OpenStack: Install default configuration files

Add the default configuration files for Keystone, Nova,
Neutron, Glance, Cinder, Swift, Ceilometer, Ironic and Tempest.

Also install configuration files which will are not going to be modified
in the following commit, in the post-install-commands for the chunk; as
opposite to having them laying around in the repo and installing them
with the install-files configuration extension.

Note:
  - Some configuration files have been created using commands given in
    their documentations or they .conf.sample files.
  - To generate cinder.conf use the following command on the top of the
    cinder repository:
    ./tools/config/generate_sample.sh -b . -p cinder -o etc/cinder
  - Nova.conf has been taken from:
    http://pkgs.fedoraproject.org/cgit/openstack-nova.git/tree/nova.conf.sample
    commit 69755b4a072edff0957ee256290395600edbab9e
  - tempest.conf has been taken from the tag version '4'.

Signed-off-by: Francisco Redondo Marchena <francisco.marchena@codethink.co.uk>
Signed-off-by: Patrick Darley <patrick.darley@codethink.co.uk>
Signed-off-by: Tiago Gomes <tiago.gomes@codethink.co.uk>

Change-Id: Id26886aaaa9edd8509412615a65e681d5c8117ed

1 files changed, 479 insertions, 110 deletions

diff --git a/install-files/openstack/usr/share/openstack/neutron/neutron.conf b/install-files/openstack/usr/share/openstack/neutron/neutron.conf
index 51de7464..ee42954b 100644
--- a/install-files/openstack/usr/share/openstack/neutron/neutron.conf
+++ b/install-files/openstack/usr/share/openstack/neutron/neutron.conf
@@ -17,10 +17,7 @@
 
 # Where to store Neutron state files.  This directory must be writable by the
 # user executing the agent.
-state_path = /var/lib/neutron
-
-# Where to store lock files
-lock_path = $state_path/lock
+# state_path = /var/lib/neutron
 
 # log_format = %(asctime)s %(levelname)8s [%(name)s] %(message)s
 # log_date_format = %Y-%m-%d %H:%M:%S
@@ -32,8 +29,7 @@ lock_path = $state_path/lock
 # (not user_stderr) and (not log_file) -> stdout
 # publish_errors                       -> notification system
 
-use_syslog = True
-
+# use_syslog = False
 # syslog_log_facility = LOG_USER
 
 # use_stderr = True
@@ -61,7 +57,7 @@ use_syslog = True
 # previous versions, the class name of a plugin can be specified instead of its
 # entrypoint name.
 #
-core_plugin = ml2
+# core_plugin =
 # Example: core_plugin = ml2
 
 # (ListOpt) List of service plugin entrypoints to be loaded from the
@@ -70,15 +66,22 @@ core_plugin = ml2
 # with previous versions, the class name of a plugin can be specified instead
 # of its entrypoint name.
 #
-service_plugins = router
+# service_plugins =
 # Example: service_plugins = router,firewall,lbaas,vpnaas,metering
 
 # Paste configuration file
-api_paste_config = api-paste.ini
+# api_paste_config = api-paste.ini
+
+# (StrOpt) Hostname to be used by the neutron server, agents and services
+# running on this machine. All the agents and services running on this machine
+# must use the same host value.
+# The default value is hostname of the machine.
+#
+# host =
 
 # The strategy to be used for auth.
 # Supported values are 'keystone'(default), 'noauth'.
-auth_strategy = keystone
+# auth_strategy = keystone
 
 # Base MAC address. The first 3 octets will remain unchanged. If the
 # 4h octet is not 00, it will also be used. The others will be
@@ -115,7 +118,7 @@ auth_strategy = keystone
 # Enable or disable overlapping IPs for subnets
 # Attention: the following parameter MUST be set to False if Neutron is
 # being used in conjunction with nova security groups
-allow_overlapping_ips = True
+# allow_overlapping_ips = False
 # Ensure that configured gateway is on subnet. For IPv6, validate only if
 # gateway is not a link local address. Deprecated, to be removed during the
 # K release, at which point the check will be mandatory.
@@ -140,6 +143,29 @@ allow_overlapping_ips = True
 # Maximum number of routes per router
 # max_routes = 30
 
