// Module included in the following assemblies:
//
// * installing/installing_openstack/installing-openstack-cloud-config-reference.adoc

:_mod-docs-content-type: REFERENCE
[id="cluster-cloud-controller-config_{context}"]
= The OpenStack Cloud Controller Manager (CCM) config map

[role="_abstract"]
An {rh-openstack} CCM config map defines how your cluster interacts with your {rh-openstack} cloud. By default, the configuration is stored under the `cloud.conf` key in the `cloud-conf` config map in the `openshift-cloud-controller-manager` namespace.

[IMPORTANT]
====
The `cloud-conf` config map is generated from the `cloud-provider-config` config map in the `openshift-config` namespace.

To change the settings that are described by the `cloud-conf` config map, modify the `cloud-provider-config` config map.

As part of this synchronization, the CCM Operator overrides some options. For more information, see "The {rh-openstack} Cloud Controller Manager".
====

For example:

.An example `cloud-conf` config map
[source,yaml]
----
apiVersion: v1
data:
  cloud.conf: |
    [Global]
    secret-name = openstack-credentials
    secret-namespace = kube-system
    region = regionOne
    [LoadBalancer]
    enabled = True
kind: ConfigMap
metadata:
  creationTimestamp: "2022-12-20T17:01:08Z"
  name: cloud-conf
  namespace: openshift-cloud-controller-manager
  resourceVersion: "2519"
  uid: cbbeedaf-41ed-41c2-9f37-4885732d3677
----
`apiVersion.data.cloud.conf`: Specifies global options by using a `clouds.yaml` file rather than modifying the config map.

The following options are present in the config map. Except when indicated otherwise, they are mandatory for clusters that run on {rh-openstack}.

// [id="ccm-config-global-options"]
// == Global options

// The following options are used for {rh-openstack} CCM authentication with the {rh-openstack} Identity service, also known as Keystone. They are similar to the global options that you can set by using the `openstack` CLI.

// |===
// | Option | Description

// | `ca-file`
// | Optional. The CA certificate bundle file for communication with the {rh-openstack} Identity service. If you use the HTTPS protocol with The Identity service URL, this option is required.

// | `cert-file`
// | Optional. The client certificate path to use for client TLS authentication.

// | `key-file`
// | Optional. The client private key path to use for client TLS authentication.

// | `region`
// | The Identity service region name.

// | `trust-id`
// | The Identity service trust ID. A trust represents the authorization of a user, or trustor, to delegate roles to another user, or trustee. Optionally, a trust authorizes the trustee to impersonate the trustor. You can find available trusts by querying the `/v3/OS-TRUST/trusts` endpoint of the Identity service API.

// | `trustee-id`
// | The Identity service trustee user ID.

// | `trustee-password`
// | The Identity service trustee user password.

// | `application-credential-id`
// | The ID of an application credential to authenticate with. An `application-credential-secret` must be set along with this parameter.

// | `application-credential-name`
// | The name of an application credential to authenticate with. If `application-credential-id` is not set, the user name and domain must be set.

// | `application-credential-secret`
// | The secret of an application credential to authenticate with.

// | `tls-insecure`
// | Whether or not to verify the server's TLS certificate. If set to `true`, the certificate is not verified. By default, the certificate is verified.
// |===


// [id="ccm-config-networking-options"]
// == Networking options

// |===
// | Option | Description

// | `ipv6-support-disabled`
// | Whether or not IPv6 is supported as indicated by a boolean value. By default, this option is `false`.

// | `public-network-name`
// | The name of an {rh-openstack} Networking service, or Neutron, external network. The CCM uses this option when retrieving the external IP address of a Kubernetes node. This value can contain multiple names. Specified networks are bitwise ORed. The default value is `""`.

// | `internal-network-name`
// | The name of a Networking service internal network. The CCM uses this option when retrieving the internal IP address of a Kubernetes node. This value can contain multiple names. Specified networks are bitwise ORed. The default value is `""`.

// | `address-sort-order`
// | This configuration key affects how the provider reports node addresses to Kubernetes node resources. The default order depends on the hard-coded order in which the provider queries addresses and what the cloud returns. A specific order is not guaranteed.

//  To override this behavior, specify a comma-separated list of CIDR addresses. CCM sorts and groups all addresses that match the list in a prioritized manner, wherein the first retrieved item has  a higher priority than the last. Addresses that do not match the list remain in their default order. The default value is `""`.

// This option can be useful if you have multiple or dual-stack interfaces attached to a node that need a user-controlled, deterministic way of sorting addresses.
// |===
