From 07119c26d140fd06c86ce825967582a42187e5f0 Mon Sep 17 00:00:00 2001
From: Amrith Kumar <amrith@tesora.com>
Date: Sat, 17 Oct 2015 19:27:44 -0400
Subject: [PATCH 1/2] Incorrect usage of python-novaclient

This usage was causing an annoying error message. I've addressed it in
a configurable way. There's a new config parameter that can be
changed.

Change-Id: I78832d0bb2ecdc49901b74d3811764a9676f7c8b
Closes-Bug: #1493576
---
 trove/common/cfg.py                              | 2 ++
 trove/common/remote.py                           | 4 ++--
 trove/tests/unittests/mgmt/test_models.py        | 2 +-
 trove/tests/unittests/taskmanager/test_models.py | 2 +-
 trove/tests/util/__init__.py                     | 6 ++++--
 5 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/trove/common/cfg.py b/trove/common/cfg.py
index afab91c..534676d 100644
--- a/trove/common/cfg.py
+++ b/trove/common/cfg.py
@@ -54,6 +54,8 @@ common_opts = [
                help='Service type to use when searching catalog.'),
     cfg.StrOpt('nova_compute_endpoint_type', default='publicURL',
                help='Service endpoint type to use when searching catalog.'),
+    cfg.IntOpt('nova_client_version', default=2,
+               help="The version of of the compute service client."),
     cfg.StrOpt('neutron_url', help='URL without the tenant segment.'),
     cfg.StrOpt('neutron_service_type', default='network',
                help='Service type to use when searching catalog.'),
diff --git a/trove/common/remote.py b/trove/common/remote.py
index 3f917fa..70be968 100644
--- a/trove/common/remote.py
+++ b/trove/common/remote.py
@@ -22,7 +22,7 @@ from trove.common.strategies.cluster import strategy
 from cinderclient.v2 import client as CinderClient
 from heatclient.v1 import client as HeatClient
 from keystoneclient.service_catalog import ServiceCatalog
-from novaclient.v2.client import Client
+from novaclient.client import Client
 from swiftclient.client import Connection
 
 CONF = cfg.CONF
@@ -97,7 +97,7 @@ def nova_client(context):
                            endpoint_region=CONF.os_region_name,
                            endpoint_type=CONF.nova_compute_endpoint_type)
 
-    client = Client(context.user, context.auth_token,
+    client = Client(CONF.nova_client_version, context.user, context.auth_token,
                     bypass_url=url, tenant_id=context.tenant,
                     auth_url=PROXY_AUTH_URL)
     client.client.auth_token = context.auth_token
diff --git a/trove/tests/unittests/mgmt/test_models.py b/trove/tests/unittests/mgmt/test_models.py
index 232996f..38b5696 100644
--- a/trove/tests/unittests/mgmt/test_models.py
+++ b/trove/tests/unittests/mgmt/test_models.py
@@ -16,7 +16,7 @@
 import uuid
 
 from mock import MagicMock, patch, ANY
-from novaclient.v2 import Client
+from novaclient.client import Client
 from novaclient.v2.flavors import FlavorManager, Flavor
 from novaclient.v2.servers import Server, ServerManager
 from oslo_config import cfg
diff --git a/trove/tests/unittests/taskmanager/test_models.py b/trove/tests/unittests/taskmanager/test_models.py
index b9283d9..3860100 100644
--- a/trove/tests/unittests/taskmanager/test_models.py
+++ b/trove/tests/unittests/taskmanager/test_models.py
@@ -634,7 +634,7 @@ class BuiltInstanceTasksTest(trove_testtools.TestCase):
 
         self.instance_task._guest = MagicMock(spec=trove.guestagent.api.API)
         self.instance_task._nova_client = MagicMock(
-            spec=novaclient.v2.Client)
+            spec=novaclient.client)
         self.stub_server_mgr = MagicMock(
             spec=novaclient.v2.servers.ServerManager)
         self.stub_running_server = MagicMock(
diff --git a/trove/tests/util/__init__.py b/trove/tests/util/__init__.py
index f87acc7..2827a44 100644
--- a/trove/tests/util/__init__.py
+++ b/trove/tests/util/__init__.py
@@ -38,6 +38,7 @@ from sqlalchemy import create_engine
 from troveclient.compat import Dbaas
 from troveclient.compat import exceptions
 
