# manila.conf

The `manila.conf` file is installed in `/etc/manila` by default. When you manually install the Shared File Systems service, the options in the `manila.conf` file are set to default values.

The `manila.conf` file contains most of the options needed to configure the Shared File Systems service.

    [DEFAULT]

    #
    # From manila
    #

    # The maximum number of items returned in a single response from a
    # collection resource. (integer value)
    #osapi_max_limit = 1000

    # Base URL to be presented to users in links to the Share API (string
    # value)
    #osapi_share_base_URL = <None>

    # DEPRECATED: Treat X-Forwarded-For as the canonical remote address.
    # Only enable this if you have a sanitizing proxy. (boolean value)
    # This option is deprecated for removal since Zed.
    # Its value may be silently ignored in the future.
    # Reason: This feature is duplicate of the HTTPProxyToWSGI middleware
    # of oslo.middleware.
    #use_forwarded_for = false

    # Top-level directory for maintaining manila's state. (string value)
    #state_path = /var/lib/manila

    # IP address of this host. (host address value)
    #
    # This option has a sample default set, which means that
    # its actual default value may vary from the one documented
    # below.
    #my_ip = <your_ip>

    # The topic scheduler nodes listen on. (string value)
    #scheduler_topic = manila-scheduler

    # The topic share nodes listen on. (string value)
    #share_topic = manila-share

    # The topic data nodes listen on. (string value)
    #data_topic = manila-data

    # Whether to rate limit the API. (boolean value)
    #api_rate_limit = true

    # Specify list of extensions to load when using osapi_share_extension
    # option with manila.api.contrib.select_extensions. (list value)
    #osapi_share_ext_list =

    # The osapi share extensions to load. (list value)
    #osapi_share_extension = manila.api.contrib.standard_extensions

    # Full class name for the scheduler manager. (string value)
    #scheduler_manager = manila.scheduler.manager.SchedulerManager

    # Full class name for the share manager. (string value)
    #share_manager = manila.share.manager.ShareManager

    # Full class name for the data manager. (string value)
    #data_manager = manila.data.manager.DataManager

    # Name of this node.  This can be an opaque identifier. It is not
    # necessarily a hostname, FQDN, or IP address. (host address value)
    #
    # This option has a sample default set, which means that
    # its actual default value may vary from the one documented
    # below.
    #host = <your_hostname>

    # Availability zone of this node. (string value)
    #storage_availability_zone = nova

    # Default share type to use. (string value)
    #default_share_type = <None>

    # Default share group type to use. (string value)
    #default_share_group_type = <None>

    # Path to the rootwrap configuration file to use for running commands
    # as root. (string value)
    #rootwrap_config = <None>

    # Whether to log monkey patching. (boolean value)
    #monkey_patch = false

    # List of modules or decorators to monkey patch. (list value)
    #monkey_patch_modules =

    # Maximum time since last check-in for up service. (integer value)
    #service_down_time = 60

    # The full class name of the share API class to use. (string value)
    #share_api_class = manila.share.api.API

    # The strategy to use for auth. (string value)
    # Possible values:
    # noauth - <No description provided>
    # noauthv2 - <No description provided>
    # keystone - <No description provided>
    #auth_strategy = keystone

    # A list of share backend names to use. These backend names should be
    # backed by a unique [CONFIG] group with its options. (list value)
    #enabled_share_backends = <None>

    # Specify list of protocols to be allowed for share creation. (list
    # value)
    #enabled_share_protocols = NFS,CIFS

    # Maximum time (in seconds) to keep a share in the recycle bin, it
    # will be deleted automatically after this amount of time has elapsed.
    # (integer value)
    #soft_deleted_share_retention_time = 604800

    # Maximum time (in seconds) to keep a share in awaiting_transfer
    # state, after timeout, the share will automatically be rolled back to
    # the available state (integer value)
    #transfer_retention_time = 300

    # Metadata keys that should only be manipulated by administrators.
    # (list value)
    #admin_only_metadata = __affinity_same_host,__affinity_different_host,__managed_at

    # Metadata keys that will decide which share metadata (element of the
    # list is <driver_updatable_key>, i.e max_files) can be passed to
    # share drivers as part of metadata create/update operations. (list
    # value)
    #driver_updatable_metadata =

    # Metadata keys that will decide which share network subnet metadata
    # (element of the list is <driver_updatable_key>, e.g. pnfs) can be
    # passed to share drivers as part of metadata create/update
    # operations. (list value)
    #driver_updatable_subnet_metadata =

    # Whether Manila should update the status of all shares within a
    # backend during ongoing ensure_shares run. (boolean value)
    #update_shares_status_on_ensure = true

    # Metadata keys for export locations that should only be manipulated
    # by administrators. (list value)
    #admin_only_el_metadata = preferred

    # Specify list of protocols to be allowed for share backup creation
    # when using either the data manager generic backup approach, or
    # another backup driver that makes use of the data manager service.
    # (list value)
    #data_manager_backup_supported_share_protocols = NFS

    # The full class name of the Compute API class to use. (string value)
    #compute_api_class = manila.compute.nova.API

    # The back end URL to use for distributed coordination. (string value)
    #backend_url = file://$state_path

    # The template for mounting NFS shares. (string value)
    #backup_mount_template = mount -vt %(proto)s %(options)s %(export)s %(path)s

    # The template for unmounting NFS shares. (string value)
    #backup_unmount_template = umount -v %(path)s

    # NFS backup export location in hostname:path, ipv4addr:path, or
    # "[ipv6addr]:path" format. (string value)
    #backup_mount_export = <None>

    # Mount Protocol for mounting NFS shares (string value)
    #backup_mount_proto = nfs

    # Mount options passed to the NFS client. See NFS man page for
    # details. (string value)
    #backup_mount_options =

    # Time to wait for access rules to be allowed/denied on backends when
    # migrating a share (seconds). (integer value)
    #data_access_wait_access_rules_timeout = 180

    # A list of the IPs of the node interface connected to the admin
    # network. Used for allowing access to the mounting shares. Default is
    # []. (list value)
    #data_node_access_ips =

    # The certificate installed in the data node in order to allow access
    # to certificate authentication-based shares. (string value)
    #data_node_access_cert = <None>

    # The admin user name registered in the security service in order to
    # allow access to user authentication-based shares. (string value)
    #data_node_access_admin_user = <None>

    # Mount options to be included in the mount command for share
    # protocols. Use dictionary format, example: {'nfs': '-o nfsvers=3',
    # 'cifs': '-o user=foo,pass=bar'} (dict value)
    #data_node_mount_options =

    # Driver to use for backups. (string value)
    #backup_driver = manila.data.drivers.nfs.NFSBackupDriver

    # The template for mounting shares during backup. Must specify the
    # executable with all necessary parameters for the protocol supported.
    # 'proto' template element may not be required if included in the
    # command. 'export' and 'path' template elements are required. It is
    # advisable to separate different commands per backend. (string value)
    #backup_share_mount_template = mount -vt %(proto)s %(options)s %(export)s %(path)s

    # The template for unmounting shares during backup. Must specify the
    # executable with all necessary parameters for the protocol supported.
    # 'path' template element is required. It is advisable to separate
    # different commands per backend. (string value)
    #backup_share_unmount_template = umount -v %(path)s

    # List of files and folders to be ignored when backing up shares.
    # Items should be names (not including any path). (list value)
    #backup_ignore_files = lost+found

    # Protocol access mapping for backup. Should be a dictionary comprised
    # of {'access_type1': ['share_proto1', 'share_proto2'],
    # 'access_type2': ['share_proto2', 'share_proto3']}. (dict value)
    #backup_protocol_access_mapping = ip:['nfs']

    # Temporary path to create and mount shares during migration. (string
    # value)
    #mount_tmp_location = /tmp/

    # Temporary path to create and mount backup during share backup.
    # (string value)
    #backup_mount_tmp_location = /tmp/

    # Chooses whether hash of each file should be checked on data copying.
    # (boolean value)
    #check_hash = false

    # This value, specified in seconds, determines how often the data
    # manager will poll to perform the next steps of backup such as fetch
    # the progress of backup. (integer value)
    #backup_continue_update_interval = 10

    # This value, specified in seconds, determines how often the data
    # manager will poll to perform the next steps of restore such as fetch
    # the progress of restore. (integer value)
    #restore_continue_update_interval = 10

    # The backend to use for database. (string value)
    #db_backend = sqlalchemy

    # Services to be added to the available pool on create. (boolean
    # value)
    #enable_new_services = true

    # Template string to be used to generate share names. (string value)
    #share_name_template = share-%s

    # Template string to be used to generate share snapshot names. (string
    # value)
    #share_snapshot_name_template = share-snapshot-%s

    # Template string to be used to generate backup names. (string value)
    #share_backup_name_template = share-backup-%s

    # Driver to use for database access. (string value)
    #db_driver = manila.db

    # Whether to make exception message format errors fatal. (boolean
    # value)
    #fatal_exception_format_errors = false

    # The full class name of the Glance API class to use. (string value)
    #image_api_class = manila.image.glance.API

    # Message minimum life in seconds. (integer value)
    #message_ttl = 2592000

    # Interval between periodic task runs to clean expired messages in
    # seconds. (integer value)
    #message_reap_interval = 86400

    # Name of Open vSwitch bridge to use. (string value)
    #ovs_integration_bridge = br-int

    # The full class name of the Networking API class to use. (string
    # value)
    #network_api_class = manila.network.neutron.neutron_network_plugin.NeutronNetworkPlugin

    # Whether to support IPv4 network resource, Default=True. (boolean
    # value)
    #network_plugin_ipv4_enabled = true

    # Whether to support IPv6 network resource, Default=False. If this
    # option is True, the value of 'network_plugin_ipv4_enabled' will be
    # ignored. (boolean value)
    #network_plugin_ipv6_enabled = false

    # The name of the physical network to determine which net segment is
    # used. This opt is optional and will only be used for networks
    # configured with multiple segments. (string value)
    #neutron_physical_net_name = <None>

    # Default Neutron network that will be used for share server creation.
    # This opt is used only with class 'NeutronSingleNetworkPlugin'.
    # (string value)
    #neutron_net_id = <None>

    # Default Neutron subnet that will be used for share server creation.
    # Should be assigned to network defined in opt 'neutron_net_id'. This
    # opt is used only with class 'NeutronSingleNetworkPlugin'. (string
    # value)
    #neutron_subnet_id = <None>

    # vNIC type used for binding. (string value)
    # Possible values:
    # baremetal - <No description provided>
    # normal - <No description provided>
    # direct - <No description provided>
    # direct-physical - <No description provided>
    # macvtap - <No description provided>
    #neutron_vnic_type = baremetal

    # Host ID to be used when creating neutron port. If not set host is
    # set to manila-share host by default. (string value)
    #neutron_host_id = lcy02-amd64-092

    # A list of binding profiles to be used during port binding. This
    # option can be used with the NeutronBindNetworkPlugin. The value for
    # this option has to be a comma separated list of names that
    # correspond to each binding profile. Each binding profile needs to be
    # specified as an individual configuration section using the binding
    # profile name as the section name. (list value)
    #neutron_binding_profiles = <None>

    # Switch ID for binding profile. (string value)
    #neutron_switch_id = <None>

    # Port ID on the given switch. (string value)
    #neutron_port_id = <None>

    # Switch label. For example: 'switch_ip: 10.4.30.5'. Multiple key-
    # value pairs separated by commas are accepted. (dict value)
    #neutron_switch_info = <None>

    # Gateway address that should be used. Required. (string value)
    #standalone_network_plugin_gateway = <None>

    # Network mask that will be used. Can be either decimal like '24' or
    # binary like '255.255.255.0'. Required. (string value)
    #standalone_network_plugin_mask = <None>

    # Network type, such as 'flat', 'vlan', 'vxlan' or 'gre'. Empty value
    # is alias for 'flat'. It will be assigned to share-network and share
    # drivers will be able to use this for network interfaces within
    # provisioned share servers. Optional. (string value)
    # Possible values:
    # flat - <No description provided>
    # vlan - <No description provided>
    # vxlan - <No description provided>
    # gre - <No description provided>
    #standalone_network_plugin_network_type = <None>

    # Set it if network has segmentation (VLAN, VXLAN, etc...). It will be
    # assigned to share-network and share drivers will be able to use this
    # for network interfaces within provisioned share servers. Optional.
    # Example: 1001 (integer value)
    #standalone_network_plugin_segmentation_id = <None>

    # Can be IP address, range of IP addresses or list of addresses or
    # ranges. Contains addresses from IP network that are allowed to be
    # used. If empty, then will be assumed that all host addresses from
    # network can be used. Optional. Examples: 10.0.0.10 or
    # 10.0.0.10-10.0.0.20 or
    # 10.0.0.10-10.0.0.20,10.0.0.30-10.0.0.40,10.0.0.50 (list value)
    #standalone_network_plugin_allowed_ip_ranges = <None>

    # Maximum Transmission Unit (MTU) value of the network. Default value
    # is 1500. (integer value)
    #standalone_network_plugin_mtu = 1500

    # The scheduler host manager class to use. (string value)
    #scheduler_host_manager = manila.scheduler.host_manager.HostManager

    # Maximum number of attempts to schedule a share. (integer value)
    #scheduler_max_attempts = 3

    # Which filter class names to use for filtering hosts when not
    # specified in the request. (list value)
    #scheduler_default_filters = OnlyHostFilter,AvailabilityZoneFilter,CapacityFilter,CapabilitiesFilter,DriverFilter,ShareReplicationFilter,CreateFromSnapshotFilter,AffinityFilter,AntiAffinityFilter

    # Which weigher class names to use for weighing hosts. (list value)
    #scheduler_default_weighers = CapacityWeigher,GoodnessWeigher,HostAffinityWeigher

    # Which filter class names to use for filtering hosts creating share
    # group when not specified in the request. (list value)
    #scheduler_default_share_group_filters = AvailabilityZoneFilter,ConsistentSnapshotFilter

    # Which filter class names to use for filtering hosts extending share
    # when not specified in the request. (list value)
    #scheduler_default_extend_filters = CapacityFilter,DriverFilter

    # Default scheduler driver to use. (string value)
    #scheduler_driver = manila.scheduler.drivers.filter.FilterScheduler

    # Absolute path to scheduler configuration JSON file. (string value)
    #scheduler_json_config_location =

    # Maximum number of volume gigabytes to allow per host. (integer
    # value)
    #max_gigabytes = 10000

    # Multiplier used for weighing share capacity. Negative numbers mean
    # to stack vs spread. (floating point value)
    #capacity_weight_multiplier = 1.0

    # Multiplier used for weighing pools which have existing share
    # servers. Negative numbers mean to spread vs stack. (floating point
    # value)
    #pool_weight_multiplier = 1.0

    # Seconds between nodes reporting state to datastore. (integer value)
    #report_interval = 10

    # Seconds between cleaning up the stopped nodes. (integer value)
    # Minimum value: 300
    #cleanup_interval = 1800

    # Seconds between running periodic tasks. (integer value)
    #periodic_interval = 60

    # Range of seconds to randomly delay when starting the periodic task
    # scheduler to reduce stampeding. (Disable by setting to 0) (integer
    # value)
    #periodic_fuzzy_delay = 60

    # IP address for OpenStack Share API to listen on. (host address
    # value)
    #osapi_share_listen = ::

    # Port for OpenStack Share API to listen on. (port value)
    # Minimum value: 0
    # Maximum value: 65535
    #osapi_share_listen_port = 8786

    # Number of workers for OpenStack Share API service. (integer value)
    #osapi_share_workers = 1

    # Wraps the socket in a SSL context if True is set. A certificate file
    # and key file must be specified. (boolean value)
    #osapi_share_use_ssl = false

    # If set to False, then share creation from snapshot will be performed
    # on the same host. If set to True, then scheduler will be used.When
    # enabling this option make sure that filter CreateFromSnapshotFilter
    # is enabled and to have hosts reporting replication_domain option.
    # (boolean value)
    #use_scheduler_creating_share_from_snapshot = false

    # Default prefix that will be used if none is providedthrough
    # share_type extra specs. Prefix will only beused if share_type
    # support mount_point_name. (string value)
    #default_mount_point_prefix = {project_id}_

    # Whether to delete shares and share snapshots in a deferred manner.
    # Setting this option to True will cause quotas to be released
    # immediately if a deletion request is accepted. Deletions may
    # eventually fail, and rectifying them will require manual
    # intervention. (boolean value)
    #is_deferred_deletion_enabled = false

    # Directory where Ganesha config files are stored. (string value)
    #ganesha_config_dir = /etc/ganesha

    # Path to main Ganesha config file. (string value)
    #ganesha_config_path = $ganesha_config_dir/ganesha.conf

    # Name of the ganesha nfs service. (string value)
    #ganesha_service_name = ganesha.nfsd

    # Location of Ganesha database file. (Ganesha module only.) (string
    # value)
    #ganesha_db_path = $state_path/manila-ganesha.db

    # Path to directory containing Ganesha export configuration. (Ganesha
    # module only.) (string value)
    #ganesha_export_dir = $ganesha_config_dir/export.d

    # Path to directory containing Ganesha export block templates.
    # (Ganesha module only.) (string value)
    #ganesha_export_template_dir = /etc/manila/ganesha-export-templ.d

    # Persist Ganesha exports and export counter in Ceph RADOS objects,
    # highly available storage. (boolean value)
    #ganesha_rados_store_enable = false

    # Name of the Ceph RADOS pool to store Ganesha exports and export
    # counter. (string value)
    #ganesha_rados_store_pool_name = <None>

    # Name of the Ceph RADOS object used as the Ganesha export counter.
    # (string value)
    #ganesha_rados_export_counter = ganesha-export-counter

    # Name of the Ceph RADOS object used to store a list of the export
    # RADOS object URLS. (string value)
    #ganesha_rados_export_index = ganesha-export-index

    # Number of times to attempt to run flakey shell commands. (integer
    # value)
    #num_shell_tries = 3

    # The percentage of backend capacity reserved. Used for shares which
    # are not created from the snapshot. (integer value)
    #reserved_share_percentage = 0

