Merge ~bjornt/maas:bug-2007297-3.3 into maas:3.3

[Björn Tillenius]

Bug #2007297: LXD REST API connection goes via proxy

Create a Session before instantiating the pylxd Client
(cherry picked from commit 33963ee1eb39c745729dd10cf789f6af04d80e94)

Set pylxd session to not trust the environment
(cherry picked from commit 58e3a2328dd308056170b3af3921ed1842a08a8f)

[MAAS Lander (maas-lander)]

UNIT TESTS
-b bug-2007297-3.3 lp:~bjornt/maas/+git/maas into -b 3.3 lp:~maas-committers/maas

STATUS: FAILED
LOG: http://maas-ci.internal:8080/job/maas-tester/5572/console
COMMIT: 838e056e32b76969965b5e8000abe1425a95119a

review: Needs Fixing

[Björn Tillenius (bjornt)]

Self-approve backport

review: Approve

[MAAS Lander (maas-lander)]

LANDING
-b bug-2007297-3.3 lp:~bjornt/maas/+git/maas into -b 3.3 lp:~maas-committers/maas

STATUS: FAILED BUILD
LOG: http://maas-ci.internal:8080/job/maas-tester/5573/console

[MAAS Lander (maas-lander)]

LANDING
-b bug-2007297-3.3 lp:~bjornt/maas/+git/maas into -b 3.3 lp:~maas-committers/maas

STATUS: FAILED BUILD
LOG: http://maas-ci.internal:8080/job/maas-tester/5575/console

[MAAS Lander (maas-lander)]

LANDING
-b bug-2007297-3.3 lp:~bjornt/maas/+git/maas into -b 3.3 lp:~maas-committers/maas

STATUS: FAILED BUILD
LOG: http://maas-ci.internal:8080/job/maas-tester/5576/console

diff --git a/src/provisioningserver/drivers/pod/lxd.py b/src/provisioningserver/drivers/pod/lxd.py
index 0181eaf..2e276d3 100644
--- a/src/provisioningserver/drivers/pod/lxd.py
+++ b/src/provisioningserver/drivers/pod/lxd.py
@@ -13,6 +13,7 @@ from urllib.parse import urlparse
 import uuid
 
 from pylxd import Client
+from pylxd.client import get_session_for_url
 from pylxd.exceptions import ClientConnectionFailed, LXDAPIException, NotFound
 import urllib3
 
@@ -850,11 +851,15 @@ class LXDPodDriver(PodDriver):
             raise Error("No certificates available")
 
         def client_with_certs(cert):
+            session = get_session_for_url(endpoint, cert=cert, verify=False)
+            # Don't inherit proxy environment variables
+            session.trust_env = False
             client = self._pylxd_client_class(
                 endpoint=endpoint,
                 project=project,
                 cert=cert,
                 verify=False,
+                session=session,
             )
             if not client.trusted and password:
                 try:
diff --git a/src/provisioningserver/drivers/pod/tests/test_lxd.py b/src/provisioningserver/drivers/pod/tests/test_lxd.py
index 4b0c6fc..47b7fc3 100644
--- a/src/provisioningserver/drivers/pod/tests/test_lxd.py
+++ b/src/provisioningserver/drivers/pod/tests/test_lxd.py
@@ -12,6 +12,7 @@ from unittest.mock import ANY, MagicMock, Mock, PropertyMock, sentinel
 
 from fixtures import EnvironmentVariable, TempDir
 from pylxd.exceptions import ClientConnectionFailed, LXDAPIException, NotFound
+from requests import Session
 from testtools.testcase import ExpectedException
 from twisted.internet.defer import inlineCallbacks
 
@@ -126,6 +127,7 @@ class FakeClient:
     project: str
     cert: Optional[Tuple[str, str]]
     verify: bool
+    session: Session
 
     _PROXIES = (
         "host_info",
@@ -142,6 +144,7 @@ class FakeClient:
         self.trusted = False
         self._fail_auth = False
         self.host_info = self.fake_lxd.host_info
+        self.api = FakeAPINode(self.session)
 
     def authenticate(self, password):
         if self._fail_auth:
@@ -155,6 +158,13 @@ class FakeClient:
         raise AttributeError(name)
 
 
[e-mail]
+class FakeAPINode:
+    """A fake pylxd.client._APINode"""
+
+    session: Session
+
+
 class FakeLXD:
     """A fake LXD server."""
 
@@ -192,8 +202,16 @@ class FakeLXD:
         project="default",
         cert=None,
         verify=False,
+        session=None,
     ):
-        client = FakeClient(self, endpoint, project, cert, verify)
+        client = FakeClient(
+            fake_lxd=self,
+            endpoint=endpoint,
+            project=project,
+            cert=cert,
+            verify=verify,
+            session=session,
+        )
 
         if self._client_behaviors is not None:
             try:
@@ -255,10 +273,13 @@ class FakeLXDCluster:
         project="default",
         cert=None,
         verify=False,
+        session=None,
     ):
         if self.client_idx == len(self.clients):
             self.client_idx = 0
-        client = self.clients[self.client_idx](endpoint, project, cert, verify)
+        client = self.clients[self.client_idx](
+            endpoint, project, cert, verify, session
+        )
         client._PROXIES += ("cluster", "cluster/members")
         self.client_idx += 1
         return client
@@ -463,6 +484,11 @@ class TestLXDPodDriver(MAASTestCase):
             self.assertIsInstance(client.cert, tuple)
             self.assertFalse(client.verify)
 
+    def test_get_client_should_not_trust_environment(self):
+        context = self.make_context()
+        with self.driver._get_client(None, context) as client:
+            self.assertFalse(client.api.session.trust_env)
+
     def test_get_client_no_certificates_no_password(self):
         context = self.make_context(with_cert=False, with_password=False)
         pod_id = factory.make_name("pod_id")
diff --git a/utilities/check-imports b/utilities/check-imports
index 401e068..1b70608 100755
--- a/utilities/check-imports
+++ b/utilities/check-imports
@@ -439,6 +439,7 @@ checks = [
         RackControllerRule
         | Rule(
             Allow("apiclient.testing.credentials.make_api_credentials"),
+            Allow("requests|requests.**"),
             Allow(StandardLibraries),
             Allow(TestingLibraries),
         ),