Merge lp:~gnuoy/charms/trusty/neutron-api/add-ssl-support into lp:~openstack-charmers-archive/charms/trusty/neutron-api/next

[Liam Young]

[James Page (james-page)]

review: Needs Fixing

[lp:~gnuoy/charms/trusty/neutron-api/add-ssl-support]

39. By Liam Young on 2014-06-30

* Add support for Apache < 2.4 and unit tests to support that.
* Fix typo in config.yaml

[Liam Young (gnuoy)]

review: Needs Resubmitting

[James Page (james-page)]

review: Approve

=== modified file 'config.yaml'
--- config.yaml	2014-06-24 11:05:17 +0000
+++ config.yaml	2014-06-30 09:11:52 +0000
@@ -89,3 +89,18 @@
     default: False
     type: boolean
     description: Enable verbose logging
+  ssl_cert:
+    type: string
+    description: |
+      SSL certificate to install and use for API ports.  Setting this value
+      and ssl_key will enable reverse proxying, point Neutron's entry in the
+      Keystone catalog to use https, and override any certficiate and key
+      issued by Keystone (if it is configured to do so).
+  ssl_key:
+    type: string
+    description: SSL key to use with certificate specified as ssl_cert.
+  ssl_ca:
+    type: string
+    description: |
+      SSL CA to use with the certificate and key provided - this is only
+      required if you are providing a privately signed ssl_cert and ssl_key.

=== modified file 'hooks/neutron_api_context.py'
--- hooks/neutron_api_context.py	2014-06-25 10:48:41 +0000
+++ hooks/neutron_api_context.py	2014-06-30 09:11:52 +0000
@@ -5,6 +5,22 @@
     relation_get,
 )
 from charmhelpers.contrib.openstack import context
+from charmhelpers.contrib.hahelpers.cluster import (
+    determine_api_port,
+)
+
+
+class ApacheSSLContext(context.ApacheSSLContext):
+
+    interfaces = ['https']
+    external_ports = []
+    service_namespace = 'neutron'
+
+    def __call__(self):
+        # late import to work around circular dependency
+        from neutron_api_utils import determine_ports
+        self.external_ports = determine_ports()
+        return super(ApacheSSLContext, self).__call__()
 
 
 class IdentityServiceContext(context.IdentityServiceContext):
@@ -41,10 +57,13 @@
         pass
 
     def __call__(self):
+        from neutron_api_utils import api_port
         ctxt = super(NeutronCCContext, self).__call__()
         ctxt['external_network'] = config('neutron-external-network')
         ctxt['verbose'] = config('verbose')
         ctxt['debug'] = config('debug')
+        ctxt['neutron_bind_port'] = \
+            determine_api_port(api_port('neutron-server'))
         for rid in relation_ids('neutron-api'):
             for unit in related_units(rid):
                 ctxt['nova_url'] = relation_get(attribute='nova_url',

=== modified file 'hooks/neutron_api_hooks.py'
--- hooks/neutron_api_hooks.py	2014-06-23 11:18:17 +0000
+++ hooks/neutron_api_hooks.py	2014-06-30 09:11:52 +0000
@@ -2,6 +2,7 @@
 
 import sys
 
+from subprocess import check_call
 from charmhelpers.core.hookenv import (
     Hooks,
     UnregisteredHookError,
@@ -56,6 +57,25 @@
 CONFIGS = register_configs()
 
 
+def configure_https():
+    '''
+    Enables SSL API Apache config if appropriate and kicks identity-service
+    with any required api updates.
+    '''
+    # need to write all to ensure changes to the entire request pipeline
+    # propagate (c-api, haprxy, apache)
+    CONFIGS.write_all()
+    if 'https' in CONFIGS.complete_contexts():
+        cmd = ['a2ensite', 'openstack_https_frontend']
+        check_call(cmd)
+    else:
+        cmd = ['a2dissite', 'openstack_https_frontend']
+        check_call(cmd)
+
+    for rid in relation_ids('identity-service'):
+        identity_joined(rid=rid)
+
+
 @hooks.hook()
 def install():
     execd_preinstall()
@@ -72,6 +92,7 @@
     global CONFIGS
     if openstack_upgrade_available('neutron-server'):
         do_openstack_upgrade(CONFIGS)
+    configure_https()
     CONFIGS.write_all()
     for r_id in relation_ids('neutron-api'):
         neutron_api_relation_joined(rid=r_id)
@@ -165,6 +186,7 @@
     CONFIGS.write(NEUTRON_CONF)
     for r_id in relation_ids('neutron-api'):
         neutron_api_relation_joined(rid=r_id)
+    configure_https()
 