    # The percentage of backend capacity reserved. Used for shares created
    # from the snapshot. On some platforms, shares can only be created
    # from the snapshot on the host where snapshot was taken, so we can
    # set a lower value in this option compared to
    # reserved_share_percentage, and allow to create shares from the
    # snapshot on the same host up to a higher threshold. (integer value)
    #reserved_share_from_snapshot_percentage = 0

    # The percentage of backend capacity reserved for share extend
    # operation. When existing limit of 'reserved_share_percentage' is
    # hit, we do not want user to create a new share but existing shares
    # can be extended based on value of this parameter. (integer value)
    #reserved_share_extend_percentage = 0

    # The backend name for a given driver implementation. (string value)
    #share_backend_name = <None>

    # Name of the configuration group in the Manila conf file to look for
    # network config options.If not set, the share backend's config group
    # will be used.If an option is not found within provided group, then
    # 'DEFAULT' group will be used for search of option. (string value)
    #network_config_group = <None>

    # There are two possible approaches for share drivers in Manila. First
    # is when share driver is able to handle share-servers and second when
    # not. Drivers can support either both or only one of these
    # approaches. So, set this opt to True if share driver is able to
    # handle share servers and it is desired mode else set False. It is
    # set to None by default to make this choice intentional. (boolean
    # value)
    #driver_handles_share_servers = <None>

    # Float representation of the over subscription ratio when thin
    # provisioning is involved. Default ratio is 20.0, meaning provisioned
    # capacity can be 20 times the total physical capacity. If the ratio
    # is 10.5, it means provisioned capacity can be 10.5 times the total
    # physical capacity. A ratio of 1.0 means provisioned capacity cannot
    # exceed the total physical capacity. A ratio lower than 1.0 is
    # invalid. (floating point value)
    # Minimum value: 1.0
    #max_over_subscription_ratio = 20.0

    # List of files and folders to be ignored when migrating shares. Items
    # should be names (not including any path). (list value)
    #migration_ignore_files = lost+found

    # The template for mounting shares for this backend. Must specify the
    # executable with all necessary parameters for the protocol supported.
    # 'proto' template element may not be required if included in the
    # command. 'export' and 'path' template elements are required. It is
    # advisable to separate different commands per backend. (string value)
    #share_mount_template = mount -vt %(proto)s %(options)s %(export)s %(path)s

    # The template for unmounting shares for this backend. Must specify
    # the executable with all necessary parameters for the protocol
    # supported. 'path' template element is required. It is advisable to
    # separate different commands per backend. (string value)
    #share_unmount_template = umount -v %(path)s

    # Protocol access mapping for this backend. Should be a dictionary
    # comprised of {'access_type1': ['share_proto1', 'share_proto2'],
    # 'access_type2': ['share_proto2', 'share_proto3']}. (dict value)
    #protocol_access_mapping = ip:['nfs'],user:['cifs']

    # If share driver requires to setup admin network for share, then
    # define network plugin config options in some separate config group
    # and set its name here. Used only with another option
    # 'driver_handles_share_servers' set to 'True'. (string value)
    #admin_network_config_group = <None>

    # A string specifying the replication domain that the backend belongs
    # to. This option needs to be specified the same in the configuration
    # sections of all backends that support replication between each
    # other. If this option is not specified in the group, it means that
    # replication is not enabled on the backend. (string value)
    #replication_domain = <None>

    # Availability zone for this share backend. If not set, the
    # ``storage_availability_zone`` option from the ``[DEFAULT]`` section
    # is used. (string value)
    #backend_availability_zone = <None>

    # String representation for an equation that will be used to filter
    # hosts. (string value)
    #filter_function = <None>

    # String representation for an equation that will be used to determine
    # the goodness of a host. (string value)
    #goodness_function = <None>

    # Maximum number of share instances created in a share server.
    # (integer value)
    #max_shares_per_share_server = -1

    # Maximum sum of gigabytes a share server can have considering all its
    # share instances and snapshots. (integer value)
    #max_share_server_size = -1

    # Backend server SSH connection timeout. (integer value)
    #ssh_conn_timeout = 60

    # Minimum number of connections in the SSH pool. (integer value)
    #ssh_min_pool_conn = 1

    # Maximum number of connections in the SSH pool. (integer value)
    #ssh_max_pool_conn = 10

    # The full class name of the Private Data Driver class to use. (string
    # value)
    #drivers_private_storage_class = manila.share.drivers_private_data.SqlStorageDriver

    # Fully qualified path to the ceph.conf file. (string value)
    #cephfs_conf_path =

    # The name of the cluster in use, if it is not the default ('ceph').
    # (string value)
    #cephfs_cluster_name = <None>

    # The name of the ceph auth identity to use. (string value)
    #cephfs_auth_id = manila

    # DEPRECATED: The prefix of the cephfs volume path. (string value)
    # This option is deprecated for removal since Wallaby.
    # Its value may be silently ignored in the future.
    # Reason: This option is not used starting with the Nautilus release
    # of Ceph.
    #cephfs_volume_path_prefix = /volumes

    # The type of protocol helper to use. Default is CEPHFS. (string
    # value)
    # Possible values:
    # CEPHFS - <No description provided>
    # NFS - <No description provided>
    #cephfs_protocol_helper_type = CEPHFS

    # DEPRECATED: Whether the NFS-Ganesha server is remote to the driver.
    # (boolean value)
    # This option is deprecated for removal since 2025.1.
    # Its value may be silently ignored in the future.
    # Reason: This option is used by the deprecated NFSProtocolHelper
    #cephfs_ganesha_server_is_remote = false

    # The IP address of the NFS-Ganesha server. (host address value)
    #cephfs_ganesha_server_ip = <None>

    # DEPRECATED: The username to authenticate as in the remote NFS-
    # Ganesha server host. (string value)
    # This option is deprecated for removal since 2025.1.
    # Its value may be silently ignored in the future.
    # Reason: This option is used by the deprecated NFSProtocolHelper
    #cephfs_ganesha_server_username = root

    # DEPRECATED: The path of the driver host's private SSH key file.
    # (string value)
    # This option is deprecated for removal since 2025.1.
    # Its value may be silently ignored in the future.
    # Reason: This option is used by the deprecated NFSProtocolHelper
    #cephfs_ganesha_path_to_private_key = <None>

    # DEPRECATED: The password to authenticate as the user in the remote
    # Ganesha server host. This is not required if
    # 'cephfs_ganesha_path_to_private_key' is configured. (string value)
    # This option is deprecated for removal since 2025.1.
    # Its value may be silently ignored in the future.
    # Reason: This option is used by the deprecated NFSProtocolHelper
    #cephfs_ganesha_server_password = <None>

    # List of IPs to export shares. If not supplied, then the value of
    # 'cephfs_ganesha_server_ip' will be used to construct share export
    # locations. (list value)
    #cephfs_ganesha_export_ips =

    # The read/write/execute permissions mode for CephFS volumes,
    # snapshots, and snapshot groups expressed in Octal as with linux
    # 'chmod' or 'umask' commands. (string value)
    #cephfs_volume_mode = 755

    # The name of the filesystem to use, if there are multiple filesystems
    # in the cluster. (string value)
    #cephfs_filesystem_name = <None>

    # Provide a unique string value to make the driver ensure all of the
    # shares it has created during startup. Ensuring would re-export
    # shares and this action isn't always required, unless something has
    # been administratively modified on CephFS. (string value)
    #cephfs_ensure_all_shares_salt = manila_cephfs_reef_caracal

    # The maximum time in seconds that the cached pool data will be
    # considered updated. If it is expired when trying to read the pool
    # data, it must be refreshed. (integer value)
    # Minimum value: 0
    #cephfs_cached_allocated_capacity_update_interval = 60

    # Linux bridge used by container hypervisor to plug host-side veth to.
    # It will be unplugged from here by the driver. (string value)
    #container_linux_bridge_name = docker0

    # OVS bridge to use to plug a container to. (string value)
    #container_ovs_bridge_name = br-int

    # Determines whether to allow guest access to CIFS share or not.
    # (boolean value)
    #container_cifs_guest_ok = true

    # Image to be used for a container-based share server. (string value)
    #container_image_name = manila-docker-container

    # Container helper which provides container-related operations to the
    # driver. (string value)
    #container_helper = manila.share.drivers.container.container_helper.DockerExecHelper

    # Helper which facilitates interaction with share server. (string
    # value)
    #container_protocol_helper = manila.share.drivers.container.protocol_helper.DockerCIFSHelper

    # Helper which facilitates interaction with security services. (string
    # value)
    #container_security_service_helper = manila.share.drivers.container.security_service_helper.SecurityServiceHelper

    # Helper which facilitates interaction with storage solution used to
    # actually store data. By default LVM is used to provide storage for a
    # share. (string value)
    #container_storage_helper = manila.share.drivers.container.storage_helper.LVMHelper

    # Folder name in host to which logical volume will be mounted prior to
    # providing access to it from a container. (string value)
    #container_volume_mount_path = /tmp/shares

    # LVM volume group to use for volumes. This volume group must be
    # created by the cloud administrator independently from manila
    # operations. (string value)
    #container_volume_group = manila_docker_volumes

    # User name for the EMC server. (string value)
    #emc_nas_login = <None>

    # Password for the EMC server. (string value)
    #emc_nas_password = <None>

    # EMC server hostname or IP address. (host address value)
    #emc_nas_server = <None>

    # Port number for the EMC server. (port value)
    # Minimum value: 0
    # Maximum value: 65535
    #emc_nas_server_port = 8080

    # Use secure connection to server. (boolean value)
    #emc_nas_server_secure = true

    # Share backend. (string value)
    # Possible values:
    # powerscale - <No description provided>
    # isilon - <No description provided>
    # vnx - <No description provided>
    # unity - <No description provided>
    # powermax - <No description provided>
    # powerstore - <No description provided>
    # powerflex - <No description provided>
    #emc_share_backend = <None>

    # The root directory where shares will be located. (string value)
    #emc_nas_root_dir = <None>

    # If set to False the https client will not validate the SSL
    # certificate of the backend endpoint. (boolean value)
    #emc_ssl_cert_verify = true

    # Can be used to specify a non default path to a CA_BUNDLE file or
    # directory with certificates of trusted CAs, which will be used to
    # validate the backend. (string value)
    #emc_ssl_cert_path = <None>

    # Data mover to host the NAS server. (string value)
    #powermax_server_container = <None>

    # Comma separated list of pools that can be used to persist share
    # data. (list value)
    #powermax_share_data_pools = <None>

    # Comma separated list of ports that can be used for share server
    # interfaces. Members of the list can be Unix-style glob expressions.
    # (list value)
    #powermax_ethernet_ports = <None>

    # Path to smb config. (string value)
    #smb_template_config_path = $state_path/smb.conf

    # Volume name template. (string value)
    #volume_name_template = manila-share-%s

    # Volume snapshot name template. (string value)
    #volume_snapshot_name_template = manila-snapshot-%s

    # Parent path in service instance where shares will be mounted.
    # (string value)
    #share_mount_path = /shares

    # Maximum time to wait for creating cinder volume. (integer value)
    #max_time_to_create_volume = 180

    # Maximum time to wait for extending cinder volume. (integer value)
    #max_time_to_extend_volume = 180

    # Maximum time to wait for attaching cinder volume. (integer value)
    #max_time_to_attach = 120

    # Path to SMB config in service instance. (string value)
    #service_instance_smb_config_path = $share_mount_path/smb.conf

    # Specify list of share export helpers. (dict value)
    #share_helpers = CIFS:manila.share.drivers.helpers.CIFSHelperIPAccess,NFS:manila.share.drivers.helpers.NFSHelper

    # Filesystem type of the share volume. (string value)
    # Possible values:
    # ext4 - <No description provided>
    # ext3 - <No description provided>
    #share_volume_fstype = ext4

    # Name or id of cinder volume type which will be used for all volumes
    # created by driver. (string value)
    #cinder_volume_type = <None>

    # If True, sets reserved blocks to 0 on formatted ext volumes to
    # ensure full capacity is available to the share. (boolean value)
    #set_zero_reserved_blocks = true

    # Remote GlusterFS server node's login password. This is not required
    # if 'glusterfs_path_to_private_key' is configured. (string value)
    #glusterfs_server_password = <None>

    # Path of Manila host's private SSH key file. (string value)
    #glusterfs_path_to_private_key = <None>

    # Type of NFS server that mediate access to the Gluster volumes
    # (Gluster or Ganesha). (string value)
    #glusterfs_nfs_server_type = Gluster

    # Remote Ganesha server node's IP address. (host address value)
    #glusterfs_ganesha_server_ip = <None>

    # Remote Ganesha server node's username. (string value)
    #glusterfs_ganesha_server_username = root

    # Remote Ganesha server node's login password. This is not required if
    # 'glusterfs_path_to_private_key' is configured. (string value)
    #glusterfs_ganesha_server_password = <None>

    # Specifies GlusterFS share layout, that is, the method of associating
    # backing GlusterFS resources to shares. (string value)
    #glusterfs_share_layout = <None>

    # Specifies the GlusterFS volume to be mounted on the Manila host. It
    # is of the form [remoteuser@]<volserver>:<volid>. (string value)
    #glusterfs_target = <None>

    # Base directory containing mount points for Gluster volumes. (string
    # value)
    #glusterfs_mount_point_base = $state_path/mnt

    # List of GlusterFS servers that can be used to create shares. Each
    # GlusterFS server should be of the form [remoteuser@]<volserver>, and
    # they are assumed to belong to distinct Gluster clusters. (list
    # value)
    #glusterfs_servers =

    # Regular expression template used to filter GlusterFS volumes for
    # share creation. The regex template can optionally (ie. with support
    # of the GlusterFS backend) contain the #{size} parameter which
    # matches an integer (sequence of digits) in which case the value
    # shall be interpreted as size of the volume in GB. Examples: "manila-
    # share-volume-\d+$", "manila-share-volume-#{size}G-\d+$"; with
    # matching volume names, respectively: "manila-share-volume-12",
    # "manila-share-volume-3G-13". In latter example, the number that
    # matches "#{size}", that is, 3, is an indication that the size of
    # volume is 3G. (string value)
    #glusterfs_volume_pattern = <None>

    # The IP of the HDFS namenode. (host address value)
    #hdfs_namenode_ip = <None>

    # The port of HDFS namenode service. (port value)
    # Minimum value: 0
    # Maximum value: 65535
    #hdfs_namenode_port = 9000

    # HDFS namenode SSH port. (port value)
    # Minimum value: 0
    # Maximum value: 65535
    #hdfs_ssh_port = 22

    # HDFS namenode ssh login name. (string value)
    #hdfs_ssh_name = <None>

    # HDFS namenode SSH login password, This parameter is not necessary,
    # if 'hdfs_ssh_private_key' is configured. (string value)
    #hdfs_ssh_pw = <None>

    # Path to HDFS namenode SSH private key for login. (string value)
    #hdfs_ssh_private_key = <None>

    # HNAS management interface IP for communication between Manila
    # controller and HNAS. (host address value)
    #hitachi_hnas_ip = <None>

    # HNAS username Base64 String in order to perform tasks such as create
    # file-systems and network interfaces. (string value)
    #hitachi_hnas_user = <None>

    # HNAS user password. Required only if private key is not provided.
    # (string value)
    #hitachi_hnas_password = <None>

    # Specify which EVS this backend is assigned to. (integer value)
    #hitachi_hnas_evs_id = <None>

    # Specify IP for mounting shares. (host address value)
    #hitachi_hnas_evs_ip = <None>

    # Specify IP for mounting shares in the Admin network. (host address
    # value)
    #hitachi_hnas_admin_network_ip = <None>

    # Specify file-system name for creating shares. (string value)
    #hitachi_hnas_file_system_name = <None>

    # RSA/DSA private key value used to connect into HNAS. Required only
    # if password is not provided. (string value)
    #hitachi_hnas_ssh_private_key = <None>

    # The IP of the clusters admin node. Only set in HNAS multinode
    # clusters. (host address value)
    #hitachi_hnas_cluster_admin_ip0 = <None>

    # The time (in seconds) to wait for stalled HNAS jobs before aborting.
    # (integer value)
    #hitachi_hnas_stalled_job_timeout = 30

    # Python class to be used for driver helper. (string value)
    #hitachi_hnas_driver_helper = manila.share.drivers.hitachi.hnas.ssh.HNASSSHBackend

    # By default, CIFS snapshots are not allowed to be taken when the
    # share has clients connected because consistent point-in-time replica
    # cannot be guaranteed for all files. Enabling this might cause
    # inconsistent snapshots on CIFS shares. (boolean value)
    #hitachi_hnas_allow_cifs_snapshot_while_mounted = false

    # HSP management host for communication between Manila controller and
    # HSP. (host address value)
    #hitachi_hsp_host = <None>

    # HSP username to perform tasks such as create filesystems and shares.
    # (string value)
    #hitachi_hsp_username = <None>

    # HSP password for the username provided. (string value)
    #hitachi_hsp_password = <None>

    # Alletra WSAPI V3 Server Url like https://<alletra ip>:8080/api/v3
    # (string value)
    #hpealletra_wsapi_url =

    # Alletra username with the 'edit' role (string value)
    #hpealletra_username =

    # Alletra password for the user specified in hpealletra_username
    # (string value)
    #hpealletra_password =

    # Enable HTTP debugging to Alletra (boolean value)
    #hpealletra_debug = false

    # 3PAR WSAPI Server Url like https://<3par ip>:8080/api/v1 (string
    # value)
    #hpe3par_api_url =

    # 3PAR username with the 'edit' role (string value)
    #hpe3par_username =

    # 3PAR password for the user specified in hpe3par_username (string
    # value)
    #hpe3par_password =

    # IP address of SAN controller (host address value)
    #hpe3par_san_ip = <None>

    # Username for SAN controller (string value)
    #hpe3par_san_login =

    # Password for SAN controller (string value)
    #hpe3par_san_password =

    # SSH port to use with SAN (port value)
    # Minimum value: 0
    # Maximum value: 65535
    #hpe3par_san_ssh_port = 22

    # The File Provisioning Group (FPG) to use (FPG)
    #hpe3par_fpg = <None>

    # Use one filestore per share (boolean value)
    #hpe3par_fstore_per_share = false

    # Require IP access rules for CIFS (in addition to user) (boolean
    # value)
    #hpe3par_require_cifs_ip = false

    # Enable HTTP debugging to 3PAR (boolean value)
    #hpe3par_debug = false

    # File system admin user name for CIFS. (string value)
    #hpe3par_cifs_admin_access_username =

    # File system admin password for CIFS. (string value)
    #hpe3par_cifs_admin_access_password =

    # File system domain for the CIFS admin user. (string value)
    #hpe3par_cifs_admin_access_domain = LOCAL_CLUSTER

    # The path where shares will be mounted when deleting nested file
    # trees. (string value)
    #hpe3par_share_mount_path = /mnt/