+# Default Subnet Pool to be used for IPv4 subnet-allocation.
+# Specifies by UUID the pool to be used in case of subnet-create being called
+# without a subnet-pool ID.  The default of None means that no pool will be
+# used unless passed explicitly to subnet create.  If no pool is used, then a
+# CIDR must be passed to create a subnet and that subnet will not be allocated
+# from any pool; it will be considered part of the tenant's private address
+# space.
+# default_ipv4_subnet_pool =
+
+# Default Subnet Pool to be used for IPv6 subnet-allocation.
+# Specifies by UUID the pool to be used in case of subnet-create being
+# called without a subnet-pool ID.  Set to "prefix_delegation"
+# to enable IPv6 Prefix Delegation in a PD-capable environment.
+# See the description for default_ipv4_subnet_pool for more information.
+# default_ipv6_subnet_pool =
+
+# =========== items for MTU selection and advertisement =============
+# Advertise MTU.  If True, effort is made to advertise MTU
+# settings to VMs via network methods (ie. DHCP and RA MTU options)
+# when the network's preferred MTU is known.
+# advertise_mtu = False
+# ======== end of items for MTU selection and advertisement =========
+
 # =========== items for agent management extension =============
 # Seconds to regard the agent as down; should be at least twice
 # report_interval, to be sure the agent is down for good
@@ -154,6 +180,23 @@ allow_overlapping_ips = True
 # Driver to use for scheduling a loadbalancer pool to an lbaas agent
 # loadbalancer_pool_scheduler_driver = neutron.services.loadbalancer.agent_scheduler.ChanceScheduler
 
+# (StrOpt) Representing the resource type whose load is being reported by
+# the agent.
+# This can be 'networks','subnets' or 'ports'. When specified (Default is networks),
+# the server will extract particular load sent as part of its agent configuration object
+# from the agent report state, which is the number of resources being consumed, at
+# every report_interval.
+# dhcp_load_type can be used in combination with network_scheduler_driver =
+# neutron.scheduler.dhcp_agent_scheduler.WeightScheduler
+# When the network_scheduler_driver is WeightScheduler, dhcp_load_type can
+# be configured to represent the choice for the resource being balanced.
+# Example: dhcp_load_type = networks
+# Values:
+#   networks - number of networks hosted on the agent
+#   subnets -  number of subnets associated with the networks hosted on the agent
+#   ports   -  number of ports associated with the networks hosted on the agent
+# dhcp_load_type = networks
+
 # Allow auto scheduling networks to DHCP agent. It will schedule non-hosted
 # networks to first DHCP agent which sends get_active_networks message to
 # neutron server
@@ -167,10 +210,25 @@ allow_overlapping_ips = True
 # admin_state_up set to True to alive agents.
 # allow_automatic_l3agent_failover = False
 
-# Number of DHCP agents scheduled to host a network. This enables redundant
-# DHCP agents for configured networks.
+# Allow automatic removal of networks from dead DHCP agents with
+# admin_state_up set to True.
+# Networks could then be rescheduled if network_auto_schedule is True
+# allow_automatic_dhcp_failover = True
+
+# Number of DHCP agents scheduled to host a tenant network.
+# If this number is greater than 1, the scheduler automatically
+# assigns multiple DHCP agents for a given tenant network,
+# providing high availability for DHCP service.
 # dhcp_agents_per_network = 1
 
+# Enable services on agents with admin_state_up False.
+# If this option is False, when admin_state_up of an agent is turned to
+# False, services on it will be disabled. If this option is True, services
+# on agents with admin_state_up False keep available and manual scheduling
+# to such agents is available. Agents with admin_state_up False are not
+# selected for automatic scheduling regardless of this option.
+# enable_services_on_agents_with_admin_state_down = False
+
 # ===========  end of items for agent scheduler extension =====
 
 # =========== items for l3 extension ==============
@@ -187,8 +245,39 @@ allow_overlapping_ips = True
 #
 # CIDR of the administrative network if HA mode is enabled
 # l3_ha_net_cidr = 169.254.192.0/18
+#
+# Enable snat by default on external gateway when available
+# enable_snat_by_default = True
 # =========== end of items for l3 extension =======
 
+# =========== items for metadata proxy configuration ==============
+# User (uid or name) running metadata proxy after its initialization
+# (if empty: agent effective user)
+# metadata_proxy_user =
+
+# Group (gid or name) running metadata proxy after its initialization
+# (if empty: agent effective group)
+# metadata_proxy_group =
+
+# Enable/Disable log watch by metadata proxy, it should be disabled when
+# metadata_proxy_user/group is not allowed to read/write its log file and
+# 'copytruncate' logrotate option must be used if logrotate is enabled on
+# metadata proxy log files. Option default value is deduced from
+# metadata_proxy_user: watch log is enabled if metadata_proxy_user is agent
+# effective user id/name.
+# metadata_proxy_watch_log =
+
+# Location of Metadata Proxy UNIX domain socket
+# metadata_proxy_socket = $state_path/metadata_proxy
+# =========== end of items for metadata proxy configuration ==============
+
+# ========== items for VLAN trunking networks ==========
+# Setting this flag to True will allow plugins that support it to
+# create VLAN transparent networks. This flag has no effect for
+# plugins that do not support VLAN transparent networks.
+# vlan_transparent = False
+# ========== end of items for VLAN trunking networks ==========
+
 # =========== WSGI parameters related to the API server ==============
 # Number of separate worker processes to spawn.  The default, 0, runs the
 # worker thread in the current process.  Greater than 0 launches that number of
@@ -202,6 +291,18 @@ allow_overlapping_ips = True
 # enabled for various plugins for compatibility.
 # rpc_workers = 0
 
