eec5c1afa1
* Adds SSL configuration params to all client classes * Adds unit test for bad SSL client configuration * Refactors the registry methods to no longer need configuration options passed, and to configure the registry client once, on images.Controller.__init__ * Adds glance-api.conf options for SSL support in registry client connections. * Adds SSL CA file socket wrappers via a client auth HTTPS connection class * Adds server SSL support, but not functional tests for SSL support yet. Still need to research self-signed cert generation for tests... * Updates documentation for bind and startup options * Adds functional test case for secure communication with API server stood up with SSL supprt. Note it is not very DRY. There is some DRY cleanup to do in the future... TODO: Integrate options with bin/glance CLI tool Change-Id: Ie9fcd36337cc93fd5beeabb9186ad5e93ae2a0f0
229 lines
7.5 KiB
Plaintext
229 lines
7.5 KiB
Plaintext
[DEFAULT]
|
|
# Show more verbose log output (sets INFO log level output)
|
|
verbose = True
|
|
|
|
# Show debugging output in logs (sets DEBUG log level output)
|
|
debug = False
|
|
|
|
# Which backend store should Glance use by default is not specified
|
|
# in a request to add a new image to Glance? Default: 'file'
|
|
# Available choices are 'file', 'swift', and 's3'
|
|
default_store = file
|
|
|
|
# Address to bind the API server
|
|
bind_host = 0.0.0.0
|
|
|
|
# Port the bind the API server to
|
|
bind_port = 9292
|
|
|
|
# Log to this file. Make sure you do not set the same log
|
|
# file for both the API and registry servers!
|
|
log_file = /var/log/glance/api.log
|
|
|
|
# Send logs to syslog (/dev/log) instead of to file specified by `log_file`
|
|
use_syslog = False
|
|
|
|
# Backlog requests when creating socket
|
|
backlog = 4096
|
|
|
|
# ================= SSL Options ===============================
|
|
|
|
# Certificate file to use when starting API server securely
|
|
# cert_file = /path/to/certfile
|
|
|
|
# Private key file to use when starting API server securely
|
|
# key_file = /path/to/keyfile
|
|
|
|
# ============ Registry Options ===============================
|
|
|
|
# Address to find the registry server
|
|
registry_host = 0.0.0.0
|
|
|
|
# Port the registry server is listening on
|
|
registry_port = 9191
|
|
|
|
# What protocol to use when connecting to the registry server?
|
|
# Set to https for secure HTTP communication
|
|
registry_client_protocol = http
|
|
|
|
# The path to the key file to use in SSL connections to the
|
|
# registry server, if any. Alternately, you may set the
|
|
# GLANCE_CLIENT_KEY_FILE environ variable to a filepath of the key file
|
|
# registry_client_key_file = /path/to/key/file
|
|
|
|
# The path to the cert file to use in SSL connections to the
|
|
# registry server, if any. Alternately, you may set the
|
|
# GLANCE_CLIENT_CERT_FILE environ variable to a filepath of the cert file
|
|
# registry_client_cert_file = /path/to/cert/file
|
|
|
|
# The path to the certifying authority cert file to use in SSL connections
|
|
# to the registry server, if any. Alternately, you may set the
|
|
# GLANCE_CLIENT_CA_FILE environ variable to a filepath of the CA cert file
|
|
# registry_client_ca_file = /path/to/ca/file
|
|
|
|
# ============ Notification System Options =====================
|
|
|
|
# Notifications can be sent when images are create, updated or deleted.
|
|
# There are three methods of sending notifications, logging (via the
|
|
# log_file directive), rabbit (via a rabbitmq queue) or noop (no
|
|
# notifications sent, the default)
|
|
notifier_strategy = noop
|
|
|
|
# Configuration options if sending notifications via rabbitmq (these are
|
|
# the defaults)
|
|
rabbit_host = localhost
|
|
rabbit_port = 5672
|
|
rabbit_use_ssl = false
|
|
rabbit_userid = guest
|
|
rabbit_password = guest
|
|
rabbit_virtual_host = /
|
|
rabbit_notification_topic = glance_notifications
|
|
|
|
# ============ Filesystem Store Options ========================
|
|
|
|
# Directory that the Filesystem backend store
|
|
# writes image data to
|
|
filesystem_store_datadir = /var/lib/glance/images/
|
|
|
|
# ============ Swift Store Options =============================
|
|
|
|
# Address where the Swift authentication service lives
|
|
swift_store_auth_address = 127.0.0.1:8080/v1.0/
|
|
|
|
# User to authenticate against the Swift authentication service
|
|
swift_store_user = jdoe
|
|
|
|
# Auth key for the user authenticating against the
|
|
# Swift authentication service
|
|
swift_store_key = a86850deb2742ec3cb41518e26aa2d89
|
|
|
|
# Container within the account that the account should use
|
|
# for storing images in Swift
|
|
swift_store_container = glance
|
|
|
|
