CORS middleware's latent configuration options need to change

[Michael]

It was pointed out in http://lists.openstack.org/pipermail/openstack-dev/2016-February/086746.html that configuration options included in paste.ini are less than optimal, because they impose an upgrade burden on both operators and engineers. The following discussion expanded to all projects (not just those using paste), and the following conclusion was reached:

A) All generated configuration files should contain any headers which the API needs to operate. This is currently supported in oslo.config's generate-config script, as of 3.7.0
B) These same configuration headers should be set as defaults for the given API, using cfg.set_defaults. This permits an operator to simply activate a domain, and not have to worry about tweaking additional settings.
C) All hardcoded headers should be detached from the CORS middleware.
D) Configuration and activation of CORS should be consistent across all projects.

It was also agreed that this is a blocking bug for mitaka. A reference patch has already been approved for keystone, available here: https://review.openstack.org/#/c/285308/

[Michael (krotscheck)]

Note: Ironic does not use oslo's config generator.

[Michael (krotscheck)]

The long-term implications of not updating this patch are that of maintenance. Using latent options is dangerous, because if they go away, and the configuration file does not update (as frequently happens in rolling updates), then suddenly CORS will break. Teams that do not assist in landing this in mitaka will have to carry the burden of maintaining this forward.

[Michael (krotscheck)]

Oslo.config release 3.7.0 is now in global requirements.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/286781

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/286795

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/286818

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/287349

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/287368

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/265415
Committed: https://git.openstack.org/cgit/openstack/nova/commit/?id=61e581c7d852a4227df32349f922ba8873784b21
Submitter: Jenkins
Branch: master

commit 61e581c7d852a4227df32349f922ba8873784b21
Author: Michael Krotscheck <email address hidden>
Date: Tue Mar 1 10:49:32 2016 -0800

    Added Keystone and RequestID headers to CORS middleware

    This patch makes use of oslo.config's genconfig hooks to add
    nova-specific default config values to the generated configuration.
    It also adds this same method to nova's configuration parsing logic,
    to ensure that these default values are also the ones used at runtime.

    Closes-bug: 1551836
    Change-Id: Ic799aea89f681ef8626e996f0357ade388f76ca9

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/287523

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/287547

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/287575

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/288054

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/288491

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/288543

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/288557

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/288599

[Michael (krotscheck)]

https://review.openstack.org/#/c/264909/

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/288528
Committed: https://git.openstack.org/cgit/openstack/solum/commit/?id=dbfdf9f5db2c216e222dfa20e49e7afba932f34c
Submitter: Jenkins
Branch: master

commit dbfdf9f5db2c216e222dfa20e49e7afba932f34c
Author: Michael Krotscheck <email address hidden>
Date: Fri Mar 4 07:29:05 2016 -0800

    Moved CORS middleware configuration into oslo-config-generator

    The default values needed for solum's implementation of cors
    middleware have been moved from paste.ini into the configuration
    hooks provided by oslo.config. Furthermore, these values have been
    added to the default configuration parsing. This ensures
    that if a value remains unset in solum.conf, it will be set
    to use sane defaults, and that an operator modifying the
    configuration file will be presented with a default set of
    necessary sane headers.

    Change-Id: I6f30224ac1b11fc4019dbc5ae5ec1e1fedbfe97d
    Closes-Bug: 1551836

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/287368
Committed: https://git.openstack.org/cgit/openstack/sahara/commit/?id=8b4b3abdaf8d9392bd3a3b53813e5ed4eeed53b6
Submitter: Jenkins
Branch: master

commit 8b4b3abdaf8d9392bd3a3b53813e5ed4eeed53b6
Author: Michael Krotscheck <email address hidden>
Date: Wed Mar 2 10:26:32 2016 -0800

    Moved CORS middleware configuration into oslo-config-generator

    The default values needed for sahara's implementation of cors
    middleware have been moved from paste.ini into the configuration
    hooks provided by oslo.config. Furthermore, these values have been
    added to the default initialization procedure. This ensures
    that if a value remains unset in the configuration file, it will
    fallback to using sane defaults. It also ensures that an operator
    modifying the configuration will be presented with that same
    set of defaults.

