Enable the paste filter HTTPProxyToWSGI by default

[Rob Crittenden]

[Impact]

Getting http link instead of https even if https setting is set.

[Test case]

1. deploy openstack ( with keystone charm option use-https, https-service-endpoints)
2. create instance
3. nova --debug list
   - check the result if https links are there.

[Regression Potential]

nova pkg will be affected by this patch. However, this patch modifies only api-paste.ini by adding http_proxy_to_wsgi. To accept this patch, nova service need to be restarted. Tested no vms are affected this patch, but APIs or daemons are temporarily.

[Others]

related commits ( which are already in comments )

https://git.openstack.org/cgit/openstack/nova/commit/?id=b609a3b32ee8e68cef7e66fabff07ca8ad6d4649
https://git.openstack.org/cgit/openstack/nova/commit/?id=6051f30a7e61c32833667d3079744b2d4fd1ce7c

[Original Description]

oslo middleware provides a paste filter that sets the correct proxy scheme and host. This is needed for the TLS proxy case.

Without this then enabling the TLS proxy in devstack will fail configuring tempest because 'nova flavor-list' returns a http scheme in Location in a redirect it returns.

I've proposed a temporary workaround in devstack using:

+ iniset $NOVA_API_PASTE_INI filter:ssl_header_handler past
e.filter_factory oslo_middleware.http_proxy_to_wsgi:HTTPProxyToWSGI.factory
+ iniset $NOVA_API_PASTE_INI composite:openstack_compute_ap
i_v21 keystone "ssl_header_handler cors compute_req_id faultwrap sizelimit autht
oken keystonecontext osapi_compute_app_v21"

But this isn't a long-term solution because two copies of the default paste filters will need to be maintained.

See https://review.openstack.org/#/c/301172

[Juan Antonio Osorio Robles (juan-osorio-robles)]

Had added cinder, but now I noticed there was already a bug report filed there too https://bugs.launchpad.net/cinder/+bug/1573766 So I'll use that one instead for Cinder. This still applies for Nova though.

[Juan Antonio Osorio Robles (juan-osorio-robles)]

Wrong link, the one for cinder was https://bugs.launchpad.net/cinder/+bug/1558683

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/318603
Committed: https://git.openstack.org/cgit/openstack/nova/commit/?id=b609a3b32ee8e68cef7e66fabff07ca8ad6d4649
Submitter: Jenkins
Branch: master

commit b609a3b32ee8e68cef7e66fabff07ca8ad6d4649
Author: Juan Antonio Osorio Robles <email address hidden>
Date: Thu May 19 15:10:22 2016 +0300

    Add http_proxy_to_wsgi to api-paste

    This sets up the HTTPProxyToWSGI middleware in front of Nova-API. The
    purpose of thise middleware is to set up the request URL correctly in
    case there is a proxy (For instance, a loadbalancer such as HAProxy)
    in front of Nova.

    So, for instance, when TLS connections are being terminated in the
    proxy, and one tries to get the versions from the / resource of
    Nova, one will notice that the protocol is incorrect; It will show
    'http' instead of 'https'. So this middleware handles such cases.
    Thus helping Keystone discovery work correctly.

    The HTTPProxyToWSGI is off by default and needs to be enabled via a
    configuration value.

    Change-Id: Ia78f73e96585ab33a379a0b0be6d9682f7fbd810
    Closes-Bug: #1573766

[Rob Crittenden (rcritten)]

The patch addresses version discovery but not nova API calls. I also need this configured for composite:openstack_compute_api_v21 to cover Location in the output of flavor-list.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/322630

[Juan Antonio Osorio Robles (juan-osorio-robles)]

This bug was not fully closed with the past commit since I missed the pagination part. The missing part was proposed in https://review.openstack.org/322630

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/322630
Committed: https://git.openstack.org/cgit/openstack/nova/commit/?id=6051f30a7e61c32833667d3079744b2d4fd1ce7c
Submitter: Jenkins
Branch: master

commit 6051f30a7e61c32833667d3079744b2d4fd1ce7c
Author: Juan Antonio Osorio Robles <email address hidden>
Date: Mon May 30 08:12:20 2016 +0300

    Add proxy middleware to application pipeline

    Recently the http_proxy_to_wsgi middleware was added before the
    versions resource; This correctly sets the URL scheme for keystone
    version discovery, however, this is missing the URL schemes for
    pagination URLs. So for this to work, the middleware needs to be
    added to the application pipelines. Note that a similar commit
    was done in cinder [1].