+from trove.common import cfg
 from trove.common.utils import import_class
 from trove.common.utils import import_object
 from trove.tests.config import CONFIG as test_config
@@ -47,6 +48,7 @@ from trove.tests.util.users import Requirements
 
 
 WHITE_BOX = test_config.white_box
+CONF = cfg.CONF
 
 
 def assert_http_code(expected_http_code, func, *args, **kwargs):
@@ -162,10 +164,10 @@ def create_nova_client(user, service_type=None):
     if test_config.nova_client is None:
         raise SkipTest("No nova_client info specified in the Test Config "
                        "so this test will be skipped.")
-    from novaclient.v2.client import Client
+    from novaclient.client import Client
     if not service_type:
         service_type = test_config.nova_client['nova_service_type']
-    openstack = Client(user.auth_user, user.auth_key,
+    openstack = Client(CONF.nova_client_version, user.auth_user, user.auth_key,
                        user.tenant, test_config.nova_client['auth_url'],
                        service_type=service_type, no_cache=True,
                        cacert=test_config.values.get('cacert', None))
-- 
2.7.0


From b85a2513267d3c5080bd8574829bdaa616013404 Mon Sep 17 00:00:00 2001
From: Amrith Kumar <amrith@tesora.com>
Date: Tue, 26 Jan 2016 13:24:53 -0500
Subject: [PATCH 2/2] Allow Trove to use insecure API for other services

If self-signed certificates are in use, you need to be able to inform
Trove that it should establish an insecure connection with those
services. Many OpenStack services support this by passing an insecure
argument to the HTTPClient.

This change adds new configuration options:

nova_api_insecure,
neutron_api_insecure,
cinder_api_insecure,
swift_api_insecure, and
api_insecure

Each of the first four determine whether or not the API's for those
services is insecure (default=False). The fifth one indicates that all
of them are insecure (default=False).

You could therefore choose to turn on insecure on just one of the
services, or easily enable it for all services that Trove accesses.

Change-Id: I26212098fdbabd479de645c42c584f378d498b17
Closes-Bug: #1535895
Doc-Impact: Trove now supports self-signed certificates for other services.
---
 trove/common/cfg.py    | 15 +++++++++++++++
 trove/common/remote.py | 13 +++++++++----
 2 files changed, 24 insertions(+), 4 deletions(-)

