Add gnocchi configuration tasks

All config files are now templated, a first attempt at a possibly passable
configuration is provided.  Role requirements are updated to work
around the current state of the OSA project and it's externalized roles.
README is updated to reference the two keystone vars being imported
and update the example playbook a bit.

README.rst

@@ -22,7 +22,21 @@ found in the openstack-ansible project: ``scripts/pw-token-gen.py``
 Role Variables
 --------------
 
-See ``defaults/main.yml`` for variables and their descriptions.
+Other variables expected for this role include:
+
+- keystone_service_publicuri
+- keystone_service_adminruri
+- galera_address
+
+Each of the keystone service uri variables is expected to include protocol,
+host, and port for the keystone service. Do not specify a path, to include
+keystone protocol version. See also the OpenStack Ansible project and the
+os_keystone role for more details on these variables.
+
+The galera address is expected to direct to the internal_lb_vip_address. See
+also the OpenStack Ansible project for more details.
+
+See ``defaults/main.yml`` for additional variables and their descriptions.
 
 Dependencies
 ------------
@@ -34,9 +48,12 @@ Example Playbook
 
 .. code-block:: yaml
 
-    - hosts: servers
+    - hosts: gnocchi_all
       roles:
-         - { role: stevelle.openstack-ansible-gnocchi }
+        role: stevelle.openstack-ansible-gnocchi
+        galera_address: "{{ internal_lb_vip_address }}"
+        tags:
+          - "os-gnocchi"
 
 License
 -------

defaults/main.yml

@@ -19,6 +19,8 @@ is_metal: true
 debug: false
 verbose: true
 
+gnocchi_fatal_deprecations: False
+
 #: Set this to enable or disable installing in a venv
 gnocchi_venv_enabled: true
 
@@ -47,6 +49,11 @@ gnocchi_git_url: "https://git.openstack.org/openstack/gnocchi"
 gnocchi_git_install_branch: 85bef730942dee660e4e87614aee3a212d7adf31# head of "master" as of 20.11.2015
 gnocchi_git_dest: "/opt/gnocchi_{{ gnocchi_git_install_branch | replace('/', '_') }}"
 
+#: Index DB info
+gnocchi_indexer_db_database: gnocchi
+gnocchi_indexer_db_user: gnocchi
+gnocchi_indexer_db_address: "{{ galera_address }}"
+
 #: System info
 gnocchi_system_user_name: gnocchi
 gnocchi_system_group_name: gnocchi
@@ -56,6 +63,8 @@ gnocchi_system_user_home: "/var/lib/{{ gnocchi_system_user_name }}"
 
 #: Service Type and Data
 gnocchi_service_name: gnocchi
+gnocchi_service_region: RegionOne
+gnocchi_service_user_name: gnocchi
 
 #: Gnocchi API program name
 gnocchi_api_program_name: gnocchi-api
@@ -89,3 +98,7 @@ gnocchi_service_names:
   - "{{ gnocchi_api_program_name }}"
   - "{{ gnocchi_metricd_program_name }}"
 
+#: Tunable overrides
+gnocchi_conf_overrides: {}
+gnocchi_api_paste_ini_overrides: {}
+gnocchi_policy_overrides: {}

meta/main.yml

@@ -11,5 +11,9 @@ galaxy_info:
     - trusty
   categories:
   - cloud
-#dependencies: TBD
-
+dependencies:
+ - pip_install
+# TODO the following won't resolve yet: not split out from OSA
+#  - galera_client
+#  - openstack_openrc
+#  - pip_lock_down

