karbor.conf

DEFAULT

state_path
Type

string

Default

/var/lib/karbor

Top-level directory for maintaining karbor’s state

Deprecated Variations

Group

Name

DEFAULT

pybasedir

service_down_time
Type

integer

Default

60

Maximum time since last check-in for a service to be considered up

operationengine_topic
Type

string

Default

karbor-operationengine

The topic that OperationEngine nodes listen on

operationengine_manager
Type

string

Default

karbor.services.operationengine.manager.OperationEngineManager

Full class name for the Manager for OperationEngine

protection_topic
Type

string

Default

karbor-protection

The topic that protection nodes listen on

protection_manager
Type

string

Default

karbor.services.protection.manager.ProtectionManager

Full class name for the Manager for Protection

host
Type

host address

Default

ubuntu-focal-rax-ord-0019851069

Name of this node. This can be an opaque identifier. It is not necessarily a host name, FQDN, or IP address.

auth_strategy
Type

string

Default

keystone

Valid Values

noauth, keystone

The strategy to use for auth. Supports noauth or keystone.

osapi_max_limit
Type

integer

Default

1000

The maximum number of items that a collection resource returns in a single response

osapi_karbor_base_URL
Type

string

Default

<None>

Base URL that will be presented to users in links to the OpenStack Karbor API

query_instance_filters
Type

list

Default

['status']

Instance filter options which non-admin user could use to query instances. Default values are: [‘status’]

query_provider_filters
Type

list

Default

['name', 'description']

Provider filter options which non-admin user could use to query providers. Default values are: [‘name’, ‘description’]

query_checkpoint_filters
Type

list

Default

['project_id', 'plan_id', 'start_date', 'end_date']

Checkpoint filter options which non-admin user could use to query checkpoints. Default values are: [‘project_id’, ‘plan_id’, ‘start_date’, ‘end_date’]

enable_new_services
Type

boolean

Default

True

Services to be added to the available pool on create

thread_count
Type

integer

Default

10

The count of thread which executor will start

min_interval
Type

integer

Default

3600

The minimum interval of two adjacent time points. min_interval >= (max_window_time * 2)

min_window_time
Type

integer

Default

900

The minimum window time

max_window_time
Type

integer

Default

1800

The maximum window time

time_format
Type

string

Default

calendar

Valid Values

crontab, calendar

The type of time format which is used to compute time

trigger_poll_interval
Type

integer

Default

15

Interval, in seconds, in which Karbor will poll for trigger events

scheduling_strategy
Type

string

Default

multi_node

Time trigger scheduling strategy

retained_operation_log_number
Type

integer

Default

5

The number of retained operation log

sync_status_interval
Type

integer

Default

20

update protection status interval

workflow_engine
Type

string

Default

karbor.services.protection.flows.workflow.TaskFlowEngine

The workflow engine provides flow and task interface

provider_registry
Type

string

Default

provider-registry

the provider registry

max_concurrent_operations
Type

integer

Default

0

number of maximum concurrent operation (protect, restore, delete) flows. 0 means no hard limit

tcp_keepalive
Type

boolean

Default

True

Sets the value of TCP_KEEPALIVE (True/False) for each server socket.

tcp_keepalive_interval
Type

integer

Default

<None>

Sets the value of TCP_KEEPINTVL in seconds for each server socket. Not supported on OS X.

tcp_keepalive_count
Type

integer

Default

<None>

Sets the value of TCP_KEEPCNT for each server socket. Not supported on OS X.

fatal_exception_format_errors
Type

boolean

Default

False

Make exception message format errors fatal.

report_interval
Type

integer

Default

10

Interval, in seconds, between nodes reporting state to datastore

periodic_interval
Type

integer

Default

60

Interval, in seconds, between running periodic tasks

periodic_fuzzy_delay
Type

integer

Default

60

Range, in seconds, to randomly delay when starting the periodic task OperationEngine to reduce stampeding. (Disable by setting to 0)

osapi_karbor_listen
Type

host address

Default

0.0.0.0

IP address on which OpenStack Karbor API listens

osapi_karbor_listen_port
Type

port number

Default

8799

Minimum Value

0

Maximum Value

65535

Port on which OpenStack Karbor API listens

osapi_karbor_workers
Type

integer

Default

<None>

Number of workers for OpenStack Karbor API service. The default is equal to the number of CPUs available.

debug
Type

boolean

Default

False

Mutable

This option can be changed without restarting.

