Redirects to HTTP when SSL enabled

[Bartłomiej Daca]

Environment: multinode kolla deploy with haproxy and SSL

info: In some API calls there are redirects to http URL, not the https. Observed in:
- cinder when listing volumes with pagination
- swift when using Static Web functionality
- nova when listing version details

How to reproduce:

Example for nova:

curl -H 'X-Auth-Token: *****' https://my-cloud:8774/v2/

result:
{
    "version": {
        "status": "SUPPORTED",
        "updated": "2011-01-21T11:33:21Z",
        "links": [
            {"href": "http://my-cloud:8774/v2/", "rel": "self"},
            {"href": "http://docs.openstack.org/", "type": "text/html", "rel": "describedby"}
        ],
        "min_version": "",
        "version": "",
        "media-types": [{"base": "application/json", "type": "application/vnd.openstack.compute+json;version=2"}],
        "id": "v2.0"
    }
}

Example for cinder:

curl -X GET -H 'Content-Type: application/json' -H 'Accept: application/json' -H 'X-Auth-Token: *****' https://my-cloud:8776/v2/{{ tenant_id }}/volumes?limit=1

result:
{
    "volumes_links": [
        {"href": "http://my-cloud:8776/v2/{{ tenant_id }}/volumes?limit=1&marker={{ volume_id }}", "rel": "next"}
    ],
    "volumes": [
        {
            "id": "{{ volume_id }}",
            "links": [
                {"href": "http://my-cloud:8776/v2/{{ tenant_id }}/volumes/{{ volume_id }}", "rel": "self"},
                {"href": "http://my-cloud:8776/{{ tenant_id }}/volumes/{{ volume_id }}", "rel": "bookmark"}
            ],
            "name": "dsf"
        }
    ]
}

I can provide example for swift if someone will be interested, but it is more complicated.

[Christian Berendt (berendt)]

Same for Heat when using the --wait parameter of stack create/update.

[Christian Berendt (berendt)]

For heat: by default the enable_proxy_headers_parsing parameter is set to False in [oslo_middleware] section. This parameter has to be set to True when running heat-api behind a proxy. After settings this parameter to True everything is working like expected. Probably this is the same issue for the other services.

Setting priority to critical, at least Heat is not working behind a proxy using SSL which is a blocker from my POV.

[Jeffrey Zhang (jeffrey4l)]

This is resolved by https://review.openstack.org/#/c/439468/ since pike cycle.