    # The configuration file for the Manila Huawei driver. (string value)
    #manila_huawei_conf_file = /etc/manila/manila_huawei_conf.xml

    # IP to be added to GPFS export string. (host address value)
    #gpfs_share_export_ip = <None>

    # Base folder where exported shares are located. (string value)
    #gpfs_mount_point_base = $state_path/mnt

    # NFS Server type. Valid choices are "CES" (Ganesha NFS) or "KNFS"
    # (Kernel NFS). (string value)
    #gpfs_nfs_server_type = CES

    # A list of the fully qualified NFS server names that make up the
    # OpenStack Manila configuration. (list value)
    #gpfs_nfs_server_list = <None>

    # True:when Manila services are running on one of the Spectrum Scale
    # node. False:when Manila services are not running on any of the
    # Spectrum Scale node. (boolean value)
    #is_gpfs_node = false

    # GPFS server SSH port. (port value)
    # Minimum value: 0
    # Maximum value: 65535
    #gpfs_ssh_port = 22

    # GPFS server SSH login name. (string value)
    #gpfs_ssh_login = <None>

    # GPFS server SSH login password. The password is not needed, if
    # 'gpfs_ssh_private_key' is configured. (string value)
    #gpfs_ssh_password = <None>

    # Path to GPFS server SSH private key for login. (string value)
    #gpfs_ssh_private_key = <None>

    # Specify list of share export helpers. (dict value)
    #gpfs_share_helpers = CES:manila.share.drivers.ibm.gpfs.CESHelper,KNFS:manila.share.drivers.ibm.gpfs.KNFSHelper

    # Administrative user account name used to access the INFINIDAT
    # Infinibox storage system. (string value)
    #infinibox_login = <None>

    # Password for the administrative user account specified in the
    # infinibox_login option. (string value)
    #infinibox_password = <None>

    # The name (or IP address) for the INFINIDAT Infinibox storage system.
    # (host address value)
    #infinibox_hostname = <None>

    # Use SSL to connect to the INFINIDAT Infinibox storage system.
    # (boolean value)
    #infinidat_use_ssl = false

    # Suppress requests library SSL certificate warnings. (boolean value)
    #infinidat_suppress_ssl_warnings = false

    # Name of the pool from which volumes are allocated. (string value)
    #infinidat_pool_name = <None>

    # Name of the NAS network space on the INFINIDAT InfiniBox. (string
    # value)
    #infinidat_nas_network_space_name = <None>

    # Use thin provisioning. (boolean value)
    #infinidat_thin_provision = true

    # Controls access to the .snapshot directory. By default, each share
    # allows access to its own .snapshot directory, which contains files
    # and directories of each snapshot taken. To restrict access to the
    # .snapshot directory, this option should be set to False. (boolean
    # value)
    #infinidat_snapdir_accessible = true

    # Controls visibility of the .snapshot directory. By default, each
    # share contains the .snapshot directory, which is hidden on the
    # client side. To make the .snapshot directory visible, this option
    # should be set to True. (boolean value)
    #infinidat_snapdir_visible = false

    # Infortrend NAS IP for management. (host address value)
    #infortrend_nas_ip = <None>

    # User for the Infortrend NAS server. (string value)
    #infortrend_nas_user = manila

    # Password for the Infortrend NAS server. This is not necessary if
    # infortrend_nas_ssh_key is set. (string value)
    #infortrend_nas_password = <None>

    # SSH key for the Infortrend NAS server. This is not necessary if
    # infortrend_nas_password is set. (string value)
    #infortrend_nas_ssh_key = <None>

    # Comma separated list of Infortrend NAS pools. (list value)
    #infortrend_share_pools = <None>

    # Comma separated list of Infortrend channels. (list value)
    #infortrend_share_channels = <None>

    # SSH timeout in seconds. (integer value)
    #infortrend_ssh_timeout = 30

    # IP address for the AS13000 storage. (host address value)
    #as13000_nas_ip = <None>

    # Port number for the AS13000 storage. (port value)
    # Minimum value: 0
    # Maximum value: 65535
    #as13000_nas_port = 8088

    # Username for the AS13000 storage (string value)
    #as13000_nas_login = <None>

    # Password for the AS13000 storage (string value)
    #as13000_nas_password = <None>

    # The Storage Pools Manila should use, a comma separated list (list
    # value)
    #as13000_share_pools = <None>

    # The effective time of token validity in seconds. (integer value)
    #as13000_token_available_time = 3600

    # IP address for the InStorage. (host address value)
    #instorage_nas_ip = <None>

    # Port number for the InStorage. (port value)
    # Minimum value: 0
    # Maximum value: 65535
    #instorage_nas_port = 22

    # Username for the InStorage. (string value)
    #instorage_nas_login = <None>

    # Password for the InStorage. (string value)
    #instorage_nas_password = <None>

    # The Storage Pools Manila should use, a comma separated list. (list
    # value)
    #instorage_nas_pools = <None>

    # IP address for the Macrosan NAS server. (host address value)
    #macrosan_nas_ip = <None>

    # Port number for the Macrosan NAS server. (port value)
    # Minimum value: 0
    # Maximum value: 65535
    #macrosan_nas_port = 8443

    # Username for the Macrosan NAS server. (string value)
    #macrosan_nas_username = manila

    # Password for the Macrosan NAS server. (string value)
    #macrosan_nas_password = <None>

    # Http protocol for the Macrosan NAS server. (string value)
    # Possible values:
    # http - <No description provided>
    # https - <No description provided>
    #macrosan_nas_http_protocol = https

    # Defines whether the driver should check ssl cert. (boolean value)
    #macrosan_ssl_cert_verify = false

    # Url prefix for the Macrosan NAS server. (string value)
    #macrosan_nas_prefix = nas

    # Comma separated list of Macrosan NAS pools. (list value)
    #macrosan_share_pools = <None>

    # request timeout in seconds. (integer value)
    #macrosan_timeout = 60

    # The list of IPs or hostnames of nodes where mapr-core is installed.
    # (list value)
    #maprfs_clinode_ip = <None>

    # CLDB node SSH port. (port value)
    # Minimum value: 0
    # Maximum value: 65535
    #maprfs_ssh_port = 22

    # Cluster admin user ssh login name. (string value)
    #maprfs_ssh_name = mapr

    # Cluster node SSH login password, This parameter is not necessary, if
    # 'maprfs_ssh_private_key' is configured. (string value)
    #maprfs_ssh_pw = <None>

    # Path to SSH private key for login. (string value)
    #maprfs_ssh_private_key = <None>

    # Path in MapRFS where share volumes must be created. (string value)
    #maprfs_base_volume_dir = /

    # The list of IPs or hostnames of ZooKeeper nodes. (list value)
    #maprfs_zookeeper_ip = <None>

    # The list of IPs or hostnames of CLDB nodes. (list value)
    #maprfs_cldb_ip = <None>

    # Specify whether existing volume should be renamed when start
    # managing. (boolean value)
    #maprfs_rename_managed_volume = true

    # Base folder where exported shares are located. (string value)
    #lvm_share_export_root = $state_path/mnt

    # List of IPs to export shares belonging to the LVM storage driver.
    # (list value)
    #lvm_share_export_ips = <None>

    # If set, create LVMs with multiple mirrors. Note that this requires
    # lvm_mirrors + 2 PVs with available space. (integer value)
    #lvm_share_mirrors = 0

    # Name for the VG that will contain exported shares. (string value)
    #lvm_share_volume_group = lvm-shares

    # Specify list of share export helpers. (dict value)
    #lvm_share_helpers = CIFS:manila.share.drivers.helpers.CIFSHelperUserAccess,NFS:manila.share.drivers.helpers.NFSHelper

    # The storage family type used on the storage system; valid values
    # include ontap_cluster for using clustered Data ONTAP. (string value)
    #netapp_storage_family = ontap_cluster

    # The hostname (or IP address) for the storage system. (host address
    # value)
    #netapp_server_hostname = <None>

    # The TCP port to use for communication with the storage system or
    # proxy server. If not specified, Data ONTAP drivers will use 80 for
    # HTTP and 443 for HTTPS. (port value)
    # Minimum value: 0
    # Maximum value: 65535
    #netapp_server_port = <None>

    # The ONTAP client used for retrieving and modifying data on the
    # storage. The legacy client relies mostly on ZAPI calls, only using
    # REST calls for SVM migrate feature. If set to False, the new REST
    # client is used, which runs REST calls if supported, otherwise falls
    # back to the equivalent ZAPI call. (boolean value)
    #netapp_use_legacy_client = true

    # The transport protocol used when communicating with the storage
    # system or proxy server. Valid values are http or https. (string
    # value)
    #netapp_transport_type = http

    # The path to a CA_BUNDLE file or directory with certificates of
    # trusted CA. If set to a directory, it must have been processed using
    # the c_rehash utility supplied with OpenSSL. If not informed, it will
    # use the Mozilla's carefully curated collection of Root Certificates
    # for validating the trustworthiness of SSL certificates. (string
    # value)
    #netapp_ssl_cert_path = <None>

    # Administrative user account name used to access the storage system.
    # (string value)
    #netapp_login = <None>

    # Password for the administrative user account specified in the
    # netapp_login option. (string value)
    #netapp_password = <None>

    # For self signed certificate: This file contains the private key
    # associated with the self-signed certificate. It is a sensitive file
    # that should be kept secure and protected. The private key is used to
    # sign the certificate and establish the authenticity and integrity of
    # the certificate during the authentication process. For ca verified
    # certificate: This file contains the private key associated with the
    # certificate. It is generated when creating the certificate signing
    # request (CSR) and should be kept secure and protected. The private
    # key is used to sign the CSR and later used to establish secure
    # connections and authenticate the entity. (string value)
    #
    # This option has a sample default set, which means that
    # its actual default value may vary from the one documented
    # below.
    #netapp_private_key_file = /path/to/private_key.key,

    # For self signed certificate: This file contains the self-signed
    # digital certificate itself. It includes information about the entity
    # such as the common name (e.g., domain name), organization details,
    # validity period, and public key. The certificate file is generated
    # based on the private key and is used by clients or systems to verify
    # the entity identity during the authentication process. For ca
    # verified certificate: This file contains the digital certificate
    # issued by the trusted third-party certificate authority (CA). It
    # includes information about the entity identity, public key, and the
    # CA that issued the certificate. The certificate file is used by
    # clients or systems to verify the authenticity and integrity of the
    # entity during the authentication process. (string value)
    #
    # This option has a sample default set, which means that
    # its actual default value may vary from the one documented
    # below.
    #netapp_certificate_file = /path/to/certificate.pem

    # This is applicable only for ca verified certificate. This file
    # contains the public key certificate of the trusted third-party
    # certificate authority (CA) that issued the certificate. It is used
    # by clients or  systems to validate the authenticity of the
    # certificate presented by the entity. The CA certificate file is
    # typically pre-configured in the trust store of clients or systems to
    # establish trust in certificates issued by that CA. (string value)
    #
    # This option has a sample default set, which means that
    # its actual default value may vary from the one documented
    # below.
    #netapp_ca_certificate_file = /path/to/ca_certificate.crt

    # Enable certificate verification (boolean value)
    #netapp_certificate_host_validation = false

    # The NFS protocol versions that will be enabled. Supported values
    # include nfs3, nfs4.0, nfs4.1. This option only applies when the
    # option driver_handles_share_servers is set to True.  (list value)
    #netapp_enabled_share_protocols = nfs3,nfs4.0

    # NetApp volume name template. (string value)
    #netapp_volume_name_template = share_%(share_id)s

    # Name template to use for new Vserver. When using CIFS protocol make
    # sure to not configure characters illegal in DNS hostnames. (string
    # value)
    #netapp_vserver_name_template = os_%s

    # NetApp QoS policy group name template. (string value)
    #netapp_qos_policy_group_name_template = qos_share_%(share_id)s

    # Pattern for overriding the selection of network ports on which to
    # create Vserver LIFs. (string value)
    #netapp_port_name_search_pattern = (.*)

    # Logical interface (LIF) name template (string value)
    #netapp_lif_name_template = os_%(net_allocation_id)s

    # Path to interact with auth tokens (string value)
    #netapp_identity_auth_token_path =

    # Pattern for searching available aggregates for provisioning. (string
    # value)
    #netapp_aggregate_name_search_pattern = (.*)

    # Name of aggregate to create Vserver root volumes on. This option
    # only applies when the option driver_handles_share_servers is set to
    # True. (string value)
    #netapp_root_volume_aggregate = <None>

    # Root volume name. (string value)
    #netapp_root_volume = root

    # The number of hours that a deleted volume should be retained before
    # the delete is completed. (integer value)
    # Minimum value: 0
    #netapp_delete_retention_hours = 12

    # The percentage of share space set aside as reserve for snapshot
    # usage; valid values range from 0 to 90. (integer value)
    # Minimum value: 0
    # Maximum value: 90
    #netapp_volume_snapshot_reserve_percent = 5

    # This option forces all existing shares to have their snapshot
    # directory visibility set to either 'visible' or 'hidden' during
    # driver startup. If set to 'default', nothing will be changed during
    # startup. This will not affect new shares, which will have their
    # snapshot directory always visible, unless toggled by the share type
    # extra spec 'netapp:hide_snapdir'. (string value)
    # Possible values:
    # visible - <No description provided>
    # hidden - <No description provided>
    # default - <No description provided>
    #netapp_reset_snapdir_visibility = default

    # NetApp volume Snapshot policy names which will not be overriden by
    # extra-specs. (list value)
    #netapp_volume_snapshot_policy_exceptions = ec2_backups

    # NetApp SnapMirror policy name template for Storage Virtual Machines
    # (Vservers). (string value)
    #netapp_snapmirror_policy_name_svm_template = snapmirror_policy_%(share_server_id)s

    # NetApp FPolicy file operations to apply to a FPolicy event, when not
    # provided by the user using "netapp:fpolicy_file_operations" extra-
    # spec. (list value)
    #netapp_fpolicy_default_file_operations = create,write,rename

    # NetApp FPolicy policy name template. (string value)
    #netapp_fpolicy_policy_name_template = fpolicy_policy_%(share_id)s

    # NetApp FPolicy policy name template. (string value)
    #netapp_fpolicy_event_name_template = fpolicy_event_%(protocol)s_%(share_id)s

    # The maximum time in seconds that the cached aggregates status will
    # be considered valid. Trying to read the expired cache leads to
    # refreshing it. (integer value)
    # Minimum value: 0
    #netapp_cached_aggregates_status_lifetime = 60

    # Specify if the FlexGroup pool is enabled. When it is enabled, the
    # driver will report a single pool representing all aggregates (ONTAP
    # chooses on which the share will be allocated). If you want to Manila
    # control the aggregate selection, you can configure its custom
    # FlexGroup pools through netapp_flexgroup_pools option. The FlexGroup
    # placement is done either by ONTAP or Manila, not both. (boolean
    # value)
    #netapp_enable_flexgroup = false

    # Multi opt of dict to represent the FlexGroup pools. A FlexGroup pool
    # is configured with its name and its list of aggregates. Specify this
    # option as many times as you have FlexGroup pools. Each entry takes
    # the dict config form: netapp_flexgroup_pools = <pool_name>:
    # <aggr_name1> <aggr_name2> .. (dict value)
    #netapp_flexgroup_pools =

    # Specify if the FlexVol pools must not be reported when the
    # netapp_enable_flexgroup is enabled. (boolean value)
    #netapp_flexgroup_pool_only = false

    # Sets time in seconds to wait for a FlexGroup volume create to
    # complete and go online. (integer value)
    # Minimum value: 60
    #netapp_flexgroup_volume_online_timeout = 360

    # Provisioning FlexGroup share requires that all of its aggregates to
    # not be busy deploying another volume. So, sets time in seconds to
    # retry to create the FlexGroup share. (integer value)
    # Minimum value: 60
    #netapp_flexgroup_aggregate_not_busy_timeout = 360

    # Sets time in seconds to wait for a FlexGroup snapshot to not be busy
    # with clones after splitting them. (integer value)
    # Minimum value: 60
    #netapp_delete_busy_flexgroup_snapshot_timeout = 360

    # Sets maximum amount of time in seconds to wait for a synchronous
    # ONTAP REST API operation to be completed. (integer value)
    # Minimum value: 60
    #netapp_rest_operation_timeout = 60

    # Defines the expiration time (in days) for the certificate created
    # during the vserver creation.  This option only applies when the
    # option driver_handles_share_servers is set to True. (integer value)
    # Minimum value: 1
    # Maximum value: 3652
    #netapp_security_cert_expire_days = 365

    # Prevent the creation of a share server if total number of data LIFs
    # on one node of HA pair, including those that can be migrated in case
    # of failure, exceeds the maximum data LIFs supported by the node.
    # This option guarantees that, in the event of a node failure, the
    # partner node will be able to takeover all data LIFs. (boolean value)
    #netapp_restrict_lif_creation_per_ha_pair = false

    # This option enable/disable AES encryption for the share server based
    # on the parameter value (True/False). (boolean value)
    #netapp_cifs_aes_encryption = false

    # This option enables the logical space reporting on a newly created
    # vserver and logical space accounting on newly created volumes on
    # this vserver. (boolean value)
    #netapp_enable_logical_space_reporting = false

