Horizon

There are various customizations you can do to tailor the deployment of OpenStack Horizon. You can find those below.

General Parameters

  • conf.horizon.apache

    • Type: string

    • Description:

    • <IfVersion < 2.4>
Listen 0.0.0.0:{{ tuple \"dashboard\" \"internal\" \"web\" . | include \"helm-toolkit.endpoints.endpoint_port_lookup\" }}
</IfVersion>
LogFormat \"%h %l %u %t \\\"%r\\\" %>s %b \\\"%{Referer}i\\\" \\\"%{User-Agent}i\\\"\" combined
LogFormat \"%{X-Forwarded-For}i %l %u %t \\\"%r\\\" %>s %b \\\"%{Referer}i\\\" \\\"%{User-Agent}i\\\"\" proxy

SetEnvIf X-Forwarded-For \"^.*\\..*\\..*\\..*\" forwarded
CustomLog /dev/stdout combined env=!forwarded
CustomLog /dev/stdout proxy env=forwarded

<VirtualHost *:{{ tuple \"dashboard\" \"internal\" \"web\" . | include \"helm-toolkit.endpoints.endpoint_port_lookup\" }}>
    WSGIApplicationGroup %{GLOBAL}
    WSGIScriptReloading On
    WSGIDaemonProcess horizon-http processes=5 threads=1 user=horizon group=horizon display-name=%{GROUP}
    WSGIProcessGroup horizon-http
    WSGIScriptAlias / /var/www/cgi-bin/horizon/django.wsgi
    WSGIPassAuthorization On
    RewriteEngine on
    RewriteCond %{REQUEST_METHOD} !^(POST|PUT|GET|DELETE|PATCH)
    RewriteRule .* - [F]

    <Location \"/\">
        Require all granted
    </Location>

    Alias /static /var/www/html/horizon
    <Location \"/static\">
        SetHandler static
    </Location>

    <IfVersion >= 2.4>
      ErrorLogFormat \"%{cu}t %M\"
    </IfVersion>
    ErrorLog /dev/stdout
    TransferLog /dev/stdout

    SetEnvIf X-Forwarded-For \"^.*\\..*\\..*\\..*\" forwarded
    CustomLog /dev/stdout combined env=!forwarded
    CustomLog /dev/stdout proxy env=forwarded
</Virtualhost>

  • conf.horizon.branding.favicon

    • Type: string

    • Description:

    • nil

  • conf.horizon.branding.logo

    • Type: string

    • Description:

    • nil

  • conf.horizon.branding.logo_splash

    • Type: string

    • Description:

    • nil

  • conf.horizon.custom_panels

    • Type: object

    • Description:

    • {}

  • conf.horizon.extra_panels[0]

    • Type: string

    • Description:

    • “heat_dashboard”

  • conf.horizon.extra_panels[1]

    • Type: string

    • Description:

    • “neutron_taas_dashboard”

  • conf.horizon.local_settings.config.allowed_hosts[0]

    • Type: string

    • Description:

    • “*”

  • conf.horizon.local_settings.config.auth.idp_mapping[0].idp

    • Type: string

    • Description:

    • “myidp1”

  • conf.horizon.local_settings.config.auth.idp_mapping[0].label

    • Type: string

    • Description:

    • “Acme Corporation - OpenID Connect”

  • conf.horizon.local_settings.config.auth.idp_mapping[0].name

    • Type: string

    • Description:

    • “acme_oidc”

  • conf.horizon.local_settings.config.auth.idp_mapping[0].protocol

    • Type: string

    • Description:

    • “oidc”

  • conf.horizon.local_settings.config.auth.idp_mapping[1].idp

    • Type: string

    • Description:

    • “myidp2”

  • conf.horizon.local_settings.config.auth.idp_mapping[1].label

    • Type: string

    • Description:

    • “Acme Corporation - SAML2”

  • conf.horizon.local_settings.config.auth.idp_mapping[1].name

    • Type: string

    • Description:

    • “acme_saml2”

  • conf.horizon.local_settings.config.auth.idp_mapping[1].protocol

    • Type: string

    • Description:

    • “saml2”

  • conf.horizon.local_settings.config.auth.sso.enabled

    • Type: bool

    • Description:

    • false

  • conf.horizon.local_settings.config.auth.sso.initial_choice

    • Type: string

    • Description:

    • “credentials”

  • conf.horizon.local_settings.config.csrf_cookie_httponly

    • Type: string

    • Description:

    • “False”

  • conf.horizon.local_settings.config.csrf_cookie_secure

    • Type: string

    • Description:

    • “False”

  • conf.horizon.local_settings.config.csrf_trusted_origins

    • Type: list

    • Description:

    • []

  • conf.horizon.local_settings.config.debug

    • Type: string

    • Description:

    • “False”

  • conf.horizon.local_settings.config.disable_password_reveal

    • Type: string

    • Description:

    • “True”

  • conf.horizon.local_settings.config.disallow_iframe_embed

    • Type: string

    • Description:

    • “False”

  • conf.horizon.local_settings.config.enable_pwd_validator

    • Type: bool

    • Description:

    • false

  • conf.horizon.local_settings.config.endpoint_type

    • Type: string

    • Description:

    • “internalURL”

  • conf.horizon.local_settings.config.enforce_password_check

    • Type: string

    • Description:

    • “True”

  • conf.horizon.local_settings.config.horizon_images_upload_mode

    • Type: string

    • Description:

    • “legacy”

  • conf.horizon.local_settings.config.horizon_secret_key

    • Type: string

    • Description:

    • “9aee62c0-5253-4a86-b189-e0fb71fa503c”

  • conf.horizon.local_settings.config.keystone_default_domain

    • Type: string

    • Description:

    • “Default”

  • conf.horizon.local_settings.config.keystone_multidomain_support

    • Type: string

    • Description:

    • “True”

  • conf.horizon.local_settings.config.log_level

    • Type: string

    • Description:

    • “DEBUG”

  • conf.horizon.local_settings.config.openstack_api_versions.container_infra

    • Type: string

    • Description:

    • “1.10”

  • conf.horizon.local_settings.config.openstack_cinder_features.enable_backup

    • Type: string

    • Description:

    • “True”

  • conf.horizon.local_settings.config.openstack_enable_password_retrieve

    • Type: string

    • Description:

    • “False”

  • conf.horizon.local_settings.config.openstack_neutron_network.enable_distributed_router

    • Type: string

    • Description:

    • “False”

  • conf.horizon.local_settings.config.openstack_neutron_network.enable_fip_topology_check

    • Type: string

    • Description:

    • “True”

  • conf.horizon.local_settings.config.openstack_neutron_network.enable_firewall

    • Type: string

    • Description:

    • “True”

  • conf.horizon.local_settings.config.openstack_neutron_network.enable_ha_router

    • Type: string

    • Description:

    • “False”

  • conf.horizon.local_settings.config.openstack_neutron_network.enable_ipv6

    • Type: string

    • Description:

    • “True”

  • conf.horizon.local_settings.config.openstack_neutron_network.enable_lb

    • Type: string

    • Description:

    • “True”

  • conf.horizon.local_settings.config.openstack_neutron_network.enable_quotas

    • Type: string

    • Description:

    • “True”

  • conf.horizon.local_settings.config.openstack_neutron_network.enable_router

    • Type: string

    • Description:

    • “True”

  • conf.horizon.local_settings.config.openstack_neutron_network.enable_vpn

    • Type: string

    • Description:

    • “True”

  • conf.horizon.local_settings.config.password_autocomplete

    • Type: string

    • Description:

    • “False”

  • conf.horizon.local_settings.config.pwd_validator_help_text

    • Type: string

    • Description:

    • “_("Your password must be at least eight (8) characters in length and must include characters from at least two (2) of these groupings: alpha, numeric, and special characters.")”

