive value will cause the operation to suspend the retrieval +# when the count of objects reaches the specified limit. The server may +# still limit the count to something less than the configured value. +# Any remaining objects may be retrieved with additional requests. +# (integer value) +# Minimum value: 0 +#maximum_objects = 100 + +# +# This option adds a prefix to the folder where cached images are stored +# +# This is not the full path - just a folder prefix. This should only be +# used when a datastore cache is shared between compute nodes. +# +# Note: This should only be used when the compute nodes are running on same +# host or they have a shared file system. +# +# Possible values: +# +# * Any string representing the cache prefix to the folder +# (string value) +#cache_prefix = + + +[vnc] +vncserver_proxyclient_address = $my_ip +vncserver_listen = $my_ip +enabled = true +# +# Virtual Network Computer (VNC) can be used to provide remote desktop +# console access to instances for tenants and/or administrators. + +# +# From nova.conf +# + +# +# Enable VNC related features. +# +# Guests will get created with graphical devices to support this. Clients +# (for example Horizon) can then establish a VNC connection to the guest. +# (boolean value) +# Deprecated group/name - [DEFAULT]/vnc_enabled +#enabled = true + +# +# Keymap for VNC. +# +# The keyboard mapping (keymap) determines which keyboard layout a VNC +# session should use by default. +# +# Possible values: +# +# * A keyboard layout which is supported by the underlying hypervisor on +# this node. This is usually an 'IETF language tag' (for example +# 'en-us'). If you use QEMU as hypervisor, you should find the list +# of supported keyboard layouts at ``/usr/share/qemu/keymaps``. +# (string value) +# Deprecated group/name - [DEFAULT]/vnc_keymap +#keymap = en-us + +# +# The IP address or hostname on which an instance should listen to for +# incoming VNC connection requests on this node. +# (unknown value) +# Deprecated group/name - [DEFAULT]/vncserver_listen +# Deprecated group/name - [vnc]/vncserver_listen +#server_listen = 127.0.0.1 + +# +# Private, internal IP address or hostname of VNC console proxy. +# +# The VNC proxy is an OpenStack component that enables compute service +# users to access their instances through VNC clients. +# +# This option sets the private address to which proxy clients, such as +# ``nova-xvpvncproxy``, should connect to. +# (unknown value) +# Deprecated group/name - [DEFAULT]/vncserver_proxyclient_address +# Deprecated group/name - [vnc]/vncserver_proxyclient_address +#server_proxyclient_address = 127.0.0.1 + +# +# Public address of noVNC VNC console proxy. +# +# The VNC proxy is an OpenStack component that enables compute service +# users to access their instances through VNC clients. noVNC provides +# VNC support through a websocket-based client. +# +# This option sets the public base URL to which client systems will +# connect. noVNC clients can use this address to connect to the noVNC +# instance and, by extension, the VNC sessions. +# +# Related options: +# +# * novncproxy_host +# * novncproxy_port +# (uri value) +#novncproxy_base_url = http://127.0.0.1:6080/vnc_auto.html + +# +# IP address or hostname that the XVP VNC console proxy should bind to. +# +# The VNC proxy is an OpenStack component that enables compute service +# users to access their instances through VNC clients. Xen provides +# the Xenserver VNC Proxy, or XVP, as an alternative to the +# websocket-based noVNC proxy used by Libvirt. In contrast to noVNC, +# XVP clients are Java-based. +# +# This option sets the private address to which the XVP VNC console proxy +# service should bind to. +# +# Related options: +# +# * xvpvncproxy_port +# * xvpvncproxy_base_url +# (unknown value) +#xvpvncproxy_host = 0.0.0.0 + +# +# Port that the XVP VNC console proxy should bind to. +# +# The VNC proxy is an OpenStack component that enables compute service +# users to access their instances through VNC clients. Xen provides +# the Xenserver VNC Proxy, or XVP, as an alternative to the +# websocket-based noVNC proxy used by Libvirt. In contrast to noVNC, +# XVP clients are Java-based. +# +# This option sets the private port to which the XVP VNC console proxy +# service should bind to. +# +# Related options: +# +# * xvpvncproxy_host +# * xvpvncproxy_base_url +# (port value) +# Minimum value: 0 +# Maximum value: 65535 +#xvpvncproxy_port = 6081 + +# +# Public URL address of XVP VNC console proxy. +# +# The VNC proxy is an OpenStack component that enables compute service +# users to access their instances through VNC clients. Xen provides +# the Xenserver VNC Proxy, or XVP, as an alternative to the +# websocket-based noVNC