2015-08-10 14:08:59 -04:00
|
|
|
---
|
2017-01-20 00:08:09 +08:00
|
|
|
horizon_services:
|
|
|
|
horizon:
|
|
|
|
container_name: horizon
|
|
|
|
group: horizon
|
|
|
|
enabled: true
|
|
|
|
image: "{{ horizon_image_full }}"
|
|
|
|
environment:
|
2018-04-19 22:27:30 +08:00
|
|
|
ENABLE_BLAZAR: "{{ 'yes' if enable_horizon_blazar | bool else 'no' }}"
|
2017-01-20 00:08:09 +08:00
|
|
|
ENABLE_CLOUDKITTY: "{{ 'yes' if enable_horizon_cloudkitty | bool else 'no' }}"
|
2017-06-27 14:38:13 +01:00
|
|
|
ENABLE_DESIGNATE: "{{ 'yes' if enable_horizon_designate | bool else 'no' }}"
|
2017-01-20 00:08:09 +08:00
|
|
|
ENABLE_FREEZER: "{{ 'yes' if enable_horizon_freezer | bool else 'no' }}"
|
2017-12-11 15:30:43 +08:00
|
|
|
ENABLE_HEAT: "{{ 'yes' if enable_horizon_heat | bool else 'no' }}"
|
2017-01-20 00:08:09 +08:00
|
|
|
ENABLE_IRONIC: "{{ 'yes' if enable_horizon_ironic | bool else 'no' }}"
|
|
|
|
ENABLE_MAGNUM: "{{ 'yes' if enable_horizon_magnum | bool else 'no' }}"
|
|
|
|
ENABLE_MANILA: "{{ 'yes' if enable_horizon_manila | bool else 'no' }}"
|
2018-11-06 10:20:02 +07:00
|
|
|
ENABLE_MASAKARI: "{{ 'yes' if enable_horizon_masakari | bool else 'no' }}"
|
2017-01-20 00:08:09 +08:00
|
|
|
ENABLE_MISTRAL: "{{ 'yes' if enable_horizon_mistral | bool else 'no' }}"
|
2019-12-28 09:06:46 +03:30
|
|
|
ENABLE_MONASCA: "{{ 'yes' if enable_horizon_monasca | bool else 'no' }}"
|
2017-01-20 00:08:09 +08:00
|
|
|
ENABLE_MURANO: "{{ 'yes' if enable_horizon_murano | bool else 'no' }}"
|
2018-06-20 10:45:27 +08:00
|
|
|
ENABLE_NEUTRON_VPNAAS: "{{ 'yes' if enable_horizon_neutron_vpnaas | bool else 'no' }}"
|
2018-03-30 15:57:19 +01:00
|
|
|
ENABLE_OCTAVIA: "{{ 'yes' if enable_horizon_octavia | bool else 'no' }}"
|
2017-01-20 00:08:09 +08:00
|
|
|
ENABLE_SAHARA: "{{ 'yes' if enable_horizon_sahara | bool else 'no' }}"
|
|
|
|
ENABLE_SENLIN: "{{ 'yes' if enable_horizon_senlin | bool else 'no' }}"
|
|
|
|
ENABLE_SOLUM: "{{ 'yes' if enable_horizon_solum | bool else 'no' }}"
|
|
|
|
ENABLE_TACKER: "{{ 'yes' if enable_horizon_tacker | bool else 'no' }}"
|
|
|
|
ENABLE_TROVE: "{{ 'yes' if enable_horizon_trove | bool else 'no' }}"
|
2017-12-29 18:11:52 +08:00
|
|
|
ENABLE_VITRAGE: "{{ 'yes' if enable_horizon_vitrage | bool else 'no' }}"
|
2017-01-20 00:08:09 +08:00
|
|
|
ENABLE_WATCHER: "{{ 'yes' if enable_horizon_watcher | bool else 'no' }}"
|
2017-03-31 09:28:00 +08:00
|
|
|
ENABLE_ZUN: "{{ 'yes' if enable_horizon_zun | bool else 'no' }}"
|
2017-06-15 15:18:01 +01:00
|
|
|
FORCE_GENERATE: "{{ 'yes' if horizon_dev_mode | bool else 'no' }}"
|
2019-04-09 16:55:20 +08:00
|
|
|
volumes: "{{ horizon_default_volumes + horizon_extra_volumes }}"
|
2018-07-17 20:04:53 +05:30
|
|
|
dimensions: "{{ horizon_dimensions }}"
|
2019-08-14 11:15:33 +00:00
|
|
|
healthcheck: "{{ horizon_healthcheck }}"
|
2018-06-19 00:43:35 -05:00
|
|
|
haproxy:
|
|
|
|
horizon:
|
|
|
|
enabled: "{{ enable_horizon }}"
|
|
|
|
mode: "http"
|
|
|
|
external: false
|
Standardize use and construction of endpoint URLs
The goal for this push request is to normalize the construction and use
