openstack/openstack-helm
Code Issues Proposed changes
71de762a28
openstack-helm/horizon/values.yaml
xuxant02@gmail.com fac3c74fdb Removed default policy from horizon chart 
The policy document and policy documents in the code are conflicting and creating strange issue. As the policy for nova, neutron, keystone, glance and cinder are available in horizon code, they have been removed from the chart values file.

Change-Id: I78b487c11d3d018b18ce823ffd9d8b8940dfa575
2021-09-27 17:36:43 +05:45

1352 lines
52 KiB
YAML
Raw Blame History

# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# Default values for horizon.
# This is a YAML-formatted file.
# Declare name/value pairs to be passed into your templates.
# name: value
---
images:
tags:
db_init: docker.io/openstackhelm/heat:stein-ubuntu_bionic
horizon_db_sync: docker.io/openstackhelm/horizon:stein-ubuntu_bionic
db_drop: docker.io/openstackhelm/heat:stein-ubuntu_bionic
horizon: docker.io/openstackhelm/horizon:stein-ubuntu_bionic
test: docker.io/openstackhelm/osh-selenium:latest-ubuntu_bionic
dep_check: quay.io/airshipit/kubernetes-entrypoint:v1.0.0
image_repo_sync: docker.io/docker:17.07.0
pull_policy: "IfNotPresent"
local_registry:
active: false
exclude:
- dep_check
- image_repo_sync
release_group: null
labels:
dashboard:
node_selector_key: openstack-control-plane
node_selector_value: enabled
job:
node_selector_key: openstack-control-plane
node_selector_value: enabled
test:
node_selector_key: openstack-control-plane
node_selector_value: enabled
network:
dashboard:
ingress:
public: true
classes:
namespace: "nginx"
cluster: "nginx-cluster"
annotations:
nginx.ingress.kubernetes.io/rewrite-target: /
external_policy_local: false
node_port:
enabled: false
port: 31000
conf:
software:
apache2:
binary: apache2
start_parameters: -DFOREGROUND
site_dir: /etc/apache2/sites-available
conf_dir: /etc/apache2/conf-available
mods_dir: /etc/apache2/mods-available
a2enmod:
- headers
- rewrite
a2dismod:
- status
horizon:
apache: |
<IfVersion < 2.4>
Listen 0.0.0.0:{{ tuple "dashboard" "internal" "web" . | include "helm-toolkit.endpoints.endpoint_port_lookup" }}
</IfVersion>
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" proxy
SetEnvIf X-Forwarded-For "^.*\..*\..*\..*" forwarded
CustomLog /dev/stdout combined env=!forwarded
CustomLog /dev/stdout proxy env=forwarded
<VirtualHost *:{{ tuple "dashboard" "internal" "web" . | include "helm-toolkit.endpoints.endpoint_port_lookup" }}>
WSGIScriptReloading On
WSGIDaemonProcess horizon-http processes=5 threads=1 user=horizon group=horizon display-name=%{GROUP} python-path=/var/lib/kolla/venv/lib/python2.7/site-packages
WSGIProcessGroup horizon-http
WSGIScriptAlias / /var/www/cgi-bin/horizon/django.wsgi
WSGIPassAuthorization On
RewriteEngine on
RewriteCond %{REQUEST_METHOD} !^(POST|PUT|GET|DELETE|PATCH)
RewriteRule .* - [F]
<Location "/">
Require all granted
</Location>
Alias /static /var/www/html/horizon
<Location "/static">
SetHandler static
</Location>
<IfVersion >= 2.4>
ErrorLogFormat "%{cu}t %M"
</IfVersion>
ErrorLog /dev/stdout
TransferLog /dev/stdout
SetEnvIf X-Forwarded-For "^.*\..*\..*\..*" forwarded
CustomLog /dev/stdout combined env=!forwarded
CustomLog /dev/stdout proxy env=forwarded
</Virtualhost>
security: |
#
# Disable access to the entire file system except for the directories that
# are explicitly allowed later.
#
# This currently breaks the configurations that come with some web application
# Debian packages.
#
#<Directory />
# AllowOverride None
# Require all denied
#</Directory>
# Changing the following options will not really affect the security of the
# server, but might make attacks slightly more difficult in some cases.
#
# ServerTokens
# This directive configures what you return as the Server HTTP response
# Header. The default is 'Full' which sends information about the OS-Type
# and compiled in modules.
# Set to one of: Full | OS | Minimal | Minor | Major | Prod
# where Full conveys the most information, and Prod the least.
ServerTokens Prod
#
# Optionally add a line containing the server version and virtual host
# name to server-generated pages (internal error documents, FTP directory
# listings, mod_status and mod_info output etc., but not CGI generated
# documents or custom error documents).
# Set to "EMail" to also include a mailto: link to the ServerAdmin.
# Set to one of: On | Off | EMail
ServerSignature Off
#
# Allow TRACE method
#
# Set to "extended" to also reflect the request body (only for testing and
# diagnostic purposes).
#
# Set to one of: On | Off | extended
TraceEnable Off
#
# Forbid access to version control directories
#
# If you use version control systems in your document root, you should
# probably deny access to their directories. For example, for subversion:
#
#<DirectoryMatch "/\.svn">
# Require all denied
#</DirectoryMatch>
#Security-Settings
# Setting this header will prevent MSIE from interpreting files as something
# else than declared by the content type in the HTTP headers.
# Requires mod_headers to be enabled.
#
Header set X-Content-Type-Options: "nosniff"
Header set X-Permitted-Cross-Domain-Policies: "none"
# Setting this header will prevent other sites from embedding pages from this
# site as frames. This defends against clickjacking attacks.
# Requires mod_headers to be enabled.
#
local_settings:
config:
# Use "True" and "False" as Titlecase strings with quotes, boolean
# values will not work
horizon_secret_key: 9aee62c0-5253-4a86-b189-e0fb71fa503c
debug: "False"
use_ssl: "False"
keystone_multidomain_support: "True"
keystone_default_domain: Default
disable_password_reveal: "True"
csrf_cookie_secure: "False"
csrf_cookie_httponly: "False"
enforce_password_check: "True"
# Set enable_pwd_validator to true to enforce password validator settings.
enable_pwd_validator: false
pwd_validator_regex: '(?=.*[a-zA-Z])(?=.*\d).{8,}|(?=.*\d)(?=.*\W).{8,}|(?=.*\W)(?=.*[a-zA-Z]).{8,}'
pwd_validator_help_text: '_("Your password must be at least eight (8) characters in length and must include characters from at least two (2) of these groupings: alpha, numeric, and special characters.")'
