2015-06-17 08:11:44 +00:00
|
|
|
---
|
2015-08-29 11:49:57 +00:00
|
|
|
###################
|
2020-01-27 12:28:59 +01:00
|
|
|
# External Ceph options
|
2015-08-29 11:49:57 +00:00
|
|
|
####################
|
2016-03-16 21:45:25 +00:00
|
|
|
# These options must be UUID4 values in string format
|
|
|
|
# XXXXXXXX-XXXX-4XXX-XXXX-XXXXXXXXXXXX
|
2017-03-07 22:03:50 +08:00
|
|
|
# for backward compatible consideration, rbd_secret_uuid is only used for nova,
|
|
|
|
# cinder_rbd_secret_uuid is used for cinder
|
2016-03-16 21:45:25 +00:00
|
|
|
rbd_secret_uuid:
|
2017-03-07 22:03:50 +08:00
|
|
|
cinder_rbd_secret_uuid:
|
2015-08-29 11:49:57 +00:00
|
|
|
|
2015-06-17 08:11:44 +00:00
|
|
|
###################
|
|
|
|
# Database options
|
|
|
|
####################
|
2016-03-16 21:45:25 +00:00
|
|
|
database_password:
|
2017-12-14 18:51:30 +00:00
|
|
|
# Password for the dedicated backup user account
|
|
|
|
mariadb_backup_database_password:
|
2022-05-31 14:49:11 +02:00
|
|
|
# Password for the monitor user
|
|
|
|
mariadb_monitor_password:
|
2015-06-17 08:11:44 +00:00
|
|
|
|
|
|
|
####################
|
|
|
|
# Docker options
|
|
|
|
####################
|
2016-03-16 21:45:25 +00:00
|
|
|
# This should only be set if you require a password for your Docker registry
|
2015-06-17 08:11:44 +00:00
|
|
|
docker_registry_password:
|
|
|
|
|
2017-09-29 09:20:39 +02:00
|
|
|
####################
|
|
|
|
# VMware support
|
|
|
|
####################
|
|
|
|
vmware_dvs_host_password:
|
|
|
|
vmware_nsxv_password:
|
|
|
|
vmware_vcenter_host_password:
|
2018-05-07 05:46:38 -07:00
|
|
|
nsxv3_api_password:
|
2021-09-03 22:38:37 +02:00
|
|
|
vmware_nsxp_api_password:
|
|
|
|
vmware_nsxp_metadata_proxy_shared_secret:
|
2017-09-29 09:20:39 +02:00
|
|
|
|
2017-11-21 14:30:51 +03:00
|
|
|
#####################
|
|
|
|
# Hitachi NAS support
|
|
|
|
#####################
|
|
|
|
hnas_nfs_password:
|
|
|
|
|
2018-03-21 11:39:26 -04:00
|
|
|
#######################
|
|
|
|
# Infoblox IPAM support
|
|
|
|
#######################
|
|
|
|
infoblox_admin_password:
|
|
|
|
|
2015-06-17 08:11:44 +00:00
|
|
|
####################
|
2016-02-04 19:11:05 +05:30
|
|
|
# OpenStack options
|
2015-06-17 08:11:44 +00:00
|
|
|
####################
|
2016-08-04 06:51:11 +00:00
|
|
|
aodh_database_password:
|
|
|
|
aodh_keystone_password:
|
|
|
|
|
2016-08-08 16:48:11 +00:00
|
|
|
barbican_database_password:
|
|
|
|
barbican_keystone_password:
|
2017-02-07 16:16:17 +07:00
|
|
|
barbican_p11_password:
|
2017-03-11 15:29:45 +08:00
|
|
|
barbican_crypto_key:
|
2016-08-08 16:48:11 +00:00
|
|
|
|
2017-04-07 16:01:07 +01:00
|
|
|
blazar_database_password:
|
|
|
|
blazar_keystone_password:
|
|
|
|
|
2016-03-16 21:45:25 +00:00
|
|
|
keystone_admin_password:
|
|
|
|
keystone_database_password:
|
2015-06-17 08:11:44 +00:00
|
|
|
|
2016-07-27 07:02:04 +00:00
|
|
|
grafana_database_password:
|
|
|
|
grafana_admin_password:
|
|
|
|
|
2016-03-16 21:45:25 +00:00
|
|
|
glance_database_password:
|
|
|
|
glance_keystone_password:
|
2015-07-04 12:47:45 +00:00
|
|
|
|
2016-08-01 05:17:43 +00:00
|
|
|
gnocchi_database_password:
|
|
|
|
gnocchi_keystone_password:
|
|
|
|
|
2016-03-29 13:25:43 -04:00
|
|
|
kuryr_keystone_password:
|
|
|
|
|
2016-03-16 21:45:25 +00:00
|
|
|
nova_database_password:
