diff --git a/ansible/roles/horizon/templates/local_settings.j2 b/ansible/roles/horizon/templates/local_settings.j2 index 9d476c7d65..954cc3419b 100644 --- a/ansible/roles/horizon/templates/local_settings.j2 +++ b/ansible/roles/horizon/templates/local_settings.j2 @@ -1,8 +1,11 @@ +# -*- coding: utf-8 -*- + import os from django.utils.translation import ugettext_lazy as _ from openstack_dashboard import exceptions +from openstack_dashboard.settings import HORIZON_CONFIG DEBUG = False TEMPLATE_DEBUG = DEBUG @@ -12,15 +15,14 @@ COMPRESS_OFFLINE = True # WEBROOT is the location relative to Webserver root # should end with a slash. WEBROOT = '/' -# LOGIN_URL = WEBROOT + 'auth/login/' -# LOGOUT_URL = WEBROOT + 'auth/logout/' +#LOGIN_URL = WEBROOT + 'auth/login/' +#LOGOUT_URL = WEBROOT + 'auth/logout/' # # LOGIN_REDIRECT_URL can be used as an alternative for # HORIZON_CONFIG.user_home, if user_home is not set. # Do not set it to '/home/', as this will cause circular redirect loop -# LOGIN_REDIRECT_URL = WEBROOT +#LOGIN_REDIRECT_URL = WEBROOT -# Required for Django 1.5. # If horizon is running in production (DEBUG is False), set this # with the list of host/domain names that the application can serve. # For more information see: @@ -28,12 +30,10 @@ WEBROOT = '/' ALLOWED_HOSTS = ['*'] # Set SSL proxy settings: -# For Django 1.4+ pass this header from the proxy after terminating the SSL, +# Pass this header from the proxy after terminating the SSL, # and don't forget to strip it from the client's request. # For more information see: -# https://docs.djangoproject.com/en/1.4/ref/settings/#secure-proxy-ssl-header -#SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTOCOL', 'https') -# https://docs.djangoproject.com/en/1.5/ref/settings/#secure-proxy-ssl-header +# https://docs.djangoproject.com/en/dev/ref/settings/#secure-proxy-ssl-header #SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https') # If Horizon is being served through SSL, then uncomment the following two @@ -47,53 +47,61 @@ CSRF_COOKIE_SECURE = True SESSION_COOKIE_SECURE = True {% endif %} +# The absolute path to the directory where message files are collected. +# The message file must have a .json file extension. When the user logins to +# horizon, the message files collected are processed and displayed to the user. +#MESSAGES_PATH=None + # Overrides for OpenStack API versions. Use this setting to force the # OpenStack dashboard to use a specific API version for a given service API. # Versions specified here should be integers or floats, not strings. # NOTE: The version should be formatted as it appears in the URL for the # service API. For example, The identity service APIs have inconsistent # use of the decimal point, so valid options would be 2.0 or 3. +# Minimum compute version to get the instance locked status is 2.9. #OPENSTACK_API_VERSIONS = { # "data-processing": 1.1, # "identity": 3, # "volume": 2, +# "compute": 2, #} OPENSTACK_API_VERSIONS = { "identity": 3, } -# Set this to True if running on multi-domain model. When this is enabled, it -# will require user to enter the Domain name in addition to username for login. -OPENSTACK_KEYSTONE_MULTIDOMAIN_SUPPORT = True +# Set this to True if running on a multi-domain model. When this is enabled, it +# will require the user to enter the Domain name in addition to the username +# for login. +#OPENSTACK_KEYSTONE_MULTIDOMAIN_SUPPORT = False # Overrides the default domain used when running on single-domain model # with Keystone V3. All entities will be created in the default domain. -#OPENSTACK_KEYSTONE_DEFAULT_DOMAIN = 'Default' +# NOTE: This value must be the ID of the default domain, NOT the name. +# Also, you will most likely have a value in the keystone policy file like this +# "cloud_admin": "rule:admin_required and domain_id:" +# This value