session_cookie_secure: "False"
session_cookie_httponly: "False"
secure_proxy_ssl_header: false
password_autocomplete: "False"
disallow_iframe_embed: "False"
allowed_hosts:
- '*'
horizon_images_upload_mode: 'legacy'
openstack_cinder_features:
enable_backup: "True"
openstack_neutron_network:
enable_router: "True"
enable_quotas: "True"
enable_ipv6: "True"
enable_distributed_router: "False"
enable_ha_router: "False"
enable_lb: "True"
enable_firewall: "True"
enable_vpn: "True"
enable_fip_topology_check: "True"
openstack_enable_password_retrieve: "False"
auth:
sso:
enabled: False
initial_choice: "credentials"
idp_mapping:
- name: "acme_oidc"
label: "Acme Corporation - OpenID Connect"
idp: "myidp1"
protocol: "oidc"
- name: "acme_saml2"
label: "Acme Corporation - SAML2"
idp: "myidp2"
protocol: "saml2"
log_level: "DEBUG"
# Pass any settings to the end of local_settings.py
raw: {}
template: |
import os
from django.utils.translation import ugettext_lazy as _
from openstack_dashboard import exceptions
DEBUG = {{ .Values.conf.horizon.local_settings.config.debug }}
TEMPLATE_DEBUG = DEBUG
COMPRESS_OFFLINE = True
COMPRESS_CSS_HASHING_METHOD = "hash"
# WEBROOT is the location relative to Webserver root
# should end with a slash.
WEBROOT = '/'
# LOGIN_URL = WEBROOT + 'auth/login/'
# LOGOUT_URL = WEBROOT + 'auth/logout/'
#
# LOGIN_REDIRECT_URL can be used as an alternative for
# HORIZON_CONFIG.user_home, if user_home is not set.
# Do not set it to '/home/', as this will cause circular redirect loop
# LOGIN_REDIRECT_URL = WEBROOT
# Required for Django 1.5.
# If horizon is running in production (DEBUG is False), set this
# with the list of host/domain names that the application can serve.
# For more information see:
# https://docs.djangoproject.com/en/dev/ref/settings/#allowed-hosts
ALLOWED_HOSTS = [{{ include "helm-toolkit.utils.joinListWithCommaAndSingleQuotes" .Values.conf.horizon.local_settings.config.allowed_hosts }},'%s' % (os.environ.get("MY_POD_IP"))]
# Set SSL proxy settings:
# For Django 1.4+ pass this header from the proxy after terminating the SSL,
# and don't forget to strip it from the client's request.
# For more information see:
# https://docs.djangoproject.com/en/1.4/ref/settings/#secure-proxy-ssl-header
#SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTOCOL', 'https')
# https://docs.djangoproject.com/en/1.5/ref/settings/#secure-proxy-ssl-header
{{- if .Values.conf.horizon.local_settings.config.secure_proxy_ssl_header }}
SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
{{- end }}
# If Horizon is being served through SSL, then uncomment the following two
# settings to better secure the cookies from security exploits
USE_SSL = {{ .Values.conf.horizon.local_settings.config.use_ssl }}
CSRF_COOKIE_SECURE = {{ .Values.conf.horizon.local_settings.config.csrf_cookie_secure }}
CSRF_COOKIE_HTTPONLY = {{ .Values.conf.horizon.local_settings.config.csrf_cookie_httponly }}
SESSION_COOKIE_SECURE = {{ .Values.conf.horizon.local_settings.config.session_cookie_secure }}
SESSION_COOKIE_HTTPONLY = {{ .Values.conf.horizon.local_settings.config.session_cookie_httponly }}
# Overrides for OpenStack API versions. Use this setting to force the
# OpenStack dashboard to use a specific API version for a given service API.
# Versions specified here should be integers or floats, not strings.
# NOTE: The version should be formatted as it appears in the URL for the
# service API. For example, The identity service APIs have inconsistent
# use of the decimal point, so valid options would be 2.0 or 3.
#OPENSTACK_API_VERSIONS = {
# "data-processing": 1.1,
# "identity": 3,
# "volume": 2,
#}
OPENSTACK_API_VERSIONS = {
"identity": 3,
}
# Set this to True if running on multi-domain model. When this is enabled, it
# will require user to enter the Domain name in addition to username for login.
OPENSTACK_KEYSTONE_MULTIDOMAIN_SUPPORT = {{ .Values.conf.horizon.local_settings.config.keystone_multidomain_support }}
# Overrides the default domain used when running on single-domain model
# with Keystone V3. All entities will be created in the default domain.
OPENSTACK_KEYSTONE_DEFAULT_DOMAIN = '{{ .Values.conf.horizon.local_settings.config.keystone_default_domain }}'
# Set Console type:
# valid options are "AUTO"(default), "VNC", "SPICE", "RDP", "SERIAL" or None
# Set to None explicitly if you want to deactivate the console.
#CONSOLE_TYPE = "AUTO"
