Update the format of new/deprecated options

Also add new glance options from oslo.messaging that didn't make it in the previous run of the script. Change-Id: I937f3d57a7e995d99b2e13fafc660377f71f5d6b Closes-Bug: 1354550
2014-08-22 17:39:08 +02:00 · 2014-08-22 17:39:08 +02:00 · 6f00520585
commit 6f00520585
parent 185a3808cc
8 changed files with 1031 additions and 878 deletions
--- a/doc/common/tables/ceilometer-conf-changes-icehouse.xml
+++ b/doc/common/tables/ceilometer-conf-changes-icehouse.xml
@ -13,75 +13,75 @@
      </tr>
    </thead>
    <tr>
-      <td>collector_workers = 1</td>
+      <td>[DEFAULT] collector_workers = 1</td>
      <td>(IntOpt) Number of workers for collector service. A single collector is enabled by default.</td>
    </tr>
    <tr>
-      <td>dispatcher = ['database']</td>
+      <td>[DEFAULT] dispatcher = ['database']</td>
      <td>(MultiStrOpt) Dispatcher to process data.</td>
    </tr>
    <tr>
-      <td>heat_control_exchange = heat</td>
+      <td>[DEFAULT] heat_control_exchange = heat</td>
      <td>(StrOpt) Exchange name for Heat notifications</td>
    </tr>
    <tr>
-      <td>kombu_reconnect_delay = 1.0</td>
+      <td>[DEFAULT] kombu_reconnect_delay = 1.0</td>
      <td>(FloatOpt) How long to wait before reconnecting in response to an AMQP consumer cancel notification.</td>
    </tr>
    <tr>
-      <td>log_config_append = None</td>
+      <td>[DEFAULT] log_config_append = None</td>
      <td>(StrOpt) The name of logging configuration file. It does not disable existing loggers, but just appends specified logging configuration to any other existing logging options. Please see the Python logging module documentation for details on logging configuration files.</td>
    </tr>
    <tr>
-      <td>max_request_body_size = 114688</td>
+      <td>[DEFAULT] max_request_body_size = 114688</td>
      <td>(IntOpt) The maximum body size per request, in bytes</td>
    </tr>
    <tr>
-      <td>notification_workers = 1</td>
+      <td>[DEFAULT] notification_workers = 1</td>
      <td>(IntOpt) Number of workers for notification service. A single notification agent is enabled by default.</td>
    </tr>
    <tr>
-      <td>use_syslog_rfc_format = False</td>
+      <td>[DEFAULT] use_syslog_rfc_format = False</td>
      <td>(BoolOpt) (Optional) Use syslog rfc5424 format for logging. If enabled, will add APP-NAME (RFC5424) before the MSG part of the syslog message.  The old format without APP-NAME is deprecated in I, and will be removed in J.</td>
    </tr>
    <tr>
-      <td>event/definitions_cfg_file = event_definitions.yaml</td>
+      <td>[event] definitions_cfg_file = event_definitions.yaml</td>
      <td>(StrOpt) Configuration file for event definitions.</td>
    </tr>
    <tr>
-      <td>event/drop_unmatched_notifications = False</td>
+      <td>[event] drop_unmatched_notifications = False</td>
      <td>(BoolOpt) Drop notifications if no event definition matches. (Otherwise, we convert them with just the default traits)</td>
    </tr>
    <tr>
-      <td>notification/ack_on_event_error = True</td>
+      <td>[notification] ack_on_event_error = True</td>
      <td>(BoolOpt) Acknowledge message when event persistence fails.</td>
    </tr>
    <tr>
-      <td>notification/store_events = False</td>
+      <td>[notification] store_events = False</td>
      <td>(BoolOpt) Save event details.</td>
    </tr>
    <tr>
-      <td>publisher/metering_secret = change this or be hacked</td>
+      <td>[publisher] metering_secret = change this or be hacked</td>
      <td>(StrOpt) Secret value for signing metering messages.</td>
    </tr>
    <tr>
-      <td>vmware/api_retry_count = 10</td>
+      <td>[vmware] api_retry_count = 10</td>
      <td>(IntOpt) Number of times a VMware Vsphere API must be retried</td>
    </tr>
    <tr>
-      <td>vmware/host_ip = </td>
+      <td>[vmware] host_ip = </td>
      <td>(StrOpt) IP address of the VMware Vsphere host</td>
    </tr>
    <tr>
-      <td>vmware/host_password = </td>
+      <td>[vmware] host_password = </td>
      <td>(StrOpt) Password of VMware Vsphere</td>
    </tr>
    <tr>
-      <td>vmware/host_username = </td>
+      <td>[vmware] host_username = </td>
      <td>(StrOpt) Username of VMware Vsphere</td>
    </tr>
    <tr>
-      <td>vmware/task_poll_interval = 0.5</td>
+      <td>[vmware] task_poll_interval = 0.5</td>
      <td>(FloatOpt) Sleep time in seconds for polling an ongoing async task</td>
    </tr>
  </table>
@ -98,25 +98,20 @@
      </tr>
    </thead>
    <tr>
-      <td>allowed_rpc_exception_modules</td>
+      <td>[DEFAULT] allowed_rpc_exception_modules</td>
      <td>ceilometer.openstack.common.exception, nova.exception, cinder.exception, exceptions</td>
      <td>nova.exception, cinder.exception, exceptions</td>
    </tr>
    <tr>
-      <td>default_log_levels</td>
+      <td>[DEFAULT] default_log_levels</td>
      <td>amqplib=WARN, sqlalchemy=WARN, boto=WARN, suds=INFO, keystone=INFO, eventlet.wsgi.server=WARN</td>
      <td>amqp=WARN, amqplib=WARN, boto=WARN, qpid=WARN, sqlalchemy=WARN, suds=INFO, iso8601=WARN, requests.packages.urllib3.connectionpool=WARN</td>
    </tr>
    <tr>
-      <td>logging_context_format_string</td>
+      <td>[DEFAULT] logging_context_format_string</td>
      <td>%(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user)s %(tenant)s] %(instance)s%(message)s</td>
      <td>%(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user_identity)s] %(instance)s%(message)s</td>
    </tr>
    <tr>
      <td>cells/cell_type</td>
      <td>None</td>
      <td>compute</td>
    </tr>
  </table>
  <table>
    <caption>Deprecated options</caption>
@ -129,12 +124,12 @@
      </tr>
    </thead>
    <tr>
-      <td>log_config</td>
+      <td>[DEFAULT] log_config</td>
-      <td>log_config_append</td>
+      <td>[DEFAULT] log_config_append</td>
    </tr>
    <tr>
-      <td>publisher_rpc/metering_secret</td>
+      <td>[publisher_rpc] metering_secret</td>
-      <td>publisher/metering_secret</td>
+      <td>[publisher] metering_secret</td>
    </tr>
  </table>
 </section>
--- a/doc/common/tables/cinder-conf-changes-icehouse.xml
+++ b/doc/common/tables/cinder-conf-changes-icehouse.xml
@ -13,279 +13,279 @@
      </tr>
    </thead>
    <tr>
-      <td>allocated_capacity_weight_multiplier = -1.0</td>
+      <td>[DEFAULT] allocated_capacity_weight_multiplier = -1.0</td>
      <td>(FloatOpt) Multiplier used for weighing volume capacity. Negative numbers mean to stack vs spread.</td>
    </tr>
    <tr>
-      <td>backup_metadata_version = 1</td>
+      <td>[DEFAULT] backup_metadata_version = 1</td>
      <td>(IntOpt) Backup metadata version to be used when backing up volume metadata. If this number is bumped, make sure the service doing the restore supports the new version.</td>
    </tr>
    <tr>
-      <td>cinder_emc_config_file = /etc/cinder/cinder_emc_config.xml</td>
+      <td>[DEFAULT] cinder_emc_config_file = /etc/cinder/cinder_emc_config.xml</td>
      <td>(StrOpt) use this file for cinder emc plugin config data</td>
    </tr>
    <tr>
-      <td>default_timeout = 20</td>
+      <td>[DEFAULT] default_timeout = 20</td>
      <td>(IntOpt) Default Time Out For CLI operations in minutes</td>
    </tr>
    <tr>
-      <td>extra_capabilities = {}</td>
+      <td>[DEFAULT] extra_capabilities = {}</td>
      <td>(StrOpt) User defined capabilities, a JSON formatted string specifying key/value pairs.</td>
    </tr>
    <tr>
-      <td>gpfs_storage_pool = None</td>
+      <td>[DEFAULT] gpfs_storage_pool = None</td>
      <td>(StrOpt) Specifies the storage pool that volumes are assigned to.  By default, the system storage pool is used.</td>
    </tr>
    <tr>
-      <td>hplefthand_api_url = None</td>
+      <td>[DEFAULT] hplefthand_api_url = None</td>
      <td>(StrOpt) HP LeftHand WSAPI Server Url like https://&lt;LeftHand ip&gt;:8081/lhos</td>
    </tr>
    <tr>
-      <td>hplefthand_clustername = None</td>
+      <td>[DEFAULT] hplefthand_clustername = None</td>
      <td>(StrOpt) HP LeftHand cluster name</td>
    </tr>
    <tr>
-      <td>hplefthand_debug = False</td>
+      <td>[DEFAULT] hplefthand_debug = False</td>
      <td>(BoolOpt) Enable HTTP debugging to LeftHand</td>
    </tr>
    <tr>
-      <td>hplefthand_iscsi_chap_enabled = False</td>
+      <td>[DEFAULT] hplefthand_iscsi_chap_enabled = False</td>
      <td>(BoolOpt) Configure CHAP authentication for iSCSI connections (Default: Disabled)</td>
    </tr>
    <tr>
-      <td>hplefthand_password = None</td>
+      <td>[DEFAULT] hplefthand_password = None</td>
      <td>(StrOpt) HP LeftHand Super user password</td>
    </tr>
    <tr>
-      <td>hplefthand_username = None</td>
+      <td>[DEFAULT] hplefthand_username = None</td>
      <td>(StrOpt) HP LeftHand Super user username</td>
    </tr>
    <tr>
-      <td>kombu_reconnect_delay = 1.0</td>
+      <td>[DEFAULT] kombu_reconnect_delay = 1.0</td>
      <td>(FloatOpt) How long to wait before reconnecting in response to an AMQP consumer cancel notification.</td>
    </tr>
    <tr>
-      <td>log_config_append = None</td>
+      <td>[DEFAULT] log_config_append = None</td>
      <td>(StrOpt) The name of logging configuration file. It does not disable existing loggers, but just appends specified logging configuration to any other existing logging options. Please see the Python logging module documentation for details on logging configuration files.</td>
    </tr>
    <tr>
-      <td>max_header_line = 16384</td>
+      <td>[DEFAULT] max_header_line = 16384</td>
      <td>(IntOpt) Maximum line size of message headers to be accepted. max_header_line may need to be increased when using large tokens (typically those generated by the Keystone v3 API with big service catalogs).</td>
    </tr>
    <tr>
-      <td>max_luns_per_storage_group = 256</td>
+      <td>[DEFAULT] max_luns_per_storage_group = 256</td>
      <td>(IntOpt) Default max number of LUNs in a storage group</td>
    </tr>
    <tr>
-      <td>msa_vdisk = OpenStack</td>
+      <td>[DEFAULT] msa_vdisk = OpenStack</td>
      <td>(StrOpt) The VDisk to use for volume creation.</td>
    </tr>
    <tr>
-      <td>nas_ip = </td>
+      <td>[DEFAULT] nas_ip = </td>
      <td>(StrOpt) IP address or Hostname of NAS system.</td>
    </tr>
    <tr>
-      <td>nas_login = admin</td>
+      <td>[DEFAULT] nas_login = admin</td>
      <td>(StrOpt) User name to connect to NAS system.</td>
    </tr>
    <tr>
-      <td>nas_password = </td>
+      <td>[DEFAULT] nas_password = </td>
      <td>(StrOpt) Password to connect to NAS system.</td>
    </tr>
    <tr>
-      <td>nas_private_key = </td>
+      <td>[DEFAULT] nas_private_key = </td>
      <td>(StrOpt) Filename of private key to use for SSH authentication.</td>
    </tr>
    <tr>
-      <td>nas_ssh_port = 22</td>
+      <td>[DEFAULT] nas_ssh_port = 22</td>
      <td>(IntOpt) SSH port to use to connect to NAS system.</td>
    </tr>
    <tr>
-      <td>naviseccli_path = </td>
+      <td>[DEFAULT] naviseccli_path = </td>
      <td>(StrOpt) Naviseccli Path</td>
    </tr>
    <tr>
-      <td>netapp_controller_ips = None</td>
+      <td>[DEFAULT] netapp_controller_ips = None</td>
      <td>(StrOpt) This option is only utilized when the storage family is configured to eseries. This option is used to restrict provisioning to the specified controllers. Specify the value of this option to be a comma separated list of controller hostnames or IP addresses to be used for provisioning.</td>
    </tr>
    <tr>
-      <td>netapp_copyoffload_tool_path = None</td>
+      <td>[DEFAULT] netapp_copyoffload_tool_path = None</td>
      <td>(StrOpt) This option specifies the path of the NetApp copy offload tool binary. Ensure that the binary has execute permissions set which allow the effective user of the cinder-volume process to execute the file.</td>
    </tr>
    <tr>
-      <td>netapp_sa_password = None</td>
+      <td>[DEFAULT] netapp_sa_password = None</td>
      <td>(StrOpt) Password for the NetApp E-Series storage array.</td>
    </tr>
    <tr>
-      <td>netapp_storage_pools = None</td>
+      <td>[DEFAULT] netapp_storage_pools = None</td>
      <td>(StrOpt) This option is used to restrict provisioning to the specified storage pools. Only dynamic disk pools are currently supported. Specify the value of this option to be a comma separated list of disk pool names to be used for provisioning.</td>
    </tr>
    <tr>
-      <td>netapp_webservice_path = /devmgr/v2</td>
+      <td>[DEFAULT] netapp_webservice_path = /devmgr/v2</td>
      <td>(StrOpt) This option is used to specify the path to the E-Series proxy application on a proxy server. The value is combined with the value of the netapp_transport_type, netapp_server_hostname, and netapp_server_port options to create the URL used by the driver to connect to the proxy application.</td>
    </tr>
    <tr>
-      <td>nexenta_nms_cache_volroot = True</td>
+      <td>[DEFAULT] nexenta_nms_cache_volroot = True</td>
      <td>(BoolOpt) If set True cache NexentaStor appliance volroot option value.</td>
    </tr>
    <tr>
-      <td>nexenta_rrmgr_compression = 0</td>
+      <td>[DEFAULT] nexenta_rrmgr_compression = 0</td>
      <td>(IntOpt) Enable stream compression, level 1..9. 1 - gives best speed; 9 - gives best compression.</td>
    </tr>
    <tr>
-      <td>nexenta_rrmgr_connections = 2</td>
+      <td>[DEFAULT] nexenta_rrmgr_connections = 2</td>
      <td>(IntOpt) Number of TCP connections.</td>
    </tr>
    <tr>
-      <td>nexenta_rrmgr_tcp_buf_size = 4096</td>
+      <td>[DEFAULT] nexenta_rrmgr_tcp_buf_size = 4096</td>
      <td>(IntOpt) TCP Buffer size in KiloBytes.</td>
    </tr>
    <tr>
-      <td>osapi_volume_workers = None</td>
+      <td>[DEFAULT] osapi_volume_workers = None</td>
      <td>(IntOpt) Number of workers for OpenStack Volume API service</td>
    </tr>
    <tr>
-      <td>password = None</td>
+      <td>[DEFAULT] password = None</td>
      <td>(StrOpt) Password for Redis server (optional).</td>
    </tr>
    <tr>
-      <td>port = 6379</td>
+      <td>[DEFAULT] port = 6379</td>
      <td>(IntOpt) Use this port to connect to redis host.</td>
    </tr>
    <tr>
-      <td>rabbit_login_method = AMQPLAIN</td>
+      <td>[DEFAULT] rabbit_login_method = AMQPLAIN</td>
      <td>(StrOpt) the RabbitMQ login method</td>
    </tr>
    <tr>
-      <td>storage_vnx_pool_name = None</td>
+      <td>[DEFAULT] storage_vnx_pool_name = None</td>
      <td>(StrOpt) ISCSI pool name</td>
    </tr>
    <tr>
-      <td>transport_url = None</td>
+      <td>[DEFAULT] transport_url = None</td>
      <td>(StrOpt) A URL representing the messaging driver to use and its full configuration. If not set, we fall back to the rpc_backend option and driver specific configuration.</td>
    </tr>
    <tr>
-      <td>use_syslog_rfc_format = False</td>
+      <td>[DEFAULT] use_syslog_rfc_format = False</td>
      <td>(BoolOpt) (Optional) Use syslog rfc5424 format for logging. If enabled, will add APP-NAME (RFC5424) before the MSG part of the syslog message.  The old format without APP-NAME is deprecated in I, and will be removed in J.</td>
    </tr>
    <tr>
-      <td>vmware_api_retry_count = 10</td>
+      <td>[DEFAULT] vmware_api_retry_count = 10</td>
      <td>(IntOpt) Number of times VMware ESX/VC server API must be retried upon connection related issues.</td>
    </tr>
    <tr>
-      <td>vmware_host_ip = None</td>
+      <td>[DEFAULT] vmware_host_ip = None</td>
      <td>(StrOpt) IP address for connecting to VMware ESX/VC server.</td>
    </tr>
    <tr>
-      <td>vmware_host_password = None</td>
+      <td>[DEFAULT] vmware_host_password = None</td>
      <td>(StrOpt) Password for authenticating with VMware ESX/VC server.</td>
    </tr>
    <tr>
-      <td>vmware_host_username = None</td>
+      <td>[DEFAULT] vmware_host_username = None</td>
      <td>(StrOpt) Username for authenticating with VMware ESX/VC server.</td>
    </tr>
    <tr>
-      <td>vmware_host_version = None</td>
+      <td>[DEFAULT] vmware_host_version = None</td>
      <td>(StrOpt) Optional string specifying the VMware VC server version. The driver attempts to retrieve the version from VMware VC server. Set this configuration only if you want to override the VC server version.</td>
    </tr>
    <tr>
