summaryrefslogtreecommitdiffstats
path: root/puppet/services/horizon.yaml
AgeCommit message (Collapse)AuthorFilesLines
2017-08-18Enable listening on TLS for the internal network for horizonJuan Antonio Osorio Robles1-0/+16
This sets the flag that tells the horizon manifest to use TLS for the configuration. bp tls-via-certmonger Depends-On: I7f2e11eb60c7b075e8a59f28682ecc50eeb95c3e Change-Id: I13d59e7663538884b34b5a910b741de8721abbb9
2017-07-14Adds network/cidr mapping into a new service propertyGiulio Fidente1-0/+4
Makes it possible to resolve network subnets within a service template; the data is transported into a new property ServiceData wired into every service which hopefully is generic enough to be extended in the future and transport more data. Data can be consumed in service templates to set config values which need to know what is the subnet where a deamon operates (for example the Ceph Public vs Cluster network). Change-Id: I28e21c46f1ef609517175f7e7ee19e28d1c0cba2
2017-06-20Remove add_listen: false from Horizon hieradataBen Nemec1-1/+0
I'm not sure why this was here, but without a Listen directive in Apache's ports.conf Horizon is inaccessible. Removing this allows Horizon to work again. Change-Id: Ic221e15f188cf50b485e995035cb96f5d5960a72 Closes-Bug: 1696439
2017-06-08Change HorizonSecureCookies default to FalseBen Nemec1-1/+1
HorizonSecureCookies is incompatible with non-ssl deployments, which is our default deployment method. When SSL is in use, it can be turned on in the enable-tls.yaml file. This does mean that existing users won't automatically get this feature turned on as part of their upgrade because enable-tls.yaml is an environment that is intended to be copied and edited, but it's simple to add the parameter to the file for users who want that behavior after they upgrade to a version where it is available. Change-Id: If83d3d8709fc4e0c09569e8bf524721d332bf560 Closes-Bug: 1696861
2017-06-07Ability to enable/disable debug mode per OpenStack serviceEmilien Macchi1-4/+8
Add ServiceDebug parameters for each services that will allow operators to enable/disable Debug for specific services. We keep the Debug parameters for backward compatibility. Operators want to enable Debug everywhere: Debug: true Operators want to disable Debug everywhere: Debug: false Operators want to disable Debug everywhere except Glance: GlanceDebug: true Operators want to enable Debug everywhere except Glance: Debug: true GlanceDebug: false New parameters: AodhDebug, BarbicanDebug, CeilometerDebug, CinderDebug, CongressDebug, GlanceDebug, GnocchiDebug, HeatDebug, HorizonDebug, IronicDebug, KeystoneDebug, ManilaDebug, MistralDebug, NeutronDebug, NovaDebug, OctaviaDebug, PankoDebug, SaharaDebug, TackerDebug, ZaqarDebug. Note: for backward compatibility in Horizon, HorizonDebug is set to false, so we maintain previous behavior. Change-Id: Icbf4a38afcdbd8471d1afc11743df9705451db52 Implement-blueprint: composable-debug Closes-Bug: #1634567
2017-05-20Merge "Open ports 443 and 80 on haproxy's firewall when horizon is standalone"Jenkins1-0/+7
2017-05-19Update the template_version alias for all the templates to pike.Carlos Camacho1-1/+1
Master is now the development branch for pike changing the release alias name. Change-Id: I938e4a983e361aefcaa0bd9a4226c296c5823127
2017-05-15Add role specific information to the service templateSaravanan KR1-0/+8
When a service is enabled on multiple roles, the parameters for the service will be global. This change enables an option to provide role specific parameter to services and other templates. Two new parameters - RoleName and RoleParameters, are added to the service template. RoleName provides the role name of on which the current instance of the service is being applied on. RoleParameters provides the list of parameters which are configured specific to the role in the environment file, like below: parameters_default: # Default value for applied to all roles NovaReservedHostMemory: 2048 ComputeDpdkParameters: # Applied only to ComputeDpdk role NovaReservedHostMemory: 4096 In above sample, the cluster contains 2 roles - Compute, ComputeDpdk. The values of ComputeDpdkParameters will be passed on to the templates as RoleParameters while creating the stack for ComputeDpdk role. The parameter which supports role specific configuration, should find the parameter first in in the RoleParameters list, if not found, then the default (for all roles) should be used. Implements: blueprint tripleo-derive-parameters Change-Id: I72376a803ec6b2ed93903cc0c95a6ffce718b6dc
2017-04-26Open ports 443 and 80 on haproxy's firewall when horizon is standaloneRadomir Dopieralski1-0/+7