proxy used by Libvirt. In contrast to noVNC, +# XVP clients are Java-based. +# +# This option sets the public base URL to which client systems will +# connect. XVP clients can use this address to connect to the XVP +# instance and, by extension, the VNC sessions. +# +# Related options: +# +# * xvpvncproxy_host +# * xvpvncproxy_port +# (uri value) +#xvpvncproxy_base_url = http://127.0.0.1:6081/console + +# +# IP address that the noVNC console proxy should bind to. +# +# The VNC proxy is an OpenStack component that enables compute service +# users to access their instances through VNC clients. noVNC provides +# VNC support through a websocket-based client. +# +# This option sets the private address to which the noVNC console proxy +# service should bind to. +# +# Related options: +# +# * novncproxy_port +# * novncproxy_base_url +# (string value) +#novncproxy_host = 0.0.0.0 + +# +# Port that the noVNC console proxy should bind to. +# +# The VNC proxy is an OpenStack component that enables compute service +# users to access their instances through VNC clients. noVNC provides +# VNC support through a websocket-based client. +# +# This option sets the private port to which the noVNC console proxy +# service should bind to. +# +# Related options: +# +# * novncproxy_host +# * novncproxy_base_url +# (port value) +# Minimum value: 0 +# Maximum value: 65535 +#novncproxy_port = 6080 + +# +# The authentication schemes to use with the compute node. +# +# Control what RFB authentication schemes are permitted for connections between +# the proxy and the compute host. If multiple schemes are enabled, the first +# matching scheme will be used, thus the strongest schemes should be listed +# first. +# +# Possible values: +# +# * ``none``: allow connection without authentication +# * ``vencrypt``: use VeNCrypt authentication scheme +# +# Related options: +# +# * ``[vnc]vencrypt_client_key``, ``[vnc]vencrypt_client_cert``: must also be +# set +# (list value) +#auth_schemes = none + +# The path to the client certificate PEM file (for x509) +# +# The fully qualified path to a PEM file containing the private key which the +# VNC +# proxy server presents to the compute node during VNC authentication. +# +# Related options: +# +# * ``vnc.auth_schemes``: must include ``vencrypt`` +# * ``vnc.vencrypt_client_cert``: must also be set +# (string value) +#vencrypt_client_key = + +# The path to the client key file (for x509) +# +# The fully qualified path to a PEM file containing the x509 certificate which +# the VNC proxy server presents to the compute node during VNC authentication. +# +# Realted options: +# +# * ``vnc.auth_schemes``: must include ``vencrypt`` +# * ``vnc.vencrypt_client_key``: must also be set +# (string value) +#vencrypt_client_cert = + +# The path to the CA certificate PEM file +# +# The fully qualified path to a PEM file containing one or more x509 +# certificates +# for the certificate authorities used by the compute node VNC server. +# +# Related options: +# +# * ``vnc.auth_schemes``: must include ``vencrypt`` +# (string value) +#vencrypt_ca_certs = + + +[workarounds] +# +# A collection of workarounds used to mitigate bugs or issues found in system +# tools (e.g. Libvirt or QEMU) or Nova itself under certain conditions. These +# should only be enabled in exceptional circumstances. All options are linked +# against bug IDs, where more information on the issue can be found. + +# +# From nova.conf +# + +# +# Use sudo instead of rootwrap. +# +# Allow fallback to sudo for performance reasons. +# +# For more information, refer to the bug report: +# +# https://bugs.launchpad.net/nova/+bug/1415106 +# +# Possible values: +# +# * True: Use sudo instead of rootwrap +# * False: Use rootwrap as usual +# +# Interdependencies to other options: +# +# * Any options that affect 'rootwrap' will be ignored. +# (boolean value) +#disable_rootwrap = false + +# +# Disable live snapshots when using the libvirt driver. +# +# Live snapshots allow the snapshot of the disk to happen without an +# interruption to the guest, using coordination with a guest agent to +# quiesce the filesystem. +# +# When using libvirt 1.2.2 live snapshots fail intermittently under load +# (likely related to concurrent libvirt/qemu operations). This config +# option provides a mechanism to disable live snapshot, in favor of cold +# snapshot, while this is resolved. Cold snapshot causes an instance +# outage while the guest is going through the snapshotting process. +# +# For more information, refer to the bug report: +# +# https://bugs.launchpad.net/nova/+bug/1334398 +# +# Possible values: +# +# * True: Live snapshot is disabled when using libvirt +# * False: Live snapshots are always used when snapshotting (as