If set to true, the logging level will be set to DEBUG instead of the default INFO level.

log_config_append
Type

string

Default

<None>

Mutable

This option can be changed without restarting.

The name of a logging configuration file. This file is appended to any existing logging configuration files. For details about logging configuration files, see the Python logging module documentation. Note that when logging configuration files are used then all logging configuration is set in the configuration file and other logging configuration options are ignored (for example, log-date-format).

Deprecated Variations

Group

Name

DEFAULT

log-config

DEFAULT

log_config

log_date_format
Type

string

Default

%Y-%m-%d %H:%M:%S

Defines the format string for %(asctime)s in log records. Default: the value above . This option is ignored if log_config_append is set.

log_file
Type

string

Default

<None>

(Optional) Name of log file to send logging output to. If no default is set, logging will go to stderr as defined by use_stderr. This option is ignored if log_config_append is set.

Deprecated Variations

Group

Name

DEFAULT

logfile

log_dir
Type

string

Default

<None>

(Optional) The base directory used for relative log_file paths. This option is ignored if log_config_append is set.

Deprecated Variations

Group

Name

DEFAULT

logdir

watch_log_file
Type

boolean

Default

False

Uses logging handler designed to watch file system. When log file is moved or removed this handler will open a new log file with specified path instantaneously. It makes sense only if log_file option is specified and Linux platform is used. This option is ignored if log_config_append is set.

use_syslog
Type

boolean

Default

False

Use syslog for logging. Existing syslog format is DEPRECATED and will be changed later to honor RFC5424. This option is ignored if log_config_append is set.

use_journal
Type

boolean

Default

False

Enable journald for logging. If running in a systemd environment you may wish to enable journal support. Doing so will use the journal native protocol which includes structured metadata in addition to log messages.This option is ignored if log_config_append is set.

syslog_log_facility
Type

string

Default

LOG_USER

Syslog facility to receive log lines. This option is ignored if log_config_append is set.

use_json
Type

boolean

Default

False

Use JSON formatting for logging. This option is ignored if log_config_append is set.

use_stderr
Type

boolean

Default

False

Log output to standard error. This option is ignored if log_config_append is set.

use_eventlog
Type

boolean

Default

False

Log output to Windows Event Log.

log_rotate_interval
Type

integer

Default

1

The amount of time before the log files are rotated. This option is ignored unless log_rotation_type is setto “interval”.

log_rotate_interval_type
Type

string

Default

days

Valid Values

Seconds, Minutes, Hours, Days, Weekday, Midnight

Rotation interval type. The time of the last file change (or the time when the service was started) is used when scheduling the next rotation.

max_logfile_count
Type

integer

Default

30

Maximum number of rotated log files.

max_logfile_size_mb
Type

integer

Default

200

Log file maximum size in MB. This option is ignored if “log_rotation_type” is not set to “size”.

log_rotation_type
Type

string

Default

none

Valid Values

interval, size, none

Log rotation type.

Possible values

interval

Rotate logs at predefined time intervals.

size

Rotate logs once they reach a predefined size.

none

Do not rotate log files.

logging_context_format_string
Type

string

Default

%(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user_identity)s] %(instance)s%(message)s

Format string to use for log messages with context. Used by oslo_log.formatters.ContextFormatter

logging_default_format_string
Type

string

Default

%(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [-] %(instance)s%(message)s