 
 @hooks.hook('neutron-api-relation-joined')

=== modified file 'hooks/neutron_api_utils.py'
--- hooks/neutron_api_utils.py	2014-06-23 11:18:17 +0000
+++ hooks/neutron_api_utils.py	2014-06-30 09:11:52 +0000
@@ -26,6 +26,8 @@
 
 # removed from original: charm-helper-sh
 BASE_PACKAGES = [
+    'apache2',
+    'haproxy',
     'python-keystoneclient',
     'python-mysqldb',
     'python-psycopg2',
@@ -65,6 +67,14 @@
         'services': ['neutron-server'],
         'contexts': [neutron_api_context.NeutronCCContext()],
     }),
+    (APACHE_CONF, {
+        'contexts': [neutron_api_context.ApacheSSLContext()],
+        'services': ['apache2'],
+    }),
+    (APACHE_24_CONF, {
+        'contexts': [neutron_api_context.ApacheSSLContext()],
+        'services': ['apache2'],
+    }),
 ])
 
 
@@ -120,6 +130,11 @@
     '''
     resource_map = deepcopy(BASE_RESOURCE_MAP)
 
+    if os.path.exists('/etc/apache2/conf-available'):
+        resource_map.pop(APACHE_CONF)
+    else:
+        resource_map.pop(APACHE_24_CONF)
+
     # add neutron plugin requirements. nova-c-c only needs the neutron-server
     # associated with configs, not the plugin agent.
     plugin = config('neutron-plugin')

=== modified file 'unit_tests/test_neutron_api_context.py'
--- unit_tests/test_neutron_api_context.py	2014-06-20 10:02:09 +0000
+++ unit_tests/test_neutron_api_context.py	2014-06-30 09:11:52 +0000
@@ -7,6 +7,7 @@
     'relation_ids',
     'related_units',
     'config',
+    'determine_api_port',
 ]
 
 
@@ -53,6 +54,8 @@
         super(NeutronAPIContextsTest, self).setUp(context, TO_PATCH)
         self.relation_get.side_effect = self.test_relation.get
         self.config.side_effect = self.test_config.get
+        self.api_port = 9696
+        self.determine_api_port.return_value = self.api_port
         self.test_config.set('neutron-plugin', 'ovs')
         self.test_config.set('neutron-security-groups', True)
         self.test_config.set('debug', True)
@@ -70,7 +73,8 @@
         ctxt_data = {
             'debug': True,
             'external_network': 'bob',
-            'verbose': True
+            'neutron_bind_port': self.api_port,
+            'verbose': True,
         }
         with patch.object(napi_ctxt, '_ensure_packages'):
             self.assertEquals(ctxt_data, napi_ctxt())
@@ -85,6 +89,7 @@
         self.test_relation.set({'nova_url': nova_url})
         napi_ctxt = context.NeutronCCContext()
         self.assertEquals(nova_url, napi_ctxt()['nova_url'])
+        self.assertEquals(self.api_port, napi_ctxt()['neutron_bind_port'])
 
     def test_neutroncc_context_manager(self):
         napi_ctxt = context.NeutronCCContext()

=== modified file 'unit_tests/test_neutron_api_hooks.py'
--- unit_tests/test_neutron_api_hooks.py	2014-06-23 11:18:17 +0000
+++ unit_tests/test_neutron_api_hooks.py	2014-06-30 09:11:52 +0000
@@ -24,6 +24,7 @@
     'canonical_url',
     'config',
     'CONFIGS',
+    'check_call',
     'configure_installation_source',
     'determine_endpoints',
     'determine_packages',
@@ -82,7 +83,8 @@
         self.open_port.assert_has_calls(_port_calls)
         self.assertTrue(self.execd_preinstall.called)
 
