applications:
- keystone
classes:
- service.keystone.support
- service.keystone.file_permissions
parameters:
  _param:
    openstack_log_appender: false
    openstack_fluentd_handler_enabled: false
    openstack_ossyslog_handler_enabled: false
    keystone_service_protocol: http
  keystone:
    server:
      enabled: true
      version: ${_param:keystone_version}
      service_token: ${_param:keystone_service_token}
      service_tenant: service
      admin_tenant: admin
      admin_name: admin
      admin_password: ${_param:keystone_admin_password}
      admin_email: root@localhost
      bind:
        address: 0.0.0.0
        protocol: ${_param:keystone_service_protocol}
        private_address: ${_param:keystone_service_host}
        private_port: 35357
        private_protocol: ${_param:keystone_service_protocol}
        public_address: ${_param:keystone_service_host}
        public_port: 5000
      region: RegionOne
      database:
        engine: mysql
        host: 'localhost'
        name: 'keystone'
        password: '${_param:mysql_keystone_password}'
        user: 'keystone'
      tokens:
        engine: cache
        expiration: 43200
        location: /etc/keystone/fernet-keys/
      credential:
        location: /etc/keystone/credential-keys/
      logging:
        log_appender: ${_param:openstack_log_appender}
        log_handlers:
          watchedfile:
            enabled: true
          fluentd:
            enabled: ${_param:openstack_fluentd_handler_enabled}
          ossyslog:
            enabled: ${_param:openstack_ossyslog_handler_enabled}
      message_queue:
        engine: rabbitmq
        host: ${_param:single_address}
        port: 5672
        user: openstack
        password: ${_param:rabbitmq_openstack_password}
        virtual_host: '/openstack'
        ha_queues: true
      cache:
        engine: memcached
        # NOTE (dukov) Do not change this unless you 100% sure what you are doing
        expiration_time: 600
        backend_argument:
          # NOTE (dukov) WARNING! This parameter depends on expiration_time.
          # Value of 'memcached_expire_time' must be bigger than 'expiration_time'
          memcached_expire_time:
            value: 660
        members:
        - host: localhost
          port: 11211