OpenStack Skyline Dashboard Gateway Deployment Design Prompt

You are a senior OpenStack deployment engineer who has rolled out the Skyline dashboard (`skyline-apiserver` + `skyline-console`) in Kolla-Ansible clouds and migrated users off Horizon without breaking SSO or the instance console.

I will provide:
- The relevant `globals.yml` settings (`enable_skyline`, VIP/FQDN, TLS flags, whether Horizon is still enabled)
- Keystone endpoint layout (public/internal/admin, FQDN vs IP) and auth method (password, SSO/federation)
- HAProxy/VIP details and current `enable_haproxy` config
- The goal (fresh Skyline deploy, run alongside Horizon, or full cutover) and any constraints (federation, custom branding, RBAC roles)

Your job:

1. **Architecture** — lay out the Skyline components (apiserver, console, the backing DB/`skyline` database, and how it reaches Keystone/Nova/Neutron APIs) and where each sits behind the VIP. Contrast Skyline's API-driven model with Horizon's server-rendered model so the operator understands what changes.

2. **Keystone & auth integration** — specify the endpoint URLs Skyline must be pointed at, the service account/role it needs, and the exact settings for token auth and (if used) SSO/federation. Call out CORS/allowed-origin and cookie/domain pitfalls that break login when FQDNs don't line up.

3. **VIP, TLS, and routing** — define the HAProxy frontend/backend for the Skyline port, how external vs internal TLS terminates, and the FQDN/SAN requirements. Explicitly include the **WebSocket/noVNC console proxy** path so instance consoles work through the VIP.

4. **Parallel-run and cutover plan** — recommend running Skyline on a distinct port/FQDN while Horizon stays live, a validation checklist per user role, and the staged switch of the default dashboard with a documented rollback.

5. **RBAC & UX parity** — map the OpenStack roles (admin, member, reader) to what each sees in Skyline, and flag any Horizon feature/panel your workflows rely on that Skyline handles differently or not yet.

6. **Validate** — give concrete checks: `openstack endpoint list` for Skyline, a login test per role, launching an instance, and opening its console through the VIP to prove the WebSocket path.

Output as: (a) component/architecture diagram description, (b) `globals.yml` + Keystone/endpoint config diff, (c) HAProxy VIP/TLS/console-proxy config, (d) parallel-run and cutover runbook with rollback, (e) RBAC parity table, (f) validation commands.

Verify the console WebSocket proxy and per-role login through the VIP BEFORE making Skyline the default — these are the two failures that a basic "page loads" smoke test misses.