of internal, external, and admin URLs. While extending Kolla-ansible
to enable a more flexible method to manage external URLs, we noticed
that the same URL was constructed multiple times in different parts
of the code. This can make it difficult for people that want to work
with these URLs and create inconsistencies in a large code base with
time. Therefore, we are proposing here the use of
"single Kolla-ansible variable" per endpoint URL, which facilitates
for people that are interested in overriding/extending these URLs.
As an example, we extended Kolla-ansible to facilitate the "override"
of public (external) URLs with the following standard
"<component/serviceName>.<companyBaseUrl>".
Therefore, the "NAT/redirect" in the SSL termination system (HAproxy,
HTTPD or some other) is done via the service name, and not by the port.
This allows operators to easily and automatically create more friendly
URL names. To develop this feature, we first applied this patch that
we are sending now to the community. We did that to reduce the surface
of changes in Kolla-ansible.
Another example is the integration of Kolla-ansible and Consul, which
we also implemented internally, and also requires URLs changes.
Therefore, this PR is essential to reduce code duplicity, and to
facility users/developers to work/customize the services URLs.
Change-Id: I73d483e01476e779a5155b2e18dd5ea25f514e93
Signed-off-by: Rafael Weingärtner <rafael@apache.org>
2020-06-16 16:03:31 -03:00
|
|
|
port: "{% if kolla_enable_tls_internal|bool %}{{ horizon_tls_port }}{% else %}{{ horizon_port }}{% endif %}"
|
2018-12-27 15:55:55 -05:00
|
|
|
listen_port: "{{ horizon_listen_port }}"
|
2020-09-26 20:29:20 +02:00
|
|
|
frontend_http_extra:
|
|
|
|
- "use_backend acme_client_back if { path_reg ^/.well-known/acme-challenge/.+ }"
|
2020-04-13 15:06:00 -05:00
|
|
|
backend_http_extra:
|
2018-06-19 00:43:35 -05:00
|
|
|
- "balance source"
|
2020-04-29 16:45:34 -07:00
|
|
|
tls_backend: "{{ horizon_enable_tls_backend }}"
|
2019-06-07 13:56:21 +00:00
|
|
|
horizon_redirect:
|
|
|
|
enabled: "{{ enable_horizon|bool and kolla_enable_tls_internal|bool }}"
|
|
|
|
mode: "redirect"
|
|
|
|
external: false
|
|
|
|
port: "{{ horizon_port }}"
|
|
|
|
listen_port: "{{ horizon_listen_port }}"
|
2018-06-19 00:43:35 -05:00
|
|
|
horizon_external:
|
|
|
|
enabled: "{{ enable_horizon }}"
|
|
|
|
mode: "http"
|
|
|
|
external: true
|
Standardize use and construction of endpoint URLs
The goal for this push request is to normalize the construction and use
of internal, external, and admin URLs. While extending Kolla-ansible
to enable a more flexible method to manage external URLs, we noticed
that the same URL was constructed multiple times in different parts
of the code. This can make it difficult for people that want to work
with these URLs and create inconsistencies in a large code base with
time. Therefore, we are proposing here the use of
"single Kolla-ansible variable" per endpoint URL, which facilitates
for people that are interested in overriding/extending these URLs.