tasks/gnocchi_post_install.yml

@@ -0,0 +1,57 @@
+---
+# Copyright 2015, Rackspace US, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+- name: Drop gnocchi Config(s)
+  config_template:
+    src: "{{ item.src }}"
+    dest: "{{ item.dest }}"
+    owner: "{{ gnocchi_system_user_name }}"
+    group: "{{ gnocchi_system_group_name }}"
+    mode: "0644"
+    config_overrides: "{{ item.config_overrides }}"
+    config_type: "{{ item.config_type }}"
+  with_items:
+    - src: "gnocchi-api-paste.ini.j2"
+      dest: "/etc/gnocchi/gnocchi-api-paste.ini"
+      config_overrides: "{{ gnocchi_api_paste_ini_overrides }}"
+      config_type: "ini"
+    - src: "gnocchi-api.conf.j2"
+      dest: "/etc/gnocchi/gnocchi.conf"
+      config_overrides: "{{ gnocchi_conf_overrides }}"
+      config_type: "ini"
+    - src: "policy.json.j2"
+      dest: "/etc/gnocchi/policy.json"
+      config_overrides: "{{ gnocchi_policy_overrides }}"
+      config_type: "json"
+  notify:
+    - Restart gnocchi services
+  tags:
+    - gnocchi-config
+
+- name: Get gnocchi command path
+  command: which gnocchi
+  register: gnocchi_command_path
+  when:
+    - not gnocchi_venv_enabled | bool
+  tags:
+    - gnocchi-command-bin
+
+- name: Set gnocchi command path
+  set_fact:
+    gnocchi_bin: "{{ gnocchi_command_path.stdout | dirname }}"
+  when:
+    - not gnocchi_venv_enabled | bool
+  tags:
+    - gnocchi-command-bin

tasks/main.yml

@@ -14,7 +14,6 @@
 # limitations under the License.
 
 - include: gnocchi_pre_install.yml
-
 - include: gnocchi_install.yml
-
+- include: glance_post_install.yml
 - include: gnocchi_upstart_init.yml

templates/gnocchi-api-paste.ini.j2

@@ -0,0 +1,16 @@
+# {{ ansible_managed }}
+
+# Remove keystone_authtoken from the pipeline if you don't want to use keystone authentication
+[pipeline:main]
+pipeline = keystone_authtoken gnocchi
+
+[app:gnocchi]
+paste.app_factory = gnocchi.rest.app:app_factory
+
+[filter:keystone_authtoken]
+paste.filter_factory = keystonemiddleware.auth_token:filter_factory
+oslo_config_project = gnocchi
+
+[filter:cors]
+paste.filter_factory = oslo_middleware.cors:filter_factory
+oslo_config_project = gnocchi