-      <td>vmware_image_transfer_timeout_secs = 7200</td>
+      <td>[DEFAULT] vmware_image_transfer_timeout_secs = 7200</td>
      <td>(IntOpt) Timeout in seconds for VMDK volume transfer between Cinder and Glance.</td>
    </tr>
    <tr>
-      <td>vmware_max_objects_retrieval = 100</td>
+      <td>[DEFAULT] vmware_max_objects_retrieval = 100</td>
      <td>(IntOpt) Max number of objects to be retrieved per batch. Query results will be obtained in batches from the server and not in one shot. Server may still limit the count to something less than the configured value.</td>
    </tr>
    <tr>
-      <td>vmware_task_poll_interval = 5</td>
+      <td>[DEFAULT] vmware_task_poll_interval = 5</td>
      <td>(IntOpt) The interval (in seconds) for polling remote tasks invoked on VMware ESX/VC server.</td>
    </tr>
    <tr>
-      <td>vmware_volume_folder = cinder-volumes</td>
+      <td>[DEFAULT] vmware_volume_folder = cinder-volumes</td>
      <td>(StrOpt) Name for the folder in the VC datacenter that will contain cinder volumes.</td>
    </tr>
    <tr>
-      <td>vmware_wsdl_location = None</td>
+      <td>[DEFAULT] vmware_wsdl_location = None</td>
      <td>(StrOpt) Optional VIM service WSDL Location e.g http://&lt;server&gt;/vimService.wsdl. Optional over-ride to default location for bug work-arounds.</td>
    </tr>
    <tr>
-      <td>volume_clear_ionice = None</td>
+      <td>[DEFAULT] volume_clear_ionice = None</td>
      <td>(StrOpt) The flag to pass to ionice to alter the i/o priority of the process used to zero a volume after deletion, for example "-c3" for idle only priority.</td>
    </tr>
    <tr>
-      <td>xiv_chap = disabled</td>
+      <td>[DEFAULT] xiv_chap = disabled</td>
      <td>(StrOpt) CHAP authentication mode, effective only for iscsi (disabled|enabled)</td>
    </tr>
    <tr>
-      <td>zoning_mode = none</td>
+      <td>[DEFAULT] zoning_mode = none</td>
      <td>(StrOpt) FC Zoning mode configured</td>
    </tr>
    <tr>
-      <td>BRCD_FABRIC_EXAMPLE/fc_fabric_address = </td>
+      <td>[BRCD_FABRIC_EXAMPLE] fc_fabric_address = </td>
      <td>(StrOpt) Management IP of fabric</td>
    </tr>
    <tr>
-      <td>BRCD_FABRIC_EXAMPLE/fc_fabric_password = </td>
+      <td>[BRCD_FABRIC_EXAMPLE] fc_fabric_password = </td>
      <td>(StrOpt) Password for user</td>
    </tr>
    <tr>
-      <td>BRCD_FABRIC_EXAMPLE/fc_fabric_port = 22</td>
+      <td>[BRCD_FABRIC_EXAMPLE] fc_fabric_port = 22</td>
      <td>(IntOpt) Connecting port</td>
    </tr>
    <tr>
-      <td>BRCD_FABRIC_EXAMPLE/fc_fabric_user = </td>
+      <td>[BRCD_FABRIC_EXAMPLE] fc_fabric_user = </td>
      <td>(StrOpt) Fabric user ID</td>
    </tr>
    <tr>
-      <td>BRCD_FABRIC_EXAMPLE/principal_switch_wwn = None</td>
+      <td>[BRCD_FABRIC_EXAMPLE] principal_switch_wwn = None</td>
      <td>(StrOpt) Principal switch WWN of the fabric</td>
    </tr>
    <tr>
-      <td>BRCD_FABRIC_EXAMPLE/zone_activate = True</td>
+      <td>[BRCD_FABRIC_EXAMPLE] zone_activate = True</td>
      <td>(BoolOpt) overridden zoning activation state</td>
    </tr>
    <tr>
-      <td>BRCD_FABRIC_EXAMPLE/zone_name_prefix = None</td>
+      <td>[BRCD_FABRIC_EXAMPLE] zone_name_prefix = None</td>
      <td>(StrOpt) overridden zone name prefix</td>
    </tr>
    <tr>
-      <td>BRCD_FABRIC_EXAMPLE/zoning_policy = initiator-target</td>
+      <td>[BRCD_FABRIC_EXAMPLE] zoning_policy = initiator-target</td>
      <td>(StrOpt) overridden zoning policy</td>
    </tr>
    <tr>
-      <td>fc-zone-manager/brcd_sb_connector = cinder.zonemanager.drivers.brocade.brcd_fc_zone_client_cli.BrcdFCZoneClientCLI</td>
+      <td>[fc-zone-manager] brcd_sb_connector = cinder.zonemanager.drivers.brocade.brcd_fc_zone_client_cli.BrcdFCZoneClientCLI</td>
      <td>(StrOpt) Southbound connector for zoning operation</td>
    </tr>
    <tr>
-      <td>fc-zone-manager/fc_fabric_names = None</td>
+      <td>[fc-zone-manager] fc_fabric_names = None</td>
      <td>(StrOpt) Comma separated list of fibre channel fabric names. This list of names is used to retrieve other SAN credentials for connecting to each SAN fabric</td>
    </tr>
    <tr>
-      <td>fc-zone-manager/fc_san_lookup_service = cinder.zonemanager.drivers.brocade.brcd_fc_san_lookup_service.BrcdFCSanLookupService</td>
+      <td>[fc-zone-manager] fc_san_lookup_service = cinder.zonemanager.drivers.brocade.brcd_fc_san_lookup_service.BrcdFCSanLookupService</td>
      <td>(StrOpt) FC San Lookup Service</td>
    </tr>
    <tr>
-      <td>fc-zone-manager/zone_driver = cinder.zonemanager.drivers.brocade.brcd_fc_zone_driver.BrcdFCZoneDriver</td>
+      <td>[fc-zone-manager] zone_driver = cinder.zonemanager.drivers.brocade.brcd_fc_zone_driver.BrcdFCZoneDriver</td>
      <td>(StrOpt) FC Zone Driver responsible for zone management</td>
    </tr>
    <tr>
-      <td>fc-zone-manager/zoning_policy = initiator-target</td>
+      <td>[fc-zone-manager] zoning_policy = initiator-target</td>
      <td>(StrOpt) Zoning policy configured by user</td>
    </tr>
    <tr>
-      <td>matchmaker_ring/ringfile = /etc/oslo/matchmaker_ring.json</td>
+      <td>[matchmaker_ring] ringfile = /etc/oslo/matchmaker_ring.json</td>
      <td>(StrOpt) Matchmaker ring file (JSON).</td>
    </tr>
    <tr>
-      <td>ssl/ca_file = None</td>
+      <td>[ssl] ca_file = None</td>
      <td>(StrOpt) CA certificate file to use to verify connecting clients</td>
    </tr>
    <tr>
-      <td>ssl/cert_file = None</td>
+      <td>[ssl] cert_file = None</td>
      <td>(StrOpt) Certificate file to use when starting the server securely</td>
    </tr>
    <tr>
-      <td>ssl/key_file = None</td>
+      <td>[ssl] key_file = None</td>
      <td>(StrOpt) Private key file to use when starting the server securely</td>
    </tr>
  </table>
@ -302,27 +302,27 @@
      </tr>
    </thead>
    <tr>
-      <td>default_log_levels</td>
+      <td>[DEFAULT] default_log_levels</td>
      <td>amqplib=WARN, sqlalchemy=WARN, boto=WARN, suds=INFO, keystone=INFO, eventlet.wsgi.server=WARN</td>
      <td>amqp=WARN, amqplib=WARN, boto=WARN, qpid=WARN, sqlalchemy=WARN, suds=INFO, oslo.messaging=INFO, iso8601=WARN, requests.packages.urllib3.connectionpool=WARN</td>
    </tr>
    <tr>
-      <td>logging_context_format_string</td>
+      <td>[DEFAULT] logging_context_format_string</td>
      <td>%(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user)s %(tenant)s] %(instance)s%(message)s</td>
      <td>%(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user_identity)s] %(instance)s%(message)s</td>
    </tr>
    <tr>
-      <td>rpc_zmq_matchmaker</td>
+      <td>[DEFAULT] rpc_zmq_matchmaker</td>
      <td>cinder.openstack.common.rpc.matchmaker.MatchMakerLocalhost</td>
      <td>oslo.messaging._drivers.matchmaker.MatchMakerLocalhost</td>
    </tr>
    <tr>
-      <td>sf_account_prefix</td>
+      <td>[DEFAULT] sf_account_prefix</td>
-      <td>ol.local.net</td>
+      <td>shock</td>
      <td>None</td>
    </tr>
    <tr>
-      <td>state_path</td>
+      <td>[DEFAULT] state_path</td>
      <td>$pybasedir</td>
      <td>/var/lib/cinder</td>
    </tr>
@ -338,24 +338,24 @@
      </tr>
    </thead>
    <tr>
-      <td>pybasedir</td>
+      <td>[DEFAULT] pybasedir</td>
-      <td>state_path</td>
+      <td>[DEFAULT] state_path</td>
    </tr>
    <tr>
-      <td>matchmaker_ringfile</td>
+      <td>[DEFAULT] matchmaker_ringfile</td>
-      <td>matchmaker_ring/ringfile</td>
+      <td>[matchmaker_ring] ringfile</td>
    </tr>
    <tr>
-      <td>log_config</td>
+      <td>[DEFAULT] log_config</td>
-      <td>log_config_append</td>
+      <td>[DEFAULT] log_config_append</td>
    </tr>
    <tr>
-      <td>rpc_notifier2/topics</td>
+      <td>[rpc_notifier2] topics</td>
-      <td>notification_topics</td>
+      <td>[DEFAULT] notification_topics</td>
    </tr>
    <tr>
-      <td>db_backend</td>
+      <td>[DEFAULT] db_backend</td>
-      <td>database/backend</td>
+      <td>[database] backend</td>
    </tr>
  </table>
 </section>
--- a/doc/common/tables/glance-conf-changes-icehouse.xml
+++ b/doc/common/tables/glance-conf-changes-icehouse.xml
@ -13,183 +13,323 @@
      </tr>
    </thead>
    <tr>
-      <td>enable_v1_registry = True</td>
+      <td>[DEFAULT] amqp_auto_delete = False</td>
      <td>(BoolOpt) Auto-delete queues in amqp.</td>
    </tr>
    <tr>
      <td>[DEFAULT] amqp_durable_queues = False</td>
      <td>(BoolOpt) Use durable queues in amqp.</td>
    </tr>
    <tr>
      <td>[DEFAULT] control_exchange = openstack</td>
      <td>(StrOpt) The default exchange under which topics are scoped. May be overridden by an exchange name specified in the transport_url option.</td>
    </tr>
    <tr>
      <td>[DEFAULT] enable_v1_registry = True</td>
      <td>(BoolOpt) Deploy the v1 OpenStack Registry API.</td>
    </tr>
    <tr>
-      <td>enable_v2_registry = True</td>
+      <td>[DEFAULT] enable_v2_registry = True</td>
      <td>(BoolOpt) Deploy the v2 OpenStack Registry API.</td>
    </tr>
    <tr>
-      <td>filesystem_store_datadirs = None</td>
+      <td>[DEFAULT] fake_rabbit = False</td>
      <td>(BoolOpt) If passed, use a fake RabbitMQ provider.</td>
    </tr>
    <tr>
      <td>[DEFAULT] filesystem_store_datadirs = None</td>
      <td>(MultiStrOpt) List of directories and its priorities to which the Filesystem backend store writes images.</td>
    </tr>
    <tr>
-      <td>image_location_quota = 10</td>
+      <td>[DEFAULT] host = 127.0.0.1</td>
      <td>(StrOpt) Host to locate redis.</td>
    </tr>
    <tr>
      <td>[DEFAULT] image_location_quota = 10</td>
      <td>(IntOpt) Maximum number of locations allowed on an image. Negative values evaluate to unlimited.</td>
    </tr>
    <tr>
-      <td>image_member_quota = 128</td>
+      <td>[DEFAULT] image_member_quota = 128</td>
      <td>(IntOpt) Maximum number of image members per image. Negative values evaluate to unlimited.</td>
    </tr>
    <tr>
-      <td>image_property_quota = 128</td>
+      <td>[DEFAULT] image_property_quota = 128</td>
      <td>(IntOpt) Maximum number of properties allowed on an image. Negative values evaluate to unlimited.</td>
    </tr>
    <tr>
-      <td>image_tag_quota = 128</td>
+      <td>[DEFAULT] image_tag_quota = 128</td>
      <td>(IntOpt) Maximum number of tags allowed on an image. Negative values evaluate to unlimited.</td>
    </tr>
    <tr>
-      <td>location_strategy = location_order</td>
+      <td>[DEFAULT] kombu_reconnect_delay = 1.0</td>
      <td>(FloatOpt) How long to wait before reconnecting in response to an AMQP consumer cancel notification.</td>
    </tr>
    <tr>
      <td>[DEFAULT] kombu_ssl_ca_certs = </td>
      <td>(StrOpt) SSL certification authority file (valid only if SSL enabled).</td>
    </tr>
    <tr>
      <td>[DEFAULT] kombu_ssl_certfile = </td>
      <td>(StrOpt) SSL cert file (valid only if SSL enabled).</td>
    </tr>
    <tr>
      <td>[DEFAULT] kombu_ssl_keyfile = </td>
      <td>(StrOpt) SSL key file (valid only if SSL enabled).</td>
    </tr>
    <tr>
      <td>[DEFAULT] kombu_ssl_version = </td>
      <td>(StrOpt) SSL version to use (valid only if SSL enabled). valid values are TLSv1, SSLv23 and SSLv3. SSLv2 may be available on some distributions.</td>
    </tr>
    <tr>
      <td>[DEFAULT] location_strategy = location_order</td>
      <td>(StrOpt) This value sets what strategy will be used to determine the image location order. Currently two strategies are packaged with Glance 'location_order' and 'store_type'.</td>
    </tr>
    <tr>
-      <td>log_config_append = None</td>
+      <td>[DEFAULT] log_config_append = None</td>
      <td>(StrOpt) The name of logging configuration file. It does not disable existing loggers, but just appends specified logging configuration to any other existing logging options. Please see the Python logging module documentation for details on logging configuration files.</td>
    </tr>
    <tr>
-      <td>max_header_line = 16384</td>
+      <td>[DEFAULT] matchmaker_heartbeat_freq = 300</td>
      <td>(IntOpt) Heartbeat frequency.</td>
    </tr>
    <tr>
      <td>[DEFAULT] matchmaker_heartbeat_ttl = 600</td>
      <td>(IntOpt) Heartbeat time-to-live.</td>
    </tr>
    <tr>
      <td>[DEFAULT] max_header_line = 16384</td>
      <td>(IntOpt) Maximum line size of message headers to be accepted. max_header_line may need to be increased when using large tokens (typically those generated by the Keystone v3 API with big service catalogs</td>
    </tr>
    <tr>
-      <td>property_protection_rule_format = roles</td>
+      <td>[DEFAULT] notification_topics = ['notifications']</td>
      <td>(ListOpt) AMQP topic used for OpenStack notifications.</td>
    </tr>
    <tr>
      <td>[DEFAULT] password = None</td>
      <td>(StrOpt) Password for Redis server (optional).</td>
    </tr>
    <tr>
      <td>[DEFAULT] port = 6379</td>
      <td>(IntOpt) Use this port to connect to redis host.</td>
    </tr>
    <tr>
      <td>[DEFAULT] property_protection_rule_format = roles</td>
      <td>(StrOpt) This config value indicates whether "roles" or "policies" are used in the property protection file.</td>
    </tr>
    <tr>
-      <td>swift_store_retry_get_count = 0</td>
+      <td>[DEFAULT] qpid_hosts = ['$qpid_hostname:$qpid_port']</td>
      <td>(ListOpt) Qpid HA cluster host:port pairs.</td>
    </tr>
    <tr>
      <td>[DEFAULT] qpid_topology_version = 1</td>
      <td>(IntOpt) The qpid topology version to use.  Version 1 is what was originally used by impl_qpid.  Version 2 includes some backwards-incompatible changes that allow broker federation to work.  Users should update to version 2 when they are able to take everything down, as it requires a clean break.</td>
    </tr>
    <tr>
      <td>[DEFAULT] rabbit_ha_queues = False</td>
      <td>(BoolOpt) Use HA queues in RabbitMQ (x-ha-policy: all). If you change this option, you must wipe the RabbitMQ database.</td>
    </tr>
    <tr>
      <td>[DEFAULT] rabbit_hosts = ['$rabbit_host:$rabbit_port']</td>
      <td>(ListOpt) RabbitMQ HA cluster host:port pairs.</td>
    </tr>
    <tr>
      <td>[DEFAULT] rabbit_login_method = AMQPLAIN</td>
      <td>(StrOpt) the RabbitMQ login method</td>
    </tr>
    <tr>
      <td>[DEFAULT] rabbit_retry_interval = 1</td>
      <td>(IntOpt) How frequently to retry connecting with RabbitMQ.</td>
    </tr>
    <tr>
      <td>[DEFAULT] rpc_backend = rabbit</td>
      <td>(StrOpt) The messaging driver to use, defaults to rabbit. Other drivers include qpid and zmq.</td>
    </tr>
    <tr>
      <td>[DEFAULT] rpc_cast_timeout = 30</td>
      <td>(IntOpt) Seconds to wait before a cast expires (TTL). Only supported by impl_zmq.</td>
    </tr>
    <tr>
      <td>[DEFAULT] rpc_conn_pool_size = 30</td>
      <td>(IntOpt) Size of RPC connection pool.</td>
    </tr>
    <tr>
      <td>[DEFAULT] rpc_response_timeout = 60</td>
      <td>(IntOpt) Seconds to wait for a response from a call.</td>
    </tr>
    <tr>
      <td>[DEFAULT] rpc_thread_pool_size = 64</td>
      <td>(IntOpt) Size of RPC greenthread pool.</td>
    </tr>
    <tr>
      <td>[DEFAULT] rpc_zmq_bind_address = *</td>
      <td>(StrOpt) ZeroMQ bind address. Should be a wildcard (*), an ethernet interface, or IP. The "host" option should point or resolve to this address.</td>
    </tr>
    <tr>
      <td>[DEFAULT] rpc_zmq_contexts = 1</td>
      <td>(IntOpt) Number of ZeroMQ contexts, defaults to 1.</td>
    </tr>
    <tr>
      <td>[DEFAULT] rpc_zmq_host = shock</td>
      <td>(StrOpt) Name of this node. Must be a valid hostname, FQDN, or IP address. Must match "host" option, if running Nova.</td>
    </tr>
    <tr>
      <td>[DEFAULT] rpc_zmq_ipc_dir = /var/run/openstack</td>
      <td>(StrOpt) Directory for holding IPC sockets.</td>
    </tr>
    <tr>
      <td>[DEFAULT] rpc_zmq_matchmaker = oslo.messaging._drivers.matchmaker.MatchMakerLocalhost</td>
      <td>(StrOpt) MatchMaker driver.</td>
    </tr>
    <tr>
      <td>[DEFAULT] rpc_zmq_port = 9501</td>
      <td>(IntOpt) ZeroMQ receiver listening port.</td>
    </tr>
    <tr>
      <td>[DEFAULT] rpc_zmq_topic_backlog = None</td>
      <td>(IntOpt) Maximum number of ingress messages to locally buffer per topic. Default is unlimited.</td>
    </tr>
    <tr>
      <td>[DEFAULT] swift_store_retry_get_count = 0</td>