+# Timeout for client connections socket operations. If an
+# incoming connection is idle for this number of seconds it
+# will be closed. A value of '0' means wait forever. (integer
+# value)
+# client_socket_timeout = 900
+
+# wsgi keepalive option. Determines if connections are allowed to be held open
+# by clients after a request is fulfilled. A value of False will ensure that
+# the socket connection will be explicitly closed once a response has been
+# sent to the client.
+# wsgi_keep_alive = True
+
 # Sets the value of TCP_KEEPIDLE in seconds to use for each server socket when
 # starting API server. Not supported on OS X.
 # tcp_keepidle = 600
@@ -231,32 +332,36 @@ allow_overlapping_ips = True
 # ssl_ca_file = /path/to/cafile
 # ======== end of WSGI parameters related to the API server ==========
 
-
 # ======== neutron nova interactions ==========
 # Send notification to nova when port status is active.
-notify_nova_on_port_status_changes = True
+# notify_nova_on_port_status_changes = True
 
 # Send notifications to nova when port data (fixed_ips/floatingips) change
 # so nova can update it's cache.
-notify_nova_on_port_data_changes = True
+# notify_nova_on_port_data_changes = True
 
 # URL for connection to nova (Only supports one nova region currently).
-nova_url = http://{{ CONTROLLER_HOST_ADDRESS  }}:8774/v2
+# nova_url = http://127.0.0.1:8774/v2
 
 # Name of nova region to use. Useful if keystone manages more than one region
-nova_region_name = regionOne
+# nova_region_name =
 
 # Username for connection to nova in admin context
-nova_admin_username = {{ NOVA_SERVICE_USER }}
+# nova_admin_username =
 
 # The uuid of the admin nova tenant
-nova_admin_tenant_id = {{ SERVICE_TENANT_ID }}
+# nova_admin_tenant_id =
+
+# The name of the admin nova tenant. If the uuid of the admin nova tenant
+# is set, this is optional.  Useful for cases where the uuid of the admin
+# nova tenant is not available when configuration is being done.
+# nova_admin_tenant_name =
 
 # Password for connection to nova in admin context.
-nova_admin_password = {{ NOVA_SERVICE_PASSWORD }}
+# nova_admin_password =
 
 # Authorization URL for connection to nova in admin context.
-nova_admin_auth_url = http://{{ CONTROLLER_HOST_ADDRESS }}:35357/v2.0
+# nova_admin_auth_url =
 
 # CA file for novaclient to verify server certificates
 # nova_ca_certificates_file =
@@ -275,42 +380,42 @@ nova_admin_auth_url = http://{{ CONTROLLER_HOST_ADDRESS }}:35357/v2.0
 
 # Use durable queues in amqp. (boolean value)
 # Deprecated group/name - [DEFAULT]/rabbit_durable_queues
-#amqp_durable_queues=false
+# amqp_durable_queues=false
 
 # Auto-delete queues in amqp. (boolean value)
-#amqp_auto_delete=false
+# amqp_auto_delete=false
 
 # Size of RPC connection pool. (integer value)
-#rpc_conn_pool_size=30
+# rpc_conn_pool_size=30
 
 # Qpid broker hostname. (string value)
-#qpid_hostname=localhost
+# qpid_hostname=localhost
 
 # Qpid broker port. (integer value)
-#qpid_port=5672
+# qpid_port=5672
 
 # Qpid HA cluster host:port pairs. (list value)
-#qpid_hosts=$qpid_hostname:$qpid_port
+# qpid_hosts=$qpid_hostname:$qpid_port
 
 # Username for Qpid connection. (string value)
-#qpid_username=
+# qpid_username=
 
 # Password for Qpid connection. (string value)
-#qpid_password=
+# qpid_password=
 
 # Space separated list of SASL mechanisms to use for auth.
 # (string value)
-#qpid_sasl_mechanisms=
+# qpid_sasl_mechanisms=
 
 # Seconds between connection keepalive heartbeats. (integer
 # value)
-#qpid_heartbeat=60
+# qpid_heartbeat=60
 
 # Transport to use, either 'tcp' or 'ssl'. (string value)
-#qpid_protocol=tcp
+# qpid_protocol=tcp
 
 # Whether to disable the Nagle algorithm. (boolean value)
-#qpid_tcp_nodelay=true
+# qpid_tcp_nodelay=true
 
 # The qpid topology version to use.  Version 1 is what was
 # originally used by impl_qpid.  Version 2 includes some
@@ -318,136 +423,136 @@ nova_admin_auth_url = http://{{ CONTROLLER_HOST_ADDRESS }}:35357/v2.0
 # to work.  Users should update to version 2 when they are
 # able to take everything down, as it requires a clean break.
 # (integer value)
-#qpid_topology_version=1
+# qpid_topology_version=1
 
