f3fbe83708
This pull request adds support for the OpenID Connect authentication flow in Keystone and enables both ID and access token authentication flows. The ID token configuration is designed to allow users to authenticate via Horizon using an identity federation; whereas the Access token is used to allow users to authenticate in the OpenStack CLI using a federated user. Without this PR, if one wants to configure OpenStack to use identity federation, he/she needs to do a lot of configurations in the keystone, Horizon, and register quite a good number of different parameters using the CLI such as mappings, identity providers, federated protocols, and so on. Therefore, with this PR, we propose a method for operators to introduce/present the IdP's metadata to Kolla-ansible, and based on the presented metadata, Kolla-ansible takes care of all of the configurations to prepare OpenStack to work in a federated environment. Implements: blueprint add-openid-support Co-Authored-By: Jason Anderson <jasonanderson@uchicago.edu> Change-Id: I0203a3470d7f8f2a54d5e126d947f540d93b8210
260 lines
4.8 KiB
YAML
260 lines
4.8 KiB
YAML
---
|
|
###################
|
|
# External Ceph options
|
|
####################
|
|
# These options must be UUID4 values in string format
|
|
# XXXXXXXX-XXXX-4XXX-XXXX-XXXXXXXXXXXX
|
|
# for backward compatible consideration, rbd_secret_uuid is only used for nova,
|
|
# cinder_rbd_secret_uuid is used for cinder
|
|
rbd_secret_uuid:
|
|
cinder_rbd_secret_uuid:
|
|
|
|
###################
|
|
# Database options
|
|
####################
|
|
database_password:
|
|
# Password for the dedicated backup user account
|
|
mariadb_backup_database_password:
|
|
|
|
####################
|
|
# Docker options
|
|
####################
|
|
# This should only be set if you require a password for your Docker registry
|
|
docker_registry_password:
|
|
|
|
####################
|
|
# VMware support
|
|
####################
|
|
vmware_dvs_host_password:
|
|
vmware_nsxv_password:
|
|
vmware_vcenter_host_password:
|
|
nsxv3_api_password:
|
|
|
|
#####################
|
|
# Hitachi NAS support
|
|
#####################
|
|
hnas_nfs_password:
|
|
|
|
######################
|
|
# Oracle ZFSSA support
|
|
######################
|
|
zfssa_iscsi_password:
|
|
|
|
#######################
|
|
# Infoblox IPAM support
|
|
#######################
|
|
infoblox_admin_password:
|
|
|
|
####################
|
|
# OpenStack options
|
|
####################
|
|
aodh_database_password:
|
|
aodh_keystone_password:
|
|
|
|
barbican_database_password:
|
|
barbican_keystone_password:
|
|
barbican_p11_password:
|
|
barbican_crypto_key:
|
|
|
|
blazar_database_password:
|
|
blazar_keystone_password:
|
|
|
|
keystone_admin_password:
|
|
keystone_database_password:
|
|
|
|
grafana_database_password:
|
|
grafana_admin_password:
|
|
|
|
glance_database_password:
|
|
glance_keystone_password:
|
|
|
|
gnocchi_database_password:
|
|
gnocchi_keystone_password:
|
|
|
|
kuryr_keystone_password:
|
|
|
|
nova_database_password:
|
|
nova_api_database_password:
|
|
nova_keystone_password:
|
|
|
|
placement_keystone_password:
|
|
placement_database_password:
|
|
|
|
neutron_database_password:
|
|
neutron_keystone_password:
|
|
metadata_secret:
|
|
|
|
cinder_database_password:
|
|
cinder_keystone_password:
|
|
|
|
cloudkitty_database_password:
|
|
cloudkitty_keystone_password:
|
|
|
|
cyborg_database_password:
|
|
cyborg_keystone_password:
|
|
|
|
panko_database_password:
|
|
panko_keystone_password:
|
|
|
|