      <td>(IntOpt) The number of times a Swift download will be retried before the request fails.</td>
    </tr>
    <tr>
-      <td>use_syslog_rfc_format = False</td>
+      <td>[DEFAULT] transport_url = None</td>
      <td>(StrOpt) A URL representing the messaging driver to use and its full configuration. If not set, we fall back to the rpc_backend option and driver specific configuration.</td>
    </tr>
    <tr>
      <td>[DEFAULT] use_syslog_rfc_format = False</td>
      <td>(BoolOpt) (Optional) Use syslog rfc5424 format for logging. If enabled, will add APP-NAME (RFC5424) before the MSG part of the syslog message.  The old format without APP-NAME is deprecated in I, and will be removed in J.</td>
    </tr>
    <tr>
-      <td>vmware_api_insecure = False</td>
+      <td>[DEFAULT] vmware_api_insecure = False</td>
      <td>(BoolOpt) Allow to perform insecure SSL requests to ESX/VC.</td>
    </tr>
    <tr>
-      <td>vmware_api_retry_count = 10</td>
+      <td>[DEFAULT] vmware_api_retry_count = 10</td>
      <td>(IntOpt) Number of times VMware ESX/VC server API must be retried upon connection related issues.</td>
    </tr>
    <tr>
-      <td>vmware_datacenter_path = ha-datacenter</td>
+      <td>[DEFAULT] vmware_datacenter_path = ha-datacenter</td>
      <td>(StrOpt) Inventory path to a datacenter. If the vmware_server_host specified is an ESX/ESXi, the vmware_datacenter_path is optional. If specified, it should be "ha-datacenter".</td>
    </tr>
    <tr>
-      <td>vmware_datastore_name = None</td>
+      <td>[DEFAULT] vmware_datastore_name = None</td>
      <td>(StrOpt) Datastore associated with the datacenter.</td>
    </tr>
    <tr>
-      <td>vmware_server_host = None</td>
+      <td>[DEFAULT] vmware_server_host = None</td>
      <td>(StrOpt) ESX/ESXi or vCenter Server target system. The server value can be an IP address or a DNS name.</td>
    </tr>
    <tr>
-      <td>vmware_server_password = None</td>
+      <td>[DEFAULT] vmware_server_password = None</td>
      <td>(StrOpt) Password for authenticating with VMware ESX/VC server.</td>
    </tr>
    <tr>
-      <td>vmware_server_username = None</td>
+      <td>[DEFAULT] vmware_server_username = None</td>
      <td>(StrOpt) Username for authenticating with VMware ESX/VC server.</td>
    </tr>
    <tr>
-      <td>vmware_store_image_dir = /openstack_glance</td>
+      <td>[DEFAULT] vmware_store_image_dir = /openstack_glance</td>
      <td>(StrOpt) The name of the directory where the glance images will be stored in the VMware datastore.</td>
    </tr>
    <tr>
-      <td>vmware_task_poll_interval = 5</td>
+      <td>[DEFAULT] vmware_task_poll_interval = 5</td>
      <td>(IntOpt) The interval used for polling remote tasks invoked on VMware ESX/VC server.</td>
    </tr>
    <tr>
-      <td>database/backend = sqlalchemy</td>
+      <td>[database] backend = sqlalchemy</td>
      <td>(StrOpt) The backend to use for db</td>
    </tr>
    <tr>
-      <td>database/connection = None</td>
+      <td>[database] connection = None</td>
      <td>(StrOpt) The SQLAlchemy connection string used to connect to the database</td>
    </tr>
    <tr>
-      <td>database/connection_debug = 0</td>
+      <td>[database] connection_debug = 0</td>
      <td>(IntOpt) Verbosity of SQL debugging information. 0=None, 100=Everything</td>
    </tr>
    <tr>
-      <td>database/connection_trace = False</td>
+      <td>[database] connection_trace = False</td>
      <td>(BoolOpt) Add python stack traces to SQL as comment strings</td>
    </tr>
    <tr>
-      <td>database/db_inc_retry_interval = True</td>
+      <td>[database] db_inc_retry_interval = True</td>
      <td>(BoolOpt) Whether to increase interval between db connection retries, up to db_max_retry_interval</td>
    </tr>
    <tr>
-      <td>database/db_max_retries = 20</td>
+      <td>[database] db_max_retries = 20</td>
      <td>(IntOpt) maximum db connection retries before error is raised. (setting -1 implies an infinite retry count)</td>
    </tr>
    <tr>
-      <td>database/db_max_retry_interval = 10</td>
+      <td>[database] db_max_retry_interval = 10</td>
      <td>(IntOpt) max seconds between db connection retries, if db_inc_retry_interval is enabled</td>
    </tr>
    <tr>
-      <td>database/db_retry_interval = 1</td>
+      <td>[database] db_retry_interval = 1</td>
      <td>(IntOpt) seconds between db connection retries</td>
    </tr>
    <tr>
-      <td>database/idle_timeout = 3600</td>
+      <td>[database] idle_timeout = 3600</td>
      <td>(IntOpt) Timeout before idle sql connections are reaped</td>
    </tr>
    <tr>
-      <td>database/max_overflow = None</td>
+      <td>[database] max_overflow = None</td>
      <td>(IntOpt) If set, use this value for max_overflow with sqlalchemy</td>
    </tr>
    <tr>
-      <td>database/max_pool_size = None</td>
+      <td>[database] max_pool_size = None</td>
      <td>(IntOpt) Maximum number of SQL connections to keep open in a pool</td>
    </tr>
    <tr>
-      <td>database/max_retries = 10</td>
+      <td>[database] max_retries = 10</td>
      <td>(IntOpt) Maximum db connection retries during startup. (setting -1 implies an infinite retry count)</td>
    </tr>
    <tr>
-      <td>database/min_pool_size = 1</td>
+      <td>[database] min_pool_size = 1</td>
      <td>(IntOpt) Minimum number of SQL connections to keep open in a pool</td>
    </tr>
    <tr>
-      <td>database/mysql_sql_mode = TRADITIONAL</td>
+      <td>[database] mysql_sql_mode = TRADITIONAL</td>
      <td>(StrOpt) The SQL mode to be used for MySQL sessions. This option, including the default, overrides any server-set SQL mode. To use whatever SQL mode is set by the server configuration, set this to no value. Example: mysql_sql_mode=</td>
    </tr>
    <tr>
-      <td>database/pool_timeout = None</td>
+      <td>[database] pool_timeout = None</td>
      <td>(IntOpt) If set, use this value for pool_timeout with sqlalchemy</td>
    </tr>
    <tr>
-      <td>database/retry_interval = 10</td>
+      <td>[database] retry_interval = 10</td>
      <td>(IntOpt) Interval between retries of opening a sql connection</td>
    </tr>
    <tr>
-      <td>database/sqlite_db = glance.sqlite</td>
+      <td>[database] sqlite_db = glance.sqlite</td>
      <td>(StrOpt) The file name to use with SQLite</td>
    </tr>
    <tr>
-      <td>database/sqlite_synchronous = True</td>
+      <td>[database] sqlite_synchronous = True</td>
      <td>(BoolOpt) If True, SQLite uses synchronous mode</td>
    </tr>
    <tr>
-      <td>database/use_db_reconnect = False</td>
+      <td>[database] use_db_reconnect = False</td>
      <td>(BoolOpt) Enable the experimental use of database reconnect on connection lost</td>
    </tr>
    <tr>
-      <td>image_format/container_formats = ['ami', 'ari', 'aki', 'bare', 'ovf', 'ova']</td>
+      <td>[image_format] container_formats = ['ami', 'ari', 'aki', 'bare', 'ovf', 'ova']</td>
      <td>(ListOpt) Supported values for the 'container_format' image attribute</td>
    </tr>
    <tr>
-      <td>image_format/disk_formats = ['ami', 'ari', 'aki', 'vhd', 'vmdk', 'raw', 'qcow2', 'vdi', 'iso']</td>
+      <td>[image_format] disk_formats = ['ami', 'ari', 'aki', 'vhd', 'vmdk', 'raw', 'qcow2', 'vdi', 'iso']</td>
      <td>(ListOpt) Supported values for the 'disk_format' image attribute</td>
    </tr>
    <tr>
-      <td>store_type_location_strategy/store_type_preference = []</td>
+      <td>[matchmaker_ring] ringfile = /etc/oslo/matchmaker_ring.json</td>
      <td>(StrOpt) Matchmaker ring file (JSON).</td>
    </tr>
    <tr>
      <td>[store_type_location_strategy] store_type_preference = []</td>
      <td>(ListOpt) The store names to use to get store preference order. The name must be registered by one of the stores defined by the 'known_stores' config option. This option will be applied when you using 'store_type' option as image location strategy defined by the 'location_strategy' config option.</td>
    </tr>
    <tr>
-      <td>task/task_time_to_live = 48</td>
+      <td>[task] task_time_to_live = 48</td>
      <td>(IntOpt) Time in hours for which a task lives after, either succeeding or failing</td>
    </tr>
  </table>
@ -206,42 +346,42 @@
      </tr>
    </thead>
    <tr>
-      <td>default_log_levels</td>
+      <td>[DEFAULT] default_log_levels</td>
      <td>amqplib=WARN, sqlalchemy=WARN, boto=WARN, suds=INFO, keystone=INFO, eventlet.wsgi.server=WARN</td>
      <td>amqp=WARN, amqplib=WARN, boto=WARN, qpid=WARN, sqlalchemy=WARN, suds=INFO, iso8601=WARN, requests.packages.urllib3.connectionpool=WARN</td>
    </tr>
    <tr>
-      <td>known_stores</td>
+      <td>[DEFAULT] known_stores</td>
      <td>glance.store.filesystem.Store, glance.store.http.Store, glance.store.rbd.Store, glance.store.s3.Store, glance.store.swift.Store, glance.store.sheepdog.Store, glance.store.cinder.Store</td>
      <td>glance.store.filesystem.Store, glance.store.http.Store</td>
    </tr>
    <tr>
-      <td>logging_context_format_string</td>
+      <td>[DEFAULT] logging_context_format_string</td>
      <td>%(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user)s %(tenant)s] %(instance)s%(message)s</td>
      <td>%(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user_identity)s] %(instance)s%(message)s</td>
    </tr>
    <tr>
-      <td>qpid_port</td>
+      <td>[DEFAULT] qpid_port</td>
      <td>5672</td>
      <td>5672</td>
    </tr>
    <tr>
-      <td>rbd_store_ceph_conf</td>
+      <td>[DEFAULT] rbd_store_ceph_conf</td>
      <td></td>
      <td>/etc/ceph/ceph.conf</td>
    </tr>
    <tr>
-      <td>rbd_store_chunk_size</td>
+      <td>[DEFAULT] rbd_store_chunk_size</td>
      <td>4</td>
      <td>8</td>
    </tr>
    <tr>
-      <td>rbd_store_pool</td>
+      <td>[DEFAULT] rbd_store_pool</td>
      <td>rbd</td>
      <td>images</td>
    </tr>
    <tr>
-      <td>sheepdog_store_port</td>
+      <td>[DEFAULT] sheepdog_store_port</td>
      <td>7000</td>
      <td>7000</td>
    </tr>
@ -257,36 +397,36 @@
      </tr>
    </thead>
    <tr>
-      <td>rabbit_durable_queues</td>
+      <td>[DEFAULT] rabbit_durable_queues</td>
-      <td>amqp_durable_queues</td>
+      <td>[DEFAULT] amqp_durable_queues</td>
    </tr>
    <tr>
-      <td>disk_formats</td>
+      <td>[DEFAULT] disk_formats</td>
-      <td>image_format/disk_formats</td>
+      <td>[image_format] disk_formats</td>
    </tr>
    <tr>
-      <td>log_config</td>
+      <td>[DEFAULT] log_config</td>
-      <td>log_config_append</td>
+      <td>[DEFAULT] log_config_append</td>
    </tr>
    <tr>
-      <td>sql_connection</td>
+      <td>[DEFAULT] sql_connection</td>
-      <td>database/connection</td>
+      <td>[database] connection</td>
    </tr>
    <tr>
-      <td>sql_max_retries</td>
+      <td>[DEFAULT] sql_max_retries</td>
-      <td>database/max_retries</td>
+      <td>[database] max_retries</td>
    </tr>
    <tr>
-      <td>sql_retry_interval</td>
+      <td>[DEFAULT] sql_retry_interval</td>
-      <td>database/retry_interval</td>
+      <td>[database] retry_interval</td>
    </tr>
    <tr>
-      <td>sql_idle_timeout</td>
+      <td>[DEFAULT] sql_idle_timeout</td>
-      <td>database/idle_timeout</td>
+      <td>[database] idle_timeout</td>
    </tr>
    <tr>
-      <td>container_formats</td>
+      <td>[DEFAULT] container_formats</td>
-      <td>image_format/container_formats</td>
+      <td>[image_format] container_formats</td>
    </tr>
  </table>
 </section>
--- a/doc/common/tables/heat-conf-changes-icehouse.xml
+++ b/doc/common/tables/heat-conf-changes-icehouse.xml
@ -13,231 +13,231 @@
      </tr>
    </thead>
    <tr>
-      <td>engine_life_check_timeout = 2</td>
+      <td>[DEFAULT] engine_life_check_timeout = 2</td>
      <td>(IntOpt) RPC timeout for the engine liveness check that is used for stack locking.</td>
    </tr>
    <tr>
-      <td>keystone_backend = heat.common.heat_keystoneclient.KeystoneClientV3</td>
+      <td>[DEFAULT] keystone_backend = heat.common.heat_keystoneclient.KeystoneClientV3</td>
      <td>(StrOpt) Fully qualified class name to use as a keystone backend.</td>
    </tr>
    <tr>
-      <td>log_config_append = None</td>
+      <td>[DEFAULT] log_config_append = None</td>
      <td>(StrOpt) The name of logging configuration file. It does not disable existing loggers, but just appends specified logging configuration to any other existing logging options. Please see the Python logging module documentation for details on logging configuration files.</td>
    </tr>
    <tr>
-      <td>onready = None</td>
+      <td>[DEFAULT] onready = None</td>
      <td>(StrOpt) onready allows you to send a notification when the heat processes are ready to serve.  This is either a module with the notify() method or a shell command.  To enable notifications with systemd, one may use the 'systemd-notify --ready' shell command or the 'heat.common.systemd' notification module.</td>
    </tr>
    <tr>
-      <td>region_name_for_services = None</td>
+      <td>[DEFAULT] region_name_for_services = None</td>
      <td>(StrOpt) Default region name used to get services endpoints.</td>
    </tr>
    <tr>
-      <td>secure_proxy_ssl_header = X-Forwarded-Proto</td>
+      <td>[DEFAULT] secure_proxy_ssl_header = X-Forwarded-Proto</td>
      <td>(StrOpt) The HTTP Header that will be used to determine which the original request protocol scheme was, even if it was removed by an SSL terminator proxy.</td>
    </tr>
    <tr>
-      <td>stack_action_timeout = 3600</td>
+      <td>[DEFAULT] stack_action_timeout = 3600</td>
      <td>(IntOpt) Timeout in seconds for stack action (ie. create or update).</td>
    </tr>
    <tr>
-      <td>stack_domain_admin = None</td>
+      <td>[DEFAULT] stack_domain_admin = None</td>
      <td>(StrOpt) Keystone username, a user with roles sufficient to manage users and projects in the stack_user_domain.</td>
    </tr>
    <tr>
-      <td>stack_domain_admin_password = None</td>
+      <td>[DEFAULT] stack_domain_admin_password = None</td>
      <td>(StrOpt) Keystone password for stack_domain_admin user.</td>
    </tr>
    <tr>
-      <td>stack_user_domain = None</td>
+      <td>[DEFAULT] stack_user_domain = None</td>
      <td>(StrOpt) Keystone domain ID which contains heat template-defined users.</td>
    </tr>
    <tr>
-      <td>clients/ca_file = None</td>
+      <td>[clients] ca_file = None</td>
      <td>(StrOpt) Optional CA cert file to use in SSL connections.</td>
    </tr>
    <tr>
-      <td>clients/cert_file = None</td>
+      <td>[clients] cert_file = None</td>
      <td>(StrOpt) Optional PEM-formatted certificate chain file.</td>
    </tr>
    <tr>
-      <td>clients/endpoint_type = publicURL</td>
+      <td>[clients] endpoint_type = publicURL</td>
      <td>(StrOpt) Type of endpoint in Identity service catalog to use for communication with the OpenStack service.</td>
    </tr>
    <tr>
-      <td>clients/insecure = False</td>
+      <td>[clients] insecure = False</td>
      <td>(BoolOpt) If set, then the server's certificate will not be verified.</td>
    </tr>
    <tr>
-      <td>clients/key_file = None</td>
+      <td>[clients] key_file = None</td>
      <td>(StrOpt) Optional PEM-formatted file that contains the private key.</td>
    </tr>
    <tr>
-      <td>clients_ceilometer/ca_file = None</td>
+      <td>[clients_ceilometer] ca_file = None</td>
      <td>(StrOpt) Optional CA cert file to use in SSL connections.</td>
    </tr>
    <tr>
-      <td>clients_ceilometer/cert_file = None</td>
+      <td>[clients_ceilometer] cert_file = None</td>
      <td>(StrOpt) Optional PEM-formatted certificate chain file.</td>
    </tr>
    <tr>
-      <td>clients_ceilometer/endpoint_type = publicURL</td>
+      <td>[clients_ceilometer] endpoint_type = publicURL</td>
      <td>(StrOpt) Type of endpoint in Identity service catalog to use for communication with the OpenStack service.</td>
    </tr>
    <tr>
-      <td>clients_ceilometer/insecure = False</td>
+      <td>[clients_ceilometer] insecure = False</td>
      <td>(BoolOpt) If set, then the server's certificate will not be verified.</td>
    </tr>
    <tr>
-      <td>clients_ceilometer/key_file = None</td>
+      <td>[clients_ceilometer] key_file = None</td>
      <td>(StrOpt) Optional PEM-formatted file that contains the private key.</td>
    </tr>
    <tr>
-      <td>clients_cinder/ca_file = None</td>