  • conf.horizon.local_settings.config.pwd_validator_regex

    • Type: string

    • Description:

    • “(?=.*[a-zA-Z])(?=.*\d).{8,}|(?=.*\d)(?=.*\W).{8,}|(?=.*\W)(?=.*[a-zA-Z]).{8,}”

  • conf.horizon.local_settings.config.raw

    • Type: object

    • Description:

    • {}

  • conf.horizon.local_settings.config.secure_proxy_ssl_header

    • Type: bool

    • Description:

    • false

  • conf.horizon.local_settings.config.session_cookie_httponly

    • Type: string

    • Description:

    • “False”

  • conf.horizon.local_settings.config.session_cookie_secure

    • Type: string

    • Description:

    • “False”

  • conf.horizon.local_settings.config.show_openrc_file

    • Type: string

    • Description:

    • “True”

  • conf.horizon.local_settings.config.use_ssl

    • Type: string

    • Description:

    • “False”

  • conf.horizon.local_settings.template

    • Type: string

    • Description:

    • import os

from django.utils.translation import gettext_lazy as _

from openstack_dashboard import exceptions

DEBUG = {{ .Values.conf.horizon.local_settings.config.debug }}
TEMPLATE_DEBUG = DEBUG

COMPRESS_OFFLINE = True
COMPRESS_CSS_HASHING_METHOD = \"hash\"

# WEBROOT is the location relative to Webserver root
# should end with a slash.
WEBROOT = '/'
# LOGIN_URL = WEBROOT + 'auth/login/'
# LOGOUT_URL = WEBROOT + 'auth/logout/'
#
# LOGIN_REDIRECT_URL can be used as an alternative for
# HORIZON_CONFIG.user_home, if user_home is not set.
# Do not set it to '/home/', as this will cause circular redirect loop
# LOGIN_REDIRECT_URL = WEBROOT

# Required for Django 1.5.
# If horizon is running in production (DEBUG is False), set this
# with the list of host/domain names that the application can serve.
# For more information see:
# https://docs.djangoproject.com/en/dev/ref/settings/#allowed-hosts
ALLOWED_HOSTS = [{{ include \"helm-toolkit.utils.joinListWithCommaAndSingleQuotes\" .Values.conf.horizon.local_settings.config.allowed_hosts }},'%s' % (os.environ.get(\"MY_POD_IP\"))]

# Set SSL proxy settings:
# For Django 1.4+ pass this header from the proxy after terminating the SSL,
# and don't forget to strip it from the client's request.
# For more information see:
# https://docs.djangoproject.com/en/1.4/ref/settings/#secure-proxy-ssl-header
#SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTOCOL', 'https')
# https://docs.djangoproject.com/en/1.5/ref/settings/#secure-proxy-ssl-header
{{- if .Values.conf.horizon.local_settings.config.secure_proxy_ssl_header }}
SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
{{- end }}

# If Horizon is being served through SSL, then uncomment the following two
# settings to better secure the cookies from security exploits
USE_SSL = {{ .Values.conf.horizon.local_settings.config.use_ssl }}
CSRF_COOKIE_SECURE = {{ .Values.conf.horizon.local_settings.config.csrf_cookie_secure }}
CSRF_COOKIE_HTTPONLY = {{ .Values.conf.horizon.local_settings.config.csrf_cookie_httponly }}
SESSION_COOKIE_SECURE = {{ .Values.conf.horizon.local_settings.config.session_cookie_secure }}

SESSION_COOKIE_HTTPONLY = {{ .Values.conf.horizon.local_settings.config.session_cookie_httponly }}

# https://docs.djangoproject.com/en/dev/ref/settings/#csrf-trusted-origins
CSRF_TRUSTED_ORIGINS = [{{ include \"helm-toolkit.utils.joinListWithCommaAndSingleQuotes\" .Values.conf.horizon.local_settings.config.csrf_trusted_origins }}]

# Overrides for OpenStack API versions. Use this setting to force the
# OpenStack dashboard to use a specific API version for a given service API.
# Versions specified here should be integers or floats, not strings.
# NOTE: The version should be formatted as it appears in the URL for the
# service API. For example, The identity service APIs have inconsistent
# use of the decimal point, so valid options would be 2.0 or 3.
#OPENSTACK_API_VERSIONS = {
#    \"data-processing\": 1.1,
#    \"identity\": 3,
#    \"volume\": 2,
#}

OPENSTACK_API_VERSIONS = {
    \"identity\": 3,
    \"container-infra\": \"{{ .Values.conf.horizon.local_settings.config.openstack_api_versions.container_infra }}\"
}

# Set this to True if running on multi-domain model. When this is enabled, it
# will require user to enter the Domain name in addition to username for login.
OPENSTACK_KEYSTONE_MULTIDOMAIN_SUPPORT = {{ .Values.conf.horizon.local_settings.config.keystone_multidomain_support }}

# Overrides the default domain used when running on single-domain model
# with Keystone V3. All entities will be created in the default domain.
OPENSTACK_KEYSTONE_DEFAULT_DOMAIN = '{{ .Values.conf.horizon.local_settings.config.keystone_default_domain }}'

# Set Console type:
# valid options are \"AUTO\"(default), \"VNC\", \"SPICE\", \"RDP\", \"SERIAL\" or None
# Set to None explicitly if you want to deactivate the console.
#CONSOLE_TYPE = \"AUTO\"

# Default OpenStack Dashboard configuration.
HORIZON_CONFIG = {
    'user_home': 'openstack_dashboard.views.get_user_home',
    'ajax_queue_limit': 10,
    'auto_fade_alerts': {
        'delay': 3000,
        'fade_duration': 1500,
        'types': ['alert-success', 'alert-info']
    },
    'help_url': \"http://docs.openstack.org\",
    'exceptions': {'recoverable': exceptions.RECOVERABLE,
                   'not_found': exceptions.NOT_FOUND,
                   'unauthorized': exceptions.UNAUTHORIZED},
    'modal_backdrop': 'static',
    'angular_modules': [],
    'js_files': [],
    'js_spec_files': [],
}

{{- if .Values.conf.horizon.local_settings.config.enable_pwd_validator }}
# Specify a regular expression to validate user passwords.
HORIZON_CONFIG[\"password_validator\"] = {
    \"regex\": '{{ .Values.conf.horizon.local_settings.config.pwd_validator_regex }}',
    \"help_text\": {{ .Values.conf.horizon.local_settings.config.pwd_validator_help_text }},
}
{{- end }}

# Disable simplified floating IP address management for deployments with
# multiple floating IP pools or complex network requirements.
#HORIZON_CONFIG[\"simple_ip_management\"] = False

# Turn off browser autocompletion for forms including the login form and
# the database creation workflow if so desired.
HORIZON_CONFIG[\"password_autocomplete\"] = '{{ .Values.conf.horizon.local_settings.config.password_autocomplete }}'

# Setting this to True will disable the reveal button for password fields,
# including on the login form.
HORIZON_CONFIG[\"disable_password_reveal\"] = {{ .Values.conf.horizon.local_settings.config.disable_password_reveal }}

LOCAL_PATH = '/tmp'

# Set custom secret key:
# You can either set it to a specific value or you can let horizon generate a
# default secret key that is unique on this machine, e.i. regardless of the
# amount of Python WSGI workers (if used behind Apache+mod_wsgi): However,
# there may be situations where you would want to set this explicitly, e.g.
# when multiple dashboard instances are distributed on different machines
# (usually behind a load-balancer). Either you have to make sure that a session
# gets all requests routed to the same dashboard instance or you set the same
# SECRET_KEY for all of them.
SECRET_KEY='{{ .Values.conf.horizon.local_settings.config.horizon_secret_key }}'

CACHES = {
    'default': {
        'BACKEND': 'django.core.cache.backends.memcached.PyMemcacheCache',
        'LOCATION': '{{ tuple \"oslo_cache\" \"internal\" \"memcache\" . | include \"helm-toolkit.endpoints.host_and_port_endpoint_uri_lookup\" }}',
    }
}
DATABASES = {
    'default': {
        # Database configuration here
        'ENGINE': 'django.db.backends.mysql',
        'NAME': '{{ .Values.endpoints.oslo_db.path | base }}',
        'USER': '{{ .Values.endpoints.oslo_db.auth.horizon.username }}',
        'PASSWORD': '{{ .Values.endpoints.oslo_db.auth.horizon.password }}',
        'HOST': '{{ tuple \"oslo_db\" \"internal\" . | include \"helm-toolkit.endpoints.hostname_fqdn_endpoint_lookup\" }}',
        'default-character-set': 'utf8',
        {{- if .Values.manifests.certificates }}
        'OPTIONS':{
            'ssl': {
                'ca': '/etc/mysql/certs/ca.crt',
                'cert': '/etc/mysql/certs/tls.crt',
                'key': '/etc/mysql/certs/tls.key'
            }
        },
        {{- end }}
        'PORT': '{{ tuple \"oslo_db\" \"internal\" \"mysql\" . | include \"helm-toolkit.endpoints.endpoint_port_lookup\" }}'
    }
}
SESSION_ENGINE = 'django.contrib.sessions.backends.cached_db'

# Send email to the console by default
EMAIL_BACKEND = 'django.core.mail.backends.console.EmailBackend'
# Or send them to /dev/null
#EMAIL_BACKEND = 'django.core.mail.backends.dummy.EmailBackend'

# Configure these for your outgoing email host
#EMAIL_HOST = 'smtp.my-company.com'
#EMAIL_PORT = 25\\\\
#EMAIL_HOST_USER = 'djangomail'
#EMAIL_HOST_PASSWORD = 'top-secret!'