Format string to use for log messages when context is undefined. Used by oslo_log.formatters.ContextFormatter

logging_debug_format_suffix
Type

string

Default

%(funcName)s %(pathname)s:%(lineno)d

Additional data to append to log message when logging level for the message is DEBUG. Used by oslo_log.formatters.ContextFormatter

logging_exception_prefix
Type

string

Default

%(asctime)s.%(msecs)03d %(process)d ERROR %(name)s %(instance)s

Prefix each line of exception output with this format. Used by oslo_log.formatters.ContextFormatter

logging_user_identity_format
Type

string

Default

%(user)s %(tenant)s %(domain)s %(user_domain)s %(project_domain)s

Defines the format string for %(user_identity)s that is used in logging_context_format_string. Used by oslo_log.formatters.ContextFormatter

default_log_levels
Type

list

Default

['amqp=WARN', 'amqplib=WARN', 'boto=WARN', 'qpid=WARN', 'sqlalchemy=WARN', 'suds=INFO', 'oslo.messaging=INFO', 'oslo_messaging=INFO', 'iso8601=WARN', 'requests.packages.urllib3.connectionpool=WARN', 'urllib3.connectionpool=WARN', 'websocket=WARN', 'requests.packages.urllib3.util.retry=WARN', 'urllib3.util.retry=WARN', 'keystonemiddleware=WARN', 'routes.middleware=WARN', 'stevedore=WARN', 'taskflow=WARN', 'keystoneauth=WARN', 'oslo.cache=INFO', 'oslo_policy=INFO', 'dogpile.core.dogpile=INFO']

List of package logging levels in logger=LEVEL pairs. This option is ignored if log_config_append is set.

publish_errors
Type

boolean

Default

False

Enables or disables publication of error events.

instance_format
Type

string

Default

"[instance: %(uuid)s] "

The format for an instance that is passed with the log message.

instance_uuid_format
Type

string

Default

"[instance: %(uuid)s] "

The format for an instance UUID that is passed with the log message.

rate_limit_interval
Type

integer

Default

0

Interval, number of seconds, of log rate limiting.

rate_limit_burst
Type

integer

Default

0

Maximum number of logged messages per rate_limit_interval.

rate_limit_except_level
Type

string

Default

CRITICAL

Log level name used by rate limiting: CRITICAL, ERROR, INFO, WARNING, DEBUG or empty string. Logs with level greater or equal to rate_limit_except_level are not filtered. An empty string means that all levels are filtered.

fatal_deprecations
Type

boolean

Default

False

Enables or disables fatal status of deprecations.

cinder_client

service_name
Type

string

Default

<None>

The name of service registered in Keystone

service_type
Type

string

Default

<None>

The type of service registered in Keystone

version
Type

string

Default

<None>

The version of service client

region_id
Type

string

Default

RegionOne

The region id which the service belongs to.

interface
Type

string

Default

internal

The network interface of the endpoint. Valid values are: public, admin, internal.

ca_cert_file
Type

string

Default

<None>

Location of the CA certificate file to use for client requests in SSL connections.

auth_insecure
Type

boolean

Default

False

Bypass verification of server certificate when making SSL connection to service.

cinder_endpoint
Type

string

Default

<None>

URL of the cinder endpoint.

cinder_catalog_info
Type

string

Default

volumev3:cinderv3:publicURL

Info to match when looking for cinder in the service catalog. Format is: separated values of the form: <service_type>:<service_name>:<endpoint_type> - Only used if cinder_endpoint is unset

cinder_ca_cert_file
Type

string

Default

<None>

Location of the CA certificate file to use for client requests in SSL connections.

cinder_auth_insecure
Type

boolean

Default

False

Bypass verification of server certificate when making SSL connection to Cinder.

clients_keystone

auth_uri
Type

string

Default

''

Unversioned keystone url in format like http://0.0.0.0:5000.

database

sqlite_synchronous
Type

boolean

Default

True

If True, SQLite uses synchronous mode.

Deprecated Variations

Group

Name

DEFAULT

sqlite_synchronous

backend
Type

string

Default

sqlalchemy

The back end to use for the database.

Deprecated Variations

Group

Name

DEFAULT

db_backend

connection
Type

string

Default

<None>

The SQLAlchemy connection string to use to connect to the database.

Deprecated Variations

Group

Name

DEFAULT

sql_connection

DATABASE

sql_connection

sql

connection

slave_connection
Type

string

Default

<None>

The SQLAlchemy connection string to use to connect to the slave database.

mysql_sql_mode
Type

string

Default

TRADITIONAL

The SQL mode to be used for MySQL sessions. This option, including the default, overrides any server-set SQL mode. To use whatever SQL mode is set by the server configuration, set this to no value. Example: mysql_sql_mode=

mysql_enable_ndb
Type

boolean

Default

False

If True, transparently enables support for handling MySQL Cluster (NDB).

connection_recycle_time
Type

integer

Default

3600

Connections which have been present in the connection pool longer than this number of seconds will be replaced with a new one the next time they are checked out from the pool.