+      <td>[clients_cinder] ca_file = None</td>
      <td>(StrOpt) Optional CA cert file to use in SSL connections.</td>
    </tr>
    <tr>
-      <td>clients_cinder/cert_file = None</td>
+      <td>[clients_cinder] cert_file = None</td>
      <td>(StrOpt) Optional PEM-formatted certificate chain file.</td>
    </tr>
    <tr>
-      <td>clients_cinder/endpoint_type = publicURL</td>
+      <td>[clients_cinder] endpoint_type = publicURL</td>
      <td>(StrOpt) Type of endpoint in Identity service catalog to use for communication with the OpenStack service.</td>
    </tr>
    <tr>
-      <td>clients_cinder/insecure = False</td>
+      <td>[clients_cinder] insecure = False</td>
      <td>(BoolOpt) If set, then the server's certificate will not be verified.</td>
    </tr>
    <tr>
-      <td>clients_cinder/key_file = None</td>
+      <td>[clients_cinder] key_file = None</td>
      <td>(StrOpt) Optional PEM-formatted file that contains the private key.</td>
    </tr>
    <tr>
-      <td>clients_heat/ca_file = None</td>
+      <td>[clients_heat] ca_file = None</td>
      <td>(StrOpt) Optional CA cert file to use in SSL connections.</td>
    </tr>
    <tr>
-      <td>clients_heat/cert_file = None</td>
+      <td>[clients_heat] cert_file = None</td>
      <td>(StrOpt) Optional PEM-formatted certificate chain file.</td>
    </tr>
    <tr>
-      <td>clients_heat/endpoint_type = publicURL</td>
+      <td>[clients_heat] endpoint_type = publicURL</td>
      <td>(StrOpt) Type of endpoint in Identity service catalog to use for communication with the OpenStack service.</td>
    </tr>
    <tr>
-      <td>clients_heat/insecure = False</td>
+      <td>[clients_heat] insecure = False</td>
      <td>(BoolOpt) If set, then the server's certificate will not be verified.</td>
    </tr>
    <tr>
-      <td>clients_heat/key_file = None</td>
+      <td>[clients_heat] key_file = None</td>
      <td>(StrOpt) Optional PEM-formatted file that contains the private key.</td>
    </tr>
    <tr>
-      <td>clients_heat/url = None</td>
+      <td>[clients_heat] url = None</td>
      <td>(StrOpt) Optional heat url in format like http://0.0.0.0:8004/v1/%(tenant_id)s.</td>
    </tr>
    <tr>
-      <td>clients_keystone/ca_file = None</td>
+      <td>[clients_keystone] ca_file = None</td>
      <td>(StrOpt) Optional CA cert file to use in SSL connections.</td>
    </tr>
    <tr>
-      <td>clients_keystone/cert_file = None</td>
+      <td>[clients_keystone] cert_file = None</td>
      <td>(StrOpt) Optional PEM-formatted certificate chain file.</td>
    </tr>
    <tr>
-      <td>clients_keystone/endpoint_type = publicURL</td>
+      <td>[clients_keystone] endpoint_type = publicURL</td>
      <td>(StrOpt) Type of endpoint in Identity service catalog to use for communication with the OpenStack service.</td>
    </tr>
    <tr>
-      <td>clients_keystone/insecure = False</td>
+      <td>[clients_keystone] insecure = False</td>
      <td>(BoolOpt) If set, then the server's certificate will not be verified.</td>
    </tr>
    <tr>
-      <td>clients_keystone/key_file = None</td>
+      <td>[clients_keystone] key_file = None</td>
      <td>(StrOpt) Optional PEM-formatted file that contains the private key.</td>
    </tr>
    <tr>
-      <td>clients_neutron/ca_file = None</td>
+      <td>[clients_neutron] ca_file = None</td>
      <td>(StrOpt) Optional CA cert file to use in SSL connections.</td>
    </tr>
    <tr>
-      <td>clients_neutron/cert_file = None</td>
+      <td>[clients_neutron] cert_file = None</td>
      <td>(StrOpt) Optional PEM-formatted certificate chain file.</td>
    </tr>
    <tr>
-      <td>clients_neutron/endpoint_type = publicURL</td>
+      <td>[clients_neutron] endpoint_type = publicURL</td>
      <td>(StrOpt) Type of endpoint in Identity service catalog to use for communication with the OpenStack service.</td>
    </tr>
    <tr>
-      <td>clients_neutron/insecure = False</td>
+      <td>[clients_neutron] insecure = False</td>
      <td>(BoolOpt) If set, then the server's certificate will not be verified.</td>
    </tr>
    <tr>
-      <td>clients_neutron/key_file = None</td>
+      <td>[clients_neutron] key_file = None</td>
      <td>(StrOpt) Optional PEM-formatted file that contains the private key.</td>
    </tr>
    <tr>
-      <td>clients_nova/ca_file = None</td>
+      <td>[clients_nova] ca_file = None</td>
      <td>(StrOpt) Optional CA cert file to use in SSL connections.</td>
    </tr>
    <tr>
-      <td>clients_nova/cert_file = None</td>
+      <td>[clients_nova] cert_file = None</td>
      <td>(StrOpt) Optional PEM-formatted certificate chain file.</td>
    </tr>
    <tr>
-      <td>clients_nova/endpoint_type = publicURL</td>
+      <td>[clients_nova] endpoint_type = publicURL</td>
      <td>(StrOpt) Type of endpoint in Identity service catalog to use for communication with the OpenStack service.</td>
    </tr>
    <tr>
-      <td>clients_nova/insecure = False</td>
+      <td>[clients_nova] insecure = False</td>
      <td>(BoolOpt) If set, then the server's certificate will not be verified.</td>
    </tr>
    <tr>
-      <td>clients_nova/key_file = None</td>
+      <td>[clients_nova] key_file = None</td>
      <td>(StrOpt) Optional PEM-formatted file that contains the private key.</td>
    </tr>
    <tr>
-      <td>clients_swift/ca_file = None</td>
+      <td>[clients_swift] ca_file = None</td>
      <td>(StrOpt) Optional CA cert file to use in SSL connections.</td>
    </tr>
    <tr>
-      <td>clients_swift/cert_file = None</td>
+      <td>[clients_swift] cert_file = None</td>
      <td>(StrOpt) Optional PEM-formatted certificate chain file.</td>
    </tr>
    <tr>
-      <td>clients_swift/endpoint_type = publicURL</td>
+      <td>[clients_swift] endpoint_type = publicURL</td>
      <td>(StrOpt) Type of endpoint in Identity service catalog to use for communication with the OpenStack service.</td>
    </tr>
    <tr>
-      <td>clients_swift/insecure = False</td>
+      <td>[clients_swift] insecure = False</td>
      <td>(BoolOpt) If set, then the server's certificate will not be verified.</td>
    </tr>
    <tr>
-      <td>clients_swift/key_file = None</td>
+      <td>[clients_swift] key_file = None</td>
      <td>(StrOpt) Optional PEM-formatted file that contains the private key.</td>
    </tr>
    <tr>
-      <td>clients_trove/ca_file = None</td>
+      <td>[clients_trove] ca_file = None</td>
      <td>(StrOpt) Optional CA cert file to use in SSL connections.</td>
    </tr>
    <tr>
-      <td>clients_trove/cert_file = None</td>
+      <td>[clients_trove] cert_file = None</td>
      <td>(StrOpt) Optional PEM-formatted certificate chain file.</td>
    </tr>
    <tr>
-      <td>clients_trove/endpoint_type = publicURL</td>
+      <td>[clients_trove] endpoint_type = publicURL</td>
      <td>(StrOpt) Type of endpoint in Identity service catalog to use for communication with the OpenStack service.</td>
    </tr>
    <tr>
-      <td>clients_trove/insecure = False</td>
+      <td>[clients_trove] insecure = False</td>
      <td>(BoolOpt) If set, then the server's certificate will not be verified.</td>
    </tr>
    <tr>
-      <td>clients_trove/key_file = None</td>
+      <td>[clients_trove] key_file = None</td>
      <td>(StrOpt) Optional PEM-formatted file that contains the private key.</td>
    </tr>
    <tr>
-      <td>revision/heat_revision = unknown</td>
+      <td>[revision] heat_revision = unknown</td>
      <td>(StrOpt) Heat build revision. If you would prefer to manage your build revision separately, you can move this section to a different file and add it as another config option.</td>
    </tr>
  </table>
@ -254,27 +254,27 @@
      </tr>
    </thead>
    <tr>
-      <td>allowed_rpc_exception_modules</td>
+      <td>[DEFAULT] allowed_rpc_exception_modules</td>
      <td>heat.openstack.common.exception, heat.common.exception, nova.exception, cinder.exception, exceptions</td>
      <td>nova.exception, cinder.exception, exceptions</td>
    </tr>
    <tr>
-      <td>cloud_backend</td>
+      <td>[DEFAULT] cloud_backend</td>
      <td>None</td>
      <td>heat.engine.clients.OpenStackClients</td>
    </tr>
    <tr>
-      <td>control_exchange</td>
+      <td>[DEFAULT] control_exchange</td>
      <td>openstack</td>
      <td>heat</td>
    </tr>
    <tr>
-      <td>default_log_levels</td>
+      <td>[DEFAULT] default_log_levels</td>
      <td>amqplib=WARN, sqlalchemy=WARN, boto=WARN, suds=INFO, keystone=INFO, eventlet.wsgi.server=WARN</td>
      <td>amqp=WARN, amqplib=WARN, boto=WARN, qpid=WARN, sqlalchemy=WARN, suds=INFO, iso8601=WARN</td>
    </tr>
    <tr>
-      <td>logging_context_format_string</td>
+      <td>[DEFAULT] logging_context_format_string</td>
      <td>%(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user)s %(tenant)s] %(instance)s%(message)s</td>
      <td>%(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user_identity)s] %(instance)s%(message)s</td>
    </tr>
@ -290,20 +290,20 @@
      </tr>
    </thead>
    <tr>
-      <td>db_backend</td>
+      <td>[DEFAULT] db_backend</td>
-      <td>database/backend</td>
+      <td>[database] backend</td>
    </tr>
    <tr>
-      <td>log_config</td>
+      <td>[DEFAULT] log_config</td>
-      <td>log_config_append</td>
+      <td>[DEFAULT] log_config_append</td>
    </tr>
    <tr>
-      <td>sql_connection</td>
+      <td>[DEFAULT] sql_connection</td>
-      <td>database/connection</td>
+      <td>[database] connection</td>
    </tr>
    <tr>
-      <td>sql_idle_timeout</td>
+      <td>[DEFAULT] sql_idle_timeout</td>
-      <td>database/idle_timeout</td>
+      <td>[database] idle_timeout</td>
    </tr>
  </table>
 </section>
--- a/doc/common/tables/keystone-conf-changes-icehouse.xml
+++ b/doc/common/tables/keystone-conf-changes-icehouse.xml
@ -13,175 +13,175 @@
      </tr>
    </thead>
    <tr>
-      <td>admin_bind_host = 0.0.0.0</td>
+      <td>[DEFAULT] admin_bind_host = 0.0.0.0</td>
      <td>(StrOpt) The IP Address of the network interface to for the admin service to listen on.</td>
    </tr>
    <tr>
-      <td>domain_id_immutable = True</td>
+      <td>[DEFAULT] domain_id_immutable = True</td>
      <td>(BoolOpt) Set this to false if you want to enable the ability for user, group and project entities to be moved between domains by updating their domain_id. Allowing such movement is not recommended if the scope of a domain admin is being restricted by use of an appropriate policy file (see policy.v3cloudsample as an example).</td>
    </tr>
    <tr>
-      <td>host = 127.0.0.1</td>
+      <td>[DEFAULT] host = 127.0.0.1</td>
      <td>(StrOpt) Host to locate redis.</td>
    </tr>
    <tr>
-      <td>keystone_ec2_cafile = None</td>
+      <td>[DEFAULT] keystone_ec2_cafile = None</td>
      <td>(StrOpt) A PEM encoded certificate authority to use when verifying HTTPS connections. Defaults to the system CAs.</td>
    </tr>
    <tr>
-      <td>keystone_ec2_certfile = None</td>
+      <td>[DEFAULT] keystone_ec2_certfile = None</td>
      <td>(StrOpt) Client certificate key filename. Required if EC2 server requires client certificate.</td>
    </tr>
    <tr>
-      <td>keystone_ec2_insecure = False</td>
+      <td>[DEFAULT] keystone_ec2_insecure = False</td>
      <td>(BoolOpt) Disable SSL certificate verification.</td>
    </tr>
    <tr>
-      <td>keystone_ec2_keyfile = None</td>
+      <td>[DEFAULT] keystone_ec2_keyfile = None</td>
      <td>(StrOpt) Required if EC2 server requires client certificate.</td>
    </tr>
    <tr>
-      <td>keystone_ec2_url = http://localhost:5000/v2.0/ec2tokens</td>
+      <td>[DEFAULT] keystone_ec2_url = http://localhost:5000/v2.0/ec2tokens</td>
      <td>(StrOpt) URL to get token from ec2 request.</td>
    </tr>
    <tr>
-      <td>kombu_reconnect_delay = 1.0</td>
+      <td>[DEFAULT] kombu_reconnect_delay = 1.0</td>
      <td>(FloatOpt) How long to wait before reconnecting in response to an AMQP consumer cancel notification.</td>
    </tr>
    <tr>
-      <td>list_limit = None</td>
+      <td>[DEFAULT] list_limit = None</td>
      <td>(IntOpt) The maximum number of entities that will be returned in a collection can be set with list_limit, with no limit set by default. This global limit may be then overridden for a specific driver, by specifying a list_limit in the appropriate section (e.g. [assignment]).</td>
    </tr>
    <tr>
-      <td>log_config_append = None</td>
+      <td>[DEFAULT] log_config_append = None</td>
      <td>(StrOpt) The name of logging configuration file. It does not disable existing loggers, but just appends specified logging configuration to any other existing logging options. Please see the Python logging module documentation for details on logging configuration files.</td>
    </tr>
    <tr>
-      <td>password = None</td>
+      <td>[DEFAULT] password = None</td>
      <td>(StrOpt) Password for Redis server (optional).</td>
    </tr>
    <tr>
-      <td>port = 6379</td>
+      <td>[DEFAULT] port = 6379</td>
      <td>(IntOpt) Use this port to connect to redis host.</td>
    </tr>
    <tr>
-      <td>public_bind_host = 0.0.0.0</td>
+      <td>[DEFAULT] public_bind_host = 0.0.0.0</td>
      <td>(StrOpt) The IP Address of the network interface to for the public service to listen on.</td>
    </tr>
    <tr>
-      <td>rabbit_login_method = AMQPLAIN</td>
+      <td>[DEFAULT] rabbit_login_method = AMQPLAIN</td>
      <td>(StrOpt) the RabbitMQ login method</td>
    </tr>
    <tr>
-      <td>tcp_keepalive = False</td>
+      <td>[DEFAULT] tcp_keepalive = False</td>
      <td>(BoolOpt) Set this to True if you want to enable TCP_KEEPALIVE on server sockets i.e. sockets used by the keystone wsgi server for client connections.</td>
    </tr>
    <tr>
-      <td>tcp_keepidle = 600</td>
+      <td>[DEFAULT] tcp_keepidle = 600</td>
      <td>(IntOpt) Sets the value of TCP_KEEPIDLE in seconds for each server socket. Only applies if tcp_keepalive is True. Not supported on OS X.</td>
    </tr>
    <tr>
-      <td>transport_url = None</td>
+      <td>[DEFAULT] transport_url = None</td>
      <td>(StrOpt) A URL representing the messaging driver to use and its full configuration. If not set, we fall back to the rpc_backend option and driver specific configuration.</td>
    </tr>
    <tr>
-      <td>use_syslog_rfc_format = False</td>
+      <td>[DEFAULT] use_syslog_rfc_format = False</td>
      <td>(BoolOpt) (Optional) Use syslog rfc5424 format for logging. If enabled, will add APP-NAME (RFC5424) before the MSG part of the syslog message.  The old format without APP-NAME is deprecated in I, and will be removed in J.</td>
    </tr>
    <tr>
-      <td>assignment/list_limit = None</td>
+      <td>[assignment] list_limit = None</td>
      <td>(IntOpt) Maximum number of entities that will be returned in an assignment collection.</td>
    </tr>
    <tr>
-      <td>audit/namespace = openstack</td>
+      <td>[audit] namespace = openstack</td>
      <td>(StrOpt) namespace prefix for generated id</td>
    </tr>
    <tr>
-      <td>catalog/list_limit = None</td>
+      <td>[catalog] list_limit = None</td>
      <td>(IntOpt) Maximum number of entities that will be returned in a catalog collection.</td>
    </tr>
    <tr>
-      <td>database/db_inc_retry_interval = True</td>
+      <td>[database] db_inc_retry_interval = True</td>
      <td>(BoolOpt) Whether to increase interval between db connection retries, up to db_max_retry_interval</td>
    </tr>
    <tr>
-      <td>database/db_max_retries = 20</td>
+      <td>[database] db_max_retries = 20</td>
      <td>(IntOpt) maximum db connection retries before error is raised. (setting -1 implies an infinite retry count)</td>
    </tr>
    <tr>
-      <td>database/db_max_retry_interval = 10</td>
+      <td>[database] db_max_retry_interval = 10</td>
      <td>(IntOpt) max seconds between db connection retries, if db_inc_retry_interval is enabled</td>
    </tr>
    <tr>
-      <td>database/db_retry_interval = 1</td>
+      <td>[database] db_retry_interval = 1</td>
      <td>(IntOpt) seconds between db connection retries</td>
    </tr>
    <tr>
-      <td>database/mysql_sql_mode = TRADITIONAL</td>
+      <td>[database] mysql_sql_mode = TRADITIONAL</td>