As an example, we extended Kolla-ansible to facilitate the "override"
of public (external) URLs with the following standard
"<component/serviceName>.<companyBaseUrl>".
Therefore, the "NAT/redirect" in the SSL termination system (HAproxy,
HTTPD or some other) is done via the service name, and not by the port.
This allows operators to easily and automatically create more friendly
URL names. To develop this feature, we first applied this patch that
we are sending now to the community. We did that to reduce the surface
of changes in Kolla-ansible.
Another example is the integration of Kolla-ansible and Consul, which
we also implemented internally, and also requires URLs changes.
Therefore, this PR is essential to reduce code duplicity, and to
facility users/developers to work/customize the services URLs.
Change-Id: I73d483e01476e779a5155b2e18dd5ea25f514e93
Signed-off-by: Rafael Weingärtner <rafael@apache.org>
2020-06-16 16:03:31 -03:00
|
|
|
port: "{% if kolla_enable_tls_external|bool %}{{ horizon_tls_port }}{% else %}{{ horizon_port }}{% endif %}"
|
2018-12-27 15:55:55 -05:00
|
|
|
listen_port: "{{ horizon_listen_port }}"
|
2020-09-26 20:29:20 +02:00
|
|
|
frontend_http_extra:
|
|
|
|
- "use_backend acme_client_back if { path_reg ^/.well-known/acme-challenge/.+ }"
|
2020-04-13 15:06:00 -05:00
|
|
|
backend_http_extra:
|
2018-06-19 00:43:35 -05:00
|
|
|
- "balance source"
|
2020-04-29 16:45:34 -07:00
|
|
|
tls_backend: "{{ horizon_enable_tls_backend }}"
|
2018-06-19 00:43:35 -05:00
|
|
|
horizon_external_redirect:
|
|
|
|
enabled: "{{ enable_horizon|bool and kolla_enable_tls_external|bool }}"
|
|
|
|
mode: "redirect"
|
|
|
|
external: true
|
|
|
|
port: "{{ horizon_port }}"
|
2018-12-27 15:55:55 -05:00
|
|
|
listen_port: "{{ horizon_listen_port }}"
|
2020-09-26 20:29:20 +02:00
|
|
|
acme_client:
|
|
|
|
enabled: "{{ enable_horizon }}"
|
|
|
|
with_frontend: false
|
|
|
|
custom_member_list: "{{ acme_client_servers }}"
|
|
|
|
|
2017-10-24 15:37:21 +02:00
|
|
|
horizon_keystone_domain_choices:
|
|
|
|
Default: default
|
2017-01-20 00:08:09 +08:00
|
|
|
|
2020-11-04 10:53:40 +01:00
|
|
|
horizon_custom_themes: []
|
|
|
|
|
2016-09-08 12:49:02 +01:00
|
|
|
####################
|
|
|
|
# Database
|
|
|
|
####################
|
|
|
|
horizon_database_name: "horizon"
|
2018-01-14 20:16:43 +02:00
|
|
|
horizon_database_user: "{% if use_preconfigured_databases | bool and use_common_mariadb_user | bool %}{{ database_user }}{% else %}horizon{% endif %}"
|
2019-09-11 20:47:00 +02:00
|
|
|
horizon_database_address: "{{ database_address | put_address_in_context('url') }}:{{ database_port }}"
|
2016-09-08 12:49:02 +01:00
|
|
|
|
2015-08-10 14:08:59 -04:00
|
|
|
####################
|
|
|
|
# Docker
|
|
|
|
####################
|
2022-04-12 18:38:03 +02:00
|
|
|
horizon_image: "{{ docker_registry ~ '/' if docker_registry else '' }}{{ docker_namespace }}/{{ kolla_base_distro }}-horizon"
|
2020-01-09 17:03:28 +00:00
|
|
|
horizon_tag: "{{ openstack_tag }}"
|
2015-08-10 14:08:59 -04:00