# For multiple regions uncomment this configuration, and add (endpoint, title).
#AVAILABLE_REGIONS = [
#    ('http://cluster1.example.com:5000/v2.0', 'cluster1'),
#    ('http://cluster2.example.com:5000/v2.0', 'cluster2'),
#]

OPENSTACK_KEYSTONE_URL = \"{{ tuple \"identity\" \"internal\" \"api\" . | include \"helm-toolkit.endpoints.keystone_endpoint_uri_lookup\" }}\"
OPENSTACK_KEYSTONE_DEFAULT_ROLE = \"member\"

# This setting specifies the name of the header with remote IP address. If not present,
# then REMOTE_ADDR header is used. The commom value for this setting is HTTP_X_REAL_IP
# or HTTP_X_FORWARDED_FORx
SECURE_PROXY_ADDR_HEADER = 'HTTP_X_FORWARDED_FOR'

{{- if .Values.conf.horizon.local_settings.config.auth.sso.enabled }}
# Enables keystone web single-sign-on if set to True.
WEBSSO_ENABLED = True

# Determines which authentication choice to show as default.
WEBSSO_INITIAL_CHOICE = \"{{ .Values.conf.horizon.local_settings.config.auth.sso.initial_choice }}\"

{{- if .Values.conf.horizon.local_settings.config.auth.sso.websso_keystone_url }}
# The full auth URL for the Keystone endpoint used for web single-sign-on authentication.
WEBSSO_KEYSTONE_URL = \"{{ .Values.conf.horizon.local_settings.config.auth.sso.websso_keystone_url }}\"
{{- end }}

# The list of authentication mechanisms
# which include keystone federation protocols.
# Current supported protocol IDs are 'saml2' and 'oidc'
# which represent SAML 2.0, OpenID Connect respectively.
# Do not remove the mandatory credentials mechanism.
WEBSSO_CHOICES = (
    (\"credentials\", _(\"Keystone Credentials\")),
  {{- range $i, $sso := .Values.conf.horizon.local_settings.config.auth.idp_mapping }}
    ({{ $sso.name | quote }}, {{ $sso.label | quote }}),
  {{- end }}
)

WEBSSO_IDP_MAPPING = {
  {{- range $i, $sso := .Values.conf.horizon.local_settings.config.auth.idp_mapping }}
    {{ $sso.name | quote}}: ({{ $sso.idp | quote }}, {{ $sso.protocol | quote }}),
  {{- end }}
}

{{- end }}

# Disable SSL certificate checks (useful for self-signed certificates):
#OPENSTACK_SSL_NO_VERIFY = True

{{- if .Values.manifests.certificates }}
# The CA certificate to use to verify SSL connections
OPENSTACK_SSL_CACERT = '/etc/openstack-dashboard/certs/ca.crt'
{{- end }}

# The OPENSTACK_KEYSTONE_BACKEND settings can be used to identify the
# capabilities of the auth backend for Keystone.
# If Keystone has been configured to use LDAP as the auth backend then set
# can_edit_user to False and name to 'ldap'.
#
# TODO(tres): Remove these once Keystone has an API to identify auth backend.
OPENSTACK_KEYSTONE_BACKEND = {
    'name': 'native',
    'can_edit_user': True,
    'can_edit_group': True,
    'can_edit_project': True,
    'can_edit_domain': True,
    'can_edit_role': True,
}

# Setting this to True, will add a new \"Retrieve Password\" action on instance,
# allowing Admin session password retrieval/decryption.
OPENSTACK_ENABLE_PASSWORD_RETRIEVE = {{ .Values.conf.horizon.local_settings.config.openstack_enable_password_retrieve }}
# Controls whether the keystone openrc file is accessible from the user menu and the api access panel.
SHOW_OPENRC_FILE = {{ .Values.conf.horizon.local_settings.config.show_openrc_file }}
# The Launch Instance user experience has been significantly enhanced.
# You can choose whether to enable the new launch instance experience,
# the legacy experience, or both. The legacy experience will be removed
# in a future release, but is available as a temporary backup setting to ensure
# compatibility with existing deployments. Further development will not be
# done on the legacy experience. Please report any problems with the new
# experience via the StoryBoard tracking system.
#
# Toggle LAUNCH_INSTANCE_LEGACY_ENABLED and LAUNCH_INSTANCE_NG_ENABLED to
# determine the experience to enable.  Set them both to true to enable
# both.
#LAUNCH_INSTANCE_LEGACY_ENABLED = True
#LAUNCH_INSTANCE_NG_ENABLED = False

# The Xen Hypervisor has the ability to set the mount point for volumes
# attached to instances (other Hypervisors currently do not). Setting
# can_set_mount_point to True will add the option to set the mount point
# from the UI.
OPENSTACK_HYPERVISOR_FEATURES = {
    'can_set_mount_point': False,
    'can_set_password': False,
}

# The OPENSTACK_CINDER_FEATURES settings can be used to enable optional
# services provided by cinder that is not exposed by its extension API.
OPENSTACK_CINDER_FEATURES = {
    'enable_backup': {{ .Values.conf.horizon.local_settings.config.openstack_cinder_features.enable_backup }},
}

# The OPENSTACK_NEUTRON_NETWORK settings can be used to enable optional
# services provided by neutron. Options currently available are load
# balancer service, security groups, quotas, VPN service.
OPENSTACK_NEUTRON_NETWORK = {
    'enable_router': {{ .Values.conf.horizon.local_settings.config.openstack_neutron_network.enable_router }},
    'enable_quotas': {{ .Values.conf.horizon.local_settings.config.openstack_neutron_network.enable_quotas }},
    'enable_ipv6': {{ .Values.conf.horizon.local_settings.config.openstack_neutron_network.enable_ipv6 }},
    'enable_distributed_router': {{ .Values.conf.horizon.local_settings.config.openstack_neutron_network.enable_distributed_router }},
    'enable_ha_router': {{ .Values.conf.horizon.local_settings.config.openstack_neutron_network.enable_ha_router }},
    'enable_lb': {{ .Values.conf.horizon.local_settings.config.openstack_neutron_network.enable_lb }},
    'enable_firewall': {{ .Values.conf.horizon.local_settings.config.openstack_neutron_network.enable_firewall }},
    'enable_vpn': {{ .Values.conf.horizon.local_settings.config.openstack_neutron_network.enable_vpn }},
    'enable_fip_topology_check': {{ .Values.conf.horizon.local_settings.config.openstack_neutron_network.enable_fip_topology_check }},

    # The profile_support option is used to detect if an external router can be
    # configured via the dashboard. When using specific plugins the
    # profile_support can be turned on if needed.
    'profile_support': None,
    #'profile_support': 'cisco',

    # Set which provider network types are supported. Only the network types
    # in this list will be available to choose from when creating a network.
    # Network types include local, flat, vlan, gre, and vxlan.
    'supported_provider_types': ['*'],

    # Set which VNIC types are supported for port binding. Only the VNIC
    # types in this list will be available to choose from when creating a
    # port.
    # VNIC types include 'normal', 'macvtap' and 'direct'.
    'supported_vnic_types': ['*']
}

# The OPENSTACK_IMAGE_BACKEND settings can be used to customize features
# in the OpenStack Dashboard related to the Image service, such as the list
# of supported image formats.
#OPENSTACK_IMAGE_BACKEND = {
#    'image_formats': [
#        ('', _('Select format')),
#        ('aki', _('AKI - Amazon Kernel Image')),
#        ('ami', _('AMI - Amazon Machine Image')),
#        ('ari', _('ARI - Amazon Ramdisk Image')),
#        ('docker', _('Docker')),
#        ('iso', _('ISO - Optical Disk Image')),
#        ('ova', _('OVA - Open Virtual Appliance')),
#        ('qcow2', _('QCOW2 - QEMU Emulator')),
#        ('raw', _('Raw')),
#        ('vdi', _('VDI - Virtual Disk Image')),
#        ('vhd', ('VHD - Virtual Hard Disk')),
#        ('vmdk', _('VMDK - Virtual Machine Disk')),
#    ]
#}