      <td>(StrOpt) The SQL mode to be used for MySQL sessions. This option, including the default, overrides any server-set SQL mode. To use whatever SQL mode is set by the server configuration, set this to no value. Example: mysql_sql_mode=</td>
    </tr>
    <tr>
-      <td>database/sqlite_db = keystone.sqlite</td>
+      <td>[database] sqlite_db = keystone.sqlite</td>
      <td>(StrOpt) The file name to use with SQLite</td>
    </tr>
    <tr>
-      <td>database/sqlite_synchronous = True</td>
+      <td>[database] sqlite_synchronous = True</td>
      <td>(BoolOpt) If True, SQLite uses synchronous mode</td>
    </tr>
    <tr>
-      <td>database/use_db_reconnect = False</td>
+      <td>[database] use_db_reconnect = False</td>
      <td>(BoolOpt) Enable the experimental use of database reconnect on connection lost</td>
    </tr>
    <tr>
-      <td>federation/assertion_prefix = </td>
+      <td>[federation] assertion_prefix = </td>
      <td>(StrOpt) Value to be used when filtering assertion parameters from the environment.</td>
    </tr>
    <tr>
-      <td>federation/driver = keystone.contrib.federation.backends.sql.Federation</td>
+      <td>[federation] driver = keystone.contrib.federation.backends.sql.Federation</td>
      <td>(StrOpt) Keystone Federation backend driver.</td>
    </tr>
    <tr>
-      <td>identity/list_limit = None</td>
+      <td>[identity] list_limit = None</td>
      <td>(IntOpt) Maximum number of entities that will be returned in an identity collection.</td>
    </tr>
    <tr>
-      <td>kvs/backends = []</td>
+      <td>[kvs] backends = []</td>
      <td>(ListOpt) Extra dogpile.cache backend modules to register with the dogpile.cache library.</td>
    </tr>
    <tr>
-      <td>kvs/config_prefix = keystone.kvs</td>
+      <td>[kvs] config_prefix = keystone.kvs</td>
      <td>(StrOpt) Prefix for building the configuration dictionary for the KVS region. This should not need to be changed unless there is another dogpile.cache region with the same configuration name.</td>
    </tr>
    <tr>
-      <td>kvs/default_lock_timeout = 5</td>
+      <td>[kvs] default_lock_timeout = 5</td>
      <td>(IntOpt) Default lock timeout for distributed locking.</td>
    </tr>
    <tr>
-      <td>kvs/enable_key_mangler = True</td>
+      <td>[kvs] enable_key_mangler = True</td>
      <td>(BoolOpt) Toggle to disable using a key-mangling function to ensure fixed length keys. This is toggle-able for debugging purposes, it is highly recommended to always leave this set to True.</td>
    </tr>
    <tr>
-      <td>ldap/chase_referrals = None</td>
+      <td>[ldap] chase_referrals = None</td>
      <td>(BoolOpt) Override the system's default referral chasing behavior for queries.</td>
    </tr>
    <tr>
-      <td>policy/list_limit = None</td>
+      <td>[policy] list_limit = None</td>
      <td>(IntOpt) Maximum number of entities that will be returned in a policy collection.</td>
    </tr>
    <tr>
-      <td>revoke/caching = True</td>
+      <td>[revoke] caching = True</td>
      <td>(BoolOpt) Toggle for revocation event cacheing. This has no effect unless global caching is enabled.</td>
    </tr>
    <tr>
-      <td>revoke/driver = keystone.contrib.revoke.backends.kvs.Revoke</td>
+      <td>[revoke] driver = keystone.contrib.revoke.backends.kvs.Revoke</td>
      <td>(StrOpt) An implementation of the backend for persisting revocation events.</td>
    </tr>
    <tr>
-      <td>revoke/expiration_buffer = 1800</td>
+      <td>[revoke] expiration_buffer = 1800</td>
      <td>(IntOpt) This value (calculated in seconds) is added to token expiration before a revocation event may be removed from the backend.</td>
    </tr>
    <tr>
-      <td>token/revoke_by_id = True</td>
+      <td>[token] revoke_by_id = True</td>
      <td>(BoolOpt) Revoke token by token identifier.  Setting revoke_by_id to True enables various forms of enumerating tokens, e.g. `list tokens for user`.  These enumerations are processed to determine the list of tokens to revoke.   Only disable if you are switching to using the Revoke extension with a backend other than KVS, which stores events in memory.</td>
    </tr>
  </table>
@ -198,102 +198,102 @@
      </tr>
    </thead>
    <tr>
-      <td>admin_endpoint</td>
+      <td>[DEFAULT] admin_endpoint</td>
      <td>http://localhost:%(admin_port)s/</td>
      <td>None</td>
    </tr>
    <tr>
-      <td>default_log_levels</td>
+      <td>[DEFAULT] default_log_levels</td>
      <td>amqplib=WARN, sqlalchemy=WARN, boto=WARN, suds=INFO, keystone=INFO, eventlet.wsgi.server=WARN</td>
      <td>amqp=WARN, amqplib=WARN, boto=WARN, qpid=WARN, sqlalchemy=WARN, suds=INFO, iso8601=WARN, requests.packages.urllib3.connectionpool=WARN</td>
    </tr>
    <tr>
-      <td>logging_context_format_string</td>
+      <td>[DEFAULT] logging_context_format_string</td>
      <td>%(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user)s %(tenant)s] %(instance)s%(message)s</td>
      <td>%(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user_identity)s] %(instance)s%(message)s</td>
    </tr>
    <tr>
-      <td>public_endpoint</td>
+      <td>[DEFAULT] public_endpoint</td>
      <td>http://localhost:%(public_port)s/</td>
      <td>None</td>
    </tr>
    <tr>
-      <td>rpc_zmq_matchmaker</td>
+      <td>[DEFAULT] rpc_zmq_matchmaker</td>
      <td>keystone.openstack.common.rpc.matchmaker.MatchMakerLocalhost</td>
      <td>oslo.messaging._drivers.matchmaker.MatchMakerLocalhost</td>
    </tr>
    <tr>
-      <td>auth/external</td>
+      <td>[auth] external</td>
      <td>keystone.auth.plugins.external.ExternalDefault</td>
      <td>keystone.auth.plugins.external.DefaultDomain</td>
    </tr>
    <tr>
-      <td>database/connection</td>
+      <td>[database] connection</td>
-      <td>sqlite:////home/gauvain/sources/openstack/openstack-doc-tools/autogenerate_config_docs/sources/keystone/keystone/openstack/common/db/$sqlite_db</td>
+      <td>sqlite:////home/gpocentek/Workspace/OpenStack/openstack-doc-tools/autogenerate_config_docs/sources/keystone/keystone/openstack/common/db/$sqlite_db</td>
      <td>None</td>
    </tr>
    <tr>
-      <td>ldap/group_additional_attribute_mapping</td>
+      <td>[ldap] group_additional_attribute_mapping</td>
      <td>None</td>
      <td></td>
    </tr>
    <tr>
-      <td>ldap/group_attribute_ignore</td>
+      <td>[ldap] group_attribute_ignore</td>
      <td></td>
      <td></td>
    </tr>
    <tr>
-      <td>ldap/role_additional_attribute_mapping</td>
+      <td>[ldap] role_additional_attribute_mapping</td>
      <td>None</td>
      <td></td>
    </tr>
    <tr>
-      <td>ldap/role_attribute_ignore</td>
+      <td>[ldap] role_attribute_ignore</td>
      <td></td>
      <td></td>
    </tr>
    <tr>
-      <td>ldap/tenant_additional_attribute_mapping</td>
+      <td>[ldap] tenant_additional_attribute_mapping</td>
      <td>None</td>
      <td></td>
    </tr>
    <tr>
-      <td>ldap/tenant_attribute_ignore</td>
+      <td>[ldap] tenant_attribute_ignore</td>
      <td></td>
      <td></td>
    </tr>
    <tr>
-      <td>ldap/user_additional_attribute_mapping</td>
+      <td>[ldap] user_additional_attribute_mapping</td>
      <td>None</td>
      <td></td>
    </tr>
    <tr>
-      <td>ldap/user_attribute_ignore</td>
+      <td>[ldap] user_attribute_ignore</td>
      <td>default_project_id,tenants</td>
      <td>default_project_id, tenants</td>
    </tr>
    <tr>
-      <td>memcache/servers</td>
+      <td>[memcache] servers</td>
      <td>localhost:11211</td>
      <td>localhost:11211</td>
    </tr>
    <tr>
-      <td>paste_deploy/config_file</td>
+      <td>[paste_deploy] config_file</td>
      <td>None</td>
      <td>keystone-paste.ini</td>
    </tr>
    <tr>
-      <td>signing/ca_key</td>
+      <td>[signing] ca_key</td>
      <td>/etc/keystone/ssl/certs/cakey.pem</td>
      <td>/etc/keystone/ssl/private/cakey.pem</td>
    </tr>
    <tr>
-      <td>ssl/ca_key</td>
+      <td>[ssl] ca_key</td>
      <td>/etc/keystone/ssl/certs/cakey.pem</td>
      <td>/etc/keystone/ssl/private/cakey.pem</td>
    </tr>
    <tr>
-      <td>token/expiration</td>
+      <td>[token] expiration</td>
      <td>86400</td>
      <td>3600</td>
    </tr>
@ -309,28 +309,28 @@
      </tr>
    </thead>
    <tr>
-      <td>bind_host</td>
+      <td>[DEFAULT] bind_host</td>
-      <td>admin_bind_host</td>
+      <td>[DEFAULT] admin_bind_host</td>
    </tr>
    <tr>
-      <td>log_config</td>
+      <td>[DEFAULT] log_config</td>
-      <td>log_config_append</td>
+      <td>[DEFAULT] log_config_append</td>
    </tr>
    <tr>
-      <td>rpc_notifier2/topics</td>
+      <td>[rpc_notifier2] topics</td>
-      <td>notification_topics</td>
+      <td>[DEFAULT] notification_topics</td>
    </tr>
    <tr>
-      <td>sql/connection</td>
+      <td>[sql] connection</td>
-      <td>database/connection</td>
+      <td>[database] connection</td>
    </tr>
    <tr>
-      <td>sql/idle_timeout</td>
+      <td>[sql] idle_timeout</td>
-      <td>database/idle_timeout</td>
+      <td>[database] idle_timeout</td>
    </tr>
    <tr>
-      <td>bind_host</td>
+      <td>[DEFAULT] bind_host</td>
-      <td>public_bind_host</td>
+      <td>[DEFAULT] public_bind_host</td>
    </tr>
  </table>
 </section>
--- a/doc/common/tables/neutron-conf-changes-icehouse.xml
+++ b/doc/common/tables/neutron-conf-changes-icehouse.xml
@ -13,687 +13,703 @@
      </tr>
    </thead>
    <tr>
-      <td>auth_ca_cert = None</td>
+      <td>[DEFAULT] auth_ca_cert = None</td>
      <td>(StrOpt) Certificate Authority public key (CA cert) file for ssl</td>
    </tr>
    <tr>
-      <td>auth_insecure = False</td>
+      <td>[DEFAULT] auth_insecure = False</td>
      <td>(BoolOpt) Turn off verification of the certificate for ssl</td>
    </tr>
    <tr>
-      <td>ca_certs = None</td>
+      <td>[DEFAULT] ca_certs = None</td>
      <td>(StrOpt) CA certificates</td>
    </tr>
    <tr>
-      <td>ctl_cert = None</td>
+      <td>[DEFAULT] ctl_cert = None</td>
      <td>(StrOpt) controller certificate</td>
    </tr>
    <tr>
-      <td>ctl_privkey = None</td>
+      <td>[DEFAULT] ctl_privkey = None</td>
      <td>(StrOpt) controller private key</td>
    </tr>
    <tr>
-      <td>default_service_cluster_uuid = None</td>
+      <td>[DEFAULT] default_service_cluster_uuid = None</td>
      <td>(StrOpt) Unique identifier of the Service Cluster which will be used by logical services like dhcp and metadata</td>
    </tr>
    <tr>
-      <td>dnsmasq_dns_servers = None</td>
+      <td>[DEFAULT] dnsmasq_dns_servers = None</td>
      <td>(ListOpt) Comma-separated list of the DNS servers which will be used as forwarders.</td>
    </tr>
    <tr>
-      <td>log_config_append = None</td>
+      <td>[DEFAULT] log_config_append = None</td>
      <td>(StrOpt) The name of logging configuration file. It does not disable existing loggers, but just appends specified logging configuration to any other existing logging options. Please see the Python logging module documentation for details on logging configuration files.</td>
    </tr>
    <tr>
-      <td>max_header_line = 16384</td>
+      <td>[DEFAULT] max_header_line = 16384</td>
      <td>(IntOpt) Max header line to accommodate large tokens</td>
    </tr>
    <tr>
-      <td>max_request_body_size = 114688</td>
+      <td>[DEFAULT] max_request_body_size = 114688</td>
-      <td>(IntOpt) the maximum body size per each request(bytes)</td>
+      <td>(IntOpt) The maximum body size per request, in bytes</td>
    </tr>
    <tr>
-      <td>metadata_backlog = 128</td>
+      <td>[DEFAULT] metadata_backlog = 128</td>
      <td>(IntOpt) Number of backlog requests to configure the metadata server socket with</td>
    </tr>
    <tr>
-      <td>metadata_workers = 0</td>
+      <td>[DEFAULT] metadata_workers = 0</td>
      <td>(IntOpt) Number of separate worker processes for metadata server</td>
    </tr>
    <tr>
-      <td>notify_nova_on_port_data_changes = True</td>
+      <td>[DEFAULT] notify_nova_on_port_data_changes = True</td>
      <td>(BoolOpt) Send notification to nova when port data (fixed_ips/floatingip) changes so nova can update its cache.</td>
    </tr>
    <tr>
-      <td>notify_nova_on_port_status_changes = True</td>
+      <td>[DEFAULT] notify_nova_on_port_status_changes = True</td>
      <td>(BoolOpt) Send notification to nova when port status changes</td>
    </tr>
    <tr>
-      <td>nova_admin_auth_url = http://localhost:5000/v2.0</td>
+      <td>[DEFAULT] nova_admin_auth_url = http://localhost:5000/v2.0</td>
      <td>(StrOpt) Authorization URL for connecting to nova in admin context</td>
    </tr>
    <tr>
-      <td>nova_admin_password = None</td>
+      <td>[DEFAULT] nova_admin_password = None</td>
      <td>(StrOpt) Password for connection to nova in admin context</td>
    </tr>
    <tr>
-      <td>nova_admin_tenant_id = None</td>
+      <td>[DEFAULT] nova_admin_tenant_id = None</td>
      <td>(StrOpt) The uuid of the admin nova tenant</td>
    </tr>
    <tr>
-      <td>nova_admin_username = None</td>
+      <td>[DEFAULT] nova_admin_username = None</td>
      <td>(StrOpt) Username for connecting to nova in admin context</td>
    </tr>
    <tr>
-      <td>nova_region_name = None</td>
+      <td>[DEFAULT] nova_region_name = None</td>
      <td>(StrOpt) Name of nova region to use. Useful if keystone manages more than one region.</td>
    </tr>
    <tr>
-      <td>nova_url = http://127.0.0.1:8774/v2</td>
+      <td>[DEFAULT] nova_url = http://127.0.0.1:8774/v2</td>
      <td>(StrOpt) URL for connection to nova</td>
    </tr>
    <tr>
-      <td>nsx_controllers = None</td>
+      <td>[DEFAULT] nsx_controllers = None</td>
      <td>(ListOpt) Lists the NSX controllers in this cluster</td>
    </tr>
    <tr>
-      <td>nsx_password = admin</td>
+      <td>[DEFAULT] nsx_password = admin</td>
      <td>(StrOpt) Password for NSX controllers in this cluster</td>
    </tr>
    <tr>
-      <td>nsx_user = admin</td>
+      <td>[DEFAULT] nsx_user = admin</td>
      <td>(StrOpt) User name for NSX controllers in this cluster</td>
    </tr>
    <tr>
-      <td>ofp_listen_host = </td>
+      <td>[DEFAULT] ofp_listen_host = </td>
      <td>(StrOpt) openflow listen host</td>
    </tr>
    <tr>
-      <td>ofp_ssl_listen_port = 6633</td>
+      <td>[DEFAULT] ofp_ssl_listen_port = 6633</td>
      <td>(IntOpt) openflow ssl listen port</td>
    </tr>
    <tr>
-      <td>ofp_tcp_listen_port = 6633</td>
+      <td>[DEFAULT] ofp_tcp_listen_port = 6633</td>
      <td>(IntOpt) openflow tcp listen port</td>
    </tr>
    <tr>
-      <td>ovs_vsctl_timeout = 10</td>
+      <td>[DEFAULT] ovs_vsctl_timeout = 10</td>
      <td>(IntOpt) Timeout in seconds for ovs-vsctl commands</td>
    </tr>
    <tr>
-      <td>rpc_workers = 0</td>
+      <td>[DEFAULT] rpc_workers = 0</td>
      <td>(IntOpt) Number of RPC worker processes for service</td>
    </tr>
    <tr>
-      <td>send_events_interval = 2</td>
+      <td>[DEFAULT] send_events_interval = 2</td>
      <td>(IntOpt) Number of seconds between sending events to nova if there are any events to send.</td>
    </tr>
    <tr>
-      <td>AGENT/get_datapath_retry_times = 60</td>
+      <td>[DEFAULT] wsapi_host = </td>
      <td>(StrOpt) webapp listen host</td>
    </tr>
    <tr>
      <td>[DEFAULT] wsapi_port = 8080</td>
      <td>(IntOpt) webapp listen port</td>
    </tr>
    <tr>
      <td>[AGENT] get_datapath_retry_times = 60</td>
      <td>(IntOpt) Number of seconds to retry acquiring an Open vSwitch datapath</td>
    </tr>
    <tr>
-      <td>AGENT/integration_bridge = br-int</td>
+      <td>[AGENT] integration_bridge = br-int</td>
      <td>(StrOpt) integration bridge</td>
    </tr>
    <tr>
-      <td>CISCO/nexus_l3_enable = False</td>
+      <td>[CISCO] nexus_l3_enable = False</td>
      <td>(BoolOpt) Enable L3 support on the Nexus switches</td>
    </tr>
    <tr>
-      <td>ESWITCH/apply_profile_patch = False</td>
+      <td>[CISCO_N1K] http_timeout = 15</td>
      <td>(IntOpt) N1K http timeout duration in seconds</td>
    </tr>
    <tr>
      <td>[ESWITCH] apply_profile_patch = False</td>
      <td>(BoolOpt) Enable server compatibility with old nova</td>
    </tr>
    <tr>
-      <td>META/rpc_flavor = </td>
+      <td>[META] rpc_flavor = </td>
      <td>(StrOpt) Flavor of which plugin handles RPC</td>
    </tr>
    <tr>
-      <td>MLNX/physical_network_type = eth</td>