# Do we create the container if it does not exist?
|
|
swift_store_create_container_on_put = False
|
|
|
|
# What size, in MB, should Glance start chunking image files
|
|
# and do a large object manifest in Swift? By default, this is
|
|
# the maximum object size in Swift, which is 5GB
|
|
swift_store_large_object_size = 5120
|
|
|
|
# When doing a large object manifest, what size, in MB, should
|
|
# Glance write chunks to Swift? This amount of data is written
|
|
# to a temporary disk buffer during the process of chunking
|
|
# the image file, and the default is 200MB
|
|
swift_store_large_object_chunk_size = 200
|
|
|
|
# Whether to use ServiceNET to communicate with the Swift storage servers.
|
|
# (If you aren't RACKSPACE, leave this False!)
|
|
#
|
|
# To use ServiceNET for authentication, prefix hostname of
|
|
# `swift_store_auth_address` with 'snet-'.
|
|
# Ex. https://example.com/v1.0/ -> https://snet-example.com/v1.0/
|
|
swift_enable_snet = False
|
|
|
|
# ============ S3 Store Options =============================
|
|
|
|
# Address where the S3 authentication service lives
|
|
s3_store_host = 127.0.0.1:8080/v1.0/
|
|
|
|
# User to authenticate against the S3 authentication service
|
|
s3_store_access_key = <20-char AWS access key>
|
|
|
|
# Auth key for the user authenticating against the
|
|
# S3 authentication service
|
|
s3_store_secret_key = <40-char AWS secret key>
|
|
|
|
# Container within the account that the account should use
|
|
# for storing images in S3. Note that S3 has a flat namespace,
|
|
# so you need a unique bucket name for your glance images. An
|
|
# easy way to do this is append your AWS access key to "glance".
|
|
# S3 buckets in AWS *must* be lowercased, so remember to lowercase
|
|
# your AWS access key if you use it in your bucket name below!
|
|
s3_store_bucket = <lowercased 20-char aws access key>glance
|
|
|
|
# Do we create the bucket if it does not exist?
|
|
s3_store_create_bucket_on_put = False
|
|
|
|
# ============ RBD Store Options =============================
|
|
|
|
# Ceph configuration file path
|
|
# If using cephx authentication, this file should
|
|
# include a reference to the right keyring
|
|
# in a client.<USER> section
|
|
rbd_store_ceph_conf = /etc/ceph/ceph.conf
|
|
|
|
# RADOS user to authenticate as (only applicable if using cephx)
|
|
rbd_store_user = glance
|
|
|
|
# RADOS pool in which images are stored
|
|
rbd_store_pool = images
|
|
|
|
# Images will be chunked into objects of this size (in megabytes).
|
|
# For best performance, this should be a power of two
|
|
rbd_store_chunk_size = 8
|
|
|
|
# ============ Image Cache Options ========================
|
|
|
|
image_cache_enabled = False
|
|
|
|
# Directory that the Image Cache writes data to
|
|
# Make sure this is also set in glance-pruner.conf
|
|
image_cache_datadir = /var/lib/glance/image-cache/
|
|
|
|
# Number of seconds after which we should consider an incomplete image to be
|
|
# stalled and eligible for reaping
|
|
image_cache_stall_timeout = 86400
|
|
|
|
# ============ Delayed Delete Options =============================
|
|
|
|
# Turn on/off delayed delete
|
|
delayed_delete = False
|
|
|
|
# Delayed delete time in seconds
|
|
scrub_time = 43200
|
|
|
|
# Directory that the scrubber will use to remind itself of what to delete
|
|
# Make sure this is also set in glance-scrubber.conf
|
|
scrubber_datadir = /var/lib/glance/scrubber
|
|
|
|
[pipeline:glance-api]
|
|
pipeline = versionnegotiation context apiv1app
|
|
# NOTE: use the following pipeline for keystone
|
|
# pipeline = versionnegotiation authtoken context apiv1app
|
|
|
|
# To enable Image Cache Management API replace pipeline with below:
|
|
# pipeline = versionnegotiation context imagecache apiv1app
|
|
# NOTE: use the following pipeline for keystone auth (with caching)
|
|
# pipeline = versionnegotiation authtoken context imagecache apiv1app
|
|
|
|
[pipeline:versions]
|
|
pipeline = versionsapp
|
|
|
|
[app:versionsapp]
|
|
paste.app_factory = glance.api.versions:app_factory
|
|
|
|
[app:apiv1app]
|
|
paste.app_factory = glance.api.v1:app_factory
|
|
|
|
[filter:versionnegotiation]
|
|
paste.filter_factory = glance.api.middleware.version_negotiation:filter_factory
|
|
|
|
[filter:imagecache]
|
|
paste.filter_factory = glance.api.middleware.image_cache:filter_factory
|
|
|
|
[filter:context]
|
|
paste.filter_factory = glance.common.context:filter_factory
|
|
|
|
[filter:authtoken]
|
|
paste.filter_factory = keystone.middleware.auth_token:filter_factory
|
|
service_protocol = http
|
|
service_host = 127.0.0.1
|
|
service_port = 5000
|
|
auth_host = 127.0.0.1
|
|
auth_port = 5001
|
|
auth_protocol = http
|
|
auth_uri = http://127.0.0.1:5000/
|
|
admin_token = 999888777666
|