ironic fails when glance-api is deployed under uwsgi as vhost

[Pavlo Shchelokovskyy]

Recently glance-api has moved to UWSGI+apache, and this broke ironic.

We perform no discovery of glance API endpoint from keystone catalog. Instead we rely on glance api to be always configured as host:port in ironic.conf, but that is broken when there is no port in http://<IP>/image.

Besides, we are using urljoin to form a path to image in some places, and that would break also, since

urljoin('http://<IP>/image', '/v1/images') == 'http://<IP>/v1/images'

loosing vhost altogether.

[John L. Villalovos (happycamp)]

The devstack patch which appears to have broken the gate: https://review.openstack.org/#/c/459451/

[John L. Villalovos (happycamp)]

A revert has been proposed: https://review.openstack.org/#/c/476108/

[Monty Taylor (mordred)]

I think we should fix just ironic. I'm about to AFK for about 3 hours, but when I come back online I'll write a patch for you. Consuming glance by just hitting host:port is fragile at best and, as you can see, doesn't actually work.

[Monty Taylor (mordred)]

Oh! Pavlo already has patches up for that. I love the direction they're going - it's much better.

I'll go review them when I get back - thanks Pavlo!

[Pavlo Shchelokovskyy (pshchelo)]

The patch fixing the glance handling in ironic is https://review.openstack.org/#/c/467728,

but in order to have more clean/separated commits we still need that revert in devstack to land the first patch in the series https://review.openstack.org/#/c/469627/14

otherwise would need to squash those two into a giant pile of code.

Apparently not only ironic was broken (seems like dib is too) so chances for revert in devstack are non-zero.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/476498

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/476498
Committed: https://git.openstack.org/cgit/openstack/ironic/commit/?id=cb7cdd35347c76e1ca66644532be1b6c898491c1
Submitter: Jenkins
Branch: master

commit cb7cdd35347c76e1ca66644532be1b6c898491c1
Author: Dmitry Tantsur <email address hidden>
Date: Thu Jun 22 14:33:32 2017 +0200

    Fetch Glance endpoint from Keystone if it's not provided in the configuration

    This is needed to fix the CI broken by glance switching to running
    under wsgi, and thus breaking our assumption that glance is accessible
    by host:port only.

    The options glance_host, glance_port and glance_protocol were
    deprecated. Standalone deployments should use glance_api_servers
    instead.

    Also removes two unused utility functions.

    Change-Id: I54dc04ab084aeb7208c9dd9940c6434c029bf41c
    Partial-Bug: #1699542

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/477768

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/477768
Committed: https://git.openstack.org/cgit/openstack/mogan/commit/?id=f4ca7840c8e52c354a494c29141362095facaa0b
Submitter: Jenkins
Branch: master

commit f4ca7840c8e52c354a494c29141362095facaa0b
Author: liusheng <email address hidden>
Date: Tue Jun 27 14:05:04 2017 +0800

    Change the glance_api_servers to adapt glance started with uwsgi

    If deploying glance api servers under uwsgi mode, the endpoint won't
    include port in its url. That will broken gate if we config the glance
    api url including port.

    Change-Id: Id610d6fd3482e6281f498300b3cde7cd45b017bc
    Closes-Bug: #1699542

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/469627
Committed: https://git.openstack.org/cgit/openstack/ironic/commit/?id=308e414a57941675acf6cd825daafc653cf5927e
Submitter: Jenkins
Branch: master

commit 308e414a57941675acf6cd825daafc653cf5927e
Author: Pavlo Shchelokovskyy <email address hidden>
Date: Fri Jun 23 14:17:26 2017 +0000

    Introduce keystoneauth adapters for clients

    Currently ironic explicitly or implicitly sets the API urls
    for most services in the config.
    This is quite fragile and we should move to discovery from
    the keystone catalog eventually.

    To support this, this patch registers `keystoneauth1.adapter.Adapter`
    options to all config sections for service clients auth.
    Among others it exports `interfaces` option that we set to
    ['internal', 'public'] by default.
    Other exported options are `service_type`, `service_name`, `region_name`
    and `endpoint_override`.
    The latter will eventually be used by all clients to specify a specific
    endpoint to use (for example in noauth mode).

    Effectively this patch starts to move all clients code to load client
    configuration from config for all of auth, session and adapter.

    The first to move is [service_catalog] section, with [conductor]api_url
    option being deprecated in favor of [service_catalog]endpoint_override.
    A sane default of 'service_type' = 'baremetal' is set for this config
    section as well.

    More patches moving other clients to consume these new options and
    deprecate some other options will follow.

    Change-Id: I1283ef3b4d736ac089df0cc74a5850a93b24b6ab
    Partial-Bug: #1699547
    Related-Bug: #1699542

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/467728
Committed: https://git.openstack.org/cgit/openstack/ironic/commit/?id=63e0ff2f6ce3a8275c262127e046fffbb1f1ff65
Submitter: Zuul
Branch: master

commit 63e0ff2f6ce3a8275c262127e046fffbb1f1ff65
Author: Pavlo Shchelokovskyy <email address hidden>
Date: Tue Jun 6 14:15:42 2017 +0000

    Rework keystone auth for glance

    this patch changes the way glance client is instantiated, using
    keystoneauth sessions and adapters.

    In order to support glance API endpoint discovery from keystone catalog
    and more unified way of client loading,
    many options in `[glance]` config sections are deprecated,
    mostly those that specified a (set of) glance API endpoint(s)
    or parts of glance API address.
    Instead, a single option `[glance]endpoint_override` must be used when
    required to access a specific (possibly load-balanced)
    glance API endpoint without discovering it from keystone catalog.

    Another set of deprecated options are those that are duplicating
    keystoneauth session options in [glance] section.

    Also, intrinsic support for parsing the glance API URL from image ref
    set to the full glance REST path to the image is removed as it was not
    working any way since an 'http(s)://' image ref is not treated
    as a glance image.

    Change-Id: I6a93b71ac097e951dfc93fd1ee4d7ef483514f2c
    Partial-Bug: #1699547
    Closes-Bug: #1699542

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/ironic 10.0.0 release.

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: stable/pike
Review: https://review.openstack.org/552515

[OpenStack Infra (hudson-openstack)]

Change abandoned by Jacek Tomasiak (<email address hidden>) on branch: stable/pike
Review: https://review.openstack.org/552515
Reason: Closing in favor of: https://review.openstack.org/#/c/553330/