+      <td>[MLNX] physical_network_type = eth</td>
      <td>(StrOpt) Physical network type for provider network (eth or ib)</td>
    </tr>
    <tr>
-      <td>MLNX/physical_network_type_mappings = []</td>
+      <td>[MLNX] physical_network_type_mappings = []</td>
      <td>(ListOpt) List of &lt;physical_network&gt;:&lt;physical_network_type&gt;  with physical_network_type is either eth or ib</td>
    </tr>
    <tr>
-      <td>NOVA/node_override_vif_hostdev = []</td>
+      <td>[NOVA] node_override_vif_hostdev = []</td>
      <td>(ListOpt) Nova compute nodes to manually set VIF type to hostdev</td>
    </tr>
    <tr>
-      <td>NOVA/node_override_vif_midonet = []</td>
+      <td>[NOVA] node_override_vif_midonet = []</td>
      <td>(ListOpt) Nova compute nodes to manually set VIF type to midonet</td>
    </tr>
    <tr>
-      <td>NOVA/node_override_vif_mlnx_direct = []</td>
+      <td>[NOVA] node_override_vif_mlnx_direct = []</td>
      <td>(ListOpt) Nova compute nodes to manually set VIF type to mlnx_direct</td>
    </tr>
    <tr>
-      <td>NSX/agent_mode = agent</td>
+      <td>[NSX] agent_mode = agent</td>
      <td>(StrOpt) The mode used to implement DHCP/metadata services.</td>
    </tr>
    <tr>
-      <td>NSX/concurrent_connections = 10</td>
+      <td>[NSX] concurrent_connections = 10</td>
      <td>(IntOpt) Maximum concurrent connections to each NSX controller.</td>
    </tr>
    <tr>
-      <td>NSX/default_transport_type = stt</td>
+      <td>[NSX] default_transport_type = stt</td>
      <td>(StrOpt) The default network tranport type to use (stt, gre, bridge, ipsec_gre, or ipsec_stt)</td>
    </tr>
    <tr>
-      <td>NSX/max_lp_per_bridged_ls = 5000</td>
+      <td>[NSX] max_lp_per_bridged_ls = 5000</td>
      <td>(IntOpt) Maximum number of ports of a logical switch on a bridged transport zone (default 5000)</td>
    </tr>
    <tr>
-      <td>NSX/max_lp_per_overlay_ls = 256</td>
+      <td>[NSX] max_lp_per_overlay_ls = 256</td>
      <td>(IntOpt) Maximum number of ports of a logical switch on an overlay transport zone (default 256)</td>
    </tr>
    <tr>
-      <td>NSX/metadata_mode = access_network</td>
+      <td>[NSX] metadata_mode = access_network</td>
      <td>(StrOpt) If set to access_network this enables a dedicated connection to the metadata proxy for metadata server access via Neutron router. If set to dhcp_host_route this enables host route injection via the dhcp agent. This option is only useful if running on a host that does not support namespaces otherwise access_network should be used.</td>
    </tr>
    <tr>
-      <td>NSX/nsx_gen_timeout = -1</td>
+      <td>[NSX] nsx_gen_timeout = -1</td>
      <td>(IntOpt) Number of seconds a generation id should be valid for (default -1 meaning do not time out)</td>
    </tr>
    <tr>
-      <td>NSX/replication_mode = service</td>
+      <td>[NSX] replication_mode = service</td>
      <td>(StrOpt) The default option leverages service nodes to perform packet replication though one could set to this to 'source' to perform replication locally. This is useful if one does not want to deploy a service node(s).</td>
    </tr>
    <tr>
-      <td>NSX_DHCP/default_lease_time = 43200</td>
+      <td>[NSX_DHCP] default_lease_time = 43200</td>
      <td>(IntOpt) Default DHCP lease time</td>
    </tr>
    <tr>
-      <td>NSX_DHCP/domain_name = openstacklocal</td>
+      <td>[NSX_DHCP] domain_name = openstacklocal</td>
      <td>(StrOpt) Domain to use for building the hostnames</td>
    </tr>
    <tr>
-      <td>NSX_DHCP/extra_domain_name_servers = []</td>
+      <td>[NSX_DHCP] extra_domain_name_servers = []</td>
      <td>(ListOpt) Comma separated list of additional domain name servers</td>
    </tr>
    <tr>
-      <td>NSX_LSN/sync_on_missing_data = False</td>
+      <td>[NSX_LSN] sync_on_missing_data = False</td>
      <td>(BoolOpt) Pull LSN information from NSX in case it is missing from the local data store. This is useful to rebuild the local store in case of server recovery.</td>
    </tr>
    <tr>
-      <td>NSX_METADATA/metadata_server_address = 127.0.0.1</td>
+      <td>[NSX_METADATA] metadata_server_address = 127.0.0.1</td>
      <td>(StrOpt) IP address used by Metadata server.</td>
    </tr>
    <tr>
-      <td>NSX_METADATA/metadata_server_port = 8775</td>
+      <td>[NSX_METADATA] metadata_server_port = 8775</td>
      <td>(IntOpt) TCP Port used by Metadata server.</td>
    </tr>
    <tr>
-      <td>NSX_METADATA/metadata_shared_secret = </td>
+      <td>[NSX_METADATA] metadata_shared_secret = </td>
      <td>(StrOpt) Shared secret to sign instance-id request</td>
    </tr>
    <tr>
-      <td>NSX_SYNC/always_read_status = False</td>
+      <td>[NSX_SYNC] always_read_status = False</td>
      <td>(BoolOpt) Always read operational status from backend on show operations. Enabling this option might slow down the system.</td>
    </tr>
    <tr>
-      <td>NSX_SYNC/max_random_sync_delay = 0</td>
+      <td>[NSX_SYNC] max_random_sync_delay = 0</td>
      <td>(IntOpt) Maximum value for the additional random delay in seconds between runs of the state synchronization task</td>
    </tr>
    <tr>
-      <td>NSX_SYNC/min_chunk_size = 500</td>
+      <td>[NSX_SYNC] min_chunk_size = 500</td>
      <td>(IntOpt) Minimum number of resources to be retrieved from NSX during state synchronization</td>
    </tr>
    <tr>
-      <td>NSX_SYNC/min_sync_req_delay = 1</td>
+      <td>[NSX_SYNC] min_sync_req_delay = 1</td>
      <td>(IntOpt) Minimum delay, in seconds, between two state synchronization queries to NSX. It must not exceed state_sync_interval</td>
    </tr>
    <tr>
-      <td>NSX_SYNC/state_sync_interval = 10</td>
+      <td>[NSX_SYNC] state_sync_interval = 10</td>
      <td>(IntOpt) Interval in seconds between runs of the state synchronization task. Set it to 0 to disable it</td>
    </tr>
    <tr>
-      <td>OFC/api_max_attempts = 3</td>
+      <td>[OFC] api_max_attempts = 3</td>
      <td>(IntOpt) Maximum attempts per OFC API request.NEC plugin retries API request to OFC when OFC returns ServiceUnavailable (503).The value must be greater than 0.</td>
    </tr>
    <tr>
-      <td>OFC/insecure_ssl = False</td>
+      <td>[OFC] insecure_ssl = False</td>
      <td>(BoolOpt) Disable SSL certificate verification</td>
    </tr>
    <tr>
-      <td>OFC/path_prefix = </td>
+      <td>[OFC] path_prefix = </td>
      <td>(StrOpt) Base URL of OFC REST API. It is prepended to each API request.</td>
    </tr>
    <tr>
-      <td>QUOTAS/quota_health_monitor = -1</td>
+      <td>[QUOTAS] quota_health_monitor = -1</td>
      <td>(IntOpt) Number of health monitors allowed per tenant. A negative value means unlimited.</td>
    </tr>
    <tr>
-      <td>QUOTAS/quota_member = -1</td>
+      <td>[QUOTAS] quota_member = -1</td>
      <td>(IntOpt) Number of pool members allowed per tenant. A negative value means unlimited.</td>
    </tr>
    <tr>
-      <td>QUOTAS/quota_pool = 10</td>
+      <td>[QUOTAS] quota_pool = 10</td>
      <td>(IntOpt) Number of pools allowed per tenant. A negative value means unlimited.</td>
    </tr>
    <tr>
-      <td>QUOTAS/quota_vip = 10</td>
+      <td>[QUOTAS] quota_vip = 10</td>
      <td>(IntOpt) Number of vips allowed per tenant. A negative value means unlimited.</td>
    </tr>
    <tr>
-      <td>RESTPROXY/auth_resource = </td>
+      <td>[RESTPROXY] auth_resource = </td>
      <td>(StrOpt) Nuage provided uri for initial authorization to access VSD</td>
    </tr>
    <tr>
-      <td>RESTPROXY/auto_sync_on_failure = True</td>
+      <td>[RESTPROXY] auto_sync_on_failure = True</td>
      <td>(BoolOpt) If neutron fails to create a resource because the backend controller doesn't know of a dependency, the plugin automatically triggers a full data synchronization to the controller.</td>
    </tr>
    <tr>
-      <td>RESTPROXY/base_uri = /</td>
+      <td>[RESTPROXY] base_uri = /</td>
      <td>(StrOpt) Nuage provided base uri to reach out to VSD</td>
    </tr>
    <tr>
-      <td>RESTPROXY/cache_connections = True</td>
+      <td>[RESTPROXY] cache_connections = True</td>
      <td>(BoolOpt) Re-use HTTP/HTTPS connections to the controller.</td>
    </tr>
    <tr>
-      <td>RESTPROXY/consistency_interval = 60</td>
+      <td>[RESTPROXY] consistency_interval = 60</td>
      <td>(IntOpt) Time between verifications that the backend controller database is consistent with Neutron</td>
    </tr>
    <tr>
-      <td>RESTPROXY/default_floatingip_quota = 254</td>
+      <td>[RESTPROXY] default_floatingip_quota = 254</td>
      <td>(IntOpt) Per Net Partition quota of floating ips</td>
    </tr>
    <tr>
-      <td>RESTPROXY/default_net_partition_name = OpenStackDefaultNetPartition</td>
+      <td>[RESTPROXY] default_net_partition_name = OpenStackDefaultNetPartition</td>
      <td>(StrOpt) Default Network partition in which VSD will orchestrate network resources using openstack</td>
    </tr>
    <tr>
-      <td>RESTPROXY/no_ssl_validation = False</td>
+      <td>[RESTPROXY] no_ssl_validation = False</td>
      <td>(BoolOpt) Disables SSL certificate validation for controllers</td>
    </tr>
    <tr>
-      <td>RESTPROXY/organization = system</td>
+      <td>[RESTPROXY] organization = system</td>
      <td>(StrOpt) Organization name in which VSD will orchestrate network resources using openstack</td>
    </tr>
    <tr>
-      <td>RESTPROXY/server = localhost:8800</td>
+      <td>[RESTPROXY] server = localhost:8800</td>
      <td>(StrOpt) IP Address and Port of Nuage's VSD server</td>
    </tr>
    <tr>
-      <td>RESTPROXY/serverauth = username:password</td>
+      <td>[RESTPROXY] serverauth = username:password</td>
      <td>(StrOpt) Username and password for authentication</td>
    </tr>
    <tr>
-      <td>RESTPROXY/serverssl = False</td>
+      <td>[RESTPROXY] serverssl = False</td>
      <td>(BoolOpt) Boolean for SSL connection with VSD server</td>
    </tr>
    <tr>
-      <td>RESTPROXY/ssl_cert_directory = /etc/neutron/plugins/bigswitch/ssl</td>
+      <td>[RESTPROXY] ssl_cert_directory = /etc/neutron/plugins/bigswitch/ssl</td>
      <td>(StrOpt) Directory containing ca_certs and host_certs certificate directories.</td>
    </tr>
    <tr>
-      <td>RESTPROXY/ssl_sticky = True</td>
+      <td>[RESTPROXY] ssl_sticky = True</td>
      <td>(BoolOpt) Trust and store the first certificate received for each controller address and use it to validate future connections to that address.</td>
    </tr>
    <tr>
-      <td>RESTPROXY/thread_pool_size = 4</td>
+      <td>[RESTPROXY] thread_pool_size = 4</td>
      <td>(IntOpt) Maximum number of threads to spawn to handle large volumes of port creations.</td>
    </tr>
    <tr>
-      <td>RESTPROXYAGENT/integration_bridge = br-int</td>
+      <td>[RESTPROXYAGENT] integration_bridge = br-int</td>
      <td>(StrOpt) Name of integration bridge on compute nodes used for security group insertion.</td>
    </tr>
    <tr>
-      <td>RESTPROXYAGENT/polling_interval = 5</td>
+      <td>[RESTPROXYAGENT] polling_interval = 5</td>
      <td>(IntOpt) Seconds between agent checks for port changes</td>
    </tr>
    <tr>
-      <td>RESTPROXYAGENT/virtual_switch_type = ovs</td>
+      <td>[RESTPROXYAGENT] virtual_switch_type = ovs</td>
      <td>(StrOpt) Virtual switch type.</td>
    </tr>
    <tr>
-      <td>SDNVE/base_url = /one/nb/v2/</td>
+      <td>[SDNVE] base_url = /one/nb/v2/</td>
      <td>(StrOpt) Base URL for SDN-VE controller REST API</td>
    </tr>
    <tr>
-      <td>SDNVE/controller_ips = ['127.0.0.1']</td>
+      <td>[SDNVE] controller_ips = ['127.0.0.1']</td>
      <td>(ListOpt) List of IP addresses of SDN-VE controller(s)</td>
    </tr>
    <tr>
-      <td>SDNVE/default_tenant_type = OF</td>
+      <td>[SDNVE] default_tenant_type = OF</td>
      <td>(StrOpt) Tenant type: OF (default) and OVERLAY</td>
    </tr>
    <tr>
-      <td>SDNVE/format = json</td>
+      <td>[SDNVE] format = json</td>
      <td>(StrOpt) SDN-VE request/response format</td>
    </tr>
    <tr>
-      <td>SDNVE/info = sdnve_info_string</td>
+      <td>[SDNVE] info = sdnve_info_string</td>
      <td>(StrOpt) SDN-VE RPC subject</td>
    </tr>
    <tr>
-      <td>SDNVE/integration_bridge = None</td>
+      <td>[SDNVE] integration_bridge = None</td>
      <td>(StrOpt) Integration bridge to use</td>
    </tr>
    <tr>
-      <td>SDNVE/interface_mappings = []</td>
+      <td>[SDNVE] interface_mappings = []</td>
      <td>(ListOpt) List of &lt;physical_network_name&gt;:&lt;interface_name&gt;</td>
    </tr>
    <tr>
-      <td>SDNVE/of_signature = SDNVE-OF</td>
+      <td>[SDNVE] of_signature = SDNVE-OF</td>
      <td>(StrOpt) The string in tenant description that indicates the tenant is a OF tenant</td>
    </tr>
    <tr>
-      <td>SDNVE/out_of_band = True</td>
+      <td>[SDNVE] out_of_band = True</td>
      <td>(BoolOpt) Indicating if controller is out of band or not</td>
    </tr>
    <tr>
-      <td>SDNVE/overlay_signature = SDNVE-OVERLAY</td>
+      <td>[SDNVE] overlay_signature = SDNVE-OVERLAY</td>
      <td>(StrOpt) The string in tenant description that indicates the tenant is a OVERLAY tenant</td>
    </tr>
    <tr>
-      <td>SDNVE/password = admin</td>
+      <td>[SDNVE] password = admin</td>
      <td>(StrOpt) SDN-VE administrator password</td>
    </tr>
    <tr>
-      <td>SDNVE/port = 8443</td>
+      <td>[SDNVE] port = 8443</td>
      <td>(StrOpt) SDN-VE controller port number</td>
    </tr>
    <tr>
-      <td>SDNVE/reset_bridge = True</td>
+      <td>[SDNVE] reset_bridge = True</td>
      <td>(BoolOpt) Reset the integration bridge before use</td>
    </tr>
    <tr>
-      <td>SDNVE/use_fake_controller = False</td>
+      <td>[SDNVE] use_fake_controller = False</td>
      <td>(BoolOpt) If set to True uses a fake controller.</td>
    </tr>
    <tr>
-      <td>SDNVE/userid = admin</td>
+      <td>[SDNVE] userid = admin</td>
      <td>(StrOpt) SDN-VE administrator user id</td>
    </tr>
    <tr>
-      <td>SDNVE_AGENT/polling_interval = 2</td>
+      <td>[SDNVE_AGENT] polling_interval = 2</td>
      <td>(IntOpt) Agent polling interval if necessary</td>
    </tr>
    <tr>
-      <td>SDNVE_AGENT/root_helper = sudo</td>
+      <td>[SDNVE_AGENT] root_helper = sudo</td>
      <td>(StrOpt) Using root helper</td>
    </tr>
    <tr>
-      <td>SDNVE_AGENT/rpc = True</td>
+      <td>[SDNVE_AGENT] rpc = True</td>
      <td>(BoolOpt) Whether using rpc</td>
    </tr>
    <tr>
-      <td>SECURITYGROUP/enable_security_group = True</td>
+      <td>[SECURITYGROUP] enable_security_group = True</td>
      <td>(BoolOpt) Controls whether the neutron security group API is enabled in the server. It should be false when using no security groups or using the nova security group API.</td>
    </tr>
    <tr>
-      <td>audit/api_audit_map = api_audit_map.conf</td>
+      <td>[audit] api_audit_map = api_audit_map.conf</td>
      <td>(StrOpt) File containing mapping for api paths and service endpoints</td>
    </tr>
    <tr>
-      <td>audit/namespace = openstack</td>
+      <td>[audit] namespace = openstack</td>
      <td>(StrOpt) namespace prefix for generated id</td>
    </tr>
    <tr>
-      <td>cisco_csr_ipsec/status_check_interval = 60</td>
+      <td>[cisco_csr_ipsec] status_check_interval = 60</td>
      <td>(IntOpt) Status check interval for Cisco CSR IPSec connections</td>
    </tr>
    <tr>
-      <td>database/db_inc_retry_interval = True</td>
+      <td>[database] db_inc_retry_interval = True</td>
      <td>(BoolOpt) Whether to increase interval between db connection retries, up to db_max_retry_interval</td>
    </tr>
    <tr>
-      <td>database/db_max_retries = 20</td>
+      <td>[database] db_max_retries = 20</td>
      <td>(IntOpt) maximum db connection retries before error is raised. (setting -1 implies an infinite retry count)</td>
    </tr>
    <tr>
-      <td>database/db_max_retry_interval = 10</td>
+      <td>[database] db_max_retry_interval = 10</td>
      <td>(IntOpt) max seconds between db connection retries, if db_inc_retry_interval is enabled</td>
    </tr>
    <tr>
-      <td>database/db_retry_interval = 1</td>
+      <td>[database] db_retry_interval = 1</td>
      <td>(IntOpt) seconds between db connection retries</td>
    </tr>
    <tr>
-      <td>database/use_db_reconnect = False</td>