must match the domain id specified there. +#OPENSTACK_KEYSTONE_DEFAULT_DOMAIN = 'default' + +# Set this to True to enable panels that provide the ability for users to +# manage Identity Providers (IdPs) and establish a set of rules to map +# federation protocol attributes to Identity API attributes. +# This extension requires v3.0+ of the Identity API. +#OPENSTACK_KEYSTONE_FEDERATION_MANAGEMENT = False # Set Console type: # valid options are "AUTO"(default), "VNC", "SPICE", "RDP", "SERIAL" or None # Set to None explicitly if you want to deactivate the console. #CONSOLE_TYPE = "AUTO" -# Default OpenStack Dashboard configuration. -HORIZON_CONFIG = { - 'user_home': 'openstack_dashboard.views.get_user_home', - 'ajax_queue_limit': 10, - 'auto_fade_alerts': { - 'delay': 3000, - 'fade_duration': 1500, - 'types': ['alert-success', 'alert-info'] - }, - 'help_url': "http://docs.openstack.org", - 'exceptions': {'recoverable': exceptions.RECOVERABLE, - 'not_found': exceptions.NOT_FOUND, - 'unauthorized': exceptions.UNAUTHORIZED}, - 'modal_backdrop': 'static', - 'angular_modules': [], - 'js_files': [], - 'js_spec_files': [], -} +# If provided, a "Report Bug" link will be displayed in the site header +# which links to the value of this setting (ideally a URL containing +# information on how to report issues). +#HORIZON_CONFIG["bug_url"] = "http://bug-report.example.com" + +# Show backdrop element outside the modal, do not close the modal +# after clicking on backdrop. +#HORIZON_CONFIG["modal_backdrop"] = "static" # Specify a regular expression to validate user passwords. #HORIZON_CONFIG["password_validator"] = { @@ -129,6 +137,13 @@ SECRET_KEY='{{ horizon_secret_key }}' # We recommend you use memcached for development; otherwise after every reload # of the django development server, you will have to login again. To use # memcached set CACHES to something like +#CACHES = { +# 'default': { +# 'BACKEND': 'django.core.cache.backends.memcached.MemcachedCache', +# 'LOCATION': '127.0.0.1:11211', +# }, +#} + CACHES = { 'default': { 'BACKEND': 'django.core.cache.backends.memcached.MemcachedCache', @@ -168,15 +183,33 @@ OPENSTACK_KEYSTONE_DEFAULT_ROLE = "{{ horizon_openstack_keystone_default_role }} # Determines which authentication choice to show as default. #WEBSSO_INITIAL_CHOICE = "credentials" -# The list of authentication mechanisms -# which include keystone federation protocols. -# Current supported protocol IDs are 'saml2' and 'oidc' -# which represent SAML 2.0, OpenID Connect respectively. +# The list of authentication mechanisms which include keystone +# federation protocols and identity provider/federation protocol +# mapping keys (WEBSSO_IDP_MAPPING). Current supported protocol +# IDs are 'saml2' and 'oidc' which represent SAML 2.0, OpenID +# Connect respectively. # Do not remove the mandatory credentials mechanism. +# Note: The last two tuples are sample mapping keys to a identity provider +# and federation protocol combination (WEBSSO_IDP_MAPPING). #WEBSSO_CHOICES = ( # ("credentials", _("Keystone Credentials")), # ("oidc", _("OpenID Connect")), -# ("saml2", _("Security Assertion Markup Language"))) +# ("saml2", _("Security Assertion Markup Language")), +# ("acme_oidc", "ACME - OpenID Connect"), +# ("acme_saml2", "ACME - SAML2"), +#) + +# A dictionary of specific identity provider and federation protocol +# combinations. From the selected authentication mechanism, the value +# will be looked up as keys in the dictionary. If a match is found, +# it will redirect the user to a identity provider and federation protocol +# specific WebSSO endpoint in keystone, otherwise it will use the value +# as the protocol_id when redirecting to the WebSSO by protocol endpoint. +# NOTE: The value is expected to be a tuple formatted as: (, ). +#WEBSSO_IDP_MAPPING = { +# "acme_oidc": ("acme", "oidc"), +# "acme_saml2": ("acme", "saml2"), +#} # Disable SSL certificate checks (useful for self-signed certificates): #OPENSTACK_SSL_NO_VERIFY = True @@ -217,6 +250,13 @@ OPENSTACK_KEYSTONE_BACKEND = { #LAUNCH_INSTANCE_LEGACY_ENABLED = True #LAUNCH_INSTANCE_NG_ENABLED = False +# A dictionary of settings which can be used to provide the default values for +# properties found in the Launch Instance modal. +#LAUNCH_INSTANCE_DEFAULTS = { +# 'config_drive': False, +# 'enable_scheduler_hints': True +#} + # The Xen Hypervisor has the ability to set the mount point for volumes # attached to instances (other Hypervisors currently do not). Setting # can_set_mount_point to True will add the option to set the mount point @@ -224,6 +264,8 @@ OPENSTACK_KEYSTONE_BACKEND = { OPENSTACK_HYPERVISOR_FEATURES = { 'can_set_mount_point': False, 'can_set_password': False, + 'requires_keypair': False, + 'enable_quotas': True } # The OPENSTACK_CINDER_FEATURES settings can be used to enable optional @@ -246,6 +288,13 @@ OPENSTACK_NEUTRON_NETWORK = { 'enable_vpn': True, 'enable_fip_topology_check': True, + # Default dns servers you would like to use when a subnet is + # created. This is only a default, users can still choose a different + # list of dns servers when creating a new subnet. + # The entries below are examples only, and are not appropriate for + # real deployments + # 'default_dns_nameservers': ["8.8.8.8", "8.8.4.4", "208.67.222.222"], + # The profile_support option is used to detect if an external router can be # configured via the dashboard. When using specific plugins the # profile_support can be turned on if needed. @@ -254,14 +303,37 @@ OPENSTACK_NEUTRON_NETWORK = { # Set which provider network types are supported. Only the network types # in this list will be available to choose from when creating a network. - # Network types include local, flat, vlan, gre, and vxlan. - 'supported_provider_types': ['*'], + # Network types include local, flat, vlan, gre, vxlan and geneve. + # 'supported_provider_types': ['*'], + + # You can configure available segmentation ID range per network type + # in your deployment. + # 'segmentation_id_range': { + # 'vlan': [1024, 2048], + # 'vxlan': [4094, 65536], + # }, + + # You can define additional provider network types here. + # 'extra_provider_types': { + # 'awesome_type': { + # 'display_name': 'Awesome New Type', + # 'require_physical_network': False, + # 'require_segmentation_id': True, + # } + # }, # Set which VNIC types are supported for port binding. Only the VNIC # types in this list will be available to choose from when creating a # port. # VNIC types include 'normal', 'macvtap' and 'direct'. - 'supported_vnic_types': ['*'] + # Set to empty list or None to disable VNIC type selection. + 'supported_vnic_types': ['*'], +} + +# The OPENSTACK_HEAT_STACK settings can be used to disable password +# field required while launching the stack. +OPENSTACK_HEAT_STACK = { + 'enable_user_pass': True, } # The OPENSTACK_IMAGE_BACKEND settings can be used to customize features @@ -279,9 +351,9 @@ OPENSTACK_NEUTRON_NETWORK = { # ('qcow2', _('QCOW2 - QEMU Emulator')), # ('raw', _('Raw')), # ('vdi', _('VDI - Virtual Disk Image')), -# ('vhd', ('VHD - Virtual Hard Disk')), +# ('vhd', _('VHD - Virtual Hard Disk')), # ('vmdk', _('VMDK - Virtual Machine Disk')), -# ] +# ], #} # The IMAGE_CUSTOM_PROPERTY_TITLES settings is used to customize the titles for @@ -300,6 +372,12 @@ IMAGE_CUSTOM_PROPERTY_TITLES = { # table. IMAGE_RESERVED_CUSTOM_PROPERTIES = [] +# Set to 'legacy' or 'direct' to allow users to upload images to glance via +# Horizon server. When enabled, a file form field will appear on the create +# image form. If set to 'off', there will be no file form field on the create +# image form. See documentation for deployment