# Default OpenStack Dashboard configuration.
HORIZON_CONFIG = {
'user_home': 'openstack_dashboard.views.get_user_home',
'ajax_queue_limit': 10,
'auto_fade_alerts': {
'delay': 3000,
'fade_duration': 1500,
'types': ['alert-success', 'alert-info']
},
'help_url': "http://docs.openstack.org",
'exceptions': {'recoverable': exceptions.RECOVERABLE,
'not_found': exceptions.NOT_FOUND,
'unauthorized': exceptions.UNAUTHORIZED},
'modal_backdrop': 'static',
'angular_modules': [],
'js_files': [],
'js_spec_files': [],
}
{{- if .Values.conf.horizon.local_settings.config.enable_pwd_validator }}
# Specify a regular expression to validate user passwords.
HORIZON_CONFIG["password_validator"] = {
"regex": '{{ .Values.conf.horizon.local_settings.config.pwd_validator_regex }}',
"help_text": {{ .Values.conf.horizon.local_settings.config.pwd_validator_help_text }},
}
{{- end }}
# Disable simplified floating IP address management for deployments with
# multiple floating IP pools or complex network requirements.
#HORIZON_CONFIG["simple_ip_management"] = False
# Turn off browser autocompletion for forms including the login form and
# the database creation workflow if so desired.
HORIZON_CONFIG["password_autocomplete"] = '{{ .Values.conf.horizon.local_settings.config.password_autocomplete }}'
# Setting this to True will disable the reveal button for password fields,
# including on the login form.
HORIZON_CONFIG["disable_password_reveal"] = {{ .Values.conf.horizon.local_settings.config.disable_password_reveal }}
LOCAL_PATH = '/tmp'
# Set custom secret key:
# You can either set it to a specific value or you can let horizon generate a
# default secret key that is unique on this machine, e.i. regardless of the
# amount of Python WSGI workers (if used behind Apache+mod_wsgi): However,
# there may be situations where you would want to set this explicitly, e.g.
# when multiple dashboard instances are distributed on different machines
# (usually behind a load-balancer). Either you have to make sure that a session
# gets all requests routed to the same dashboard instance or you set the same
# SECRET_KEY for all of them.
SECRET_KEY='{{ .Values.conf.horizon.local_settings.config.horizon_secret_key }}'
CACHES = {
'default': {
'BACKEND': 'django.core.cache.backends.memcached.MemcachedCache',
'LOCATION': '{{ tuple "oslo_cache" "internal" "memcache" . | include "helm-toolkit.endpoints.host_and_port_endpoint_uri_lookup" }}',
}
}
DATABASES = {
'default': {
# Database configuration here
'ENGINE': 'django.db.backends.mysql',
'NAME': '{{ .Values.endpoints.oslo_db.path | base }}',
'USER': '{{ .Values.endpoints.oslo_db.auth.horizon.username }}',
'PASSWORD': '{{ .Values.endpoints.oslo_db.auth.horizon.password }}',
'HOST': '{{ tuple "oslo_db" "internal" . | include "helm-toolkit.endpoints.hostname_fqdn_endpoint_lookup" }}',
'default-character-set': 'utf8',
{{- if .Values.manifests.certificates }}
'OPTIONS':{
'ssl': {
'ca': '/etc/mysql/certs/ca.crt',
'cert': '/etc/mysql/certs/tls.crt',
'key': '/etc/mysql/certs/tls.key'
}
},
{{- end }}
'PORT': '{{ tuple "oslo_db" "internal" "mysql" . | include "helm-toolkit.endpoints.endpoint_port_lookup" }}'
}
}
SESSION_ENGINE = 'django.contrib.sessions.backends.cached_db'
# Send email to the console by default
EMAIL_BACKEND = 'django.core.mail.backends.console.EmailBackend'
# Or send them to /dev/null
#EMAIL_BACKEND = 'django.core.mail.backends.dummy.EmailBackend'
# Configure these for your outgoing email host
#EMAIL_HOST = 'smtp.my-company.com'
#EMAIL_PORT = 25\\
#EMAIL_HOST_USER = 'djangomail'
#EMAIL_HOST_PASSWORD = 'top-secret!'
# For multiple regions uncomment this configuration, and add (endpoint, title).
#AVAILABLE_REGIONS = [
# ('http://cluster1.example.com:5000/v2.0', 'cluster1'),
# ('http://cluster2.example.com:5000/v2.0', 'cluster2'),
#]
OPENSTACK_KEYSTONE_URL = "{{ tuple "identity" "internal" "api" . | include "helm-toolkit.endpoints.keystone_endpoint_uri_lookup" }}"
OPENSTACK_KEYSTONE_DEFAULT_ROLE = "member"
# This setting specifies the name of the header with remote IP address. If not present,
# then REMOTE_ADDR header is used. The commom value for this setting is HTTP_X_REAL_IP
# or HTTP_X_FORWARDED_FORx
SECURE_PROXY_ADDR_HEADER = 'HTTP_X_FORWARDED_FOR'
{{- if .Values.conf.horizon.local_settings.config.auth.sso.enabled }}
# Enables keystone web single-sign-on if set to True.
WEBSSO_ENABLED = True
# Determines which authentication choice to show as default.
WEBSSO_INITIAL_CHOICE = "{{ .Values.conf.horizon.local_settings.config.auth.sso.initial_choice }}"
# The list of authentication mechanisms
# which include keystone federation protocols.
# Current supported protocol IDs are 'saml2' and 'oidc'
# which represent SAML 2.0, OpenID Connect respectively.
# Do not remove the mandatory credentials mechanism.
WEBSSO_CHOICES = (
("credentials", _("Keystone Credentials")),
{{- range $i, $sso := .Values.conf.horizon.local_settings.config.auth.idp_mapping }}
({{ $sso.name | quote }}, {{ $sso.label | quote }}),
{{- end }}
)
WEBSSO_IDP_MAPPING = {
{{- range $i, $sso := .Values.conf.horizon.local_settings.config.auth.idp_mapping }}
{{ $sso.name | quote}}: ({{ $sso.idp | quote }}, {{ $sso.protocol | quote }}),
{{- end }}
}
{{- end }}
# Disable SSL certificate checks (useful for self-signed certificates):
#OPENSTACK_SSL_NO_VERIFY = True
{{- if .Values.manifests.certificates }}
# The CA certificate to use to verify SSL connections
OPENSTACK_SSL_CACERT = '/etc/openstack-dashboard/certs/ca.crt'
