58a4c980bb
We're enabling the audit middleware for the following API services:
* cinder
* nova
* neutron
* glance
* heat
* barbican
* octavia
* gnocchi
* config.verbose was deprecated a long time ago and Gnocchi doesn't
support a separate "logging.conf" file
* as such, Gnocchi can't be configured to use "info" level logging
* the audit logs will only be emitted in debug mode
* cf001e8428/gnocchi/service.py (L72-L79)
* newly defined audit map (the other services had already existing
definitions, which were updated):
* aodh
* designate
* magnum
* masakari
* updated wsgi log configuration
The following services do not support the audit middleware,
the support for api paste was dropped:
* placement
* watcher
* keystone (has its own pycadf audit implementation)
* emits notifications using oslo.notifications
* configurable driver, possible options include "messagingv2" and "log"
* we can't just use the log driver since the user may request amqp
notifications using:
"juju config keystone enable-telemetry-notifications=True"
* we'll listen for amqp notifications using a separate service
Reference:
* audit middleware configuration: https://docs.openstack.org/keystonemiddleware/latest/audit.html
* api map samples: https://opendev.org/openstack/pycadf/src/tag/3.1.1/etc/pycadf
Change-Id: I28a261b85067704221d6ab3d949c5d2a27a4a9d7
68 lines
2.2 KiB
Django/Jinja
68 lines
2.2 KiB
Django/Jinja
[composite:neutron]
|
|
use = egg:Paste#urlmap
|
|
/: neutronversions_composite
|
|
/healthcheck: healthcheck
|
|
/v2.0: neutronapi_v2_0
|
|
{% if ingress_internal.ingress_path -%}
|
|
{{ ingress_internal.ingress_path }}: neutronversions_composite
|
|
{{ ingress_internal.ingress_path }}/v2.0: neutronapi_v2_0
|
|
{% endif -%}
|
|
|
|
[composite:neutronapi_v2_0]
|
|
use = call:neutron.auth:pipeline_factory
|
|
noauth = cors http_proxy_to_wsgi request_id fake_project_id catch_errors osprofiler extensions neutronapiapp_v2_0
|
|
keystone = cors http_proxy_to_wsgi request_id catch_errors osprofiler authtoken audit keystonecontext extensions neutronapiapp_v2_0
|
|
|
|
[composite:neutronversions_composite]
|
|
use = call:neutron.auth:pipeline_factory
|
|
noauth = cors http_proxy_to_wsgi neutronversions
|
|
keystone = cors http_proxy_to_wsgi neutronversions
|
|
|
|
[filter:audit]
|
|
paste.filter_factory = keystonemiddleware.audit:filter_factory
|
|
audit_map_file = /etc/neutron/api_audit_map.conf
|
|
service_name = neutron
|
|
|
|
[filter:request_id]
|
|
paste.filter_factory = oslo_middleware:RequestId.factory
|
|
|
|
[filter:catch_errors]
|
|
paste.filter_factory = oslo_middleware:CatchErrors.factory
|
|
|
|
[filter:cors]
|
|
paste.filter_factory = oslo_middleware.cors:filter_factory
|
|
oslo_config_project = neutron
|
|
|
|
[filter:project_id]
|
|
paste.filter_factory = neutron.api.extensions:ProjectIdMiddleware.factory
|
|
oslo_config_project = neutron
|
|
|
|
[filter:fake_project_id]
|
|
paste.filter_factory = neutron.auth:NoauthFakeProjectId.factory
|
|
|
|
[filter:http_proxy_to_wsgi]
|
|
paste.filter_factory = oslo_middleware.http_proxy_to_wsgi:HTTPProxyToWSGI.factory
|
|
|
|
[filter:keystonecontext]
|
|
paste.filter_factory = neutron.auth:NeutronKeystoneContext.factory
|
|
|
|
[filter:authtoken]
|
|
paste.filter_factory = keystonemiddleware.auth_token:filter_factory
|
|
|
|
[filter:extensions]
|
|
paste.filter_factory = neutron.api.extensions:plugin_aware_extension_middleware_factory
|
|
|
|
[app:neutronversions]
|
|
paste.app_factory = neutron.pecan_wsgi.app:versions_factory
|
|
|
|
[app:neutronapiapp_v2_0]
|
|
paste.app_factory = neutron.api.v2.router:APIRouter.factory
|
|
|
|
[filter:osprofiler]
|
|
paste.filter_factory = osprofiler.web:WsgiMiddleware.factory
|
|
|
|
[app:healthcheck]
|
|
paste.app_factory = oslo_middleware:Healthcheck.app_factory
|
|
backends = disable_by_file
|
|
disable_by_file_path = /var/lib/neutron/healthcheck_disable
|