long as +# there is a new enough libvirt and the backend storage supports it) +# (boolean value) +#disable_libvirt_livesnapshot = false + +# +# Enable handling of events emitted from compute drivers. +# +# Many compute drivers emit lifecycle events, which are events that occur when, +# for example, an instance is starting or stopping. If the instance is going +# through task state changes due to an API operation, like resize, the events +# are ignored. +# +# This is an advanced feature which allows the hypervisor to signal to the +# compute service that an unexpected state change has occurred in an instance +# and that the instance can be shutdown automatically. Unfortunately, this can +# race in some conditions, for example in reboot operations or when the compute +# service or when host is rebooted (planned or due to an outage). If such races +# are common, then it is advisable to disable this feature. +# +# Care should be taken when this feature is disabled and +# 'sync_power_state_interval' is set to a negative value. In this case, any +# instances that get out of sync between the hypervisor and the Nova database +# will have to be synchronized manually. +# +# For more information, refer to the bug report: +# +# https://bugs.launchpad.net/bugs/1444630 +# +# Interdependencies to other options: +# +# * If ``sync_power_state_interval`` is negative and this feature is disabled, +# then instances that get out of sync between the hypervisor and the Nova +# database will have to be synchronized manually. +# (boolean value) +#handle_virt_lifecycle_events = true + +# +# Disable the server group policy check upcall in compute. +# +# In order to detect races with server group affinity policy, the compute +# service attempts to validate that the policy was not violated by the +# scheduler. It does this by making an upcall to the API database to list +# the instances in the server group for one that it is booting, which violates +# our api/cell isolation goals. Eventually this will be solved by proper +# affinity +# guarantees in the scheduler and placement service, but until then, this late +# check is needed to ensure proper affinity policy. +# +# Operators that desire api/cell isolation over this check should +# enable this flag, which will avoid making that upcall from compute. +# +# Related options: +# +# * [filter_scheduler]/track_instance_changes also relies on upcalls from the +# compute service to the scheduler service. +# (boolean value) +#disable_group_policy_check_upcall = false + + +[wsgi] +# +# Options under this group are used to configure WSGI (Web Server Gateway +# Interface). WSGI is used to serve API requests. + +# +# From nova.conf +# + +# +# This option represents a file name for the paste.deploy config for nova-api. +# +# Possible values: +# +# * A string representing file name for the paste.deploy config. +# (string value) +#api_paste_config = api-paste.ini + +# DEPRECATED: +# It represents a python format string that is used as the template to generate +# log lines. The following values can be formatted into it: client_ip, +# date_time, request_line, status_code, body_length, wall_seconds. +# +# This option is used for building custom request loglines when running +# nova-api under eventlet. If used under uwsgi or apache, this option +# has no effect. +# +# Possible values: +# +# * '%(client_ip)s "%(request_line)s" status: %(status_code)s' +# 'len: %(body_length)s time: %(wall_seconds).7f' (default) +# * Any formatted string formed by specific values. +# (string value) +# This option is deprecated for removal since 16.0.0. +# Its value may be silently ignored in the future. +# Reason: +# This option only works when running nova-api under eventlet, and +# encodes very eventlet specific pieces of information. Starting in Pike +# the preferred model for running nova-api is under uwsgi or apache +# mod_wsgi. +#wsgi_log_format = %(client_ip)s "%(request_line)s" status: %(status_code)s len: %(body_length)s time: %(wall_seconds).7f + +# +# This option specifies the HTTP header used to determine the protocol scheme +# for the original request, even if it was removed by a SSL terminating proxy. +# +# Possible values: +# +# * None (default) - the request scheme is not influenced by any HTTP headers +# * Valid HTTP header, like HTTP_X_FORWARDED_PROTO +# +# WARNING: Do not set this unless you know what you are doing. +# +# Make sure ALL of the following are true before setting this (assuming the +# values from the example above): +# * Your API is behind a proxy. +# * Your proxy strips the X-Forwarded-Proto header from all incoming requests. +# In other words, if end users include that header in their requests, the +# proxy +# will discard it. +# * Your