Configuration Options

The following is an overview of all available configuration options in Freezer API.

For a sample configuration file, refer to Freezer Configuration Options.

DEFAULT

debug

Type:

boolean

Default:

False

Mutable:

This option can be changed without restarting.

If set to true, the logging level will be set to DEBUG instead of the default INFO level.

log_config_append

Type:

string

Default:

<None>

Mutable:

This option can be changed without restarting.

The name of a logging configuration file. This file is appended to any existing logging configuration files. For details about logging configuration files, see the Python logging module documentation. Note that when logging configuration files are used then all logging configuration is set in the configuration file and other logging configuration options are ignored (for example, log-date-format).

Deprecated Variations

Group	Name
DEFAULT	log-config
DEFAULT	log_config

log_date_format

Type:

string

Default:

%Y-%m-%d %H:%M:%S

Defines the format string for %(asctime)s in log records. Default: the value above . This option is ignored if log_config_append is set.

log_file

Type:

string

Default:

<None>

(Optional) Name of log file to send logging output to. If no default is set, logging will go to stderr as defined by use_stderr. This option is ignored if log_config_append is set.

Deprecated Variations

Group	Name
DEFAULT	logfile

log_dir

Type:

string

Default:

<None>

(Optional) The base directory used for relative log_file paths. This option is ignored if log_config_append is set.

Deprecated Variations

Group	Name
DEFAULT	logdir

watch_log_file

Type:

boolean

Default:

False

Uses logging handler designed to watch file system. When log file is moved or removed this handler will open a new log file with specified path instantaneously. It makes sense only if log_file option is specified and Linux platform is used. This option is ignored if log_config_append is set.

Warning

This option is deprecated for removal. Its value may be silently ignored in the future.

Reason:

This function is known to have bene broken for long time, and depends on the unmaintained library

use_syslog

Type:

boolean

Default:

False

Use syslog for logging. Existing syslog format is DEPRECATED and will be changed later to honor RFC5424. This option is ignored if log_config_append is set.

use_journal

Type:

boolean

Default:

False

Enable journald for logging. If running in a systemd environment you may wish to enable journal support. Doing so will use the journal native protocol which includes structured metadata in addition to log messages.This option is ignored if log_config_append is set.

syslog_log_facility

Type:

string

Default:

LOG_USER

Syslog facility to receive log lines. This option is ignored if log_config_append is set.

use_json

Type:

boolean

Default:

False

Use JSON formatting for logging. This option is ignored if log_config_append is set.

use_stderr

Type:

boolean

Default:

False

Log output to standard error. This option is ignored if log_config_append is set.

log_color

Type:

boolean

Default:

False

(Optional) Set the ‘color’ key according to log levels. This option takes effect only when logging to stderr or stdout is used. This option is ignored if log_config_append is set.

log_rotate_interval

Type:

integer

Default:

1

The amount of time before the log files are rotated. This option is ignored unless log_rotation_type is set to “interval”.

log_rotate_interval_type

Type:

string

Default:

days

Valid Values:

Seconds, Minutes, Hours, Days, Weekday, Midnight

Rotation interval type. The time of the last file change (or the time when the service was started) is used when scheduling the next rotation.

max_logfile_count

Type:

integer

Default:

30

Maximum number of rotated log files.

max_logfile_size_mb

Type:

integer

Default:

200

Log file maximum size in MB. This option is ignored if “log_rotation_type” is not set to “size”.

log_rotation_type

Type:

string

Default:

none

Valid Values:

interval, size, none

Log rotation type.

Possible values

interval

Rotate logs at predefined time intervals.

size

Rotate logs once they reach a predefined size.

none

Do not rotate log files.

logging_context_format_string

Type:

string

Default:

%(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(global_request_id)s %(request_id)s %(user_identity)s] %(instance)s%(message)s

Format string to use for log messages with context. Used by oslo_log.formatters.ContextFormatter

logging_default_format_string

Type:

string

Default:

%(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [-] %(instance)s%(message)s

Format string to use for log messages when context is undefined. Used by oslo_log.formatters.ContextFormatter

logging_debug_format_suffix

Type:

string

Default:

%(funcName)s %(pathname)s:%(lineno)d

Additional data to append to log message when logging level for the message is DEBUG. Used by oslo_log.formatters.ContextFormatter

logging_exception_prefix

Type:

string

Default:

%(asctime)s.%(msecs)03d %(process)d ERROR %(name)s %(instance)s

Prefix each line of exception output with this format. Used by oslo_log.formatters.ContextFormatter

logging_user_identity_format

Type:

string

Default:

%(user)s %(project)s %(domain)s %(system_scope)s %(user_domain)s %(project_domain)s

Defines the format string for %(user_identity)s that is used in logging_context_format_string. Used by oslo_log.formatters.ContextFormatter

default_log_levels

Type:

list

Default:

['amqp=WARN', 'amqplib=WARN', 'boto=WARN', 'qpid=WARN', 'sqlalchemy=WARN', 'suds=INFO', 'oslo.messaging=INFO', 'oslo_messaging=INFO', 'iso8601=WARN', 'requests.packages.urllib3.connectionpool=WARN', 'urllib3.connectionpool=WARN', 'websocket=WARN', 'requests.packages.urllib3.util.retry=WARN', 'urllib3.util.retry=WARN', 'keystonemiddleware=WARN', 'routes.middleware=WARN', 'stevedore=WARN', 'taskflow=WARN', 'keystoneauth=WARN', 'oslo.cache=INFO', 'oslo_policy=INFO', 'dogpile.core.dogpile=INFO']

List of package logging levels in logger=LEVEL pairs. This option is ignored if log_config_append is set.

publish_errors

Type:

boolean

Default:

False

Enables or disables publication of error events.

instance_format

Type:

string

Default:

"[instance: %(uuid)s] "

The format for an instance that is passed with the log message.

instance_uuid_format

Type:

string

Default:

"[instance: %(uuid)s] "

The format for an instance UUID that is passed with the log message.

rate_limit_interval

Type:

integer

Default:

0

Interval, number of seconds, of log rate limiting.

rate_limit_burst

Type:

integer

Default:

0

Maximum number of logged messages per rate_limit_interval.

rate_limit_except_level

Type:

string

Default:

CRITICAL

Valid Values:

CRITICAL, ERROR, INFO, WARNING, DEBUG, ‘’

Log level name used by rate limiting. Logs with level greater or equal to rate_limit_except_level are not filtered. An empty string means that all levels are filtered.

fatal_deprecations

Type:

boolean

Default:

False

Enables or disables fatal status of deprecations.

bind_host

Type:

ip address

Default:

0.0.0.0

IP address to listen on. Default is 0.0.0.0

bind_port

Type:

port number

Default:

9090

Minimum Value:

0

Maximum Value:

65535

Port number to listen on. Default is 9090

enable_v1_api

Type:

boolean

Default:

False

Default False, the v2 Freezer API will be deployed.

When this option is set to True, Freezer-API service will respond to requests on registered endpoints conforming to the v1 OpenStack Freezer api.

The v1 OpenStack Freezer API functions as follows:

• Multi-tenancy is not supported under this api version.

• Everything is user based.

• Freezer api v1 supports Oslo.db.

• Use elasticsearch db with v1 api version

The v2 OpenStack Freezer API functions as follows:

• Multi-tenancy is supported under this api version.

• Freezer api v2 supports Oslo.db.

• Recommended to use oslo.db with api v2

cors

allowed_origin

Type:

list

Default:

<None>

Indicate whether this resource may be shared with the domain received in the requests “origin” header. Format: “<protocol>://<host>[:<port>]”, no trailing slash. Example: https://horizon.example.com

allow_credentials

Type:

boolean

Default:

True

Indicate that the actual request can include user credentials

expose_headers

Type:

list

Default:

[]

Indicate which headers are safe to expose to the API. Defaults to HTTP Simple Headers.

max_age

Type:

integer

Default:

3600

Maximum cache age of CORS preflight requests.

allow_methods

Type:

list

Default:

['OPTIONS', 'GET', 'HEAD', 'POST', 'PUT', 'DELETE', 'TRACE', 'PATCH']

Indicate which methods can be used during the actual request.

allow_headers

Type:

list

Default:

[]

Indicate which header field names may be used during the actual request.

database

sqlite_synchronous

Type:

boolean

Default:

True

If True, SQLite uses synchronous mode.

backend

Type:

string

Default:

sqlalchemy

The back end to use for the database.

connection

Type:

string

Default:

<None>

The SQLAlchemy connection string to use to connect to the database.

slave_connection

Type:

string

Default:

<None>

The SQLAlchemy connection string to use to connect to the slave database.

asyncio_connection

Type:

string

Default:

<None>

The SQLAlchemy asyncio connection string to use to connect to the database.

asyncio_slave_connection

Type:

string

Default:

<None>

The SQLAlchemy asyncio connection string to use to connect to the slave database.

mysql_sql_mode

Type:

string

Default:

TRADITIONAL

The SQL mode to be used for MySQL sessions. This option, including the default, overrides any server-set SQL mode. To use whatever SQL mode is set by the server configuration, set this to no value. Example: mysql_sql_mode=

mysql_wsrep_sync_wait

Type:

integer

Default:

<None>

For Galera only, configure wsrep_sync_wait causality checks on new connections. Default is None, meaning don’t configure any setting.

connection_recycle_time

Type:

integer

Default:

3600

Connections which have been present in the connection pool longer than this number of seconds will be replaced with a new one the next time they are checked out from the pool.

max_pool_size

Type:

integer

Default:

5

Maximum number of SQL connections to keep open in a pool. Setting a value of 0 indicates no limit.

max_retries

Type:

integer

Default:

10

Maximum number of database connection retries during startup. Set to -1 to specify an infinite retry count.

retry_interval

Type:

integer

Default:

10

Interval between retries of opening a SQL connection.

max_overflow

Type:

integer

Default:

50

If set, use this value for max_overflow with SQLAlchemy.

connection_debug

Type:

integer

Default:

0

Minimum Value:

0

Maximum Value:

100

Verbosity of SQL debugging information: 0=None, 100=Everything.

connection_trace

Type:

boolean

Default:

False

Add Python stack traces to SQL as comment strings.

pool_timeout

Type:

integer

Default:

<None>

If set, use this value for pool_timeout with SQLAlchemy.

use_db_reconnect

Type:

boolean

Default:

False

Enable the experimental use of database reconnect on connection lost.

db_retry_interval

Type:

integer

Default:

1

Seconds between retries of a database transaction.

db_inc_retry_interval

Type:

boolean

Default:

True

If True, increases the interval between retries of a database operation up to db_max_retry_interval.

db_max_retry_interval

Type:

integer

Default:

10

If db_inc_retry_interval is set, the maximum seconds between retries of a database operation.

db_max_retries

Type:

integer

Default:

20

Maximum retries in case of connection error or deadlock error before error is raised. Set to -1 to specify an infinite retry count.

connection_parameters

Type:

string

Default:

''

Optional URL parameters to append onto the connection URL at connect time; specify as param1=value1&param2=value2&…

healthcheck

path

Type:

string

Default:

/healthcheck

The path to respond to healtcheck requests on.

Warning

This option is deprecated for removal. Its value may be silently ignored in the future.

detailed

Type:

boolean

Default:

False

Show more detailed information as part of the response. Security note: Enabling this option may expose sensitive details about the service being monitored. Be sure to verify that it will not violate your security policies.

backends

Type:

list

Default:

[]

Additional backends that can perform health checks and report that information back as part of a request.

allowed_source_ranges

Type:

list

Default:

[]

A list of network addresses to limit source ip allowed to access healthcheck information. Any request from ip outside of these network addresses are ignored.

ignore_proxied_requests

Type:

boolean

Default:

False

Ignore requests with proxy headers.

disable_by_file_path

Type:

string

Default:

<None>

Check the presence of a file to determine if an application is running on a port. Used by DisableByFileHealthcheck plugin.

disable_by_file_paths

Type:

list

Default:

[]

Check the presence of a file based on a port to determine if an application is running on a port. Expects a “port:path” list of strings. Used by DisableByFilesPortsHealthcheck plugin.

enable_by_file_paths

Type:

list

Default:

[]

Check the presence of files. Used by EnableByFilesHealthcheck plugin.

keystone_authtoken

www_authenticate_uri

Type:

string

Default:

<None>

Complete “public” Identity API endpoint. This endpoint should not be an “admin” endpoint, as it should be accessible by all end users. Unauthenticated clients are redirected to this endpoint to authenticate. Although this endpoint should ideally be unversioned, client support in the wild varies. If you’re using a versioned v2 endpoint here, then this should not be the same endpoint the service user utilizes for validating tokens, because normal end users may not be able to reach that endpoint.

Deprecated Variations

Group	Name
keystone_authtoken	auth_uri

auth_uri

Type:

string

Default:

<None>

Complete “public” Identity API endpoint. This endpoint should not be an “admin” endpoint, as it should be accessible by all end users. Unauthenticated clients are redirected to this endpoint to authenticate. Although this endpoint should ideally be unversioned, client support in the wild varies. If you’re using a versioned v2 endpoint here, then this should not be the same endpoint the service user utilizes for validating tokens, because normal end users may not be able to reach that endpoint. This option is deprecated in favor of www_authenticate_uri and will be removed in the S release.

Warning

This option is deprecated for removal since Queens. Its value may be silently ignored in the future.