Deprecated Variations

Group

Name

DATABASE

idle_timeout

database

idle_timeout

DEFAULT

sql_idle_timeout

DATABASE

sql_idle_timeout

sql

idle_timeout

max_pool_size
Type

integer

Default

5

Maximum number of SQL connections to keep open in a pool. Setting a value of 0 indicates no limit.

Deprecated Variations

Group

Name

DEFAULT

sql_max_pool_size

DATABASE

sql_max_pool_size

max_retries
Type

integer

Default

10

Maximum number of database connection retries during startup. Set to -1 to specify an infinite retry count.

Deprecated Variations

Group

Name

DEFAULT

sql_max_retries

DATABASE

sql_max_retries

retry_interval
Type

integer

Default

10

Interval between retries of opening a SQL connection.

Deprecated Variations

Group

Name

DEFAULT

sql_retry_interval

DATABASE

reconnect_interval

max_overflow
Type

integer

Default

50

If set, use this value for max_overflow with SQLAlchemy.

Deprecated Variations

Group

Name

DEFAULT

sql_max_overflow

DATABASE

sqlalchemy_max_overflow

connection_debug
Type

integer

Default

0

Minimum Value

0

Maximum Value

100

Verbosity of SQL debugging information: 0=None, 100=Everything.

Deprecated Variations

Group

Name

DEFAULT

sql_connection_debug

connection_trace
Type

boolean

Default

False

Add Python stack traces to SQL as comment strings.

Deprecated Variations

Group

Name

DEFAULT

sql_connection_trace

pool_timeout
Type

integer

Default

<None>

If set, use this value for pool_timeout with SQLAlchemy.

Deprecated Variations

Group

Name

DATABASE

sqlalchemy_pool_timeout

use_db_reconnect
Type

boolean

Default

False

Enable the experimental use of database reconnect on connection lost.

db_retry_interval
Type

integer

Default

1

Seconds between retries of a database transaction.

db_inc_retry_interval
Type

boolean

Default

True

If True, increases the interval between retries of a database operation up to db_max_retry_interval.

db_max_retry_interval
Type

integer

Default

10

If db_inc_retry_interval is set, the maximum seconds between retries of a database operation.

db_max_retries
Type

integer

Default

20

Maximum retries in case of connection error or deadlock error before error is raised. Set to -1 to specify an infinite retry count.

connection_parameters
Type

string

Default

''

Optional URL parameters to append onto the connection URL at connect time; specify as param1=value1&param2=value2&…

glance_client

service_name
Type

string

Default

<None>

The name of service registered in Keystone

service_type
Type

string

Default

<None>

The type of service registered in Keystone

version
Type

string

Default

<None>

The version of service client

region_id
Type

string

Default

RegionOne

The region id which the service belongs to.

interface
Type

string

Default

internal

The network interface of the endpoint. Valid values are: public, admin, internal.

ca_cert_file
Type

string

Default

<None>

Location of the CA certificate file to use for client requests in SSL connections.

auth_insecure
Type

boolean

Default

False

Bypass verification of server certificate when making SSL connection to service.

glance_endpoint
Type

string

Default

<None>

URL of the glance endpoint.

glance_catalog_info
Type

string

Default

image:glance:publicURL

Info to match when looking for glance in the service catalog. Format is: separated values of the form: <service_type>:<service_name>:<endpoint_type> - Only used if glance_endpoint is unset

glance_ca_cert_file
Type

string

Default

<None>

Location of the CA certificate file to use for client requests in SSL connections.

glance_auth_insecure
Type

boolean

Default

False

Bypass verification of server certificate when making SSL connection to Glance.

karbor_client

service_name
Type

string

Default

<None>

The name of service registered in Keystone

service_type
Type

string

Default

<None>

The type of service registered in Keystone

version
Type

string

Default

<None>

The version of service client

region_id
Type

string

Default

RegionOne

The region id which the service belongs to.

