66826e9e5b
This code introduces standalone service which proxies its calls to existing nova EC2-API. All the code here except for the ec2api/api/proxy.py, ec2api/api/ec2client.py and some util functions is taken from current nova and unused functionality is cut of it. The proxy.py and ec2client.py files implement the new code which proxies incoming request (on port 8788) to original EC2 API in nova on port 8773. The result is transparently translated back to user. Change-Id: I4cb84f833d7d4f0e379672710ed39562811d43e0
718 lines
21 KiB
Plaintext
718 lines
21 KiB
Plaintext
[DEFAULT]
|
|
|
|
#
|
|
# Options defined in oslo.messaging
|
|
#
|
|
|
|
# Use durable queues in amqp. (boolean value)
|
|
# Deprecated group/name - [DEFAULT]/rabbit_durable_queues
|
|
#amqp_durable_queues=false
|
|
|
|
# Auto-delete queues in amqp. (boolean value)
|
|
#amqp_auto_delete=false
|
|
|
|
# Size of RPC connection pool. (integer value)
|
|
#rpc_conn_pool_size=30
|
|
|
|
# Modules of exceptions that are permitted to be recreated
|
|
# upon receiving exception data from an rpc call. (list value)
|
|
#allowed_rpc_exception_modules=oslo.messaging.exceptions,nova.exception,cinder.exception,exceptions