 # SSL version to use (valid only if SSL enabled). valid values
 # are TLSv1, SSLv23 and SSLv3. SSLv2 may be available on some
 # distributions. (string value)
-#kombu_ssl_version=
+# kombu_ssl_version=
 
 # SSL key file (valid only if SSL enabled). (string value)
-#kombu_ssl_keyfile=
+# kombu_ssl_keyfile=
 
 # SSL cert file (valid only if SSL enabled). (string value)
-#kombu_ssl_certfile=
+# kombu_ssl_certfile=
 
 # SSL certification authority file (valid only if SSL
 # enabled). (string value)
-#kombu_ssl_ca_certs=
+# kombu_ssl_ca_certs=
 
 # How long to wait before reconnecting in response to an AMQP
 # consumer cancel notification. (floating point value)
-#kombu_reconnect_delay=1.0
+# kombu_reconnect_delay=1.0
 
 # The RabbitMQ broker address where a single node is used.
 # (string value)
-rabbit_host={{ RABBITMQ_HOST }}
+# rabbit_host=localhost
 
 # The RabbitMQ broker port where a single node is used.
 # (integer value)
-rabbit_port={{ RABBITMQ_PORT }}
+# rabbit_port=5672
 
 # RabbitMQ HA cluster host:port pairs. (list value)
-#rabbit_hosts=$rabbit_host:$rabbit_port
+# rabbit_hosts=$rabbit_host:$rabbit_port
 
 # Connect over SSL for RabbitMQ. (boolean value)
-#rabbit_use_ssl=false
+# rabbit_use_ssl=false
 
 # The RabbitMQ userid. (string value)
-rabbit_userid={{ RABBITMQ_USER }}
+# rabbit_userid=guest
 
 # The RabbitMQ password. (string value)
-rabbit_password={{ RABBITMQ_PASSWORD }}
+# rabbit_password=guest
 
 # the RabbitMQ login method (string value)
-#rabbit_login_method=AMQPLAIN
+# rabbit_login_method=AMQPLAIN
 
 # The RabbitMQ virtual host. (string value)
-#rabbit_virtual_host=/
+# rabbit_virtual_host=/
 
 # How frequently to retry connecting with RabbitMQ. (integer
 # value)
-#rabbit_retry_interval=1
+# rabbit_retry_interval=1
 
 # How long to backoff for between retries when connecting to
 # RabbitMQ. (integer value)
-#rabbit_retry_backoff=2
+# rabbit_retry_backoff=2
 
 # Maximum number of RabbitMQ connection retries. Default is 0
 # (infinite retry count). (integer value)
-#rabbit_max_retries=0
+# rabbit_max_retries=0
 
 # Use HA queues in RabbitMQ (x-ha-policy: all). If you change
 # this option, you must wipe the RabbitMQ database. (boolean
 # value)
-#rabbit_ha_queues=false
+# rabbit_ha_queues=false
 
 # If passed, use a fake RabbitMQ provider. (boolean value)
-#fake_rabbit=false
+# fake_rabbit=false
 
 # ZeroMQ bind address. Should be a wildcard (*), an ethernet
 # interface, or IP. The "host" option should point or resolve
 # to this address. (string value)
-#rpc_zmq_bind_address=*
+# rpc_zmq_bind_address=*
 
 # MatchMaker driver. (string value)
-#rpc_zmq_matchmaker=oslo.messaging._drivers.matchmaker.MatchMakerLocalhost
+# rpc_zmq_matchmaker=oslo.messaging._drivers.matchmaker.MatchMakerLocalhost
 
 # ZeroMQ receiver listening port. (integer value)
-#rpc_zmq_port=9501
+# rpc_zmq_port=9501
 
 # Number of ZeroMQ contexts, defaults to 1. (integer value)
-#rpc_zmq_contexts=1
+# rpc_zmq_contexts=1
 
 # Maximum number of ingress messages to locally buffer per
 # topic. Default is unlimited. (integer value)
-#rpc_zmq_topic_backlog=<None>
+# rpc_zmq_topic_backlog=
 
 # Directory for holding IPC sockets. (string value)
-#rpc_zmq_ipc_dir=/var/run/openstack
+# rpc_zmq_ipc_dir=/var/run/openstack
 
 # Name of this node. Must be a valid hostname, FQDN, or IP
 # address. Must match "host" option, if running Nova. (string
 # value)
-#rpc_zmq_host=oslo
+# rpc_zmq_host=oslo
 