# The IMAGE_CUSTOM_PROPERTY_TITLES settings is used to customize the titles for
# image custom property attributes that appear on image detail pages.
IMAGE_CUSTOM_PROPERTY_TITLES = {
    \"architecture\": _(\"Architecture\"),
    \"kernel_id\": _(\"Kernel ID\"),
    \"ramdisk_id\": _(\"Ramdisk ID\"),
    \"image_state\": _(\"Euca2ools state\"),
    \"project_id\": _(\"Project ID\"),
    \"image_type\": _(\"Image Type\"),
}

# The IMAGE_RESERVED_CUSTOM_PROPERTIES setting is used to specify which image
# custom properties should not be displayed in the Image Custom Properties
# table.
IMAGE_RESERVED_CUSTOM_PROPERTIES = []

# Set to 'legacy' or 'direct' to allow users to upload images to glance via
# Horizon server. When enabled, a file form field will appear on the create
# image form. If set to 'off', there will be no file form field on the create
# image form. See documentation for deployment considerations.
HORIZON_IMAGES_UPLOAD_MODE = '{{ .Values.conf.horizon.local_settings.config.horizon_images_upload_mode }}'

# OPENSTACK_ENDPOINT_TYPE specifies the endpoint type to use for the endpoints
# in the Keystone service catalog. Use this setting when Horizon is running
# external to the OpenStack environment. The default is 'publicURL'.
OPENSTACK_ENDPOINT_TYPE = \"{{ .Values.conf.horizon.local_settings.config.endpoint_type }}\"

# SECONDARY_ENDPOINT_TYPE specifies the fallback endpoint type to use in the
# case that OPENSTACK_ENDPOINT_TYPE is not present in the endpoints
# in the Keystone service catalog. Use this setting when Horizon is running
# external to the OpenStack environment. The default is None.  This
# value should differ from OPENSTACK_ENDPOINT_TYPE if used.
SECONDARY_ENDPOINT_TYPE = \"publicURL\"

# The number of objects (Swift containers/objects or images) to display
# on a single page before providing a paging element (a \"more\" link)
# to paginate results.
API_RESULT_LIMIT = 1000
API_RESULT_PAGE_SIZE = 20

# The size of chunk in bytes for downloading objects from Swift
SWIFT_FILE_TRANSFER_CHUNK_SIZE = 512 * 1024

# Specify a maximum number of items to display in a dropdown.
DROPDOWN_MAX_ITEMS = 30

# The timezone of the server. This should correspond with the timezone
# of your entire OpenStack installation, and hopefully be in UTC.
TIME_ZONE = \"UTC\"

# When launching an instance, the menu of available flavors is
# sorted by RAM usage, ascending. If you would like a different sort order,
# you can provide another flavor attribute as sorting key. Alternatively, you
# can provide a custom callback method to use for sorting. You can also provide
# a flag for reverse sort. For more info, see
# http://docs.python.org/2/library/functions.html#sorted
#CREATE_INSTANCE_FLAVOR_SORT = {
#    'key': 'name',
#     # or
#    'key': my_awesome_callback_method,
#    'reverse': False,
#}

# Set this to True to display an 'Admin Password' field on the Change Password
# form to verify that it is indeed the admin logged-in who wants to change
# the password.
ENFORCE_PASSWORD_CHECK = {{ .Values.conf.horizon.local_settings.config.enforce_password_check }}

# Modules that provide /auth routes that can be used to handle different types
# of user authentication. Add auth plugins that require extra route handling to
# this list.
#AUTHENTICATION_URLS = [
#    'openstack_auth.urls',
#]

# The Horizon Policy Enforcement engine uses these values to load per service
# policy rule files. The content of these files should match the files the
# OpenStack services are using to determine role based access control in the
# target installation.

# Path to directory containing policy.yaml files
POLICY_FILES_PATH = '/etc/openstack-dashboard'
# Map of local copy of service policy files
#POLICY_FILES = {
#    'identity': 'keystone_policy.yaml',
#    'compute': 'nova_policy.yaml',
#    'volume': 'cinder_policy.yaml',
#    'image': 'glance_policy.yaml',
#    'orchestration': 'heat_policy.yaml',
#    'network': 'neutron_policy.yaml',
#    'telemetry': 'ceilometer_policy.yaml',
#}

# Trove user and database extension support. By default support for
# creating users and databases on database instances is turned on.
# To disable these extensions set the permission here to something
# unusable such as [\"!\"].
# TROVE_ADD_USER_PERMS = []
# TROVE_ADD_DATABASE_PERMS = []

# Change this patch to the appropriate static directory containing
# two files: _variables.scss and _styles.scss
#CUSTOM_THEME_PATH = 'static/themes/default'

LOGGING = {
    'version': 1,
    # When set to True this will disable all logging except
    # for loggers specified in this configuration dictionary. Note that
    # if nothing is specified here and disable_existing_loggers is True,
    # django.db.backends will still log unless it is disabled explicitly.
    'disable_existing_loggers': False,
    'handlers': {
        'null': {
            'level': 'DEBUG',
            'class': 'logging.NullHandler',
        },
        'console': {
            # Set the level to \"DEBUG\" for verbose output logging.
            'level': 'INFO',
            'class': 'logging.StreamHandler',
        },
    },
    'loggers': {
        # Logging from django.db.backends is VERY verbose, send to null
        # by default.
        'django.db.backends': {
            'handlers': ['null'],
            'propagate': False,
        },
        'requests': {
            'handlers': ['null'],
            'propagate': False,
        },
        'horizon': {
            'handlers': ['console'],
            'level': '{{ .Values.conf.horizon.local_settings.config.log_level }}',
            'propagate': False,
        },
        'openstack_dashboard': {
            'handlers': ['console'],
            'level': '{{ .Values.conf.horizon.local_settings.config.log_level }}',
            'propagate': False,
        },
        'novaclient': {
            'handlers': ['console'],
            'level': '{{ .Values.conf.horizon.local_settings.config.log_level }}',
            'propagate': False,
        },
        'cinderclient': {
            'handlers': ['console'],
            'level': '{{ .Values.conf.horizon.local_settings.config.log_level }}',
            'propagate': False,
        },
        'glanceclient': {
            'handlers': ['console'],
            'level': '{{ .Values.conf.horizon.local_settings.config.log_level }}',
            'propagate': False,
        },
        'glanceclient': {
            'handlers': ['console'],
            'level': '{{ .Values.conf.horizon.local_settings.config.log_level }}',
            'propagate': False,
        },
        'neutronclient': {
            'handlers': ['console'],
            'level': '{{ .Values.conf.horizon.local_settings.config.log_level }}',
            'propagate': False,
        },
        'heatclient': {
            'handlers': ['console'],
            'level': '{{ .Values.conf.horizon.local_settings.config.log_level }}',
            'propagate': False,
        },
        'ceilometerclient': {
            'handlers': ['console'],
            'level': '{{ .Values.conf.horizon.local_settings.config.log_level }}',
            'propagate': False,
        },
        'troveclient': {
            'handlers': ['console'],
            'level': '{{ .Values.conf.horizon.local_settings.config.log_level }}',
            'propagate': False,
        },
        'swiftclient': {
            'handlers': ['console'],
            'level': '{{ .Values.conf.horizon.local_settings.config.log_level }}',
            'propagate': False,
        },
        'openstack_auth': {
            'handlers': ['console'],
            'level': '{{ .Values.conf.horizon.local_settings.config.log_level }}',
            'propagate': False,
        },
        'nose.plugins.manager': {
            'handlers': ['console'],
            'level': '{{ .Values.conf.horizon.local_settings.config.log_level }}',
            'propagate': False,
        },
        'django': {
            'handlers': ['console'],
            'level': '{{ .Values.conf.horizon.local_settings.config.log_level }}',
            'propagate': False,
        },
        'iso8601': {
            'handlers': ['null'],
            'propagate': False,
        },
        'scss': {
            'handlers': ['null'],
            'propagate': False,
        },
    }
}