    # This option enables user to configure the prefix of fixed QoS
    # policies created on vserver. (string value)
    #netapp_fixed_qos_policy_prefix = FIXED_QOS

    # This option enables user to configure the prefix of adaptive QoS
    # policies created on vserver. (string value)
    #netapp_adaptive_qos_policy_prefix = ADAPTIVE_QOS

    # This option enable/disable SMB signing that protects the security of
    # the data fabric by making sure that traffic between storage systems
    # and clients is not compromised. (boolean value)
    #netapp_cifs_smb_signing = false

    # The maximum time in seconds to wait for existing snapmirror
    # transfers to complete before aborting when promoting a replica.
    # (integer value)
    # Minimum value: 0
    #netapp_snapmirror_quiesce_timeout = 3600

    # The maximum time in seconds to wait for a snapmirror release when
    # breaking snapmirror relationships. (integer value)
    # Minimum value: 0
    #netapp_snapmirror_release_timeout = 3600

    # An interval in either minutes or hours used to update the SnapMirror
    # relationship. Few valid values are: 5min, 10min, 30min, hourly etc.
    # The schedule at the "destination" host will be the one that will be
    # considered when creating a new replica, or promoting a replica
    # (string value)
    #netapp_snapmirror_schedule = hourly

    # The maximum time in seconds to wait for the completion of a volume
    # move operation after the cutover was triggered. (integer value)
    # Minimum value: 0
    #netapp_volume_move_cutover_timeout = 3600

    # The maximum time in seconds to wait for the completion of a volume
    # clone split operation in order to start a volume move. (integer
    # value)
    # Minimum value: 0
    #netapp_start_volume_move_timeout = 3600

    # The maximum time in seconds that migration cancel waits for all
    # migration operations be completely aborted. (integer value)
    # Minimum value: 0
    #netapp_migration_cancel_timeout = 3600

    # The maximum time in seconds that a share server migration waits for
    # a vserver to change its internal states. (integer value)
    # Minimum value: 0
    #netapp_server_migration_state_change_timeout = 3600

    # Specify if the capacity check must be made by the driver while
    # performing a share server migration. If enabled, the driver will
    # validate if the destination backend can hold all shares and
    # snapshots capacities from the source share server. (boolean value)
    #netapp_server_migration_check_capacity = true

    # The maximum time in seconds to wait for mounting a replica. (integer
    # value)
    # Minimum value: 0
    #netapp_mount_replica_timeout = 3600

    # Specify compatible backup_types for backend to provision backup
    # share for SnapVault relationship. Multiple backup_types can be
    # provided. If multiple backup types are enabled, create separate
    # config sections for each backup type specifying the
    # "netapp_backup_vserver", "netapp_backup_backend_section_name",
    # "netapp_backup_volume", and "netapp_snapmirror_job_timeout" as
    # appropriate. Example- netapp_enabled_backup_types = eng_backup,
    # finance_backup (list value)
    #netapp_enabled_backup_types =

    # Backend (ONTAP cluster) name where backup volume will be
    # provisioned. This is one of the backend which is enabled in
    # manila.conf file. (string value)
    #netapp_backup_backend_section_name = <None>

    # vserver name of backend that is use for backup the share. When user
    # provide vserver value then backup volume will  be created under this
    # vserver  (string value)
    #netapp_backup_vserver =

    # Specify backup share name in case user wanted to backup the share.
    # Some case user has dedicated volume for backup in this case use can
    # provide dedicated volume. backup_share_server must be specified if
    # backup_share is provided (string value)
    #netapp_backup_volume =

    # The maximum time in seconds to wait for a snapmirror related
    # operation to backup to complete. (integer value)
    # Minimum value: 0
    #netapp_snapmirror_job_timeout = 1800

    # One or more comma delimited IP addresses for management
    # communication with NexentaStor appliance. (list value)
    #nexenta_rest_addresses = <None>

    # Port to connect to Nexenta REST API server. (integer value)
    #nexenta_rest_port = 8443

    # Use http or https for REST connection (default auto). (string value)
    # Possible values:
    # http - <No description provided>
    # https - <No description provided>
    # auto - <No description provided>
    #nexenta_rest_protocol = auto

    # Use HTTP secure protocol for NexentaStor management REST API
    # connections (boolean value)
    #nexenta_use_https = true

    # User name to connect to Nexenta SA. (string value)
    #nexenta_user = admin

    # Password to connect to Nexenta SA. (string value)
    #nexenta_password = <None>

    # Volume name on NexentaStor. (string value)
    #nexenta_volume = volume1

    # Pool name on NexentaStor. (string value)
    #nexenta_pool = pool1

    # Defines whether share over NFS is enabled. (boolean value)
    #nexenta_nfs = true

    # Defines whether the driver should check ssl cert. (boolean value)
    #nexenta_ssl_cert_verify = false

    # Specifies the time limit (in seconds), within which the connection
    # to NexentaStor management REST API server must be established
    # (floating point value)
    #nexenta_rest_connect_timeout = 30

    # Specifies the time limit (in seconds), within which NexentaStor
    # management REST API server must send a response (floating point
    # value)
    #nexenta_rest_read_timeout = 300

    # Specifies the backoff factor to apply between connection attempts to
    # NexentaStor management REST API server (floating point value)
    #nexenta_rest_backoff_factor = 1

    # Specifies the number of times to repeat NexentaStor management REST
    # API call in case of connection errors and NexentaStor appliance
    # EBUSY or ENOENT errors (integer value)
    #nexenta_rest_retry_count = 5

    # Parent filesystem where all the shares will be created. This
    # parameter is only used by NexentaStor4 driver. (string value)
    #nexenta_nfs_share = nfs_share

    # Nexenta share name prefix. (string value)
    #nexenta_share_name_prefix = share-

    # Parent folder on NexentaStor. (string value)
    #nexenta_folder = folder

    # Compression value for new ZFS folders. (string value)
    # Possible values:
    # on - <No description provided>
    # off - <No description provided>
    # gzip - <No description provided>
    # gzip-1 - <No description provided>
    # gzip-2 - <No description provided>
    # gzip-3 - <No description provided>
    # gzip-4 - <No description provided>
    # gzip-5 - <No description provided>
    # gzip-6 - <No description provided>
    # gzip-7 - <No description provided>
    # gzip-8 - <No description provided>
    # gzip-9 - <No description provided>
    # lzjb - <No description provided>
    # zle - <No description provided>
    # lz4 - <No description provided>
    #nexenta_dataset_compression = on

    # Deduplication value for new ZFS folders. Only used by NexentaStor4
    # driver. (string value)
    # Possible values:
    # on - <No description provided>
    # off - <No description provided>
    # sha256 - <No description provided>
    # verify - <No description provided>
    #nexenta_dataset_dedupe = off

    # If True shares will not be space guaranteed and overprovisioning
    # will be enabled. (boolean value)
    #nexenta_thin_provisioning = true

    # Specifies a suggested block size in for files in a file system.
    # (bytes) (integer value)
    #nexenta_dataset_record_size = 131072

    # Data IP address of Nexenta storage appliance. (host address value)
    #nexenta_nas_host = <None>

    # Base directory that contains NFS share mount points. (string value)
    #nexenta_mount_point_base = $state_path/mnt

    # API token for an administrative user account (string value)
    #flashblade_api = <None>

    # When enabled, all FlashBlade file systems and snapshots will be
    # eradicated at the time of deletion in Manila. Data will NOT be
    # recoverable after a delete with this set to True! When disabled,
    # file systems and snapshots will go into pending eradication state
    # and can be recovered.) (boolean value)
    #flashblade_eradicate = true

    # The name (or IP address) for the Pure Storage FlashBlade storage
    # system management VIP. (host address value)
    #flashblade_mgmt_vip = <None>

    # The names (or IP address) for the Pure Storage FlashBlade storage
    # system data VIPs. The first listed name or IP address will be
    # considered to be the preferred IP address, although is not enforced.
    # (list value)
    #flashblade_data_vip = <None>

    # The URL to manage QNAP Storage. (string value)
    #qnap_management_url = <None>

    # NAS share IP for mounting shares. (host address value)
    #qnap_share_ip = <None>

    # Username for QNAP storage. (string value)
    #qnap_nas_login = <None>

    # Password for QNAP storage. (string value)
    #qnap_nas_password = <None>

    # Pool within which QNAP shares must be created. (string value)
    #qnap_poolname = <None>

    # URL of the Quobyte API server (http or https) (string value)
    #quobyte_api_url = <None>

    # The X.509 CA file to verify the server cert. (string value)
    #quobyte_api_ca = <None>

    # Actually deletes shares (vs. unexport) (boolean value)
    #quobyte_delete_shares = false

    # Username for Quobyte API server. (string value)
    #quobyte_api_username = admin

    # Password for Quobyte API server (string value)
    #quobyte_api_password = quobyte

    # Name of volume configuration used for new shares. (string value)
    #quobyte_volume_configuration = BASE

    # Default owning user for new volumes. (string value)
    #quobyte_default_volume_user = root

    # Default owning group for new volumes. (string value)
    #quobyte_default_volume_group = root

    # Export path for shares of this bacckend. This needs to match the
    # quobyte-nfs services "Pseudo" option. (string value)
    #quobyte_export_path = /quobyte

    # User in service instance that will be used for authentication.
    # (string value)
    #service_instance_user = <None>

    # Password for service instance user. (string value)
    #service_instance_password = <None>

    # Path to host's private key. (string value)
    #path_to_private_key = <None>

    # Maximum time in seconds to wait for creating service instance.
    # (integer value)
    #max_time_to_build_instance = 300

    # Block SSH connection to the service instance from other networks
    # than service network. (boolean value)
    #limit_ssh_access = false

    # Name or ID of service instance in Nova to use for share exports.
    # Used only when share servers handling is disabled. (string value)
    #service_instance_name_or_id = <None>

    # Can be either name of network that is used by service instance
    # within Nova to get IP address or IP address itself (either IPv4 or
    # IPv6) for managing shares there. Used only when share servers
    # handling is disabled. (host address value)
    #service_net_name_or_ip = <None>

    # Can be either name of network that is used by service instance
    # within Nova to get IP address or IP address itself (either IPv4 or
    # IPv6) for exporting shares. Used only when share servers handling is
    # disabled. (host address value)
    #tenant_net_name_or_ip = <None>

    # Name of image in Glance, that will be used for service instance
    # creation. Only used if driver_handles_share_servers=True. (string
    # value)
    #service_image_name = manila-service-image

    # Name of service instance. Only used if
    # driver_handles_share_servers=True. (string value)
    #service_instance_name_template = %s

    # Keypair name that will be created and used for service instances.
    # Only used if driver_handles_share_servers=True. (string value)
    #manila_service_keypair_name = manila-service

    # Path to hosts public key. Only used if
    # driver_handles_share_servers=True. (string value)
    #path_to_public_key = ~/.ssh/id_rsa.pub

    # Security group name, that will be used for service instance
    # creation. Only used if driver_handles_share_servers=True. (string
    # value)
    #service_instance_security_group = manila-service

    # ID of flavor, that will be used for service instance creation. Only
    # used if driver_handles_share_servers=True. (string value)
    #service_instance_flavor_id = 100

    # Name of manila service network. Used only with Neutron. Only used if
    # driver_handles_share_servers=True. (string value)
    #service_network_name = manila_service_network

    # Hostname to be used for service network binding. Used only with
    # Neutron and if driver_handles_share_servers=True. (host address
    # value)
    #
    # This option has a sample default set, which means that
    # its actual default value may vary from the one documented
    # below.
    #service_network_host = <your_network_hostname>

    # CIDR of manila service network. Used only with Neutron and if
    # driver_handles_share_servers=True. (string value)
    #service_network_cidr = 10.254.0.0/16

    # This mask is used for dividing service network into subnets, IP
    # capacity of subnet with this mask directly defines possible amount
    # of created service VMs per tenant's subnet. Used only with Neutron
    # and if driver_handles_share_servers=True. (integer value)
    #service_network_division_mask = 28

    # Module path to the Virtual Interface (VIF) driver class. This option
    # is used only by drivers operating in
    # `driver_handles_share_servers=True` mode that provision OpenStack
    # compute instances as share servers. This option is only supported
    # with Neutron networking. Drivers provided in tree work with Linux
    # Bridge (manila.network.linux.interface.BridgeInterfaceDriver) and
    # OVS (manila.network.linux.interface.OVSInterfaceDriver). If the
    # manila-share service is running on a host that is connected to the
    # administrator network, a no-op driver
    # (manila.network.linux.interface.NoopInterfaceDriver) may be used.
    # (string value)
    #interface_driver = manila.network.linux.interface.OVSInterfaceDriver

    # Attach share server directly to share network. Used only with
    # Neutron and if driver_handles_share_servers=True. (boolean value)
    #connect_share_server_to_tenant_network = false

    # ID of neutron network used to communicate with admin network, to
    # create additional admin export locations on. (string value)
    #admin_network_id = <None>

    # ID of neutron subnet used to communicate with admin network, to
    # create additional admin export locations on. Related to
    # 'admin_network_id'. (string value)
    #admin_subnet_id = <None>

    # Boot service instances (share servers) from a Cinder volume. If
    # False, boot from the image as before. Only used if
    # driver_handles_share_servers=True. (boolean value)
    #service_instance_boot_from_volume = false

    # Size (GiB) of the root volume when booting from volume. Only used if
    # driver_handles_share_servers=True. (integer value)
    # Minimum value: 1
    #service_instance_boot_volume_size = 10

    # Name or id of cinder volume type which will be used for all boot
    # volumes created by driver. (string value)
    #service_instance_boot_volume_type = <None>

    # UUID of volume in Cinder, that will be used as base volume that
    # bootable volume clone from during service instance creation. Only
    # used if driver_handles_share_servers=True. (string value)
    #service_instance_base_boot_volume_id = <None>

    # Whether the root volume is deleted when the service instance is
    # terminated. Only used if driver_handles_share_servers=True. (boolean
    # value)
    #service_instance_boot_volume_delete_on_termination = true

    # Boot volume name template. (string value)
    #service_instance_boot_volume_name_template = manila-share-%s-boot

    # Tegile NAS server hostname or IP address. (host address value)
    #tegile_nas_server = <None>

    # User name for the Tegile NAS server. (string value)
    #tegile_nas_login = <None>

    # Password for the Tegile NAS server. (string value)
    #tegile_nas_password = <None>

    # Create shares in this project (string value)
    #tegile_default_project = <None>

    # Path to the x509 certificate used for accessing the service
    # instance. (string value)
    #winrm_cert_pem_path = ~/.ssl/cert.pem

    # Path to the x509 certificate key. (string value)
    #winrm_cert_key_pem_path = ~/.ssl/key.pem

    # Use x509 certificates in order to authenticate to the service
    # instance. (boolean value)
    #winrm_use_cert_based_auth = false

    # WinRM connection timeout. (integer value)
    #winrm_conn_timeout = 60

    # WinRM operation timeout. (integer value)
    #winrm_operation_timeout = 60

    # WinRM retry count. (integer value)
    #winrm_retry_count = 3

    # WinRM retry interval in seconds (integer value)
    #winrm_retry_interval = 5

    # IP to be added to user-facing export location. Required. (host
    # address value)
    #zfs_share_export_ip = <None>

    # IP to be added to admin-facing export location. Required. (host
    # address value)
    #zfs_service_ip = <None>

    # Specify list of zpools that are allowed to be used by backend. Can
    # contain nested datasets. Examples: Without nested dataset:
    # 'zpool_name'. With nested dataset: 'zpool_name/nested_dataset_name'.
    # Required. (list value)
    #zfs_zpool_list = <None>

    # Define here list of options that should be applied for each dataset
    # creation if needed. Example: compression=gzip,dedup=off. Note that,
    # for secondary replicas option 'readonly' will be set to 'on' and for
    # active replicas to 'off' in any way. Also, 'quota' will be equal to
    # share size. Optional. (list value)
    #zfs_dataset_creation_options = <None>

    # Prefix to be used in each dataset name. Optional. (string value)
    #zfs_dataset_name_prefix = manila_share_

    # Prefix to be used in each dataset snapshot name. Optional. (string
    # value)
    #zfs_dataset_snapshot_name_prefix = manila_share_snapshot_

    # Remote ZFS storage hostname that should be used for SSH'ing.
    # Optional. (boolean value)
    #zfs_use_ssh = false

    # SSH user that will be used in 2 cases: 1) By manila-share service in
    # case it is located on different host than its ZFS storage. 2) By
    # manila-share services with other ZFS backends that perform
    # replication. It is expected that SSH'ing will be key-based,
    # passwordless. This user should be passwordless sudoer. Optional.
    # (string value)
    #zfs_ssh_username = <None>

    # Password for user that is used for SSH'ing ZFS storage host. Not
    # used for replication operations. They require passwordless SSH
    # access. Optional. (string value)
    #zfs_ssh_user_password = <None>

    # Path to SSH private key that should be used for SSH'ing ZFS storage
    # host. Not used for replication operations. Optional. (string value)
    #zfs_ssh_private_key_path = <None>

    # Specify list of share export helpers for ZFS storage. It should look
    # like following:
    # 'FOO_protocol=foo.FooClass,BAR_protocol=bar.BarClass'. Required.
    # (dict value)
    #zfs_share_helpers = NFS:manila.share.drivers.zfsonlinux.utils.NFSviaZFSHelper

    # Set snapshot prefix for usage in ZFS replication. Required. (string
    # value)
    #zfs_replica_snapshot_prefix = tmp_snapshot_for_replication_

    # Set snapshot prefix for usage in ZFS migration. Required. (string
    # value)
    #zfs_migration_snapshot_prefix = tmp_snapshot_for_share_migration_