    Change-Id: Iedcaa002ff3d40cf61168769bc3946f8c6e42b87
    Closes-Bug: 1551836

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/288054
Committed: https://git.openstack.org/cgit/openstack/aodh/commit/?id=7e638e07edfc33d9c58ecb17a12f56728cd9fcdb
Submitter: Jenkins
Branch: master

commit 7e638e07edfc33d9c58ecb17a12f56728cd9fcdb
Author: Michael Krotscheck <email address hidden>
Date: Thu Mar 3 10:29:20 2016 -0800

    Moved CORS middleware configuration into oslo-config-generator

    The default values needed for aodh's implementation of cors
    middleware have been moved from paste.ini into the configuration
    hooks provided by oslo.config. Furthermore, these values have been
    added to aodh's default configuration parsing. This ensures
    that if a value remains unset in aodh.conf, it will be set
    to use sane defaults, and that an operator modifying the
    configuration file will be presented with a default set of
    necessary sane headers.

    Change-Id: Iccdbbfcc300f4a63fe7a58f0742eef782aff6844
    Closes-Bug: 1551836

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/286781
Committed: https://git.openstack.org/cgit/openstack/ceilometer/commit/?id=309345268bcc115744108cf3c25c02999354739c
Submitter: Jenkins
Branch: master

commit 309345268bcc115744108cf3c25c02999354739c
Author: Michael Krotscheck <email address hidden>
Date: Tue Mar 1 11:09:46 2016 -0800

    Moved CORS middleware configuration into oslo-config-generator

    The default values needed for ceilometer's implementation of cors
    middleware have been moved from paste.ini into the configuration
    hooks provided by oslo.config. Furthermore, these values have been
    added to ceilometer's default configuration parsing. This ensures
    that if a value remains unset in ceilometer.conf, it will be set
    to use sane defaults, and that an operator modifying the
    configuration file will be presented with a default set of
    necessary sane headers.

    Closes-Bug: 1551836
    Change-Id: Iaab90bfa1811bf6d56696648a000f02ee3306285

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/287547
Committed: https://git.openstack.org/cgit/openstack/murano/commit/?id=151d8cfe3091943bf981dc401312054a459b97d2
Submitter: Jenkins
Branch: master

commit 151d8cfe3091943bf981dc401312054a459b97d2
Author: Tin Lam <email address hidden>
Date: Wed Mar 2 19:30:10 2016 -0600

    Moved CORS middleware configuration into oslo-config-generator

    The default values needed for murano's implementation of cors
    middleware have been moved from paste.ini into the configuration
    hooks provided by oslo.config. Furthermore, these values have been
    added to the default initialization procedure. This ensures
    that if a value remains unset in the configuration file, it will
    fallback to using sane defaults. It also ensures that an operator
    modifying the configuration will be presented with that same
    set of defaults.

    Change-Id: I50a204e27a43991d94cfb5f39c1dd3e904eb5696
    Closes-Bug: #1551836

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/287274
Committed: https://git.openstack.org/cgit/openstack/glance/commit/?id=7a93458baa99f6b8c1538f14f521703082af9c42
Submitter: Jenkins
Branch: master

commit 7a93458baa99f6b8c1538f14f521703082af9c42
Author: Michael Krotscheck <email address hidden>
Date: Wed Mar 2 07:48:05 2016 -0800

    Moved CORS middleware configuration into oslo-config-generator

    The default values needed for glance's implementation of cors
    middleware have been moved from paste.ini into the configuration
    hooks provided by oslo.config. Furthermore, these values have been
    added to glance's default configuration parsing. This ensures
    that if a value remains unset in glance-api.conf, it will be set to use
    sane defaults, and that an operator modifying the configuration
    file will be presented with a default set of necessary sane headers.

