Table 5.33. New options
| Option = default value |
(Type) Help string |
| admin_bind_host = 0.0.0.0 |
(StrOpt) The IP Address of the network interface to for the admin service to listen on. |
| domain_id_immutable = True |
(BoolOpt) Set this to false if you want to enable the ability for user, group and project entities to be moved between domains by updating their domain_id. Allowing such movement is not recommended if the scope of a domain admin is being restricted by use of an appropriate policy file (see policy.v3cloudsample as an example). |
| host = 127.0.0.1 |
(StrOpt) Host to locate redis. |
| keystone_ec2_cafile = None |
(StrOpt) A PEM encoded certificate authority to use when verifying HTTPS connections. Defaults to the system CAs. |
| keystone_ec2_certfile = None |
(StrOpt) Client certificate key filename. Required if EC2 server requires client certificate. |
| keystone_ec2_insecure = False |
(BoolOpt) Disable SSL certificate verification. |
| keystone_ec2_keyfile = None |
(StrOpt) Required if EC2 server requires client certificate. |
| keystone_ec2_url = http://localhost:5000/v2.0/ec2tokens |
(StrOpt) URL to get token from ec2 request. |
| kombu_reconnect_delay = 1.0 |
(FloatOpt) How long to wait before reconnecting in response to an AMQP consumer cancel notification. |
| list_limit = None |
(IntOpt) The maximum number of entities that will be returned in a collection can be set with list_limit, with no limit set by default. This global limit may be then overridden for a specific driver, by specifying a list_limit in the appropriate section (e.g. [assignment]). |
| log_config_append = None |
(StrOpt) The name of logging configuration file. It does not disable existing loggers, but just appends specified logging configuration to any other existing logging options. Please see the Python logging module documentation for details on logging configuration files. |
| password = None |
(StrOpt) Password for Redis server (optional). |
| port = 6379 |
(IntOpt) Use this port to connect to redis host. |
| public_bind_host = 0.0.0.0 |
(StrOpt) The IP Address of the network interface to for the public service to listen on. |
| rabbit_login_method = AMQPLAIN |
(StrOpt) the RabbitMQ login method |
| tcp_keepalive = False |
(BoolOpt) Set this to True if you want to enable TCP_KEEPALIVE on server sockets i.e. sockets used by the keystone wsgi server for client connections. |
| tcp_keepidle = 600 |
(IntOpt) Sets the value of TCP_KEEPIDLE in seconds for each server socket. Only applies if tcp_keepalive is True. Not supported on OS X. |
| transport_url = None |
(StrOpt) A URL representing the messaging driver to use and its full configuration. If not set, we fall back to the rpc_backend option and driver specific configuration. |
| use_syslog_rfc_format = False |
(BoolOpt) (Optional) Use syslog rfc5424 format for logging. If enabled, will add APP-NAME (RFC5424) before the MSG part of the syslog message. The old format without APP-NAME is deprecated in I, and will be removed in J. |
| assignment/list_limit = None |
(IntOpt) Maximum number of entities that will be returned in an assignment collection. |
| audit/namespace = openstack |
(StrOpt) namespace prefix for generated id |
| catalog/list_limit = None |
(IntOpt) Maximum number of entities that will be returned in a catalog collection. |
| database/db_inc_retry_interval = True |
(BoolOpt) Whether to increase interval between db connection retries, up to db_max_retry_interval |
| database/db_max_retries = 20 |
(IntOpt) maximum db connection retries before error is raised. (setting -1 implies an infinite retry count) |
| database/db_max_retry_interval = 10 |
(IntOpt) max seconds between db connection retries, if db_inc_retry_interval is enabled |
| database/db_retry_interval = 1 |
(IntOpt) seconds between db connection retries |
| database/mysql_sql_mode = TRADITIONAL |
(StrOpt) The SQL mode to be used for MySQL sessions. This option, including the default, overrides any server-set SQL mode. To use whatever SQL mode is set by the server configuration, set this to no value. Example: mysql_sql_mode= |
| database/sqlite_db = keystone.sqlite |