interface
Type

string

Default

internal

The network interface of the endpoint. Valid values are: public, admin, internal.

ca_cert_file
Type

string

Default

<None>

Location of the CA certificate file to use for client requests in SSL connections.

auth_insecure
Type

boolean

Default

False

Bypass verification of server certificate when making SSL connection to service.

keystone_authtoken

www_authenticate_uri
Type

string

Default

<None>

Complete “public” Identity API endpoint. This endpoint should not be an “admin” endpoint, as it should be accessible by all end users. Unauthenticated clients are redirected to this endpoint to authenticate. Although this endpoint should ideally be unversioned, client support in the wild varies. If you’re using a versioned v2 endpoint here, then this should not be the same endpoint the service user utilizes for validating tokens, because normal end users may not be able to reach that endpoint.

Deprecated Variations

Group

Name

keystone_authtoken

auth_uri

auth_uri
Type

string

Default

<None>

Complete “public” Identity API endpoint. This endpoint should not be an “admin” endpoint, as it should be accessible by all end users. Unauthenticated clients are redirected to this endpoint to authenticate. Although this endpoint should ideally be unversioned, client support in the wild varies. If you’re using a versioned v2 endpoint here, then this should not be the same endpoint the service user utilizes for validating tokens, because normal end users may not be able to reach that endpoint. This option is deprecated in favor of www_authenticate_uri and will be removed in the S release.

Warning

This option is deprecated for removal since Queens. Its value may be silently ignored in the future.

Reason

The auth_uri option is deprecated in favor of www_authenticate_uri and will be removed in the S release.

auth_version
Type

string

Default

<None>

API version of the Identity API endpoint.

interface
Type

string

Default

internal

Interface to use for the Identity API endpoint. Valid values are “public”, “internal” (default) or “admin”.

delay_auth_decision
Type

boolean

Default

False

Do not handle authorization requests within the middleware, but delegate the authorization decision to downstream WSGI components.

http_connect_timeout
Type

integer

Default

<None>

Request timeout value for communicating with Identity API server.

http_request_max_retries
Type

integer

Default

3

How many times are we trying to reconnect when communicating with Identity API Server.

cache
Type

string

Default

<None>

Request environment key where the Swift cache object is stored. When auth_token middleware is deployed with a Swift cache, use this option to have the middleware share a caching backend with swift. Otherwise, use the memcached_servers option instead.

certfile
Type

string

Default

<None>

Required if identity server requires client certificate

keyfile
Type

string

Default

<None>

Required if identity server requires client certificate

cafile
Type

string

Default

<None>

A PEM encoded Certificate Authority to use when verifying HTTPs connections. Defaults to system CAs.

insecure
Type

boolean

Default

False

Verify HTTPS connections.

region_name
Type

string

Default

<None>

The region in which the identity server can be found.

memcached_servers
Type

list

Default

<None>

Optionally specify a list of memcached server(s) to use for caching. If left undefined, tokens will instead be cached in-process.

Deprecated Variations

Group

Name

keystone_authtoken

memcache_servers

token_cache_time
Type

integer

Default

300

In order to prevent excessive effort spent validating tokens, the middleware caches previously-seen tokens for a configurable duration (in seconds). Set to -1 to disable caching completely.

memcache_security_strategy
Type

string

Default

None

Valid Values

None, MAC, ENCRYPT

(Optional) If defined, indicate whether token data should be authenticated or authenticated and encrypted. If MAC, token data is authenticated (with HMAC) in the cache. If ENCRYPT, token data is encrypted and authenticated in the cache. If the value is not one of these options or empty, auth_token will raise an exception on initialization.

memcache_secret_key
Type

string

Default

<None>

(Optional, mandatory if memcache_security_strategy is defined) This string is used for key derivation.

memcache_pool_dead_retry
Type

integer

Default

300

(Optional) Number of seconds memcached server is considered dead before it is tried again.

memcache_pool_maxsize
Type

integer

Default

10

(Optional) Maximum total number of open connections to every memcached server.