    Change-Id: I3c9d267b6224d6c7e5cc2c41cb51fb7e363c4955
    Closes-Bug: 1551836

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/287575
Committed: https://git.openstack.org/cgit/openstack/manila/commit/?id=75d85aab3c7e1c2879a385f3e6eb8f96e6ceeb60
Submitter: Jenkins
Branch: master

commit 75d85aab3c7e1c2879a385f3e6eb8f96e6ceeb60
Author: Tin Lam <email address hidden>
Date: Wed Mar 2 21:19:24 2016 -0600

    Moved CORS middleware configuration into oslo-config-generator

    The default values needed for manila's implementation of cors
    middleware have been moved from paste.ini into the configuration
    hooks provided by oslo.config. Furthermore, these values have been
    added to the default initialization procedure. This ensures
    that if a value remains unset in the configuration file, it will
    fallback to using sane defaults. It also ensures that an operator
    modifying the configuration will be presented with that same
    set of defaults.

    Change-Id: Ie4adc39866a4ee6132eab6a111660218b3e6e5bd
    Closes-Bug: #1551836

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/287354
Committed: https://git.openstack.org/cgit/openstack/searchlight/commit/?id=8c4ec967bc0e2aa0d7b3d658569aff1f36e6f442
Submitter: Jenkins
Branch: master

commit 8c4ec967bc0e2aa0d7b3d658569aff1f36e6f442
Author: Michael Krotscheck <email address hidden>
Date: Wed Mar 2 09:57:08 2016 -0800

    Moved CORS middleware configuration into oslo-config-generator

    The default values needed for searchlight's implementation of cors
    middleware have been moved from paste.ini into the configuration
    hooks provided by oslo.config. Furthermore, these values have been
    added to the default initialization procedure. This ensures
    that if a value remains unset in the configuration file, it will
    fallback to using sane defaults. It also ensures that an operator
    modifying the configuration will be presented with that same
    set of defaults.

    Change-Id: Iada9cedcdc5b104bf2fa1c68d0d74794c04d1d28
    Closes-Bug: 1551836

[OpenStack Infra (hudson-openstack)]

Change abandoned by Rongze Zhu (<email address hidden>) on branch: master
Review: https://review.openstack.org/287349

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/288491
Committed: https://git.openstack.org/cgit/openstack/designate/commit/?id=771f5a205f08da1828bd4cb13fc9e1e0871a8041
Submitter: Jenkins
Branch: master

commit 771f5a205f08da1828bd4cb13fc9e1e0871a8041
Author: Michael Krotscheck <email address hidden>
Date: Fri Mar 4 06:34:15 2016 -0800

    Moved CORS middleware configuration into set_defaults

    The default values needed for designate's implementation of cors
    middleware have been moved from paste.ini into a common
    set_defaults method, invoked on load. Unlike similar patches
    on other services, this patch does not include config-generation
    hooks, as designate does not use it.

    Change-Id: I6661f67bbdc36e17bc297128b470007e4762b603
    Closes-Bug: 1551836

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/286818
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=aae181817e5f463a959b08477e9c2c8d94eadc25
Submitter: Jenkins
Branch: master

commit aae181817e5f463a959b08477e9c2c8d94eadc25
Author: Michael Krotscheck <email address hidden>
Date: Tue Mar 1 12:21:33 2016 -0800

    Moved CORS middleware configuration into oslo-config-generator

    The default values needed for neutron's implementation of cors
    middleware have been moved from paste.ini into the configuration
    hooks provided by oslo.config. Furthermore, these values have been
    added to neutron's default configuration parsing. This ensures
    that if a value remains unset in neutron.conf, it will be set to use
    sane defaults, and that an operator modifying the configuration
    file will be presented with a default set of necessary sane headers.

    Change-Id: I327d1d7ce50dd4a20d781e6251a5af81c57e6ca1
    Closes-Bug: 1551836

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/286795
Committed: https://git.openstack.org/cgit/openstack/cinder/commit/?id=abba4921845cbdb66dfb5112c20dc04446870a42
Submitter: Jenkins
Branch: master

commit abba4921845cbdb66dfb5112c20dc04446870a42
Author: Michael Krotscheck <email address hidden>
Date: Tue Mar 1 11:31:40 2016 -0800

    Moved CORS middleware configuration into oslo-config-generator

    The default values needed for cinder's implementation of cors
    middleware have been moved from paste.ini into the configuration
    hooks provided by oslo.config. Furthermore, these values have been
    added to cinder's default configuration parsing. This ensures
    that if a value remains unset in cinder.conf, it will be set
    to use sane defaults, and that an operator modifying the
    configuration file will be presented with a default set of
    necessary sane headers.

