1 # Copyright 2020 Canonical Ltd.
3 # Licensed under the Apache License, Version 2.0 (the "License");
4 # you may not use this file except in compliance with the License.
5 # You may obtain a copy of the License at
7 # http://www.apache.org/licenses/LICENSE-2.0
9 # Unless required by applicable law or agreed to in writing, software
10 # distributed under the License is distributed on an "AS IS" BASIS,
11 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 # See the License for the specific language governing permissions and
13 # limitations under the License.
18 The maximum file size, in megabytes.
20 If there is a reverse proxy in front of Keystone, it may
21 need to be configured to handle the requested size.
26 Ingress class name. This is useful for selecting the ingress to be used
27 in case there are multiple ingresses in the underlying k8s clusters.
28 ingress_whitelist_source_range:
31 A comma-separated list of CIDRs to store in the
32 ingress.kubernetes.io/whitelist-source-range annotation.
34 This can be used to lock down access to
35 Keystone based on source IP address.
39 description: TLS Secret name
43 description: Ingress URL
48 ImagePullPolicy configuration for the pod.
49 Possible values: always, ifnotpresent, never
52 description: Enables the security context of the pods
57 description: Region ID to be created when starting the service
61 description: Keystone DB Password
66 Mysql uri with the following format:
67 mysql://<user>:<pass>@<host>:<port>/<database>
70 description: Admin username to be created when starting the service
74 description: Admin password to be created when starting the service
78 description: Admin project to be created when starting the service
82 description: Service Username to be created when starting the service
86 description: Service Password to be created when starting the service
90 description: Service Project to be created when starting the service
94 description: User domain name (Hardcoded in the container start.sh script)
99 Project domain name (Hardcoded in the container start.sh script)
103 description: Token keys expiration in seconds
107 description: Boolean to enable/disable LDAP authentication
109 ldap_authentication_domain_name:
111 description: Name of the domain which use LDAP authentication
115 description: URL of the LDAP server
116 default: "ldap://localhost"
119 description: User to bind and search for users
123 description: Password to bind and search for users
125 ldap_chase_referrals:
128 Sets keystone’s referral chasing behavior across directory partitions.
129 If left unset, the system’s default behavior will be used.
134 Defines the maximum number of results per page that keystone should
135 request from the LDAP server when listing objects. A value of zero (0)
141 Root of the tree in LDAP server in which Keystone will search for users
143 ldap_user_objectclass:
146 LDAP object class that Keystone will filter on within user_tree_dn to
147 find user objects. Any objects of other classes will be ignored.
148 default: inetOrgPerson
149 ldap_user_id_attribute:
152 This set of options define the mapping to LDAP attributes for the three
153 key user attributes supported by Keystone. The LDAP attribute chosen for
154 user_id must be something that is immutable for a user and no more than
155 64 characters in length. Notice that Distinguished Name (DN) may be
156 longer than 64 characters and thus is not suitable. An uid, or mail may
159 ldap_user_name_attribute:
162 This set of options define the mapping to LDAP attributes for the three
163 key user attributes supported by Keystone. The LDAP attribute chosen for
164 user_id must be something that is immutable for a user and no more than
165 64 characters in length. Notice that Distinguished Name (DN) may be
166 longer than 64 characters and thus is not suitable. An uid, or mail may
169 ldap_user_pass_attribute:
172 This set of options define the mapping to LDAP attributes for the three
173 key user attributes supported by Keystone. The LDAP attribute chosen for
174 user_id must be something that is immutable for a user and no more than
175 64 characters in length. Notice that Distinguished Name (DN) may be
176 longer than 64 characters and thus is not suitable. An uid, or mail may
178 default: userPassword
182 This filter option allow additional filter (over and above
183 user_objectclass) to be included into the search of user. One common use
184 of this is to provide more efficient searching, where the recommended
185 search for user objects is (&(objectCategory=person)(objectClass=user)).
186 By specifying user_objectclass as user and user_filter as
187 objectCategory=person in the Keystone configuration file, this can be
190 ldap_user_enabled_attribute:
193 In Keystone, a user entity can be either enabled or disabled. Setting
194 the above option will give a mapping to an equivalent attribute in LDAP,
195 allowing your LDAP management tools to disable a user.
197 ldap_user_enabled_mask:
200 Some LDAP schemas, rather than having a dedicated attribute for user
201 enablement, use a bit within a general control attribute (such as
202 userAccountControl) to indicate this. Setting user_enabled_mask will
203 cause Keystone to look at only the status of this bit in the attribute
204 specified by user_enabled_attribute, with the bit set indicating the
207 ldap_user_enabled_default:
210 Most LDAP servers use a boolean or bit in a control field to indicate
211 enablement. However, some schemas might use an integer value in an
212 attribute. In this situation, set user_enabled_default to the integer
213 value that represents a user being enabled.
215 ldap_user_enabled_invert:
218 Some LDAP schemas have an “account locked” attribute, which is the
219 equivalent to account being “disabled.” In order to map this to the
220 Keystone enabled attribute, you can utilize the user_enabled_invert
221 setting in conjunction with user_enabled_attribute to map the lock
222 status to disabled in Keystone.
224 ldap_group_objectclass:
226 description: The LDAP object class to use for groups.
227 default: groupOfNames
230 description: The search base to use for groups.
235 Enable Transport Layer Security (TLS) for providing a secure connection
236 from Keystone to LDAP (StartTLS, not LDAPS).
238 ldap_tls_cacert_base64:
241 CA certificate in Base64 format (if you have the PEM file, text inside
242 "-----BEGIN CERTIFICATE-----"/"-----END CERTIFICATE-----" tags).
247 Defines how the certificates are checked for validity in the client
248 (i.e., Keystone end) of the secure connection (this doesn’t affect what
249 level of checking the server is doing on the certificates it receives
250 from Keystone). Possible values are "demand", "never", and "allow". The
251 default of demand means the client always checks the certificate and
252 will drop the connection if it is not provided or invalid. never is the
253 opposite—it never checks it, nor requires it to be provided. allow means
254 that if it is not provided then the connection is allowed to continue,
255 but if it is provided it will be checked—and if invalid, the connection