{{- end }}
# The OPENSTACK_KEYSTONE_BACKEND settings can be used to identify the
# capabilities of the auth backend for Keystone.
# If Keystone has been configured to use LDAP as the auth backend then set
# can_edit_user to False and name to 'ldap'.
#
# TODO(tres): Remove these once Keystone has an API to identify auth backend.
OPENSTACK_KEYSTONE_BACKEND = {
'name': 'native',
'can_edit_user': True,
'can_edit_group': True,
'can_edit_project': True,
'can_edit_domain': True,
'can_edit_role': True,
}
# Setting this to True, will add a new "Retrieve Password" action on instance,
# allowing Admin session password retrieval/decryption.
OPENSTACK_ENABLE_PASSWORD_RETRIEVE = {{ .Values.conf.horizon.local_settings.config.openstack_enable_password_retrieve }}
# The Launch Instance user experience has been significantly enhanced.
# You can choose whether to enable the new launch instance experience,
# the legacy experience, or both. The legacy experience will be removed
# in a future release, but is available as a temporary backup setting to ensure
# compatibility with existing deployments. Further development will not be
# done on the legacy experience. Please report any problems with the new
# experience via the StoryBoard tracking system.
#
# Toggle LAUNCH_INSTANCE_LEGACY_ENABLED and LAUNCH_INSTANCE_NG_ENABLED to
# determine the experience to enable. Set them both to true to enable
# both.
#LAUNCH_INSTANCE_LEGACY_ENABLED = True
#LAUNCH_INSTANCE_NG_ENABLED = False
# The Xen Hypervisor has the ability to set the mount point for volumes
# attached to instances (other Hypervisors currently do not). Setting
# can_set_mount_point to True will add the option to set the mount point
# from the UI.
OPENSTACK_HYPERVISOR_FEATURES = {
'can_set_mount_point': False,
'can_set_password': False,
}
# The OPENSTACK_CINDER_FEATURES settings can be used to enable optional
# services provided by cinder that is not exposed by its extension API.
OPENSTACK_CINDER_FEATURES = {
'enable_backup': {{ .Values.conf.horizon.local_settings.config.openstack_cinder_features.enable_backup }},
}
# The OPENSTACK_NEUTRON_NETWORK settings can be used to enable optional
# services provided by neutron. Options currently available are load
# balancer service, security groups, quotas, VPN service.
OPENSTACK_NEUTRON_NETWORK = {
'enable_router': {{ .Values.conf.horizon.local_settings.config.openstack_neutron_network.enable_router }},
'enable_quotas': {{ .Values.conf.horizon.local_settings.config.openstack_neutron_network.enable_quotas }},
'enable_ipv6': {{ .Values.conf.horizon.local_settings.config.openstack_neutron_network.enable_ipv6 }},
'enable_distributed_router': {{ .Values.conf.horizon.local_settings.config.openstack_neutron_network.enable_distributed_router }},
'enable_ha_router': {{ .Values.conf.horizon.local_settings.config.openstack_neutron_network.enable_ha_router }},
'enable_lb': {{ .Values.conf.horizon.local_settings.config.openstack_neutron_network.enable_lb }},
'enable_firewall': {{ .Values.conf.horizon.local_settings.config.openstack_neutron_network.enable_firewall }},
'enable_vpn': {{ .Values.conf.horizon.local_settings.config.openstack_neutron_network.enable_vpn }},
'enable_fip_topology_check': {{ .Values.conf.horizon.local_settings.config.openstack_neutron_network.enable_fip_topology_check }},
# The profile_support option is used to detect if an external router can be
# configured via the dashboard. When using specific plugins the
# profile_support can be turned on if needed.
'profile_support': None,
#'profile_support': 'cisco',
# Set which provider network types are supported. Only the network types
# in this list will be available to choose from when creating a network.
# Network types include local, flat, vlan, gre, and vxlan.
'supported_provider_types': ['*'],
# Set which VNIC types are supported for port binding. Only the VNIC
# types in this list will be available to choose from when creating a
# port.
# VNIC types include 'normal', 'macvtap' and 'direct'.
'supported_vnic_types': ['*']
