16625: Merge branch 'master' into 16625-add-azure-managed-image-support

[arvados.git] / lib / config / config.default.yml

diff --git a/lib/config/config.default.yml b/lib/config/config.default.yml
index 204f7538bad5fc268d191f9fa58a38aa5f7389a0..89156719b2f34be76ca02ed58e83867514d1d1e2 100644 (file)
--- a/lib/config/config.default.yml
+++ b/lib/config/config.default.yml
@@ -139,9 +139,6 @@ Clusters:
       Workbench2:
         InternalURLs: {}
         ExternalURL: ""
-      Nodemanager:
-        InternalURLs: {}
-        ExternalURL: "-"
       Health:
         InternalURLs: {}
         ExternalURL: "-"
@@ -440,6 +437,13 @@ Clusters:
       # or omitted, pages are processed serially.
       BalanceCollectionBuffers: 1000
 
+      # Maximum time for a rebalancing run. This ensures keep-balance
+      # eventually gives up and retries if, for example, a network
+      # error causes a hung connection that is never closed by the
+      # OS. It should be long enough that it doesn't interrupt a
+      # long-running balancing operation.
+      BalanceTimeout: 6h
+
       # Default lifetime for ephemeral collections: 2 weeks. This must not
       # be less than BlobSigningTTL.
       DefaultTrashLifetime: 336h
@@ -479,6 +483,9 @@ Clusters:
       # Use of this feature is not recommended, if it can be avoided.
       ForwardSlashNameSubstitution: ""
 
+      # Include "folder objects" in S3 ListObjects responses.
+      S3FolderObjects: true
+
       # Managed collection properties. At creation time, if the client didn't
       # provide the listed keys, they will be automatically populated following
       # one of the following behaviors:
@@ -551,6 +558,40 @@ Clusters:
         # work. If false, only the primary email address will be used.
         AlternateEmailAddresses: true
 
+      OpenIDConnect:
+        # Authenticate with an OpenID Connect provider.
+        Enable: false
+
+        # Issuer URL, e.g., "https://login.example.com".
+        #
+        # This must be exactly equal to the URL returned by the issuer
+        # itself in its config response ("isser" key). If the
+        # configured value is "https://example" and the provider
+        # returns "https://example:443" or "https://example/" then
+        # login will fail, even though those URLs are equivalent
+        # (RFC3986).
+        Issuer: ""
+
+        # Your client ID and client secret (supplied by the provider).
+        ClientID: ""
+        ClientSecret: ""
+
+        # OpenID claim field containing the user's email
+        # address. Normally "email"; see
+        # https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims
+        EmailClaim: "email"
+
+        # OpenID claim field containing the email verification
+        # flag. Normally "email_verified".  To accept every returned
+        # email address without checking a "verified" field at all,
+        # use the empty string "".
+        EmailVerifiedClaim: "email_verified"
+
+        # OpenID claim field containing the user's preferred
+        # username. If empty, use the mailbox part of the user's email
+        # address.
+        UsernameClaim: ""
+
       PAM:
         # (Experimental) Use PAM to authenticate users.
         Enable: false
@@ -614,9 +655,15 @@ Clusters:
         # "ou=Users,dc=example,dc=com"
         SearchBase: ""
 
-        # Additional filters for username lookup. Special characters
-        # in assertion values must be escaped (see RFC4515). Example:
-        # "(objectClass=person)"
+        # Additional filters to apply when looking up users' LDAP
+        # entries. This can be used to restrict access to a subset of
+        # LDAP users, or to disambiguate users from other directory
+        # entries that have the SearchAttribute present.
+        #
+        # Special characters in assertion values must be escaped (see
+        # RFC4515).
+        #
+        # Example: "(objectClass=person)"
         SearchFilters: ""
 
         # LDAP attribute to use as the user's email address.
@@ -905,6 +952,10 @@ Clusters:
         TimeoutShutdown: 10s
 
         # Worker VM image ID.
+        # (aws) AMI identifier
+        # (azure) managed disks: the name of the managed disk image
+        # (azure) unmanaged disks (deprecated): the complete URI of the VHD, e.g.
+        # https://xxxxx.blob.core.windows.net/system/Microsoft.Compute/Images/images/xxxxx.vhd
         ImageID: ""
 
         # An executable file (located on the dispatcher host) to be
@@ -961,13 +1012,33 @@ Clusters:
 
           # (azure) Instance configuration.
           CloudEnvironment: AzurePublicCloud
-          ResourceGroup: ""
           Location: centralus
+
+          # (azure) The resource group where the VM and virtual NIC will be
+          # created.
+          ResourceGroup: ""
+
+          # (azure) The resource group of the Network to use for the virtual
+          # NIC (if different from ResourceGroup)
+          NetworkResourceGroup: ""
           Network: ""
           Subnet: ""
+
+          # (azure) managed disks: The resource group where the managed disk
+          # image can be found (if different from ResourceGroup).
+          ImageResourceGroup: ""
+
+          # (azure) unmanaged disks (deprecated): Where to store the VM VHD blobs
           StorageAccount: ""
           BlobContainer: ""
+
+          # (azure) How long to wait before deleting VHD and NIC
+          # objects that are no longer being used.
           DeleteDanglingResourcesAfter: 20s
+
+          # Account (that already exists in the VM image) that will be
+          # set up with an ssh authorized key to allow the compute
+          # dispatcher to connect.
           AdminUsername: arvados
 
     InstanceTypes:
@@ -1025,6 +1096,8 @@ Clusters:
           ConnectTimeout: 1m
           ReadTimeout: 10m
           RaceWindow: 24h
+          # Use aws-s3-go (v2) instead of goamz
+          UseAWSS3v2Driver: false
 
           # For S3 driver, potentially unsafe tuning parameter,
           # intentionally excluded from main documentation.