[DEFAULT]

#

# From keystone

#

# A "shared secret" that can be used to bootstrap Keystone. This "token" does

# not represent a user, and carries no explicit authorization. If set to

# `None`, the value is ignored and the `admin_token` log in mechanism is

# effectively disabled. To completely disable `admin_token` in production

# (highly recommended), remove AdminTokenAuthMiddleware from your paste

# application pipelines (for example, in keystone-paste.ini). (string value)

#admin_token = <None>

# The base public endpoint URL for Keystone that is advertised to clients

# (NOTE: this does NOT affect how Keystone listens for connections). Defaults

# to the base host URL of the request. E.g. a request to

# http://server:5000/v3/users will default to http://server:5000. You should

# only need to set this value if the base URL contains a path (e.g. /prefix/v3)

# or the endpoint should be found on a different server. (string value)

#public_endpoint = <None>

# The base admin endpoint URL for Keystone that is advertised to clients (NOTE:

# this does NOT affect how Keystone listens for connections). Defaults to the

# base host URL of the request. E.g. a request to http://server:35357/v3/users

# will default to http://server:35357. You should only need to set this value

# if the base URL contains a path (e.g. /prefix/v3) or the endpoint should be

# found on a different server. (string value)

#admin_endpoint = <None>

# Maximum depth of the project hierarchy, excluding the project acting as a

# domain at the top of the hierarchy. WARNING: setting it to a large value may

# adversely impact  performance. (integer value)

#max_project_tree_depth = 5

# Limit the sizes of user & project ID/names. (integer value)

#max_param_size = 64

# Similar to max_param_size, but provides an exception for token values.

# (integer value)

#max_token_size = 8192

# Similar to the member_role_name option, this represents the default role ID

# used to associate users with their default projects in the v2 API. This will

# be used as the explicit role where one is not specified by the v2 API.

# (string value)

#member_role_id = 9fe2ff9ee4384b1894a90878d3e92bab

# This is the role name used in combination with the member_role_id option; see

# that option for more detail. (string value)

#member_role_name = _member_

# The value passed as the keyword "rounds" to passlib's encrypt method.

# (integer value)

# Minimum value: 1000

# Maximum value: 100000

#crypt_strength = 10000

# The maximum number of entities that will be returned in a collection, with no

# limit set by default. This global limit may be then overridden for a specific

# driver, by specifying a list_limit in the appropriate section (e.g.

# [assignment]). (integer value)

#list_limit = <None>

# Set this to false if you want to enable the ability for user, group and

# project entities to be moved between domains by updating their domain_id.

# Allowing such movement is not recommended if the scope of a domain admin is

# being restricted by use of an appropriate policy file (see

# policy.v3cloudsample as an example). This ability is deprecated and will be

# removed in a future release. (boolean value)

# This option is deprecated for removal.

# Its value may be silently ignored in the future.

#domain_id_immutable = true

# If set to true, strict password length checking is performed for password

# manipulation. If a password exceeds the maximum length, the operation will

# fail with an HTTP 403 Forbidden error. If set to false, passwords are

# automatically truncated to the maximum length. (boolean value)

#strict_password_check = false

# The HTTP header used to determine the scheme for the original request, even

# if it was removed by an SSL terminating proxy. (string value)

#secure_proxy_ssl_header = HTTP_X_FORWARDED_PROTO

# If set to true the server will return information in the response that may

# allow an unauthenticated or authenticated user to get more information than

# normal, such as why authentication failed. This may be useful for debugging

# but is insecure. (boolean value)

#insecure_debug = false

#

# From keystone.notifications

#

# Default publisher_id for outgoing notifications (string value)

#default_publisher_id = <None>

# Define the notification format for Identity Service events. A "basic"

# notification has information about the resource being operated on. A "cadf"

# notification has the same information, as well as information about the

# initiator of the event. (string value)

# Allowed values: basic, cadf

#notification_format = basic