    Depends-on: I658e54966c390b41e3b551dd9827606c2e013511
    Change-Id: Ia8735d5952d7e03b6948f748afead13e6f890271
    Closes-Bug: 1551836

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/288557
Committed: https://git.openstack.org/cgit/openstack/magnum/commit/?id=a5883fd3afc204619218769229026020c65fff84
Submitter: Jenkins
Branch: master

commit a5883fd3afc204619218769229026020c65fff84
Author: Michael Krotscheck <email address hidden>
Date: Fri Mar 4 08:11:28 2016 -0800

    Moved CORS middleware configuration into oslo-config-generator

    The default values needed for magnum's implementation of cors
    middleware have been moved from paste.ini into the configuration
    hooks provided by oslo.config. Furthermore, these values have been
    added to the default initialization procedure. This ensures
    that if a value remains unset in the configuration file, it will
    fallback to using sane defaults. It also ensures that an operator
    modifying the configuration will be presented with that same
    set of defaults.

    Change-Id: I7d8f8708d53bbab117600070982ac80482fa0a77
    Closes-Bug: 1551836

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/288498
Committed: https://git.openstack.org/cgit/openstack/mistral/commit/?id=54296b15192daf01a49e9f0a5839f1d92f572a2d
Submitter: Jenkins
Branch: master

commit 54296b15192daf01a49e9f0a5839f1d92f572a2d
Author: Michael Krotscheck <email address hidden>
Date: Fri Mar 4 06:49:21 2016 -0800

    Moved CORS middleware configuration into oslo-config-generator

    The default values needed for mistral's implementation of cors
    middleware have been moved from paste.ini into the configuration
    hooks provided by oslo.config. Furthermore, these values have been
    added to the default configuration parsing. This ensures
    that if a value remains unset in mistral.conf, it will be set
    to use sane defaults, and that an operator modifying the
    configuration file will be presented with a default set of
    necessary sane headers.

    Change-Id: I1174fa44f316be60fdc86a4d1032ca71c9827a25
    Closes-Bug: 1551836

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/287523
Committed: https://git.openstack.org/cgit/openstack/barbican/commit/?id=034d09ec55c219c88104a289c30a9ddc2cb114c4
Submitter: Jenkins
Branch: master

commit 034d09ec55c219c88104a289c30a9ddc2cb114c4
Author: Tin Lam <email address hidden>
Date: Wed Mar 2 18:07:41 2016 -0600

    Moved CORS middleware configuration into set_defaults

    The default values needed for barbican's implementation of cors
    middleware have been moved from paste.ini into a common
    set_middleware_defaults method, invoked on load.

    Change-Id: I5722bfc31534936fd07a8dee4ca24afe81c06682
    Closes-Bug: #1551836

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/287585
Committed: https://git.openstack.org/cgit/openstack/congress/commit/?id=c596b89c489c1172473af4f8e7e1d4afdaa656d9
Submitter: Jenkins
Branch: master

commit c596b89c489c1172473af4f8e7e1d4afdaa656d9
Author: Tin Lam <email address hidden>
Date: Wed Mar 2 22:19:31 2016 -0600

    Moved CORS middleware configuration into oslo-config-generator

    The default values needed for congress's implementation of cors
    middleware have been moved from paste.ini into the configuration
    hooks provided by oslo.config. Furthermore, these values have been
    added to the default initialization procedure. This ensures
    that if a value remains unset in the configuration file, it will
    fallback to using sane defaults. It also ensures that an operator
    modifying the configuration will be presented with that same
    set of defaults.

    Change-Id: I2edc24e4d47c4d664dd31c407d46e42fefdb1488
    Closes-Bug: #1551836

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/288543
Committed: https://git.openstack.org/cgit/openstack/trove/commit/?id=552f1f2070953ed117ce7abe4261961c8899e248
Submitter: Jenkins
Branch: master

commit 552f1f2070953ed117ce7abe4261961c8899e248
Author: Michael Krotscheck <email address hidden>
Date: Fri Mar 4 07:43:58 2016 -0800

    Moved CORS middleware configuration into set_defaults

    The default values needed for trove's implementation of cors
    middleware have been moved from paste.ini into a common
    set_defaults method, invoked on load. Unlike similar patches
    on other services, this patch does not include config-generation
    hooks, as trove doesn't use them yet.

