Cinder quotas fail with https:// keystone URL.

[György Szombathelyi]

AFter this bug:
https://bugs.launchpad.net/cinder/+bug/1516085
fixed, there's still an error at the connection to keystone, when keystone is secured by TLS. The problem is the client.Client call does not pass keystone_authoken.cafile nor keystone_authtoken.insecure, so the SSL checks can fail.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/272437

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/272437
Committed: https://git.openstack.org/cgit/openstack/cinder/commit/?id=6c27d05d8faa2fb284a0c9eeb57480bb5e82942f
Submitter: Jenkins
Branch: master

commit 6c27d05d8faa2fb284a0c9eeb57480bb5e82942f
Author: Gyorgy Szombathelyi <email address hidden>
Date: Sat Feb 20 19:34:48 2016 +0100

    Support https keystone CA checking in volume quotas

    Currently connecting to https secured keystone instance mostly
    fail in cinder quotas, since neither CA certificate nor the
    insecure option is passed to keystone client. Fixing this by
    passing these options from keystone_authtoken, converting them
    to a verify option for the keystone session object.

    Change-Id: Ifd9214b837d87d7bf6d78406a8cef447c2b7c39e
    Closes-Bug: #1537783

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/mitaka
Review: https://review.openstack.org/298912

[Doug Hellmann (doug-hellmann)]

This issue was fixed in the openstack/cinder 9.0.0.0b1 development milestone.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/298912
Committed: https://git.openstack.org/cgit/openstack/cinder/commit/?id=7b630d60041eee981f54136ab9457854a48ec74f
Submitter: Jenkins
Branch: stable/mitaka

commit 7b630d60041eee981f54136ab9457854a48ec74f
Author: Gyorgy Szombathelyi <email address hidden>
Date: Sat Feb 20 19:34:48 2016 +0100

    Support https keystone CA checking in volume quotas

    Currently connecting to https secured keystone instance mostly
    fail in cinder quotas, since neither CA certificate nor the
    insecure option is passed to keystone client. Fixing this by
    passing these options from keystone_authtoken, converting them
    to a verify option for the keystone session object.

    Change-Id: Ifd9214b837d87d7bf6d78406a8cef447c2b7c39e
    Closes-Bug: #1537783
    (cherry picked from commit 6c27d05d8faa2fb284a0c9eeb57480bb5e82942f)

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: stable/liberty
Review: https://review.openstack.org/332812

[jichenjc (jichenjc)]

I am trying to backport this to liberty https://review.openstack.org/332812
the reason is if no CA usage will lead to maluser to do the midattack if https is used?

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: stable/liberty
Review: https://review.openstack.org/333749

[OpenStack Infra (hudson-openstack)]

Change abandoned by jichenjc (<email address hidden>) on branch: stable/liberty
Review: https://review.openstack.org/332812

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/333749
Committed: https://git.openstack.org/cgit/openstack/cinder/commit/?id=36aae4305846605775b5a4a4acc0499daf39ec94
Submitter: Jenkins
Branch: stable/liberty

commit 36aae4305846605775b5a4a4acc0499daf39ec94
Author: Gyorgy Szombathelyi <email address hidden>
Date: Sat Feb 20 19:34:48 2016 +0100

    Support https keystone CA checking in volume quotas

    Currently connecting to https secured keystone instance mostly
    fail in cinder quotas, since neither CA certificate nor the
    insecure option is passed to keystone client. Fixing this by
    passing these options from keystone_authtoken, converting them
    to a verify option for the keystone session object.

    This can't be directly cherrypicked since code directory
    changes, so add patch to old place instead.

    Change-Id: Ifd9214b837d87d7bf6d78406a8cef447c2b7c39e
    Closes-Bug: #1537783
    (cherry picked from commit 6c27d05d8faa2fb284a0c9eeb57480bb5e82942f)

[Doug Hellmann (doug-hellmann)]

This issue was fixed in the openstack/cinder 8.1.0 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/cinder 7.0.3 release.