templates/gnocchi.conf.j2

@@ -0,0 +1,633 @@
+# {{ ansible_managed }}
+
+[DEFAULT]
+
+#
+# From oslo.log
+#
+
+# Print debugging output (set logging level to DEBUG instead of default INFO
+# level). (boolean value)
+debug = {{ debug }}
+
+# If set to false, will disable INFO logging level, making WARNING the default.
+# (boolean value)
+# This option is deprecated for removal.
+# Its value may be silently ignored in the future.
+verbose = {{ verbose }}
+
+# The name of a logging configuration file. This file is appended to any
+# existing logging configuration files. For details about logging configuration
+# files, see the Python logging module documentation. Note that when logging
+# configuration files are used then all logging configuration is set in the
+# configuration file and other logging configuration options are ignored (for
+# example, log_format). (string value)
+# Deprecated group/name - [DEFAULT]/log_config
+#log_config_append = <None>
+
+# Format string for %%(asctime)s in log records. Default: %(default)s . This
+# option is ignored if log_config_append is set. (string value)
+#log_date_format = %Y-%m-%d %H:%M:%S
+
+# (Optional) Name of log file to output to. If no default is set, logging will
+# go to stdout. This option is ignored if log_config_append is set. (string
+# value)
+# Deprecated group/name - [DEFAULT]/logfile
+log_file = /var/log/gnocchi/gnocchi.log
+
+# (Optional) The base directory used for relative --log-file paths. This option
+# is ignored if log_config_append is set. (string value)
+# Deprecated group/name - [DEFAULT]/logdir
+#log_dir = <None>
+
+# (Optional) Uses logging handler designed to watch file system. When log file
+# is moved or removed this handler will open a new log file with specified path
+# instantaneously. It makes sense only if log-file option is specified and
+# Linux platform is used. This option is ignored if log_config_append is set.
+# (boolean value)
+watch_log_file = true
+
+# Use syslog for logging. Existing syslog format is DEPRECATED and will be
+# changed later to honor RFC5424. This option is ignored if log_config_append
+# is set. (boolean value)
+#use_syslog = false
+
+# (Optional) Enables or disables syslog rfc5424 format for logging. If enabled,
+# prefixes the MSG part of the syslog message with APP-NAME (RFC5424). The
+# format without the APP-NAME is deprecated in Kilo, and will be removed in
+# Mitaka, along with this option. This option is ignored if log_config_append
+# is set. (boolean value)
+# This option is deprecated for removal.
+# Its value may be silently ignored in the future.
+#use_syslog_rfc_format = true
+
+# Syslog facility to receive log lines. This option is ignored if
+# log_config_append is set. (string value)
+#syslog_log_facility = LOG_USER
+
+# Log output to standard error. This option is ignored if log_config_append is
+# set. (boolean value)
+#use_stderr = true
+
+# Format string to use for log messages with context. (string value)
+#logging_context_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user_identity)s] %(instance)s%(message)s
+
+# Format string to use for log messages without context. (string value)
+#logging_default_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [-] %(instance)s%(message)s
+
+# Data to append to log format when level is DEBUG. (string value)
+#logging_debug_format_suffix = %(funcName)s %(pathname)s:%(lineno)d
+
+# Prefix each line of exception output with this format. (string value)
+#logging_exception_prefix = %(asctime)s.%(msecs)03d %(process)d ERROR %(name)s %(instance)s
+
+# List of logger=LEVEL pairs. This option is ignored if log_config_append is
+# set. (list value)
+#default_log_levels = amqp=WARN,amqplib=WARN,boto=WARN,qpid=WARN,sqlalchemy=WARN,suds=INFO,oslo.messaging=INFO,iso8601=WARN,requests.packages.urllib3.connectionpool=WARN,urllib3.connectionpool=WARN,websocket=WARN,requests.packages.urllib3.util.retry=WARN,urllib3.util.retry=WARN,keystonemiddleware=WARN,routes.middleware=WARN,stevedore=WARN,taskflow=WARN
+
+# Enables or disables publication of error events. (boolean value)
+#publish_errors = false
+
+# The format for an instance that is passed with the log message. (string
+# value)
+#instance_format = "[instance: %(uuid)s] "
+
+# The format for an instance UUID that is passed with the log message. (string
+# value)
+#instance_uuid_format = "[instance: %(uuid)s] "
+
+# Format string for user_identity field of the logging_context_format_string
+# (string value)
+#logging_user_identity_format = %(user)s %(tenant)s %(domain)s %(user_domain)s %(project_domain)s
+
+# Enables or disables fatal status of deprecations. (boolean value)
+fatal_deprecations = {{ gnocchi_fatal_deprecations }}
+
+
+[api]
+
+#
+# From gnocchi
+#
+
+# Path to API Paste configuration. (string value)
+#paste_config = api-paste.ini
+
+# The port for the Gnocchi API server. (port value)
+# Minimum value: 1
+# Maximum value: 65535
+#port = 8041
+
+# The listen IP for the Gnocchi API server. (string value)
+#host = 0.0.0.0
+
+# Toggle Pecan Debug Middleware. (boolean value)
+#pecan_debug = false
+
+# Middlewares to use. Use Paste config instead. (multi valued)
+# This option is deprecated for removal.
+# Its value may be silently ignored in the future.
+#middlewares =
+
+# Number of workers for Gnocchi API server. By default the available number of
+# CPU is used. (integer value)
+# Minimum value: 1
+#workers = <None>
+