    Change-Id: Id8e04249498f63e42dadcacbd2c08b525adc0958
    Closes-Bug: 1551836

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/288599
Committed: https://git.openstack.org/cgit/openstack/heat/commit/?id=59ccb2f7515be43ca06436d2131bfa2b737ee092
Submitter: Jenkins
Branch: master

commit 59ccb2f7515be43ca06436d2131bfa2b737ee092
Author: Michael Krotscheck <email address hidden>
Date: Fri Mar 4 09:20:45 2016 -0800

    Moved CORS middleware configuration into oslo-config-generator

    The default values needed for heat's implementation of cors
    middleware have been moved from paste.ini into the configuration
    hooks provided by oslo.config. Furthermore, these values have been
    added to the default configuration parsing. This ensures
    that if a value remains unset in heat.conf, it will be set
    to use sane defaults, and that an operator modifying the
    configuration file will be presented with a default set of
    necessary sane headers.

    Change-Id: Ie3791007b33788829417ce508a3c719ae626bbce
    Closes-Bug: 1551836

[Thierry Carrez (ttx)]

This issue was fixed in the openstack/glance 12.0.0.0rc1 release candidate.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/288074
Committed: https://git.openstack.org/cgit/openstack/cue/commit/?id=98bd25c5849cc6ffab8df36bab89187ef3052716
Submitter: Jenkins
Branch: master

commit 98bd25c5849cc6ffab8df36bab89187ef3052716
Author: Michael Krotscheck <email address hidden>
Date: Thu Mar 3 11:23:21 2016 -0800

    Moved CORS middleware configuration into oslo-config-generator

    The default values needed for cue's implementation of cors
    middleware have been moved from paste.ini into the configuration
    hooks provided by oslo.config. Furthermore, these values have been
    added to the default initialization procedure. This ensures
    that if a value remains unset in the configuration file, it will
    fallback to using sane defaults. It also ensures that an operator
    modifying the configuration will be presented with that same
    set of defaults.

    Change-Id: Ia179bbd7489ca128186990439a161903b7b4c28d
    Closes-Bug: 1551836

[Thierry Carrez (ttx)]

This issue was fixed in the openstack/heat 6.0.0.0rc1 release candidate.

[Thierry Carrez (ttx)]

This issue was fixed in the openstack/neutron 8.0.0.0rc1 release candidate.

[Thierry Carrez (ttx)]

This issue was fixed in the openstack/cinder 8.0.0.0rc1 release candidate.

[Thierry Carrez (ttx)]

This issue was fixed in the openstack/mistral 2.0.0.0rc1 release candidate.

[Thierry Carrez (ttx)]

This issue was fixed in the openstack/sahara 4.0.0.0rc1 release candidate.

[Thierry Carrez (ttx)]

This issue was fixed in the openstack/trove 5.0.0.0rc1 release candidate.

[Doug Hellmann (doug-hellmann)]

This issue was fixed in the openstack/designate 2.0.0.0rc1 release candidate.

[Doug Hellmann (doug-hellmann)]

This issue was fixed in the openstack/ceilometer 6.0.0.0rc1 release candidate.

[Doug Hellmann (doug-hellmann)]

This issue was fixed in the openstack/aodh 2.0.0.0rc1 release candidate.

[Doug Hellmann (doug-hellmann)]

This issue was fixed in the openstack/manila 2.0.0.0rc1 release candidate.

[Thierry Carrez (ttx)]

This issue was fixed in the openstack/congress 3.0.0.0rc1 release candidate.

[Thierry Carrez (ttx)]

This issue was fixed in the openstack/barbican 2.0.0.0rc1 release candidate.

[Thierry Carrez (ttx)]

This issue was fixed in the openstack/searchlight 0.2.0.0rc1 release candidate.

[Thierry Carrez (ttx)]

This issue was fixed in the openstack/solum 4.1.1 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/magnum 2.0.0 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/manila 2.0.0 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/solum 4.1.1 release.