|
|
|
|
nova_api_database_password:
|
|
|
|
nova_keystone_password:
|
2015-07-12 03:02:33 +00:00
|
|
|
|
2017-02-01 21:46:32 +08:00
|
|
|
placement_keystone_password:
|
2018-10-26 18:13:48 +02:00
|
|
|
placement_database_password:
|
2017-02-01 21:46:32 +08:00
|
|
|
|
2016-03-16 21:45:25 +00:00
|
|
|
neutron_database_password:
|
|
|
|
neutron_keystone_password:
|
|
|
|
metadata_secret:
|
2015-06-17 08:11:44 +00:00
|
|
|
|
2016-03-16 21:45:25 +00:00
|
|
|
cinder_database_password:
|
|
|
|
cinder_keystone_password:
|
2015-08-04 07:39:22 +00:00
|
|
|
|
2016-08-01 02:27:39 +02:00
|
|
|
cloudkitty_database_password:
|
|
|
|
cloudkitty_keystone_password:
|
|
|
|
|
2018-12-02 21:17:07 +08:00
|
|
|
cyborg_database_password:
|
|
|
|
cyborg_keystone_password:
|
|
|
|
|
2017-01-19 18:42:12 +08:00
|
|
|
freezer_database_password:
|
|
|
|
freezer_keystone_password:
|
|
|
|
|
2016-08-04 17:20:20 +00:00
|
|
|
sahara_database_password:
|
|
|
|
sahara_keystone_password:
|
|
|
|
|
2016-08-10 15:48:32 +10:00
|
|
|
designate_database_password:
|
|
|
|
designate_keystone_password:
|
|
|
|
# This option must be UUID4 value in string format
|
|
|
|
designate_pool_id:
|
|
|
|
# This option must be HMAC-MD5 value in string format
|
|
|
|
designate_rndc_key:
|
|
|
|
|
2016-03-16 21:45:25 +00:00
|
|
|
swift_keystone_password:
|
|
|
|
swift_hash_path_suffix:
|
|
|
|
swift_hash_path_prefix:
|
2015-08-18 14:05:54 +00:00
|
|
|
|
2016-03-16 21:45:25 +00:00
|
|
|
heat_database_password:
|
|
|
|
heat_keystone_password:
|
|
|
|
heat_domain_admin_password:
|
2015-08-02 12:26:30 -07:00
|
|
|
|
2016-03-16 21:45:25 +00:00
|
|
|
murano_database_password:
|
|
|
|
murano_keystone_password:
|
2017-04-06 15:14:04 +01:00
|
|
|
murano_agent_rabbitmq_password:
|
2015-08-28 10:49:29 +01:00
|
|
|
|
2018-07-26 16:51:14 +01:00
|
|
|
monasca_agent_password:
|
2018-03-28 17:54:19 +01:00
|
|
|
monasca_database_password:
|
|
|
|
monasca_keystone_password:
|
|
|
|
|
2016-03-16 21:45:25 +00:00
|
|
|
ironic_database_password:
|
|
|
|
ironic_keystone_password:
|
2015-08-28 11:26:40 -04:00
|
|
|
|
2017-01-13 15:19:20 -03:00
|
|
|
ironic_inspector_database_password:
|
|
|
|
ironic_inspector_keystone_password:
|
|
|
|
|
2016-03-16 21:45:25 +00:00
|
|
|
magnum_database_password:
|
|
|
|
magnum_keystone_password:
|
2015-10-17 18:13:51 +02:00
|
|
|
|
2016-03-16 21:45:25 +00:00
|
|
|
mistral_database_password:
|
|
|
|
mistral_keystone_password:
|
2015-12-28 08:38:30 +09:00
|
|
|
|
2016-08-12 18:43:02 +00:00
|
|
|
trove_database_password:
|
|
|
|
trove_keystone_password:
|
|
|
|
|
2016-03-29 13:25:43 -04:00
|
|
|
ceilometer_database_password:
|
|
|
|
ceilometer_keystone_password:
|
|
|
|
|
2016-07-05 09:58:29 +01:00
|
|
|
watcher_database_password:
|
|
|
|
watcher_keystone_password:
|
|
|
|
|
2016-07-08 19:12:50 +02:00
|
|
|
senlin_database_password:
|
|
|
|
senlin_keystone_password:
|
|
|
|
|
2016-11-25 06:14:51 +08:00
|
|
|
solum_database_password:
|
|
|
|
solum_keystone_password:
|
|
|
|
|
2016-03-21 18:12:32 -03:00
|
|
|
horizon_secret_key:
|
2016-09-08 12:49:02 +01:00
|
|
|
horizon_database_password:
|
2015-08-29 11:49:57 +00:00
|
|
|
|
2016-03-29 13:25:43 -04:00
|
|
|
telemetry_secret_key:
|
|
|
|
|
2016-03-21 18:12:32 -03:00
|
|
|
manila_database_password:
|
|
|
|
manila_keystone_password:
|
2016-03-01 10:46:48 -05:00
|
|
|
|
2016-11-30 16:45:00 +08:00
|
|
|
octavia_database_password:
|
|
|
|
octavia_keystone_password:
|
2017-01-13 14:17:26 +08:00
|
|
|
octavia_ca_password:
|
2020-09-25 08:50:09 +01:00
|
|
|
octavia_client_ca_password:
|
2016-11-30 16:45:00 +08:00
|
|
|
|
2016-11-15 18:51:52 +00:00
|
|
|
tacker_database_password:
|
|
|
|
tacker_keystone_password:
|
|
|
|
|
2017-01-03 08:45:53 +00:00
|
|
|
zun_database_password:
|
|
|
|
zun_keystone_password:
|
|
|
|
|
2017-02-11 17:01:19 +00:00
|
|
|
vitrage_database_password:
|
|
|
|
vitrage_keystone_password:
|
|
|
|
|
2021-09-17 05:59:43 -04:00
|
|
|
venus_database_password:
|
|
|
|
venus_keystone_password:
|
|
|
|
|
2018-11-06 10:20:02 +07:00
|
|
|
masakari_database_password:
|
|
|
|
masakari_keystone_password:
|
|
|
|
|
2016-03-21 18:12:32 -03:00
|
|
|
memcache_secret_key:
|
2016-03-01 10:46:48 -05:00
|
|
|
|
2018-02-25 12:02:00 +01:00
|
|
|
# HMAC secret key
|
2017-04-10 15:31:41 +01:00
|
|
|
osprofiler_secret:
|
|
|
|
|
2016-03-27 00:39:07 +08:00
|
|
|
nova_ssh_key:
|
|
|
|
private_key:
|
|
|
|
public_key:
|
|
|
|
|
2016-08-04 02:50:31 +00:00
|
|
|
kolla_ssh_key:
|
|
|
|
private_key:
|
|
|
|
public_key:
|
|
|
|
|
2016-08-07 13:58:50 +10:00
|
|
|
keystone_ssh_key:
|
|
|
|
private_key:
|
|
|
|
public_key:
|
|
|
|
|
2016-08-03 14:25:52 +00:00
|
|
|
bifrost_ssh_key:
|
|
|
|
private_key:
|
|
|
|
public_key:
|
|
|
|
|
2020-07-09 15:28:50 +08:00
|
|
|
octavia_amp_ssh_key:
|
|
|
|
private_key:
|
|
|
|
public_key:
|
|
|
|
|
2022-03-25 11:37:58 +01:00
|
|
|
neutron_ssh_key:
|
|
|
|
private_key:
|
|
|
|
public_key:
|
|
|
|
|
2016-08-01 05:17:43 +00:00
|
|
|
####################
|
|
|
|
# Gnocchi options
|
|
|
|
####################
|
|
|
|
gnocchi_project_id:
|
|
|
|
gnocchi_resource_id:
|
|
|
|
gnocchi_user_id:
|
|
|
|
|
2015-06-17 08:11:44 +00:00
|
|
|
####################
|
|
|
|
# RabbitMQ options
|
|
|
|
####################
|
2016-03-16 21:45:25 +00:00
|
|
|
rabbitmq_password:
|
2017-11-02 13:32:49 +00:00
|
|
|
rabbitmq_monitoring_password:
|
2016-03-16 21:45:25 +00:00
|
|
|
rabbitmq_cluster_cookie:
|
2017-04-05 16:57:35 +01:00
|
|
|
outward_rabbitmq_password:
|
|
|
|
outward_rabbitmq_cluster_cookie:
|
2015-09-16 18:39:51 -07:00
|
|
|
|
|
|
|
####################
|
|
|
|
# HAProxy options
|
|
|
|
####################
|
2016-03-16 21:45:25 +00:00
|
|
|
haproxy_password:
|
|
|
|
keepalived_password:
|
2016-03-23 12:02:49 +01:00
|
|
|
|
|
|
|
####################
|
|
|
|
# Kibana options
|
|
|
|
####################
|
|
|
|
kibana_password:
|
2016-09-02 00:48:01 -04:00
|
|
|
|
|
|
|
####################
|
|
|
|
# etcd options
|
|
|
|
####################
|
|
|
|
etcd_cluster_token:
|
2017-07-21 07:08:54 +00:00
|
|
|
|
|
|
|
####################
|
|
|
|
# redis options
|
|
|
|
####################
|
|
|
|
redis_master_password:
|
2017-12-05 06:08:02 +00:00
|
|
|
|
2017-07-17 15:59:05 +00:00
|
|
|
####################
|
|
|
|
# Prometheus options
|
|
|
|
####################
|
|
|
|
prometheus_mysql_exporter_database_password:
|
2018-06-01 17:03:58 -04:00
|
|
|
prometheus_alertmanager_password:
|
Add support to OpenID Connect Authentication flow
This pull request adds support for the OpenID Connect authentication
flow in Keystone and enables both ID and access token authentication