freezer_database_password:
|
|
freezer_keystone_password:
|
|
|
|
sahara_database_password:
|
|
sahara_keystone_password:
|
|
|
|
designate_database_password:
|
|
designate_keystone_password:
|
|
# This option must be UUID4 value in string format
|
|
designate_pool_id:
|
|
# This option must be HMAC-MD5 value in string format
|
|
designate_rndc_key:
|
|
|
|
swift_keystone_password:
|
|
swift_hash_path_suffix:
|
|
swift_hash_path_prefix:
|
|
|
|
heat_database_password:
|
|
heat_keystone_password:
|
|
heat_domain_admin_password:
|
|
|
|
murano_database_password:
|
|
murano_keystone_password:
|
|
murano_agent_rabbitmq_password:
|
|
|
|
monasca_agent_password:
|
|
monasca_database_password:
|
|
monasca_grafana_admin_password:
|
|
monasca_keystone_password:
|
|
|
|
ironic_database_password:
|
|
ironic_keystone_password:
|
|
|
|
ironic_inspector_database_password:
|
|
ironic_inspector_keystone_password:
|
|
|
|
magnum_database_password:
|
|
magnum_keystone_password:
|
|
|
|
mistral_database_password:
|
|
mistral_keystone_password:
|
|
|
|
trove_database_password:
|
|
trove_keystone_password:
|
|
|
|
ceilometer_database_password:
|
|
ceilometer_keystone_password:
|
|
|
|
watcher_database_password:
|
|
watcher_keystone_password:
|
|
|
|
rally_database_password:
|
|
|
|
senlin_database_password:
|
|
senlin_keystone_password:
|
|
|
|
solum_database_password:
|
|
solum_keystone_password:
|
|
|
|
horizon_secret_key:
|
|
horizon_database_password:
|
|
|
|
telemetry_secret_key:
|
|
|
|
manila_database_password:
|
|
manila_keystone_password:
|
|
|
|
octavia_database_password:
|
|
octavia_keystone_password:
|
|
octavia_ca_password:
|
|
octavia_client_ca_password:
|
|
|
|
tacker_database_password:
|
|
tacker_keystone_password:
|
|
|
|
zun_database_password:
|
|
zun_keystone_password:
|
|
|
|
vitrage_database_password:
|
|
vitrage_keystone_password:
|
|
|
|
masakari_database_password:
|
|
masakari_keystone_password:
|
|
|
|
memcache_secret_key:
|
|
|
|
# HMAC secret key
|
|
osprofiler_secret:
|
|
|
|
nova_ssh_key:
|
|
private_key:
|
|
public_key:
|
|
|
|
kolla_ssh_key:
|
|
private_key:
|
|
public_key:
|
|
|
|
keystone_ssh_key:
|
|
private_key:
|
|
public_key:
|
|
|
|
bifrost_ssh_key:
|
|
private_key:
|
|
public_key:
|
|
|
|
octavia_amp_ssh_key:
|
|
private_key:
|
|
public_key:
|
|
|
|
####################
|
|
# Gnocchi options
|
|
####################
|
|
gnocchi_project_id:
|
|
gnocchi_resource_id:
|
|
gnocchi_user_id:
|
|
|
|
####################
|
|
# Qdrouterd options
|
|
####################
|
|
qdrouterd_password:
|
|
|
|
####################
|
|
# RabbitMQ options
|
|
####################
|
|
rabbitmq_password:
|
|
rabbitmq_monitoring_password:
|
|
rabbitmq_cluster_cookie:
|
|
outward_rabbitmq_password:
|
|
outward_rabbitmq_cluster_cookie:
|
|
|
|
####################
|
|
# HAProxy options
|
|
####################
|
|
haproxy_password:
|
|
keepalived_password:
|
|
|
|
####################
|
|
# Kibana options
|
|
####################
|
|
kibana_password:
|
|
|
|
####################
|
|
# etcd options
|
|
####################
|
|
etcd_cluster_token:
|
|
|
|
####################
|
|
# redis options
|
|
####################
|
|
redis_master_password:
|
|
|
|
####################
|
|
# Prometheus options
|
|
####################
|
|
prometheus_mysql_exporter_database_password:
|
|
prometheus_alertmanager_password:
|
|
|
|
###############################
|
|
# OpenStack identity federation
|
|
###############################
|
|
keystone_federation_openid_crypto_password:
|