skyline-console — Rewrite pack

Deployment and connection contract (rewrite pack) — skyline-console — branch stable/2026.2

Branch stable/2026.2 @ 806d200392ee — repository https://opendev.org/openstack/skyline-console — analysed on 2026-10-29 Other repositories cited: skyline-apiserver stable/2026.2 @ 4af72bfd4577 (prefix skyline-apiserver:), cinder stable/2026.2 @ c117f9cf0 (prefix cinder:), nova stable/2026.2 @ 8df1922926 (prefix nova:).

Scope agreed with the user. In OpenKeel, Skyline is kept as is. The console is not rewritten in Go. This pack answers two questions instead:

1. How to build the console from this branch and deploy it on Kubernetes so that it works.
2. What it needs from skyline-apiserver, and through skyline-apiserver's proxy from each OpenStack API, so that the Go rewrites of those APIs keep it working. This is the client contract.

1. Contents of _rewrite/

Library versions in the lockfile: React 16.14.0, MobX 5.15.7, antd 4.15.6, axios 0.21.4, webpack 4.46.0 (yarn.lock:3172, yarn.lock:12646).

2. Build and packaging

Proof on this branch. A clean copy (git archive HEAD) built with Node 16.20.2 and yarn 1.22.19 in 1 min 44 s (install 63 s, webpack 41 s). It produced 45 files, 16 MB, in skyline_console/static/. One workaround was needed: registry.yarnpkg.com is TLS-intercepted on this network, so the copy's lockfile was pointed at registry.npmjs.org. That registry serves the same tarballs, and yarn still checked every package's integrity.

Pitfall 1 — stale bundle in git. skyline_console/static/ is committed with a bundle from 2022 (49 files, last changed by feat: update dist for rc1 release). It lacks chunks that the current source builds, such as Inctance-HA and barbican. Installing the Python package from the git tree without make package ships that old UI. Always build the bundle in the image.

Pitfall 2 — wrong console in the apiserver image. skyline-apiserver's image installs the console from skyline_console/skyline_console.tar.gz (skyline-apiserver:container/Dockerfile:23). Its Makefile downloads skyline-console-master.tar.gz by default (skyline-apiserver:Makefile:20). For stable/2026.2, set SKYLINE_CONSOLE_PACKAGE_URL=https://tarballs.opendev.org/openstack/skyline-console/skyline-console-stable-2026.2.tar.gz, or build the tarball from this branch. The image labels skyline.build_console_commit with the console commit (skyline-apiserver:container/Dockerfile:9): check it.

3. Serving on Kubernetes

The built console is static files, but its runtime contract is strict. Everything must be one origin, at the root path:

• the axios base URL is / and every API path is absolute (src/client/client/request.js:159, src/client/client/constants.js:60);
• webpack publicPath is / (config/webpack.prod.js:46);
• routes are absolute (/compute/..., /auth/login).

So the console cannot be served under a sub-path (https://host/skyline/) without rebuilding it. It also cannot sit on a different host from the API without CORS and cookie changes, which the code does not support.

3.1 Recommended layout: the skyline-apiserver container as shipped

One pod runs nginx, the static console and gunicorn (skyline-apiserver):

• gunicorn listens on the unix socket /var/lib/skyline/skyline.sock (skyline-apiserver:etc/gunicorn.py:17);
• nginx serves / from the console, proxies /api/openstack/skyline/ to the socket, and proxies one location per catalog endpoint (skyline-apiserver:skyline_apiserver/templates/nginx.conf.j2:83, skyline-apiserver:skyline_apiserver/templates/nginx.conf.j2:91, skyline-apiserver:skyline_apiserver/templates/nginx.conf.j2:111).

The Kubernetes Service exposes nginx's port: 9999 by default, or LISTEN_ADDRESS (skyline-apiserver:container/start_service.sh:17). One Ingress rule / → that Service.

flowchart LR
  user[Browser] -->|HTTPS host skyline.example| ing[Ingress /]
  ing --> svc[Service :9999]
  subgraph pod[skyline pod]
    nginx[nginx<br/>generated at start] -->|static| files[(skyline_console/static)]
    nginx -->|/api/openstack/skyline/ → unix socket| api[skyline-apiserver gunicorn]
  end
  svc --> nginx
  nginx -->|/api/openstack/regionone/nova/ …| nova[Nova Service]
  nginx -->|/api/openstack/regionone/neutron/ …| neutron[Neutron Service]
  api -->|REST| ks[Keystone]
  user -.->|noVNC URL from Nova| vnc[novncproxy Ingress]

What this layout requires:

3.2 Alternative: a separate console container

Possible (any static nginx with try_files $uri $uri/ /index.html and gzip_static on). The Ingress must then reproduce what the generated nginx does:

• /api/openstack/skyline/ → skyline-apiserver, prefix stripped;
• one /api/openstack/<region>/<service>/ rule per OpenStack API, prefix replaced by the service's root path, Host set to the upstream;
• everything else → the console.

profile.endpoints must point to exactly those paths (skyline-apiserver:skyline_apiserver/client/openstack/system.py:76). This duplicates the generator's logic in the chart and drifts with the catalog; only worth it when the apiserver is replaced.

4. Connection contract with skyline-apiserver

Checked on the wire with the built bundle (_rewrite/smoke-exchanges_stable-2026.2.json), and in the code:

The apiserver side of this contract (and its own findings: every middleware failure becomes 401, which logs the user out) is in [../reverse-spec-skyline-apiserver/07-rewrite-pack_stable-2026.2.md](../reverse-spec-skyline-apiserver/07-rewrite-pack_stable-2026.2.md) § 4.