-    def test_config_changed(self):
+    @patch.object(hooks, 'configure_https')
+    def test_config_changed(self, conf_https):
         self.openstack_upgrade_available.return_value = True
         self.relation_ids.side_effect = self._fake_relids
         _n_api_rel_joined = self.patch('neutron_api_relation_joined')
@@ -192,7 +194,8 @@
         self._call_hook('identity-service-relation-changed')
         self.assertFalse(_api_rel_joined.called)
 
-    def test_identity_changed(self):
+    @patch.object(hooks, 'configure_https')
+    def test_identity_changed(self, conf_https):
         self.CONFIGS.complete_contexts.return_value = ['identity-service']
         _api_rel_joined = self.patch('neutron_api_relation_joined')
         self.relation_ids.side_effect = self._fake_relids
@@ -331,3 +334,21 @@
         self._call_hook('ha-relation-changed')
         self.assertFalse(_n_api_rel_joined.called)
         self.assertFalse(_id_rel_joined.called)
+
+    def test_configure_https(self):
+        self.CONFIGS.complete_contexts.return_value = ['https']
+        self.relation_ids.side_effect = self._fake_relids
+        _id_rel_joined = self.patch('identity_joined')
+        hooks.configure_https()
+        self.check_call.assert_called_with(['a2ensite',
+                                           'openstack_https_frontend'])
+        self.assertTrue(_id_rel_joined.called)
+
+    def test_configure_https_nohttps(self):
+        self.CONFIGS.complete_contexts.return_value = []
+        self.relation_ids.side_effect = self._fake_relids
+        _id_rel_joined = self.patch('identity_joined')
+        hooks.configure_https()
+        self.check_call.assert_called_with(['a2dissite',
+                                           'openstack_https_frontend'])
+        self.assertTrue(_id_rel_joined.called)

=== modified file 'unit_tests/test_neutron_api_utils.py'
--- unit_tests/test_neutron_api_utils.py	2014-06-23 11:18:17 +0000
+++ unit_tests/test_neutron_api_utils.py	2014-06-30 09:11:52 +0000
@@ -85,10 +85,23 @@
         port_list = nutils.determine_ports()
         self.assertItemsEqual(port_list, [9696])
 
-    def test_resource_map(self):
-        _map = nutils.resource_map()
-        confs = [nutils.NEUTRON_CONF, nutils.NEUTRON_DEFAULT]
-        [self.assertIn(q_conf, _map.keys()) for q_conf in confs]
+    @patch('os.path.exists')
+    def test_resource_map(self, _path_exists):
+        _path_exists.return_value = False
+        _map = nutils.resource_map()
+        confs = [nutils.NEUTRON_CONF, nutils.NEUTRON_DEFAULT,
+                 nutils.APACHE_CONF]
+        [self.assertIn(q_conf, _map.keys()) for q_conf in confs]
+        self.assertTrue(nutils.APACHE_24_CONF not in _map.keys())
+
+    @patch('os.path.exists')
+    def test_resource_map_apache24(self, _path_exists):
+        _path_exists.return_value = True
+        _map = nutils.resource_map()
+        confs = [nutils.NEUTRON_CONF, nutils.NEUTRON_DEFAULT,
+                 nutils.APACHE_24_CONF]
+        [self.assertIn(q_conf, _map.keys()) for q_conf in confs]
+        self.assertTrue(nutils.APACHE_CONF not in _map.keys())
 
     def test_restart_map(self):
         _restart_map = nutils.restart_map()
@@ -103,6 +116,9 @@
             (ML2CONF, {
                 'services': ['neutron-server'],
             }),
+            (nutils.APACHE_24_CONF, {
+                'services': ['apache2'],
+            }),
         ])
         self.assertItemsEqual(_restart_map, expect)
 
@@ -120,7 +136,8 @@
         _regconfs = nutils.register_configs()
         confs = ['/etc/neutron/neutron.conf',
                  '/etc/default/neutron-server',
-                 '/etc/neutron/plugins/ml2/ml2_conf.ini']
+                 '/etc/neutron/plugins/ml2/ml2_conf.ini',
+                 '/etc/apache2/sites-available/openstack_https_frontend.conf']
         self.assertItemsEqual(_regconfs.configs, confs)
 
     @patch('os.path.isfile')