80bea7a386
Currently metadata proxy cannot run with nobody user/group as metadata
proxy requires to connect to metadata_proxy_socket when queried.
This change allows to run metadata proxy with nobody user/group by
allowing to choose the metadata_proxy_socket mode with the new option
metadata_proxy_socket_mode (4 choices) in order to adapt socket
permissions to metadata proxy user/group.
This change refactors also where options are defined to enable
metadata_proxy_user/group options in the metadata agent.
In practice:
* if metadata_proxy_user is agent effective user or root, then:
* metadata proxy is allowed to use rootwrap (unsecure)
* set metadata_proxy_socket_mode = user (0o644)
* else if metadata_proxy_group is agent effective group, then:
* metadata proxy is not allowed to use rootwrap (secure)
* set metadata_proxy_socket_mode = group (0o664)
* set metadata_proxy_log_watch = false
* else:
* metadata proxy has lowest permissions (securest) but metadata proxy
socket can be opened by everyone
* set metadata_proxy_socket_mode = all (0o666)
* set metadata_proxy_log_watch = false
An alternative is to set metadata_proxy_socket_mode = deduce, in such
case metadata agent uses previous rules to choose the correct mode.
DocImpact
Closes-Bug: #1427228
Change-Id: I235a0cc4f0cbd55ae4ec1570daf2ebbb6a72441d
69 lines
2.5 KiB
INI
69 lines
2.5 KiB
INI
[DEFAULT]
|
|
# Show debugging output in log (sets DEBUG log level output)
|
|
# debug = True
|
|
|
|
# The Neutron user information for accessing the Neutron API.
|
|
auth_url = http://localhost:5000/v2.0
|
|
auth_region = RegionOne
|
|
# Turn off verification of the certificate for ssl
|
|
# auth_insecure = False
|
|
# Certificate Authority public key (CA cert) file for ssl
|
|
# auth_ca_cert =
|
|
admin_tenant_name = %SERVICE_TENANT_NAME%
|
|
admin_user = %SERVICE_USER%
|
|
admin_password = %SERVICE_PASSWORD%
|
|
|
|
# Network service endpoint type to pull from the keystone catalog
|
|
# endpoint_type = adminURL
|
|
|
|
# IP address used by Nova metadata server
|
|
# nova_metadata_ip = 127.0.0.1
|
|
|
|
# TCP Port used by Nova metadata server
|
|
# nova_metadata_port = 8775
|
|
|
|
# Which protocol to use for requests to Nova metadata server, http or https
|
|
# nova_metadata_protocol = http
|
|
|
|
# Whether insecure SSL connection should be accepted for Nova metadata server
|
|
# requests
|
|
# nova_metadata_insecure = False
|
|
|
|
# Client certificate for nova api, needed when nova api requires client
|
|
# certificates
|
|
# nova_client_cert =
|
|
|
|
# Private key for nova client certificate
|
|
# nova_client_priv_key =
|
|
|
|
# When proxying metadata requests, Neutron signs the Instance-ID header with a
|
|
# shared secret to prevent spoofing. You may select any string for a secret,
|
|
# but it must match here and in the configuration used by the Nova Metadata
|
|
# Server. NOTE: Nova uses the same config key, but in [neutron] section.
|
|
# metadata_proxy_shared_secret =
|
|
|
|
# Location of Metadata Proxy UNIX domain socket
|
|
# metadata_proxy_socket = $state_path/metadata_proxy
|
|
|
|
# Metadata Proxy UNIX domain socket mode, 3 values allowed:
|
|
# 'deduce': deduce mode from metadata_proxy_user/group values,
|
|
# 'user': set metadata proxy socket mode to 0o644, to use when
|
|
# metadata_proxy_user is agent effective user or root,
|
|
# 'group': set metadata proxy socket mode to 0o664, to use when
|
|
# metadata_proxy_group is agent effective group,
|
|
# 'all': set metadata proxy socket mode to 0o666, to use otherwise.
|
|
# metadata_proxy_socket_mode = deduce
|
|
|
|
# Number of separate worker processes for metadata server. Defaults to
|
|
# half the number of CPU cores
|
|
# metadata_workers =
|
|
|
|
# Number of backlog requests to configure the metadata server socket with
|
|
# metadata_backlog = 4096
|
|
|
|
# URL to connect to the cache backend.
|
|
# default_ttl=0 parameter will cause cache entries to never expire.
|
|
# Otherwise default_ttl specifies time in seconds a cache entry is valid for.
|
|
# No cache is used in case no value is passed.
|
|
# cache_url = memory://?default_ttl=5
|