|
|
|
|
# Qpid broker hostname. (string value)
|
|
#qpid_hostname=nova
|
|
|
|
# Qpid broker port. (integer value)
|
|
#qpid_port=5672
|
|
|
|
# Qpid HA cluster host:port pairs. (list value)
|
|
#qpid_hosts=$qpid_hostname:$qpid_port
|
|
|
|
# Username for Qpid connection. (string value)
|
|
#qpid_username=
|
|
|
|
# Password for Qpid connection. (string value)
|
|
#qpid_password=
|
|
|
|
# Space separated list of SASL mechanisms to use for auth.
|
|
# (string value)
|
|
#qpid_sasl_mechanisms=
|
|
|
|
# Seconds between connection keepalive heartbeats. (integer
|
|
# value)
|
|
#qpid_heartbeat=60
|
|
|
|
# Transport to use, either 'tcp' or 'ssl'. (string value)
|
|
#qpid_protocol=tcp
|
|
|
|
# Whether to disable the Nagle algorithm. (boolean value)
|
|
#qpid_tcp_nodelay=true
|
|
|
|
# The qpid topology version to use. Version 1 is what was
|
|
# originally used by impl_qpid. Version 2 includes some
|
|
# backwards-incompatible changes that allow broker federation
|
|
# to work. Users should update to version 2 when they are
|
|
# able to take everything down, as it requires a clean break.
|
|
# (integer value)
|
|
#qpid_topology_version=1
|
|
|
|
# SSL version to use (valid only if SSL enabled). valid values
|
|
# are TLSv1, SSLv23 and SSLv3. SSLv2 may be available on some
|
|
# distributions. (string value)
|
|
#kombu_ssl_version=
|
|
|
|
# SSL key file (valid only if SSL enabled). (string value)
|
|
#kombu_ssl_keyfile=
|
|
|
|
# SSL cert file (valid only if SSL enabled). (string value)
|
|
#kombu_ssl_certfile=
|
|
|
|
# SSL certification authority file (valid only if SSL
|
|
# enabled). (string value)
|
|
#kombu_ssl_ca_certs=
|
|
|
|
# How long to wait before reconnecting in response to an AMQP
|
|
# consumer cancel notification. (floating point value)
|
|
#kombu_reconnect_delay=1.0
|
|
|
|
# The RabbitMQ broker address where a single node is used.
|
|
# (string value)
|
|
#rabbit_host=nova
|
|
|
|
# The RabbitMQ broker port where a single node is used.
|
|
# (integer value)
|
|
#rabbit_port=5672
|
|
|
|
# RabbitMQ HA cluster host:port pairs. (list value)
|
|
#rabbit_hosts=$rabbit_host:$rabbit_port
|
|
|
|
# Connect over SSL for RabbitMQ. (boolean value)
|
|
#rabbit_use_ssl=false
|
|
|
|
# The RabbitMQ userid. (string value)
|
|
#rabbit_userid=guest
|
|
|
|
# The RabbitMQ password. (string value)
|
|
#rabbit_password=guest
|
|
|
|
# the RabbitMQ login method (string value)
|
|
#rabbit_login_method=AMQPLAIN
|
|
|
|
# The RabbitMQ virtual host. (string value)
|
|
#rabbit_virtual_host=/
|
|
|
|
# How frequently to retry connecting with RabbitMQ. (integer
|
|
# value)
|
|
#rabbit_retry_interval=1
|
|
|
|
# How long to backoff for between retries when connecting to
|
|
# RabbitMQ. (integer value)
|
|
#rabbit_retry_backoff=2
|
|
|
|
# Maximum number of RabbitMQ connection retries. Default is 0
|
|
# (infinite retry count). (integer value)
|
|
#rabbit_max_retries=0
|
|
|
|
# Use HA queues in RabbitMQ (x-ha-policy: all). If you change
|
|
# this option, you must wipe the RabbitMQ database. (boolean
|
|
# value)
|
|
#rabbit_ha_queues=false
|
|
|
|
# If passed, use a fake RabbitMQ provider. (boolean value)
|
|
#fake_rabbit=false
|
|
|
|
# ZeroMQ bind address. Should be a wildcard (*), an ethernet
|
|
# interface, or IP. The "host" option should point or resolve
|
|
# to this address. (string value)
|
|
#rpc_zmq_bind_address=*
|
|
|
|
# MatchMaker driver. (string value)
|
|
#rpc_zmq_matchmaker=oslo.messaging._drivers.matchmaker.MatchMakerLocalhost
|
|
|
|
# ZeroMQ receiver listening port. (integer value)
|
|
#rpc_zmq_port=9501
|
|
|
|
# Number of ZeroMQ contexts, defaults to 1. (integer value)
|
|
#rpc_zmq_contexts=1
|
|
|
|
# Maximum number of ingress messages to locally buffer per
|
|