Change-Id: Ifec9839ac0fc688678f0221bb731fb64bd86d2d9
2017-04-06Merge "Adds Horizon secure cookie map."Jenkins1-0/+5
2017-03-23Adds Horizon secure cookie map.lhinds1-0/+5
Puppet-horizon already contains a `secure_cookies` parameter, that sets `CSRF_COOKIE_SECURE` and `SESSION_COOKIE_SECURE` within `/templates/local_settings.py.erb`. This change introduces the services map for TripleO Heat Templates Change-Id: Ie6f6158929c33da8c5f245e2379aebe1afd524ef Closes-bug: #1640491
2017-03-10horizon: switch keystone_url to use uri_no_suffixEmilien Macchi1-1/+1
Switch Horizon to use keystone_url with keystone versionless endpoint. Change-Id: I7a22136937d414b2c3713894e04b0f093247ad33 Partial-implement: blueprint keystone-v3
2017-03-01upgrades/validation: only run validation when services existEmilien Macchi1-1/+2
During upgrades, validation test if a service is running before the upgrade process starts. In some cases, servies doesn't exist yet so we don't want to run the validation. This patch makes sure we check if the service is actually present on the system before validating it's running correctly. Also it makes sure that services are enabled before trying to stop them. It allows use-cases where we want to add new services during an upgrade. Also install new packages of services added in Ocata, so we can validate upgrades on scenarios jobs. Change-Id: Ib48fb6b1557be43956557cbde4cbe26b53a50bd8
2017-02-28Put service stop at step1 and quiesce at step2.Sofer Athlan-Guyot1-1/+1
In the previous release[1], the services were stopped before the pacemaker services, so that they get a chance to send last message to the database/rabbitmq queue: Let's do the upgrade in the same order. [1] https://github.com/openstack/tripleo-heat-templates/blob/stable/newton/extraconfig/tasks/major_upgrade_controller_pacemaker_2.sh#L13-L71 Change-Id: I1c4045e8b9167396c9dfa4da99973102f1af1218
2017-02-28Add upgrade support for HorizonEmilien Macchi1-0/+16
Change-Id: I91c3c93c1571288daa78b6d24b0aa9824a2bb5c4
2017-01-25Merge "Manage password_validator regex"Jenkins1-0/+10
2017-01-25Manage password_validator regexLuke Hinds1-0/+10
Horizon provides a password validation check, which OpenStack cloud operators can use to enforce password complexity checks for users within horizon. A dictionary containing a regular expression can be used for password validation with help text that is displayed if the password does not pass validation. HORIZON_CONFIG["password_validator"] = { "regex": '.*', "help_text": _("Your password does not meet the requirements."), } This change allows injection of the regex into horizons local_settings file from a tripleo heat template Change-Id: Ib6517c8f96148bea002b0e3442a26367b236928f Depends-On: If82a80ed6a8e6e65aecc2a25ee6d60640ae03c9a Closes-Bug: #1640800
2016-12-23Bump template version for all templates to "ocata"Steven Hardy1-1/+1
Heat now supports release name aliases, so we can replace the inconsistent mix of date related versions with one consistent version that aligns with the supported version of heat for this t-h-t branch. This should also help new users who sometimes copy/paste old templates and discover intrinsic functions in the t-h-t docs don't work because their template version is too old. Change-Id: Ib415e7290fea27447460baa280291492df197e54
2016-12-23Merge "Manage disallow_iframe_embed"Jenkins1-0/+1
2016-12-14Enable SECURE_PROXY_SSL_HEADER option for horizonJuan Antonio Osorio Robles1-0/+1
This reads makes Django take the X-Forwarded-Proto header into account when forming URLs. Change-Id: Ice64de9a11d7819ae7f380279ff356342d9b6673 Depends-On: Ifed7d4c3409419c01c5b20c707221c1fc76ea09e
2016-12-13Manage disallow_iframe_embedLuke Hinds1-0/+1
disallow_iframe_embed can be used to prevent Horizon from being embedded within an iframe. Legacy browsers are still vulnerable to a Cross-Frame Scripting (XFS) vulnerability, so this option allows extra security hardening where iframes are not used in deployment Change-Id: I2fe6b243250608b340ee555062060dbdad1a49c4 Depends-On: I5c540e552efe738bdec8598f9257fa22ae651a76 Closes-Bug: #1641882
2016-11-22Merge "Disable Options Indexes in horizon"Jenkins1-0/+1
2016-11-17Disable Options Indexes in horizonAndreas Karis1-0/+1
Security scanners complain that directory listings are enabled in horizon. Change-Id: I1d7cfcb3521e8235a99bc452f1b7b92c20ce72ac Closes-Bug: #1637576
2016-11-17Enable enforce_password_checkLuke Hinds1-0/+1
By setting ENFORCE_PASSWORD_CHECK to `True`, it displays an 'Admin Password' field on the Change Password form to verify that it is indeed the admin logged-in who wants to change the password. Change-Id: Ib11bef93b6b0c74063052875fa361290bf1e92fd Depends-On: If7af97df7a011569a7e14fbab4f880688d7b82c3 Closes-Bug: #1640806