+      <td>[database] use_db_reconnect = False</td>
      <td>(BoolOpt) Enable the experimental use of database reconnect on connection lost</td>
    </tr>
    <tr>
-      <td>haproxy/loadbalancer_state_path = $state_path/lbaas</td>
+      <td>[haproxy] loadbalancer_state_path = $state_path/lbaas</td>
      <td>(StrOpt) Location to store config and state files</td>
    </tr>
    <tr>
-      <td>haproxy/user_group = nogroup</td>
+      <td>[haproxy] user_group = nogroup</td>
      <td>(StrOpt) The user group</td>
    </tr>
    <tr>
-      <td>heleoslb/admin_password = None</td>
+      <td>[heleoslb] admin_password = None</td>
      <td>(StrOpt) ESM admin password.</td>
    </tr>
    <tr>
-      <td>heleoslb/admin_username = None</td>
+      <td>[heleoslb] admin_username = None</td>
      <td>(StrOpt) ESM admin username.</td>
    </tr>
    <tr>
-      <td>heleoslb/async_requests = None</td>
+      <td>[heleoslb] async_requests = None</td>
      <td>(BoolOpt) Define if the requests have run asynchronously or not</td>
    </tr>
    <tr>
-      <td>heleoslb/dummy_utif_id = None</td>
+      <td>[heleoslb] dummy_utif_id = None</td>
      <td>(StrOpt) Dummy user traffic Security Zone id for LBs</td>
    </tr>
    <tr>
-      <td>heleoslb/esm_mgmt = None</td>
+      <td>[heleoslb] esm_mgmt = None</td>
      <td>(StrOpt) ESM management root address</td>
    </tr>
    <tr>
-      <td>heleoslb/inband_id = None</td>
+      <td>[heleoslb] inband_id = None</td>
      <td>(StrOpt) In band Security Zone id for LBs</td>
    </tr>
    <tr>
-      <td>heleoslb/lb_flavor = small</td>
+      <td>[heleoslb] lb_flavor = small</td>
      <td>(StrOpt) choose LB image flavor to use, accepted values: small, medium</td>
    </tr>
    <tr>
-      <td>heleoslb/lb_image = None</td>
+      <td>[heleoslb] lb_image = None</td>
      <td>(StrOpt) Load Balancer image id (Embrane LB)</td>
    </tr>
    <tr>
-      <td>heleoslb/mgmt_id = None</td>
+      <td>[heleoslb] mgmt_id = None</td>
      <td>(StrOpt) Management Security Zone id for LBs</td>
    </tr>
    <tr>
-      <td>heleoslb/oob_id = None</td>
+      <td>[heleoslb] oob_id = None</td>
      <td>(StrOpt) Out of band Security Zone id for LBs</td>
    </tr>
    <tr>
-      <td>heleoslb/resource_pool_id = None</td>
+      <td>[heleoslb] resource_pool_id = None</td>
      <td>(StrOpt) Shared resource pool id</td>
    </tr>
    <tr>
-      <td>heleoslb/sync_interval = 60</td>
+      <td>[heleoslb] sync_interval = 60</td>
      <td>(IntOpt) resource synchronization interval in seconds</td>
    </tr>
    <tr>
-      <td>ml2_brocade/address = </td>
+      <td>[ml2_brocade] address = </td>
      <td>(StrOpt) The address of the host to SSH to</td>
    </tr>
    <tr>
-      <td>ml2_brocade/ostype = NOS</td>
+      <td>[ml2_brocade] ostype = NOS</td>
-      <td>(StrOpt) Unused</td>
+      <td>(StrOpt) OS Type of the switch</td>
    </tr>
    <tr>
-      <td>ml2_brocade/password = password</td>
+      <td>[ml2_brocade] osversion = 4.0.0</td>
      <td>(StrOpt) OS Version number</td>
    </tr>
    <tr>
      <td>[ml2_brocade] password = password</td>
      <td>(StrOpt) The SSH password to use</td>
    </tr>
    <tr>
-      <td>ml2_brocade/physical_networks = </td>
+      <td>[ml2_brocade] physical_networks = </td>
      <td>(StrOpt) Allowed physical networks</td>
    </tr>
    <tr>
-      <td>ml2_brocade/username = admin</td>
+      <td>[ml2_brocade] username = admin</td>
      <td>(StrOpt) The SSH username to use</td>
    </tr>
    <tr>
-      <td>ml2_odl/password = None</td>
+      <td>[ml2_odl] password = None</td>
      <td>(StrOpt) HTTP password for authentication</td>
    </tr>
    <tr>
-      <td>ml2_odl/session_timeout = 30</td>
+      <td>[ml2_odl] session_timeout = 30</td>
      <td>(IntOpt) Tomcat session timeout in minutes.</td>
    </tr>
    <tr>
-      <td>ml2_odl/timeout = 10</td>
+      <td>[ml2_odl] timeout = 10</td>
      <td>(IntOpt) HTTP timeout in seconds.</td>
    </tr>
    <tr>
-      <td>ml2_odl/url = None</td>
+      <td>[ml2_odl] url = None</td>
      <td>(StrOpt) HTTP URL of OpenDaylight REST interface.</td>
    </tr>
    <tr>
-      <td>ml2_odl/username = None</td>
+      <td>[ml2_odl] username = None</td>
      <td>(StrOpt) HTTP username for authentication</td>
    </tr>
    <tr>
-      <td>netscaler_driver/netscaler_ncc_password = None</td>
+      <td>[netscaler_driver] netscaler_ncc_password = None</td>
      <td>(StrOpt) Password to login to the NetScaler Control Center Server.</td>
    </tr>
    <tr>
-      <td>netscaler_driver/netscaler_ncc_uri = None</td>
+      <td>[netscaler_driver] netscaler_ncc_uri = None</td>
      <td>(StrOpt) The URL to reach the NetScaler Control Center Server.</td>
    </tr>
    <tr>
-      <td>netscaler_driver/netscaler_ncc_username = None</td>
+      <td>[netscaler_driver] netscaler_ncc_username = None</td>
      <td>(StrOpt) Username to login to the NetScaler Control Center Server.</td>
    </tr>
    <tr>
-      <td>nvsd/nvsd_ip = 127.0.0.1</td>
+      <td>[nvsd] nvsd_ip = 127.0.0.1</td>
      <td>(StrOpt) NVSD Controller IP address</td>
    </tr>
    <tr>
-      <td>nvsd/nvsd_passwd = oc123</td>
+      <td>[nvsd] nvsd_passwd = oc123</td>
      <td>(StrOpt) NVSD Controller password</td>
    </tr>
    <tr>
-      <td>nvsd/nvsd_port = 8082</td>
+      <td>[nvsd] nvsd_port = 8082</td>
      <td>(IntOpt) NVSD Controller Port number</td>
    </tr>
    <tr>
-      <td>nvsd/nvsd_retries = 0</td>
+      <td>[nvsd] nvsd_retries = 0</td>
      <td>(IntOpt) Number of login retries to NVSD controller</td>
    </tr>
    <tr>
-      <td>nvsd/nvsd_user = ocplugin</td>
+      <td>[nvsd] nvsd_user = ocplugin</td>
      <td>(StrOpt) NVSD Controller username</td>
    </tr>
    <tr>
-      <td>nvsd/request_timeout = 30</td>
+      <td>[nvsd] request_timeout = 30</td>
      <td>(IntOpt) NVSD controller REST API request timeout in seconds</td>
    </tr>
    <tr>
-      <td>plumgriddirector/director_server = localhost</td>
+      <td>[plumgriddirector] director_server = localhost</td>
      <td>(StrOpt) PLUMgrid Director server to connect to</td>
    </tr>
    <tr>
-      <td>plumgriddirector/director_server_port = 8080</td>
+      <td>[plumgriddirector] director_server_port = 8080</td>
      <td>(StrOpt) PLUMgrid Director server port to connect to</td>
    </tr>
    <tr>
-      <td>plumgriddirector/password = password</td>
+      <td>[plumgriddirector] password = password</td>
      <td>(StrOpt) PLUMgrid Director admin password</td>
    </tr>
    <tr>
-      <td>plumgriddirector/servertimeout = 5</td>
+      <td>[plumgriddirector] servertimeout = 5</td>
      <td>(IntOpt) PLUMgrid Director server timeout</td>
    </tr>
    <tr>
-      <td>plumgriddirector/username = username</td>
+      <td>[plumgriddirector] username = username</td>
      <td>(StrOpt) PLUMgrid Director admin username</td>
    </tr>
    <tr>
-      <td>radware/actions_to_skip = ['setup_l2_l3']</td>
+      <td>[radware] actions_to_skip = ['setup_l2_l3']</td>
      <td>(ListOpt) List of actions that we dont want to push to the completion queue</td>
    </tr>
    <tr>
-      <td>radware/l2_l3_ctor_params = {'ha_ip_pool_name': 'default', 'allocate_ha_vrrp': True, 'ha_network_name': 'HA-Network', 'service': '_REPLACE_', 'allocate_ha_ips': True}</td>
+      <td>[radware] l2_l3_ctor_params = {'ha_ip_pool_name': 'default', 'allocate_ha_vrrp': True, 'ha_network_name': 'HA-Network', 'service': '_REPLACE_', 'allocate_ha_ips': True}</td>
      <td>(DictOpt) l2_l3 workflow constructor params</td>
    </tr>
    <tr>
-      <td>radware/l2_l3_setup_params = {'data_ip_address': '192.168.200.99', 'data_port': 1, 'gateway': '192.168.200.1', 'ha_port': 2, 'data_ip_mask': '255.255.255.0'}</td>
+      <td>[radware] l2_l3_setup_params = {'data_ip_address': '192.168.200.99', 'data_port': 1, 'gateway': '192.168.200.1', 'ha_port': 2, 'data_ip_mask': '255.255.255.0'}</td>
      <td>(DictOpt) l2_l3 workflow setup params</td>
    </tr>
    <tr>
-      <td>radware/l2_l3_workflow_name = openstack_l2_l3</td>
+      <td>[radware] l2_l3_workflow_name = openstack_l2_l3</td>
      <td>(StrOpt) l2_l3 workflow name</td>
    </tr>
    <tr>
-      <td>radware/l4_action_name = BaseCreate</td>
+      <td>[radware] l4_action_name = BaseCreate</td>
      <td>(StrOpt) l4 workflow action name</td>
    </tr>
    <tr>
-      <td>radware/l4_workflow_name = openstack_l4</td>
+      <td>[radware] l4_workflow_name = openstack_l4</td>
      <td>(StrOpt) l4 workflow name</td>
    </tr>
    <tr>
-      <td>radware/service_adc_type = VA</td>
+      <td>[radware] service_adc_type = VA</td>
      <td>(StrOpt) Service ADC type</td>
    </tr>
    <tr>
-      <td>radware/service_adc_version = </td>
+      <td>[radware] service_adc_version = </td>
      <td>(StrOpt) Service ADC version</td>
    </tr>
    <tr>
-      <td>radware/service_cache = 20</td>
+      <td>[radware] service_cache = 20</td>
      <td>(IntOpt) service cache</td>
    </tr>
    <tr>
-      <td>radware/service_compression_throughput = 100</td>
+      <td>[radware] service_compression_throughput = 100</td>
      <td>(IntOpt) service compression throughtput</td>
    </tr>
    <tr>
-      <td>radware/service_ha_pair = False</td>
+      <td>[radware] service_ha_pair = False</td>
      <td>(BoolOpt) service HA pair</td>
    </tr>
    <tr>
-      <td>radware/service_isl_vlan = -1</td>
+      <td>[radware] service_isl_vlan = -1</td>
      <td>(IntOpt) A required VLAN for the interswitch link to use</td>
    </tr>
    <tr>
-      <td>radware/service_resource_pool_ids = []</td>
+      <td>[radware] service_resource_pool_ids = []</td>
      <td>(ListOpt) Resource pool ids</td>
    </tr>
    <tr>
-      <td>radware/service_session_mirroring_enabled = False</td>
+      <td>[radware] service_session_mirroring_enabled = False</td>
      <td>(BoolOpt) Support an Alteon interswitch link for stateful session failover</td>
    </tr>
    <tr>
-      <td>radware/service_ssl_throughput = 100</td>
+      <td>[radware] service_ssl_throughput = 100</td>
      <td>(IntOpt) service ssl throughtput</td>
    </tr>
    <tr>
-      <td>radware/service_throughput = 1000</td>
+      <td>[radware] service_throughput = 1000</td>
      <td>(IntOpt) service throughtput</td>
    </tr>
    <tr>
-      <td>radware/vdirect_address = None</td>
+      <td>[radware] vdirect_address = None</td>
      <td>(StrOpt) vdirect server IP address</td>
    </tr>
    <tr>
-      <td>radware/vdirect_password = radware</td>
+      <td>[radware] vdirect_password = radware</td>
      <td>(StrOpt) vdirect user password</td>
    </tr>
    <tr>
-      <td>radware/vdirect_user = vDirect</td>
+      <td>[radware] vdirect_user = vDirect</td>
      <td>(StrOpt) vdirect user name</td>
    </tr>
    <tr>
-      <td>ssl/ca_file = None</td>
+      <td>[ssl] ca_file = None</td>
      <td>(StrOpt) CA certificate file to use to verify connecting clients</td>
    </tr>
    <tr>
-      <td>ssl/cert_file = None</td>
+      <td>[ssl] cert_file = None</td>
      <td>(StrOpt) Certificate file to use when starting the server securely</td>
    </tr>
    <tr>
-      <td>ssl/key_file = None</td>
+      <td>[ssl] key_file = None</td>
      <td>(StrOpt) Private key file to use when starting the server securely</td>
    </tr>
  </table>
@ -710,57 +726,57 @@
      </tr>
    </thead>
    <tr>
-      <td>allowed_rpc_exception_modules</td>
+      <td>[DEFAULT] allowed_rpc_exception_modules</td>
      <td>neutron.openstack.common.exception, nova.exception, cinder.exception, exceptions</td>
      <td>nova.exception, cinder.exception, exceptions</td>
    </tr>
    <tr>
-      <td>default_log_levels</td>
+      <td>[DEFAULT] default_log_levels</td>
      <td>amqp=WARN, amqplib=WARN, boto=WARN, eventlet.wsgi.server=WARN, keystone=INFO, qpid=WARN, sqlalchemy=WARN, suds=INFO</td>
      <td>amqp=WARN, amqplib=WARN, boto=WARN, qpid=WARN, sqlalchemy=WARN, suds=INFO, iso8601=WARN</td>
    </tr>
    <tr>
-      <td>device_driver</td>
+      <td>[DEFAULT] device_driver</td>
      <td>neutron.services.loadbalancer.drivers.haproxy.namespace_driver.HaproxyNSDriver</td>
      <td>neutron.services.loadbalancer.drivers.haproxy.namespace_driver.HaproxyNSDriver</td>
    </tr>
    <tr>
-      <td>logging_context_format_string</td>
+      <td>[DEFAULT] logging_context_format_string</td>
      <td>%(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user)s %(tenant)s] %(instance)s%(message)s</td>
      <td>%(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user_identity)s] %(instance)s%(message)s</td>
    </tr>
    <tr>
-      <td>AGENT/minimize_polling</td>
+      <td>[AGENT] minimize_polling</td>
      <td>False</td>
      <td>True</td>
    </tr>
    <tr>
-      <td>NOVA/vif_types</td>
+      <td>[NOVA] vif_types</td>
      <td>unbound, binding_failed, ovs, ivs, bridge, 802.1qbg, 802.1qbh, hyperv, other</td>
      <td>unbound, binding_failed, ovs, ivs, bridge, 802.1qbg, 802.1qbh, hyperv, midonet, mlnx_direct, hostdev, other</td>
    </tr>
    <tr>
-      <td>RESTPROXY/server_auth</td>
+      <td>[RESTPROXY] server_auth</td>
      <td>username:password</td>
      <td>None</td>
    </tr>
    <tr>
-      <td>RESTPROXY/server_ssl</td>
+      <td>[RESTPROXY] server_ssl</td>
      <td>False</td>
      <td>True</td>
    </tr>
    <tr>
-      <td>RESTPROXY/servers</td>
+      <td>[RESTPROXY] servers</td>
      <td>localhost:8800</td>
      <td>localhost:8800</td>
    </tr>
    <tr>
-      <td>SECURITYGROUP/firewall_driver</td>
+      <td>[SECURITYGROUP] firewall_driver</td>
      <td>neutron.agent.firewall.NoopFirewallDriver</td>
      <td>None</td>
    </tr>
    <tr>
-      <td>fwaas/driver</td>
+      <td>[fwaas] driver</td>
      <td>neutron.services.firewall.drivers.fwaas_base.NoopFwaasDriver</td>
      <td></td>
    </tr>
@ -776,36 +792,36 @@
      </tr>
    </thead>
    <tr>
-      <td>nvp_controllers</td>
+      <td>[DEFAULT] nvp_controllers</td>
-      <td>nsx_controllers</td>
+      <td>[DEFAULT] nsx_controllers</td>
    </tr>
    <tr>
-      <td>NVP/nvp_gen_timeout</td>
+      <td>[NVP] nvp_gen_timeout</td>
-      <td>NSX/nsx_gen_timeout</td>
+      <td>[NSX] nsx_gen_timeout</td>
    </tr>
    <tr>
-      <td>dnsmasq_dns_server</td>
+      <td>[DEFAULT] dnsmasq_dns_server</td>
-      <td>dnsmasq_dns_servers</td>
+      <td>[DEFAULT] dnsmasq_dns_servers</td>
    </tr>
    <tr>
-      <td>log_config</td>
+      <td>[DEFAULT] log_config</td>
-      <td>log_config_append</td>
+      <td>[DEFAULT] log_config_append</td>
    </tr>
    <tr>
-      <td>nvp_password</td>
+      <td>[DEFAULT] nvp_user</td>
-      <td>nsx_password</td>
+      <td>[DEFAULT] nsx_user</td>
    </tr>
    <tr>
-      <td>loadbalancer_state_path</td>
+      <td>[DEFAULT] nvp_password</td>
-      <td>haproxy/loadbalancer_state_path</td>
+      <td>[DEFAULT] nsx_password</td>
    </tr>
    <tr>
-      <td>user_group</td>
+      <td>[DEFAULT] loadbalancer_state_path</td>
-      <td>haproxy/user_group</td>
+      <td>[haproxy] loadbalancer_state_path</td>
    </tr>
    <tr>
-      <td>nvp_user</td>
+      <td>[DEFAULT] user_group</td>
-      <td>nsx_user</td>
+      <td>[haproxy] user_group</td>
    </tr>
  </table>
 </section>
--- a/doc/common/tables/nova-conf-changes-icehouse.xml
+++ b/doc/common/tables/nova-conf-changes-icehouse.xml
--- a/doc/common/tables/swift-conf-changes-icehouse.xml
+++ b/doc/common/tables/swift-conf-changes-icehouse.xml
@ -13,219 +13,221 @@
      </tr>
    </thead>
    <tr>
-      <td>container-sync-realms.conf: [DEFAULT]/mtime_check_interval = 300</td>
+      <td>container-sync-realms.conf: [DEFAULT] mtime_check_interval = 300</td>
      <td>(StrOpt) No help text available for this option.</td>
    </tr>
    <tr>
-      <td>container-sync-realms.conf: [realm1]/cluster_name1 = https://host1/v1/</td>
+      <td>container-sync-realms.conf: [realm1] cluster_name1 = https://host1/v1/</td>
      <td>(StrOpt) No help text available for this option.</td>
    </tr>
    <tr>
-      <td>container-sync-realms.conf: [realm1]/cluster_name2 = https://host2/v1/</td>
+      <td>container-sync-realms.conf: [realm1] cluster_name2 = https://host2/v1/</td>
      <td>(StrOpt) No help text available for this option.</td>
    </tr>
    <tr>
-      <td>container-sync-realms.conf: [realm1]/key = realm1key</td>