# topic. Default is unlimited. (integer value)
|
|
#rpc_zmq_topic_backlog=<None>
|
|
|
|
# Directory for holding IPC sockets. (string value)
|
|
#rpc_zmq_ipc_dir=/var/run/openstack
|
|
|
|
# Name of this node. Must be a valid hostname, FQDN, or IP
|
|
# address. Must match "host" option, if running Nova. (string
|
|
# value)
|
|
#rpc_zmq_host=nova
|
|
|
|
# Seconds to wait before a cast expires (TTL). Only supported
|
|
# by impl_zmq. (integer value)
|
|
#rpc_cast_timeout=30
|
|
|
|
# Heartbeat frequency. (integer value)
|
|
#matchmaker_heartbeat_freq=300
|
|
|
|
# Heartbeat time-to-live. (integer value)
|
|
#matchmaker_heartbeat_ttl=600
|
|
|
|
# Host to locate redis. (string value)
|
|
#host=127.0.0.1
|
|
|
|
# Use this port to connect to redis host. (integer value)
|
|
#port=6379
|
|
|
|
# Password for Redis server (optional). (string value)
|
|
#password=<None>
|
|
|
|
# Size of RPC greenthread pool. (integer value)
|
|
#rpc_thread_pool_size=64
|
|
|
|
# Driver or drivers to handle sending notifications. (multi
|
|
# valued)
|
|
#notification_driver=
|
|
|
|
# AMQP topic used for OpenStack notifications. (list value)
|
|
# Deprecated group/name - [rpc_notifier2]/topics
|
|
#notification_topics=notifications
|
|
|
|
# Seconds to wait for a response from a call. (integer value)
|
|
#rpc_response_timeout=60
|
|
|
|
# A URL representing the messaging driver to use and its full
|
|
# configuration. If not set, we fall back to the rpc_backend
|
|
# option and driver specific configuration. (string value)
|
|
#transport_url=<None>
|
|
|
|
# The messaging driver to use, defaults to rabbit. Other
|
|
# drivers include qpid and zmq. (string value)
|
|
#rpc_backend=rabbit
|
|
|
|
# The default exchange under which topics are scoped. May be
|
|
# overridden by an exchange name specified in the
|
|
# transport_url option. (string value)
|
|
#control_exchange=openstack
|
|
|
|
|
|
#
|
|
# Options defined in ec2api.exception
|
|
#
|
|
|
|
# Make exception message format errors fatal (boolean value)
|
|
#fatal_exception_format_errors=false
|
|
|
|
|
|
#
|
|
# Options defined in ec2api.paths
|
|
#
|
|
|
|
# Directory where the ec2api python module is installed
|
|
# (string value)
|
|
#pybasedir=/home/apavlov/progmatic/ec2-api
|
|
|
|
# Directory where ec2api binaries are installed (string value)
|
|
#bindir=/usr/local/bin
|
|
|
|
# Top-level directory for maintaining ec2api's state (string
|
|
# value)
|
|
#state_path=$pybasedir
|
|
|
|
|
|
#
|
|
# Options defined in ec2api.service
|
|
#
|
|
|
|
# Enable ssl connections or not (boolean value)
|
|
#use_ssl=false
|
|
|
|
# The IP address on which the EC2 API will listen. (string
|
|
# value)
|
|
#ec2api_listen=0.0.0.0
|
|
|
|
# The port on which the EC2 API will listen. (integer value)
|
|
#ec2api_listen_port=8788
|
|
|
|
# Number of workers for EC2 API service. The default will be
|
|
# equal to the number of CPUs available. (integer value)
|
|
#ec2api_workers=<None>
|
|
|
|
# Maximum time since last check-in for up service (integer
|
|
# value)
|
|
#service_down_time=60
|
|
|
|
|
|
#
|
|
# Options defined in ec2api.utils
|
|
#
|
|
|
|
# Explicitly specify the temporary working directory (string
|
|
# value)
|
|
#tempdir=<None>
|
|
|
|
|
|
#
|
|
# Options defined in ec2api.wsgi
|
|
#
|
|
|
|
# File name for the paste.deploy config for ec2api (string
|
|
# value)
|
|
#api_paste_config=api-paste.ini
|
|
|
|
# A python format string that is used as the template to
|
|
# generate log lines. The following values can be formatted
|
|
# into it: client_ip, date_time, request_line, status_code,
|
|
# body_length, wall_seconds. (string value)
|
|
#wsgi_log_format=%(client_ip)s "%(request_line)s" status: %(status_code)s len: %(body_length)s time: %(wall_seconds).7f
