Merge lp:~ivoks/charm-helpers/new-ssl into lp:charm-helpers

[Ante Karamatić]

As part of changing OpenStack charm to provide better SSL experience, we need to put HAproxy in front of the Apache. Apache then does SSL termination on destination host, and HAproxy balances TCP traffic instead of HTTP. This allows us to keep all outside server traffic - crypted.

In addition, this branch extends restart_on_change() to provide stop/start in addition to restart. This is required when restarting services that might switch TCP ports, depending on changes in relation.

[lp:~ivoks/charm-helpers/new-ssl]

119. By Ante Karamatić on 2014-02-17

Fix tests

120. By Ante Karamatić on 2014-02-17

Remove determine_haproxy_port()

[James Page (james-page)]

review: Approve

=== modified file 'charmhelpers/contrib/hahelpers/cluster.py'
--- charmhelpers/contrib/hahelpers/cluster.py	2013-08-13 23:18:10 +0000
+++ charmhelpers/contrib/hahelpers/cluster.py	2014-02-17 11:34:17 +0000
@@ -126,17 +126,17 @@
     return public_port - (i * 10)
 
 
-def determine_haproxy_port(public_port):
+def determine_apache_port(public_port):
     '''
-    Description: Determine correct proxy listening port based on public IP +
-    existence of HTTPS reverse proxy.
+    Description: Determine correct apache listening port based on public IP +
+    state of the cluster.
 
     public_port: int: standard public port for given service
 
     returns: int: the correct listening port for the HAProxy service
     '''
     i = 0
-    if https():
+    if len(peer_units()) > 0 or is_clustered():
         i += 1
     return public_port - (i * 10)
 
 
=== modified file 'charmhelpers/contrib/openstack/context.py'
--- charmhelpers/contrib/openstack/context.py	2014-02-12 14:57:24 +0000
+++ charmhelpers/contrib/openstack/context.py	2014-02-17 11:34:17 +0000
@@ -26,8 +26,8 @@
 )
 
 from charmhelpers.contrib.hahelpers.cluster import (
+    determine_apache_port,
     determine_api_port,
-    determine_haproxy_port,
     https,
     is_clustered,
     peer_units,
@@ -380,11 +380,9 @@
             'private_address': unit_get('private-address'),
             'endpoints': []
         }
-        for ext_port in self.external_ports:
-            if peer_units() or is_clustered():
-                int_port = determine_haproxy_port(ext_port)
-            else:
-                int_port = determine_api_port(ext_port)
+        for api_port in self.external_ports:
+            ext_port = determine_apache_port(api_port)
+            int_port = determine_api_port(api_port)
             portmap = (int(ext_port), int(int_port))
             ctxt['endpoints'].append(portmap)
         return ctxt
 
=== modified file 'charmhelpers/contrib/openstack/templates/haproxy.cfg'
--- charmhelpers/contrib/openstack/templates/haproxy.cfg	2013-07-19 23:31:35 +0000
+++ charmhelpers/contrib/openstack/templates/haproxy.cfg	2014-02-17 11:34:17 +0000
@@ -8,8 +8,8 @@
 
 defaults
     log global
-    mode http
-    option httplog
+    mode tcp
+    option tcplog
     option dontlognull
     retries 3
     timeout queue 1000
@@ -29,7 +29,6 @@
 {% for service, ports in service_ports.iteritems() -%}
 listen {{ service }} 0.0.0.0:{{ ports[0] }}
     balance roundrobin
-    option tcplog
     {% for unit, address in units.iteritems() -%}
     server {{ unit }} {{ address }}:{{ ports[1] }} check
     {% endfor %}
 
=== modified file 'charmhelpers/core/host.py'
--- charmhelpers/core/host.py	2013-11-29 11:08:56 +0000
+++ charmhelpers/core/host.py	2014-02-17 11:34:17 +0000
@@ -194,7 +194,7 @@
         return None
 
 
-def restart_on_change(restart_map):
+def restart_on_change(restart_map, stopstart=False):
     """Restart services based on configuration files changing
 
     This function is used a decorator, for example
@@ -219,8 +219,14 @@
             for path in restart_map:
                 if checksums[path] != file_hash(path):
                     restarts += restart_map[path]
-            for service_name in list(OrderedDict.fromkeys(restarts)):
-                service('restart', service_name)
+            services_list = list(OrderedDict.fromkeys(restarts))
+            if not stopstart:
+                for service_name in services_list:
+                    service('restart', service_name)
+            else:
+                for action in ['stop', 'start']:
+                    for service_name in services_list:
+                        service(action, service_name)
         return wrapped_f
     return wrap
 
 
=== modified file 'tests/contrib/hahelpers/test_cluster_utils.py'
--- tests/contrib/hahelpers/test_cluster_utils.py	2013-07-23 11:50:28 +0000
+++ tests/contrib/hahelpers/test_cluster_utils.py	2014-02-17 11:34:17 +0000
@@ -187,16 +187,18 @@
         self.assertEquals(9676, cluster_utils.determine_api_port(9696))
 
     @patch.object(cluster_utils, 'https')
-    def test_determine_haproxy_port_https(self, https):
+    def test_determine_apache_port_https(self, https):
         '''It determines haproxy port with https enabled'''
         https.return_value = True
-        self.assertEquals(9686, cluster_utils.determine_haproxy_port(9696))
+        self.assertEquals(9696, cluster_utils.determine_apache_port(9696))
 
     @patch.object(cluster_utils, 'https')
-    def test_determine_haproxy_port_no_https(self, https):
+    @patch.object(cluster_utils, 'is_clustered')
+    def test_determine_apache_port_clustered(self, https, is_clustered):
         '''It determines haproxy port with https disabled'''
-        https.return_value = False
-        self.assertEquals(9696, cluster_utils.determine_haproxy_port(9696))
+        https.return_value = True
+        is_clustered.return_value = True
+        self.assertEquals(9686, cluster_utils.determine_apache_port(9696))
 
     def test_get_hacluster_config_complete(self):
         '''It fetches all hacluster charm config'''
 
=== modified file 'tests/contrib/openstack/test_os_contexts.py'
--- tests/contrib/openstack/test_os_contexts.py	2014-02-12 16:08:44 +0000
+++ tests/contrib/openstack/test_os_contexts.py	2014-02-17 11:34:17 +0000
@@ -176,7 +176,7 @@
     'unit_get',
     'https',
     'determine_api_port',
-    'determine_haproxy_port',
+    'determine_apache_port',
     'peer_units',
     'is_clustered',
 ]
@@ -470,11 +470,12 @@
     def _test_https_context(self, apache, is_clustered, peer_units):
         self.https.return_value = True
 
-        if is_clustered or peer_units:
+        if is_clustered:
             self.determine_api_port.return_value = 8756
-            self.determine_haproxy_port.return_value = 8766
+            self.determine_apache_port.return_value = 8766
         else:
             self.determine_api_port.return_value = 8766
+            self.determine_apache_port.return_value = 8776
 
         self.unit_get.return_value = 'cinderhost1'
         self.is_clustered.return_value = is_clustered