+      <td>container-sync-realms.conf: [realm1] key = realm1key</td>
      <td>(StrOpt) No help text available for this option.</td>
    </tr>
    <tr>
-      <td>container-sync-realms.conf: [realm1]/key2 = realm1key2</td>
+      <td>container-sync-realms.conf: [realm1] key2 = realm1key2</td>
      <td>(StrOpt) No help text available for this option.</td>
    </tr>
    <tr>
-      <td>container-sync-realms.conf: [realm2]/cluster_name3 = https://host3/v1/</td>
+      <td>container-sync-realms.conf: [realm2] cluster_name3 = https://host3/v1/</td>
      <td>(StrOpt) No help text available for this option.</td>
    </tr>
    <tr>
-      <td>container-sync-realms.conf: [realm2]/cluster_name4 = https://host4/v1/</td>
+      <td>container-sync-realms.conf: [realm2] cluster_name4 = https://host4/v1/</td>
      <td>(StrOpt) No help text available for this option.</td>
    </tr>
    <tr>
-      <td>container-sync-realms.conf: [realm2]/key = realm2key</td>
+      <td>container-sync-realms.conf: [realm2] key = realm2key</td>
      <td>(StrOpt) No help text available for this option.</td>
    </tr>
    <tr>
-      <td>container-sync-realms.conf: [realm2]/key2 = realm2key2</td>
+      <td>container-sync-realms.conf: [realm2] key2 = realm2key2</td>
      <td>(StrOpt) No help text available for this option.</td>
    </tr>
    <tr>
-      <td>dispersion.conf: [dispersion]/container_populate = yes</td>
+      <td>dispersion.conf: [dispersion] container_populate = yes</td>
      <td>(StrOpt) No help text available for this option.</td>
    </tr>
    <tr>
-      <td>dispersion.conf: [dispersion]/object_populate = yes</td>
+      <td>dispersion.conf: [dispersion] object_populate = yes</td>
      <td>(StrOpt) No help text available for this option.</td>
    </tr>
    <tr>
-      <td>memcache.conf: [memcache]/memcache_max_connections = 2</td>
+      <td>memcache.conf: [memcache] memcache_max_connections = 2</td>
      <td>(StrOpt) Max number of connections to each memcached server per worker services</td>
    </tr>
    <tr>
-      <td>object-expirer.conf: [object-expirer]/expiring_objects_account_name = expiring_objects</td>
+      <td>object-expirer.conf: [object-expirer] expiring_objects_account_name = expiring_objects</td>
      <td>(StrOpt) No help text available for this option.</td>
    </tr>
    <tr>
-      <td>object-server.conf: [DEFAULT]/client_timeout = 60</td>
+      <td>object-server.conf: [DEFAULT] client_timeout = 60</td>
      <td>(StrOpt) Timeout to read one chunk from a client external services</td>
    </tr>
    <tr>
-      <td>object-server.conf: [DEFAULT]/conn_timeout = 0.5</td>
+      <td>object-server.conf: [DEFAULT] conn_timeout = 0.5</td>
      <td>(StrOpt) Connection timeout to external services</td>
    </tr>
    <tr>
-      <td>object-server.conf: [DEFAULT]/disk_chunk_size = 65536</td>
+      <td>object-server.conf: [DEFAULT] disk_chunk_size = 65536</td>
      <td>(StrOpt) Size of chunks to read/write to disk</td>
    </tr>
    <tr>
-      <td>object-server.conf: [DEFAULT]/expiring_objects_account_name = expiring_objects</td>
+      <td>object-server.conf: [DEFAULT] expiring_objects_account_name = expiring_objects</td>
      <td>(StrOpt) No help text available for this option.</td>
    </tr>
    <tr>
-      <td>object-server.conf: [DEFAULT]/network_chunk_size = 65536</td>
+      <td>object-server.conf: [DEFAULT] network_chunk_size = 65536</td>
      <td>(StrOpt) Size of chunks to read/write over the network</td>
    </tr>
    <tr>
-      <td>object-server.conf: [DEFAULT]/node_timeout = 3</td>
+      <td>object-server.conf: [DEFAULT] node_timeout = 3</td>
      <td>(StrOpt) Request timeout to external services</td>
    </tr>
    <tr>
-      <td>object-server.conf: [app-object-server]/replication_concurrency = 4</td>
+      <td>object-server.conf: [app-object-server] replication_concurrency = 4</td>
      <td>(StrOpt) Set to restrict the number of concurrent incoming REPLICATION requests; set to 0 for unlimited</td>
    </tr>
    <tr>
-      <td>object-server.conf: [app-object-server]/replication_failure_ratio = 1.0</td>
+      <td>object-server.conf: [app-object-server] replication_failure_ratio = 1.0</td>
      <td>(StrOpt) If the value of failures / successes of REPLICATION subrequests exceeds this ratio, the overall REPLICATION request will be aborted</td>
    </tr>
    <tr>
-      <td>object-server.conf: [app-object-server]/replication_failure_threshold = 100</td>
+      <td>object-server.conf: [app-object-server] replication_failure_threshold = 100</td>
      <td>(StrOpt) The number of subrequest failures before the replication_failure_ratio is checked</td>
    </tr>
    <tr>
-      <td>object-server.conf: [app-object-server]/replication_lock_timeout = 15</td>
+      <td>object-server.conf: [app-object-server] replication_lock_timeout = 15</td>
      <td>(StrOpt) Number of seconds to wait for an existing replication device lock before giving up.</td>
    </tr>
    <tr>
-      <td>object-server.conf: [app-object-server]/replication_one_per_device = True</td>
+      <td>object-server.conf: [app-object-server] replication_one_per_device = True</td>
      <td>(StrOpt) Restricts incoming REPLICATION requests to one per device, replication_currency above allowing. This can help control I/O to each device, but you may wish to set this to False to allow multiple REPLICATION requests (up to the above replication_concurrency setting) per device.</td>
    </tr>
    <tr>
-      <td>object-server.conf: [object-replicator]/handoff_delete = auto</td>
+      <td>object-server.conf: [object-replicator] handoff_delete = auto</td>
      <td>(StrOpt) By default handoff partitions will be removed when it has successfully replicated to all the canonical nodes. If set to an integer n, it will remove the partition if it is successfully replicated to n nodes.  The default setting should not be changed, except for extremem situations. This uses what's set here, or what's set in the DEFAULT section, or 10 (though other sections use 3 as the final default).</td>
    </tr>
    <tr>
-      <td>object-server.conf: [object-replicator]/handoffs_first = False</td>
+      <td>object-server.conf: [object-replicator] handoffs_first = False</td>
      <td>(StrOpt) If set to True, partitions that are not supposed to be on the node will be replicated first.  The default setting should not be changed, except for extreme situations.</td>
    </tr>
    <tr>
-      <td>object-server.conf: [object-replicator]/node_timeout = &amp;lt;whatever's in the DEFAULT section or 10&amp;gt;</td>
+      <td>object-server.conf: [object-replicator] node_timeout = &lt;whatever's in the DEFAULT section or 10&gt;</td>
      <td>(StrOpt) Request timeout to external services</td>
    </tr>
    <tr>
-      <td>object-server.conf: [object-replicator]/sync_method = rsync</td>
+      <td>object-server.conf: [object-replicator] sync_method = rsync</td>
      <td>(StrOpt) No help text available for this option.</td>
    </tr>
    <tr>
-      <td>proxy-server.conf: [DEFAULT]/admin_key = secret_admin_key</td>
+      <td>proxy-server.conf: [DEFAULT] admin_key = secret_admin_key</td>
      <td>(StrOpt) to use for admin calls that are HMAC signed.  Default is empty, which will disable admin calls to /info. the proxy server.  For most cases, this should be `egg:swift#proxy`. request whenever it has to failover to a handoff node</td>
    </tr>
    <tr>
-      <td>proxy-server.conf: [DEFAULT]/disallowed_sections = container_quotas, tempurl</td>
+      <td>proxy-server.conf: [DEFAULT] disallowed_sections = container_quotas, tempurl</td>
      <td>(StrOpt) No help text available for this option.</td>
    </tr>
    <tr>
-      <td>proxy-server.conf: [DEFAULT]/expiring_objects_account_name = expiring_objects</td>
+      <td>proxy-server.conf: [DEFAULT] expiring_objects_account_name = expiring_objects</td>
      <td>(StrOpt) No help text available for this option.</td>
    </tr>
    <tr>
-      <td>proxy-server.conf: [DEFAULT]/expose_info = true</td>
+      <td>proxy-server.conf: [DEFAULT] expose_info = true</td>
      <td>(StrOpt) Enables exposing configuration settings via HTTP GET /info.</td>
    </tr>
    <tr>
-      <td>proxy-server.conf: [app-proxy-server]/post_quorum_timeout = 0.5</td>
+      <td>proxy-server.conf: [app-proxy-server] post_quorum_timeout = 0.5</td>
      <td>(StrOpt) No help text available for this option.</td>
    </tr>
    <tr>
-      <td>proxy-server.conf: [app-proxy-server]/recoverable_node_timeout = node_timeout</td>
+      <td>proxy-server.conf: [app-proxy-server] recoverable_node_timeout = node_timeout</td>
      <td>(StrOpt) Request timeout to external services for requests that, on failure, can be recovered from. For example, object GET. from a client external services</td>
    </tr>
    <tr>
-      <td>proxy-server.conf: [filter-authtoken]/include_service_catalog = False</td>
+      <td>proxy-server.conf: [filter-authtoken] include_service_catalog = False</td>
      <td>(StrOpt) No help text available for this option.</td>
    </tr>
    <tr>
-      <td>proxy-server.conf: [filter-bulk]/delete_container_retry_count = 0</td>
+      <td>proxy-server.conf: [filter-bulk] delete_container_retry_count = 0</td>
      <td>(StrOpt) No help text available for this option.</td>
    </tr>
    <tr>
-      <td>proxy-server.conf: [filter-bulk]/max_failed_deletes = 1000</td>
+      <td>proxy-server.conf: [filter-bulk] max_failed_deletes = 1000</td>
      <td>(StrOpt) No help text available for this option.</td>
    </tr>
    <tr>
-      <td>proxy-server.conf: [filter-cache]/memcache_max_connections = 2</td>
+      <td>proxy-server.conf: [filter-cache] memcache_max_connections = 2</td>
      <td>(StrOpt) Max number of connections to each memcached server per worker services</td>
    </tr>
    <tr>
-      <td>proxy-server.conf: [filter-container_sync]/allow_full_urls = true</td>
+      <td>proxy-server.conf: [filter-container_sync] allow_full_urls = true</td>
      <td>(StrOpt) No help text available for this option.</td>
    </tr>
    <tr>
-      <td>proxy-server.conf: [filter-container_sync]/use = egg:swift#container_sync</td>
+      <td>proxy-server.conf: [filter-container_sync] use = egg:swift#container_sync</td>
      <td>(StrOpt) Entry point of paste.deploy in the server</td>
    </tr>
    <tr>
-      <td>proxy-server.conf: [filter-dlo]/max_get_time = 86400</td>
+      <td>proxy-server.conf: [filter-dlo] max_get_time = 86400</td>
      <td>(StrOpt) No help text available for this option.</td>
    </tr>
    <tr>
-      <td>proxy-server.conf: [filter-dlo]/rate_limit_after_segment = 10</td>
+      <td>proxy-server.conf: [filter-dlo] rate_limit_after_segment = 10</td>
      <td>(StrOpt) Rate limit the download of large object segments after this segment is downloaded.</td>
    </tr>
    <tr>
-      <td>proxy-server.conf: [filter-dlo]/rate_limit_segments_per_sec = 1</td>
+      <td>proxy-server.conf: [filter-dlo] rate_limit_segments_per_sec = 1</td>
      <td>(StrOpt) Rate limit large object downloads at this rate. contact for a normal request. You can use '* replicas' at the end to have it use the number given times the number of replicas for the ring being used for the request. paste.deploy to use for auth. To use tempauth set to: `egg:swift#tempauth` each request</td>
    </tr>
    <tr>
-      <td>proxy-server.conf: [filter-dlo]/use = egg:swift#dlo</td>
+      <td>proxy-server.conf: [filter-dlo] use = egg:swift#dlo</td>
      <td>(StrOpt) Entry point of paste.deploy in the server</td>
    </tr>
    <tr>
-      <td>proxy-server.conf: [filter-gatekeeper]/set log_address = /dev/log</td>
+      <td>proxy-server.conf: [filter-gatekeeper] set log_address = /dev/log</td>
      <td>(StrOpt) Location where syslog sends the logs to</td>
    </tr>
    <tr>
-      <td>proxy-server.conf: [filter-gatekeeper]/set log_facility = LOG_LOCAL0</td>
+      <td>proxy-server.conf: [filter-gatekeeper] set log_facility = LOG_LOCAL0</td>
      <td>(StrOpt) Syslog log facility</td>
    </tr>
    <tr>
-      <td>proxy-server.conf: [filter-gatekeeper]/set log_headers = false</td>
+      <td>proxy-server.conf: [filter-gatekeeper] set log_headers = false</td>
      <td>(StrOpt) If True, log headers in each request</td>
    </tr>
    <tr>
-      <td>proxy-server.conf: [filter-gatekeeper]/set log_level = INFO</td>
+      <td>proxy-server.conf: [filter-gatekeeper] set log_level = INFO</td>
      <td>(StrOpt) Log level</td>
    </tr>
    <tr>
-      <td>proxy-server.conf: [filter-gatekeeper]/set log_name = gatekeeper</td>
+      <td>proxy-server.conf: [filter-gatekeeper] set log_name = gatekeeper</td>
      <td>(StrOpt) Label to use when logging</td>
    </tr>
    <tr>
-      <td>proxy-server.conf: [filter-gatekeeper]/use = egg:swift#gatekeeper</td>
+      <td>proxy-server.conf: [filter-gatekeeper] use = egg:swift#gatekeeper</td>
      <td>(StrOpt) Entry point of paste.deploy in the server</td>
    </tr>
    <tr>
-      <td>proxy-server.conf: [filter-proxy-logging]/access_log_headers_only = </td>
+      <td>proxy-server.conf: [filter-proxy-logging] access_log_headers_only = </td>
      <td>(StrOpt) If access_log_headers is True and access_log_headers_only is set only
            these headers are logged. Multiple headers can be defined as comma separated list like this:
            access_log_headers_only = Host, X-Object-Meta-Mtime</td>
    </tr>
    <tr>
      <td>proxy-server.conf: [filter-slo] max_get_time = 86400</td>
      <td>(StrOpt) No help text available for this option.</td>
    </tr>
    <tr>
-      <td>proxy-server.conf: [filter-slo]/max_get_time = 86400</td>
+      <td>proxy-server.conf: [filter-slo] rate_limit_after_segment = 10</td>
      <td>(StrOpt) No help text available for this option.</td>
    </tr>
    <tr>
      <td>proxy-server.conf: [filter-slo]/rate_limit_after_segment = 10</td>
      <td>(StrOpt) Rate limit the download of large object segments after this segment is downloaded.</td>
    </tr>
    <tr>
-      <td>proxy-server.conf: [filter-slo]/rate_limit_segments_per_sec = 0</td>
+      <td>proxy-server.conf: [filter-slo] rate_limit_segments_per_sec = 0</td>
      <td>(StrOpt) Rate limit large object downloads at this rate. contact for a normal request. You can use '* replicas' at the end to have it use the number given times the number of replicas for the ring being used for the request. paste.deploy to use for auth. To use tempauth set to: `egg:swift#tempauth` each request</td>
    </tr>
  </table>
@ -242,27 +244,27 @@
      </tr>
    </thead>
    <tr>
-      <td>container-server.conf: [container-sync]/sync_proxy</td>
+      <td>container-server.conf: [container-sync] sync_proxy</td>
      <td>http://127.0.0.1:8888</td>
      <td>http://10.1.1.1:8888,http://10.1.1.2:8888</td>
    </tr>
    <tr>
-      <td>object-server.conf: [object-updater]/node_timeout</td>
+      <td>object-server.conf: [object-updater] node_timeout</td>
      <td>10</td>
-      <td>&amp;lt;whatever's in the DEFAULT section or 10&amp;gt;</td>
+      <td>&lt;whatever's in the DEFAULT section or 10&gt;</td>
    </tr>
    <tr>
-      <td>proxy-server.conf: [app-proxy-server]/swift_owner_headers</td>
+      <td>proxy-server.conf: [app-proxy-server] swift_owner_headers</td>
      <td>x-container-read, x-container-write, x-container-sync-key, x-container-sync-to, x-account-meta-temp-url-key, x-account-meta-temp-url-key-2</td>
      <td>x-container-read, x-container-write, x-container-sync-key, x-container-sync-to, x-account-meta-temp-url-key, x-account-meta-temp-url-key-2, x-account-access-control</td>
    </tr>
    <tr>
-      <td>proxy-server.conf: [filter-bulk]/yield_frequency</td>
+      <td>proxy-server.conf: [filter-bulk] yield_frequency</td>
      <td>60</td>
      <td>10</td>
    </tr>
    <tr>
-      <td>proxy-server.conf: [pipeline-main]/pipeline</td>
+      <td>proxy-server.conf: [pipeline-main] pipeline</td>
      <td>catch_errors healthcheck proxy-logging cache bulk slo ratelimit tempauth container-quotas account-quotas proxy-logging proxy-server</td>
      <td>catch_errors gatekeeper healthcheck proxy-logging cache container_sync bulk tempurl slo dlo ratelimit tempauth container-quotas account-quotas proxy-logging proxy-server</td>
    </tr>