    # ZFSSA management IP address. (host address value)
    #zfssa_host = <None>

    # IP address for data. (host address value)
    #zfssa_data_ip = <None>

    # ZFSSA management authorized username. (string value)
    #zfssa_auth_user = <None>

    # ZFSSA management authorized user's password. (string value)
    #zfssa_auth_password = <None>

    # ZFSSA storage pool name. (string value)
    #zfssa_pool = <None>

    # ZFSSA project name. (string value)
    #zfssa_project = <None>

    # Controls checksum used for data blocks. (string value)
    #zfssa_nas_checksum = fletcher4

    # Data compression-off, lzjb, gzip-2, gzip, gzip-9. (string value)
    #zfssa_nas_compression = off

    # Controls behavior when servicing synchronous writes. (string value)
    #zfssa_nas_logbias = latency

    # Location of project in ZFS/SA. (string value)
    #zfssa_nas_mountpoint =

    # Controls whether a share quota includes snapshot. (string value)
    #zfssa_nas_quota_snap = true

    # Controls whether file ownership can be changed. (string value)
    #zfssa_nas_rstchown = true

    # Controls whether the share is scanned for viruses. (string value)
    #zfssa_nas_vscan = false

    # REST connection timeout (in seconds). (string value)
    #zfssa_rest_timeout = <None>

    # Driver policy for share manage. A strict policy checks for a schema
    # named manila_managed, and makes sure its value is true. A loose
    # policy does not check for the schema. (string value)
    # Possible values:
    # loose - <No description provided>
    # strict - <No description provided>
    #zfssa_manage_policy = loose

    # Whether to enable pre hooks or not. (boolean value)
    #enable_pre_hooks = false

    # Whether to enable post hooks or not. (boolean value)
    #enable_post_hooks = false

    # Whether to enable periodic hooks or not. (boolean value)
    #enable_periodic_hooks = false

    # Whether to suppress pre hook errors (allow driver perform actions)
    # or not. (boolean value)
    #suppress_pre_hooks_errors = false

    # Whether to suppress post hook errors (allow driver's results to pass
    # through) or not. (boolean value)
    #suppress_post_hooks_errors = false

    # Interval in seconds between execution of periodic hooks. Used when
    # option 'enable_periodic_hooks' is set to True. Default is 300.
    # (floating point value)
    #periodic_hooks_interval = 300.0

    # Driver to use for share creation. (string value)
    #share_driver = manila.share.drivers.generic.GenericShareDriver

    # Driver(s) to perform some additional actions before and after share
    # driver actions and on a periodic basis. Default is []. (list value)
    #hook_drivers =

    # Whether share servers will be deleted on deletion of the last share.
    # (boolean value)
    #delete_share_server_with_last_share = false

    # If set to True, then manila will deny access and remove all access
    # rules on share unmanage.If set to False - nothing will be changed.
    # (boolean value)
    #unmanage_remove_access_rules = false

    # If set to True, then Manila will delete all share servers which were
    # unused more than specified time .If set to False - automatic
    # deletion of share servers will be disabled. (boolean value)
    #automatic_share_server_cleanup = true

    # Unallocated share servers reclamation time interval (minutes).
    # Minimum value is 10 minutes, maximum is 720 minutes. The reclamation
    # function is run every 10 minutes and delete share servers which were
    # unused more than unused_share_server_cleanup_interval option
    # defines. This value reflects the shortest time Manila will wait for
    # a share server to go unutilized before deleting it. (integer value)
    # Minimum value: 10
    # Maximum value: 720
    #unused_share_server_cleanup_interval = 10

    # This value, specified in seconds, determines how often the share
    # manager will poll for the health (replica_state) of each replica
    # instance. (integer value)
    #replica_state_update_interval = 300

    # This value, specified in seconds, determines how often the share
    # manager will poll the driver to perform the next step of migration
    # in the storage backend, for a migrating share. (integer value)
    #migration_driver_continue_update_interval = 60

    # This value, specified in seconds, determines how often the share
    # manager will poll the driver to perform the next step of migration
    # in the storage backend, for a migrating share server. (integer
    # value)
    #server_migration_driver_continue_update_interval = 900

    # If set to True, neutron network are extended to destination host
    # during share server migration. This option should only be enabled if
    # using NeutronNetworkPlugin or its derivatives and when multiple
    # bindings of Manila ports are supported by Neutron ML2 plugin.
    # (boolean value)
    #server_migration_extend_neutron_network = false

    # This value, specified in seconds, determines how often the share
    # manager will poll the driver to update the share usage size in the
    # storage backend, for shares in that backend. (integer value)
    #share_usage_size_update_interval = 300

    # If set to True, share usage size will be polled for in the interval
    # specified with "share_usage_size_update_interval". Usage data can be
    # consumed by telemetry integration. If telemetry is not configured,
    # this option must be set to False. If set to False - gathering share
    # usage size will be disabled. (boolean value)
    #enable_gathering_share_usage_size = false

    # Offload pending share ensure during share service startup (boolean
    # value)
    #share_service_inithost_offload = false

    # This value, specified in seconds, determines how often the share
    # manager will check for expired shares and delete them from the
    # Recycle bin. (integer value)
    #check_for_expired_shares_in_recycle_bin_interval = 3600

    # This value, specified in seconds, determines how often the share
    # manager will check for expired transfers and destroy them and roll
    # back share state. (integer value)
    #check_for_expired_transfers = 300

    # This value, specified in seconds, determines how often the share
    # manager will poll to perform the next steps of backup such as fetch
    # the progress of backup. (integer value)
    #driver_backup_continue_update_interval = 60

    # This value, specified in seconds, determines how often the share
    # manager will poll to perform the next steps of restore such as fetch
    # the progress of restore. (integer value)
    #driver_restore_continue_update_interval = 60

    # This value, specified in seconds, determines how often the share
    # manager will try to delete the share and share snapshots in backend
    # driver. (integer value)
    #periodic_deferred_delete_interval = 300

    # The full class name of the Volume API class to use. (string value)
    #volume_api_class = manila.volume.cinder.API

    # Sets the value of TCP_KEEPALIVE (True/False) for each server socket.
    # (boolean value)
    #tcp_keepalive = true

    # Sets the value of TCP_KEEPINTVL in seconds for each server socket.
    # Not supported on OS X. (integer value)
    #tcp_keepalive_interval = <None>

    # Sets the value of TCP_KEEPCNT for each server socket. Not supported
    # on OS X. (integer value)
    #tcp_keepalive_count = <None>

    # Hostname or IP address VAST storage system management VIP. (host
    # address value)
    #vast_mgmt_host = <None>

    # Port for VAST management (port value)
    # Minimum value: 0
    # Maximum value: 65535
    #vast_mgmt_port = 443

    # Name of Virtual IP pool (string value)
    #vast_vippool_name = <None>

    # Base path for shares (string value)
    #vast_root_export = manila

    # Username for VAST management (string value)
    #vast_mgmt_user = <None>

    # Password for VAST management (string value)
    #vast_mgmt_password = <None>

    # API token for accessing VAST mgmt. If provided, it will be used
    # instead of 'san_login' and 'san_password'. (string value)
    #vast_api_token =

    #
    # From oslo.log
    #

    # If set to true, the logging level will be set to DEBUG instead of
    # the default INFO level. (boolean value)
    # Note: This option can be changed without restarting.
    #debug = false

    # The name of a logging configuration file. This file is appended to
    # any existing logging configuration files. For details about logging
    # configuration files, see the Python logging module documentation.
    # Note that when logging configuration files are used then all logging
    # configuration is set in the configuration file and other logging
    # configuration options are ignored (for example, log-date-format).
    # (string value)
    # Note: This option can be changed without restarting.
    # Deprecated group/name - [DEFAULT]/log_config
    #log_config_append = <None>

    # Defines the format string for %%(asctime)s in log records. Default:
    # %(default)s . This option is ignored if log_config_append is set.
    # (string value)
    #log_date_format = %Y-%m-%d %H:%M:%S

    # (Optional) Name of log file to send logging output to. If no default
    # is set, logging will go to stderr as defined by use_stderr. This
    # option is ignored if log_config_append is set. (string value)
    # Deprecated group/name - [DEFAULT]/logfile
    #log_file = <None>

    # (Optional) The base directory used for relative log_file  paths.
    # This option is ignored if log_config_append is set. (string value)
    # Deprecated group/name - [DEFAULT]/logdir
    #log_dir = <None>

    # Use syslog for logging. Existing syslog format is DEPRECATED and
    # will be changed later to honor RFC5424. This option is ignored if
    # log_config_append is set. (boolean value)
    #use_syslog = false

    # Enable journald for logging. If running in a systemd environment you
    # may wish to enable journal support. Doing so will use the journal
    # native protocol which includes structured metadata in addition to
    # log messages.This option is ignored if log_config_append is set.
    # (boolean value)
    #use_journal = false

    # Syslog facility to receive log lines. This option is ignored if
    # log_config_append is set. (string value)
    #syslog_log_facility = LOG_USER

    # Use JSON formatting for logging. This option is ignored if
    # log_config_append is set. (boolean value)
    #use_json = false

    # Log output to standard error. This option is ignored if
    # log_config_append is set. (boolean value)
    #use_stderr = false

    # (Optional) Set the 'color' key according to log levels. This option
    # takes effect only when logging to stderr or stdout is used. This
    # option is ignored if log_config_append is set. (boolean value)
    #log_color = false

    # The amount of time before the log files are rotated. This option is
    # ignored unless log_rotation_type is set to "interval". (integer
    # value)
    #log_rotate_interval = 1

    # Rotation interval type. The time of the last file change (or the
    # time when the service was started) is used when scheduling the next
    # rotation. (string value)
    # Possible values:
    # Seconds - <No description provided>
    # Minutes - <No description provided>
    # Hours - <No description provided>
    # Days - <No description provided>
    # Weekday - <No description provided>
    # Midnight - <No description provided>
    #log_rotate_interval_type = days

    # Maximum number of rotated log files. (integer value)
    #max_logfile_count = 30

    # Log file maximum size in MB. This option is ignored if
    # "log_rotation_type" is not set to "size". (integer value)
    #max_logfile_size_mb = 200

    # Log rotation type. (string value)
    # Possible values:
    # interval - Rotate logs at predefined time intervals.
    # size - Rotate logs once they reach a predefined size.
    # none - Do not rotate log files.
    #log_rotation_type = none

    # Format string to use for log messages with context. Used by
    # oslo_log.formatters.ContextFormatter (string value)
    #logging_context_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(global_request_id)s %(request_id)s %(user_identity)s] %(instance)s%(message)s

    # Format string to use for log messages when context is undefined.
    # Used by oslo_log.formatters.ContextFormatter (string value)
    #logging_default_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [-] %(instance)s%(message)s

    # Additional data to append to log message when logging level for the
    # message is DEBUG. Used by oslo_log.formatters.ContextFormatter
    # (string value)
    #logging_debug_format_suffix = %(funcName)s %(pathname)s:%(lineno)d

    # Prefix each line of exception output with this format. Used by
    # oslo_log.formatters.ContextFormatter (string value)
    #logging_exception_prefix = %(asctime)s.%(msecs)03d %(process)d ERROR %(name)s %(instance)s

    # Defines the format string for %(user_identity)s that is used in
    # logging_context_format_string. Used by
    # oslo_log.formatters.ContextFormatter (string value)
    #logging_user_identity_format = %(user)s %(project)s %(domain)s %(system_scope)s %(user_domain)s %(project_domain)s

    # List of package logging levels in logger=LEVEL pairs. This option is
    # ignored if log_config_append is set. (list value)
    #default_log_levels = amqp=WARN,boto=WARN,sqlalchemy=WARN,suds=INFO,oslo.messaging=INFO,oslo_messaging=INFO,iso8601=WARN,requests.packages.urllib3.connectionpool=WARN,urllib3.connectionpool=WARN,websocket=WARN,requests.packages.urllib3.util.retry=WARN,urllib3.util.retry=WARN,keystonemiddleware=WARN,routes.middleware=WARN,stevedore=WARN,taskflow=WARN,keystoneauth=WARN,oslo.cache=INFO,oslo_policy=INFO,dogpile.core.dogpile=INFO

    # Enables or disables publication of error events. (boolean value)
    #publish_errors = false

    # The format for an instance that is passed with the log message.
    # (string value)
    #instance_format = "[instance: %(uuid)s] "

    # The format for an instance UUID that is passed with the log message.
    # (string value)
    #instance_uuid_format = "[instance: %(uuid)s] "

    # Interval, number of seconds, of log rate limiting. (integer value)
    #rate_limit_interval = 0

    # Maximum number of logged messages per rate_limit_interval. (integer
    # value)
    #rate_limit_burst = 0

    # Log level name used by rate limiting. Logs with level greater or
    # equal to rate_limit_except_level are not filtered. An empty string
    # means that all levels are filtered. (string value)
    # Possible values:
    # CRITICAL - <No description provided>
    # ERROR - <No description provided>
    # INFO - <No description provided>
    # WARNING - <No description provided>
    # DEBUG - <No description provided>
    # '' - <No description provided>
    #rate_limit_except_level = CRITICAL

    # Enables or disables fatal status of deprecations. (boolean value)
    #fatal_deprecations = false

    #
    # From oslo.messaging
    #

    # Size of executor thread pool when executor is threading or eventlet.
    # (integer value)
    # Deprecated group/name - [DEFAULT]/rpc_thread_pool_size
    #executor_thread_pool_size = 64

    # Seconds to wait for a response from a call. (integer value)
    #rpc_response_timeout = 60

    # The network address and optional user credentials for connecting to
    # the messaging backend, in URL format. The expected format is:
    #
    # driver://[user:pass@]host:port[,[userN:passN@]hostN:portN]/virtual_host?query
    #
    # Example: rabbit://rabbitmq:password@127.0.0.1:5672//
    #
    # For full details on the fields in the URL see the documentation of
    # oslo_messaging.TransportURL at
    # https://docs.openstack.org/oslo.messaging/latest/reference/transport.html
    # (string value)
    #transport_url = rabbit://

    # The default exchange under which topics are scoped. May be
    # overridden by an exchange name specified in the transport_url
    # option. (string value)
    #control_exchange = openstack

    # Add an endpoint to answer to ping calls. Endpoint is named
    # oslo_rpc_server_ping (boolean value)
    #rpc_ping_enabled = false

    #
    # From oslo.service.periodic_task
    #

    # Some periodic tasks can be run in a separate process. Should we run
    # them here? (boolean value)
    #run_external_periodic_tasks = true

    #
    # From oslo.service.service
    #

    # DEPRECATED: Enable eventlet backdoor.  Acceptable values are 0,
    # <port>, and <start>:<end>, where 0 results in listening on a random
    # tcp port number; <port> results in listening on the specified port
    # number (and not enabling backdoor if that port is in use); and
    # <start>:<end> results in listening on the smallest unused port
    # number within the specified range of port numbers. The chosen port
    # is displayed in the service's log file. (string value)
    # This option is deprecated for removal.
    # Its value may be silently ignored in the future.
    # Reason: The 'backdoor_port' option is deprecated and will be removed
    # in a future release.
    #backdoor_port = <None>

    # DEPRECATED: Enable eventlet backdoor, using the provided path as a
    # unix socket that can receive connections. This option is mutually
    # exclusive with 'backdoor_port' in that only one should be provided.
    # If both are provided then the existence of this option overrides the
    # usage of that option. Inside the path {pid} will be replaced with
    # the PID of the current process. (string value)
    # This option is deprecated for removal.
    # Its value may be silently ignored in the future.
    # Reason: The 'backdoor_socket' option is deprecated and will be
    # removed in a future release.
    #backdoor_socket = <None>

    # Enables or disables logging values of all registered options when
    # starting a service (at DEBUG level). (boolean value)
    #log_options = true

    # Specify a timeout after which a gracefully shutdown server will
    # exit. Zero value means endless wait. (integer value)
    #graceful_shutdown_timeout = 60

    #
    # From oslo.service.wsgi
    #

    # DEPRECATED: File name for the paste.deploy config for api service
    # (string value)
    # This option is deprecated for removal.
    # Its value may be silently ignored in the future.
    # Reason: The 'api_paste_config' option is deprecated and will be
    # removed in a future release.
    #api_paste_config = api-paste.ini

    # DEPRECATED: A python format string that is used as the template to
    # generate log lines. The following values can beformatted into it:
    # client_ip, date_time, request_line, status_code, body_length,
    # wall_seconds. (string value)
    # This option is deprecated for removal.
    # Its value may be silently ignored in the future.
    # Reason: The 'wsgi_log_format' option is deprecated and will be
    # removed in a future release.
    #wsgi_log_format = %(client_ip)s "%(request_line)s" status: %(status_code)s  len: %(body_length)s time: %(wall_seconds).7f

    # DEPRECATED: Sets the value of TCP_KEEPIDLE in seconds for each
    # server socket. Not supported on OS X. (integer value)
    # This option is deprecated for removal.
    # Its value may be silently ignored in the future.
    # Reason: The 'tcp_keepidle' option is deprecated and will be removed
    # in a future release.
    #tcp_keepidle = 600

    # DEPRECATED: Size of the pool of greenthreads used by wsgi (integer
    # value)
    # This option is deprecated for removal.
    # Its value may be silently ignored in the future.
    # Reason: The 'wsgi_default_pool_size' option is deprecated and will
    # be removed in a future release.
    #wsgi_default_pool_size = 100

    # DEPRECATED: Maximum line size of message headers to be accepted.
    # max_header_line may need to be increased when using large tokens
    # (typically those generated when keystone is configured to use PKI
    # tokens with big service catalogs). (integer value)
    # This option is deprecated for removal.
    # Its value may be silently ignored in the future.
    # Reason: The 'max_header_line' option is deprecated and will be
    # removed in a future release.
    #max_header_line = 16384

    # DEPRECATED: If False, closes the client socket connection
    # explicitly. (boolean value)
    # This option is deprecated for removal.
    # Its value may be silently ignored in the future.
    # Reason: The 'wsgi_keep_alive' option is deprecated and will be
    # removed in a future release.
    #wsgi_keep_alive = true

    # DEPRECATED: Timeout for client connections' socket operations. If an
    # incoming connection is idle for this number of seconds it will be
    # closed. A value of '0' means wait forever. (integer value)
    # This option is deprecated for removal.
    # Its value may be silently ignored in the future.
    # Reason: The 'client_socket_timeout' option is deprecated and will be
    # removed in a future release.
    #client_socket_timeout = 900