flows. The ID token configuration is designed to allow users to
authenticate via Horizon using an identity federation; whereas the
Access token is used to allow users to authenticate in the OpenStack CLI
using a federated user.
Without this PR, if one wants to configure OpenStack to use identity
federation, he/she needs to do a lot of configurations in the keystone,
Horizon, and register quite a good number of different parameters using
the CLI such as mappings, identity providers, federated protocols, and
so on. Therefore, with this PR, we propose a method for operators to
introduce/present the IdP's metadata to Kolla-ansible, and based on the
presented metadata, Kolla-ansible takes care of all of the
configurations to prepare OpenStack to work in a federated environment.
Implements: blueprint add-openid-support
Co-Authored-By: Jason Anderson <jasonanderson@uchicago.edu>
Change-Id: I0203a3470d7f8f2a54d5e126d947f540d93b8210
2019-01-21 12:25:39 +01:00
|
|
|
|
|
|
|
###############################
|
|
|
|
# OpenStack identity federation
|
|
|
|
###############################
|
|
|
|
keystone_federation_openid_crypto_password:
|
2021-02-19 13:39:06 +00:00
|
|
|
|
|
|
|
####################
|
|
|
|
# Ceph RadosGW options
|
|
|
|
####################
|
|
|
|
ceph_rgw_keystone_password:
|
libvirt: support SASL authentication
In Kolla Ansible OpenStack deployments, by default, libvirt is
configured to allow read-write access via an unauthenticated,
unencrypted TCP connection, using the internal API network. This is to
facilitate migration between hosts.
By default, Kolla Ansible does not use encryption for services on the
internal network (and did not support it until Ussuri). However, most
other services on the internal network are at least authenticated
(usually via passwords), ensuring that they cannot be used by anyone
with access to the network, unless they have credentials.
The main issue here is the lack of authentication. Any client with
access to the internal network is able to connect to the libvirt TCP
port and make arbitrary changes to the hypervisor. This could include
starting a VM, modifying an existing VM, etc. Given the flexibility of
the domain options, it could be seen as equivalent to having root access
to the hypervisor.
Kolla Ansible supports libvirt TLS [1] since the Train release, using
client and server certificates for mutual authentication and encryption.
However, this feature is not enabled by default, and requires
certificates to be generated for each compute host.
This change adds support for libvirt SASL authentication, and enables it
by default. This provides base level of security. Deployments requiring
further security should use libvirt TLS.
[1] https://docs.openstack.org/kolla-ansible/latest/reference/compute/libvirt-guide.html#libvirt-tls
Depends-On: https://review.opendev.org/c/openstack/kolla/+/833021
Closes-Bug: #1964013
Change-Id: Ia91ceeb609e4cdb144433122b443028c0278b71e
2022-03-04 17:57:24 +00:00
|
|
|
|
|
|
|
##################
|
|
|
|
# libvirt options
|
|
|
|
##################
|
|
|
|
libvirt_sasl_password:
|
2022-05-31 14:49:11 +02:00
|
|
|
|
|
|
|
############
|
|
|
|
# ProxySQL
|
|
|
|
############
|
|
|
|
proxysql_admin_password:
|
|
|
|
proxysql_stats_password:
|