cinder-api lost SSL in oslo.service wsgi move for M

[Martin Millnert]

Following the move to wsgi eventlet server from oslo.service, cinder-api lost the ability to run the wsgi eventlet server with SSL on, that existed in Liberty:

liberty: 2016-06-09 18:54:21.663 4708 INFO eventlet.wsgi.server [-] (4708) wsgi starting up on https://0.0.0.0:8776
mitaka: 2016-06-09 18:25:28.911 26920 INFO eventlet.wsgi.server [-] (26920) wsgi starting up on http://0.0.0.0:8776

With otherwise identical config, including SSL options, etc. The change that migrated to oslo.service, was https://github.com/openstack/cinder/commit/b4c8bb3912972a4417c9efa93cb209f5efe76a14 .

It's probably merely a question of picking up the config options and passing them along?

[Justin A Wilson (justin-wilson)]

The code for turning on SSL for the Cinder API is there, even though there is no option to turn it on via the config file. I managed to enable it, but it caused issues with the Cinder client's and the Openstack client's ability to connect to the endpoint. Furthermore, the Openstack Security Guide (http://docs.openstack.org/security-guide/secure-communication/secure-reference-architectures.html) recommends that you encrypt the traffic by using a SSL/TLS enabled proxy in between it anyways.

[[e-mail] (dyyang)]

We just met the same issue when enabling SSL for cinder-api in Newton release, any progress or plan on fixing this?

[Justin A Wilson (justin-wilson)]

I'm still working at it. The cinder client seems to be using the wrong protocol (http). I'm currently looking into how it selects which protocol should be used.

[Justin A Wilson (justin-wilson)]

I was able to get SSL working, though you must modify the Cinder API endpoint and supply the CA file to the client each time you want to use it. Horizon's configuration must be updated as well, because it isn't aware that SSL is enabled for the cinder endpoint by default. So, a the location of the CA file must be assigned to OPENSTACK_SSL_CACERT somewhere in local_settings.py so that Horizon can supply that to the Cinder client.

[Justin A Wilson (justin-wilson)]

https://review.openstack.org/#/c/352958/10

[Nicolas Bock (nicolasbock)]

Justin, are you planning on backporting your fix for Mitaka?

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/352958
Committed: https://git.openstack.org/cgit/openstack/cinder/commit/?id=19544f781eadce8ad86fd4dab80f5e5439b3418a
Submitter: Jenkins
Branch: master

commit 19544f781eadce8ad86fd4dab80f5e5439b3418a
Author: Justin A Wilson <email address hidden>
Date: Tue Aug 9 17:59:59 2016 +0300

    Added config option to enable SSL

    Added option, osapi_volume_use_ssl, to the Cinder configuration that restores
    its capability of utilizing SSL to encrypt the traffic to and from
    the endpoint.

    Change-Id: I6ecd6eda1eb0300e53b3088cd36c7e22dc79240d
    Closes-Bug: 1590901

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/cinder 9.0.0.0rc1 release candidate.

[Radoslav (radoslav-milanov)]

Is this going to be fixed in Mitaka?

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/cinder 9.0.0.0rc1 release candidate.

[Edgar Magana (emagana)]

We would like have this back-ported to Mitaka. We are using https://repos.fedorapeople.org/repos/openstack/openstack-mitaka/

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/mitaka
Review: https://review.openstack.org/395159

[OpenStack Infra (hudson-openstack)]

Change abandoned by Justin A Wilson (<email address hidden>) on branch: stable/mitaka
Review: https://review.openstack.org/395159
Reason: Messed up commit

[Justin A Wilson (justin-wilson)]

Successfully backported after screwing up the commands the first time

https://review.openstack.org/#/c/395159/

[OpenStack Infra (hudson-openstack)]

Change abandoned by Justin A Wilson (<email address hidden>) on branch: stable/mitaka
Review: https://review.openstack.org/395159