 # Seconds to wait before a cast expires (TTL). Only supported
 # by impl_zmq. (integer value)
-#rpc_cast_timeout=30
+# rpc_cast_timeout=30
 
 # Heartbeat frequency. (integer value)
-#matchmaker_heartbeat_freq=300
+# matchmaker_heartbeat_freq=300
 
 # Heartbeat time-to-live. (integer value)
-#matchmaker_heartbeat_ttl=600
+# matchmaker_heartbeat_ttl=600
 
 # Size of RPC greenthread pool. (integer value)
-#rpc_thread_pool_size=64
+# rpc_thread_pool_size=64
 
 # Driver or drivers to handle sending notifications. (multi
 # valued)
-notification_driver=neutron.openstack.common.notifier.rpc_notifier
+# notification_driver=
 
 # AMQP topic used for OpenStack notifications. (list value)
 # Deprecated group/name - [rpc_notifier2]/topics
-#notification_topics=notifications
+# notification_topics=notifications
 
 # Seconds to wait for a response from a call. (integer value)
-#rpc_response_timeout=60
+# rpc_response_timeout=60
 
 # A URL representing the messaging driver to use and its full
 # configuration. If not set, we fall back to the rpc_backend
 # option and driver specific configuration. (string value)
-#transport_url=<None>
+# transport_url=
 
 # The messaging driver to use, defaults to rabbit. Other
 # drivers include qpid and zmq. (string value)
-rpc_backend=rabbit
+# rpc_backend=rabbit
 
 # The default exchange under which topics are scoped. May be
 # overridden by an exchange name specified in the
 # transport_url option. (string value)
-#control_exchange=openstack
+# control_exchange=openstack
 
 
 [matchmaker_redis]
@@ -457,13 +562,13 @@ rpc_backend=rabbit
 #
 
 # Host to locate redis. (string value)
-#host=127.0.0.1
+# host=127.0.0.1
 
 # Use this port to connect to redis host. (integer value)
-#port=6379
+# port=6379
 
 # Password for Redis server (optional). (string value)
-#password=<None>
+# password=
 
 
 [matchmaker_ring]
@@ -474,13 +579,14 @@ rpc_backend=rabbit
 
 # Matchmaker ring file (JSON). (string value)
 # Deprecated group/name - [DEFAULT]/matchmaker_ringfile
-#ringfile=/etc/oslo/matchmaker_ring.json
+# ringfile=/etc/oslo/matchmaker_ring.json
 
 [quotas]
 # Default driver to use for quota checks
 # quota_driver = neutron.db.quota_db.DbQuotaDriver
 
 # Resource name(s) that are supported in quota features
+# This option is deprecated for removal in the M release, please refrain from using it
 # quota_items = network,subnet,port
 
 # Default number of resource allowed per tenant. A negative value means
@@ -523,6 +629,16 @@ rpc_backend=rabbit
 # and that is the reason why quota is possible.
 # quota_health_monitor = -1
 
+# Number of loadbalancers allowed per tenant. A negative value means unlimited.
+# quota_loadbalancer = 10
+
+# Number of listeners allowed per tenant. A negative value means unlimited.
+# quota_listener = -1
+
+# Number of v2 health monitors allowed per tenant. A negative value means
+# unlimited. These health monitors exist under the lbaas v2 API
+# quota_healthmonitor = -1
+
 # Number of routers allowed per tenant. A negative value means unlimited.
 # quota_router = 10
 
@@ -543,9 +659,29 @@ rpc_backend=rabbit
 [agent]
 # Use "sudo neutron-rootwrap /etc/neutron/rootwrap.conf" to use the real
 # root filter facility.
-# Change to "sudo" to skip the filtering and just run the comand directly
+# Change to "sudo" to skip the filtering and just run the command directly
 # root_helper = sudo
-root_helper = sudo /usr/bin/neutron-rootwrap /etc/neutron/rootwrap.conf
+
+# Set to true to add comments to generated iptables rules that describe
+# each rule's purpose. (System must support the iptables comments module.)
+# comment_iptables_rules = True
+
+# Root helper daemon application to use when possible.
+# root_helper_daemon =
+
+# Use the root helper when listing the namespaces on a system. This may not
+# be required depending on the security configuration. If the root helper is
+# not required, set this to False for a performance improvement.
+# use_helper_for_ns_read = True
+
+# The interval to check external processes for failure in seconds (0=disabled)
+# check_child_processes_interval = 60
+
+# Action to take when an external process spawned by an agent dies
+# Values:
+#   respawn - Respawns the external process
+#   exit - Exits the agent
+# check_child_processes_action = respawn
 
