Merge lp:~ivoks/charms/precise/glance/tls-ha into lp:~charmers/charms/precise/glance/trunk

[Ante Karamatić]

As part of changing OpenStack charm to provide better SSL experience, we need to put HAproxy in front of the Apache. Apache then does SSL termination on destination host, and HAproxy balances TCP traffic instead of HTTP. This allows us to keep all outside server traffic - crypted.

In addition, we stop and start services, instead of restarting. This avoids TCP port conflicts.

Depends on charm-helpers from: lp:~ivoks/charm-helpers/new-ssl

[lp:~ivoks/charms/precise/glance/tls-ha]

47. By Ante Karamatić on 2014-02-18

[hopem] Fix unit test

=== modified file 'hooks/charmhelpers/contrib/hahelpers/cluster.py'
--- hooks/charmhelpers/contrib/hahelpers/cluster.py	2013-08-17 00:29:10 +0000
+++ hooks/charmhelpers/contrib/hahelpers/cluster.py	2014-02-18 11:51:52 +0000
@@ -126,6 +126,13 @@
     return public_port - (i * 10)
 
 
+def determine_apache_port(public_port):
+    i = 0
+    if len(peer_units()) > 0 or is_clustered():
+        i += 1
+    return public_port - (i * 10)
+
+
 def determine_haproxy_port(public_port):
     '''
     Description: Determine correct proxy listening port based on public IP +

=== modified file 'hooks/charmhelpers/contrib/openstack/context.py'
--- hooks/charmhelpers/contrib/openstack/context.py	2014-02-14 13:41:38 +0000
+++ hooks/charmhelpers/contrib/openstack/context.py	2014-02-18 11:51:52 +0000
@@ -26,8 +26,8 @@
 )
 
 from charmhelpers.contrib.hahelpers.cluster import (
+    determine_apache_port,
     determine_api_port,
-    determine_haproxy_port,
     https,
     is_clustered,
     peer_units,
@@ -380,11 +380,9 @@
             'private_address': unit_get('private-address'),
             'endpoints': []
         }
-        for ext_port in self.external_ports:
-            if peer_units() or is_clustered():
-                int_port = determine_haproxy_port(ext_port)
-            else:
-                int_port = determine_api_port(ext_port)
+        for api_port in self.external_ports:
+            ext_port = determine_apache_port(api_port)
+            int_port = determine_api_port(api_port)
             portmap = (int(ext_port), int(int_port))
             ctxt['endpoints'].append(portmap)
         return ctxt

=== modified file 'hooks/charmhelpers/core/host.py'
--- hooks/charmhelpers/core/host.py	2014-02-14 13:41:38 +0000
+++ hooks/charmhelpers/core/host.py	2014-02-18 11:51:52 +0000
@@ -194,7 +194,7 @@
         return None
 
 
-def restart_on_change(restart_map):
+def restart_on_change(restart_map, stopstart=False):
     """Restart services based on configuration files changing
 
     This function is used a decorator, for example
@@ -219,8 +219,14 @@
             for path in restart_map:
                 if checksums[path] != file_hash(path):
                     restarts += restart_map[path]
-            for service_name in list(OrderedDict.fromkeys(restarts)):
-                service('restart', service_name)
+            services_list = list(OrderedDict.fromkeys(restarts))
+            if not stopstart:
+                for service_name in services_list:
+                    service('restart', service_name)
+            else:
+                for action in ['stop', 'start']:
+                    for service_name in services_list:
+                        service(action, service_name)
         return wrapped_f
     return wrap
 

=== modified file 'hooks/glance_contexts.py'
--- hooks/glance_contexts.py	2014-02-14 13:41:38 +0000
+++ hooks/glance_contexts.py	2014-02-18 11:51:52 +0000
@@ -11,8 +11,8 @@
 )
 
 from charmhelpers.contrib.hahelpers.cluster import (
+    determine_apache_port,
     determine_api_port,
-    determine_haproxy_port,
 )
 