# 'direction' should not be specified for all_tcp/udp/icmp.
# It is specified in the form.
SECURITY_GROUP_RULES = {
    'all_tcp': {
        'name': _('All TCP'),
        'ip_protocol': 'tcp',
        'from_port': '1',
        'to_port': '65535',
    },
    'all_udp': {
        'name': _('All UDP'),
        'ip_protocol': 'udp',
        'from_port': '1',
        'to_port': '65535',
    },
    'all_icmp': {
        'name': _('All ICMP'),
        'ip_protocol': 'icmp',
        'from_port': '-1',
        'to_port': '-1',
    },
    'ssh': {
        'name': 'SSH',
        'ip_protocol': 'tcp',
        'from_port': '22',
        'to_port': '22',
    },
    'smtp': {
        'name': 'SMTP',
        'ip_protocol': 'tcp',
        'from_port': '25',
        'to_port': '25',
    },
    'dns': {
        'name': 'DNS',
        'ip_protocol': 'tcp',
        'from_port': '53',
        'to_port': '53',
    },
    'http': {
        'name': 'HTTP',
        'ip_protocol': 'tcp',
        'from_port': '80',
        'to_port': '80',
    },
    'pop3': {
        'name': 'POP3',
        'ip_protocol': 'tcp',
        'from_port': '110',
        'to_port': '110',
    },
    'imap': {
        'name': 'IMAP',
        'ip_protocol': 'tcp',
        'from_port': '143',
        'to_port': '143',
    },
    'ldap': {
        'name': 'LDAP',
        'ip_protocol': 'tcp',
        'from_port': '389',
        'to_port': '389',
    },
    'https': {
        'name': 'HTTPS',
        'ip_protocol': 'tcp',
        'from_port': '443',
        'to_port': '443',
    },
    'smtps': {
        'name': 'SMTPS',
        'ip_protocol': 'tcp',
        'from_port': '465',
        'to_port': '465',
    },
    'imaps': {
        'name': 'IMAPS',
        'ip_protocol': 'tcp',
        'from_port': '993',
        'to_port': '993',
    },
    'pop3s': {
        'name': 'POP3S',
        'ip_protocol': 'tcp',
        'from_port': '995',
        'to_port': '995',
    },
    'ms_sql': {
        'name': 'MS SQL',
        'ip_protocol': 'tcp',
        'from_port': '1433',
        'to_port': '1433',
    },
    'mysql': {
        'name': 'MYSQL',
        'ip_protocol': 'tcp',
        'from_port': '3306',
        'to_port': '3306',
    },
    'rdp': {
        'name': 'RDP',
        'ip_protocol': 'tcp',
        'from_port': '3389',
        'to_port': '3389',
    },
}

# Deprecation Notice:
#
# The setting FLAVOR_EXTRA_KEYS has been deprecated.
# Please load extra spec metadata into the Glance Metadata Definition Catalog.
#
# The sample quota definitions can be found in:
# <glance_source>/etc/metadefs/compute-quota.json
#
# The metadata definition catalog supports CLI and API:
#  $glance --os-image-api-version 2 help md-namespace-import
#  $glance-manage db_load_metadefs <directory_with_definition_files>
#
# See Metadata Definitions on: https://docs.openstack.org/glance/latest/

# Indicate to the Sahara data processing service whether or not
# automatic floating IP allocation is in effect.  If it is not
# in effect, the user will be prompted to choose a floating IP
# pool for use in their cluster.  False by default.  You would want
# to set this to True if you were running Nova Networking with
# auto_assign_floating_ip = True.
#SAHARA_AUTO_IP_ALLOCATION_ENABLED = False

# The hash algorithm to use for authentication tokens. This must
# match the hash algorithm that the identity server and the
# auth_token middleware are using. Allowed values are the
# algorithms supported by Python's hashlib library.
#OPENSTACK_TOKEN_HASH_ALGORITHM = 'md5'

# AngularJS requires some settings to be made available to
# the client side. Some settings are required by in-tree / built-in horizon
# features. These settings must be added to REST_API_REQUIRED_SETTINGS in the
# form of ['SETTING_1','SETTING_2'], etc.
#
# You may remove settings from this list for security purposes, but do so at
# the risk of breaking a built-in horizon feature. These settings are required
# for horizon to function properly. Only remove them if you know what you
# are doing. These settings may in the future be moved to be defined within
# the enabled panel configuration.
# You should not add settings to this list for out of tree extensions.
# See: https://wiki.openstack.org/wiki/Horizon/RESTAPI
REST_API_REQUIRED_SETTINGS = ['OPENSTACK_HYPERVISOR_FEATURES',
                              'LAUNCH_INSTANCE_DEFAULTS',
                              'OPENSTACK_IMAGE_FORMATS']

# Additional settings can be made available to the client side for
# extensibility by specifying them in REST_API_ADDITIONAL_SETTINGS
# !! Please use extreme caution as the settings are transferred via HTTP/S
# and are not encrypted on the browser. This is an experimental API and
# may be deprecated in the future without notice.
#REST_API_ADDITIONAL_SETTINGS = []

# DISALLOW_IFRAME_EMBED can be used to prevent Horizon from being embedded
# within an iframe. Legacy browsers are still vulnerable to a Cross-Frame
# Scripting (XFS) vulnerability, so this option allows extra security hardening
# where iframes are not used in deployment. Default setting is True.
# For more information see:
# http://tinyurl.com/anticlickjack
DISALLOW_IFRAME_EMBED = {{ .Values.conf.horizon.local_settings.config.disallow_iframe_embed }}

STATIC_ROOT = '/var/www/html/horizon'

{{- range $option, $value := .Values.conf.horizon.local_settings.config.raw }}
{{ $option }} = {{ toJson $value }}
{{- end }}

  • conf.horizon.local_settings_d

    • Type: object

    • Description:

    • {}

  • conf.horizon.policy.ceilometer.context_is_admin

    • Type: string

    • Description:

    • “role:admin”

  • conf.horizon.policy.ceilometer.context_is_owner

    • Type: string

    • Description:

    • “user_id:%(target.user_id)s”

  • conf.horizon.policy.ceilometer.context_is_project

    • Type: string

    • Description:

    • “project_id:%(target.project_id)s”

  • conf.horizon.policy.ceilometer.segregation

    • Type: string

    • Description:

    • “rule:context_is_admin”

  • conf.horizon.policy.heat.actions:action

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.build_info:build_info

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.cloudformation:CancelUpdateStack

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.cloudformation:CreateStack

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.cloudformation:DeleteStack

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.cloudformation:DescribeStackEvents

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.cloudformation:DescribeStackResource

    • Type: string

    • Description:

    • “”

  • conf.horizon.policy.heat.cloudformation:DescribeStackResources

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.cloudformation:DescribeStacks

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.cloudformation:EstimateTemplateCost

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.cloudformation:GetTemplate

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.cloudformation:ListStackResources

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.cloudformation:ListStacks

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.cloudformation:UpdateStack

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.cloudformation:ValidateTemplate

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.cloudwatch:DeleteAlarms

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.cloudwatch:DescribeAlarmHistory

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.cloudwatch:DescribeAlarms

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.cloudwatch:DescribeAlarmsForMetric

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.cloudwatch:DisableAlarmActions

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.cloudwatch:EnableAlarmActions

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.cloudwatch:GetMetricStatistics

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.cloudwatch:ListMetrics

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.cloudwatch:PutMetricAlarm

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.cloudwatch:PutMetricData

    • Type: string

    • Description:

    • “”

  • conf.horizon.policy.heat.cloudwatch:SetAlarmState

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.context_is_admin

    • Type: string

    • Description:

    • “role:admin”

  • conf.horizon.policy.heat.deny_everybody

    • Type: string

    • Description:

    • “!”

  • conf.horizon.policy.heat.deny_stack_user

    • Type: string

    • Description:

    • “not role:heat_stack_user”

  • conf.horizon.policy.heat.events:index

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.events:show

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.resource:index

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.resource:mark_unhealthy

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.resource:metadata

    • Type: string

    • Description:

    • “”

  • conf.horizon.policy.heat.resource:show

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.resource:signal

    • Type: string

    • Description:

    • “”

  • conf.horizon.policy.heat.resource_types:OS::Cinder::EncryptedVolumeType

    • Type: string

    • Description:

    • “rule:context_is_admin”

  • conf.horizon.policy.heat.resource_types:OS::Cinder::VolumeType

    • Type: string

    • Description:

    • “rule:context_is_admin”

  • conf.horizon.policy.heat.resource_types:OS::Manila::ShareType

    • Type: string

    • Description:

    • “rule:context_is_admin”

  • conf.horizon.policy.heat.resource_types:OS::Neutron::QoSBandwidthLimitRule

    • Type: string

    • Description:

    • “rule:context_is_admin”

  • conf.horizon.policy.heat.resource_types:OS::Neutron::QoSPolicy

    • Type: string

    • Description:

    • “rule:context_is_admin”

  • conf.horizon.policy.heat.resource_types:OS::Nova::Flavor

    • Type: string

    • Description:

    • “rule:context_is_admin”

  • conf.horizon.policy.heat.resource_types:OS::Nova::HostAggregate

    • Type: string

    • Description:

    • “rule:context_is_admin”

  • conf.horizon.policy.heat.service:index

    • Type: string

    • Description:

    • “rule:context_is_admin”

  • conf.horizon.policy.heat.software_configs:create

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.software_configs:delete

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.software_configs:global_index

    • Type: string

    • Description:

    • “rule:deny_everybody”

  • conf.horizon.policy.heat.software_configs:index

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.software_configs:show

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.software_deployments:create

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.software_deployments:delete

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.software_deployments:index

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.software_deployments:metadata

    • Type: string

    • Description:

    • “”

  • conf.horizon.policy.heat.software_deployments:show

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.software_deployments:update

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.stacks:abandon

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.stacks:create

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.stacks:delete

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.stacks:delete_snapshot

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.stacks:detail

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.stacks:environment

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.stacks:export

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.stacks:generate_template

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.stacks:global_index

    • Type: string

    • Description:

    • “rule:deny_everybody”

  • conf.horizon.policy.heat.stacks:index

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.stacks:list_outputs

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.stacks:list_resource_types

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.stacks:list_snapshots

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.stacks:list_template_functions

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.stacks:list_template_versions

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.stacks:lookup

    • Type: string

    • Description:

    • “”

  • conf.horizon.policy.heat.stacks:preview

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.stacks:preview_update

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.stacks:preview_update_patch

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.stacks:resource_schema

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.stacks:restore_snapshot

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.stacks:show

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.stacks:show_output

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.stacks:show_snapshot

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.stacks:snapshot

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.stacks:template

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.stacks:update

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.stacks:update_patch

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.policy.heat.stacks:validate_template

    • Type: string

    • Description:

    • “rule:deny_stack_user”

  • conf.horizon.security

    • Type: string

    • Description:

    • #
# Disable access to the entire file system except for the directories that
# are explicitly allowed later.
#
# This currently breaks the configurations that come with some web application
# Debian packages.
#
#<Directory />
#   AllowOverride None
#   Require all denied
#</Directory>

# Changing the following options will not really affect the security of the
# server, but might make attacks slightly more difficult in some cases.

#
# ServerTokens
# This directive configures what you return as the Server HTTP response
# Header. The default is 'Full' which sends information about the OS-Type
# and compiled in modules.
# Set to one of:  Full | OS | Minimal | Minor | Major | Prod
# where Full conveys the most information, and Prod the least.
ServerTokens Prod

#
# Optionally add a line containing the server version and virtual host
# name to server-generated pages (internal error documents, FTP directory
# listings, mod_status and mod_info output etc., but not CGI generated
# documents or custom error documents).
# Set to \"EMail\" to also include a mailto: link to the ServerAdmin.
# Set to one of:  On | Off | EMail
ServerSignature Off

#
# Allow TRACE method
#
# Set to \"extended\" to also reflect the request body (only for testing and
# diagnostic purposes).
#
# Set to one of:  On | Off | extended
TraceEnable Off

#
# Forbid access to version control directories
#
# If you use version control systems in your document root, you should
# probably deny access to their directories. For example, for subversion:
#
#<DirectoryMatch \"/\\.svn\">
#   Require all denied
#</DirectoryMatch>

#Security-Settings
# Setting this header will prevent MSIE from interpreting files as something
# else than declared by the content type in the HTTP headers.
# Requires mod_headers to be enabled.
#
Header set X-Content-Type-Options: \"nosniff\"
Header set X-Permitted-Cross-Domain-Policies: \"none\"
# Setting this header will prevent other sites from embedding pages from this
# site as frames. This defends against clickjacking attacks.
# Requires mod_headers to be enabled.
#

  • conf.software.apache2.a2dismod[0]

    • Type: string

    • Description:

    • “status”

  • conf.software.apache2.a2enmod[0]

    • Type: string

    • Description:

    • “headers”

  • conf.software.apache2.a2enmod[1]

    • Type: string

    • Description:

    • “rewrite”

  • conf.software.apache2.binary

    • Type: string

    • Description:

    • “apache2”

  • conf.software.apache2.conf_dir

    • Type: string

    • Description:

    • “/etc/apache2/conf-available”

  • conf.software.apache2.mods_dir

    • Type: string

    • Description:

    • “/etc/apache2/mods-available”

  • conf.software.apache2.site_dir

    • Type: string

    • Description:

    • “/etc/apache2/sites-available”

  • conf.software.apache2.start_parameters

    • Type: string

    • Description:

    • “-DFOREGROUND”

  • dependencies.dynamic.common.local_image_registry.jobs[0]

    • Type: string

    • Description:

    • “horizon-image-repo-sync”

  • dependencies.dynamic.common.local_image_registry.services[0].endpoint

    • Type: string

    • Description:

    • “node”

  • dependencies.dynamic.common.local_image_registry.services[0].service

    • Type: string

    • Description:

    • “local_image_registry”

  • dependencies.static.dashboard.jobs[0]

    • Type: string

    • Description:

    • “horizon-db-sync”

  • dependencies.static.dashboard.services[0].endpoint

    • Type: string

    • Description:

    • “internal”

  • dependencies.static.dashboard.services[0].service

    • Type: string

    • Description:

    • “oslo_cache”

  • dependencies.static.dashboard.services[1].endpoint

    • Type: string

    • Description:

    • “internal”

  • dependencies.static.dashboard.services[1].service

    • Type: string

    • Description:

    • “oslo_db”

  • dependencies.static.dashboard.services[2].endpoint

    • Type: string

    • Description:

    • “internal”

  • dependencies.static.dashboard.services[2].service

    • Type: string

    • Description:

    • “identity”

  • dependencies.static.db_drop.services[0].endpoint

    • Type: string

    • Description:

    • “internal”

  • dependencies.static.db_drop.services[0].service

    • Type: string

    • Description:

    • “oslo_db”

  • dependencies.static.db_init.services[0].endpoint

    • Type: string

    • Description:

    • “internal”

  • dependencies.static.db_init.services[0].service

    • Type: string

    • Description:

    • “oslo_db”

  • dependencies.static.db_sync.jobs[0]

    • Type: string

    • Description:

    • “horizon-db-init”

  • dependencies.static.db_sync.services[0].endpoint

    • Type: string

    • Description:

    • “internal”

  • dependencies.static.db_sync.services[0].service

    • Type: string

    • Description:

    • “oslo_db”

  • dependencies.static.image_repo_sync.services[0].endpoint

    • Type: string

    • Description:

    • “internal”

  • dependencies.static.image_repo_sync.services[0].service

    • Type: string

    • Description:

    • “local_image_registry”

  • dependencies.static.tests.services[0].endpoint

    • Type: string

    • Description:

    • “internal”

  • dependencies.static.tests.services[0].service

    • Type: string

    • Description:

    • “dashboard”

  • endpoints.cluster_domain_suffix

    • Type: string

    • Description:

    • “cluster.local”

  • endpoints.dashboard.host_fqdn_override.default

    • Type: string

    • Description:

    • nil

  • endpoints.dashboard.hosts.default

    • Type: string

    • Description:

    • “horizon-int”

  • endpoints.dashboard.hosts.public

    • Type: string

    • Description:

    • “horizon”

  • endpoints.dashboard.name

    • Type: string

    • Description:

    • “horizon”

  • endpoints.dashboard.path.default

    • Type: string

    • Description:

    • nil

  • endpoints.dashboard.port.web.default

    • Type: int

    • Description:

    • 80

  • endpoints.dashboard.scheme.default

    • Type: string

    • Description:

    • “http”

  • endpoints.identity.auth.admin.password

    • Type: string

    • Description:

    • “password”

  • endpoints.identity.auth.admin.project_domain_name

    • Type: string

    • Description:

    • “default”

  • endpoints.identity.auth.admin.project_name

    • Type: string

    • Description:

    • “admin”

  • endpoints.identity.auth.admin.region_name

    • Type: string

    • Description:

    • “RegionOne”

  • endpoints.identity.auth.admin.user_domain_name

    • Type: string

    • Description:

    • “default”

  • endpoints.identity.auth.admin.username

    • Type: string

    • Description:

    • “admin”

  • endpoints.identity.host_fqdn_override.default

    • Type: string

    • Description:

    • nil

  • endpoints.identity.hosts.default

    • Type: string

    • Description:

    • “keystone”

  • endpoints.identity.hosts.internal

    • Type: string

    • Description:

    • “keystone-api”