proxy sets the X-Forwarded-Proto header and sends it to API, but only +# for requests that originally come in via HTTPS. +# +# If any of those are not true, you should keep this setting set to None. +# +# (string value) +#secure_proxy_ssl_header = + +# +# This option allows setting path to the CA certificate file that should be used +# to verify connecting clients. +# +# Possible values: +# +# * String representing path to the CA certificate file. +# +# Related options: +# +# * enabled_ssl_apis +# (string value) +#ssl_ca_file = + +# +# This option allows setting path to the SSL certificate of API server. +# +# Possible values: +# +# * String representing path to the SSL certificate. +# +# Related options: +# +# * enabled_ssl_apis +# (string value) +#ssl_cert_file = + +# +# This option specifies the path to the file where SSL private key of API +# server is stored when SSL is in effect. +# +# Possible values: +# +# * String representing path to the SSL private key. +# +# Related options: +# +# * enabled_ssl_apis +# (string value) +#ssl_key_file = + +# +# This option sets the value of TCP_KEEPIDLE in seconds for each server socket. +# It specifies the duration of time to keep connection active. TCP generates a +# KEEPALIVE transmission for an application that requests to keep connection +# active. Not supported on OS X. +# +# Related options: +# +# * keep_alive +# (integer value) +# Minimum value: 0 +#tcp_keepidle = 600 + +# +# This option specifies the size of the pool of greenthreads used by wsgi. +# It is possible to limit the number of concurrent connections using this +# option. +# (integer value) +# Minimum value: 0 +# Deprecated group/name - [DEFAULT]/wsgi_default_pool_size +#default_pool_size = 1000 + +# +# This option specifies the maximum line size of message headers to be accepted. +# max_header_line may need to be increased when using large tokens (typically +# those generated by the Keystone v3 API with big service catalogs). +# +# Since TCP is a stream based protocol, in order to reuse a connection, the HTTP +# has to have a way to indicate the end of the previous response and beginning +# of the next. Hence, in a keep_alive case, all messages must have a +# self-defined message length. +# (integer value) +# Minimum value: 0 +#max_header_line = 16384 + +# +# This option allows using the same TCP connection to send and receive multiple +# HTTP requests/responses, as opposed to opening a new one for every single +# request/response pair. HTTP keep-alive indicates HTTP connection reuse. +# +# Possible values: +# +# * True : reuse HTTP connection. +# * False : closes the client socket connection explicitly. +# +# Related options: +# +# * tcp_keepidle +# (boolean value) +# Deprecated group/name - [DEFAULT]/wsgi_keep_alive +#keep_alive = true + +# +# This option specifies the timeout for client connections' socket operations. +# If an incoming connection is idle for this number of seconds it will be +# closed. It indicates timeout on individual read/writes on the socket +# connection. To wait forever set to 0. +# (integer value) +# Minimum value: 0 +#client_socket_timeout = 900 + + +[xenserver] +# +# XenServer options are used when the compute_driver is set to use +# XenServer (compute_driver=xenapi.XenAPIDriver). +# +# Must specify connection_url, connection_password and ovs_integration_bridge to +# use compute_driver=xenapi.XenAPIDriver. + +# +# From nova.conf +# + +# +# Number of seconds to wait for agent's reply to a request. +# +# Nova configures/performs certain administrative actions on a server with the +# help of an agent that's installed on the server. The communication between +# Nova and the agent is achieved via sharing messages, called records, over +# xenstore, a shared storage across all the domains on a Xenserver host. +# Operations performed by the agent on behalf of nova are: 'version',' +# key_init', +# 'password','resetnetwork','inject_file', and 'agentupdate'. +# +# To perform one of the above operations, the xapi 'agent' plugin writes the +# command and its associated parameters to a certain location known to the +# domain +# and awaits response. On being notified of the message, the agent performs +# appropriate actions on the server and writes the result back to xenstore. This +# result is then read by the xapi 'agent' plugin to determine the +# success/failure +# of the operation. +# +# This config option determines how long the xapi 'agent' plugin shall wait to +# read the response off of xenstore for a given request/command. If the agent on +# the instance fails to write the result in this time period, the operation is +# considered to have timed out. +# +# Related options: +# +# * ``agent_version_timeout`` +# * ``agent_resetnetwork_timeout`` +# +# (integer value) +# Minimum value: 0 +#agent_timeout = 30 + +# +# Number of seconds to wait for agent't reply to version request. +# +# This indicates the amount of time xapi 'agent' plugin waits for the agent to +# respond to the 'version' request specifically. The generic timeout for agent +# communication ``agent_timeout`` is ignored in this case. +# +# During the build process the 'version' request is used to determine if the +# agent is available/operational to perform other requests such as +# 'resetnetwork', 'password', 'key_init' and 'inject_file'. If the 'version' +# call +# fails, the other configuration is skipped. So, this configuration option can +# also be interpreted as time in which agent is expected to be fully +# operational. +# (integer value) +# Minimum value: 0 +#agent_version_timeout = 300 + +# +# Number of seconds to wait for agent's reply to resetnetwork +# request. +# +# This indicates the amount of time xapi 'agent' plugin waits for the agent to +# respond to the 'resetnetwork' request specifically. The generic timeout for +# agent communication ``agent_timeout`` is ignored in this case. +# (integer value) +# Minimum value: 0 +#agent_resetnetwork_timeout = 60 + +# +# Path to locate guest agent on the server. +# +# Specifies the path in which the XenAPI guest agent should be located. If the +# agent is present, network configuration is not injected into the image. +# +# Related options: +# +# For this option to have an effect: +# * ``flat_injected`` should be set to ``True`` +# * ``compute_driver`` should be set to ``xenapi.XenAPIDriver`` +# +# (string value) +#agent_path = usr/sbin/xe-update-networking + +# +# Disables the use of XenAPI agent. +# +# This configuration option suggests whether the use of agent should be enabled +# or not regardless of what image properties are present. Image properties have +# an effect only when this is set to ``True``. Read description of config option +# ``use_agent_default`` for more information. +# +# Related options: +# +# * ``use_agent_default`` +# +# (boolean value) +#disable_agent = false + +# +# Whether or not to use the agent by default when its usage is enabled but not +# indicated by the image. +# +# The use of XenAPI agent can be disabled altogether using the configuration +# option ``disable_agent``. However, if it is not disabled, the use of an agent +# can still be controlled by the image in use through one of its properties, +# ``xenapi_use_agent``. If this property is either not present or specified +# incorrectly on the image, the use of agent is determined by this configuration +# option. +# +# Note that if this configuration is set to ``True`` when the agent is not +# present, the boot times will increase significantly. +# +# Related options: +# +# * ``disable_agent`` +# +# (boolean value) +#use_agent_default = false + +# Timeout in seconds for XenAPI login. (integer value) +# Minimum value: 0 +#login_timeout = 10 + +# +# Maximum number of concurrent XenAPI connections. +# +# In nova, multiple XenAPI requests can happen at a time. +# Configuring this option will parallelize access to the XenAPI +# session, which allows you to make concurrent XenAPI connections. +# (integer value) +# Minimum value: 1 +#connection_concurrent = 5 + +# +# Cache glance images locally. +# +# The value for this option must be chosen from the choices listed +# here. Configuring a value other than these will default to 'all'. +# +# Note: There is nothing that deletes these images. +# +# Possible values: +# +# * `all`: will cache all images. +# * `some`: will only cache images that have the +# image_property `cache_in_nova=True`. +# * `none`: turns off caching entirely. +# (string value) +# Possible values: +# all - +# some - +# none - +#cache_images = all + +# +# Compression level for images. +# +# By setting this option we can configure the gzip compression level. +# This option sets GZIP environment variable before spawning tar -cz +# to force the compression level. It defaults to none, which means the +# GZIP environment variable is not set and the default (usually -6) +# is used. +# +# Possible values: +# +# * Range is 1-9, e.g., 9 for gzip -9, 9 being most +# compressed but most CPU intensive on dom0. +# * Any values out of this range will default to None. +# (integer value) +# Minimum value: 1 +# Maximum value: 9 +#image_compression_level = + +# Default OS type used when uploading an image to glance (string value) +#default_os_type = linux + +# Time in secs to wait for a block device to be created (integer value) +# Minimum value: 1 +#block_device_creation_timeout = 10 + +# +# Maximum size in bytes of kernel or ramdisk images. +# +# Specifying the maximum size