+# The maximum number of items returned in a single response from a collection
+# resource (integer value)
+#max_limit = 1000
+
+
+[archive_policy]
+
+#
+# From gnocchi
+#
+
+# Default aggregation methods to use in created archive policies (list value)
+#default_aggregation_methods = mean,min,max,sum,std,median,count,95pct
+
+
+[cors]
+
+#
+# From oslo.middleware
+#
+
+# Indicate whether this resource may be shared with the domain received in the
+# requests "origin" header. (list value)
+#allowed_origin = <None>
+
+# Indicate that the actual request can include user credentials (boolean value)
+#allow_credentials = true
+
+# Indicate which headers are safe to expose to the API. Defaults to HTTP Simple
+# Headers. (list value)
+#expose_headers = Content-Type,Cache-Control,Content-Language,Expires,Last-Modified,Pragma
+
+# Maximum cache age of CORS preflight requests. (integer value)
+#max_age = 3600
+
+# Indicate which methods can be used during the actual request. (list value)
+#allow_methods = GET,POST,PUT,DELETE,OPTIONS
+
+# Indicate which header field names may be used during the actual request.
+# (list value)
+#allow_headers = Content-Type,Cache-Control,Content-Language,Expires,Last-Modified,Pragma
+
+
+[cors.subdomain]
+
+#
+# From oslo.middleware
+#
+
+# Indicate whether this resource may be shared with the domain received in the
+# requests "origin" header. (list value)
+#allowed_origin = <None>
+
+# Indicate that the actual request can include user credentials (boolean value)
+#allow_credentials = true
+
+# Indicate which headers are safe to expose to the API. Defaults to HTTP Simple
+# Headers. (list value)
+#expose_headers = Content-Type,Cache-Control,Content-Language,Expires,Last-Modified,Pragma
+
+# Maximum cache age of CORS preflight requests. (integer value)
+#max_age = 3600
+
+# Indicate which methods can be used during the actual request. (list value)
+#allow_methods = GET,POST,PUT,DELETE,OPTIONS
+
+# Indicate which header field names may be used during the actual request.
+# (list value)
+#allow_headers = Content-Type,Cache-Control,Content-Language,Expires,Last-Modified,Pragma
+
+
+[database]
+
+#
+# From oslo.db
+#
+
+# The file name to use with SQLite. (string value)
+# Deprecated group/name - [DEFAULT]/sqlite_db
+#sqlite_db = oslo.sqlite
+
+# If True, SQLite uses synchronous mode. (boolean value)
+# Deprecated group/name - [DEFAULT]/sqlite_synchronous
+#sqlite_synchronous = true
+
+# The back end to use for the database. (string value)
+# Deprecated group/name - [DEFAULT]/db_backend
+#backend = sqlalchemy
+
+# The SQLAlchemy connection string to use to connect to the database. (string
+# value)
+# Deprecated group/name - [DEFAULT]/sql_connection
+# Deprecated group/name - [DATABASE]/sql_connection
+# Deprecated group/name - [sql]/connection
+connection = mysql+pymysql://{{ gnocchi_indexer_db_user }}:{{ gnocchi_indexer_db_password }}@{{ gnocchi_indexer_db_address }}/{{ gnocchi_indexer_db_database }}?charset=utf8
+
+# The SQLAlchemy connection string to use to connect to the slave database.
+# (string value)
+#slave_connection = <None>
+
+# The SQL mode to be used for MySQL sessions. This option, including the
+# default, overrides any server-set SQL mode. To use whatever SQL mode is set
+# by the server configuration, set this to no value. Example: mysql_sql_mode=
+# (string value)
+#mysql_sql_mode = TRADITIONAL
+
+# Timeout before idle SQL connections are reaped. (integer value)
+# Deprecated group/name - [DEFAULT]/sql_idle_timeout
+# Deprecated group/name - [DATABASE]/sql_idle_timeout
+# Deprecated group/name - [sql]/idle_timeout
+#idle_timeout = 3600
+
+# Minimum number of SQL connections to keep open in a pool. (integer value)
+# Deprecated group/name - [DEFAULT]/sql_min_pool_size
+# Deprecated group/name - [DATABASE]/sql_min_pool_size
+#min_pool_size = 1
+
+# Maximum number of SQL connections to keep open in a pool. (integer value)
+# Deprecated group/name - [DEFAULT]/sql_max_pool_size
+# Deprecated group/name - [DATABASE]/sql_max_pool_size
+#max_pool_size = <None>
+
+# Maximum number of database connection retries during startup. Set to -1 to
+# specify an infinite retry count. (integer value)
+# Deprecated group/name - [DEFAULT]/sql_max_retries
+# Deprecated group/name - [DATABASE]/sql_max_retries
+#max_retries = 10
+
+# Interval between retries of opening a SQL connection. (integer value)
+# Deprecated group/name - [DEFAULT]/sql_retry_interval
+# Deprecated group/name - [DATABASE]/reconnect_interval
+#retry_interval = 10
+
+# If set, use this value for max_overflow with SQLAlchemy. (integer value)
+# Deprecated group/name - [DEFAULT]/sql_max_overflow
+# Deprecated group/name - [DATABASE]/sqlalchemy_max_overflow
+#max_overflow = <None>
+
+# Verbosity of SQL debugging information: 0=None, 100=Everything. (integer
+# value)
+# Deprecated group/name - [DEFAULT]/sql_connection_debug
+#connection_debug = 0
+
+# Add Python stack traces to SQL as comment strings. (boolean value)
+# Deprecated group/name - [DEFAULT]/sql_connection_trace
+#connection_trace = false
+
+# If set, use this value for pool_timeout with SQLAlchemy. (integer value)
+# Deprecated group/name - [DATABASE]/sqlalchemy_pool_timeout
+#pool_timeout = <None>
+
+# Enable the experimental use of database reconnect on connection lost.
+# (boolean value)
+#use_db_reconnect = false
+
+# Seconds between retries of a database transaction. (integer value)
+#db_retry_interval = 1