# Define the notification options to opt-out from. The value expected is:

# identity.<resource_type>.<operation>. This field can be set multiple times in

# order to add more notifications to opt-out from. For example:

#  notification_opt_out=identity.user.created

#  notification_opt_out=identity.authenticate.success (multi valued)

#notification_opt_out =

#

# From oslo.log

#

# If set to true, the logging level will be set to DEBUG instead of the default

# INFO level. (boolean value)

#debug = false

# If set to false, the logging level will be set to WARNING instead of the

# default INFO level. (boolean value)

# This option is deprecated for removal.

# Its value may be silently ignored in the future.

#verbose = true

# The name of a logging configuration file. This file is appended to any

# existing logging configuration files. For details about logging configuration

# files, see the Python logging module documentation. Note that when logging

# configuration files are used then all logging configuration is set in the

# configuration file and other logging configuration options are ignored (for

# example, logging_context_format_string). (string value)

# Deprecated group/name - [DEFAULT]/log_config

#log_config_append = <None>

# Defines the format string for %%(asctime)s in log records. Default:

# %(default)s . This option is ignored if log_config_append is set. (string

# value)

#log_date_format = %Y-%m-%d %H:%M:%S

# (Optional) Name of log file to send logging output to. If no default is set,

# logging will go to stderr as defined by use_stderr. This option is ignored if

# log_config_append is set. (string value)

# Deprecated group/name - [DEFAULT]/logfile

#log_file = <None>

# (Optional) The base directory used for relative log_file  paths. This option

# is ignored if log_config_append is set. (string value)

# Deprecated group/name - [DEFAULT]/logdir

#log_dir = <None>

# Uses logging handler designed to watch file system. When log file is moved or

# removed this handler will open a new log file with specified path

# instantaneously. It makes sense only if log_file option is specified and

# Linux platform is used. This option is ignored if log_config_append is set.

# (boolean value)

#watch_log_file = false

# Use syslog for logging. Existing syslog format is DEPRECATED and will be

# changed later to honor RFC5424. This option is ignored if log_config_append

# is set. (boolean value)

#use_syslog = false

# Syslog facility to receive log lines. This option is ignored if

# log_config_append is set. (string value)

#syslog_log_facility = LOG_USER

# Log output to standard error. This option is ignored if log_config_append is

# set. (boolean value)

#use_stderr = true

# Format string to use for log messages with context. (string value)

#logging_context_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user_identity)s] %(instance)s%(message)s

# Format string to use for log messages when context is undefined. (string

# value)

#logging_default_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [-] %(instance)s%(message)s

# Additional data to append to log message when logging level for the message

# is DEBUG. (string value)

#logging_debug_format_suffix = %(funcName)s %(pathname)s:%(lineno)d

# Prefix each line of exception output with this format. (string value)

#logging_exception_prefix = %(asctime)s.%(msecs)03d %(process)d ERROR %(name)s %(instance)s

# Defines the format string for %(user_identity)s that is used in

# logging_context_format_string. (string value)

#logging_user_identity_format = %(user)s %(tenant)s %(domain)s %(user_domain)s %(project_domain)s

# List of package logging levels in logger=LEVEL pairs. This option is ignored

# if log_config_append is set. (list value)

#default_log_levels = amqp=WARN,amqplib=WARN,boto=WARN,qpid=WARN,sqlalchemy=WARN,suds=INFO,oslo.messaging=INFO,iso8601=WARN,requests.packages.urllib3.connectionpool=WARN,urllib3.connectionpool=WARN,websocket=WARN,requests.packages.urllib3.util.retry=WARN,urllib3.util.retry=WARN,keystonemiddleware=WARN,routes.middleware=WARN,stevedore=WARN,taskflow=WARN,keystoneauth=WARN,oslo.cache=INFO,dogpile.core.dogpile=INFO

# Enables or disables publication of error events. (boolean value)

#publish_errors = false

# The format for an instance that is passed with the log message. (string

# value)

#instance_format = "[instance: %(uuid)s] "

# The format for an instance UUID that is passed with the log message. (string

# value)

#instance_uuid_format = "[instance: %(uuid)s] "