}
# The OPENSTACK_IMAGE_BACKEND settings can be used to customize features
# in the OpenStack Dashboard related to the Image service, such as the list
# of supported image formats.
#OPENSTACK_IMAGE_BACKEND = {
# 'image_formats': [
# ('', _('Select format')),
# ('aki', _('AKI - Amazon Kernel Image')),
# ('ami', _('AMI - Amazon Machine Image')),
# ('ari', _('ARI - Amazon Ramdisk Image')),
# ('docker', _('Docker')),
# ('iso', _('ISO - Optical Disk Image')),
# ('ova', _('OVA - Open Virtual Appliance')),
# ('qcow2', _('QCOW2 - QEMU Emulator')),
# ('raw', _('Raw')),
# ('vdi', _('VDI - Virtual Disk Image')),
# ('vhd', ('VHD - Virtual Hard Disk')),
# ('vmdk', _('VMDK - Virtual Machine Disk')),
# ]
#}
# The IMAGE_CUSTOM_PROPERTY_TITLES settings is used to customize the titles for
# image custom property attributes that appear on image detail pages.
IMAGE_CUSTOM_PROPERTY_TITLES = {
"architecture": _("Architecture"),
"kernel_id": _("Kernel ID"),
"ramdisk_id": _("Ramdisk ID"),
"image_state": _("Euca2ools state"),
"project_id": _("Project ID"),
"image_type": _("Image Type"),
}
# The IMAGE_RESERVED_CUSTOM_PROPERTIES setting is used to specify which image
# custom properties should not be displayed in the Image Custom Properties
# table.
IMAGE_RESERVED_CUSTOM_PROPERTIES = []
# Set to 'legacy' or 'direct' to allow users to upload images to glance via
# Horizon server. When enabled, a file form field will appear on the create
# image form. If set to 'off', there will be no file form field on the create
# image form. See documentation for deployment considerations.
HORIZON_IMAGES_UPLOAD_MODE = '{{ .Values.conf.horizon.local_settings.config.horizon_images_upload_mode }}'
# OPENSTACK_ENDPOINT_TYPE specifies the endpoint type to use for the endpoints
# in the Keystone service catalog. Use this setting when Horizon is running
# external to the OpenStack environment. The default is 'publicURL'.
OPENSTACK_ENDPOINT_TYPE = "internalURL"
# SECONDARY_ENDPOINT_TYPE specifies the fallback endpoint type to use in the
# case that OPENSTACK_ENDPOINT_TYPE is not present in the endpoints
# in the Keystone service catalog. Use this setting when Horizon is running
# external to the OpenStack environment. The default is None. This
# value should differ from OPENSTACK_ENDPOINT_TYPE if used.
SECONDARY_ENDPOINT_TYPE = "publicURL"
# The number of objects (Swift containers/objects or images) to display
# on a single page before providing a paging element (a "more" link)
# to paginate results.
API_RESULT_LIMIT = 1000
API_RESULT_PAGE_SIZE = 20
# The size of chunk in bytes for downloading objects from Swift
SWIFT_FILE_TRANSFER_CHUNK_SIZE = 512 * 1024
# Specify a maximum number of items to display in a dropdown.
DROPDOWN_MAX_ITEMS = 30
# The timezone of the server. This should correspond with the timezone
# of your entire OpenStack installation, and hopefully be in UTC.
TIME_ZONE = "UTC"
# When launching an instance, the menu of available flavors is
# sorted by RAM usage, ascending. If you would like a different sort order,
# you can provide another flavor attribute as sorting key. Alternatively, you
# can provide a custom callback method to use for sorting. You can also provide
# a flag for reverse sort. For more info, see
# http://docs.python.org/2/library/functions.html#sorted
#CREATE_INSTANCE_FLAVOR_SORT = {
# 'key': 'name',
# # or
# 'key': my_awesome_callback_method,
# 'reverse': False,
#}
# Set this to True to display an 'Admin Password' field on the Change Password
# form to verify that it is indeed the admin logged-in who wants to change
# the password.
ENFORCE_PASSWORD_CHECK = {{ .Values.conf.horizon.local_settings.config.enforce_password_check }}
# Modules that provide /auth routes that can be used to handle different types
# of user authentication. Add auth plugins that require extra route handling to
# this list.
#AUTHENTICATION_URLS = [
# 'openstack_auth.urls',
#]
# The Horizon Policy Enforcement engine uses these values to load per service
# policy rule files. The content of these files should match the files the
# OpenStack services are using to determine role based access control in the
# target installation.
# Path to directory containing policy.yaml files
POLICY_FILES_PATH = '/etc/openstack-dashboard'
# Map of local copy of service policy files
#POLICY_FILES = {
# 'identity': 'keystone_policy.yaml',
# 'compute': 'nova_policy.yaml',
# 'volume': 'cinder_policy.yaml',
# 'image': 'glance_policy.yaml',
# 'orchestration': 'heat_policy.yaml',
# 'network': 'neutron_policy.yaml',
# 'telemetry': 'ceilometer_policy.yaml',
#}
# Trove user and database extension support. By default support for
# creating users and databases on database instances is turned on.
# To disable these extensions set the permission here to something
# unusable such as ["!"].
# TROVE_ADD_USER_PERMS = []
# TROVE_ADD_DATABASE_PERMS = []
# Change this patch to the appropriate static directory containing
# two files: _variables.scss and _styles.scss
#CUSTOM_THEME_PATH = 'static/themes/default'