(StrOpt) The file name to use with SQLite |
| database/sqlite_synchronous = True |
(BoolOpt) If True, SQLite uses synchronous mode |
| database/use_db_reconnect = False |
(BoolOpt) Enable the experimental use of database reconnect on connection lost |
| federation/assertion_prefix = |
(StrOpt) Value to be used when filtering assertion parameters from the environment. |
| federation/driver = keystone.contrib.federation.backends.sql.Federation |
(StrOpt) Keystone Federation backend driver. |
| identity/list_limit = None |
(IntOpt) Maximum number of entities that will be returned in an identity collection. |
| kvs/backends = [] |
(ListOpt) Extra dogpile.cache backend modules to register with the dogpile.cache library. |
| kvs/config_prefix = keystone.kvs |
(StrOpt) Prefix for building the configuration dictionary for the KVS region. This should not need to be changed unless there is another dogpile.cache region with the same configuration name. |
| kvs/default_lock_timeout = 5 |
(IntOpt) Default lock timeout for distributed locking. |
| kvs/enable_key_mangler = True |
(BoolOpt) Toggle to disable using a key-mangling function to ensure fixed length keys. This is toggle-able for debugging purposes, it is highly recommended to always leave this set to True. |
| ldap/chase_referrals = None |
(BoolOpt) Override the system's default referral chasing behavior for queries. |
| policy/list_limit = None |
(IntOpt) Maximum number of entities that will be returned in a policy collection. |
| revoke/caching = True |
(BoolOpt) Toggle for revocation event cacheing. This has no effect unless global caching is enabled. |
| revoke/driver = keystone.contrib.revoke.backends.kvs.Revoke |
(StrOpt) An implementation of the backend for persisting revocation events. |
| revoke/expiration_buffer = 1800 |
(IntOpt) This value (calculated in seconds) is added to token expiration before a revocation event may be removed from the backend. |
| token/revoke_by_id = True |
(BoolOpt) Revoke token by token identifier. Setting revoke_by_id to True enables various forms of enumerating tokens, e.g. `list tokens for user`. These enumerations are processed to determine the list of tokens to revoke. Only disable if you are switching to using the Revoke extension with a backend other than KVS, which stores events in memory. |
Table 5.34. New default values
| Option |
Previous default value |
New default value |
| admin_endpoint |
http://localhost:%(admin_port)s/ |
None |
| default_log_levels |
amqplib=WARN, sqlalchemy=WARN, boto=WARN, suds=INFO, keystone=INFO, eventlet.wsgi.server=WARN |
amqp=WARN, amqplib=WARN, boto=WARN, qpid=WARN, sqlalchemy=WARN, suds=INFO, iso8601=WARN, requests.packages.urllib3.connectionpool=WARN |
| logging_context_format_string |
%(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user)s %(tenant)s] %(instance)s%(message)s |
%(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user_identity)s] %(instance)s%(message)s |
| public_endpoint |
http://localhost:%(public_port)s/ |
None |
| rpc_zmq_matchmaker |
keystone.openstack.common.rpc.matchmaker.MatchMakerLocalhost |
oslo.messaging._drivers.matchmaker.MatchMakerLocalhost |
| auth/external |
keystone.auth.plugins.external.ExternalDefault |
keystone.auth.plugins.external.DefaultDomain |
| database/connection |
sqlite:////home/gauvain/sources/openstack/openstack-doc-tools/autogenerate_config_docs/sources/keystone/keystone/openstack/common/db/$sqlite_db |
None |
| ldap/group_additional_attribute_mapping |
None |
|
| ldap/group_attribute_ignore |
|
|
| ldap/role_additional_attribute_mapping |
None |
|
| ldap/role_attribute_ignore |
|
|
| ldap/tenant_additional_attribute_mapping |
None |
|
| ldap/tenant_attribute_ignore |
|
|
| ldap/user_additional_attribute_mapping |
None |
|
| ldap/user_attribute_ignore |
default_project_id,tenants |
default_project_id, tenants |
| memcache/servers |
localhost:11211 |
localhost:11211 |
| paste_deploy/config_file |
None |
keystone-paste.ini |
| signing/ca_key |
/etc/keystone/ssl/certs/cakey.pem |
/etc/keystone/ssl/private/cakey.pem |
| ssl/ca_key |
/etc/keystone/ssl/certs/cakey.pem |
/etc/keystone/ssl/private/cakey.pem |
| token/expiration |
86400 |
3600 |