Reason:

The auth_uri option is deprecated in favor of www_authenticate_uri and will be removed in the S release.

auth_version

Type:

string

Default:

<None>

API version of the Identity API endpoint.

interface

Type:

string

Default:

internal

Interface to use for the Identity API endpoint. Valid values are “public”, “internal” (default) or “admin”.

delay_auth_decision

Type:

boolean

Default:

False

Do not handle authorization requests within the middleware, but delegate the authorization decision to downstream WSGI components.

http_connect_timeout

Type:

integer

Default:

<None>

Request timeout value for communicating with Identity API server.

http_request_max_retries

Type:

integer

Default:

3

How many times are we trying to reconnect when communicating with Identity API Server.

cache

Type:

string

Default:

<None>

Request environment key where the Swift cache object is stored. When auth_token middleware is deployed with a Swift cache, use this option to have the middleware share a caching backend with swift. Otherwise, use the memcached_servers option instead.

certfile

Type:

string

Default:

<None>

Required if identity server requires client certificate

keyfile

Type:

string

Default:

<None>

Required if identity server requires client certificate

cafile

Type:

string

Default:

<None>

A PEM encoded Certificate Authority to use when verifying HTTPs connections. Defaults to system CAs.

insecure

Type:

boolean

Default:

False

Verify HTTPS connections.

region_name

Type:

string

Default:

<None>

The region in which the identity server can be found.

memcached_servers

Type:

list

Default:

<None>

Optionally specify a list of memcached server(s) to use for caching. If left undefined, tokens will instead be cached in-process.

Deprecated Variations

Group	Name
keystone_authtoken	memcache_servers

token_cache_time

Type:

integer

Default:

300

In order to prevent excessive effort spent validating tokens, the middleware caches previously-seen tokens for a configurable duration (in seconds). Set to -1 to disable caching completely.

memcache_security_strategy

Type:

string

Default:

None

Valid Values:

None, MAC, ENCRYPT

(Optional) If defined, indicate whether token data should be authenticated or authenticated and encrypted. If MAC, token data is authenticated (with HMAC) in the cache. If ENCRYPT, token data is encrypted and authenticated in the cache. If the value is not one of these options or empty, auth_token will raise an exception on initialization.

memcache_secret_key

Type:

string

Default:

<None>

(Optional, mandatory if memcache_security_strategy is defined) This string is used for key derivation.

memcache_pool_dead_retry

Type:

integer

Default:

300

(Optional) Number of seconds memcached server is considered dead before it is tried again.

memcache_pool_maxsize

Type:

integer

Default:

10

(Optional) Maximum total number of open connections to every memcached server.

memcache_pool_socket_timeout

Type:

integer

Default:

3

(Optional) Socket timeout in seconds for communicating with a memcached server.

memcache_pool_unused_timeout

Type:

integer

Default:

60

(Optional) Number of seconds a connection to memcached is held unused in the pool before it is closed.

memcache_pool_conn_get_timeout

Type:

integer

Default:

10

(Optional) Number of seconds that an operation will wait to get a memcached client connection from the pool.

memcache_use_advanced_pool

Type:

boolean

Default:

True

(Optional) Use the advanced (eventlet safe) memcached client pool.

include_service_catalog

Type:

boolean

Default:

True

(Optional) Indicate whether to set the X-Service-Catalog header. If False, middleware will not ask for service catalog on token validation and will not set the X-Service-Catalog header.

enforce_token_bind

Type:

string

Default:

permissive

Used to control the use and type of token binding. Can be set to: “disabled” to not check token binding. “permissive” (default) to validate binding information if the bind type is of a form known to the server and ignore it if not. “strict” like “permissive” but if the bind type is unknown the token will be rejected. “required” any form of token binding is needed to be allowed. Finally the name of a binding method that must be present in tokens.

service_token_roles

Type:

list

Default:

['service']

A choice of roles that must be present in a service token. Service tokens are allowed to request that an expired token can be used and so this check should tightly control that only actual services should be sending this token. Roles here are applied as an ANY check so any role in this list must be present. For backwards compatibility reasons this currently only affects the allow_expired check.

service_token_roles_required

Type:

boolean

Default:

False

For backwards compatibility reasons we must let valid service tokens pass that don’t pass the service_token_roles check as valid. Setting this true will become the default in a future release and should be enabled if possible.

service_type

Type:

string

Default:

<None>

The name or type of the service as it appears in the service catalog. This is used to validate tokens that have restricted access rules.

auth_admin_prefix

Type:

string

Default:

''

Prefix to prepend at the beginning of the path. Deprecated, use identity_uri.