memcache_pool_socket_timeout
Type

integer

Default

3

(Optional) Socket timeout in seconds for communicating with a memcached server.

memcache_pool_unused_timeout
Type

integer

Default

60

(Optional) Number of seconds a connection to memcached is held unused in the pool before it is closed.

memcache_pool_conn_get_timeout
Type

integer

Default

10

(Optional) Number of seconds that an operation will wait to get a memcached client connection from the pool.

memcache_use_advanced_pool
Type

boolean

Default

False

(Optional) Use the advanced (eventlet safe) memcached client pool. The advanced pool will only work under python 2.x.

include_service_catalog
Type

boolean

Default

True

(Optional) Indicate whether to set the X-Service-Catalog header. If False, middleware will not ask for service catalog on token validation and will not set the X-Service-Catalog header.

enforce_token_bind
Type

string

Default

permissive

Used to control the use and type of token binding. Can be set to: “disabled” to not check token binding. “permissive” (default) to validate binding information if the bind type is of a form known to the server and ignore it if not. “strict” like “permissive” but if the bind type is unknown the token will be rejected. “required” any form of token binding is needed to be allowed. Finally the name of a binding method that must be present in tokens.

service_token_roles
Type

list

Default

['service']

A choice of roles that must be present in a service token. Service tokens are allowed to request that an expired token can be used and so this check should tightly control that only actual services should be sending this token. Roles here are applied as an ANY check so any role in this list must be present. For backwards compatibility reasons this currently only affects the allow_expired check.

service_token_roles_required
Type

boolean

Default

False

For backwards compatibility reasons we must let valid service tokens pass that don’t pass the service_token_roles check as valid. Setting this true will become the default in a future release and should be enabled if possible.

service_type
Type

string

Default

<None>

The name or type of the service as it appears in the service catalog. This is used to validate tokens that have restricted access rules.

auth_type
Type

unknown type

Default

<None>

Authentication type to load

Deprecated Variations

Group

Name

keystone_authtoken

auth_plugin

auth_section
Type

unknown type

Default

<None>

Config Section from which to load plugin specific options

manila_client

service_name
Type

string

Default

<None>

The name of service registered in Keystone

service_type
Type

string

Default

<None>

The type of service registered in Keystone

version
Type

string

Default

<None>

The version of service client

region_id
Type

string

Default

RegionOne

The region id which the service belongs to.

interface
Type

string

Default

internal

The network interface of the endpoint. Valid values are: public, admin, internal.

ca_cert_file
Type

string

Default

<None>

Location of the CA certificate file to use for client requests in SSL connections.

auth_insecure
Type

boolean

Default

False

Bypass verification of server certificate when making SSL connection to service.

manila_endpoint
Type

string

Default

<None>

URL of the manila endpoint.

manila_catalog_info
Type

string

Default

sharev2:manilav2:publicURL

Info to match when looking for manila in the service catalog. Format is: separated values of the form: <service_type>:<service_name>:<endpoint_type> - Only used if manila_endpoint is unset

manila_ca_cert_file
Type

string

Default

<None>

Location of the CA certificate file to use for client requests in SSL connections.

manila_auth_insecure
Type

boolean

Default

False

Bypass verification of server certificate when making SSL connection to manila.

neutron_client

service_name
Type

string

Default

<None>

The name of service registered in Keystone

service_type
Type

string

Default

<None>

The type of service registered in Keystone

version
Type

string

Default

<None>

The version of service client

region_id
Type

string

Default

RegionOne

The region id which the service belongs to.

interface
Type

string

Default

internal

The network interface of the endpoint. Valid values are: public, admin, internal.

ca_cert_file
Type

string

Default

<None>

Location of the CA certificate file to use for client requests in SSL connections.

auth_insecure
Type

boolean

Default

False

Bypass verification of server certificate when making SSL connection to service.

neutron_endpoint
Type

string

Default

<None>

URL of the neutron endpoint.

neutron_catalog_info
Type

string

Default

network:neutron:publicURL

Info to match when looking for neutron in the service catalog. Format is: separated values of the form: <service_type>:<service_name>:<endpoint_type> - Only used if neutron_endpoint is unset

neutron_ca_cert_file
Type

string

Default

<None>

Location of the CA certificate file to use for client requests in SSL connections.