|
|
|
|
# CA certificate file to use to verify connecting clients
|
|
# (string value)
|
|
#ssl_ca_file=<None>
|
|
|
|
# SSL certificate of API server (string value)
|
|
#ssl_cert_file=<None>
|
|
|
|
# SSL private key of API server (string value)
|
|
#ssl_key_file=<None>
|
|
|
|
# Sets the value of TCP_KEEPIDLE in seconds for each server
|
|
# socket. Not supported on OS X. (integer value)
|
|
#tcp_keepidle=600
|
|
|
|
# Size of the pool of greenthreads used by wsgi (integer
|
|
# value)
|
|
#wsgi_default_pool_size=1000
|
|
|
|
# Maximum line size of message headers to be accepted.
|
|
# max_header_line may need to be increased when using large
|
|
# tokens (typically those generated by the Keystone v3 API
|
|
# with big service catalogs). (integer value)
|
|
#max_header_line=16384
|
|
|
|
|
|
#
|
|
# Options defined in ec2api.api
|
|
#
|
|
|
|
# The IP address of the EC2 API server (string value)
|
|
#base_ec2_host=nova
|
|
|
|
# The port of the EC2 API server (integer value)
|
|
#base_ec2_port=8773
|
|
|
|
# The protocol to use when connecting to the EC2 API server
|
|
# (http, https) (string value)
|
|
#base_ec2_scheme=http
|
|
|
|
# The path prefix used to call the ec2 API server (string
|
|
# value)
|
|
#base_ec2_path=/services/Cloud
|
|
|
|
# URL to get token from ec2 request. (string value)
|
|
#keystone_url=http://localhost:5000/v2.0
|
|
|
|
# Time in seconds before ec2 timestamp expires (integer value)
|
|
#ec2_timestamp_expiry=300
|
|
|
|
|
|
#
|
|
# Options defined in ec2api.api.auth
|
|
#
|
|
|
|
# whether to use per-user rate limiting for the api. (boolean
|
|
# value)
|
|
#api_rate_limit=false
|
|
|
|
# Treat X-Forwarded-For as the canonical remote address. Only
|
|
# enable this if you have a sanitizing proxy. (boolean value)
|
|
#use_forwarded_for=false
|
|
|
|
|
|
#
|
|
# Options defined in ec2api.openstack.common.eventlet_backdoor
|
|
#
|
|
|
|
# Enable eventlet backdoor. Acceptable values are 0, <port>,
|
|
# and <start>:<end>, where 0 results in listening on a random
|
|
# tcp port number; <port> results in listening on the
|
|
# specified port number (and not enabling backdoor if that
|
|
# port is in use); and <start>:<end> results in listening on
|
|
# the smallest unused port number within the specified range
|
|
# of port numbers. The chosen port is displayed in the
|
|
# service's log file. (string value)
|
|
#backdoor_port=<None>
|
|
|
|
|
|
#
|
|
# Options defined in ec2api.openstack.common.log
|
|
#
|
|
|
|
# Print debugging output (set logging level to DEBUG instead
|
|
# of default WARNING level). (boolean value)
|
|
#debug=false
|
|
|
|
# Print more verbose output (set logging level to INFO instead
|
|
# of default WARNING level). (boolean value)
|
|
#verbose=false
|
|
|
|
# Log output to standard error. (boolean value)
|
|
#use_stderr=true
|
|
|
|
# Format string to use for log messages with context. (string
|
|
# value)
|
|
#logging_context_format_string=%(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user_identity)s] %(instance)s%(message)s
|
|
|
|
# Format string to use for log messages without context.
|
|
# (string value)
|
|
#logging_default_format_string=%(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [-] %(instance)s%(message)s
|
|
|
|
# Data to append to log format when level is DEBUG. (string
|
|
# value)
|
|
#logging_debug_format_suffix=%(funcName)s %(pathname)s:%(lineno)d
|
|
|
|
