1 # Copyright 2020 Canonical Ltd.
3 # Licensed under the Apache License, Version 2.0 (the "License");
4 # you may not use this file except in compliance with the License.
5 # You may obtain a copy of the License at
7 # http://www.apache.org/licenses/LICENSE-2.0
9 # Unless required by applicable law or agreed to in writing, software
10 # distributed under the License is distributed on an "AS IS" BASIS,
11 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 # See the License for the specific language governing permissions and
13 # limitations under the License.
17 default: opensourcemano/keystone:latest
18 description: The docker image to install.
22 The username for accessing the registry specified in image.
27 The password associated with image_username for accessing
28 the registry specified in image.
33 The maximum file size, in megabytes.
35 If there is a reverse proxy in front of Keystone, it may
36 need to be configured to handle the requested size.
38 ingress_whitelist_source_range:
41 A comma-separated list of CIDRs to store in the
42 ingress.kubernetes.io/whitelist-source-range annotation.
44 This can be used to lock down access to
45 Keystone based on source IP address.
49 description: TLS Secret name
53 description: Ingress URL
57 description: Region ID to be created when starting the service
61 description: Keystone DB Password
65 description: Admin username to be created when starting the service
69 description: Admin password to be created when starting the service
73 description: Admin project to be created when starting the service
77 description: Service Username to be created when starting the service
81 description: Service Password to be created when starting the service
85 description: Service Project to be created when starting the service
89 description: User domain name (Hardcoded in the container start.sh script)
94 Project domain name (Hardcoded in the container start.sh script)
98 description: Token keys expiration in seconds
102 description: Boolean to enable/disable LDAP authentication
104 ldap_authentication_domain_name:
106 description: Name of the domain which use LDAP authentication
110 description: URL of the LDAP server
111 default: "ldap://localhost"
114 description: User to bind and search for users
118 description: Password to bind and search for users
120 ldap_chase_referrals:
123 Sets keystone’s referral chasing behavior across directory partitions.
124 If left unset, the system’s default behavior will be used.
129 Defines the maximum number of results per page that keystone should
130 request from the LDAP server when listing objects. A value of zero (0)
136 Root of the tree in LDAP server in which Keystone will search for users
138 ldap_user_objectclass:
141 LDAP object class that Keystone will filter on within user_tree_dn to
142 find user objects. Any objects of other classes will be ignored.
143 default: inetOrgPerson
144 ldap_user_id_attribute:
147 This set of options define the mapping to LDAP attributes for the three
148 key user attributes supported by Keystone. The LDAP attribute chosen for
149 user_id must be something that is immutable for a user and no more than
150 64 characters in length. Notice that Distinguished Name (DN) may be
151 longer than 64 characters and thus is not suitable. An uid, or mail may
154 ldap_user_name_attribute:
157 This set of options define the mapping to LDAP attributes for the three
158 key user attributes supported by Keystone. The LDAP attribute chosen for
159 user_id must be something that is immutable for a user and no more than
160 64 characters in length. Notice that Distinguished Name (DN) may be
161 longer than 64 characters and thus is not suitable. An uid, or mail may
164 ldap_user_pass_attribute:
167 This set of options define the mapping to LDAP attributes for the three
168 key user attributes supported by Keystone. The LDAP attribute chosen for
169 user_id must be something that is immutable for a user and no more than
170 64 characters in length. Notice that Distinguished Name (DN) may be
171 longer than 64 characters and thus is not suitable. An uid, or mail may
173 default: userPassword
177 This filter option allow additional filter (over and above
178 user_objectclass) to be included into the search of user. One common use
179 of this is to provide more efficient searching, where the recommended
180 search for user objects is (&(objectCategory=person)(objectClass=user)).
181 By specifying user_objectclass as user and user_filter as
182 objectCategory=person in the Keystone configuration file, this can be
185 ldap_user_enabled_attribute:
188 In Keystone, a user entity can be either enabled or disabled. Setting
189 the above option will give a mapping to an equivalent attribute in LDAP,
190 allowing your LDAP management tools to disable a user.
192 ldap_user_enabled_mask:
195 Some LDAP schemas, rather than having a dedicated attribute for user
196 enablement, use a bit within a general control attribute (such as
197 userAccountControl) to indicate this. Setting user_enabled_mask will
198 cause Keystone to look at only the status of this bit in the attribute
199 specified by user_enabled_attribute, with the bit set indicating the
202 ldap_user_enabled_default:
205 Most LDAP servers use a boolean or bit in a control field to indicate
206 enablement. However, some schemas might use an integer value in an
207 attribute. In this situation, set user_enabled_default to the integer
208 value that represents a user being enabled.
210 ldap_user_enabled_invert:
213 Some LDAP schemas have an “account locked” attribute, which is the
214 equivalent to account being “disabled.” In order to map this to the
215 Keystone enabled attribute, you can utilize the user_enabled_invert
216 setting in conjunction with user_enabled_attribute to map the lock
217 status to disabled in Keystone.
219 ldap_group_objectclass:
221 description: The LDAP object class to use for groups.
222 default: groupOfNames
225 description: The search base to use for groups.
230 Enable Transport Layer Security (TLS) for providing a secure connection
231 from Keystone to LDAP (StartTLS, not LDAPS).
233 ldap_tls_cacert_base64:
236 CA certificate in Base64 format (if you have the PEM file, text inside
237 "-----BEGIN CERTIFICATE-----"/"-----END CERTIFICATE-----" tags).
242 Defines how the certificates are checked for validity in the client
243 (i.e., Keystone end) of the secure connection (this doesn’t affect what
244 level of checking the server is doing on the certificates it receives
245 from Keystone). Possible values are "demand", "never", and "allow". The
246 default of demand means the client always checks the certificate and
247 will drop the connection if it is not provided or invalid. never is the
248 opposite—it never checks it, nor requires it to be provided. allow means
249 that if it is not provided then the connection is allowed to continue,
250 but if it is provided it will be checked—and if invalid, the connection