+
+# If True, increases the interval between retries of a database operation up to
+# db_max_retry_interval. (boolean value)
+#db_inc_retry_interval = true
+
+# If db_inc_retry_interval is set, the maximum seconds between retries of a
+# database operation. (integer value)
+#db_max_retry_interval = 10
+
+# Maximum retries in case of connection error or deadlock error before error is
+# raised. Set to -1 to specify an infinite retry count. (integer value)
+#db_max_retries = 20
+
+
+[indexer]
+
+#
+# From gnocchi
+#
+
+# Indexer driver to use (string value)
+url = mysql+pymysql://{{ gnocchi_indexer_db_user }}:{{ gnocchi_indexer_db_password }}@{{ gnocchi_indexer_db_address }}/{{ gnocchi_indexer_db_database }}?charset=utf8
+
+
+[keystone_authtoken]
+
+#
+# From keystonemiddleware.auth_token
+#
+
+# Complete public Identity API endpoint. (string value)
+auth_uri = {{ keystone_service_publicuri }}
+
+# API version of the admin Identity API endpoint. (string value)
+auth_version = 3
+
+# Do not handle authorization requests within the middleware, but delegate the
+# authorization decision to downstream WSGI components. (boolean value)
+#delay_auth_decision = false
+
+# Request timeout value for communicating with Identity API server. (integer
+# value)
+#http_connect_timeout = <None>
+
+# How many times are we trying to reconnect when communicating with Identity
+# API Server. (integer value)
+#http_request_max_retries = 3
+
+# Env key for the swift cache. (string value)
+#cache = <None>
+
+# Required if identity server requires client certificate (string value)
+#certfile = <None>
+
+# Required if identity server requires client certificate (string value)
+#keyfile = <None>
+
+# A PEM encoded Certificate Authority to use when verifying HTTPs connections.
+# Defaults to system CAs. (string value)
+#cafile = <None>
+
+# Verify HTTPS connections. (boolean value)
+#insecure = false
+
+# The region in which the identity server can be found. (string value)
+region_name = {{ gnocchi_service_region }}
+
+# Directory used to cache files related to PKI tokens. (string value)
+#signing_dir = <None>
+
+# Optionally specify a list of memcached server(s) to use for caching. If left
+# undefined, tokens will instead be cached in-process. (list value)
+# Deprecated group/name - [DEFAULT]/memcache_servers
+#memcached_servers = <None>
+
+# In order to prevent excessive effort spent validating tokens, the middleware
+# caches previously-seen tokens for a configurable duration (in seconds). Set
+# to -1 to disable caching completely. (integer value)
+#token_cache_time = 300
+
+# Determines the frequency at which the list of revoked tokens is retrieved
+# from the Identity service (in seconds). A high number of revocation events
+# combined with a low cache duration may significantly reduce performance.
+# (integer value)
+#revocation_cache_time = 10
+
+# (Optional) If defined, indicate whether token data should be authenticated or
+# authenticated and encrypted. Acceptable values are MAC or ENCRYPT.  If MAC,
+# token data is authenticated (with HMAC) in the cache. If ENCRYPT, token data
+# is encrypted and authenticated in the cache. If the value is not one of these
+# options or empty, auth_token will raise an exception on initialization.
+# (string value)
+#memcache_security_strategy = <None>
+
+# (Optional, mandatory if memcache_security_strategy is defined) This string is
+# used for key derivation. (string value)
+#memcache_secret_key = <None>
+
+# (Optional) Number of seconds memcached server is considered dead before it is
+# tried again. (integer value)
+#memcache_pool_dead_retry = 300
+
+# (Optional) Maximum total number of open connections to every memcached
+# server. (integer value)
+#memcache_pool_maxsize = 10
+
+# (Optional) Socket timeout in seconds for communicating with a memcached
+# server. (integer value)
+#memcache_pool_socket_timeout = 3
+
+# (Optional) Number of seconds a connection to memcached is held unused in the
+# pool before it is closed. (integer value)
+#memcache_pool_unused_timeout = 60
+
+# (Optional) Number of seconds that an operation will wait to get a memcached
+# client connection from the pool. (integer value)
+#memcache_pool_conn_get_timeout = 10
+
+# (Optional) Use the advanced (eventlet safe) memcached client pool. The
+# advanced pool will only work under python 2.x. (boolean value)
+#memcache_use_advanced_pool = false
+
+# (Optional) Indicate whether to set the X-Service-Catalog header. If False,
+# middleware will not ask for service catalog on token validation and will not
+# set the X-Service-Catalog header. (boolean value)
+#include_service_catalog = true
+
+# Used to control the use and type of token binding. Can be set to: "disabled"
+# to not check token binding. "permissive" (default) to validate binding
+# information if the bind type is of a form known to the server and ignore it
+# if not. "strict" like "permissive" but if the bind type is unknown the token
+# will be rejected. "required" any form of token binding is needed to be
+# allowed. Finally the name of a binding method that must be present in tokens.
+# (string value)
+#enforce_token_bind = permissive
+
+# If true, the revocation list will be checked for cached tokens. This requires
+# that PKI tokens are configured on the identity server. (boolean value)
+#check_revocations_for_cached = false
+
+# Hash algorithms to use for hashing PKI tokens. This may be a single algorithm