    [1] If5aab9cc25a2e7c66a0bb13b5f7488a667b30309

    Change-Id: I808469f24066d382decf55b9dad5312d6e068da7
    Closes-Bug: #1573766

[Davanum Srinivas (DIMS) (dims-v)]

This issue was fixed in the openstack/nova 14.0.0.0b1 development milestone.

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "lp1573766_xenial.debdiff" seems to be a debdiff. The ubuntu-sponsors team has been subscribed to the bug report so that they can review and hopefully sponsor the debdiff. If the attachment isn't a patch, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are member of the ~ubuntu-sponsors, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issue please contact him.]

[Corey Bryant (corey.bryant)]

Hello Seyeong,

I've uploaded a new package version with your patch to the xenial review queue where it is awaiting SRU Team review.
https://launchpad.net/ubuntu/xenial/+queue?queue_state=1&queue_text=

Thanks,
Corey

[Edward Hope-Morley (hopem)]

Fix proposed to branch: master
Review: https://review.openstack.org/521434

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/521434
Committed: https://git.openstack.org/cgit/openstack/charm-nova-cloud-controller/commit/?id=d9f9431456b0cfc85bf0433fb8f5608579c9e55f
Submitter: Zuul
Branch: master

commit d9f9431456b0cfc85bf0433fb8f5608579c9e55f
Author: Seyeong Kim <email address hidden>
Date: Mon Nov 20 15:38:20 2017 +0900

    Adding http_proxy_to_wsgi support to mitaka.

    nova mitaka doesn't have http_proxy_to_wsgi

    but mitaka nova has issue related to this.

    I backported commit 6051f30a, b609a3b32 to api-paste.ini.

    Change-Id: Ibeb8f655504ecfc1763743faa52f7e3aa552c3c4
    Related-Bug: #1573766

[Steve Langasek (vorlon)]

Hello Rob, or anyone else affected,

Accepted nova into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/nova/2:13.1.4-0ubuntu4.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-xenial to verification-done-xenial. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-xenial. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Seyeong Kim (seyeongkim)]

ii nova-api 2:13.1.4-0ubuntu4.2 all OpenStack Compute - API frontend

I verified
1. deployed openstack with ssl keystone.
2. created network, image, instance. base configuration.
3. nova --debug list shows https link for each instances instead of http.

Thanks.

[Seyeong Kim (seyeongkim)]

In addition to above verification.

When installing nova-common, nova-api-os-compute and nova-conductor are removed.
Is this normal in only -proposed situation?

Thanks.

[Seyeong Kim (seyeongkim)]

About above comment,
Now it seems ok,
I just assume that at the point my verification time, those two pkgs were not there.
After that, those pkgs seem to be uploaded.
not sure this is the case.
anyway now it is ok.

THanks.

[Edward Hope-Morley (hopem)]

Seems ok - http://pastebin.ubuntu.com/26163893/

[Launchpad Janitor (janitor)]

This bug was fixed in the package nova - 2:13.1.4-0ubuntu4.2

---------------
nova (2:13.1.4-0ubuntu4.2) xenial; urgency=medium

  [ Seyeong Kim ]
  * Add supporting http_proxy_to_wsgi to api-paste.ini (LP: #1573766)
    - d/p/0001-Add-http_proxy_to_wsgi-to-api-paste.patch
    - d/p/0002-Add-proxy-middleware-to-application-pipeline.patch

  [ Edward Hope-Morley ]
  * Patch nova.db.sqlalchemy.api.compute_node_statistics() to
    exclude deleted services from stats count. This is the same
    fix as that backported to newton in bug 1692397 except that
    the actual patch is not backportable due to the underlying
    code changing extensively.
    - d/p/exlude-deleted-service-from-stats-count.patch (LP: #1692397)

 -- Corey Bryant <email address hidden> Fri, 08 Dec 2017 15:44:43 -0500

[Łukasz Zemczak (sil2100)]

The verification of the Stable Release Update for nova has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Corey Bryant (corey.bryant)]

Hello Rob, or anyone else affected,

Accepted nova into mitaka-proposed. The package will build now and be available in the Ubuntu Cloud Archive in a few hours, and then in the -proposed repository.