 # =========== items for agent management extension =============
 # seconds between nodes reporting state to server; should be less than
@@ -555,11 +691,11 @@ root_helper = sudo /usr/bin/neutron-rootwrap /etc/neutron/rootwrap.conf
 # ===========  end of items for agent management extension =====
 
 [keystone_authtoken]
-auth_uri =  http://{{ CONTROLLER_HOST_ADDRESS }}:5000/v2.0
-identity_uri  =  http://{{ CONTROLLER_HOST_ADDRESS }}:35357
-admin_tenant_name = service
-admin_user = {{ NEUTRON_SERVICE_USER }}
-admin_password = {{ NEUTRON_SERVICE_PASSWORD }}
+auth_uri = http://127.0.0.1:35357/v2.0/
+identity_uri = http://127.0.0.1:5000
+admin_tenant_name = %SERVICE_TENANT_NAME%
+admin_user = %SERVICE_USER%
+admin_password = %SERVICE_PASSWORD%
 
 [database]
 # This line MUST be changed to actually run the plugin.
@@ -572,8 +708,6 @@ admin_password = {{ NEUTRON_SERVICE_PASSWORD }}
 # be set in the corresponding core plugin '.ini' file. However, it is suggested
 # to put the [database] section and its connection attribute in this
 # configuration file.
-#connection=sqlite:////var/lib/neutron/neutron.sqlite
-connection=postgresql://{{ NEUTRON_DB_USER }}:{{ NEUTRON_DB_PASSWORD }}@{{ CONTROLLER_HOST_ADDRESS }}/neutron
 
 # Database engine for which script will be generated when using offline
 # migration
@@ -611,30 +745,265 @@ connection=postgresql://{{ NEUTRON_DB_USER }}:{{ NEUTRON_DB_PASSWORD }}@{{ CONTR
 # If set, use this value for pool_timeout with sqlalchemy
 # pool_timeout = 10
 