2016-11-15Horizon service cleanups for hiera json hookDan Prince1-35/+34
This patch resolves a few issues I noticed when porting our Horizon service to support the new heat hiera agent hook (which uses Json instead of Yaml). -we only need to set django_debug if the string is non-empty. This should match previous behavior. -remove the duplicated NeutronMechanismDrivers setting. This is already managed in the neutron services and shouldn't be set here. Change-Id: I473e110bb9b14cb8f57d41c4fc398871548726b0 Partial-bug: #1596373
2016-11-09Disable password reveal in horizonAlex Schultz1-0/+1
To improve security, we should disable the password reveal option in horizon by default. An end user can override this options via their own custom hiera if they would ultimately like to have this functionality. Change-Id: Ie88dac5610840eb4b327252b32dc469099ba5f5f Depends-On: Iacf899d595a2a3c522df1b96ca527731937ec698 Closes-Bug: 1640492
2016-10-21Merge "Clarify horizon allowed hosts setting"Jenkins1-1/+2
2016-10-21Clarify horizon allowed hosts settingMatthias Runge1-1/+2
Horizon allowed hosts should name the IP addresses/ DNS names (short/long) the Horizon node is listening to. Allowed hosts is used for header checks and is a security mechanism. Change-Id: I81c96357f969a1a436eecd35eb178579159bc719
2016-09-02Merge "Remove repeated apache-related hieradata"Jenkins1-13/+0
2016-08-31Remove repeated apache-related hieradataJuan Antonio Osorio Robles1-13/+0
This is already set in the apache profile, so we shouldn't be setting it in horizon. Change-Id: I21bd2c6770f871b2940c03d4a2b1cff7d4616346
2016-08-31Availability monitoring agents supportMartin Mágr1-0/+4
- adds possibility to install sensu-client on all nodes - each composable service has it's own subscription Co-Authored-By: Emilien Macchi <emilien@redhat.com> Co-Authored-By: Michele Baldessari <michele@redhat.com> Implements: blueprint tripleo-opstools-availability-monitoring Change-Id: I6a215763fd0f0015285b3573305d18d0f56c7770
2016-08-30Mv Nova, Neutron, Horizon out of controller.yamlDan Prince1-1/+38
This patch moves the settings for Nova, Neutron, and Horizon out of controller.yaml. Also fixes the NovaPassword settings in nova-base.yaml so they don't use get_input. Also, creates a new apache.yaml base service to contain shared apache settings for several services which use Apache for WSGI. Co-Authored-By: Giulio Fidente <gfidente@redhat.com> Change-Id: I35d909bd5abc23976b5732a2b9af31cf1448838e Related-bug: #1604414
2016-08-18Add DefaultPasswords to composable servicesDan Prince1-0/+3
This patch adds a new DefaultPasswords parameter to composable services. This is needed to help provide access to top level password resources that overcloud.yaml currently manages (passwords for Rabbit, Mysql, etc.). Moving the RandomString resources into composable services would cause them to regenerate within the stack. With this approach we can leave them where they are while we deprecate the top level mechanism and move the code that uses the passwords into the composable services. Change-Id: I4f21603c58a169a093962594e860933306879e3f
2016-08-18Pass ServiceNetMap to servicesGiulio Fidente1-0/+6
This will be needed to pick the network where the service has to bind to from within the service template. Change-Id: I52652e1ad8c7b360efd2c7af199e35932aaaea8c
2016-07-27Migrate Puppet Hieradata to composable servicesEmilien Macchi1-0/+6
Migrate puppet/hieradata/*.yaml parameters to puppet/services/*.yaml except for some services that are not composable yet. Co-Authored-By: Juan Antonio Osorio Robles <jaosorior@redhat.com> Change-Id: I7e5f8b18ee9aa63a1dffc6facaf88315b07d5fd7
2016-07-25Composable firewall rulesDan Prince1-0/+5
Split out the firewall rules in puppet/hieradata/controller.yaml into the composable services Depends-On: Id370362ab57347b75b1ab25afda877885b047263 Change-Id: Icaecab100d3f278035fbbb3facb9bf6c62c76c03
2016-07-22Add 'service_name' to composable servicesDan Prince1-0/+1
This patch adds a new service_name section to each composable service. We now have an explicit unit test check to ensure that service_name exists in tools/yaml-validate.py. This patch also wires service_names into hieradata on each of the roles so that tools can access the deployed services locally during deployment and upgrades. Change-Id: I60861c5aa760534db3e314bba16a13b90ea72f0c
2016-07-11Composable Horizon service - tripleo-heat-templatesCarlos Camacho1-0/+34
Add horizon as a composable service Depends-on: Iff6508972edfd5f330b239719bc5eb14d3f71944 Change-Id: I734c3e0784c25f30adff2e13faf1155a3e45cefd Partially-implements: blueprint composable-services-within-roles