cors.set_defaults does not have real test coverage in placement and probably not nova either

[Chris Dent]

Both the placement and nova apis allow oslo_middleware.cors in their WSGI middleware stacks.

Placement has some gabbi functional tests which test that the middleware is present and does the right thing when using the middleware's own configuration defaults. Both when it is on or off in cors.yaml and non-cors.yaml.

However, the WSGI application that is actually used in a deployment, the one created by nova/api/openstack/placement/wsgi.py is not used in those functional tests. That code calls the set_defaults method on the cors middleware to change and define those HTTP headers and request methods which will be allowed without further configuration.

As far as I know, nothing (such as a tempest test) confirms those headers in either placement or nova, and it's relatively certain they are incomplete with regard to microversions (as OpenStack-API-Version and X-OpenStack-Nova-API-Version).

This bug is the result of discussion on https://review.openstack.org/#/c/587183/2/nova/api/openstack/placement/wsgi.py

The gabbi tests show the kinds of requests that can be done to confirm the right headers are generated:

https://github.com/openstack/nova/blob/master/nova/tests/functional/api/openstack/placement/gabbits/cors.yaml

https://github.com/openstack/nova/blob/master/nova/tests/functional/api/openstack/placement/gabbits/non-cors.yaml