Dmitriy Rabotyagov
224b2cf396
With PKI role in place in most cases you don't need to explicitly provide path to the CA file because PKI role ensures that CA is trusted by the system overall. In the meanwhile in PyMySQL [1] you must either provide CA file or cert/key or enable verify. Since current behaviour is to provide path to the custom CA we expect certificate being trusted overall. Thus we enable cert verification when galera_use_ssl is True. [1] https://github.com/PyMySQL/PyMySQL/blob/78f0cf99e5d5351df0821442e4dc35c49a6390c6/pymysql/connections.py#L267 Change-Id: I933e1edbd4260e2bd61bcceec3ddad8aea85353c
61 lines
3.4 KiB
Django/Jinja
61 lines
3.4 KiB
Django/Jinja
[DEFAULT]
|
|
enabled_apis = masakari_api
|
|
transport_url = {{ masakari_oslomsg_rpc_transport }}://{% for host in masakari_oslomsg_rpc_servers.split(',') %}{{ masakari_oslomsg_rpc_userid }}:{{ masakari_oslomsg_rpc_password }}@{{ host }}:{{ masakari_oslomsg_rpc_port }}{% if not loop.last %},{% else %}/{{ masakari_oslomsg_rpc_vhost }}{% if masakari_oslomsg_rpc_use_ssl | bool %}?ssl=1&ssl_version={{ masakari_oslomsg_rpc_ssl_version }}&ssl_ca_file={{ masakari_oslomsg_rpc_ssl_ca_file }}{% else %}?ssl=0{% endif %}{% endif %}{% endfor %}
|
|
# Enable to specify listening IP other than default
|
|
masakari_api_listen = {{ masakari_api_bind_address }}
|
|
# Enable to specify port other than default
|
|
masakari_api_listen_port = {{ masakari_api_service_port }}
|
|
debug = False
|
|
use_journal = true
|
|
auth_strategy = keystone
|
|
notification_driver = taskflow_driver
|
|
# Nova endpoint
|
|
nova_catalog_admin_info = compute:nova:adminURL
|
|
nova_api_insecure = "{{ keystone_service_adminuri_insecure | default("false") }}"
|
|
# Privileged credentials to interact with nova
|
|
os_privileged_user_tenant = {{ masakari_service_project_name }}
|
|
os_privileged_user_auth_url = {{ keystone_service_adminuri }}
|
|
os_privileged_user_name = {{ masakari_service_user_name }}
|
|
os_privileged_user_password = {{ masakari_service_password }}
|
|
service_down_time = 60
|
|
periodic_enable = true
|
|
use_ssl = false
|
|
|
|
[wsgi]
|
|
# The paste configuration file path
|
|
api_paste_config = {{ masakari_etc_dir }}/api-paste.ini
|
|
|
|
[keystone_authtoken]
|
|
auth_url = {{ keystone_service_adminuri }}
|
|
www_authenticate_uri = {{ keystone_service_internaluri }}
|
|
auth_type = password
|
|
project_domain_id = {{ masakari_service_user_domain_id }}
|
|
user_domain_id = {{ masakari_service_project_domain_id }}
|
|
project_name = {{ masakari_service_project_name }}
|
|
username = {{ masakari_service_user_name }}
|
|
password = {{ masakari_service_password }}
|
|
memcached_servers = {{ masakari_memcached_servers }}
|
|
memcache_security_strategy = ENCRYPT
|
|
memcache_secret_key = {{ memcached_encryption_key }}
|
|
service_token_roles_required = True
|
|
|
|
[database]
|
|
connection = mysql+pymysql://{{ masakari_galera_user }}:{{ masakari_container_mysql_password }}@{{ masakari_galera_address }}/{{ masakari_galera_database }}?charset=utf8{% if masakari_galera_use_ssl | bool %}&ssl_verify_cert=true{% if masakari_galera_ssl_ca_cert | length > 0 %}&ssl_ca={{ masakari_galera_ssl_ca_cert }}{% endif %}{% endif %}
|
|
|
|
[taskflow]
|
|
connection = mysql+pymysql://{{ masakari_galera_user }}:{{ masakari_container_mysql_password }}@{{ masakari_galera_address }}/{{ masakari_galera_database }}?charset=utf8{% if masakari_galera_use_ssl | bool %}&ssl_verify_cert=true{% if masakari_galera_ssl_ca_cert | length > 0 %}&ssl_ca={{ masakari_galera_ssl_ca_cert }}{% endif %}{% endif %}
|
|
|
|
[host_failure]
|
|
evacuate_all_instances = true
|
|
add_reserved_host_to_aggregate = false
|
|
ignore_instances_in_error_state = false
|
|
|
|
[instance_failure]
|
|
process_all_instances = false
|
|
|
|
[oslo_messaging_rabbit]
|
|
ssl = {{ masakari_oslomsg_notify_use_ssl | bool }}
|
|
|
|
[oslo_messaging_notifications]
|
|
transport_url = {{ masakari_oslomsg_notify_transport }}://{% for host in masakari_oslomsg_notify_servers.split(',') %}{{ masakari_oslomsg_notify_userid }}:{{ masakari_oslomsg_notify_password }}@{{ host }}:{{ masakari_oslomsg_notify_port }}{% if not loop.last %},{% else %}/{{ masakari_oslomsg_notify_vhost }}{% if masakari_oslomsg_notify_use_ssl | bool %}?ssl=1&ssl_version={{ masakari_oslomsg_notify_ssl_version }}&ssl_ca_file={{ masakari_oslomsg_notify_ssl_ca_file }}{% else %}?ssl=0{% endif %}{% endif %}{% endfor %}
|