of kernel or ramdisk will avoid copying +# large files to dom0 and fill up /boot/guest. +# (integer value) +#max_kernel_ramdisk_size = 16777216 + +# +# Filter for finding the SR to be used to install guest instances on. +# +# Possible values: +# +# * To use the Local Storage in default XenServer/XCP installations +# set this flag to other-config:i18n-key=local-storage. +# * To select an SR with a different matching criteria, you could +# set it to other-config:my_favorite_sr=true. +# * To fall back on the Default SR, as displayed by XenCenter, +# set this flag to: default-sr:true. +# (string value) +#sr_matching_filter = default-sr:true + +# +# Whether to use sparse_copy for copying data on a resize down. +# (False will use standard dd). This speeds up resizes down +# considerably since large runs of zeros won't have to be rsynced. +# (boolean value) +#sparse_copy = true + +# +# Maximum number of retries to unplug VBD. +# If set to 0, should try once, no retries. +# (integer value) +# Minimum value: 0 +#num_vbd_unplug_retries = 10 + +# +# Name of network to use for booting iPXE ISOs. +# +# An iPXE ISO is a specially crafted ISO which supports iPXE booting. +# This feature gives a means to roll your own image. +# +# By default this option is not set. Enable this option to +# boot an iPXE ISO. +# +# Related Options: +# +# * `ipxe_boot_menu_url` +# * `ipxe_mkisofs_cmd` +# (string value) +#ipxe_network_name = + +# +# URL to the iPXE boot menu. +# +# An iPXE ISO is a specially crafted ISO which supports iPXE booting. +# This feature gives a means to roll your own image. +# +# By default this option is not set. Enable this option to +# boot an iPXE ISO. +# +# Related Options: +# +# * `ipxe_network_name` +# * `ipxe_mkisofs_cmd` +# (string value) +#ipxe_boot_menu_url = + +# +# Name and optionally path of the tool used for ISO image creation. +# +# An iPXE ISO is a specially crafted ISO which supports iPXE booting. +# This feature gives a means to roll your own image. +# +# Note: By default `mkisofs` is not present in the Dom0, so the +# package can either be manually added to Dom0 or include the +# `mkisofs` binary in the image itself. +# +# Related Options: +# +# * `ipxe_network_name` +# * `ipxe_boot_menu_url` +# (string value) +#ipxe_mkisofs_cmd = mkisofs + +# +# URL for connection to XenServer/Xen Cloud Platform. A special value +# of unix://local can be used to connect to the local unix socket. +# +# Possible values: +# +# * Any string that represents a URL. The connection_url is +# generally the management network IP address of the XenServer. +# * This option must be set if you chose the XenServer driver. +# (string value) +#connection_url = + +# Username for connection to XenServer/Xen Cloud Platform (string value) +#connection_username = root + +# Password for connection to XenServer/Xen Cloud Platform (string value) +#connection_password = + +# +# The interval used for polling of coalescing vhds. +# +# This is the interval after which the task of coalesce VHD is +# performed, until it reaches the max attempts that is set by +# vhd_coalesce_max_attempts. +# +# Related options: +# +# * `vhd_coalesce_max_attempts` +# (floating point value) +# Minimum value: 0 +#vhd_coalesce_poll_interval = 5.0 + +# +# Ensure compute service is running on host XenAPI connects to. +# This option must be set to false if the 'independent_compute' +# option is set to true. +# +# Possible values: +# +# * Setting this option to true will make sure that compute service +# is running on the same host that is specified by connection_url. +# * Setting this option to false, doesn't perform the check. +# +# Related options: +# +# * `independent_compute` +# (boolean value) +#check_host = true + +# +# Max number of times to poll for VHD to coalesce. +# +# This option determines the maximum number of attempts that can be +# made for coalescing the VHD before giving up. +# +# Related opitons: +# +# * `vhd_coalesce_poll_interval` +# (integer value) +# Minimum value: 0 +#vhd_coalesce_max_attempts = 20 + +# Base path to the storage repository on the XenServer host. (string value) +#sr_base_path = /var/run/sr-mount + +# +# The iSCSI Target Host. +# +# This option represents the hostname or ip of the iSCSI Target. +# If the target host is not present in the connection information from +# the volume provider then the value from this option is taken. +# +# Possible values: +# +# * Any string that represents hostname/ip of Target. +# (unknown value) +#target_host = + +# +# The iSCSI Target Port. +# +# This option represents the port of the iSCSI Target. If the +# target port is not present in the connection information from the +# volume provider then the value from this option is taken. +# (port