-[service_providers]
-# Specify service providers (drivers) for advanced services like loadbalancer, VPN, Firewall.
-# Must be in form:
-# service_provider=<service_type>:<name>:<driver>[:default]
-# List of allowed service types includes LOADBALANCER, FIREWALL, VPN
-# Combination of <service type> and <name> must be unique; <driver> must also be unique
-# This is multiline option, example for default provider:
-# service_provider=LOADBALANCER:name:lbaas_plugin_driver_path:default
-# example of non-default provider:
-# service_provider=FIREWALL:name2:firewall_driver_path
-# --- Reference implementations ---
-service_provider=LOADBALANCER:Haproxy:neutron.services.loadbalancer.drivers.haproxy.plugin_driver.HaproxyOnHostPluginDriver:default
-service_provider=VPN:openswan:neutron.services.vpn.service_drivers.ipsec.IPsecVPNDriver:default
-# In order to activate Radware's lbaas driver you need to uncomment the next line.
-# If you want to keep the HA Proxy as the default lbaas driver, remove the attribute default from the line below.
-# Otherwise comment the HA Proxy line
-# service_provider = LOADBALANCER:Radware:neutron.services.loadbalancer.drivers.radware.driver.LoadBalancerDriver:default
-# uncomment the following line to make the 'netscaler' LBaaS provider available.
-# service_provider=LOADBALANCER:NetScaler:neutron.services.loadbalancer.drivers.netscaler.netscaler_driver.NetScalerPluginDriver
-# Uncomment the following line (and comment out the OpenSwan VPN line) to enable Cisco's VPN driver.
-# service_provider=VPN:cisco:neutron.services.vpn.service_drivers.cisco_ipsec.CiscoCsrIPsecVPNDriver:default
-# Uncomment the line below to use Embrane heleos as Load Balancer service provider.
-# service_provider=LOADBALANCER:Embrane:neutron.services.loadbalancer.drivers.embrane.driver.EmbraneLbaas:default
-# Uncomment the line below to use the A10 Networks LBaaS driver.  Requires 'pip install a10-neutron-lbaas'.
-#service_provider = LOADBALANCER:A10Networks:neutron.services.loadbalancer.drivers.a10networks.driver_v1.ThunderDriver:default
-# Uncomment the following line to test the LBaaS v2 API _WITHOUT_ a real backend
-# service_provider = LOADBALANCER:LoggingNoop:neutron.services.loadbalancer.drivers.logging_noop.driver.LoggingNoopLoadBalancerDriver:default
+[nova]
+# Name of the plugin to load
+# auth_plugin =
+
+# Config Section from which to load plugin specific options
+# auth_section =
+
+# PEM encoded Certificate Authority to use when verifying HTTPs connections.
+# cafile =
+
+# PEM encoded client certificate cert file
+# certfile =
+
+# Verify HTTPS connections.
+# insecure = False
+
+# PEM encoded client certificate key file
+# keyfile =
+
+# Name of nova region to use. Useful if keystone manages more than one region.
+# region_name =
+
+# Timeout value for http requests
+# timeout =
+
+[oslo_concurrency]
+
+# Directory to use for lock files. For security, the specified directory should
+# only be writable by the user running the processes that need locking.
+# Defaults to environment variable OSLO_LOCK_PATH. If external locks are used,
+# a lock path must be set.
+lock_path = $state_path/lock
+
+# Enables or disables inter-process locks.
+# disable_process_locking = False
+
+[oslo_policy]
+
+# The JSON file that defines policies.
+# policy_file = policy.json
+
+# Default rule. Enforced when a requested rule is not found.
+# policy_default_rule = default
+
+# Directories where policy configuration files are stored.
+# They can be relative to any directory in the search path defined by the
+# config_dir option, or absolute paths. The file defined by policy_file
+# must exist for these directories to be searched. Missing or empty
+# directories are ignored.
+# policy_dirs = policy.d
+
+[oslo_messaging_amqp]
+
+#
+# From oslo.messaging
+#
+
+# Address prefix used when sending to a specific server (string value)
+# Deprecated group/name - [amqp1]/server_request_prefix
+# server_request_prefix = exclusive
+
+# Address prefix used when broadcasting to all servers (string value)
+# Deprecated group/name - [amqp1]/broadcast_prefix
+# broadcast_prefix = broadcast
+
+# Address prefix when sending to any server in group (string value)
+# Deprecated group/name - [amqp1]/group_request_prefix
+# group_request_prefix = unicast
+
+# Name for the AMQP container (string value)
+# Deprecated group/name - [amqp1]/container_name
+# container_name =
+
+# Timeout for inactive connections (in seconds) (integer value)
+# Deprecated group/name - [amqp1]/idle_timeout
+# idle_timeout = 0
+
+# Debug: dump AMQP frames to stdout (boolean value)
+# Deprecated group/name - [amqp1]/trace
+# trace = false
+
+# CA certificate PEM file for verifing server certificate (string value)
+# Deprecated group/name - [amqp1]/ssl_ca_file
+# ssl_ca_file =
+
+# Identifying certificate PEM file to present to clients (string value)
+# Deprecated group/name - [amqp1]/ssl_cert_file
+# ssl_cert_file =
+
+# Private key PEM file used to sign cert_file certificate (string value)
+# Deprecated group/name - [amqp1]/ssl_key_file
+# ssl_key_file =
+
+# Password for decrypting ssl_key_file (if encrypted) (string value)
+# Deprecated group/name - [amqp1]/ssl_key_password
+# ssl_key_password =
+
+# Accept clients using either SSL or plain TCP (boolean value)
+# Deprecated group/name - [amqp1]/allow_insecure_clients
+# allow_insecure_clients = false
+
+
+[oslo_messaging_qpid]
+
+#
+# From oslo.messaging
+#
+
