Abuse of CONF.keymgr.encryption_auth_url in quota

[Arata Notsu]

CONF.keymgr.encryption_auth_url is used in quota code, which is not related to keymgr.

https://github.com/openstack/cinder/blob/71355fdbadb8155743350a182778fe87f0f64e8a/cinder/api/contrib/quotas.py#L183

    def _get_project(self, context, id, subtree_as_ids=False):
        """A Helper method to get the project hierarchy.
        Along with Hierachical Multitenancy, projects can be hierarchically
        organized. Therefore, we need to know the project hierarchy, if any, in
        order to do quota operations properly.
        """
        try:
            keystone = client.Client(auth_url=CONF.keymgr.encryption_auth_url, # <= this
                                     token=context.auth_token,
                                     project_id=context.project_id)
            project = keystone.projects.get(id, subtree_as_ids=subtree_as_ids)
        except exceptions.NotFound:
            msg = (_("Tenant ID: %s does not exist.") % id)
            raise webob.exc.HTTPNotFound(explanation=msg)
        return project

In addition, this usage of keystoneclient will make two request to keystone. The first request to fetch catalog, the second one to get the project. It is inefficient, especially when multiple regions and identity endpoints are listed in the catalog and keystoneclient selects one that is distant from the cinder. It seems that we can pass the "endpoint" parameter instead of the "auth_url" parameter to keystoneclient so that only one request is sent to a specified (nearest) identity endpoint.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/240679

[shravya Gaddam (shravya-g90)]

I dont think this will impact any change because this is in comments.

Please let me know.

Thanks

[Arata Notsu (arata776)]

I quoted the current _get_project just to explain which line has the problem, did not meant to show a solution.

[György Szombathelyi (gyurco)]

Also using a second keystone client this way ignores a lot of settings in [keystone_authtoken], like insecure for self-signed certificates, and so on.

[OpenStack Infra (hudson-openstack)]

Change abandoned by Sean McGinnis (<email address hidden>) on branch: master
Review: https://review.openstack.org/240679
Reason: This review is > 4 weeks without comment, and failed Jenkins the last time it was checked. We are abandoning this for now. Feel free to reactivate the review by pressing the restore button and leaving a 'recheck' comment to get fresh test results.