value) +# Minimum value: 0 +# Maximum value: 65535 +#target_port = 3260 + +# +# Used to prevent attempts to attach VBDs locally, so Nova can +# be run in a VM on a different host. +# +# Related options: +# +# * ``CONF.flat_injected`` (Must be False) +# * ``CONF.xenserver.check_host`` (Must be False) +# * ``CONF.default_ephemeral_format`` (Must be unset or 'ext3') +# * Joining host aggregates (will error if attempted) +# * Swap disks for Windows VMs (will error if attempted) +# * Nova-based auto_configure_disk (will error if attempted) +# (boolean value) +#independent_compute = false + +# +# Wait time for instances to go to running state. +# +# Provide an integer value representing time in seconds to set the +# wait time for an instance to go to running state. +# +# When a request to create an instance is received by nova-api and +# communicated to nova-compute, the creation of the instance occurs +# through interaction with Xen via XenAPI in the compute node. Once +# the node on which the instance(s) are to be launched is decided by +# nova-schedule and the launch is triggered, a certain amount of wait +# time is involved until the instance(s) can become available and +# 'running'. This wait time is defined by running_timeout. If the +# instances do not go to running state within this specified wait +# time, the launch expires and the instance(s) are set to 'error' +# state. +# (integer value) +# Minimum value: 0 +#running_timeout = 60 + +# DEPRECATED: +# The XenAPI VIF driver using XenServer Network APIs. +# +# Provide a string value representing the VIF XenAPI vif driver to use for +# plugging virtual network interfaces. +# +# Xen configuration uses bridging within the backend domain to allow +# all VMs to appear on the network as individual hosts. Bridge +# interfaces are used to create a XenServer VLAN network in which +# the VIFs for the VM instances are plugged. If no VIF bridge driver +# is plugged, the bridge is not made available. This configuration +# option takes in a value for the VIF driver. +# +# Possible values: +# +# * nova.virt.xenapi.vif.XenAPIOpenVswitchDriver (default) +# * nova.virt.xenapi.vif.XenAPIBridgeDriver (deprecated) +# +# Related options: +# +# * ``vlan_interface`` +# * ``ovs_integration_bridge`` +# (string value) +# This option is deprecated for removal since 15.0.0. +# Its value may be silently ignored in the future. +# Reason: +# There are only two in-tree vif drivers for XenServer. XenAPIBridgeDriver is +# for +# nova-network which is deprecated and XenAPIOpenVswitchDriver is for Neutron +# which is the default configuration for Nova since the 15.0.0 Ocata release. In +# the future the "use_neutron" configuration option will be used to determine +# which vif driver to use. +#vif_driver = nova.virt.xenapi.vif.XenAPIOpenVswitchDriver + +# +# Dom0 plugin driver used to handle image uploads. +# +# Provide a string value representing a plugin driver required to +# handle the image uploading to GlanceStore. +# +# Images, and snapshots from XenServer need to be uploaded to the data +# store for use. image_upload_handler takes in a value for the Dom0 +# plugin driver. This driver is then called to uplaod images to the +# GlanceStore. +# (string value) +#image_upload_handler = nova.virt.xenapi.image.glance.GlanceStore + +# +# Number of seconds to wait for SR to settle if the VDI +# does not exist when first introduced. +# +# Some SRs, particularly iSCSI connections are slow to see the VDIs +# right after they got introduced. Setting this option to a +# time interval will make the SR to wait for that time period +# before raising VDI not found exception. +# (integer value) +# Minimum value: 0 +#introduce_vdi_retry_wait = 20 + +# +# The name of the integration Bridge that is used with xenapi +# when connecting with Open vSwitch. +# +# Note: The value of this config option is dependent on the +# environment, therefore this configuration value must be set +# accordingly if you are using XenAPI. +# +# Possible values: +# +# * Any string that represents a bridge name. +# (string value) +#ovs_integration_bridge = + +# +# When adding new host to a pool, this will append a --force flag to the +# command, forcing hosts to join a pool, even if they have different CPUs. +# +# Since XenServer version 5.6 it is possible to create a pool of hosts that have +# different CPU capabilities. To accommodate CPU differences, XenServer limited +# features it uses to determine CPU compatibility to only the ones that are +# exposed by CPU and support for CPU masking was added. +# Despite this effort to level differences between CPUs, it is still possible +# that adding new host will fail, thus option to force join was introduced. +# (boolean