+# or multiple. The algorithms are those supported by Python standard
+# hashlib.new(). The hashes will be tried in the order given, so put the
+# preferred one first for performance. The result of the first hash will be
+# stored in the cache. This will typically be set to multiple values only while
+# migrating from a less secure algorithm to a more secure one. Once all the old
+# tokens are expired this option should be set to a single value for better
+# performance. (list value)
+#hash_algorithms = md5
+
+# Complete admin Identity API endpoint. This should specify the unversioned
+# root endpoint e.g. https://localhost:35357/ (string value)
+identity_uri = {{ keystone_service_adminuri }}
+
+# Service username. (string value)
+admin_user = {{ gnocchi_service_user_name }}
+
+# Service user password. (string value)
+admin_password = {{ gnocchi_service_password }}
+
+# Service tenant name. (string value)
+#admin_tenant_name = admin
+
+
+[metricd]
+
+#
+# From gnocchi
+#
+
+# Number of workers for Gnocchi metric daemons. By default the available number
+# of CPU is used. (integer value)
+# Minimum value: 1
+#workers = <None>
+
+
+[oslo_middleware]
+
+#
+# From oslo.middleware
+#
+
+# The maximum body size for each  request, in bytes. (integer value)
+# Deprecated group/name - [DEFAULT]/osapi_max_request_body_size
+# Deprecated group/name - [DEFAULT]/max_request_body_size
+#max_request_body_size = 114688
+
+#
+# From oslo.middleware
+#
+
+# The HTTP Header that will be used to determine what the original request
+# protocol scheme was, even if it was hidden by an SSL termination proxy.
+# (string value)
+# This option is deprecated for removal.
+# Its value may be silently ignored in the future.
+#secure_proxy_ssl_header = X-Forwarded-Proto
+
+
+[oslo_policy]
+
+#
+# From oslo.policy
+#
+
+# The JSON file that defines policies. (string value)
+# Deprecated group/name - [DEFAULT]/policy_file
+#policy_file = policy.json
+
+# Default rule. Enforced when a requested rule is not found. (string value)
+# Deprecated group/name - [DEFAULT]/policy_default_rule
+#policy_default_rule = default
+
+# Directories where policy configuration files are stored. They can be relative
+# to any directory in the search path defined by the config_dir option, or
+# absolute paths. The file defined by policy_file must exist for these
+# directories to be searched.  Missing or empty directories are ignored. (multi
+# valued)
+# Deprecated group/name - [DEFAULT]/policy_dirs
+#policy_dirs = policy.d
+
+
+[statsd]
+
+#
+# From gnocchi
+#
+
+# The listen IP for statsd (string value)
+#host = 0.0.0.0
+
+# The port for statsd (port value)
+# Minimum value: 1
+# Maximum value: 65535
+#port = 8125
+
+# Resource UUID to use to identify statsd in Gnocchi (string value)
+#resource_id = <None>
+
+# User UUID to use to identify statsd in Gnocchi (string value)
+#user_id = <None>
+
+# Project UUID to use to identify statsd in Gnocchi (string value)
+#project_id = <None>
+
+# Archive policy name to use when creating metrics (string value)
+#archive_policy_name = <None>
+
+# Delay between flushes (floating point value)
+#flush_delay = <None>
+
+
+[storage]
+
+#
+# From gnocchi
+#
+
+# Number of workers to run during adding new measures for pre-aggregation
+# needs. (integer value)
+#aggregation_workers_number = <None>
+
+# Coordination driver URL (string value)
+#coordination_url = file:///var/lib/gnocchi/locks
+
+# Storage driver to use (string value)
+#driver = file
+
+# How many seconds to wait between new metric measure processing (integer
+# value)
+#metric_processing_delay = 5
+
+# How many seconds to wait between metric ingestion reporting (integer value)
+#metric_reporting_delay = 10
+
+# Ceph pool name to use. (string value)
+#ceph_pool = gnocchi
+
+# Ceph username (ie: client.admin). (string value)
+#ceph_username = <None>
+
+# Ceph keyring path. (string value)
+#ceph_keyring = <None>
+
+# Ceph configuration file. (string value)
+#ceph_conffile = /etc/ceph/ceph.conf
+
+# Path used to store gnocchi data files. (string value)
+#file_basepath = /var/lib/gnocchi
+
+# Path used to store Gnocchi temporary files. (string value)
+#file_basepath_tmp = ${file_basepath}/tmp
+
+# Swift authentication version to user. (string value)
+#swift_auth_version = 1
+
+# Swift pre-auth URL. (string value)
+#swift_preauthurl = <None>
+
+# Swift auth URL. (string value)
+#swift_authurl = http://localhost:8080/auth/v1.0
+
+# Swift token to user to authenticate. (string value)
+#swift_preauthtoken = <None>
+
+# Swift user. (string value)
+#swift_user = admin:admin
+
+# Swift key/password. (string value)
+#swift_key = admin
+
+# Swift tenant name, only used in v2 auth. (string value)
+#swift_tenant_name = <None>
+
+# Prefix to namespace metric containers. (string value)
+#swift_container_prefix = gnocchi
+
+# Connection timeout in seconds. (integer value)
+#swift_timeout = 300
+
+# InfluxDB host (string value)
+#influxdb_host = localhost
+
+# InfluxDB port (port value)
+# Minimum value: 1
+# Maximum value: 65535
+#influxdb_port = 8086
+
+# InfluxDB username (string value)
+#influxdb_username = root
+
+# InfluxDB password (string value)
+#influxdb_password = <None>
+
+# InfluxDB database (string value)
+#influxdb_database = gnocchi
+
+# InfluxDB ingests data in asynchroneous ways. Set to True to wait data are
+# ingested. (boolean value)
+#influxdb_block_until_data_ingested = false