neutron_auth_insecure
Type

boolean

Default

False

Bypass verification of server certificate when making SSL connection to Neutron.

nova_client

service_name
Type

string

Default

<None>

The name of service registered in Keystone

service_type
Type

string

Default

<None>

The type of service registered in Keystone

version
Type

string

Default

<None>

The version of service client

region_id
Type

string

Default

RegionOne

The region id which the service belongs to.

interface
Type

string

Default

internal

The network interface of the endpoint. Valid values are: public, admin, internal.

ca_cert_file
Type

string

Default

<None>

Location of the CA certificate file to use for client requests in SSL connections.

auth_insecure
Type

boolean

Default

False

Bypass verification of server certificate when making SSL connection to service.

nova_endpoint
Type

string

Default

<None>

URL of the nova endpoint. <endpoint_url>

nova_catalog_info
Type

string

Default

compute:nova:publicURL

Info to match when looking for nova in the service catalog. Format is: separated values of the form: <service_type>:<service_name>:<endpoint_type> - Only used if nova_endpoint is unset

nova_ca_cert_file
Type

string

Default

<None>

Location of the CA certificate file to use for client requests in SSL connections.

nova_auth_insecure
Type

boolean

Default

False

Bypass verification of server certificate when making SSL connection to Nova.

operationengine

max_concurrent_operations
Type

integer

Default

0

number of maximum concurrent running operations,0 means no hard limit

executor
Type

string

Default

green_thread

Valid Values

thread_pool, green_thread

The name of executor which is used to run operations

oslo_concurrency

disable_process_locking
Type

boolean

Default

False

Enables or disables inter-process locks.

Deprecated Variations

Group

Name

DEFAULT

disable_process_locking

lock_path
Type

string

Default

<None>

Directory to use for lock files. For security, the specified directory should only be writable by the user running the processes that need locking. Defaults to environment variable OSLO_LOCK_PATH. If external locks are used, a lock path must be set.

Deprecated Variations

Group

Name

DEFAULT

lock_path

oslo_policy

enforce_scope
Type

boolean

Default

False

This option controls whether or not to enforce scope when evaluating policies. If True, the scope of the token used in the request is compared to the scope_types of the policy being enforced. If the scopes do not match, an InvalidScope exception will be raised. If False, a message will be logged informing operators that policies are being invoked with mismatching scope.

enforce_new_defaults
Type

boolean

Default

False

This option controls whether or not to use old deprecated defaults when evaluating policies. If True, the old deprecated defaults are not going to be evaluated. This means if any existing token is allowed for old defaults but is disallowed for new defaults, it will be disallowed. It is encouraged to enable this flag along with the enforce_scope flag so that you can get the benefits of new defaults and scope_type together

policy_file
Type

string

Default

policy.json

The relative or absolute path of a file that maps roles to permissions for a given service. Relative paths must be specified in relation to the configuration file setting this option.

Deprecated Variations

Group

Name

DEFAULT

policy_file

policy_default_rule
Type

string

Default

default

Default rule. Enforced when a requested rule is not found.

Deprecated Variations

Group

Name

DEFAULT

policy_default_rule

policy_dirs
Type

multi-valued

Default

policy.d

Directories where policy configuration files are stored. They can be relative to any directory in the search path defined by the config_dir option, or absolute paths. The file defined by policy_file must exist for these directories to be searched. Missing or empty directories are ignored.

Deprecated Variations

Group

Name

DEFAULT

policy_dirs

remote_content_type
Type

string

Default

application/x-www-form-urlencoded

Valid Values

application/x-www-form-urlencoded, application/json

Content Type to send and receive data for REST based policy check

remote_ssl_verify_server_crt
Type

boolean

Default

False

server identity verification for REST based policy check

remote_ssl_ca_crt_file
Type

string

Default

<None>

Absolute path to ca cert file for REST based policy check

remote_ssl_client_crt_file
Type

string

Default

<None>

Absolute path to client cert for REST based policy check

remote_ssl_client_key_file
Type

string

Default

<None>

Absolute path client key file REST based policy check