# Prefix each line of exception output with this format.
|
|
# (string value)
|
|
#logging_exception_prefix=%(asctime)s.%(msecs)03d %(process)d TRACE %(name)s %(instance)s
|
|
|
|
# List of logger=LEVEL pairs. (list value)
|
|
#default_log_levels=amqp=WARN,amqplib=WARN,boto=WARN,qpid=WARN,sqlalchemy=WARN,suds=INFO,oslo.messaging=INFO,iso8601=WARN,requests.packages.urllib3.connectionpool=WARN
|
|
|
|
# Enables or disables publication of error events. (boolean
|
|
# value)
|
|
#publish_errors=false
|
|
|
|
# Enables or disables fatal status of deprecations. (boolean
|
|
# value)
|
|
#fatal_deprecations=false
|
|
|
|
# The format for an instance that is passed with the log
|
|
# message. (string value)
|
|
#instance_format="[instance: %(uuid)s] "
|
|
|
|
# The format for an instance UUID that is passed with the log
|
|
# message. (string value)
|
|
#instance_uuid_format="[instance: %(uuid)s] "
|
|
|
|
# The name of a logging configuration file. This file is
|
|
# appended to any existing logging configuration files. For
|
|
# details about logging configuration files, see the Python
|
|
# logging module documentation. (string value)
|
|
# Deprecated group/name - [DEFAULT]/log_config
|
|
#log_config_append=<None>
|
|
|
|
# DEPRECATED. A logging.Formatter log message format string
|
|
# which may use any of the available logging.LogRecord
|
|
# attributes. This option is deprecated. Please use
|
|
# logging_context_format_string and
|
|
# logging_default_format_string instead. (string value)
|
|
#log_format=<None>
|
|
|
|
# Format string for %%(asctime)s in log records. Default:
|
|
# %(default)s . (string value)
|
|
#log_date_format=%Y-%m-%d %H:%M:%S
|
|
|
|
# (Optional) Name of log file to output to. If no default is
|
|
# set, logging will go to stdout. (string value)
|
|
# Deprecated group/name - [DEFAULT]/logfile
|
|
#log_file=<None>
|
|
|
|
# (Optional) The base directory used for relative --log-file
|
|
# paths. (string value)
|
|
# Deprecated group/name - [DEFAULT]/logdir
|
|
#log_dir=<None>
|
|
|
|
# Use syslog for logging. Existing syslog format is DEPRECATED
|
|
# during I, and will chang in J to honor RFC5424. (boolean
|
|
# value)
|
|
#use_syslog=false
|
|
|
|
# (Optional) Enables or disables syslog rfc5424 format for
|
|
# logging. If enabled, prefixes the MSG part of the syslog
|
|
# message with APP-NAME (RFC5424). The format without the APP-
|
|
# NAME is deprecated in I, and will be removed in J. (boolean
|
|
# value)
|
|
#use_syslog_rfc_format=false
|
|
|
|
# Syslog facility to receive log lines. (string value)
|
|
#syslog_log_facility=LOG_USER
|
|
|
|
|
|
[database]
|
|
|
|
#
|
|
# Options defined in ec2api.db.api
|
|
#
|
|
|
|
# Enable the experimental use of thread pooling for all DB API
|
|
# calls (boolean value)
|
|
# Deprecated group/name - [DEFAULT]/dbapi_use_tpool
|
|
#use_tpool=false
|
|
|
|
|
|
#
|
|
# Options defined in ec2api.novadb.sqlalchemy.api
|
|
#
|
|
|
|
# The SQLAlchemy connection string used to connect to the nova
|
|
# database (string value)
|
|
#connection_nova=<None>
|
|
|
|
# The SQLAlchemy connection string used to connect to the
|
|
# slave database (string value)
|
|
#slave_connection=<None>
|
|
|
|
|
|
#
|
|
# Options defined in ec2api.openstack.common.db.options
|
|
#
|
|
|
|
# The file name to use with SQLite (string value)
|
|
#sqlite_db=ec2api.sqlite
|
|
|
|
# If True, SQLite uses synchronous mode (boolean value)
|