auth_host

Type:

string

Default:

127.0.0.1

Host providing the admin Identity API endpoint. Deprecated, use identity_uri.

auth_port

Type:

integer

Default:

35357

Port of the admin Identity API endpoint. Deprecated, use identity_uri.

auth_protocol

Type:

string

Default:

https

Valid Values:

http, https

Protocol of the admin Identity API endpoint. Deprecated, use identity_uri.

identity_uri

Type:

string

Default:

<None>

Complete admin Identity API endpoint. This should specify the unversioned root endpoint e.g. https://localhost:35357/

admin_token

Type:

string

Default:

<None>

This option is deprecated and may be removed in a future release. Single shared secret with the Keystone configuration used for bootstrapping a Keystone installation, or otherwise bypassing the normal authentication process. This option should not be used, use admin_user and admin_password instead.

admin_user

Type:

string

Default:

<None>

Service username.

admin_password

Type:

string

Default:

<None>

Service user password.

admin_tenant_name

Type:

string

Default:

admin

Service tenant name.

auth_type

Type:

unknown type

Default:

<None>

Authentication type to load

Deprecated Variations

Group	Name
keystone_authtoken	auth_plugin

auth_section

Type:

unknown type

Default:

<None>

Config Section from which to load plugin specific options

oslo_middleware

max_request_body_size

Type:

integer

Default:

114688

The maximum body size for each request, in bytes.

Deprecated Variations

Group	Name
DEFAULT	osapi_max_request_body_size
DEFAULT	max_request_body_size

enable_proxy_headers_parsing

Type:

boolean

Default:

False

Whether the application is behind a proxy or not. This determines if the middleware should parse the headers or not.

http_basic_auth_user_file

Type:

string

Default:

/etc/htpasswd

HTTP basic auth password file.

oslo_policy

enforce_scope

Type:

boolean

Default:

True

This option controls whether or not to enforce scope when evaluating policies. If True, the scope of the token used in the request is compared to the scope_types of the policy being enforced. If the scopes do not match, an InvalidScope exception will be raised. If False, a message will be logged informing operators that policies are being invoked with mismatching scope.

Warning

This option is deprecated for removal. Its value may be silently ignored in the future.

Reason:

This configuration was added temporarily to facilitate a smooth transition to the new RBAC. OpenStack will always enforce scope checks. This configuration option is deprecated and will be removed in the 2025.2 cycle.

enforce_new_defaults

Type:

boolean

Default:

True

This option controls whether or not to use old deprecated defaults when evaluating policies. If True, the old deprecated defaults are not going to be evaluated. This means if any existing token is allowed for old defaults but is disallowed for new defaults, it will be disallowed. It is encouraged to enable this flag along with the enforce_scope flag so that you can get the benefits of new defaults and scope_type together. If False, the deprecated policy check string is logically OR’d with the new policy check string, allowing for a graceful upgrade experience between releases with new policies, which is the default behavior.

policy_file

Type:

string

Default:

policy.yaml

The relative or absolute path of a file that maps roles to permissions for a given service. Relative paths must be specified in relation to the configuration file setting this option.

policy_default_rule

Type:

string

Default:

default

Default rule. Enforced when a requested rule is not found.

policy_dirs

Type:

multi-valued

Default:

policy.d

Directories where policy configuration files are stored. They can be relative to any directory in the search path defined by the config_dir option, or absolute paths. The file defined by policy_file must exist for these directories to be searched. Missing or empty directories are ignored.

remote_content_type

Type:

string

Default:

application/x-www-form-urlencoded

Valid Values:

application/x-www-form-urlencoded, application/json

Content Type to send and receive data for REST based policy check

remote_ssl_verify_server_crt

Type:

boolean

Default:

False

server identity verification for REST based policy check

remote_ssl_ca_crt_file

Type:

string

Default:

<None>

Absolute path to ca cert file for REST based policy check

remote_ssl_client_crt_file

Type:

string

Default:

<None>

Absolute path to client cert for REST based policy check

remote_ssl_client_key_file

Type:

string

Default:

<None>

Absolute path client key file REST based policy check

remote_timeout

Type:

floating point

Default:

60

Minimum Value:

0

Timeout in seconds for REST based policy check

paste_deploy

config_file

Type:

string

Default:

freezer-paste.ini

Name of the paste configuration file that defines the available pipelines.

storage

backend

Type:

string

Default:

<None>

Database backend section name. This section will be loaded by the proper driver to connect to the database.

driver

Type:

string

Default:

elasticsearch

Database driver to be used.