    # DEPRECATED: True if the server should send exception tracebacks to
    # the clients on 500 errors. If False, the server will respond with
    # empty bodies. (boolean value)
    # This option is deprecated for removal.
    # Its value may be silently ignored in the future.
    # Reason: The 'wsgi_server_debug' option is deprecated and will be
    # removed in a future release.
    #wsgi_server_debug = false

    [barbican]

    #
    # From castellan.config
    #

    # Use this endpoint to connect to Barbican, for example:
    # "http://localhost:9311/" (uri value)
    #barbican_endpoint = <None>

    # Version of the Barbican API, for example: "v1" (string value)
    #barbican_api_version = <None>

    # Use this endpoint to connect to Keystone (uri value)
    # Deprecated group/name - [key_manager]/auth_url
    #auth_endpoint = http://localhost/identity/v3

    # Number of seconds to wait before retrying poll for key creation
    # completion (integer value)
    #retry_delay = 1

    # Number of times to retry poll for key creation completion (integer
    # value)
    #number_of_retries = 60

    # Specifies if insecure TLS (https) requests. If False, the server's
    # certificate will not be validated, if True, we can set the
    # verify_ssl_path config meanwhile. (boolean value)
    #verify_ssl = true

    # A path to a bundle or CA certs to check against, or None for
    # requests to attempt to locate and use certificates which verify_ssh
    # is True. If verify_ssl is False, this is ignored. (string value)
    #verify_ssl_path = <None>

    # Specifies the type of endpoint. (string value)
    # Possible values:
    # public - <No description provided>
    # internal - <No description provided>
    # admin - <No description provided>
    #barbican_endpoint_type = public

    # Specifies the region of the chosen endpoint. (string value)
    #barbican_region_name = <None>

    #
    # When True, if sending a user token to a REST API, also send a
    # service token.
    #
    # Nova often reuses the user token provided to the nova-api to talk to
    # other REST
    # APIs, such as Cinder, Glance and Neutron. It is possible that while
    # the user
    # token was valid when the request was made to Nova, the token may
    # expire before
    # it reaches the other service. To avoid any failures, and to make it
    # clear it is
    # Nova calling the service on the user's behalf, we include a service
    # token along
    # with the user token. Should the user's token have expired, a valid
    # service
    # token ensures the REST API request will still be accepted by the
    # keystone
    # middleware.
    #  (boolean value)
    #send_service_user_token = false

    # PEM encoded Certificate Authority to use when verifying HTTPs
    # connections. (string value)
    #cafile = <None>

    # PEM encoded client certificate cert file (string value)
    #certfile = <None>

    # PEM encoded client certificate key file (string value)
    #keyfile = <None>

    # Verify HTTPS connections. (boolean value)
    #insecure = false

    # Timeout value for http requests (integer value)
    #timeout = <None>

    # Collect per-API call timing information. (boolean value)
    #collect_timing = false

    # Log requests to multiple loggers. (boolean value)
    #split_loggers = false

    #
    # From manila
    #

    # Endpoint type to be used with keystone client calls. (string value)
    # Possible values:
    # publicURL - <No description provided>
    # internalURL - <No description provided>
    # adminURL - <No description provided>
    # public - <No description provided>
    # internal - <No description provided>
    # admin - <No description provided>
    #endpoint_type = publicURL

    # Region name for connecting to keystone for application credential
    # management. (string value)
    #region_name = <None>

    # Authentication URL (string value)
    #auth_url = <None>

    # Authentication type to load (string value)
    # Deprecated group/name - [barbican]/auth_plugin
    #auth_type = <None>

    # PEM encoded Certificate Authority to use when verifying HTTPs
    # connections. (string value)
    #cafile = <None>

    # PEM encoded client certificate cert file (string value)
    #certfile = <None>

    # Collect per-API call timing information. (boolean value)
    #collect_timing = false

    # Optional domain ID to use with v3 and v2 parameters. It will be used
    # for both the user and project domain in v3 and ignored in v2
    # authentication. (string value)
    #default_domain_id = <None>

    # Optional domain name to use with v3 API and v2 parameters. It will
    # be used for both the user and project domain in v3 and ignored in v2
    # authentication. (string value)
    #default_domain_name = <None>

    # Domain ID to scope to (string value)
    #domain_id = <None>

    # Domain name to scope to (string value)
    #domain_name = <None>

    # Verify HTTPS connections. (boolean value)
    #insecure = false

    # PEM encoded client certificate key file (string value)
    #keyfile = <None>

    # User's password (string value)
    #password = <None>

    # Domain ID containing project (string value)
    #project_domain_id = <None>

    # Domain name containing project (string value)
    #project_domain_name = <None>

    # Project ID to scope to (string value)
    # Deprecated group/name - [barbican]/tenant_id
    #project_id = <None>

    # Project name to scope to (string value)
    # Deprecated group/name - [barbican]/tenant_name
    #project_name = <None>

    # Log requests to multiple loggers. (boolean value)
    #split_loggers = false

    # Scope for system operations (string value)
    #system_scope = <None>

    # Timeout value for http requests (integer value)
    #timeout = <None>

    # ID of the trust to use as a trustee use (string value)
    #trust_id = <None>

    # User's domain id (string value)
    #user_domain_id = <None>

    # User's domain name (string value)
    #user_domain_name = <None>

    # User id (string value)
    #user_id = <None>

    # Username (string value)
    # Deprecated group/name - [barbican]/user_name
    #username = <None>

    [barbican_service_user]

    #
    # From castellan.config
    #

    # PEM encoded Certificate Authority to use when verifying HTTPs
    # connections. (string value)
    #cafile = <None>

    # PEM encoded client certificate cert file (string value)
    #certfile = <None>

    # PEM encoded client certificate key file (string value)
    #keyfile = <None>

    # Verify HTTPS connections. (boolean value)
    #insecure = false

    # Timeout value for http requests (integer value)
    #timeout = <None>

    # Collect per-API call timing information. (boolean value)
    #collect_timing = false

    # Log requests to multiple loggers. (boolean value)
    #split_loggers = false

    # Authentication type to load (string value)
    # Deprecated group/name - [barbican_service_user]/auth_plugin
    #auth_type = <None>

    # Config Section from which to load plugin specific options (string
    # value)
    #auth_section = <None>

    [cinder]

    #
    # From manila
    #

    # Allow attaching between instances and volumes in different
    # availability zones. (boolean value)
    #cross_az_attach = true

    # Number of cinderclient retries on failed HTTP calls. (integer value)
    #http_retries = 3

    # Endpoint type to be used with cinder client calls. (string value)
    # Possible values:
    # publicURL - <No description provided>
    # internalURL - <No description provided>
    # adminURL - <No description provided>
    # public - <No description provided>
    # internal - <No description provided>
    # admin - <No description provided>
    #endpoint_type = publicURL

    # Region name for connecting to cinder. (string value)
    #region_name = <None>

    # Authentication URL (string value)
    #auth_url = <None>

    # Authentication type to load (string value)
    # Deprecated group/name - [cinder]/auth_plugin
    #auth_type = <None>

    # PEM encoded Certificate Authority to use when verifying HTTPs
    # connections. (string value)
    #cafile = <None>

    # PEM encoded client certificate cert file (string value)
    #certfile = <None>

    # Collect per-API call timing information. (boolean value)
    #collect_timing = false

    # Optional domain ID to use with v3 and v2 parameters. It will be used
    # for both the user and project domain in v3 and ignored in v2
    # authentication. (string value)
    #default_domain_id = <None>

    # Optional domain name to use with v3 API and v2 parameters. It will
    # be used for both the user and project domain in v3 and ignored in v2
    # authentication. (string value)
    #default_domain_name = <None>

    # Domain ID to scope to (string value)
    #domain_id = <None>

    # Domain name to scope to (string value)
    #domain_name = <None>

    # Verify HTTPS connections. (boolean value)
    #insecure = false

    # PEM encoded client certificate key file (string value)
    #keyfile = <None>

    # User's password (string value)
    #password = <None>

    # Domain ID containing project (string value)
    #project_domain_id = <None>

    # Domain name containing project (string value)
    #project_domain_name = <None>

    # Project ID to scope to (string value)
    # Deprecated group/name - [cinder]/tenant_id
    #project_id = <None>

    # Project name to scope to (string value)
    # Deprecated group/name - [cinder]/tenant_name
    #project_name = <None>

    # Log requests to multiple loggers. (boolean value)
    #split_loggers = false

    # Scope for system operations (string value)
    #system_scope = <None>

    # Timeout value for http requests (integer value)
    #timeout = <None>

    # ID of the trust to use as a trustee use (string value)
    #trust_id = <None>

    # User's domain id (string value)
    #user_domain_id = <None>

    # User's domain name (string value)
    #user_domain_name = <None>

    # User id (string value)
    #user_id = <None>

    # Username (string value)
    # Deprecated group/name - [cinder]/user_name
    #username = <None>

    [cors]

    #
    # From oslo.middleware
    #

    # Indicate whether this resource may be shared with the domain
    # received in the requests "origin" header. Format:
    # "<protocol>://<host>[:<port>]", no trailing slash. Example:
    # https://horizon.example.com (list value)
    #allowed_origin = <None>

    # Indicate that the actual request can include user credentials
    # (boolean value)
    #allow_credentials = true

    # Indicate which headers are safe to expose to the API. Defaults to
    # HTTP Simple Headers. (list value)
    #expose_headers = X-Auth-Token,X-OpenStack-Request-ID,X-Openstack-Manila-Api-Version,X-OpenStack-Manila-API-Experimental,X-Subject-Token,X-Service-Token

    # Maximum cache age of CORS preflight requests. (integer value)
    #max_age = 3600

    # Indicate which methods can be used during the actual request. (list
    # value)
    #allow_methods = GET,PUT,POST,DELETE,PATCH

    # Indicate which header field names may be used during the actual
    # request. (list value)
    #allow_headers = X-Auth-Token,X-OpenStack-Request-ID,X-Openstack-Manila-Api-Version,X-OpenStack-Manila-API-Experimental,X-Identity-Status,X-Roles,X-Service-Catalog,X-User-Id,X-Tenant-Id

    [database]

    #
    # From oslo.db
    #

    # If True, SQLite uses synchronous mode. (boolean value)
    #sqlite_synchronous = true

    # The back end to use for the database. (string value)
    #backend = sqlalchemy

    # The SQLAlchemy connection string to use to connect to the database.
    # (string value)
    #connection = <None>

    # The SQLAlchemy connection string to use to connect to the slave
    # database. (string value)
    #slave_connection = <None>

    # The SQLAlchemy asyncio connection string to use to connect to the
    # database. (string value)
    #asyncio_connection = <None>

    # The SQLAlchemy asyncio connection string to use to connect to the
    # slave database. (string value)
    #asyncio_slave_connection = <None>

    # Whether or not to assume a reader context needs to guarantee it can
    # read data committed by a writer assuming replication lag is present;
    # defaults to True. When False, a reader context works the same as
    # async_reader and will select the slave database if present. When
    # using a galera cluster, this can be set to False only if you set
    # mysql_wsrep_sync_wait to 1 (this will guarantee that the reader will
    # wait until writesets are committed).Note that this may incur a
    # performance degradation within the galera cluster. Note also that
    # this parameter has no effect if you do not set any slave_connection.
    # (boolean value)
    #synchronous_reader = true

    # The SQL mode to be used for MySQL sessions. This option, including
    # the default, overrides any server-set SQL mode. To use whatever SQL
    # mode is set by the server configuration, set this to no value.
    # Example: mysql_sql_mode= (string value)
    #mysql_sql_mode = TRADITIONAL

    # For Galera only, configure wsrep_sync_wait causality checks on new
    # connections.  Default is None, meaning don't configure any setting.
    # (integer value)
    #mysql_wsrep_sync_wait = <None>

    # Connections which have been present in the connection pool longer
    # than this number of seconds will be replaced with a new one the next
    # time they are checked out from the pool. (integer value)
    #connection_recycle_time = 3600

    # Maximum number of SQL connections to keep open in a pool. Setting a
    # value of 0 indicates no limit. (integer value)
    #max_pool_size = 5

    # Maximum number of database connection retries during startup. Set to
    # -1 to specify an infinite retry count. (integer value)
    #max_retries = 10

    # Interval between retries of opening a SQL connection. (integer
    # value)
    #retry_interval = 10

    # If set, use this value for max_overflow with SQLAlchemy. (integer
    # value)
    #max_overflow = 50

    # Verbosity of SQL debugging information: 0=None, 100=Everything.
    # (integer value)
    # Minimum value: 0
    # Maximum value: 100
    #connection_debug = 0

    # Add Python stack traces to SQL as comment strings. (boolean value)
    #connection_trace = false

    # If set, use this value for pool_timeout with SQLAlchemy. (integer
    # value)
    #pool_timeout = <None>

    # Enable the experimental use of database reconnect on connection
    # lost. (boolean value)
    #use_db_reconnect = false

    # Seconds between retries of a database transaction. (integer value)
    #db_retry_interval = 1

    # If True, increases the interval between retries of a database
    # operation up to db_max_retry_interval. (boolean value)
    #db_inc_retry_interval = true

    # If db_inc_retry_interval is set, the maximum seconds between retries
    # of a database operation. (integer value)
    #db_max_retry_interval = 10

    # Maximum retries in case of connection error or deadlock error before
    # error is raised. Set to -1 to specify an infinite retry count.
    # (integer value)
    #db_max_retries = 20

    # Optional URL parameters to append onto the connection URL at connect
    # time; specify as param1=value1&param2=value2&... (string value)
    #connection_parameters =

    [glance]

    #
    # From manila
    #

    # Version of Glance API to be used. (string value)
    #api_microversion = 2

    # Region name for connecting to glance. (string value)
    #region_name = RegionOne

    # Endpoint type to be used with glance client calls. (string value)
    # Possible values:
    # publicURL - <No description provided>
    # internalURL - <No description provided>
    # adminURL - <No description provided>
    # public - <No description provided>
    # internal - <No description provided>
    # admin - <No description provided>
    #endpoint_type = publicURL

    # Authentication URL (string value)
    #auth_url = <None>

    # Authentication type to load (string value)
    # Deprecated group/name - [glance]/auth_plugin
    #auth_type = <None>

    # PEM encoded Certificate Authority to use when verifying HTTPs
    # connections. (string value)
    #cafile = <None>

    # PEM encoded client certificate cert file (string value)
    #certfile = <None>

    # Collect per-API call timing information. (boolean value)
    #collect_timing = false

    # Optional domain ID to use with v3 and v2 parameters. It will be used
    # for both the user and project domain in v3 and ignored in v2
    # authentication. (string value)
    #default_domain_id = <None>

    # Optional domain name to use with v3 API and v2 parameters. It will
    # be used for both the user and project domain in v3 and ignored in v2
    # authentication. (string value)
    #default_domain_name = <None>

    # Domain ID to scope to (string value)
    #domain_id = <None>

    # Domain name to scope to (string value)
    #domain_name = <None>

    # Verify HTTPS connections. (boolean value)
    #insecure = false

    # PEM encoded client certificate key file (string value)
    #keyfile = <None>

    # User's password (string value)
    #password = <None>

    # Domain ID containing project (string value)
    #project_domain_id = <None>

    # Domain name containing project (string value)
    #project_domain_name = <None>

    # Project ID to scope to (string value)
    # Deprecated group/name - [glance]/tenant_id
    #project_id = <None>

    # Project name to scope to (string value)
    # Deprecated group/name - [glance]/tenant_name
    #project_name = <None>

    # Log requests to multiple loggers. (boolean value)
    #split_loggers = false

    # Scope for system operations (string value)
    #system_scope = <None>

    # Timeout value for http requests (integer value)
    #timeout = <None>

    # ID of the trust to use as a trustee use (string value)
    #trust_id = <None>

    # User's domain id (string value)
    #user_domain_id = <None>

    # User's domain name (string value)
    #user_domain_name = <None>

    # User id (string value)
    #user_id = <None>

    # Username (string value)
    # Deprecated group/name - [glance]/user_name
    #username = <None>

    [healthcheck]

    #
    # From oslo.middleware
    #

    # Show more detailed information as part of the response. Security
    # note: Enabling this option may expose sensitive details about the
    # service being monitored. Be sure to verify that it will not violate
    # your security policies. (boolean value)
    #detailed = false

    # Additional backends that can perform health checks and report that
    # information back as part of a request. (list value)
    #backends =

    # A list of network addresses to limit source ip allowed to access
    # healthcheck information. Any request from ip outside of these
    # network addresses are ignored. (list value)
    #allowed_source_ranges =

    # Ignore requests with proxy headers. (boolean value)
    #ignore_proxied_requests = false

    # Check the presence of a file to determine if an application is
    # running on a port. Used by DisableByFileHealthcheck plugin. (string
    # value)
    #disable_by_file_path = <None>

    # Check the presence of a file based on a port to determine if an
    # application is running on a port. Expects a "port:path" list of
    # strings. Used by DisableByFilesPortsHealthcheck plugin. (list value)
    #disable_by_file_paths =

    # Check the presence of files. Used by EnableByFilesHealthcheck
    # plugin. (list value)
    #enable_by_file_paths =

    [key_manager]

    #
    # From castellan.config
    #

    # Specify the key manager implementation. Options are "barbican" and
    # "vault". Default is  "barbican". Will support the  values earlier
    # set using [key_manager]/api_class for some time. (string value)
    # Deprecated group/name - [key_manager]/api_class
    #backend = barbican

    # The type of authentication credential to create. Required if no
    # context is passed to the credential factory. (string value)
    # Possible values:
    # token - <No description provided>
    # password - <No description provided>
    # keystone_token - <No description provided>
    # keystone_password - <No description provided>
    #auth_type = <None>

    # Token for authentication. Required for 'token' and 'keystone_token'
    # auth_type if no context is passed to the credential factory. (string
    # value)
    #token = <None>

    # Username for authentication. Required for 'password' auth_type.
    # Optional for the 'keystone_password' auth_type. (string value)
    #username = <None>

    # Password for authentication. Required for 'password' and
    # 'keystone_password' auth_type. (string value)
    #password = <None>

