Missing Nova Config Option for Glance Client CA File

[Ryan Heffernan]

Using OS Havana, nova 2013.2.2

There is currently no config option in nova.conf to use a CA cert file to verify glance connections. In order for nova to issue glance client requests to an HTTPS glance endpoint you must turn off certificate validation (glance_api_insecure = True).

Current config in nova.conf to use an HTTPS glance API endpoint:

root@osc:~# grep glance /etc/nova/nova.conf
glance_protocol = https
glance_api_servers = https://osc:9292
glance_api_insecure = True
image_service = nova.image.glance.GlanceImageService

What is missing is an option for the CA cert, which neutron and cinder do have:

root@osc:~# grep ca_certificate /etc/nova/nova.conf
neutron_ca_certificates_file = /etc/nova/ssl/certs/ca.pem
cinder_ca_certificates_file = /etc/nova/ssl/certs/ca.pem

Simple fix in /usr/lib/python2.7/dist-packages/nova/image/glance.py :

1) In glance_opts, add the config option:

    cfg.StrOpt('glance_ca_certificates_file',
                default='',
                help='CA file for glance client to verify server certificates. '),

2) In _create_glance_client, pass cacert to http connection

        # https specific params
        params['insecure'] = CONF.glance_api_insecure
        params['ssl_compression'] = False
        params['cacert'] = CONF.glance_ca_certificates_file

3) Now you can set the CA cert in nova.conf and remove the insecure option:
root@osc:~# grep glance /etc/nova/nova.conf
glance_protocol = https
glance_ca_certificates_file = /etc/nova/ssl/certs/ca.pem
glance_api_servers = https://osc:9292
image_service = nova.image.glance.GlanceImageService

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/84522

[Openstack Gerrit (openstack-gerrit)]

Fix proposed to branch: stable/icehouse
Review: https://review.openstack.org/90372

[Openstack Gerrit (openstack-gerrit)]

Fix proposed to branch: stable/icehouse
Review: https://review.openstack.org/90384

[Matt Riedemann (mriedem)]

This is fixed by https://review.openstack.org/#/c/72974/ now.

[OpenStack Infra (hudson-openstack)]

Change abandoned by Matt Riedemann (<email address hidden>) on branch: master
Review: https://review.openstack.org/84522
Reason: Already fixed:

https://review.openstack.org/#/c/72974/