considerations. +#HORIZON_IMAGES_UPLOAD_MODE = 'legacy' + # OPENSTACK_ENDPOINT_TYPE specifies the endpoint type to use for the endpoints # in the Keystone service catalog. Use this setting when Horizon is running # external to the OpenStack environment. The default is 'publicURL'. @@ -308,9 +386,9 @@ OPENSTACK_ENDPOINT_TYPE = "internalURL" # SECONDARY_ENDPOINT_TYPE specifies the fallback endpoint type to use in the # case that OPENSTACK_ENDPOINT_TYPE is not present in the endpoints # in the Keystone service catalog. Use this setting when Horizon is running -# external to the OpenStack environment. The default is None. This +# external to the OpenStack environment. The default is None. This # value should differ from OPENSTACK_ENDPOINT_TYPE if used. -#SECONDARY_ENDPOINT_TYPE = "publicURL" +#SECONDARY_ENDPOINT_TYPE = None # The number of objects (Swift containers/objects or images) to display # on a single page before providing a paging element (a "more" link) @@ -344,7 +422,7 @@ TIME_ZONE = "UTC" # Set this to True to display an 'Admin Password' field on the Change Password # form to verify that it is indeed the admin logged-in who wants to change # the password. -# ENFORCE_PASSWORD_CHECK = False +#ENFORCE_PASSWORD_CHECK = False # Modules that provide /auth routes that can be used to handle different types # of user authentication. Add auth plugins that require extra route handling to @@ -360,7 +438,17 @@ TIME_ZONE = "UTC" # Path to directory containing policy.json files POLICY_FILES_PATH = '/etc/openstack-dashboard' -# Map of local copy of service policy files + +# Map of local copy of service policy files. +# Please insure that your identity policy file matches the one being used on +# your keystone servers. There is an alternate policy file that may be used +# in the Keystone v3 multi-domain case, policy.v3cloudsample.json. +# This file is not included in the Horizon repository by default but can be +# found at +# http://git.openstack.org/cgit/openstack/keystone/tree/etc/ \ +# policy.v3cloudsample.json +# Having matching policy files on the Horizon and Keystone servers is essential +# for normal operation. This holds true for all services and their policy files. #POLICY_FILES = { # 'identity': 'keystone_policy.json', # 'compute': 'nova_policy.json', @@ -371,16 +459,23 @@ POLICY_FILES_PATH = '/etc/openstack-dashboard' # 'telemetry': 'ceilometer_policy.json', #} +# TODO: (david-lyle) remove when plugins support adding settings. +# Note: Only used when trove-dashboard plugin is configured to be used by +# Horizon. # Trove user and database extension support. By default support for # creating users and databases on database instances is turned on. # To disable these extensions set the permission here to something # unusable such as ["!"]. -# TROVE_ADD_USER_PERMS = [] -# TROVE_ADD_DATABASE_PERMS = [] +#TROVE_ADD_USER_PERMS = [] +#TROVE_ADD_DATABASE_PERMS = [] -# Change this patch to the appropriate static directory containing -# two files: _variables.scss and _styles.scss -#CUSTOM_THEME_PATH = 'static/themes/default' +# Change this patch to the appropriate list of tuples containing +# a key, label and static directory containing two files: +# _variables.scss and _styles.scss +#AVAILABLE_THEMES = [ +# ('default', 'Default', 'themes/default'), +# ('material', 'Material', 'themes/material'), +#] LOGGING = { 'version': 1, @@ -389,16 +484,28 @@ LOGGING = { # if nothing is specified here and disable_existing_loggers is True, # django.db.backends will still log unless it is disabled explicitly. 'disable_existing_loggers': False, + 'formatters': { + 'operation': { + # The format of "%(message)s" is defined by + # OPERATION_LOG_OPTIONS['format'] + 'format': '%(asctime)s %(message)s' + }, + }, 'handlers': { 'null': { 'level': 'DEBUG', - 'class': 'django.utils.log.NullHandler', + 'class': 'logging.NullHandler', }, 'console': { # Set the level to "DEBUG" for verbose output logging. 