|
#sqlite_synchronous=true
|
|
|
|
# The backend to use for db (string value)
|
|
# Deprecated group/name - [DEFAULT]/db_backend
|
|
#backend=sqlalchemy
|
|
|
|
# The SQLAlchemy connection string used to connect to the
|
|
# database (string value)
|
|
# Deprecated group/name - [DEFAULT]/sql_connection
|
|
# Deprecated group/name - [DATABASE]/sql_connection
|
|
# Deprecated group/name - [sql]/connection
|
|
#connection=<None>
|
|
|
|
# The SQL mode to be used for MySQL sessions. This option,
|
|
# including the default, overrides any server-set SQL mode. To
|
|
# use whatever SQL mode is set by the server configuration,
|
|
# set this to no value. Example: mysql_sql_mode= (string
|
|
# value)
|
|
#mysql_sql_mode=TRADITIONAL
|
|
|
|
# Timeout before idle sql connections are reaped (integer
|
|
# value)
|
|
# Deprecated group/name - [DEFAULT]/sql_idle_timeout
|
|
# Deprecated group/name - [DATABASE]/sql_idle_timeout
|
|
# Deprecated group/name - [sql]/idle_timeout
|
|
#idle_timeout=3600
|
|
|
|
# Minimum number of SQL connections to keep open in a pool
|
|
# (integer value)
|
|
# Deprecated group/name - [DEFAULT]/sql_min_pool_size
|
|
# Deprecated group/name - [DATABASE]/sql_min_pool_size
|
|
#min_pool_size=1
|
|
|
|
# Maximum number of SQL connections to keep open in a pool
|
|
# (integer value)
|
|
# Deprecated group/name - [DEFAULT]/sql_max_pool_size
|
|
# Deprecated group/name - [DATABASE]/sql_max_pool_size
|
|
#max_pool_size=<None>
|
|
|
|
# Maximum db connection retries during startup. (setting -1
|
|
# implies an infinite retry count) (integer value)
|
|
# Deprecated group/name - [DEFAULT]/sql_max_retries
|
|
# Deprecated group/name - [DATABASE]/sql_max_retries
|
|
#max_retries=10
|
|
|
|
# Interval between retries of opening a sql connection
|
|
# (integer value)
|
|
# Deprecated group/name - [DEFAULT]/sql_retry_interval
|
|
# Deprecated group/name - [DATABASE]/reconnect_interval
|
|
#retry_interval=10
|
|
|
|
# If set, use this value for max_overflow with sqlalchemy
|
|
# (integer value)
|
|
# Deprecated group/name - [DEFAULT]/sql_max_overflow
|
|
# Deprecated group/name - [DATABASE]/sqlalchemy_max_overflow
|
|
#max_overflow=<None>
|
|
|
|
# Verbosity of SQL debugging information. 0=None,
|
|
# 100=Everything (integer value)
|
|
# Deprecated group/name - [DEFAULT]/sql_connection_debug
|
|
#connection_debug=0
|
|
|
|
# Add python stack traces to SQL as comment strings (boolean
|
|
# value)
|
|
# Deprecated group/name - [DEFAULT]/sql_connection_trace
|
|
#connection_trace=false
|
|
|
|
# If set, use this value for pool_timeout with sqlalchemy
|
|
# (integer value)
|
|
# Deprecated group/name - [DATABASE]/sqlalchemy_pool_timeout
|
|
#pool_timeout=<None>
|
|
|
|
# Enable the experimental use of database reconnect on
|
|
# connection lost (boolean value)
|
|
#use_db_reconnect=false
|
|
|
|
# seconds between db connection retries (integer value)
|
|
#db_retry_interval=1
|
|
|
|
# Whether to increase interval between db connection retries,
|
|
# up to db_max_retry_interval (boolean value)
|
|
#db_inc_retry_interval=true
|
|
|
|
# max seconds between db connection retries, if
|
|
# db_inc_retry_interval is enabled (integer value)
|
|
#db_max_retry_interval=10
|
|
|
|
# maximum db connection retries before error is raised.
|
|
# (setting -1 implies an infinite retry count) (integer value)
|
|
#db_max_retries=20
|
|
|
|
|
|
[keystone_authtoken]
