Merge lp:~billy-olsen/charms/trusty/keystone/backport-lp-1351401 into lp:~openstack-charmers-archive/charms/trusty/keystone/trunk

[Billy Olsen]

Backport fix for lp 1351401 into stable

[uosci-testing-bot (uosci-testing-bot)]

charm_lint_check #2767 keystone for billy-olsen mp253607
    LINT OK: passed

Build: http://10.245.162.77:8080/job/charm_lint_check/2767/

[uosci-testing-bot (uosci-testing-bot)]

charm_unit_test #2558 keystone for billy-olsen mp253607
    UNIT OK: passed

Build: http://10.245.162.77:8080/job/charm_unit_test/2558/

[uosci-testing-bot (uosci-testing-bot)]

charm_amulet_test #2606 keystone for billy-olsen mp253607
    AMULET OK: passed

Build: http://10.245.162.77:8080/job/charm_amulet_test/2606/

[Liang Chen (cbjchen)]

LGTM

review: Approve

=== modified file 'hooks/charmhelpers/contrib/openstack/context.py'
--- hooks/charmhelpers/contrib/openstack/context.py	2015-03-05 11:08:26 +0000
+++ hooks/charmhelpers/contrib/openstack/context.py	2015-03-19 23:26:52 +0000
@@ -64,6 +64,10 @@
 from charmhelpers.contrib.openstack.neutron import (
     neutron_plugin_attribute,
 )
+from charmhelpers.contrib.openstack.ip import (
+    resolve_address,
+    INTERNAL,
+)
 from charmhelpers.contrib.network.ip import (
     get_address_in_network,
     get_ipv6_addr,
@@ -677,7 +681,14 @@
                 'endpoints': [],
                 'ext_ports': []}
 
-        for cn in self.canonical_names():
+        cns = self.canonical_names()
+        if cns:
+            for cn in cns:
+                self.configure_cert(cn)
+        else:
+            # Expect cert/key provided in config (currently assumed that ca
+            # uses ip for cn)
+            cn = resolve_address(endpoint_type=INTERNAL)
             self.configure_cert(cn)
 
         addresses = self.get_network_addresses()

=== modified file 'hooks/keystone_context.py'
--- hooks/keystone_context.py	2015-01-27 23:56:15 +0000
+++ hooks/keystone_context.py	2015-03-19 23:26:52 +0000
@@ -1,7 +1,7 @@
 import hashlib
 import os
 
-from charmhelpers.core.hookenv import config
+from base64 import b64decode
 
 from charmhelpers.core.host import (
     mkdir,
@@ -17,6 +17,7 @@
 )
 
 from charmhelpers.core.hookenv import (
+    config,
     log,
     INFO,
 )
@@ -26,6 +27,13 @@
 CA_CERT_PATH = '/usr/local/share/ca-certificates/keystone_juju_ca_cert.crt'
 
 
+def is_cert_provided_in_config():
+    ca = config('ssl_ca')
+    cert = config('ssl_cert')
+    key = config('ssl_key')
+    return bool(ca and cert and key)
+
+
 class ApacheSSLContext(context.ApacheSSLContext):
 
     interfaces = ['https']
@@ -66,12 +74,8 @@
             get_ca,
             ensure_permissions,
             is_ssl_cert_master,
-            is_ssl_enabled,
         )
 
-        if not is_ssl_enabled():
-            return
-
         # Ensure ssl dir exists whether master or not
         ssl_dir = os.path.join('/etc/apache2/ssl/', self.service_namespace)
         perms = 0o755
@@ -80,15 +84,23 @@
         ensure_permissions(ssl_dir, user=SSH_USER, group='keystone',
                            perms=perms)
 
-        if not is_ssl_cert_master():
+        if not is_cert_provided_in_config() and not is_ssl_cert_master():
             log("Not ssl-cert-master - skipping apache cert config until "
                 "master is elected", level=INFO)
             return
 
         log("Creating apache ssl certs in %s" % (ssl_dir), level=INFO)
 
-        ca = get_ca(user=SSH_USER)
-        cert, key = ca.get_cert_and_key(common_name=cn)
+        cert = config('ssl_cert')
+        key = config('ssl_key')
+
+        if not (cert and key):
+            ca = get_ca(user=SSH_USER)
+            cert, key = ca.get_cert_and_key(common_name=cn)
+        else:
+            cert = b64decode(cert)
+            key = b64decode(key)
+
         write_file(path=os.path.join(ssl_dir, 'cert_{}'.format(cn)),
                    content=cert, owner=SSH_USER, group='keystone', perms=0o644)
         write_file(path=os.path.join(ssl_dir, 'key_{}'.format(cn)),
@@ -100,20 +112,22 @@
             get_ca,
             ensure_permissions,
             is_ssl_cert_master,
-            is_ssl_enabled,
         )
 
-        if not is_ssl_enabled():
-            return
-
-        if not is_ssl_cert_master():
+        if not is_cert_provided_in_config() and not is_ssl_cert_master():
             log("Not ssl-cert-master - skipping apache ca config until "
                 "master is elected", level=INFO)
             return
 
-        ca = get_ca(user=SSH_USER)
-        install_ca_cert(ca.get_ca_bundle())
+        ca_cert = config('ssl_ca')
+        if ca_cert is None:
+            ca = get_ca(user=SSH_USER)
+            ca_cert = ca.get_ca_bundle()
+        else:
+            ca_cert = b64decode(ca_cert)
+
         # Ensure accessible by keystone ssh user and group (unison)
+        install_ca_cert(ca_cert)
         ensure_permissions(CA_CERT_PATH, user=SSH_USER, group='keystone',
                            perms=0o0644)
 

=== modified file 'unit_tests/test_keystone_contexts.py'
--- unit_tests/test_keystone_contexts.py	2015-01-27 23:56:15 +0000
+++ unit_tests/test_keystone_contexts.py	2015-03-19 23:26:52 +0000
@@ -6,8 +6,10 @@
 )
 
 TO_PATCH = [
+    'config',
     'determine_apache_port',
     'determine_api_port',
+    'is_cert_provided_in_config',
 ]
 
 
@@ -16,6 +18,7 @@
     def setUp(self):
         super(TestKeystoneContexts, self).setUp(context, TO_PATCH)
 
+    @patch.object(context, 'is_cert_provided_in_config')
     @patch.object(context, 'mkdir')
     @patch('keystone_utils.get_ca')
     @patch('keystone_utils.ensure_permissions')
@@ -30,7 +33,9 @@
                                                mock_determine_ports,
                                                mock_ensure_permissions,
                                                mock_get_ca,
-                                               mock_mkdir):
+                                               mock_mkdir,
+                                               mock_cert_provided_in_config):
+        mock_cert_provided_in_config.return_value = False
         mock_is_ssl_enabled.return_value = True
         mock_is_ssl_cert_master.return_value = False