'level': 'INFO', 'class': 'logging.StreamHandler', }, + 'operation': { + 'level': 'INFO', + 'class': 'logging.StreamHandler', + 'formatter': 'operation', + }, }, 'loggers': { # Logging from django.db.backends is VERY verbose, send to null @@ -416,6 +523,11 @@ LOGGING = { 'level': 'DEBUG', 'propagate': False, }, + 'horizon.operation_log': { + 'handlers': ['operation'], + 'level': 'INFO', + 'propagate': False, + }, 'openstack_dashboard': { 'handlers': ['console'], 'level': 'DEBUG', @@ -431,7 +543,7 @@ LOGGING = { 'level': 'DEBUG', 'propagate': False, }, - 'glanceclient': { + 'keystoneclient': { 'handlers': ['console'], 'level': 'DEBUG', 'propagate': False, @@ -456,11 +568,6 @@ LOGGING = { 'level': 'DEBUG', 'propagate': False, }, - 'troveclient': { - 'handlers': ['console'], - 'level': 'DEBUG', - 'propagate': False, - }, 'swiftclient': { 'handlers': ['console'], 'level': 'DEBUG', @@ -489,7 +596,7 @@ LOGGING = { 'handlers': ['null'], 'propagate': False, }, - } + }, } # 'direction' should not be specified for all_tcp/udp/icmp. @@ -613,6 +720,9 @@ SECURITY_GROUP_RULES = { # # See Metadata Definitions on: http://docs.openstack.org/developer/glance/ +# TODO: (david-lyle) remove when plugins support settings natively +# Note: This is only used when the Sahara plugin is configured and enabled +# for use in Horizon. # Indicate to the Sahara data processing service whether or not # automatic floating IP allocation is in effect. If it is not # in effect, the user will be prompted to choose a floating IP @@ -639,7 +749,9 @@ SECURITY_GROUP_RULES = { # the enabled panel configuration. # You should not add settings to this list for out of tree extensions. # See: https://wiki.openstack.org/wiki/Horizon/RESTAPI -REST_API_REQUIRED_SETTINGS = ['OPENSTACK_HYPERVISOR_FEATURES'] +REST_API_REQUIRED_SETTINGS = ['OPENSTACK_HYPERVISOR_FEATURES', + 'LAUNCH_INSTANCE_DEFAULTS', + 'OPENSTACK_IMAGE_FORMATS'] # Additional settings can be made available to the client side for # extensibility by specifying them in REST_API_ADDITIONAL_SETTINGS @@ -654,4 +766,35 @@ REST_API_REQUIRED_SETTINGS = ['OPENSTACK_HYPERVISOR_FEATURES'] # where iframes are not used in deployment. Default setting is True. # For more information see: # http://tinyurl.com/anticlickjack -# DISALLOW_IFRAME_EMBED = True +#DISALLOW_IFRAME_EMBED = True + +# Help URL can be made available for the client. To provide a help URL, edit the +# following attribute to the URL of your choice. +#HORIZON_CONFIG["help_url"] = "http://openstack.mycompany.org" + +# Settings for OperationLogMiddleware +# OPERATION_LOG_ENABLED is flag to use the function to log an operation on +# Horizon. +# mask_targets is arrangement for appointing a target to mask. +# method_targets is arrangement of HTTP method to output log. +# format is the log contents. +#OPERATION_LOG_ENABLED = False +#OPERATION_LOG_OPTIONS = { +# 'mask_fields': ['password'], +# 'target_methods': ['POST'], +# 'format': ("[%(domain_name)s] [%(domain_id)s] [%(project_name)s]" +# " [%(project_id)s] [%(user_name)s] [%(user_id)s] [%(request_scheme)s]" +# " [%(referer_url)s] [%(request_url)s] [%(message)s] [%(method)s]" +# " [%(http_status)s] [%(param)s]"), +#} + +# The default date range in the Overview panel meters - either minus N +# days (if the value is integer N), or from the beginning of the current month +# until today (if set to None). This setting should be used to limit the amount +# of data fetched by default when rendering the Overview panel. +#OVERVIEW_DAYS_RANGE = 1 + +# To allow operators to require admin users provide a search criteria first +# before loading any data into the admin views, set the following attribute to +# True +#ADMIN_FILTER_DATA_FIRST=False