    # Use this endpoint to connect to Keystone. (uri value)
    #auth_url = <None>

    # User ID for authentication. Optional for 'keystone_token' and
    # 'keystone_password' auth_type. (string value)
    #user_id = <None>

    # User's domain ID for authentication. Optional for 'keystone_token'
    # and 'keystone_password' auth_type. (string value)
    #user_domain_id = <None>

    # User's domain name for authentication. Optional for 'keystone_token'
    # and 'keystone_password' auth_type. (string value)
    #user_domain_name = <None>

    # Trust ID for trust scoping. Optional for 'keystone_token' and
    # 'keystone_password' auth_type. (string value)
    #trust_id = <None>

    # Domain ID for domain scoping. Optional for 'keystone_token' and
    # 'keystone_password' auth_type. (string value)
    #domain_id = <None>

    # Domain name for domain scoping. Optional for 'keystone_token' and
    # 'keystone_password' auth_type. (string value)
    #domain_name = <None>

    # Project ID for project scoping. Optional for 'keystone_token' and
    # 'keystone_password' auth_type. (string value)
    #project_id = <None>

    # Project name for project scoping. Optional for 'keystone_token' and
    # 'keystone_password' auth_type. (string value)
    #project_name = <None>

    # Project's domain ID for project. Optional for 'keystone_token' and
    # 'keystone_password' auth_type. (string value)
    #project_domain_id = <None>

    # Project's domain name for project. Optional for 'keystone_token' and
    # 'keystone_password' auth_type. (string value)
    #project_domain_name = <None>

    # Allow fetching a new token if the current one is going to expire.
    # Optional for 'keystone_token' and 'keystone_password' auth_type.
    # (boolean value)
    #reauthenticate = true

    [keystone_authtoken]

    #
    # From keystonemiddleware.auth_token
    #

    # Complete "public" Identity API endpoint. This endpoint should not be
    # an "admin" endpoint, as it should be accessible by all end users.
    # Unauthenticated clients are redirected to this endpoint to
    # authenticate. Although this endpoint should ideally be unversioned,
    # client support in the wild varies. If you're using a versioned v2
    # endpoint here, then this should *not* be the same endpoint the
    # service user utilizes for validating tokens, because normal end
    # users may not be able to reach that endpoint. (string value)
    # Deprecated group/name - [keystone_authtoken]/auth_uri
    #www_authenticate_uri = <None>

    # DEPRECATED: Complete "public" Identity API endpoint. This endpoint
    # should not be an "admin" endpoint, as it should be accessible by all
    # end users. Unauthenticated clients are redirected to this endpoint
    # to authenticate. Although this endpoint should ideally be
    # unversioned, client support in the wild varies. If you're using a
    # versioned v2 endpoint here, then this should *not* be the same
    # endpoint the service user utilizes for validating tokens, because
    # normal end users may not be able to reach that endpoint. This option
    # is deprecated in favor of www_authenticate_uri and will be removed
    # in the S release. (string value)
    # This option is deprecated for removal since Queens.
    # Its value may be silently ignored in the future.
    # Reason: The auth_uri option is deprecated in favor of
    # www_authenticate_uri and will be removed in the S  release.
    #auth_uri = <None>

    # API version of the Identity API endpoint. (string value)
    #auth_version = <None>

    # Interface to use for the Identity API endpoint. Valid values are
    # "public", "internal" (default) or "admin". (string value)
    #interface = internal

    # Do not handle authorization requests within the middleware, but
    # delegate the authorization decision to downstream WSGI components.
    # (boolean value)
    #delay_auth_decision = false

    # Request timeout value for communicating with Identity API server.
    # (integer value)
    #http_connect_timeout = <None>

    # How many times are we trying to reconnect when communicating with
    # Identity API Server. (integer value)
    #http_request_max_retries = 3

    # Request environment key where the Swift cache object is stored. When
    # auth_token middleware is deployed with a Swift cache, use this
    # option to have the middleware share a caching backend with swift.
    # Otherwise, use the ``memcached_servers`` option instead. (string
    # value)
    #cache = <None>

    # Required if identity server requires client certificate (string
    # value)
    #certfile = <None>

    # Required if identity server requires client certificate (string
    # value)
    #keyfile = <None>

    # A PEM encoded Certificate Authority to use when verifying HTTPs
    # connections. Defaults to system CAs. (string value)
    #cafile = <None>

    # Verify HTTPS connections. (boolean value)
    #insecure = false

    # The region in which the identity server can be found. (string value)
    #region_name = <None>

    # Optionally specify a list of memcached server(s) to use for caching.
    # If left undefined, tokens will instead be cached in-process. (list
    # value)
    # Deprecated group/name - [keystone_authtoken]/memcache_servers
    #memcached_servers = <None>

    # In order to prevent excessive effort spent validating tokens, the
    # middleware caches previously-seen tokens for a configurable duration
    # (in seconds). Set to -1 to disable caching completely. (integer
    # value)
    #token_cache_time = 300

    # (Optional) If defined, indicate whether token data should be
    # authenticated or authenticated and encrypted. If MAC, token data is
    # authenticated (with HMAC) in the cache. If ENCRYPT, token data is
    # encrypted and authenticated in the cache. If the value is not one of
    # these options or empty, auth_token will raise an exception on
    # initialization. (string value)
    # Possible values:
    # None - <No description provided>
    # MAC - <No description provided>
    # ENCRYPT - <No description provided>
    #memcache_security_strategy = None

    # (Optional, mandatory if memcache_security_strategy is defined) This
    # string is used for key derivation. (string value)
    #memcache_secret_key = <None>

    # (Optional) Global toggle for TLS usage when comunicating with the
    # caching servers. (boolean value)
    #memcache_tls_enabled = false

    # (Optional) Path to a file of concatenated CA certificates in PEM
    # format necessary to establish the caching server's authenticity. If
    # tls_enabled is False, this option is ignored. (string value)
    #memcache_tls_cafile = <None>

    # (Optional) Path to a single file in PEM format containing the
    # client's certificate as well as any number of CA certificates needed
    # to establish the certificate's authenticity. This file is only
    # required when client side authentication is necessary. If
    # tls_enabled is False, this option is ignored. (string value)
    #memcache_tls_certfile = <None>

    # (Optional) Path to a single file containing the client's private key
    # in. Otherwhise the private key will be taken from the file specified
    # in tls_certfile. If tls_enabled is False, this option is ignored.
    # (string value)
    #memcache_tls_keyfile = <None>

    # (Optional) Set the available ciphers for sockets created with the
    # TLS context. It should be a string in the OpenSSL cipher list
    # format. If not specified, all OpenSSL enabled ciphers will be
    # available. (string value)
    #memcache_tls_allowed_ciphers = <None>

    # (Optional) Number of seconds memcached server is considered dead
    # before it is tried again. (integer value)
    #memcache_pool_dead_retry = 300

    # (Optional) Maximum total number of open connections to every
    # memcached server. (integer value)
    #memcache_pool_maxsize = 10

    # (Optional) Socket timeout in seconds for communicating with a
    # memcached server. (integer value)
    #memcache_pool_socket_timeout = 3

    # (Optional) Number of seconds a connection to memcached is held
    # unused in the pool before it is closed. (integer value)
    #memcache_pool_unused_timeout = 60

    # (Optional) Number of seconds that an operation will wait to get a
    # memcached client connection from the pool. (integer value)
    #memcache_pool_conn_get_timeout = 10

    # (Optional) Use the advanced (eventlet safe) memcached client pool.
    # (boolean value)
    #memcache_use_advanced_pool = true

    # (Optional) Indicate whether to set the X-Service-Catalog header. If
    # False, middleware will not ask for service catalog on token
    # validation and will not set the X-Service-Catalog header. (boolean
    # value)
    #include_service_catalog = true

    # Used to control the use and type of token binding. Can be set to:
    # "disabled" to not check token binding. "permissive" (default) to
    # validate binding information if the bind type is of a form known to
    # the server and ignore it if not. "strict" like "permissive" but if
    # the bind type is unknown the token will be rejected. "required" any
    # form of token binding is needed to be allowed. Finally the name of a
    # binding method that must be present in tokens. (string value)
    #enforce_token_bind = permissive

    # A choice of roles that must be present in a service token. Service
    # tokens are allowed to request that an expired token can be used and
    # so this check should tightly control that only actual services
    # should be sending this token. Roles here are applied as an ANY check
    # so any role in this list must be present. For backwards
    # compatibility reasons this currently only affects the allow_expired
    # check. (list value)
    #service_token_roles = service

    # For backwards compatibility reasons we must let valid service tokens
    # pass that don't pass the service_token_roles check as valid. Setting
    # this true will become the default in a future release and should be
    # enabled if possible. (boolean value)
    #service_token_roles_required = false

    # The name or type of the service as it appears in the service
    # catalog. This is used to validate tokens that have restricted access
    # rules. (string value)
    #service_type = <None>

    # Enable the SASL(Simple Authentication and Security Layer) if the
    # SASL_enable is true, else disable. (boolean value)
    #memcache_sasl_enabled = false

    # the user name for the SASL (string value)
    #memcache_username =

    # the username password for SASL (string value)
    #memcache_password =

    # Authentication type to load (string value)
    # Deprecated group/name - [keystone_authtoken]/auth_plugin
    #auth_type = <None>

    # Config Section from which to load plugin specific options (string
    # value)
    #auth_section = <None>

    [neutron]

    #
    # From manila
    #

    # URL for connecting to neutron. (string value)
    #url = <None>

    # DEPRECATED: Timeout value for connecting to neutron in seconds.
    # (integer value)
    # This option is deprecated for removal since Yoga.
    # Its value may be silently ignored in the future.
    # Reason: This parameter has had no effect since 2.0.0. The timeout
    # parameter should be used instead.
    #url_timeout = 30

    # DEPRECATED: Auth strategy for connecting to neutron in admin
    # context. (string value)
    # This option is deprecated for removal since Yoga.
    # Its value may be silently ignored in the future.
    # Reason: This parameter has had no effect since 2.0.0. Use the
    # auth_type parameter to select authentication type
    #auth_strategy = keystone

    # Endpoint type to be used with neutron client calls. (string value)
    # Possible values:
    # publicURL - <No description provided>
    # internalURL - <No description provided>
    # adminURL - <No description provided>
    # public - <No description provided>
    # internal - <No description provided>
    # admin - <No description provided>
    #endpoint_type = publicURL

    # Region name for connecting to neutron in admin context. (string
    # value)
    #region_name = <None>

    # Authentication URL (string value)
    #auth_url = <None>

    # Authentication type to load (string value)
    # Deprecated group/name - [neutron]/auth_plugin
    #auth_type = <None>

    # PEM encoded Certificate Authority to use when verifying HTTPs
    # connections. (string value)
    #cafile = <None>

    # PEM encoded client certificate cert file (string value)
    #certfile = <None>

    # Collect per-API call timing information. (boolean value)
    #collect_timing = false

    # Optional domain ID to use with v3 and v2 parameters. It will be used
    # for both the user and project domain in v3 and ignored in v2
    # authentication. (string value)
    #default_domain_id = <None>

    # Optional domain name to use with v3 API and v2 parameters. It will
    # be used for both the user and project domain in v3 and ignored in v2
    # authentication. (string value)
    #default_domain_name = <None>

    # Domain ID to scope to (string value)
    #domain_id = <None>

    # Domain name to scope to (string value)
    #domain_name = <None>

    # Verify HTTPS connections. (boolean value)
    #insecure = false

    # PEM encoded client certificate key file (string value)
    #keyfile = <None>

    # User's password (string value)
    #password = <None>

    # Domain ID containing project (string value)
    #project_domain_id = <None>

    # Domain name containing project (string value)
    #project_domain_name = <None>

    # Project ID to scope to (string value)
    # Deprecated group/name - [neutron]/tenant_id
    #project_id = <None>

    # Project name to scope to (string value)
    # Deprecated group/name - [neutron]/tenant_name
    #project_name = <None>

    # Log requests to multiple loggers. (boolean value)
    #split_loggers = false

    # Scope for system operations (string value)
    #system_scope = <None>

    # Timeout value for http requests (integer value)
    #timeout = <None>

    # ID of the trust to use as a trustee use (string value)
    #trust_id = <None>

    # User's domain id (string value)
    #user_domain_id = <None>

    # User's domain name (string value)
    #user_domain_name = <None>

    # User id (string value)
    #user_id = <None>

    # Username (string value)
    # Deprecated group/name - [neutron]/user_name
    #username = <None>

    [nova]

    #
    # From manila
    #

    # Version of Nova API to be used. (string value)
    #api_microversion = 2.10

    # Endpoint type to be used with nova client calls. (string value)
    # Possible values:
    # publicURL - <No description provided>
    # internalURL - <No description provided>
    # adminURL - <No description provided>
    # public - <No description provided>
    # internal - <No description provided>
    # admin - <No description provided>
    #endpoint_type = publicURL

    # Region name for connecting to nova. (string value)
    #region_name = <None>

    # Authentication URL (string value)
    #auth_url = <None>

    # Authentication type to load (string value)
    # Deprecated group/name - [nova]/auth_plugin
    #auth_type = <None>

    # PEM encoded Certificate Authority to use when verifying HTTPs
    # connections. (string value)
    #cafile = <None>

    # PEM encoded client certificate cert file (string value)
    #certfile = <None>

    # Collect per-API call timing information. (boolean value)
    #collect_timing = false

    # Optional domain ID to use with v3 and v2 parameters. It will be used
    # for both the user and project domain in v3 and ignored in v2
    # authentication. (string value)
    #default_domain_id = <None>

    # Optional domain name to use with v3 API and v2 parameters. It will
    # be used for both the user and project domain in v3 and ignored in v2
    # authentication. (string value)
    #default_domain_name = <None>

    # Domain ID to scope to (string value)
    #domain_id = <None>

    # Domain name to scope to (string value)
    #domain_name = <None>

    # Verify HTTPS connections. (boolean value)
    #insecure = false

    # PEM encoded client certificate key file (string value)
    #keyfile = <None>

    # User's password (string value)
    #password = <None>

    # Domain ID containing project (string value)
    #project_domain_id = <None>

    # Domain name containing project (string value)
    #project_domain_name = <None>

    # Project ID to scope to (string value)
    # Deprecated group/name - [nova]/tenant_id
    #project_id = <None>

    # Project name to scope to (string value)
    # Deprecated group/name - [nova]/tenant_name
    #project_name = <None>

    # Log requests to multiple loggers. (boolean value)
    #split_loggers = false

    # Scope for system operations (string value)
    #system_scope = <None>

    # Timeout value for http requests (integer value)
    #timeout = <None>

    # ID of the trust to use as a trustee use (string value)
    #trust_id = <None>

    # User's domain id (string value)
    #user_domain_id = <None>

    # User's domain name (string value)
    #user_domain_name = <None>

    # User id (string value)
    #user_id = <None>

    # Username (string value)
    # Deprecated group/name - [nova]/user_name
    #username = <None>

    [oslo_concurrency]

    #
    # From oslo.concurrency
    #

    # Enables or disables inter-process locks. (boolean value)
    #disable_process_locking = false

    # Directory to use for lock files.  For security, the specified
    # directory should only be writable by the user running the processes
    # that need locking. Defaults to environment variable OSLO_LOCK_PATH.
    # If external locks are used, a lock path must be set. (string value)
    #lock_path = <None>

    [oslo_messaging_kafka]

    #
    # From oslo.messaging
    #

    # Max fetch bytes of Kafka consumer (integer value)
    #kafka_max_fetch_bytes = 1048576

    # Default timeout(s) for Kafka consumers (floating point value)
    #kafka_consumer_timeout = 1.0

    # Group id for Kafka consumer. Consumers in one group will coordinate
    # message consumption (string value)
    #consumer_group = oslo_messaging_consumer

    # Upper bound on the delay for KafkaProducer batching in seconds
    # (floating point value)
    #producer_batch_timeout = 0.0

    # Size of batch for the producer async send (integer value)
    #producer_batch_size = 16384

    # The compression codec for all data generated by the producer. If not
    # set, compression will not be used. Note that the allowed values of
    # this depend on the kafka version (string value)
    # Possible values:
    # none - <No description provided>
    # gzip - <No description provided>
    # snappy - <No description provided>
    # lz4 - <No description provided>
    # zstd - <No description provided>
    #compression_codec = none

    # Enable asynchronous consumer commits (boolean value)
    #enable_auto_commit = false

    # The maximum number of records returned in a poll call (integer
    # value)
    #max_poll_records = 500

    # Protocol used to communicate with brokers (string value)
    # Possible values:
    # PLAINTEXT - <No description provided>
    # SASL_PLAINTEXT - <No description provided>
    # SSL - <No description provided>
    # SASL_SSL - <No description provided>
    #security_protocol = PLAINTEXT

    # Mechanism when security protocol is SASL (string value)
    #sasl_mechanism = PLAIN

    # CA certificate PEM file used to verify the server certificate
    # (string value)
    #ssl_cafile =

    # Client certificate PEM file used for authentication. (string value)
    #ssl_client_cert_file =

    # Client key PEM file used for authentication. (string value)
    #ssl_client_key_file =

    # Client key password file used for authentication. (string value)
    #ssl_client_key_password =

    [oslo_messaging_notifications]

    #
    # From oslo.messaging
    #

    # The Drivers(s) to handle sending notifications. Possible values are
    # messaging, messagingv2, routing, log, test, noop (multi valued)
    #driver =

    # A URL representing the messaging driver to use for notifications. If
    # not set, we fall back to the same configuration used for RPC.
    # (string value)
    #transport_url = <None>

    # AMQP topic used for OpenStack notifications. (list value)
    #topics = notifications

    # The maximum number of attempts to re-send a notification message
    # which failed to be delivered due to a recoverable error. 0 - No
    # retry, -1 - indefinite (integer value)
    #retry = -1

    [oslo_messaging_rabbit]

    #
    # From oslo.messaging
    #

    # Use durable queues in AMQP. If rabbit_quorum_queue is enabled,
    # queues will be durable and this value will be ignored. (boolean
    # value)
    #amqp_durable_queues = false

