Open Stack

I just recently joined a team in charge of implementing OpenStack deployment which I'm trying to grasp the design of.

One problem I encountered is that the openstack environment is on a pretty closed network and I need to use ssh
tunnelling to be able to access horizon, so I started to look into fronting the service with a reverse proxy
(making it available throug, horizon.example.com/horizon), then I noticed the horizon UI needs to contact the
Identity service, which I also fronted with a reverse proxy (identity.example.com:5000/v2.0) and configured
OPENSTACK_HOST = identity.example.com in /etc/openstack-dashboard/local_settings.py

The reverse proxy proxies requests to http://control1:5000 so when the response is sent back from the api it includes
<link href="http://http://control1:5000/v2.0/" rel="self"/> which the client has no network access to and a possible solution
would be to edit the url in /etc/keystone/keystone.conf then it dawned on me that we might have to re-think this design.

Possibly we are taking the wrong approach so I wanted to reach out to get some opinions on this matter since I'm new
to the architecture of OpenStack and haven't yet totally grasped how things are supposed to work together.?

Regards, Davíd Johannsson

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openstack.org/pipermail/openstack-operators/attachments/20150930/a09bd06b/attachment.html>