# Enables or disables fatal status of deprecations. (boolean value)

#fatal_deprecations = false

#

# From oslo.messaging

#

# Size of RPC connection pool. (integer value)

# Deprecated group/name - [DEFAULT]/rpc_conn_pool_size

#rpc_conn_pool_size = 30

# ZeroMQ bind address. Should be a wildcard (*), an ethernet interface, or IP.

# The "host" option should point or resolve to this address. (string value)

#rpc_zmq_bind_address = *

# MatchMaker driver. (string value)

# Allowed values: redis, dummy

#rpc_zmq_matchmaker = redis

# Type of concurrency used. Either "native" or "eventlet" (string value)

#rpc_zmq_concurrency = eventlet

# Number of ZeroMQ contexts, defaults to 1. (integer value)

#rpc_zmq_contexts = 1

# Maximum number of ingress messages to locally buffer per topic. Default is

# unlimited. (integer value)

#rpc_zmq_topic_backlog = <None>

# Directory for holding IPC sockets. (string value)

#rpc_zmq_ipc_dir = /var/run/openstack

# Name of this node. Must be a valid hostname, FQDN, or IP address. Must match

# "host" option, if running Nova. (string value)

#rpc_zmq_host = localhost

# Seconds to wait before a cast expires (TTL). The default value of -1

# specifies an infinite linger period. The value of 0 specifies no linger

# period. Pending messages shall be discarded immediately when the socket is

# closed. Only supported by impl_zmq. (integer value)

#rpc_cast_timeout = -1

# The default number of seconds that poll should wait. Poll raises timeout

# exception when timeout expired. (integer value)

#rpc_poll_timeout = 1

# Expiration timeout in seconds of a name service record about existing target

# ( < 0 means no timeout). (integer value)

#zmq_target_expire = 120

# Use PUB/SUB pattern for fanout methods. PUB/SUB always uses proxy. (boolean

# value)

#use_pub_sub = true

# Minimal port number for random ports range. (port value)

# Minimum value: 0

# Maximum value: 65535

#rpc_zmq_min_port = 49152

# Maximal port number for random ports range. (integer value)

# Minimum value: 1

# Maximum value: 65536

#rpc_zmq_max_port = 65536

# Number of retries to find free port number before fail with ZMQBindError.

# (integer value)

#rpc_zmq_bind_port_retries = 100

# Size of executor thread pool. (integer value)

# Deprecated group/name - [DEFAULT]/rpc_thread_pool_size

#executor_thread_pool_size = 64

# Seconds to wait for a response from a call. (integer value)

#rpc_response_timeout = 60

# A URL representing the messaging driver to use and its full configuration. If

# not set, we fall back to the rpc_backend option and driver specific

# configuration. (string value)

#transport_url = <None>

# The messaging driver to use, defaults to rabbit. Other drivers include amqp

# and zmq. (string value)

#rpc_backend = rabbit

# The default exchange under which topics are scoped. May be overridden by an

# exchange name specified in the transport_url option. (string value)

#control_exchange = keystone

#

# From oslo.service.service

#

# Enable eventlet backdoor.  Acceptable values are 0, <port>, and

# <start>:<end>, where 0 results in listening on a random tcp port number;

# <port> results in listening on the specified port number (and not enabling

# backdoor if that port is in use); and <start>:<end> results in listening on

# the smallest unused port number within the specified range of port numbers.

# The chosen port is displayed in the service's log file. (string value)

#backdoor_port = <None>

# Enable eventlet backdoor, using the provided path as a unix socket that can

# receive connections. This option is mutually exclusive with 'backdoor_port'

# in that only one should be provided. If both are provided then the existence

# of this option overrides the usage of that option. (string value)

#backdoor_socket = <None>

# Enables or disables logging values of all registered options when starting a

# service (at DEBUG level). (boolean value)

#log_options = true

# Specify a timeout after which a gracefully shutdown server will exit. Zero

# value means endless wait. (integer value)

#graceful_shutdown_timeout = 60

[assignment]

#

# From keystone

#

# Entrypoint for the assignment backend driver in the keystone.assignment

# namespace. Only an SQL driver is supplied. If an assignment driver is not

# specified, the identity driver will choose the assignment driver (driver

# selection based on `[identity]/driver` option is deprecated and will be

# removed in the "O" release). (string value)

#driver = <None>

# A list of role names which are prohibited from being an implied role. (list

# value)

#prohibited_implied_role = admin

[auth]