 
@@ -59,11 +59,12 @@
         specific to this charm.
         Also used to extend glance-api.conf context with correct bind_port
         '''
-        haproxy_port = determine_haproxy_port(9292)
+        haproxy_port = 9292
+        apache_port = determine_apache_port(9292)
         api_port = determine_api_port(9292)
 
         ctxt = {
-            'service_ports': {'glance_api': [haproxy_port, api_port]},
+            'service_ports': {'glance_api': [haproxy_port, apache_port]},
             'bind_port': api_port,
         }
         return ctxt

=== modified file 'hooks/glance_relations.py'
--- hooks/glance_relations.py	2013-10-22 23:20:32 +0000
+++ hooks/glance_relations.py	2014-02-18 11:51:52 +0000
@@ -207,7 +207,7 @@
 
 
 @hooks.hook('config-changed')
-@restart_on_change(restart_map())
+@restart_on_change(restart_map(), stopstart=True)
 def config_changed():
     if openstack_upgrade_available('glance-common'):
         juju_log('Upgrading OpenStack release')
@@ -223,8 +223,9 @@
 
 
 @hooks.hook('cluster-relation-changed')
-@restart_on_change(restart_map())
+@restart_on_change(restart_map(), stopstart=True)
 def cluster_changed():
+    configure_https()
     CONFIGS.write(GLANCE_API_CONF)
     CONFIGS.write(HAPROXY_CONF)
 

=== modified file 'templates/haproxy.cfg'
--- templates/haproxy.cfg	2013-07-01 19:01:13 +0000
+++ templates/haproxy.cfg	2014-02-18 11:51:52 +0000
@@ -8,8 +8,8 @@
 
 defaults
     log global
-    mode http
-    option httplog
+    mode tcp
+    option tcplog
     option dontlognull
     retries 3
     timeout queue 1000
@@ -29,7 +29,6 @@
 {% for service, ports in service_ports.iteritems() -%}
 listen {{ service }} 0.0.0.0:{{ ports[0] }}
     balance roundrobin
-    option tcplog
     {% for unit, address in units.iteritems() -%}
     server {{ unit }} {{ address }}:{{ ports[1] }} check
     {% endfor %}

=== modified file 'unit_tests/test_glance_contexts.py'
--- unit_tests/test_glance_contexts.py	2013-11-08 01:34:39 +0000
+++ unit_tests/test_glance_contexts.py	2014-02-18 11:51:52 +0000
@@ -9,7 +9,7 @@
     'relation_ids',
     'is_relation_made',
     'service_name',
-    'determine_haproxy_port',
+    'determine_apache_port',
     'determine_api_port',
 ]
 
@@ -41,16 +41,24 @@
             {'rbd_pool': service,
              'rbd_user': service})
 
-    def test_haproxy_configuration(self):
-        self.determine_haproxy_port.return_value = 9292
-        self.determine_api_port.return_value = 9282
-        self.assertEquals(
-            contexts.HAProxyContext()(),
-            {'service_ports': {'glance_api': [9292, 9282]},
-             'bind_port': 9282})
-
+    @patch('charmhelpers.contrib.openstack.context.determine_apache_port')
+    @patch('charmhelpers.contrib.openstack.context.determine_api_port')
+    @patch('charmhelpers.contrib.openstack.context.unit_get')
     @patch('charmhelpers.contrib.openstack.context.https')
-    def test_apache_ssl_context_service_enabled(self,
-                                                https):
-        https.return_value = False
-        self.assertEquals(contexts.ApacheSSLContext()(), {})
+    def test_apache_ssl_context_service_enabled(self, mock_https,
+                                                mock_unit_get,
+                                                mock_determine_api_port,
+                                                mock_determine_apache_port):
+        mock_https.return_value = True
+        mock_unit_get.return_value = '1.2.3.4'
+        mock_determine_api_port.return_value = '12'
+        mock_determine_apache_port.return_value = '34'
+
+        ctxt = contexts.ApacheSSLContext()
+        with patch.object(ctxt, 'enable_modules') as mock_enable_modules:
+            with patch.object(ctxt, 'configure_cert') as mock_configure_cert:
+                self.assertEquals(ctxt(), {'endpoints': [(34, 12)],
+                                           'private_address': '1.2.3.4',
+                                           'namespace': 'glance'})
+                self.assertTrue(mock_https.called)
+                mock_unit_get.assert_called_with('private-address')