5. What the OpenStack APIs must accept (for the OpenKeel Go services)

The per-operation list (577 calls) is [_rewrite/outbound-calls_stable-2026.2.md](_rewrite/outbound-calls_stable-2026.2.md). Paths are relative to profile.endpoints[<key>] + version suffix.

6. Conformance strategy

1. Build check (CI of the OpenKeel chart). Build the console from stable/2026.2 in the image (Node 16, yarn install --frozen-lockfile, yarn build) and fail if skyline_console/static/commit_id.txt does not match the expected commit.
2. Connection smoke test (no OpenStack needed). Run tools/smoke_server.py on the built static/, then open a deep link, log in, and check the recorded requests against _rewrite/smoke-exchanges_stable-2026.2.json: paths, headers, cookies, microversion merge, auto-refresh at 30 s. Recorded result: 35 requests. The deep link was redirected to login; after login came profile, policies, system roles and Neutron extensions, then extension/servers. The list refreshed 30.0 s later. Volumes, networks and the overview loaded, with Nova, Cinder and Neutron quotas carrying the expected headers.
3. Cluster smoke test. Deploy Skyline (§ 3.1) in a kind cluster, then run the console's Cypress suite. Override baseUrl, users and testFiles in test/e2e/config/local_config.yaml, which is merged over config.yaml (test/e2e/utils/index.js:46). Start with test/e2e/integration/pages/login.spec.js and test/e2e/integration/pages/error.spec.js, then the compute, network and storage specs, which cover the flows the OpenKeel skill asks for. cypress.json uses retries: 5, so look at the first failure, not the final status. **Recorded run (2026-10-29, tools/kind/).** kind 0.33.0, Kubernetes 1.37.0. In the cluster:
   • Keystone stable/2026.2 (Python, SQLite, Fernet);
   • skyline-apiserver stable/2026.2, built from its Dockerfile with the stable constraints and the console built from this branch;
   • a Neutron stand-in that answers only GET /v2.0/extensions. No other OpenStack service and none of the Go services were deployed. What was observed:
   • Container start. nginx was generated from the live catalog, with locations /api/openstack/regionone/keystone/ and /neutron/, and served the stable/2026.2 bundle (main.bundle.1793228949.js, the single username@domain login field).
   • Browser check. A deep link to /identity/project-admin redirected to /auth/login?referer=…. Login as e2e-admin worked, and the administrator Projects page listed Keystone's projects through the nginx proxy.
   • **Cypress 6.8.0, Electron, retries: 1:** 7 specs, 34 tests, 31 passing, in 9 min.
     • identity/role, identity/domain, identity/user (9/9: create, detail, system permission, disable, enable, login as the new user, password change, edit, delete) and identity/user-group (7/7) all pass.
     • identity/project passes 10/11, and login and error pass 2/3 and 1/2. The 3 failures all come from services that were not deployed:
   • login "check menu" clicks the second menu entry and expects Storage, but without Cinder the menu is Home, Compute, Network.
   • error "not found" opens an instance detail, which needs Nova.
   • project "edit quota" waits for the Nova quota field instances. Problems found during the run, now in § 3.1:
   • login fails without a Neutron endpoint;
   • administrator pages need a system-scope role;
   • the pod crash-loops while Keystone is down;
   • the readiness probe on / reports ready while the API still returns 502;
   • a service absent from the catalog makes the console call the root path, which nginx answers with index.html and 200. Console race. After a login whose referer is an administrator page, the user lands on /base/overview anyway. The cause: updateUser starts the system-roles request without awaiting it (src/stores/root.js:195, src/stores/root.js:212). The admin-page guard then runs while hasAdminPageRole is still false (src/layouts/Base/index.jsx:252). Reloading the deep link afterwards works. This is an upstream bug; there is nothing to configure.
4. Per-service contract. Feed _rewrite/outbound-calls_stable-2026.2.json to each Go service's e2e generation as extra cases, filtered by service. A call listed there that a service does not implement breaks the screen shown in _rewrite/ui-catalogue_stable-2026.2.md.

7. Gaps

8. Checklist (Skyline console on OpenKeel)

• [ ] image built from stable/2026.2 sources (not the committed 2022 bundle, not the master tarball); commit_id.txt checked
• [ ] one origin, root path; ingress / → skyline pod; no body-size limit, no request buffering, long read timeout
• [ ] Keystone reachable at pod start (init container waiting for it); catalog with one endpoint per type, region and interface; interface_type matching cluster-internal URLs
• [ ] Skyline system account (skyline, project service, role admin) created before the pod; a network endpoint in the catalog (login fails without it)
• [ ] administrators given a system-scope admin (or reader) role, not only a project role
• [ ] readiness probe on /api/openstack/skyline/api/v1/config, not on /
• [ ] service types registered under the default service_mapping names (or the mapping adjusted) so that locations contain nova, cinder, placement, manilav2, ironic, zun
• [ ] noVNC proxy (and other consoles) published on their own public URLs
• [ ] index.html not cached for a day across upgrades (override expires or purge)
• [ ] smoke test (§ 6.2) passes against the built bundle; Cypress login/error/identity specs pass in kind (done with Keystone only: 31/34, the 3 failures need Nova and Cinder); compute/network/storage specs pass once those services are deployed
• [ ] Go Nova keeps the last microversion value of a merged header; Go Cinder keeps the first (or accepts both identically)
• [ ] Go services answer 401 only for authentication failures; Nova quota errors keep forbidden.message with Quota exceeded

Source: reverse-spec-skyline-console/07-rewrite-pack_stable-2026.2.md. The _rewrite/ and _inventory/ files are not published on the site.