|
|
|
horizon_image_full: "{{ horizon_image }}:{{ horizon_tag }}"
|
2016-07-30 22:50:03 +08:00
|
|
|
|
2018-07-17 20:04:53 +05:30
|
|
|
horizon_dimensions: "{{ default_container_dimensions }}"
|
2016-07-30 22:50:03 +08:00
|
|
|
|
2019-08-14 11:15:33 +00:00
|
|
|
horizon_enable_healthchecks: "{{ enable_container_healthchecks }}"
|
|
|
|
horizon_healthcheck_interval: "{{ default_container_healthcheck_interval }}"
|
|
|
|
horizon_healthcheck_retries: "{{ default_container_healthcheck_retries }}"
|
|
|
|
horizon_healthcheck_start_period: "{{ default_container_healthcheck_start_period }}"
|
|
|
|
horizon_healthcheck_test: ["CMD-SHELL", "healthcheck_curl {{ 'https' if horizon_enable_tls_backend | bool else 'http' }}://{{ api_interface_address | put_address_in_context('url') }}:{{ horizon_listen_port }}"]
|
|
|
|
horizon_healthcheck_timeout: "{{ default_container_healthcheck_timeout }}"
|
|
|
|
horizon_healthcheck:
|
|
|
|
interval: "{{ horizon_healthcheck_interval }}"
|
|
|
|
retries: "{{ horizon_healthcheck_retries }}"
|
|
|
|
start_period: "{{ horizon_healthcheck_start_period }}"
|
|
|
|
test: "{% if horizon_enable_healthchecks | bool %}{{ horizon_healthcheck_test }}{% else %}NONE{% endif %}"
|
|
|
|
timeout: "{{ horizon_healthcheck_timeout }}"
|
|
|
|
|
2019-04-09 16:55:20 +08:00
|
|
|
horizon_default_volumes:
|
|
|
|
- "{{ node_config_directory }}/horizon/:{{ container_config_directory }}/:ro"
|
2020-01-30 14:00:34 +00:00
|
|
|
- "{{ kolla_dev_repos_directory ~ '/horizon/horizon:/var/lib/kolla/venv/lib/python' ~ distro_python_version ~ '/site-packages/horizon' if horizon_dev_mode | bool else '' }}"
|
|
|
|
- "{{ kolla_dev_repos_directory ~ '/horizon/openstack_dashboard:/var/lib/kolla/venv/lib/python' ~ distro_python_version ~ '/site-packages/openstack_dashboard' if horizon_dev_mode | bool else '' }}"
|
|
|
|
- "{{ kolla_dev_repos_directory ~ '/murano-dashboard/muranodashboard:/var/lib/kolla/venv/lib/python' ~ distro_python_version ~ '/site-packages/muranodashboard' if horizon_murano_dev_mode | bool else '' }}"
|
2019-04-09 16:55:20 +08:00
|
|
|
- "/etc/localtime:/etc/localtime:ro"
|
2021-05-13 12:21:11 +01:00
|
|
|
- "{{ '/etc/timezone:/etc/timezone:ro' if ansible_facts.os_family == 'Debian' else '' }}"
|
2019-04-09 16:55:20 +08:00
|
|
|
- "kolla_logs:/var/log/kolla/"
|
|
|
|
- "/tmp:/tmp"
|
|
|
|
|
|
|
|
horizon_extra_volumes: "{{ default_extra_volumes }}"
|
|
|
|
|
2016-07-30 22:50:03 +08:00
|
|
|
####################
|
|
|
|
# OpenStack
|
|
|
|
####################
|
2016-11-10 11:28:59 -03:00
|
|
|
horizon_logging_debug: "{{ openstack_logging_debug }}"
|
Add support to OpenID Connect Authentication flow
This pull request adds support for the OpenID Connect authentication
flow in Keystone and enables both ID and access token authentication
flows. The ID token configuration is designed to allow users to
authenticate via Horizon using an identity federation; whereas the
Access token is used to allow users to authenticate in the OpenStack CLI
using a federated user.
