insecure option in client_heat not working

[jz]

The curl command will fail in some environments because of SSL problem。
As I looked into the code, this curl seems hard coded, look below,
            elif key == self.CURL_CLI:
                # Construct curl command for template-author convenience
                return ("curl -i -X POST "
                        "-H 'X-Auth-Token: %(token)s' "
                        "-H 'Content-Type: application/json' "
                        "-H 'Accept: application/json' "
                        "%(endpoint)s" %
                        dict(token=self.data().get('token'),
                             endpoint=self.data().get('endpoint')))
but the following configuration option should exist for adding --insecure option to the command:
#####
[clients_heat]

# If set, then the server's certificate will not be verified. (boolean value)
insecure = true
#####

[Thomas Herve (therve)]

Note that the curl command isn't actually used to talk to Heat. Maybe it just needs to be updated to contain insecure, but if you have issues with API calls, it comes from something else. Do you have a traceback?

[jz (danielradcliffe2004)]

I just recorded the curl command.
the code is in wait_condition_handler.py

curl -i -X POST -H 'X-Auth-Token: gAAAAABV3Ge3e6TC5-81S5BY7UFYl5a1c5Zo03k3PWgAIETB2LOmPcABx45cna2z9dXe82ZWHWXln9sn_h6nCkeJ87VugjH9qIgO7bLpY3vtBWXTmyHqQHTeTK2Zz8e2Oj8YlYgMck_oOLPJ_BeLhe7F0s9tX7Zof2K-moJofUaqy7Ub0aRMD2A%3D' -H 'Content-Type: application/json' -H 'Accept: application/json' https://vio.corp.local:8004/v1/d5e9dd3a8c9c49c09871bec977be9e42/stacks/test-stack-mysql-s7difvshuuef/32fae1bd-b17f-4b25-b048-fa78e15f37fb/resources/wait_handle/signal --data-binary '{"status": "SUCCESS"}'

I think we need to fix it to ensure that curl can pass '--insecure' as part of
the request to ignore the cert issue since we have insecure option in config files.

[Steve Baker (steve-stevebaker)]

Setting to low priority, since the printed curl command is purely for user debug logging.

[jz (danielradcliffe2004)]

but we often use the url as part of the user_data of an instance to signal back. if insecure is not supported, then this can not be fulfilled in this case.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/303322

[OpenStack Infra (hudson-openstack)]

Change abandoned by Zeng Tao (<email address hidden>) on branch: master
Review: https://review.openstack.org/303322

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/303357

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/303357
Committed: https://git.openstack.org/cgit/openstack/heat/commit/?id=8f98d34f3649d884b6bfc79e1e99e2aec7a4e137
Submitter: Jenkins
Branch: master

commit 8f98d34f3649d884b6bfc79e1e99e2aec7a4e137
Author: danny <email address hidden>
Date: Sat Apr 9 19:33:09 2016 +0800

    Add --insecure in CURL if set True in client option

    The CURL attribute is offen used as part of
    the user data to signal back to heat in wait
    handle. If the insecure option is set True in
    the clients_heat option, we need to add
    --insecure to the CURL url to make it work.

    Change-Id: I153a9c71837ee61632e0cf39254bbbc66427b1de
    Closes-Bug: #1505958

[Doug Hellmann (doug-hellmann)]

This issue was fixed in the openstack/heat 7.0.0.0b2 development milestone.