|
|
|
|
#
|
|
# Options defined in keystoneclient.middleware.auth_token
|
|
#
|
|
|
|
# Prefix to prepend at the beginning of the path. Deprecated,
|
|
# use identity_uri. (string value)
|
|
#auth_admin_prefix=
|
|
|
|
# Host providing the admin Identity API endpoint. Deprecated,
|
|
# use identity_uri. (string value)
|
|
#auth_host=127.0.0.1
|
|
|
|
# Port of the admin Identity API endpoint. Deprecated, use
|
|
# identity_uri. (integer value)
|
|
#auth_port=35357
|
|
|
|
# Protocol of the admin Identity API endpoint (http or https).
|
|
# Deprecated, use identity_uri. (string value)
|
|
#auth_protocol=https
|
|
|
|
# Complete public Identity API endpoint (string value)
|
|
#auth_uri=<None>
|
|
|
|
# Complete admin Identity API endpoint. This should specify
|
|
# the unversioned root endpoint e.g. https://localhost:35357/
|
|
# (string value)
|
|
#identity_uri=<None>
|
|
|
|
# API version of the admin Identity API endpoint (string
|
|
# value)
|
|
#auth_version=<None>
|
|
|
|
# Do not handle authorization requests within the middleware,
|
|
# but delegate the authorization decision to downstream WSGI
|
|
# components (boolean value)
|
|
#delay_auth_decision=false
|
|
|
|
# Request timeout value for communicating with Identity API
|
|
# server. (boolean value)
|
|
#http_connect_timeout=<None>
|
|
|
|
# How many times are we trying to reconnect when communicating
|
|
# with Identity API Server. (integer value)
|
|
#http_request_max_retries=3
|
|
|
|
# This option is deprecated and may be removed in a future
|
|
# release. Single shared secret with the Keystone
|
|
# configuration used for bootstrapping a Keystone
|
|
# installation, or otherwise bypassing the normal
|
|
# authentication process. This option should not be used, use
|
|
# `admin_user` and `admin_password` instead. (string value)
|
|
#admin_token=<None>
|
|
|
|
# Keystone account username (string value)
|
|
#admin_user=<None>
|
|
|
|
# Keystone account password (string value)
|
|
#admin_password=<None>
|
|
|
|
# Keystone service account tenant name to validate user tokens
|
|
# (string value)
|
|
#admin_tenant_name=admin
|
|
|
|
# Env key for the swift cache (string value)
|
|
#cache=<None>
|
|
|
|
# Required if Keystone server requires client certificate
|
|
# (string value)
|
|
#certfile=<None>
|
|
|
|
# Required if Keystone server requires client certificate
|
|
# (string value)
|
|
#keyfile=<None>
|
|
|
|
# A PEM encoded Certificate Authority to use when verifying
|
|
# HTTPs connections. Defaults to system CAs. (string value)
|
|
#cafile=<None>
|
|
|
|
# Verify HTTPS connections. (boolean value)
|
|
#insecure=false
|
|
|
|
# Directory used to cache files related to PKI tokens (string
|
|
# value)
|
|
#signing_dir=<None>
|
|
|
|
# Optionally specify a list of memcached server(s) to use for
|
|
# caching. If left undefined, tokens will instead be cached
|
|
# in-process. (list value)
|
|
# Deprecated group/name - [DEFAULT]/memcache_servers
|
|
#memcached_servers=<None>
|
|
|
|
# In order to prevent excessive effort spent validating
|
|
# tokens, the middleware caches previously-seen tokens for a
|
|
# configurable duration (in seconds). Set to -1 to disable
|
|
# caching completely. (integer value)
|
|
#token_cache_time=300
|
|
|
|
# Determines the frequency at which the list of revoked tokens
|
|
# is retrieved from the Identity service (in seconds). A high
|
|
# number of revocation events combined with a low cache
|
|
# duration may significantly reduce performance. (integer
|
|
# value)
|
|
#revocation_cache_time=10
|
|
|
|
# (optional) if defined, indicate whether token data should be
|
|
# authenticated or authenticated and encrypted. Acceptable
|
|
# values are MAC or ENCRYPT. If MAC, token data is
|
|
# authenticated (with HMAC) in the cache. If ENCRYPT, token
|
|
# data is encrypted and authenticated in the cache. If the
|
|
# value is not one of these options or empty, auth_token will
|
|
# raise an exception on initialization. (string value)
|
|
#memcache_security_strategy=<None>
|
|
|
|
# (optional, mandatory if memcache_security_strategy is
|
|
# defined) this string is used for key derivation. (string
|
|
# value)
|
|
#memcache_secret_key=<None>
|
|
|
|
# (optional) indicate whether to set the X-Service-Catalog
|
|
# header. If False, middleware will not ask for service
|
|
# catalog on token validation and will not set the X-Service-
|
|
# Catalog header. (boolean value)
|
|
#include_service_catalog=true
|
|
|
|
# Used to control the use and type of token binding. Can be
|
|
# set to: "disabled" to not check token binding. "permissive"
|
|
# (default) to validate binding information if the bind type
|
|
# is of a form known to the server and ignore it if not.
|
|
# "strict" like "permissive" but if the bind type is unknown
|
|
# the token will be rejected. "required" any form of token
|
|
# binding is needed to be allowed. Finally the name of a
|
|
# binding method that must be present in tokens. (string
|
|
# value)
|
|
#enforce_token_bind=permissive
|
|
|
|
# If true, the revocation list will be checked for cached
|
|
# tokens. This requires that PKI tokens are configured on the
|
|
# Keystone server. (boolean value)
|
|
#check_revocations_for_cached=false
|
|
|
|
|
|
[matchmaker_ring]
|
|
|
|
#
|
|
# Options defined in oslo.messaging
|
|
#
|
|
|
|
# Matchmaker ring file (JSON). (string value)
|
|
# Deprecated group/name - [DEFAULT]/matchmaker_ringfile
|
|
#ringfile=/etc/oslo/matchmaker_ring.json
|
|
|
|
|