public_endpoint parameter causes incorrect url detection in keystone

[Takashi Kajinami]

Currently the public_endpoint parameter in keystone is set according to public endpoint url of keystone.

However this can cause incorrect request url generation in TripleO deployment especially for requests from admin endpoint, because we use different urls for each keystone endpoints.

For example currently following test cases in tempest are failing when tls is used for public endpoints, because keystone replaces schema in admin endpoint(http) by the one in public endpoint(https) internally when it generates request url to calcurate oauth token.

~~~
keystone_tempest_plugin.tests.api.identity.v3.test_oauth1_tokens.OAUTH1TokensTest.test_authorize_request_token
keystone_tempest_plugin.tests.api.identity.v3.test_oauth1_tokens.OAUTH1TokensTest.test_create_access_token
keystone_tempest_plugin.tests.api.identity.v3.test_oauth1_tokens.OAUTH1TokensTest.test_create_request_token
keystone_tempest_plugin.tests.api.identity.v3.test_oauth1_tokens.OAUTH1TokensTest.test_list_access_tokens
keystone_tempest_plugin.tests.api.identity.v3.test_oauth1_tokens.OAUTH1TokensTest.test_list_roles_for_access_token
keystone_tempest_plugin.tests.api.identity.v3.test_oauth1_tokens.OAUTH1TokensTest.test_revoke_access_token
keystone_tempest_plugin.tests.api.identity.v3.test_oauth1_tokens.OAUTH1TokensTest.test_show_role_for_access_token
~~~

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/ussuri
Review: https://review.opendev.org/743113

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/743114

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/743114
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=ac50d6483da28748877ce2f1ac2d42ec4cc04b8b
Submitter: Zuul
Branch: master

commit ac50d6483da28748877ce2f1ac2d42ec4cc04b8b
Author: Takashi Kajinami <email address hidden>
Date: Mon Jul 27 08:40:48 2020 +0900

    Unset keystone::public_endpoint

    When public_endpoint parameter is set, keystone composes request urls
    from that parameter. However this can cause incorrect url detection
    especially for requests coming from admin endpoint, because we use
    different urls for each endpoints (admin/internal/public) in TripleO
    deployment.

    This patch unsets that public_endpoint parameter and makes keystone
    detect request urls by headers passed from haproxy.

    Closes-bug: #1889017
    Depends-on: https://review.opendev.org/#/c/742349/
    Change-Id: Ib5f017e95f961c04da3201d75ed17424e168b270

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/743113
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=09f524e7094d2ed976cf1cfb4236acf081b80081
Submitter: Zuul
Branch: stable/ussuri

commit 09f524e7094d2ed976cf1cfb4236acf081b80081
Author: Takashi Kajinami <email address hidden>
Date: Mon Jul 27 08:40:48 2020 +0900

    Unset keystone::public_endpoint

    When public_endpoint parameter is set, keystone composes request urls
    from that parameter. However this can cause incorrect url detection
    especially for requests coming from admin endpoint, because we use
    different urls for each endpoints (admin/internal/public) in TripleO
    deployment.

    This patch unsets that public_endpoint parameter and makes keystone
    detect request urls by headers passed from haproxy.

    Closes-bug: #1889017
    Depends-on: https://review.opendev.org/#/c/742350/
    Change-Id: Ib5f017e95f961c04da3201d75ed17424e168b270
    (cherry picked from commit ac50d6483da28748877ce2f1ac2d42ec4cc04b8b)

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/train
Review: https://review.opendev.org/745761

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/745761
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=8120c2df17935381a243831f5e4675822d3c9b43
Submitter: Zuul
Branch: stable/train

commit 8120c2df17935381a243831f5e4675822d3c9b43
Author: Takashi Kajinami <email address hidden>
Date: Mon Jul 27 08:40:48 2020 +0900

    Unset keystone::public_endpoint

    When public_endpoint parameter is set, keystone composes request urls
    from that parameter. However this can cause incorrect url detection
    especially for requests coming from admin endpoint, because we use
    different urls for each endpoints (admin/internal/public) in TripleO
    deployment.

    This patch unsets that public_endpoint parameter and makes keystone
    detect request urls by headers passed from haproxy.

    Closes-bug: #1889017
    Depends-on: https://review.opendev.org/#/c/742412/
    Change-Id: Ib5f017e95f961c04da3201d75ed17424e168b270
    (cherry picked from commit ac50d6483da28748877ce2f1ac2d42ec4cc04b8b)
    (cherry picked from commit 09f524e7094d2ed976cf1cfb4236acf081b80081)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/tripleo-heat-templates 11.4.0 release.