diff --git a/trove/common/cfg.py b/trove/common/cfg.py
index 534676d..0de9b9c 100644
--- a/trove/common/cfg.py
+++ b/trove/common/cfg.py
@@ -56,16 +56,25 @@ common_opts = [
                help='Service endpoint type to use when searching catalog.'),
     cfg.IntOpt('nova_client_version', default=2,
                help="The version of of the compute service client."),
+    cfg.BoolOpt('nova_api_insecure', default=False,
+                help='Allow Trove to perform insecure SSL (https) requests to '
+                     'Nova.'),
     cfg.StrOpt('neutron_url', help='URL without the tenant segment.'),
     cfg.StrOpt('neutron_service_type', default='network',
                help='Service type to use when searching catalog.'),
     cfg.StrOpt('neutron_endpoint_type', default='publicURL',
                help='Service endpoint type to use when searching catalog.'),
+    cfg.BoolOpt('neutron_api_insecure', default=False,
+                help='Allow Trove to perform insecure SSL (https) requests to '
+                     'Neutron.'),
     cfg.StrOpt('cinder_url', help='URL without the tenant segment.'),
     cfg.StrOpt('cinder_service_type', default='volumev2',
                help='Service type to use when searching catalog.'),
     cfg.StrOpt('cinder_endpoint_type', default='publicURL',
                help='Service endpoint type to use when searching catalog.'),
+    cfg.BoolOpt('cinder_api_insecure', default=False,
+                help='Allow Trove to perform insecure SSL (https) requests to '
+                     'Cinder.'),
     cfg.StrOpt('heat_url', help='URL without the tenant segment.'),
     cfg.StrOpt('heat_service_type', default='orchestration',
                help='Service type to use when searching catalog.'),
@@ -76,6 +85,9 @@ common_opts = [
                help='Service type to use when searching catalog.'),
     cfg.StrOpt('swift_endpoint_type', default='publicURL',
                help='Service endpoint type to use when searching catalog.'),
+    cfg.BoolOpt('swift_api_insecure', default=False,
+                help='Allow Trove to perform insecure SSL (https) requests to '
+                     'Swift.'),
     cfg.StrOpt('trove_auth_url', default='http://0.0.0.0:5000/v2.0',
                help='Trove authentication URL.'),
     cfg.StrOpt('host', default='0.0.0.0',
@@ -394,6 +406,9 @@ common_opts = [
     cfg.IntOpt('timeout_wait_for_service', default=120,
                help='Maximum time (in seconds) to wait for a service to '
                     'become alive.'),
+    cfg.BoolOpt('api_insecure', default=False,
+                help='Allow Trove to perform insecure SSL (https) requests to '
+                     'all OpenStack services.'),
 ]
 
 # Profiling specific option groups
diff --git a/trove/common/remote.py b/trove/common/remote.py
index 70be968..c51d148 100644
--- a/trove/common/remote.py
+++ b/trove/common/remote.py
@@ -97,9 +97,10 @@ def nova_client(context):
                            endpoint_region=CONF.os_region_name,
                            endpoint_type=CONF.nova_compute_endpoint_type)
 
+    insecure = CONF.nova_api_insecure or CONF.api_insecure
     client = Client(CONF.nova_client_version, context.user, context.auth_token,
                     bypass_url=url, tenant_id=context.tenant,
-                    auth_url=PROXY_AUTH_URL)
+                    auth_url=PROXY_AUTH_URL, insecure=insecure)
     client.client.auth_token = context.auth_token
     client.client.management_url = url
     return client
@@ -126,9 +127,11 @@ def cinder_client(context):
                            endpoint_region=CONF.os_region_name,
                            endpoint_type=CONF.cinder_endpoint_type)
 
+    insecure = CONF.cinder_api_insecure or CONF.api_insecure
     client = CinderClient.Client(context.user, context.auth_token,
                                  project_id=context.tenant,
-                                 auth_url=PROXY_AUTH_URL)
+                                 auth_url=PROXY_AUTH_URL,
+                                 insecure=insecure)
     client.client.auth_token = context.auth_token
     client.client.management_url = url
     return client
@@ -162,10 +165,11 @@ def swift_client(context):
                            endpoint_region=CONF.os_region_name,
                            endpoint_type=CONF.swift_endpoint_type)
 
+    insecure = CONF.swift_api_insecure or CONF.api_insecure
     client = Connection(preauthurl=url,
                         preauthtoken=context.auth_token,
                         tenant_name=context.tenant,
-                        snet=USE_SNET)
+                        snet=USE_SNET, insecure=insecure)
     return client
 
 
@@ -180,8 +184,9 @@ def neutron_client(context):
                            endpoint_region=CONF.os_region_name,
                            endpoint_type=CONF.neutron_endpoint_type)
 
+    insecure = CONF.neutron_api_insecure or CONF.api_insecure
     client = NeutronClient.Client(token=context.auth_token,
-                                  endpoint_url=url)
+                                  endpoint_url=url, insecure=insecure)
     return client
 
 
-- 
2.7.0

