blob: e1b440d4802d975ce53ced9a4e1167676d3f7bc4 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
|
[DEFAULT]
debug = {{ keystone_logging_debug }}
transport_url = {{ rpc_transport_url }}
# NOTE(elemoine) log_dir alone does not work for Keystone
log_file = /var/log/kolla/keystone/keystone.log
use_stderr = true
[oslo_middleware]
enable_proxy_headers_parsing = true
{% if keystone_policy_file is defined %}
[oslo_policy]
policy_file = {{ keystone_policy_file }}
{% endif %}
[database]
connection = mysql+pymysql://{{ keystone_database_user }}:{{ keystone_database_password }}@{{ keystone_database_address }}/{{ keystone_database_name }}{{ '?ssl_ca=' ~ openstack_cacert if keystone_database_enable_tls_internal | bool }}
connection_recycle_time = {{ database_connection_recycle_time }}
max_pool_size = {{ database_max_pool_size }}
max_retries = -1
{% if keystone_domain_directory.stat.exists %}
[identity]
domain_specific_drivers_enabled = true
domain_config_dir = /etc/keystone/domains
{% endif %}
[token]
revoke_by_id = false
provider = fernet
expiration = {{ fernet_token_expiry }}
allow_expired_window = {{ fernet_token_allow_expired_window }}
[fernet_tokens]
# Keystone docs note:
# max_active_keys =
# ((token_expiration + allow_expired_window) / rotation_frequency) + 2
# https://docs.openstack.org/keystone/stein/admin/fernet-token-faq.html
#
# Use (x + y - 1) / y to round up integer division.
max_active_keys = {{ ((fernet_token_expiry | int +
fernet_token_allow_expired_window | int +
fernet_key_rotation_interval | int - 1) //
fernet_key_rotation_interval | int) + 2 }}
[cache]
backend = oslo_cache.memcache_pool
enabled = true
memcache_servers = {% for host in groups['memcached'] %}{{ 'api' | kolla_address(host) | put_address_in_context('memcache') }}:{{ memcached_port }}{% if not loop.last %},{% endif %}{% endfor %}
[oslo_messaging_notifications]
transport_url = {{ notify_transport_url }}
{% if keystone_enabled_notification_topics %}
driver = messagingv2
topics = {{ keystone_enabled_notification_topics | map(attribute='name') | join(',') }}
{% else %}
driver = noop
{% endif %}
[oslo_messaging_rabbit]
use_queue_manager = true
{% if service_name == 'keystone-api' %}
processname = {{ service_name }}
{% endif %}
heartbeat_in_pthread = {{ service_name == 'keystone' }}
{% if om_enable_rabbitmq_tls | bool %}
ssl = true
ssl_ca_file = {{ om_rabbitmq_cacert }}
{% endif %}
rabbit_quorum_queue = true
{% if om_enable_rabbitmq_stream_fanout | bool %}
rabbit_stream_fanout = true
rabbit_qos_prefetch_count = {{ om_rabbitmq_qos_prefetch_count }}
{% endif %}
rabbit_transient_quorum_queue = true
{% if enable_osprofiler | bool %}
[profiler]
enabled = true
trace_sqlalchemy = true
hmac_keys = {{ osprofiler_secret }}
connection_string = {{ osprofiler_backend_connection_string }}
{% endif %}
{% if enable_grafana | bool %}
[cors]
allowed_origin = {{ grafana_public_endpoint }}
{% endif %}
{% if enable_keystone_federation | bool %}
[federation]
{% for dashboard in keystone_trusted_dashboards %}
trusted_dashboard = {{ dashboard }}
{% endfor %}
sso_callback_template = /etc/keystone/sso_callback_template.html
[openid]
remote_id_attribute = {{ keystone_remote_id_attribute_oidc }}
[auth]
methods = password,token,openid,application_credential
{% endif %}
|