    # Auto-delete queues in AMQP. (boolean value)
    #amqp_auto_delete = false

    # Size of RPC connection pool. (integer value)
    # Minimum value: 1
    #rpc_conn_pool_size = 30

    # The pool size limit for connections expiration policy (integer
    # value)
    #conn_pool_min_size = 2

    # The time-to-live in sec of idle connections in the pool (integer
    # value)
    #conn_pool_ttl = 1200

    # Connect over SSL. (boolean value)
    #ssl = false

    # SSL version to use (valid only if SSL enabled). Valid values are
    # TLSv1 and SSLv23. SSLv2, SSLv3, TLSv1_1, and TLSv1_2 may be
    # available on some distributions. (string value)
    #ssl_version =

    # SSL key file (valid only if SSL enabled). (string value)
    #ssl_key_file =

    # SSL cert file (valid only if SSL enabled). (string value)
    #ssl_cert_file =

    # SSL certification authority file (valid only if SSL enabled).
    # (string value)
    #ssl_ca_file =

    # DEPRECATED: Global toggle for enforcing the OpenSSL FIPS mode. This
    # feature requires Python support. This is available in Python 3.9 in
    # all environments and may have been backported to older Python
    # versions on select environments. If the Python executable used does
    # not support OpenSSL FIPS mode, an exception will be raised. (boolean
    # value)
    # This option is deprecated for removal.
    # Its value may be silently ignored in the future.
    # Reason: FIPS_mode_set API was removed in OpenSSL 3.0.0. This option
    # has no effect now.
    #ssl_enforce_fips_mode = false

    # DEPRECATED: (DEPRECATED) It is recommend not to use this option
    # anymore. Run the health check heartbeat thread through a native
    # python thread by default. If this option is equal to False then the
    # health check heartbeat will inherit the execution model from the
    # parent process. For example if the parent process has monkey patched
    # the stdlib by using eventlet/greenlet then the heartbeat will be run
    # through a green thread. This option should be set to True only for
    # the wsgi services. (boolean value)
    # This option is deprecated for removal.
    # Its value may be silently ignored in the future.
    # Reason: The option is related to Eventlet which will be removed. In
    # addition this has never worked as expected with services using
    # eventlet for core service framework.
    #heartbeat_in_pthread = false

    # How long to wait (in seconds) before reconnecting in response to an
    # AMQP consumer cancel notification. (floating point value)
    # Minimum value: 0.0
    # Maximum value: 4.5
    #kombu_reconnect_delay = 1.0

    # Random time to wait for when reconnecting in response to an AMQP
    # consumer cancel notification. (floating point value)
    # Minimum value: 0.0
    #kombu_reconnect_splay = 0.0

    # EXPERIMENTAL: Possible values are: gzip, bz2. If not set compression
    # will not be used. This option may not be available in future
    # versions. (string value)
    #kombu_compression = <None>

    # How long to wait a missing client before abandoning to send it its
    # replies. This value should not be longer than rpc_response_timeout.
    # (integer value)
    # Deprecated group/name - [oslo_messaging_rabbit]/kombu_reconnect_timeout
    #kombu_missing_consumer_retry_timeout = 60

    # Determines how the next RabbitMQ node is chosen in case the one we
    # are currently connected to becomes unavailable. Takes effect only if
    # more than one RabbitMQ node is provided in config. (string value)
    # Possible values:
    # round-robin - <No description provided>
    # shuffle - <No description provided>
    #kombu_failover_strategy = round-robin

    # The RabbitMQ login method. (string value)
    # Possible values:
    # PLAIN - <No description provided>
    # AMQPLAIN - <No description provided>
    # EXTERNAL - <No description provided>
    # RABBIT-CR-DEMO - <No description provided>
    #rabbit_login_method = AMQPLAIN

    # How frequently to retry connecting with RabbitMQ. (integer value)
    # Minimum value: 1
    #rabbit_retry_interval = 1

    # How long to backoff for between retries when connecting to RabbitMQ.
    # (integer value)
    # Minimum value: 0
    #rabbit_retry_backoff = 2

    # Maximum interval of RabbitMQ connection retries. (integer value)
    # Minimum value: 1
    #rabbit_interval_max = 30

    # Try to use HA queues in RabbitMQ (x-ha-policy: all). If you change
    # this option, you must wipe the RabbitMQ database. In RabbitMQ 3.0,
    # queue mirroring is no longer controlled by the x-ha-policy argument
    # when declaring a queue. If you just want to make sure that all
    # queues (except those with auto-generated names) are mirrored across
    # all nodes, run: "rabbitmqctl set_policy HA '^(?!amq\.).*' '{"ha-
    # mode": "all"}' " (boolean value)
    #rabbit_ha_queues = false

    # Use quorum queues in RabbitMQ (x-queue-type: quorum). The quorum
    # queue is a modern queue type for RabbitMQ implementing a durable,
    # replicated FIFO queue based on the Raft consensus algorithm. It is
    # available as of RabbitMQ 3.8.0. If set this option will conflict
    # with the HA queues (``rabbit_ha_queues``) aka mirrored queues, in
    # other words the HA queues should be disabled. Quorum queues are also
    # durable by default so the amqp_durable_queues option is ignored when
    # this option is enabled. (boolean value)
    #rabbit_quorum_queue = false

    # Use quorum queues for transients queues in RabbitMQ. Enabling this
    # option will then make sure those queues are also using quorum kind
    # of rabbit queues, which are HA by default. (boolean value)
    #rabbit_transient_quorum_queue = false

    # Each time a message is redelivered to a consumer, a counter is
    # incremented. Once the redelivery count exceeds the delivery limit
    # the message gets dropped or dead-lettered (if a DLX exchange has
    # been configured) Used only when rabbit_quorum_queue is enabled,
    # Default 0 which means dont set a limit. (integer value)
    #rabbit_quorum_delivery_limit = 0

    # By default all messages are maintained in memory if a quorum queue
    # grows in length it can put memory pressure on a cluster. This option
    # can limit the number of messages in the quorum queue. Used only when
    # rabbit_quorum_queue is enabled, Default 0 which means dont set a
    # limit. (integer value)
    #rabbit_quorum_max_memory_length = 0

    # By default all messages are maintained in memory if a quorum queue
    # grows in length it can put memory pressure on a cluster. This option
    # can limit the number of memory bytes used by the quorum queue. Used
    # only when rabbit_quorum_queue is enabled, Default 0 which means dont
    # set a limit. (integer value)
    #rabbit_quorum_max_memory_bytes = 0

    # Positive integer representing duration in seconds for queue TTL
    # (x-expires). Queues which are unused for the duration of the TTL are
    # automatically deleted. The parameter affects only reply and fanout
    # queues. Setting 0 as value will disable the x-expires. If doing so,
    # make sure you have a rabbitmq policy to delete the queues or you
    # deployment will create an infinite number of queue over time.In case
    # rabbit_stream_fanout is set to True, this option will control data
    # retention policy (x-max-age) for messages in the fanout queue rather
    # then the queue duration itself. So the oldest data in the stream
    # queue will be discarded from it once reaching TTL Setting to 0 will
    # disable x-max-age for stream which make stream grow indefinitely
    # filling up the diskspace (integer value)
    # Minimum value: 0
    #rabbit_transient_queues_ttl = 1800

    # Specifies the number of messages to prefetch. Setting to zero allows
    # unlimited messages. (integer value)
    #rabbit_qos_prefetch_count = 0

    # Number of seconds after which the Rabbit broker is considered down
    # if heartbeat's keep-alive fails (0 disables heartbeat). (integer
    # value)
    #heartbeat_timeout_threshold = 60

    # How often times during the heartbeat_timeout_threshold we check the
    # heartbeat. (integer value)
    #heartbeat_rate = 3

    # DEPRECATED: (DEPRECATED) Enable/Disable the RabbitMQ mandatory flag
    # for direct send. The direct send is used as reply, so the
    # MessageUndeliverable exception is raised in case the client queue
    # does not exist.MessageUndeliverable exception will be used to loop
    # for a timeout to lets a chance to sender to recover.This flag is
    # deprecated and it will not be possible to deactivate this
    # functionality anymore (boolean value)
    # This option is deprecated for removal.
    # Its value may be silently ignored in the future.
    # Reason: Mandatory flag no longer deactivable.
    #direct_mandatory_flag = true

    # Enable x-cancel-on-ha-failover flag so that rabbitmq server will
    # cancel and notify consumerswhen queue is down (boolean value)
    #enable_cancel_on_failover = false

    # Should we use consistant queue names or random ones (boolean value)
    #use_queue_manager = false

    # Hostname used by queue manager. Defaults to the value returned by
    # socket.gethostname(). (string value)
    #
    # This option has a sample default set, which means that
    # its actual default value may vary from the one documented
    # below.
    #hostname = node1.example.com

    # Process name used by queue manager (string value)
    #
    # This option has a sample default set, which means that
    # its actual default value may vary from the one documented
    # below.
    #processname = nova-api

    # Use stream queues in RabbitMQ (x-queue-type: stream). Streams are a
    # new persistent and replicated data structure ("queue type") in
    # RabbitMQ which models an append-only log with non-destructive
    # consumer semantics. It is available as of RabbitMQ 3.9.0. If set
    # this option will replace all fanout queues with only one stream
    # queue. (boolean value)
    #rabbit_stream_fanout = false

    [oslo_middleware]

    #
    # From oslo.middleware
    #

    # The maximum body size for each request, in bytes. (integer value)
    #max_request_body_size = 114688

    # Whether the application is behind a proxy or not. This determines if
    # the middleware should parse the headers or not. (boolean value)
    #enable_proxy_headers_parsing = false

    # HTTP basic auth password file. (string value)
    #http_basic_auth_user_file = /etc/htpasswd

    [oslo_policy]

    #
    # From oslo.policy
    #

    # DEPRECATED: This option controls whether or not to enforce scope
    # when evaluating policies. If ``True``, the scope of the token used
    # in the request is compared to the ``scope_types`` of the policy
    # being enforced. If the scopes do not match, an ``InvalidScope``
    # exception will be raised. If ``False``, a message will be logged
    # informing operators that policies are being invoked with mismatching
    # scope. (boolean value)
    # This option is deprecated for removal.
    # Its value may be silently ignored in the future.
    # Reason: This configuration was added temporarily to facilitate a
    # smooth transition to the new RBAC. OpenStack will always enforce
    # scope checks. This configuration option is deprecated and will be
    # removed in the 2025.2 cycle.
    #enforce_scope = true

    # This option controls whether or not to use old deprecated defaults
    # when evaluating policies. If ``True``, the old deprecated defaults
    # are not going to be evaluated. This means if any existing token is
    # allowed for old defaults but is disallowed for new defaults, it will
    # be disallowed. It is encouraged to enable this flag along with the
    # ``enforce_scope`` flag so that you can get the benefits of new
    # defaults and ``scope_type`` together. If ``False``, the deprecated
    # policy check string is logically OR'd with the new policy check
    # string, allowing for a graceful upgrade experience between releases
    # with new policies, which is the default behavior. (boolean value)
    #enforce_new_defaults = true

    # The relative or absolute path of a file that maps roles to
    # permissions for a given service. Relative paths must be specified in
    # relation to the configuration file setting this option. (string
    # value)
    #policy_file = policy.yaml

    # Default rule. Enforced when a requested rule is not found. (string
    # value)
    #policy_default_rule = default

    # Directories where policy configuration files are stored. They can be
    # relative to any directory in the search path defined by the
    # config_dir option, or absolute paths. The file defined by
    # policy_file must exist for these directories to be searched.
    # Missing or empty directories are ignored. (multi valued)
    #policy_dirs = policy.d

    # Content Type to send and receive data for REST based policy check
    # (string value)
    # Possible values:
    # application/x-www-form-urlencoded - <No description provided>
    # application/json - <No description provided>
    #remote_content_type = application/x-www-form-urlencoded

    # server identity verification for REST based policy check (boolean
    # value)
    #remote_ssl_verify_server_crt = false

    # Absolute path to ca cert file for REST based policy check (string
    # value)
    #remote_ssl_ca_crt_file = <None>

    # Absolute path to client cert for REST based policy check (string
    # value)
    #remote_ssl_client_crt_file = <None>

    # Absolute path client key file REST based policy check (string value)
    #remote_ssl_client_key_file = <None>

    # Timeout in seconds for REST based policy check (floating point
    # value)
    # Minimum value: 0
    #remote_timeout = 60

    [oslo_reports]

    #
    # From oslo.reports
    #

    # Path to a log directory where to create a file (string value)
    #log_dir = <None>

    # The path to a file to watch for changes to trigger the reports,
    # instead of signals. Setting this option disables the signal trigger
    # for the reports. If application is running as a WSGI application it
    # is recommended to use this instead of signals. (string value)
    #file_event_handler = <None>

    # How many seconds to wait between polls when file_event_handler is
    # set (integer value)
    #file_event_handler_interval = 1

    [quota]

    #
    # From manila
    #

    # Number of shares allowed per project. (integer value)
    # Deprecated group/name - [DEFAULT]/quota_shares
    #shares = 50

    # Number of share snapshots allowed per project. (integer value)
    # Deprecated group/name - [DEFAULT]/quota_snapshots
    #snapshots = 50

    # Number of share gigabytes allowed per project. (integer value)
    # Deprecated group/name - [DEFAULT]/quota_gigabytes
    #gigabytes = 1000

    # Max size allowed per share, in gigabytes. (integer value)
    # Deprecated group/name - [DEFAULT]/quota_per_share_gigabytes
    #per_share_gigabytes = -1

    # Number of snapshot gigabytes allowed per project. (integer value)
    # Deprecated group/name - [DEFAULT]/quota_snapshot_gigabytes
    #snapshot_gigabytes = 1000

    # Number of share-networks allowed per project. (integer value)
    # Deprecated group/name - [DEFAULT]/quota_share_networks
    #share_networks = 10

    # Number of share-replicas allowed per project. (integer value)
    # Deprecated group/name - [DEFAULT]/quota_share_replicas
    #share_replicas = 100

    # Number of replica gigabytes allowed per project. (integer value)
    # Deprecated group/name - [DEFAULT]/quota_replica_gigabytes
    #replica_gigabytes = 1000

    # Number of share groups allowed. (integer value)
    # Deprecated group/name - [DEFAULT]/quota_share_groups
    #share_groups = 50

    # Number of share group snapshots allowed. (integer value)
    # Deprecated group/name - [DEFAULT]/quota_share_group_snapshots
    #share_group_snapshots = 50

    # Number of seconds until a reservation expires. (integer value)
    #reservation_expire = 86400

    # Count of reservations until usage is refreshed. (integer value)
    #until_refresh = 0

    # Number of seconds between subsequent usage refreshes. (integer
    # value)
    #max_age = 0

    # Default driver to use for quota checks. (string value)
    # Deprecated group/name - [DEFAULT]/quota_driver
    #driver = manila.quota.DbQuotaDriver

    # Number of share backups allowed per project. (integer value)
    # Deprecated group/name - [DEFAULT]/quota_backups
    #backups = 10

    # Total amount of storage, in gigabytes, allowed for backups per
    # project. (integer value)
    # Deprecated group/name - [DEFAULT]/quota_backup_gigabytes
    #backup_gigabytes = 1000

    # Number of encryption keys allowed per project. (integer value)
    #encryption_keys = 100

    [ssl]

    #
    # From oslo.service.sslutils
    #

    # DEPRECATED: CA certificate file to use to verify connecting clients.
    # (string value)
    # This option is deprecated for removal.
    # Its value may be silently ignored in the future.
    # Reason: The 'ca_file' option is deprecated and will be removed in a
    # future release.
    #ca_file = <None>

    # DEPRECATED: Certificate file to use when starting the server
    # securely. (string value)
    # This option is deprecated for removal.
    # Its value may be silently ignored in the future.
    # Reason: The 'cert_file' option is deprecated and will be removed in
    # a future release.
    #cert_file = <None>

    # DEPRECATED: Private key file to use when starting the server
    # securely. (string value)
    # This option is deprecated for removal.
    # Its value may be silently ignored in the future.
    # Reason: The 'key_file' option is deprecated and will be removed in a
    # future release.
    #key_file = <None>

    # DEPRECATED: SSL version to use (valid only if SSL enabled). Valid
    # values are TLSv1 and SSLv23. SSLv2, SSLv3, TLSv1_1, and TLSv1_2 may
    # be available on some distributions. (string value)
    # This option is deprecated for removal.
    # Its value may be silently ignored in the future.
    # Reason: The 'version' option is deprecated and will be removed in a
    # future release.
    #version = <None>

    # DEPRECATED: Sets the list of available ciphers. value should be a
    # string in the OpenSSL cipher list format. (string value)
    # This option is deprecated for removal.
    # Its value may be silently ignored in the future.
    # Reason: The 'ciphers' option is deprecated and will be removed in a
    # future release.
    #ciphers = <None>

    [vault]

    #
    # From castellan.config
    #

    # root token for vault (string value)
    #root_token_id = <None>

    # AppRole role_id for authentication with vault (string value)
    #approle_role_id = <None>

    # AppRole secret_id for authentication with vault (string value)
    #approle_secret_id = <None>

    # Mountpoint of KV store in Vault to use (string value)
    #kv_mountpoint = secret

    # Path relative to root of KV store in Vault to use. (string value)
    #kv_path = <None>

    # Version of KV store in Vault to use. (integer value)
    # Possible values:
    # 1 - <No description provided>
    # 2 - <No description provided>
    #kv_version = 2

    # Use this endpoint to connect to Vault (uri value)
    #vault_url = http://127.0.0.1:8200

    # Absolute path to ca cert file (string value)
    #ssl_ca_crt_file = <None>

    # DEPRECATED: SSL Enabled/Disabled (boolean value)
    # This option is deprecated for removal.
    # Its value may be silently ignored in the future.
    # Reason: This option has no effect.
    #use_ssl = false

    # Vault Namespace to use for all requests to Vault. Vault Namespaces
    # feature is available only in Vault Enterprise (string value)
    #namespace = <None>

    # Timeout (in seconds) in each request to Vault (floating point value)
    #timeout = 60

this page last updated: 2026-04-22 07:00:00

Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.

found an error? report a bug