94df23fbc5
This change enables the charm to configure the Openstack Dashboard to support Keystone v3 integration. Mitaka is the earliest release to support Dashboard and v3 integration so v3 integration should only be enabled on Mitaka or above. A new identity policy template now ships with the charm which is specifically for v3 integration. Both the local settings file and the new v3 policy file need the admin domain id. This is now passed to the charm from Keystone via the identity service relation. The openstack-dashboard package uses django.contrib.sessions.backends.signed_cookies for session management but cookies are not large enough to store domain scoped tokens so a different session management engine is needed. This patch adds the option to relate the charm to a database backend. If the relation is present then the charm uses the django.contrib.sessions.backends.cached_db session engine. This stores the session information in the database and also caches the session information locally using memcache. For details on Dashboard and v3 integration see https://wiki.openstack.org/wiki/Horizon/DomainWorkFlow Change-Id: I24f514e29811752d7c0c5347a1157d9778297738 Partial-Bug: 1595685 |
||
|---|---|---|
| actions | ||
| hooks | ||
| scripts | ||
| templates | ||
| tests | ||
| unit_tests | ||
| .coveragerc | ||
| .gitignore | ||
| .gitreview | ||
| .project | ||
| .pydevproject | ||
| .testr.conf | ||
| Makefile | ||
| README.md | ||
| actions.yaml | ||
| charm-helpers-hooks.yaml | ||
| charm-helpers-tests.yaml | ||
| config.yaml | ||
| copyright | ||
| hardening.yaml | ||
| icon.svg | ||
| metadata.yaml | ||
| requirements.txt | ||
| revision | ||
| setup.cfg | ||
| test-requirements.txt | ||
| tox.ini | ||
README.md
Overview
The OpenStack Dashboard provides a Django based web interface for use by both administrators and users of an OpenStack Cloud.
It allows you to manage Nova, Glance, Cinder and Neutron resources within the cloud.
Usage
The OpenStack Dashboard is deployed and related to keystone:
juju deploy openstack-dashboard
juju add-unit openstack-dashboard keystone
The dashboard will use keystone for user authentication and authorization and to interact with the catalog of services within the cloud.
The dashboard is accessible on:
http(s)://service_unit_address/horizon
At a minimum, the cloud must provide Glance and Nova services.
SSL configuration
To fully secure your dashboard services, you can provide a SSL key and certificate for installation and configuration. These are provided as base64 encoded configuration options::
juju set openstack-dashboard ssl_key="$(base64 my.key)" \
ssl_cert="$(base64 my.cert)"
The service will be reconfigured to use the supplied information.
HA/Clustering
There are two mutually exclusive high availability options: using virtual IP(s) or DNS. In both cases, a relationship to hacluster is required which provides the corosync back end HA functionality.
To use virtual IP(s) the clustered nodes must be on the same subnet such that the VIP is a valid IP on the subnet for one of the node's interfaces and each node has an interface in said subnet. The VIP becomes a highly-available API endpoint.
At a minimum, the config option 'vip' must be set in order to use virtual IP HA. If multiple networks are being used, a VIP should be provided for each network, separated by spaces. Optionally, vip_iface or vip_cidr may be specified.
To use DNS high availability there are several prerequisites. However, DNS HA does not require the clustered nodes to be on the same subnet. Currently the DNS HA feature is only available for MAAS 2.0 or greater environments. MAAS 2.0 requires Juju 2.0 or greater. The clustered nodes must have static or "reserved" IP addresses registered in MAAS. The DNS hostname(s) must be pre-registered in MAAS before use with DNS HA.
At a minimum, the config option 'dns-ha' must be set to true and at least one of 'os-public-hostname', 'os-internal-hostname' or 'os-internal-hostname' must be set in order to use DNS HA. One or more of the above hostnames may be set.
The charm will throw an exception in the following circumstances: If neither 'vip' nor 'dns-ha' is set and the charm is related to hacluster If both 'vip' and 'dns-ha' are set as they are mutually exclusive If 'dns-ha' is set and none of the os-{admin,internal,public}-hostname(s) are set
Whichever method has been used to cluster the charm the 'secret' option should be set to ensure that the Django secret is consistent accross all units.
Keystone V3
If the charm is being deployed into a keystone v3 enabled environment then the charm needs to be related to a database to store session information. This is only supported for Mitaka or later.
Use with a Load Balancing Proxy
Instead of deploying with the hacluster charm for load balancing, its possible to also deploy the dashboard with load balancing proxy such as HAProxy:
juju deploy haproxy
juju add-relation haproxy openstack-dashboard
juju add-unit -n 2 openstack-dashboard
This option potentially provides better scale-out than using the charm in conjunction with the hacluster charm.