  • endpoints.identity.name

    • Type: string

    • Description:

    • “keystone”

  • endpoints.identity.path.default

    • Type: string

    • Description:

    • “/v3”

  • endpoints.identity.port.api.default

    • Type: int

    • Description:

    • 80

  • endpoints.identity.port.api.internal

    • Type: int

    • Description:

    • 5000

  • endpoints.identity.scheme.default

    • Type: string

    • Description:

    • “http”

  • endpoints.ingress.hosts.default

    • Type: string

    • Description:

    • “ingress”

  • endpoints.ingress.name

    • Type: string

    • Description:

    • “ingress”

  • endpoints.ingress.namespace

    • Type: string

    • Description:

    • nil

  • endpoints.ingress.port.ingress.default

    • Type: int

    • Description:

    • 80

  • endpoints.kube_dns.host_fqdn_override.default

    • Type: string

    • Description:

    • nil

  • endpoints.kube_dns.hosts.default

    • Type: string

    • Description:

    • “kube-dns”

  • endpoints.kube_dns.name

    • Type: string

    • Description:

    • “kubernetes-dns”

  • endpoints.kube_dns.namespace

    • Type: string

    • Description:

    • “kube-system”

  • endpoints.kube_dns.path.default

    • Type: string

    • Description:

    • nil

  • endpoints.kube_dns.port.dns.default

    • Type: int

    • Description:

    • 53

  • endpoints.kube_dns.port.dns.protocol

    • Type: string

    • Description:

    • “UDP”

  • endpoints.kube_dns.scheme

    • Type: string

    • Description:

    • “http”

  • endpoints.local_image_registry.host_fqdn_override.default

    • Type: string

    • Description:

    • nil

  • endpoints.local_image_registry.hosts.default

    • Type: string

    • Description:

    • “localhost”

  • endpoints.local_image_registry.hosts.internal

    • Type: string

    • Description:

    • “docker-registry”

  • endpoints.local_image_registry.hosts.node

    • Type: string

    • Description:

    • “localhost”

  • endpoints.local_image_registry.name

    • Type: string

    • Description:

    • “docker-registry”

  • endpoints.local_image_registry.namespace

    • Type: string

    • Description:

    • “docker-registry”

  • endpoints.local_image_registry.port.registry.node

    • Type: int

    • Description:

    • 5000

  • endpoints.oci_image_registry.auth.enabled

    • Type: bool

    • Description:

    • false

  • endpoints.oci_image_registry.auth.horizon.password

    • Type: string

    • Description:

    • “password”

  • endpoints.oci_image_registry.auth.horizon.username

    • Type: string

    • Description:

    • “horizon”

  • endpoints.oci_image_registry.host_fqdn_override.default

    • Type: string

    • Description:

    • nil

  • endpoints.oci_image_registry.hosts.default

    • Type: string

    • Description:

    • “localhost”

  • endpoints.oci_image_registry.name

    • Type: string

    • Description:

    • “oci-image-registry”

  • endpoints.oci_image_registry.namespace

    • Type: string

    • Description:

    • “oci-image-registry”

  • endpoints.oci_image_registry.port.registry.default

    • Type: string

    • Description:

    • nil

  • endpoints.oslo_cache.host_fqdn_override.default

    • Type: string

    • Description:

    • nil

  • endpoints.oslo_cache.hosts.default

    • Type: string

    • Description:

    • “memcached”

  • endpoints.oslo_cache.port.memcache.default

    • Type: int

    • Description:

    • 11211

  • endpoints.oslo_db.auth.admin.password

    • Type: string

    • Description:

    • “password”

  • endpoints.oslo_db.auth.admin.secret.tls.internal

    • Type: string

    • Description:

    • “mariadb-tls-direct”

  • endpoints.oslo_db.auth.admin.username

    • Type: string

    • Description:

    • “root”

  • endpoints.oslo_db.auth.horizon.password

    • Type: string

    • Description:

    • “password”

  • endpoints.oslo_db.auth.horizon.username

    • Type: string

    • Description:

    • “horizon”

  • endpoints.oslo_db.host_fqdn_override.default

    • Type: string

    • Description:

    • nil

  • endpoints.oslo_db.hosts.default

    • Type: string

    • Description:

    • “mariadb”

  • endpoints.oslo_db.path

    • Type: string

    • Description:

    • “/horizon”

  • endpoints.oslo_db.port.mysql.default

    • Type: int

    • Description:

    • 3306

  • endpoints.oslo_db.scheme

    • Type: string

    • Description:

    • “mysql+pymysql”

  • helm3_hook

    • Type: bool

    • Description:

    • true

  • images.local_registry.active

    • Type: bool

    • Description:

    • false

  • images.local_registry.exclude[0]

    • Type: string

    • Description:

    • “dep_check”

  • images.local_registry.exclude[1]

    • Type: string

    • Description:

    • “image_repo_sync”

  • images.pull_policy

    • Type: string

    • Description:

    • “IfNotPresent”

  • images.tags.db_drop

    • Type: string

    • Description:

    • “docker.io/openstackhelm/heat:2024.1-ubuntu_jammy”

  • images.tags.db_init

    • Type: string

    • Description:

    • “docker.io/openstackhelm/heat:2024.1-ubuntu_jammy”

  • images.tags.dep_check

    • Type: string

    • Description:

    • “quay.io/airshipit/kubernetes-entrypoint:latest-ubuntu_focal”

  • images.tags.horizon

    • Type: string

    • Description:

    • “docker.io/openstackhelm/horizon:2024.1-ubuntu_jammy”

  • images.tags.horizon_db_sync

    • Type: string

    • Description:

    • “docker.io/openstackhelm/horizon:2024.1-ubuntu_jammy”

  • images.tags.image_repo_sync

    • Type: string

    • Description:

    • “docker.io/docker:17.07.0”

  • images.tags.test

    • Type: string

    • Description:

    • “docker.io/openstackhelm/osh-selenium:latest-ubuntu_jammy”

  • labels.dashboard.node_selector_key

    • Type: string

    • Description:

    • “openstack-control-plane”

  • labels.dashboard.node_selector_value

    • Type: string

    • Description:

    • “enabled”

  • labels.job.node_selector_key

    • Type: string

    • Description:

    • “openstack-control-plane”

  • labels.job.node_selector_value

    • Type: string

    • Description:

    • “enabled”

  • labels.test.node_selector_key

    • Type: string

    • Description:

    • “openstack-control-plane”

  • labels.test.node_selector_value

    • Type: string

    • Description:

    • “enabled”

  • manifests.certificates

    • Type: bool

    • Description:

    • false

  • manifests.configmap_bin

    • Type: bool

    • Description:

    • true

  • manifests.configmap_etc

    • Type: bool

    • Description:

    • true

  • manifests.configmap_logo

    • Type: bool

    • Description:

    • false

  • manifests.deployment

    • Type: bool

    • Description:

    • true

  • manifests.ingress_api

    • Type: bool

    • Description:

    • true

  • manifests.job_db_drop

    • Type: bool

    • Description:

    • false

  • manifests.job_db_init

    • Type: bool

    • Description:

    • true

  • manifests.job_db_sync

    • Type: bool

    • Description:

    • true

  • manifests.job_image_repo_sync

    • Type: bool

    • Description:

    • true

  • manifests.network_policy

    • Type: bool

    • Description:

    • false

  • manifests.pdb

    • Type: bool

    • Description:

    • true

  • manifests.pod_helm_test

    • Type: bool

    • Description:

    • true

  • manifests.secret_db

    • Type: bool

    • Description:

    • true

  • manifests.secret_ingress_tls

    • Type: bool

    • Description:

    • true

  • manifests.secret_keystone

    • Type: bool

    • Description:

    • true

  • manifests.secret_registry

    • Type: bool

    • Description:

    • true

  • manifests.service

    • Type: bool

    • Description:

    • true

  • manifests.service_ingress

    • Type: bool

    • Description:

    • true

  • network.dashboard.ingress.annotations.”nginx.ingress.kubernetes.io/proxy-body-size”

    • Type: string

    • Description:

    • “300m”

  • network.dashboard.ingress.annotations.”nginx.ingress.kubernetes.io/rewrite-target”

    • Type: string

    • Description:

    • “/”

  • network.dashboard.ingress.classes.cluster

    • Type: string

    • Description:

    • “nginx-cluster”

  • network.dashboard.ingress.classes.namespace

    • Type: string

    • Description:

    • “nginx”

  • network.dashboard.ingress.public

    • Type: bool

    • Description:

    • true

  • network.external_policy_local

    • Type: bool

    • Description:

    • false

  • network.node_port.enabled

    • Type: bool

    • Description:

    • false

  • network.node_port.port

    • Type: int

    • Description:

    • 31000

  • network_policy.horizon.egress[0]

    • Type: object

    • Description:

    • {}

  • network_policy.horizon.ingress[0]

    • Type: object

    • Description:

    • {}

  • pod.affinity.anti.topologyKey.default

    • Type: string

    • Description:

    • “kubernetes.io/hostname”

  • pod.affinity.anti.type.default

    • Type: string

    • Description:

    • “preferredDuringSchedulingIgnoredDuringExecution”

  • pod.affinity.anti.weight.default

    • Type: int

    • Description:

    • 10

  • pod.lifecycle.disruption_budget.horizon.min_available

    • Type: int

    • Description:

    • 0

  • pod.lifecycle.termination_grace_period.horizon.timeout

    • Type: int

    • Description:

    • 30

  • pod.lifecycle.upgrades.deployments.pod_replacement_strategy

    • Type: string

    • Description:

    • “RollingUpdate”

  • pod.lifecycle.upgrades.deployments.revision_history

    • Type: int

    • Description:

    • 3

  • pod.lifecycle.upgrades.deployments.rolling_update.max_surge

    • Type: int

    • Description:

    • 3

  • pod.lifecycle.upgrades.deployments.rolling_update.max_unavailable

    • Type: int

    • Description:

    • 1

  • pod.mounts.horizon.horizon.volumeMounts

    • Type: string

    • Description:

    • nil

  • pod.mounts.horizon.horizon.volumes

    • Type: string

    • Description:

    • nil

  • pod.mounts.horizon.init_container

    • Type: string

    • Description:

    • nil

  • pod.mounts.horizon_db_init.horizon_db_init.volumeMounts

    • Type: string

    • Description:

    • nil

  • pod.mounts.horizon_db_init.horizon_db_init.volumes

    • Type: string

    • Description:

    • nil

  • pod.mounts.horizon_db_init.init_container

    • Type: string

    • Description:

    • nil

  • pod.mounts.horizon_db_sync.horizon_db_sync.volumeMounts

    • Type: string

    • Description:

    • nil

  • pod.mounts.horizon_db_sync.horizon_db_sync.volumes

    • Type: string

    • Description:

    • nil

  • pod.mounts.horizon_db_sync.init_container

    • Type: string

    • Description:

    • nil

  • pod.mounts.horizon_tests.horizon_tests.volumeMounts

    • Type: string

    • Description:

    • nil

  • pod.mounts.horizon_tests.horizon_tests.volumes

    • Type: string

    • Description:

    • nil

  • pod.mounts.horizon_tests.init_container

    • Type: string

    • Description:

    • nil

  • pod.replicas.server

    • Type: int

    • Description:

    • 1

  • pod.resources.enabled

    • Type: bool

    • Description:

    • false

  • pod.resources.jobs.db_drop.limits.cpu

    • Type: string

    • Description:

    • “2000m”

  • pod.resources.jobs.db_drop.limits.memory

    • Type: string

    • Description:

    • “1024Mi”

  • pod.resources.jobs.db_drop.requests.cpu

    • Type: string

    • Description:

    • “100m”

  • pod.resources.jobs.db_drop.requests.memory

    • Type: string

    • Description:

    • “128Mi”

  • pod.resources.jobs.db_init.limits.cpu

    • Type: string

    • Description:

    • “2000m”

  • pod.resources.jobs.db_init.limits.memory

    • Type: string

    • Description:

    • “1024Mi”

  • pod.resources.jobs.db_init.requests.cpu

    • Type: string

    • Description:

    • “100m”

  • pod.resources.jobs.db_init.requests.memory

    • Type: string

    • Description:

    • “128Mi”

  • pod.resources.jobs.db_sync.limits.cpu

    • Type: string

    • Description:

    • “2000m”

  • pod.resources.jobs.db_sync.limits.memory

    • Type: string

    • Description:

    • “1024Mi”

  • pod.resources.jobs.db_sync.requests.cpu

    • Type: string

    • Description:

    • “100m”

  • pod.resources.jobs.db_sync.requests.memory

    • Type: string

    • Description:

    • “128Mi”

  • pod.resources.jobs.image_repo_sync.limits.cpu

    • Type: string

    • Description:

    • “2000m”

  • pod.resources.jobs.image_repo_sync.limits.memory

    • Type: string

    • Description:

    • “1024Mi”

  • pod.resources.jobs.image_repo_sync.requests.cpu

    • Type: string

    • Description:

    • “100m”

  • pod.resources.jobs.image_repo_sync.requests.memory

    • Type: string

    • Description:

    • “128Mi”

  • pod.resources.jobs.tests.limits.cpu

    • Type: string

    • Description:

    • “2000m”

  • pod.resources.jobs.tests.limits.memory

    • Type: string

    • Description:

    • “1024Mi”

  • pod.resources.jobs.tests.requests.cpu

    • Type: string

    • Description:

    • “100m”

  • pod.resources.jobs.tests.requests.memory

    • Type: string

    • Description:

    • “128Mi”

  • pod.resources.server.limits.cpu

    • Type: string

    • Description:

    • “2000m”

  • pod.resources.server.limits.memory

    • Type: string

    • Description:

    • “1024Mi”

  • pod.resources.server.requests.cpu

    • Type: string

    • Description:

    • “100m”

  • pod.resources.server.requests.memory

    • Type: string

    • Description:

    • “128Mi”

  • pod.security_context.db_sync.container.horizon_db_sync.allowPrivilegeEscalation

    • Type: bool

    • Description:

    • false

  • pod.security_context.db_sync.container.horizon_db_sync.readOnlyRootFilesystem

    • Type: bool

    • Description:

    • false

  • pod.security_context.db_sync.container.horizon_db_sync.runAsUser

    • Type: int

    • Description:

    • 0

  • pod.security_context.db_sync.pod.runAsUser

    • Type: int

    • Description:

    • 42424

  • pod.security_context.horizon.container.horizon.allowPrivilegeEscalation

    • Type: bool

    • Description:

    • false

  • pod.security_context.horizon.container.horizon.readOnlyRootFilesystem

    • Type: bool

    • Description:

    • false

  • pod.security_context.horizon.container.horizon.runAsUser

    • Type: int

    • Description:

    • 0

  • pod.security_context.horizon.pod.runAsUser

    • Type: int

    • Description:

    • 42424

  • pod.security_context.test.container.horizon_test.allowPrivilegeEscalation

    • Type: bool

    • Description:

    • false

  • pod.security_context.test.container.horizon_test.readOnlyRootFilesystem

    • Type: bool

    • Description:

    • true

  • pod.security_context.test.pod.runAsUser

    • Type: int

    • Description:

    • 42424

  • pod.tolerations.horizon.enabled

    • Type: bool

    • Description:

    • false

  • pod.tolerations.horizon.tolerations[0].effect

    • Type: string

    • Description:

    • “NoSchedule”

  • pod.tolerations.horizon.tolerations[0].key

    • Type: string

    • Description:

    • “node-role.kubernetes.io/master”

  • pod.tolerations.horizon.tolerations[0].operator

    • Type: string

    • Description:

    • “Exists”

  • pod.tolerations.horizon.tolerations[1].effect

    • Type: string

    • Description:

    • “NoSchedule”

  • pod.tolerations.horizon.tolerations[1].key

    • Type: string

    • Description:

    • “node-role.kubernetes.io/control-plane”

  • pod.tolerations.horizon.tolerations[1].operator

    • Type: string

    • Description:

    • “Exists”

  • release_group

    • Type: string

    • Description:

    • nil

  • secrets.identity.admin

    • Type: string

    • Description:

    • “horizon-keystone-admin”

  • secrets.oci_image_registry.horizon

    • Type: string

    • Description:

    • “horizon-oci-image-registry”

  • secrets.oslo_db.admin

    • Type: string

    • Description:

    • “horizon-db-admin”

  • secrets.oslo_db.horizon

    • Type: string

    • Description:

    • “horizon-db-user”

  • secrets.tls.dashboard.dashboard.internal

    • Type: string

    • Description:

    • “horizon-tls-web”

  • secrets.tls.dashboard.dashboard.public

    • Type: string

    • Description:

    • “horizon-tls-public”

  • selenium_v4

    • Type: bool

    • Description:

    • true

  • tls.identity

    • Type: bool

    • Description:

    • false