Please help us by testing this new package. To enable the -proposed repository:

  sudo add-apt-repository cloud-archive:mitaka-proposed
  sudo apt-get update

Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-mitaka-needed to verification-mitaka-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-mitaka-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Seyeong Kim (seyeongkim)]

ii nova-api-os-compute 2:13.1.4-0ubuntu4.2~cloud0 all OpenStack Compute - OpenStack Compute API frontend
ii nova-cert 2:13.1.4-0ubuntu4.2~cloud0 all OpenStack Compute - certificate management
ii nova-common 2:13.1.4-0ubuntu4.2~cloud0 all OpenStack Compute - common files
ii nova-conductor 2:13.1.4-0ubuntu4.2~cloud0 all OpenStack Compute - conductor service
ii nova-scheduler 2:13.1.4-0ubuntu4.2~cloud0 all OpenStack Compute - virtual machine scheduler
ii python-nova 2:13.1.4-0ubuntu4.2~cloud0 all OpenStack Compute Python libraries

verified this
1. deployed openstack
2. created network, image, instance. base configuration.
3. enables ssl option to keystone.
4. get keystone_juju_ca_cert.pem from keystone node
5. add cacert to novarc
6. nova --debug list shows https link for each instances instead of http.

Thanks

[Corey Bryant (corey.bryant)]

This has also been regression tested successfully for trusty-mitaka-proposed and xenial-mitaka-proposed:

trusty-mitaka-proposed:

======
Totals
======
Ran: 102 tests in 767.0600 sec.
 - Passed: 94
 - Skipped: 8
 - Expected Fail: 0
 - Unexpected Success: 0
 - Failed: 0
Sum of execute time for each test: 472.5363 sec.

xenial-mitaka-proposed:

======
Totals
======
Ran: 102 tests in 861.6688 sec.
 - Passed: 94
 - Skipped: 8
 - Expected Fail: 0
 - Unexpected Success: 0
 - Failed: 0
Sum of execute time for each test: 524.2865 sec.

[Corey Bryant (corey.bryant)]

The verification of the Stable Release Update for nova has completed successfully and the package has now been released to -updates. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Corey Bryant (corey.bryant)]

This bug was fixed in the package nova - 2:13.1.4-0ubuntu4.2~cloud0
---------------

 nova (2:13.1.4-0ubuntu4.2~cloud0) trusty-mitaka; urgency=medium
 .
   * New update for the Ubuntu Cloud Archive.
 .
 nova (2:13.1.4-0ubuntu4.2) xenial; urgency=medium
 .
   [ Seyeong Kim ]
   * Add supporting http_proxy_to_wsgi to api-paste.ini (LP: #1573766)
     - d/p/0001-Add-http_proxy_to_wsgi-to-api-paste.patch
     - d/p/0002-Add-proxy-middleware-to-application-pipeline.patch
 .
   [ Edward Hope-Morley ]
   * Patch nova.db.sqlalchemy.api.compute_node_statistics() to
     exclude deleted services from stats count. This is the same
     fix as that backported to newton in bug 1692397 except that
     the actual patch is not backportable due to the underlying
     code changing extensively.
     - d/p/exlude-deleted-service-from-stats-count.patch (LP: #1692397)

[Seyeong Kim (seyeongkim)]

Hello Ryan

This seems that merged to 18.02
Could you please check once more?

Thanks.

[Seyeong Kim (seyeongkim)]

i changed status but can't for milestone

if Im wrong please revert it