templates/policy.json

@@ -0,0 +1,36 @@
+{
+    "admin_or_creator": "role:admin or project_id:%(created_by_project_id)s",
+    "resource_owner": "project_id:%(project_id)s",
+    "metric_owner": "project_id:%(resource.project_id)s",
+
+    "get status": "role:admin",
+
+    "create resource": "",
+    "get resource": "rule:admin_or_creator or rule:resource_owner",
+    "update resource": "rule:admin_or_creator",
+    "delete resource": "rule:admin_or_creator",
+    "list resource": "",
+    "list all resource": "role:admin",
+    "search resource": "",
+    "search all resource": "role:admin",
+
+    "get archive policy": "",
+    "list archive policy": "",
+    "create archive policy": "role:admin",
+    "delete archive policy": "role:admin",
+
+    "create archive policy rule": "role:admin",
+    "get archive policy rule": "",
+    "list archive policy rule": "",
+    "delete archive policy rule": "role:admin",
+
+    "create metric": "",
+    "delete metric": "rule:admin_or_creator",
+    "get metric": "rule:admin_or_creator or rule:metric_owner",
+    "search metric": "rule:admin_or_creator or rule:metric_owner",
+    "list metric": "",
+    "list all metric": "role:admin",
+
+    "get measures":  "rule:admin_or_creator or rule:metric_owner",
+    "post measures":  "rule:admin_or_creator"
+}