diff --git a/README.rst b/README.rst
index f5dc16d..44e9150 100644
--- a/README.rst
+++ b/README.rst
@@ -43,6 +43,22 @@
           password: pwd
           virtual_host: '/openstack'
 
+Enable CORS parameters
+------------------------------
+
+.. code-block:: yaml
+
+    ceilometer:
+      server:
+        cors:
+          allowed_origin: https:localhost.local,http:localhost.local
+          expose_headers: X-Auth-Token,X-Openstack-Request-Id,X-Subject-Token
+          allow_methods: GET,PUT,POST,DELETE,PATCH
+          allow_headers: X-Auth-Token,X-Openstack-Request-Id,X-Subject-Token
+          allow_credentials: True
+          max_age: 86400
+
+
 Configuration of policy.json file
 ---------------------------------
 
diff --git a/ceilometer/files/mitaka/ceilometer-server.conf.Debian b/ceilometer/files/mitaka/ceilometer-server.conf.Debian
index 2d8f6e0..7d0e30b 100644
--- a/ceilometer/files/mitaka/ceilometer-server.conf.Debian
+++ b/ceilometer/files/mitaka/ceilometer-server.conf.Debian
@@ -665,3 +665,49 @@
 # Disables X.509 certificate validation when an SSL connection
 # to Identity Service is established. (boolean value)
 #insecure=false
+
+
+[cors]
+#
+# From oslo.middleware
+#
+
+# Indicate whether this resource may be shared with the domain received in the
+# requests "origin" header. (list value)
+#allowed_origin = <None>
+{% if server.get('cors', {}).allowed_origin is defined %}
+allowed_origin = {{ server.cors.allowed_origin }}
+{% endif %}
+
+# Indicate that the actual request can include user credentials (boolean value)
+#allow_credentials = true
+{% if server.get('cors', {}).allow_credentials is defined %}
+allow_credentials = {{ server.cors.allow_credentials }}
+{% endif %}
+
+# Indicate which headers are safe to expose to the API. Defaults to HTTP Simple
+# Headers. (list value)
+#expose_headers = X-Auth-Token,X-Openstack-Request-Id,X-Subject-Token
+{% if server.get('cors', {}).expose_headers is defined %}
+expose_headers = {{ server.cors.expose_headers }}
+{% endif %}
+
+# Maximum cache age of CORS preflight requests. (integer value)
+#max_age = 3600
+{% if server.get('cors', {}).max_age is defined %}
+max_age = {{ server.cors.max_age }}
+{% endif %}
+
+
+# Indicate which methods can be used during the actual request. (list value)
+#allow_methods = GET,PUT,POST,DELETE,PATCH
+{% if server.get('cors', {}).allow_methods is defined %}
+allow_methods = {{ server.cors.allow_methods }}
+{% endif %}
+
+# Indicate which header field names may be used during the actual request.
+# (list value)
+#allow_headers = X-Auth-Token,X-Openstack-Request-Id,X-Subject-Token,X-Project-Id,X-Project-Name,X-Project-Domain-Id,X-Project-Domain-Name,X-Domain-Id,X-Domain-Name
+{% if server.get('cors', {}).allow_headers is defined %}
+allow_headers = {{ server.cors.allow_headers }}
+{% endif %}
diff --git a/ceilometer/files/newton/ceilometer-server.conf.Debian b/ceilometer/files/newton/ceilometer-server.conf.Debian
index 2a1f891..f8549a8 100644
--- a/ceilometer/files/newton/ceilometer-server.conf.Debian
+++ b/ceilometer/files/newton/ceilometer-server.conf.Debian
@@ -232,23 +232,41 @@
 # Indicate whether this resource may be shared with the domain received in the
 # requests "origin" header. (list value)
 #allowed_origin = <None>
+{% if server.get('cors', {}).allowed_origin is defined %}
+allowed_origin = {{ server.cors.allowed_origin }}
+{% endif %}
 
 # Indicate that the actual request can include user credentials (boolean value)
 #allow_credentials = true
+{% if server.get('cors', {}).allow_credentials is defined %}
+allow_credentials = {{ server.cors.allow_credentials }}
+{% endif %}
 
 # Indicate which headers are safe to expose to the API. Defaults to HTTP Simple
 # Headers. (list value)
 #expose_headers = Content-Type,Cache-Control,Content-Language,Expires,Last-Modified,Pragma
+{% if server.get('cors', {}).expose_headers is defined %}
+expose_headers = {{ server.cors.expose_headers }}
+{% endif %}
 
 # Maximum cache age of CORS preflight requests. (integer value)
 #max_age = 3600
+{% if server.get('cors', {}).max_age is defined %}
+max_age = {{ server.cors.max_age }}
+{% endif %}
 
 # Indicate which methods can be used during the actual request. (list value)
 #allow_methods = GET,POST,PUT,DELETE,OPTIONS
+{% if server.get('cors', {}).allow_methods is defined %}
+allow_methods = {{ server.cors.allow_methods }}
+{% endif %}
 
 # Indicate which header field names may be used during the actual request.
 # (list value)
 #allow_headers = Content-Type,Cache-Control,Content-Language,Expires,Last-Modified,Pragma
+{% if server.get('cors', {}).allow_headers is defined %}
+allow_headers = {{ server.cors.allow_headers }}
+{% endif %}
 
 
 [cors.subdomain]
diff --git a/ceilometer/files/ocata/ceilometer-server.conf.Debian b/ceilometer/files/ocata/ceilometer-server.conf.Debian
index 78c6462..8ae1fd0 100644
--- a/ceilometer/files/ocata/ceilometer-server.conf.Debian
+++ b/ceilometer/files/ocata/ceilometer-server.conf.Debian
@@ -614,23 +614,41 @@
 # requests "origin" header. Format: "<protocol>://<host>[:<port>]", no trailing
 # slash. Example: https://horizon.example.com (list value)
 #allowed_origin = <None>
+{% if server.get('cors', {}).allowed_origin is defined %}
+allowed_origin = {{ server.cors.allowed_origin }}
+{% endif %}
 
 # Indicate that the actual request can include user credentials (boolean value)
 #allow_credentials = true
+{% if server.get('cors', {}).allow_credentials is defined %}
+allow_credentials = {{ server.cors.allow_credentials }}
+{% endif %}
 
 # Indicate which headers are safe to expose to the API. Defaults to HTTP Simple
 # Headers. (list value)
 #expose_headers = X-Auth-Token,X-Subject-Token,X-Service-Token,X-Openstack-Request-Id
+{% if server.get('cors', {}).expose_headers is defined %}
+expose_headers = {{ server.cors.expose_headers }}
+{% endif %}
 
 # Maximum cache age of CORS preflight requests. (integer value)
 #max_age = 3600
+{% if server.get('cors', {}).max_age is defined %}
+max_age = {{ server.cors.max_age }}
+{% endif %}
 
 # Indicate which methods can be used during the actual request. (list value)
 #allow_methods = GET,PUT,POST,DELETE,PATCH
+{% if server.get('cors', {}).allow_methods is defined %}
+allow_methods = {{ server.cors.allow_methods }}
+{% endif %}
 
 # Indicate which header field names may be used during the actual request.
 # (list value)
 #allow_headers = X-Auth-Token,X-Identity-Status,X-Roles,X-Service-Catalog,X-User-Id,X-Tenant-Id,X-Openstack-Request-Id
+{% if server.get('cors', {}).allow_headers is defined %}
+allow_headers = {{ server.cors.allow_headers }}
+{% endif %}
 
 
 [cors.subdomain]