value) +#use_join_force = true + +# +# Publicly visible name for this console host. +# +# Possible values: +# +# * Current hostname (default) or any string representing hostname. +# (string value) +#console_public_hostname = + + +[xvp] +# +# Configuration options for XVP. +# +# xvp (Xen VNC Proxy) is a proxy server providing password-protected VNC-based +# access to the consoles of virtual machines hosted on Citrix XenServer. + +# +# From nova.conf +# + +# XVP conf template (string value) +#console_xvp_conf_template = $pybasedir/nova/console/xvp.conf.template + +# Generated XVP conf file (string value) +#console_xvp_conf = /etc/xvp.conf + +# XVP master process pid file (string value) +#console_xvp_pid = /var/run/xvp.pid + +# XVP log file (string value) +#console_xvp_log = /var/log/xvp.log + +# Port for XVP to multiplex VNC connections on (port value) +# Minimum value: 0 +# Maximum value: 65535 +#console_xvp_multiplex_port = 5900 diff --git a/openstack/openstack_conf/controller/nova/rootwrap.conf b/openstack/openstack_conf/controller/nova/rootwrap.conf new file mode 100644 index 0000000..c6fd564 --- /dev/null +++ b/openstack/openstack_conf/controller/nova/rootwrap.conf @@ -0,0 +1,27 @@ +# Configuration for nova-rootwrap +# This file should be owned by (and only-writeable by) the root user + +[DEFAULT] +# List of directories to load filter definitions from (separated by ','). +# These directories MUST all be only writeable by root ! +filters_path=/etc/nova/rootwrap.d,/usr/share/nova/rootwrap + +# List of directories to search executables in, in case filters do not +# explicitly specify a full path (separated by ',') +# If not specified, defaults to system PATH environment variable. +# These directories MUST all be only writeable by root ! +exec_dirs=/sbin,/usr/sbin,/bin,/usr/bin,/usr/local/sbin,/usr/local/bin + +# Enable logging to syslog +# Default value is False +use_syslog=False + +# Which syslog facility to use. +# Valid values include auth, authpriv, syslog, local0, local1... +# Default value is 'syslog' +syslog_log_facility=syslog + +# Which messages to log. +# INFO means log all usage +# ERROR means only log unsuccessful attempts +syslog_log_level=ERROR diff --git a/openstack/openstack_conf/controller/nova/rootwrap.d/api-metadata.filters b/openstack/openstack_conf/controller/nova/rootwrap.d/api-metadata.filters new file mode 100644 index 0000000..1aa6f83 --- /dev/null +++ b/openstack/openstack_conf/controller/nova/rootwrap.d/api-metadata.filters @@ -0,0 +1,13 @@ +# nova-rootwrap command filters for api-metadata nodes +# This is needed on nova-api hosts running with "metadata" in enabled_apis +# or when running nova-api-metadata +# This file should be owned by (and only-writeable by) the root user + +[Filters] +# nova/network/linux_net.py: 'ip[6]tables-save' % (cmd, '-t', ... +iptables-save: CommandFilter, iptables-save, root +ip6tables-save: CommandFilter, ip6tables-save, root + +# nova/network/linux_net.py: 'ip[6]tables-restore' % (cmd,) +iptables-restore: CommandFilter, iptables-restore, root +ip6tables-restore: CommandFilter, ip6tables-restore, root diff --git a/openstack/passthrough.md b/openstack/passthrough.md index 3d2e06c..372dd2f 100644 --- a/openstack/passthrough.md +++ b/openstack/passthrough.md @@ -3,8 +3,14 @@ ### https://blog.csdn.net/u012336567/article/details/74743168 ``` bash +10de:1c03,10de:10f1 + +1002:67df,1002:aaf0 + +10de:1c03,10de:10f1 + sudo nano /etc/default/grub -#GRUB_CMDLINE_LINUX_DEFAULT="quiet splash intel_iommu=on vfio-pci.ids=1002:67df,1002:aaf0" +#GRUB_CMDLINE_LINUX_DEFAULT="quiet splash intel_iommu=on vfio-pci.ids=10de:1c03,10de:10f1" sudo update-grub sudo update-grub2 @@ -35,7 +41,7 @@ sudo nano /etc/modprobe.d/amdgpu-kms.conf nano /etc/modprobe.d/vfio.conf -options vfio-pci ids=10de:1401,10de:0fba +options vfio-pci ids=10de:1c03,10de:10f1 sudo nano /etc/initramfs-tools/modules @@ -51,4 +57,5 @@ nano /etc/libvirt/qemu.conf nvram = ["/usr/share/OVMF/OVMF_CODE.fd:/usr/share/OVMF/OVMF_VARS.fd"] +find /sys/kernel/iommu_groups/ -type l ``` \ No newline at end of file diff --git a/python/换源.md b/python/换源.md index 72ae1aa..cc03571 100644 --- a/python/换源.md +++ b/python/换源.md @@ -1,4 +1,7 @@ # 换源 nano ~/.pip/pip.conf + [global] -index-url = http://mirrors.aliyun.com/pypi/simple/ \ No newline at end of file +index-url = http://mirrors.aliyun.com/pypi/simple/ +[install] +trusted-host = mirrors.aliyun.com \ No newline at end of file diff --git a/ubuntu/iptables设置端口转发.md b/ubuntu/iptables设置端口转发.md index 1ca7fd6..14f4bc9 100755 --- a/ubuntu/iptables设置端口转发.md +++ b/ubuntu/iptables设置端口转发.md @@ -39,7 +39,7 @@ packet out|转发包|10.138.108.103:X|192.168.1.1:8001 将下项注释去掉 ``` bash -# net.ipv4.ipv4_forward=1 +# net.ipv4.ip_forward=1 ``` 使改动生效