Without this PR, if one wants to configure OpenStack to use identity
federation, he/she needs to do a lot of configurations in the keystone,
Horizon, and register quite a good number of different parameters using
the CLI such as mappings, identity providers, federated protocols, and
so on. Therefore, with this PR, we propose a method for operators to
introduce/present the IdP's metadata to Kolla-ansible, and based on the
presented metadata, Kolla-ansible takes care of all of the
configurations to prepare OpenStack to work in a federated environment.
Implements: blueprint add-openid-support
Co-Authored-By: Jason Anderson <jasonanderson@uchicago.edu>
Change-Id: I0203a3470d7f8f2a54d5e126d947f540d93b8210
2019-01-21 12:25:39 +01:00
|
|
|
horizon_keystone_url: "{{ keystone_public_url if horizon_use_keystone_public_url | bool else keystone_internal_url }}/v3"
|
2017-06-15 15:18:01 +01:00
|
|
|
|
|
|
|
|
2019-07-04 16:29:04 +02:00
|
|
|
####################
|
|
|
|
# Apache
|
|
|
|
####################
|
|
|
|
horizon_wsgi_processes: "{{ openstack_service_workers }}"
|
|
|
|
horizon_wsgi_threads: 1
|
|
|
|
|
|
|
|
|
2017-06-15 15:18:01 +01:00
|
|
|
####################
|
|
|
|
# Kolla
|
|
|
|
####################
|
|
|
|
horizon_git_repository: "{{ kolla_dev_repos_git }}/{{ project_name }}"
|
|
|
|
murano_dashboard_git_repository: "{{ kolla_dev_repos_git }}/murano-dashboard"
|
|
|
|
|
|
|
|
horizon_dev_repos_pull: "{{ kolla_dev_repos_pull }}"
|
|
|
|
horizon_dev_mode: "{{ kolla_dev_mode }}"
|
|
|
|
horizon_murano_dev_mode: "{{ kolla_dev_mode }}"
|
2018-07-20 10:00:37 +08:00
|
|
|
horizon_source_version: "{{ kolla_source_version }}"
|
|
|
|
horizon_murano_source_version: "{{ kolla_source_version }}"
|
2020-04-29 16:45:34 -07:00
|
|
|
|
Add support to OpenID Connect Authentication flow
This pull request adds support for the OpenID Connect authentication
flow in Keystone and enables both ID and access token authentication
flows. The ID token configuration is designed to allow users to
authenticate via Horizon using an identity federation; whereas the
Access token is used to allow users to authenticate in the OpenStack CLI
using a federated user.
Without this PR, if one wants to configure OpenStack to use identity
federation, he/she needs to do a lot of configurations in the keystone,
Horizon, and register quite a good number of different parameters using
the CLI such as mappings, identity providers, federated protocols, and
so on. Therefore, with this PR, we propose a method for operators to
introduce/present the IdP's metadata to Kolla-ansible, and based on the
presented metadata, Kolla-ansible takes care of all of the
configurations to prepare OpenStack to work in a federated environment.
Implements: blueprint add-openid-support
Co-Authored-By: Jason Anderson <jasonanderson@uchicago.edu>
Change-Id: I0203a3470d7f8f2a54d5e126d947f540d93b8210
2019-01-21 12:25:39 +01:00
|
|
|
# This variable was created for administrators to define which one of the Keystone's URLs should be configured in Horizon.
|
|
|
|
# In some cases, such as when using OIDC, horizon will need to be configured with Keystone's public URL.
|
|
|
|
# Therefore, instead of overriding the whole "horizon_keystone_url", this change allows an easier integration because
|
|
|
|
# the Keystone public URL is already defined with variable "keystone_public_url".
|
|
|
|
horizon_use_keystone_public_url: False
|