+# Use durable queues in AMQP. (boolean value)
+# Deprecated group/name - [DEFAULT]/rabbit_durable_queues
+# amqp_durable_queues = false
+
+# Auto-delete queues in AMQP. (boolean value)
+# Deprecated group/name - [DEFAULT]/amqp_auto_delete
+# amqp_auto_delete = false
+
+# Size of RPC connection pool. (integer value)
+# Deprecated group/name - [DEFAULT]/rpc_conn_pool_size
+# rpc_conn_pool_size = 30
+
+# Qpid broker hostname. (string value)
+# Deprecated group/name - [DEFAULT]/qpid_hostname
+# qpid_hostname = localhost
+
+# Qpid broker port. (integer value)
+# Deprecated group/name - [DEFAULT]/qpid_port
+# qpid_port = 5672
+
+# Qpid HA cluster host:port pairs. (list value)
+# Deprecated group/name - [DEFAULT]/qpid_hosts
+# qpid_hosts = $qpid_hostname:$qpid_port
+
+# Username for Qpid connection. (string value)
+# Deprecated group/name - [DEFAULT]/qpid_username
+# qpid_username =
+
+# Password for Qpid connection. (string value)
+# Deprecated group/name - [DEFAULT]/qpid_password
+# qpid_password =
+
+# Space separated list of SASL mechanisms to use for auth. (string value)
+# Deprecated group/name - [DEFAULT]/qpid_sasl_mechanisms
+# qpid_sasl_mechanisms =
+
+# Seconds between connection keepalive heartbeats. (integer value)
+# Deprecated group/name - [DEFAULT]/qpid_heartbeat
+# qpid_heartbeat = 60
+
+# Transport to use, either 'tcp' or 'ssl'. (string value)
+# Deprecated group/name - [DEFAULT]/qpid_protocol
+# qpid_protocol = tcp
+
+# Whether to disable the Nagle algorithm. (boolean value)
+# Deprecated group/name - [DEFAULT]/qpid_tcp_nodelay
+# qpid_tcp_nodelay = true
+
+# The number of prefetched messages held by receiver. (integer value)
+# Deprecated group/name - [DEFAULT]/qpid_receiver_capacity
+# qpid_receiver_capacity = 1
+
+# The qpid topology version to use.  Version 1 is what was originally used by
+# impl_qpid.  Version 2 includes some backwards-incompatible changes that allow
+# broker federation to work.  Users should update to version 2 when they are
+# able to take everything down, as it requires a clean break. (integer value)
+# Deprecated group/name - [DEFAULT]/qpid_topology_version
+# qpid_topology_version = 1
+
+
+[oslo_messaging_rabbit]
+
+#
+# From oslo.messaging
+#
+
+# Use durable queues in AMQP. (boolean value)
+# Deprecated group/name - [DEFAULT]/rabbit_durable_queues
+# amqp_durable_queues = false
+
+# Auto-delete queues in AMQP. (boolean value)
+# Deprecated group/name - [DEFAULT]/amqp_auto_delete
+# amqp_auto_delete = false
+
+# Size of RPC connection pool. (integer value)
+# Deprecated group/name - [DEFAULT]/rpc_conn_pool_size
+# rpc_conn_pool_size = 30
+
+# SSL version to use (valid only if SSL enabled). Valid values are TLSv1 and
+# SSLv23. SSLv2, SSLv3, TLSv1_1, and TLSv1_2 may be available on some
+# distributions. (string value)
+# Deprecated group/name - [DEFAULT]/kombu_ssl_version
+# kombu_ssl_version =
+
+# SSL key file (valid only if SSL enabled). (string value)
+# Deprecated group/name - [DEFAULT]/kombu_ssl_keyfile
+# kombu_ssl_keyfile =
+
+# SSL cert file (valid only if SSL enabled). (string value)
+# Deprecated group/name - [DEFAULT]/kombu_ssl_certfile
+# kombu_ssl_certfile =
+
+# SSL certification authority file (valid only if SSL enabled). (string value)
+# Deprecated group/name - [DEFAULT]/kombu_ssl_ca_certs
+# kombu_ssl_ca_certs =
+
+# How long to wait before reconnecting in response to an AMQP consumer cancel
+# notification. (floating point value)
+# Deprecated group/name - [DEFAULT]/kombu_reconnect_delay
+# kombu_reconnect_delay = 1.0
+
+# The RabbitMQ broker address where a single node is used. (string value)
+# Deprecated group/name - [DEFAULT]/rabbit_host
+# rabbit_host = localhost
+
+# The RabbitMQ broker port where a single node is used. (integer value)
+# Deprecated group/name - [DEFAULT]/rabbit_port
+# rabbit_port = 5672
+
+# RabbitMQ HA cluster host:port pairs. (list value)
+# Deprecated group/name - [DEFAULT]/rabbit_hosts
+# rabbit_hosts = $rabbit_host:$rabbit_port
+
+# Connect over SSL for RabbitMQ. (boolean value)
+# Deprecated group/name - [DEFAULT]/rabbit_use_ssl
+# rabbit_use_ssl = false
+
+# The RabbitMQ userid. (string value)
+# Deprecated group/name - [DEFAULT]/rabbit_userid
+# rabbit_userid = guest
+
+# The RabbitMQ password. (string value)
+# Deprecated group/name - [DEFAULT]/rabbit_password
+# rabbit_password = guest
+
+# The RabbitMQ login method. (string value)
+# Deprecated group/name - [DEFAULT]/rabbit_login_method
+# rabbit_login_method = AMQPLAIN
+
+# The RabbitMQ virtual host. (string value)
+# Deprecated group/name - [DEFAULT]/rabbit_virtual_host
+# rabbit_virtual_host = /
+
+# How frequently to retry connecting with RabbitMQ. (integer value)
+# rabbit_retry_interval = 1
+
+# How long to backoff for between retries when connecting to RabbitMQ. (integer
+# value)
+# Deprecated group/name - [DEFAULT]/rabbit_retry_backoff
+# rabbit_retry_backoff = 2
+
+# Maximum number of RabbitMQ connection retries. Default is 0 (infinite retry
+# count). (integer value)
+# Deprecated group/name - [DEFAULT]/rabbit_max_retries
+# rabbit_max_retries = 0
+
+# Use HA queues in RabbitMQ (x-ha-policy: all). If you change this option, you
+# must wipe the RabbitMQ database. (boolean value)
+# Deprecated group/name - [DEFAULT]/rabbit_ha_queues
+# rabbit_ha_queues = false
+
+# Deprecated, use rpc_backend=kombu+memory or rpc_backend=fake (boolean value)
+# Deprecated group/name - [DEFAULT]/fake_rabbit
+# fake_rabbit = false