LOGGING = {
'version': 1,
# When set to True this will disable all logging except
# for loggers specified in this configuration dictionary. Note that
# if nothing is specified here and disable_existing_loggers is True,
# django.db.backends will still log unless it is disabled explicitly.
'disable_existing_loggers': False,
'handlers': {
'null': {
'level': 'DEBUG',
'class': 'logging.NullHandler',
},
'console': {
# Set the level to "DEBUG" for verbose output logging.
'level': 'INFO',
'class': 'logging.StreamHandler',
},
},
'loggers': {
# Logging from django.db.backends is VERY verbose, send to null
# by default.
'django.db.backends': {
'handlers': ['null'],
'propagate': False,
},
'requests': {
'handlers': ['null'],
'propagate': False,
},
'horizon': {
'handlers': ['console'],
'level': '{{ .Values.conf.horizon.local_settings.config.log_level }}',
'propagate': False,
},
'openstack_dashboard': {
'handlers': ['console'],
'level': '{{ .Values.conf.horizon.local_settings.config.log_level }}',
'propagate': False,
},
'novaclient': {
'handlers': ['console'],
'level': '{{ .Values.conf.horizon.local_settings.config.log_level }}',
'propagate': False,
},
'cinderclient': {
'handlers': ['console'],
'level': '{{ .Values.conf.horizon.local_settings.config.log_level }}',
'propagate': False,
},
'glanceclient': {
'handlers': ['console'],
'level': '{{ .Values.conf.horizon.local_settings.config.log_level }}',
'propagate': False,
},
'glanceclient': {
'handlers': ['console'],
'level': '{{ .Values.conf.horizon.local_settings.config.log_level }}',
'propagate': False,
},
'neutronclient': {
'handlers': ['console'],
'level': '{{ .Values.conf.horizon.local_settings.config.log_level }}',
'propagate': False,
},
'heatclient': {
'handlers': ['console'],
'level': '{{ .Values.conf.horizon.local_settings.config.log_level }}',
'propagate': False,
},
'ceilometerclient': {
'handlers': ['console'],
'level': '{{ .Values.conf.horizon.local_settings.config.log_level }}',
'propagate': False,
},
'troveclient': {
'handlers': ['console'],
'level': '{{ .Values.conf.horizon.local_settings.config.log_level }}',
'propagate': False,
},
'swiftclient': {
'handlers': ['console'],
'level': '{{ .Values.conf.horizon.local_settings.config.log_level }}',
'propagate': False,
},
'openstack_auth': {
'handlers': ['console'],
'level': '{{ .Values.conf.horizon.local_settings.config.log_level }}',
'propagate': False,
},
'nose.plugins.manager': {
'handlers': ['console'],
'level': '{{ .Values.conf.horizon.local_settings.config.log_level }}',
'propagate': False,
},
'django': {
'handlers': ['console'],
'level': '{{ .Values.conf.horizon.local_settings.config.log_level }}',
'propagate': False,
},
'iso8601': {
'handlers': ['null'],
'propagate': False,
},
'scss': {
'handlers': ['null'],
'propagate': False,
},
}
}
# 'direction' should not be specified for all_tcp/udp/icmp.
# It is specified in the form.
SECURITY_GROUP_RULES = {
'all_tcp': {
'name': _('All TCP'),
'ip_protocol': 'tcp',
'from_port': '1',
'to_port': '65535',
},
'all_udp': {
'name': _('All UDP'),
'ip_protocol': 'udp',
'from_port': '1',
'to_port': '65535',
},
'all_icmp': {
'name': _('All ICMP'),
'ip_protocol': 'icmp',
'from_port': '-1',
'to_port': '-1',
},
'ssh': {
'name': 'SSH',
'ip_protocol': 'tcp',
'from_port': '22',
'to_port': '22',
},
'smtp': {
'name': 'SMTP',
'ip_protocol': 'tcp',
'from_port': '25',
'to_port': '25',
},
'dns': {
'name': 'DNS',
'ip_protocol': 'tcp',
'from_port': '53',
'to_port': '53',
},
'http': {
'name': 'HTTP',
'ip_protocol': 'tcp',
'from_port': '80',
'to_port': '80',
},
'pop3': {
'name': 'POP3',
'ip_protocol': 'tcp',
'from_port': '110',
'to_port': '110',
},
'imap': {
'name': 'IMAP',
'ip_protocol': 'tcp',
'from_port': '143',
'to_port': '143',
},
'ldap': {
'name': 'LDAP',
'ip_protocol': 'tcp',
'from_port': '389',
'to_port': '389',
},
'https': {
'name': 'HTTPS',
'ip_protocol': 'tcp',
'from_port': '443',
'to_port': '443',
},
'smtps': {
'name': 'SMTPS',
'ip_protocol': 'tcp',
'from_port': '465',
'to_port': '465',
},
'imaps': {
'name': 'IMAPS',
'ip_protocol': 'tcp',
'from_port': '993',
'to_port': '993',
},
'pop3s': {
'name': 'POP3S',
'ip_protocol': 'tcp',
'from_port': '995',
'to_port': '995',
},
'ms_sql': {
'name': 'MS SQL',
'ip_protocol': 'tcp',
'from_port': '1433',
'to_port': '1433',
},
'mysql': {
'name': 'MYSQL',
'ip_protocol': 'tcp',
'from_port': '3306',
'to_port': '3306',
},
'rdp': {
'name': 'RDP',
'ip_protocol': 'tcp',
'from_port': '3389',
'to_port': '3389',
},
}
# Deprecation Notice:
#
# The setting FLAVOR_EXTRA_KEYS has been deprecated.
# Please load extra spec metadata into the Glance Metadata Definition Catalog.
#
# The sample quota definitions can be found in:
# <glance_source>/etc/metadefs/compute-quota.json
#
# The metadata definition catalog supports CLI and API:
# $glance --os-image-api-version 2 help md-namespace-import
# $glance-manage db_load_metadefs <directory_with_definition_files>
#
# See Metadata Definitions on: https://docs.openstack.org/glance/latest/
# Indicate to the Sahara data processing service whether or not
# automatic floating IP allocation is in effect. If it is not
# in effect, the user will be prompted to choose a floating IP
# pool for use in their cluster. False by default. You would want
# to set this to True if you were running Nova Networking with
# auto_assign_floating_ip = True.
#SAHARA_AUTO_IP_ALLOCATION_ENABLED = False
# The hash algorithm to use for authentication tokens. This must
# match the hash algorithm that the identity server and the
# auth_token middleware are using. Allowed values are the
# algorithms supported by Python's hashlib library.
#OPENSTACK_TOKEN_HASH_ALGORITHM = 'md5'
# AngularJS requires some settings to be made available to
# the client side. Some settings are required by in-tree / built-in horizon
# features. These settings must be added to REST_API_REQUIRED_SETTINGS in the
# form of ['SETTING_1','SETTING_2'], etc.
#
# You may remove settings from this list for security purposes, but do so at
# the risk of breaking a built-in horizon feature. These settings are required
# for horizon to function properly. Only remove them if you know what you
# are doing. These settings may in the future be moved to be defined within
# the enabled panel configuration.
# You should not add settings to this list for out of tree extensions.
# See: https://wiki.openstack.org/wiki/Horizon/RESTAPI
REST_API_REQUIRED_SETTINGS = ['OPENSTACK_HYPERVISOR_FEATURES',
'LAUNCH_INSTANCE_DEFAULTS',
'OPENSTACK_IMAGE_FORMATS']
