ssl_ca configuration should be optional for certs signed by recognised CA's

[Nobuto Murata]

SSL cert and key were provided using ssl_cert and ssl_key options. In this case, the SSL cert is signed by a trusted CA already, so ssl_ca should not be necessary.

unit-aodh-5: 13:46:11 INFO unit.aodh/5.juju-log Invoking reactive handler: reactive/aodh_handlers.py:48:setup_database
unit-aodh-5: 13:46:11 INFO unit.aodh/5.juju-log Invoking reactive handler: reactive/aodh_handlers.py:38:setup_amqp_req
unit-aodh-5: 13:46:12 INFO unit.aodh/5.juju-log Invoking reactive handler: reactive/aodh_handlers.py:57:setup_endpoint
unit-aodh-5: 13:46:12 DEBUG unit.aodh/5.config-changed Traceback (most recent call last):
unit-aodh-5: 13:46:12 DEBUG unit.aodh/5.config-changed File "/var/lib/juju/agents/unit-aodh-5/charm/hooks/config-changed", line 19, in <module>
unit-aodh-5: 13:46:12 DEBUG unit.aodh/5.config-changed main()
unit-aodh-5: 13:46:12 DEBUG unit.aodh/5.config-changed File "/var/lib/juju/agents/unit-aodh-5/.venv/lib/python3.5/site-packages/charms/reactive/__init__.py", line 78, in main
unit-aodh-5: 13:46:12 DEBUG unit.aodh/5.config-changed bus.dispatch()
unit-aodh-5: 13:46:12 DEBUG unit.aodh/5.config-changed File "/var/lib/juju/agents/unit-aodh-5/.venv/lib/python3.5/site-packages/charms/reactive/bus.py", line 423, in dispatch
unit-aodh-5: 13:46:12 DEBUG unit.aodh/5.config-changed _invoke(other_handlers)
unit-aodh-5: 13:46:12 DEBUG unit.aodh/5.config-changed File "/var/lib/juju/agents/unit-aodh-5/.venv/lib/python3.5/site-packages/charms/reactive/bus.py", line 406, in _invoke
unit-aodh-5: 13:46:12 DEBUG unit.aodh/5.config-changed handler.invoke()
unit-aodh-5: 13:46:12 DEBUG unit.aodh/5.config-changed File "/var/lib/juju/agents/unit-aodh-5/.venv/lib/python3.5/site-packages/charms/reactive/bus.py", line 280, in invoke
unit-aodh-5: 13:46:12 DEBUG unit.aodh/5.config-changed self._action(*args)
unit-aodh-5: 13:46:12 DEBUG unit.aodh/5.config-changed File "/var/lib/juju/agents/unit-aodh-5/charm/reactive/aodh_handlers.py", line 60, in setup_endpoint
unit-aodh-5: 13:46:12 DEBUG unit.aodh/5.config-changed aodh.configure_ssl()
unit-aodh-5: 13:46:12 DEBUG unit.aodh/5.config-changed File "lib/charm/openstack/aodh.py", line 206, in configure_ssl
unit-aodh-5: 13:46:12 DEBUG unit.aodh/5.config-changed AodhCharm.singleton.configure_ssl()
unit-aodh-5: 13:46:12 DEBUG unit.aodh/5.config-changed File "/var/lib/juju/agents/unit-aodh-5/.venv/lib/python3.5/site-packages/charms_openstack/charm/classes.py", line 524, in configure_ssl
unit-aodh-5: 13:46:12 DEBUG unit.aodh/5.config-changed keystone_interface=keystone_interface)
unit-aodh-5: 13:46:12 DEBUG unit.aodh/5.config-changed File "/var/lib/juju/agents/unit-aodh-5/.venv/lib/python3.5/site-packages/charms_openstack/charm/classes.py", line 463, in get_certs_and_keys
unit-aodh-5: 13:46:12 DEBUG unit.aodh/5.config-changed 'ca': self.config_defined_ssl_ca.decode('utf-8'),
unit-aodh-5: 13:46:12 DEBUG unit.aodh/5.config-changed AttributeError: 'NoneType' object has no attribute 'decode'
unit-aodh-5: 13:46:12 ERROR juju.worker.uniter.operation hook "config-changed" failed: exit status 1

[Ryan Beisner (1chb1n)]

Please provide the charm revision information, juju status, and the charm config from the bundle.

Was this the stable/17.02 stable AODH charm? Or was it some other newer or older revision?

[James Page (james-page)]

ca is currently mandatory in the codebase; triaging as its possible to work around this by using the CA provided by the trusted party.

[Ryan Beisner (1chb1n)]

We will need to repro with current charms and target for next release, possibly a stable backport/update if it meets those requirements. Thank you.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/501640
Committed: https://git.openstack.org/cgit/openstack/charms.openstack/commit/?id=1e35390d63144f67c26882ddb473adb106c2699c
Submitter: Jenkins
Branch: master

commit 1e35390d63144f67c26882ddb473adb106c2699c
Author: James Page <email address hidden>
Date: Thu Sep 7 10:08:41 2017 +0100

    Make config provided CA optional

    When SSL cert and key are provided via configuration, and are signed
    by a known trusted CA, there is no need to configure the ssl_ca
    option as system installed certificates will cover the trust chain
    already.

    Make this option optional.

    Change-Id: I630d5fddb158497cb4e69f45f0c45e1f33c730f3
    Closes-Bug: 1713922