#

# From keystone

#

# Allowed authentication methods. (list value)

#methods = external,password,token,oauth1

# Entrypoint for the password auth plugin module in the keystone.auth.password

# namespace. (string value)

#password = <None>

# Entrypoint for the token auth plugin module in the keystone.auth.token

# namespace. (string value)

#token = <None>

# Entrypoint for the external (REMOTE_USER) auth plugin module in the

# keystone.auth.external namespace. Supplied drivers are DefaultDomain and

# Domain. The default driver is DefaultDomain. (string value)

#external = <None>

# Entrypoint for the oAuth1.0 auth plugin module in the keystone.auth.oauth1

# namespace. (string value)

#oauth1 = <None>

[cache]

#

# From oslo.cache

#

# Prefix for building the configuration dictionary for the cache region. This

# should not need to be changed unless there is another dogpile.cache region

# with the same configuration name. (string value)

#config_prefix = cache.oslo

# Default TTL, in seconds, for any cached item in the dogpile.cache region.

# This applies to any cached method that doesn't have an explicit cache

# expiration time defined for it. (integer value)

#expiration_time = 600

# Dogpile.cache backend module. It is recommended that Memcache with pooling

# (oslo_cache.memcache_pool) or Redis (dogpile.cache.redis) be used in

# production deployments.  Small workloads (single process) like devstack can

# use the dogpile.cache.memory backend. (string value)

#backend = dogpile.cache.null

# Arguments supplied to the backend module. Specify this option once per

# argument to be passed to the dogpile.cache backend. Example format:

# "<argname>:<value>". (multi valued)

#backend_argument =

# Proxy classes to import that will affect the way the dogpile.cache backend

# functions. See the dogpile.cache documentation on changing-backend-behavior.

# (list value)

#proxies =

# Global toggle for caching. (boolean value)

#enabled = false

# Extra debugging from the cache backend (cache keys, get/set/delete/etc

# calls). This is only really useful if you need to see the specific cache-

# backend get/set/delete calls with the keys/values.  Typically this should be

# left set to false. (boolean value)

#debug_cache_backend = false

# Memcache servers in the format of "host:port". (dogpile.cache.memcache and

# oslo_cache.memcache_pool backends only). (list value)

#memcache_servers = localhost:11211

# Number of seconds memcached server is considered dead before it is tried

# again. (dogpile.cache.memcache and oslo_cache.memcache_pool backends only).

# (integer value)

#memcache_dead_retry = 300

# Timeout in seconds for every call to a server. (dogpile.cache.memcache and

# oslo_cache.memcache_pool backends only). (integer value)

#memcache_socket_timeout = 3

# Max total number of open connections to every memcached server.

# (oslo_cache.memcache_pool backend only). (integer value)

#memcache_pool_maxsize = 10

# Number of seconds a connection to memcached is held unused in the pool before

# it is closed. (oslo_cache.memcache_pool backend only). (integer value)

#memcache_pool_unused_timeout = 60

# Number of seconds that an operation will wait to get a memcache client

# connection. (integer value)

#memcache_pool_connection_get_timeout = 10

[catalog]

#

# From keystone

#

# Catalog template file name for use with the template catalog backend. (string

# value)

#template_file = default_catalog.templates

# Entrypoint for the catalog backend driver in the keystone.catalog namespace.

# Supplied drivers are kvs, sql, templated, and endpoint_filter.sql (string

# value)

#driver = sql

# Toggle for catalog caching. This has no effect unless global caching is

# enabled. (boolean value)

#caching = true

# Time to cache catalog data (in seconds). This has no effect unless global and

# catalog caching are enabled. (integer value)

#cache_time = <None>

# Maximum number of entities that will be returned in a catalog collection.

# (integer value)

#list_limit = <None>

[cors]

#

# From oslo.middleware

#

# Indicate whether this resource may be shared with the domain received in the

# requests "origin" header. (list value)

#allowed_origin = <None>

# Indicate that the actual request can include user credentials (boolean value)

#allow_credentials = true

# Indicate which headers are safe to expose to the API. Defaults to HTTP Simple

# Headers. (list value)

#expose_headers = X-Auth-Token,X-Openstack-Request-Id,X-Subject-Token

# Maximum cache age of CORS preflight requests. (integer value)

#max_age = 3600

# Indicate which methods can be used during the actual request. (list value)

#allow_methods = GET,PUT,POST,DELETE,PATCH