# Additional settings can be made available to the client side for
# extensibility by specifying them in REST_API_ADDITIONAL_SETTINGS
# !! Please use extreme caution as the settings are transferred via HTTP/S
# and are not encrypted on the browser. This is an experimental API and
# may be deprecated in the future without notice.
#REST_API_ADDITIONAL_SETTINGS = []
# DISALLOW_IFRAME_EMBED can be used to prevent Horizon from being embedded
# within an iframe. Legacy browsers are still vulnerable to a Cross-Frame
# Scripting (XFS) vulnerability, so this option allows extra security hardening
# where iframes are not used in deployment. Default setting is True.
# For more information see:
# http://tinyurl.com/anticlickjack
DISALLOW_IFRAME_EMBED = {{ .Values.conf.horizon.local_settings.config.disallow_iframe_embed }}
STATIC_ROOT = '/var/www/html/horizon'
{{- range $option, $value := .Values.conf.horizon.local_settings.config.raw }}
{{ $option }} = {{ toJson $value }}
{{- end }}
policy:
ceilometer:
context_is_admin: 'role:admin'
context_is_owner: 'user_id:%(target.user_id)s'
context_is_project: 'project_id:%(target.project_id)s'
segregation: 'rule:context_is_admin'
heat:
'actions:action': 'rule:deny_stack_user'
'build_info:build_info': 'rule:deny_stack_user'
'cloudformation:CancelUpdateStack': 'rule:deny_stack_user'
'cloudformation:CreateStack': 'rule:deny_stack_user'
'cloudformation:DeleteStack': 'rule:deny_stack_user'
'cloudformation:DescribeStackEvents': 'rule:deny_stack_user'
'cloudformation:DescribeStackResource': ''
'cloudformation:DescribeStackResources': 'rule:deny_stack_user'
'cloudformation:DescribeStacks': 'rule:deny_stack_user'
'cloudformation:EstimateTemplateCost': 'rule:deny_stack_user'
'cloudformation:GetTemplate': 'rule:deny_stack_user'
'cloudformation:ListStackResources': 'rule:deny_stack_user'
'cloudformation:ListStacks': 'rule:deny_stack_user'
'cloudformation:UpdateStack': 'rule:deny_stack_user'
'cloudformation:ValidateTemplate': 'rule:deny_stack_user'
'cloudwatch:DeleteAlarms': 'rule:deny_stack_user'
'cloudwatch:DescribeAlarmHistory': 'rule:deny_stack_user'
'cloudwatch:DescribeAlarms': 'rule:deny_stack_user'
'cloudwatch:DescribeAlarmsForMetric': 'rule:deny_stack_user'
'cloudwatch:DisableAlarmActions': 'rule:deny_stack_user'
'cloudwatch:EnableAlarmActions': 'rule:deny_stack_user'
'cloudwatch:GetMetricStatistics': 'rule:deny_stack_user'
'cloudwatch:ListMetrics': 'rule:deny_stack_user'
'cloudwatch:PutMetricAlarm': 'rule:deny_stack_user'
'cloudwatch:PutMetricData': ''
'cloudwatch:SetAlarmState': 'rule:deny_stack_user'
context_is_admin: 'role:admin'
deny_everybody: '!'
deny_stack_user: 'not role:heat_stack_user'
'events:index': 'rule:deny_stack_user'
'events:show': 'rule:deny_stack_user'
'resource:index': 'rule:deny_stack_user'
'resource:mark_unhealthy': 'rule:deny_stack_user'
'resource:metadata': ''
'resource:show': 'rule:deny_stack_user'
'resource:signal': ''
'resource_types:OS::Cinder::EncryptedVolumeType': 'rule:context_is_admin'
'resource_types:OS::Cinder::VolumeType': 'rule:context_is_admin'
'resource_types:OS::Manila::ShareType': 'rule:context_is_admin'
'resource_types:OS::Neutron::QoSBandwidthLimitRule': 'rule:context_is_admin'
'resource_types:OS::Neutron::QoSPolicy': 'rule:context_is_admin'
'resource_types:OS::Nova::Flavor': 'rule:context_is_admin'
'resource_types:OS::Nova::HostAggregate': 'rule:context_is_admin'
'service:index': 'rule:context_is_admin'
'software_configs:create': 'rule:deny_stack_user'
'software_configs:delete': 'rule:deny_stack_user'
'software_configs:global_index': 'rule:deny_everybody'
'software_configs:index': 'rule:deny_stack_user'
'software_configs:show': 'rule:deny_stack_user'
'software_deployments:create': 'rule:deny_stack_user'
'software_deployments:delete': 'rule:deny_stack_user'
'software_deployments:index': 'rule:deny_stack_user'
'software_deployments:metadata': ''
'software_deployments:show': 'rule:deny_stack_user'
'software_deployments:update': 'rule:deny_stack_user'
'stacks:abandon': 'rule:deny_stack_user'
'stacks:create': 'rule:deny_stack_user'
'stacks:delete': 'rule:deny_stack_user'
'stacks:delete_snapshot': 'rule:deny_stack_user'
'stacks:detail': 'rule:deny_stack_user'
'stacks:environment': 'rule:deny_stack_user'
'stacks:export': 'rule:deny_stack_user'
'stacks:generate_template': 'rule:deny_stack_user'
'stacks:global_index': 'rule:deny_everybody'
'stacks:index': 'rule:deny_stack_user'
'stacks:list_outputs': 'rule:deny_stack_user'
'stacks:list_resource_types': 'rule:deny_stack_user'
'stacks:list_snapshots': 'rule:deny_stack_user'
'stacks:list_template_functions': 'rule:deny_stack_user'
'stacks:list_template_versions': 'rule:deny_stack_user'
'stacks:lookup': ''
'stacks:preview': 'rule:deny_stack_user'
'stacks:preview_update': 'rule:deny_stack_user'
'stacks:preview_update_patch': 'rule:deny_stack_user'
'stacks:resource_schema': 'rule:deny_stack_user'
'stacks:restore_snapshot': 'rule:deny_stack_user'
'stacks:show': 'rule:deny_stack_user'
'stacks:show_output': 'rule:deny_stack_user'
'stacks:show_snapshot': 'rule:deny_stack_user'
'stacks:snapshot': 'rule:deny_stack_user'
'stacks:template': 'rule:deny_stack_user'
'stacks:update': 'rule:deny_stack_user'
