We have a setup where our service public endpoints are HTTPS (to a host running Apache Traffic Server which then maps the request to use HTTP to the actual service) while the internal and admin endpoints are HTTP that should never be used off the Openstack hosts.
The problem is that make_url in util.py (https://github.com/openstack/heat/blob/master/heat/api/openstack/v1/util.py#L69) is using the current request's URL (which could be the internal URL) to generate the redirect URL to send back to the client. In our case, we end up with the client getting a URL that it can't access and <BOOM>.
We're seeing this in Icehouse and it doesn't looks like the code has changed in Juno.
We're currently doing a local patch to fix this (below is the exact code that we're currently using for make_url). We'd like to...
1. Fix this in a less hacky way if possible.
2. Get the fix into the upstream code base in case other folks have different URLs for public and internal endpoints *and* allow us to get rid of a local patch.
I'm happy to work on the fix for this. Just let me know how you'd would prefer to go about it.
Thanks,
Ken
def make_url(req, identity):
'''Return the URL for the supplied identity dictionary.'''
try:
stack_identity = identifier.HeatIdentifier(**identity)
except ValueError:
err_reason = _('Invalid Stack address')
raise exc.HTTPInternalServerError(err_reason)
########### BEGIN PATCH
# See if we can get the public endpoint from the service catalog
# in the headers. Yes, we could try to put it into the request context
# but we're going to process it per request, and if we put it there
# (1) We'd process it for every request and not just the ones that
# need it.
# (2) It would complicate this patch by spreading it across multiple
# files
# If we can't get the service catalog or find the public endpoint for
# heat, then use the old logic.
try:
sc = json_loads(req.headers['X-Service-Catalog'])
if sc:
# Walk through the entries and look for the 'heat' info
for entry in sc:
if entry.get('name') == 'heat':
# The endpoints will be an array of dicts, walk through em
for endpoint_data in entry.get('endpoints'):
pu = endpoint_data.get('publicURL')
if pu:
# If we found the public URL, let urlparse
# do the work of splicing it to the stack info
newurl = urlparse.urljoin(
pu,
stack_identity.url_path())
logger.debug('Used public endpoint::%s' % newurl)
return newurl
except Exception, ex:
# This is okay. It just means that we had a problem getting the
# service catalog. We'll just ignore it and use the pre-patch code
logger.debug("No service catalog, do it the old way, ex:%s" % ex)
########### END PATCH
return req.relative_url(stack_identity.url_path(), True)
We have a similar set up.
Would this bug be the reason we are seeing the following in horizon?
2015-04-01 08:16:39,837 8800 ERROR django.request Internal Server Error: /dashboard/
Traceback (most recent call last):
File "/usr/lib/
response = callback(request, *callback_args, **callback_kwargs)
File "/usr/lib/
return view_func(request, *args, **kwargs)
File "/usr/lib/
return view_func(request, *args, **kwargs)
File "/usr/lib/
return view_func(request, *args, **kwargs)
File "/usr/lib/
return view_func(request, *args, **kwargs)
File "/usr/lib/
return self.dispatch(
File "/usr/lib/
return handler(request, *args, **kwargs)
File "/usr/lib/
return self.get(request, *args, **kwargs)
File "/usr/lib/
handled = self.construct_
File "/usr/lib/
handled = self.handle_
File "/usr/lib/
handled = self._tables[
File "/usr/lib/
return self.take_
File "/usr/lib/
response = action.
File "/usr/lib/
return self.handle(
File "/usr/lib/
exceptions.
File "/usr/lib/
self.
File "/usr/share/
api.
File "/usr/share/
return heatclient(
File "/usr/lib/
self.
File "/usr/lib/
return self.client.
File "/usr/lib/
return self.raw_