'stacks:update_patch': 'rule:deny_stack_user'
'stacks:validate_template': 'rule:deny_stack_user'
# list of panels to enable for horizon
# this requires that the panels are already installed in the horizon image, if they are not
# nothing will be added
# the name of the panel should be the name of the dir where the panel is installed
# for example heat_dashboard, cloudkittydashboard or neutron_taas_dashboard
extra_panels:
- heat_dashboard
- neutron_taas_dashboard
dependencies:
dynamic:
common:
local_image_registry:
jobs:
- horizon-image-repo-sync
services:
- endpoint: node
service: local_image_registry
static:
dashboard:
jobs:
- horizon-db-sync
services:
- endpoint: internal
service: oslo_cache
- endpoint: internal
service: oslo_db
- endpoint: internal
service: identity
db_drop:
services:
- endpoint: internal
service: oslo_db
db_init:
services:
- endpoint: internal
service: oslo_db
db_sync:
jobs:
- horizon-db-init
services:
- endpoint: internal
service: oslo_db
image_repo_sync:
services:
- endpoint: internal
service: local_image_registry
tests:
services:
- endpoint: internal
service: dashboard
pod:
security_context:
horizon:
pod:
runAsUser: 42424
container:
horizon:
readOnlyRootFilesystem: false
allowPrivilegeEscalation: false
runAsUser: 0
db_sync:
pod:
runAsUser: 42424
container:
horizon_db_sync:
readOnlyRootFilesystem: false
allowPrivilegeEscalation: false
runAsUser: 0
test:
pod:
runAsUser: 42424
container:
horizon_test:
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
affinity:
anti:
type:
default: preferredDuringSchedulingIgnoredDuringExecution
topologyKey:
default: kubernetes.io/hostname
weight:
default: 10
mounts:
horizon_db_init:
init_container: null
horizon_db_init:
volumeMounts:
volumes:
horizon_db_sync:
init_container: null
horizon_db_sync:
volumeMounts:
volumes:
horizon:
init_container: null
horizon:
volumeMounts:
volumes:
horizon_tests:
init_container: null
horizon_tests:
volumeMounts:
volumes:
replicas:
server: 1
lifecycle:
upgrades:
deployments:
revision_history: 3
pod_replacement_strategy: RollingUpdate
rolling_update:
max_unavailable: 1
max_surge: 3
disruption_budget:
horizon:
min_available: 0
termination_grace_period:
horizon:
timeout: 30
resources:
enabled: false
server:
requests:
memory: "128Mi"
cpu: "100m"
limits:
memory: "1024Mi"
cpu: "2000m"
jobs:
db_init:
requests:
memory: "128Mi"
cpu: "100m"
limits:
memory: "1024Mi"
cpu: "2000m"
db_sync:
requests:
memory: "128Mi"
cpu: "100m"
limits:
memory: "1024Mi"
cpu: "2000m"
db_drop:
requests:
memory: "128Mi"
cpu: "100m"
limits:
memory: "1024Mi"
cpu: "2000m"
image_repo_sync:
requests:
memory: "128Mi"
cpu: "100m"
limits:
memory: "1024Mi"
cpu: "2000m"
tests:
requests:
memory: "128Mi"
cpu: "100m"
limits:
memory: "1024Mi"
cpu: "2000m"
# Names of secrets used by bootstrap and environmental checks
secrets:
identity:
admin: horizon-keystone-admin
oslo_db:
admin: horizon-db-admin
horizon: horizon-db-user
tls:
dashboard:
dashboard:
public: horizon-tls-public
internal: horizon-tls-web
# typically overridden by environmental
# values, but should include all endpoints
# required by this chart
endpoints:
cluster_domain_suffix: cluster.local
local_image_registry:
name: docker-registry
namespace: docker-registry
hosts:
default: localhost
internal: docker-registry
node: localhost
host_fqdn_override:
default: null
port:
registry:
node: 5000
identity:
name: keystone
auth:
admin:
region_name: RegionOne
username: admin
password: password
project_name: admin
user_domain_name: default
project_domain_name: default
hosts:
default: keystone
internal: keystone-api
host_fqdn_override:
default: null
path:
default: /v3
scheme:
default: http
port:
api:
default: 80
internal: 5000
oslo_cache:
hosts:
default: memcached
host_fqdn_override:
default: null
port:
memcache:
default: 11211
dashboard:
name: horizon
hosts:
default: horizon-int
public: horizon
host_fqdn_override:
default: null
# NOTE(portdirect): this chart supports TLS for fqdn over-ridden public
# endpoints using the following format:
# public:
# host: null
# tls:
# crt: null
# key: null
path:
default: null
scheme:
default: http
port:
web:
default: 80
oslo_db:
auth:
admin:
username: root
password: password
secret:
tls:
internal: mariadb-tls-direct
horizon:
username: horizon
password: password
hosts:
default: mariadb
host_fqdn_override:
default: null
path: /horizon
scheme: mysql+pymysql
port:
mysql:
default: 3306
# NOTE(tp6510): these endpoints allow for things like DNS lookups and ingress
# They are using to enable the Egress K8s network policy.
kube_dns:
namespace: kube-system
name: kubernetes-dns
hosts:
default: kube-dns
host_fqdn_override:
default: null
path:
default: null
scheme: http
port:
dns:
default: 53
protocol: UDP
ingress:
namespace: null
name: ingress
hosts:
default: ingress
port:
ingress:
default: 80
network_policy:
horizon:
ingress:
- {}
egress:
- {}
manifests:
certificates: false
configmap_bin: true
configmap_etc: true
deployment: true
ingress_api: true
job_db_init: true
job_db_sync: true
job_db_drop: false
job_image_repo_sync: true
pdb: true
pod_helm_test: true
network_policy: false
secret_db: true
secret_ingress_tls: true
secret_keystone: true
service_ingress: true
service: true
...
View Git Blame Copy Permalink