Bug LP 1863232 introduced a new Apache configuration option called
WSGISocketRotation which allows users to disable wsgi socket
rotation. This patch makes this configurable with a new
wsgi-socket-rotation config option that defaults to the Apache
default and can optionally be set to False.
[ussuri] Ensure get_requests_for_local_unit doesn't fail on incomplete relation
This is a rebuild/make sync for charms to pickup the fix in charmhelpers to fix
any inadvertant accesses of ['ca'] in the relation data before it is available
from vault in the certificates relation. Fix in charmhelpers is in [1].
Sync from charm-helpers to update [service_user] config to use the
service domain.
The keystone charm currently creates two service users, one for the
service domain (for v3 authentication), and the other for the default
domain (for v2 authentication). The [service_user] config needs to
use the service domain.
Render [service_user] only for identity-service relation
The service token section [service_user] is not required when
cinder-volume is deployed as a separate service. In other words
it is not required for the identity-credentials relation.
The [service_user] section is nearly the same as the
[keystone_authtoken] section, and the keystone_authtoken data
is only produced for the IdentityServiceContext, therefore this
change will not render [service_user] for the
IdentityCredentialsContext.
Closes-Bug: #2024676
Change-Id: Iaecae3c22db1f4f2309f73f8c6836e6c072b848b
(cherry picked from commit ebbedcbf58660ce13823152d6943fee036af7e11)
This patch configures Cinder to send a service token along with the
received user token on requests to other services. This can allow those
other services to accept the request even if the user token has been
invalidated since received by Cinder. Also with this patch Cinder will
accept request from other services with invalid user tokens but valid
service tokens. Service tokens exist since Openstack Queens.
Closes-Bug: #1992840
Change-Id: I6cb9b1cb257db0b57bd7984c795b8caa1e3b74d9
(cherry picked from commit 81c330b5d87a64a7a9ec601f4dd263b836ee9c01)
(cherry picked from commit b96c85f5a6b8e3d173a4f810fd4d5fd82737795e)
Commit 024de37 added the nova section on cinder.conf, but placed it
on the Victoria folder. This issue is also observed on Ussuri, so
this patch moves this from Victoria to Ussuri.
Closes-Bug: #1939389
Change-Id: Ia39177d6f47ddda0b1acb27cde02ae5e74a01032
(cherry picked from commit e737668e2fa2b3c59daca5676bd27b0bf4db53fe)
Cinder sometimes needs to communicate with nova,
for example to notify VMs when live-resizing a disk.
Under certain circumstances,
the autodetected authentication details don't work,
so we must add a dedicated section in the config
for the nova client with proper credentials.
This issue has been observed on victoria and newer,
hence the addition of cinder.conf for victoria.
Closes-Bug: #1939389
Co-authored-by: Samuel Walladge <email address hidden>
Change-Id: I6d44223b7c2863c6d9c62b46a41275fd360f92d1
(cherry-picked from commit 2b71f3b1d7bdd8a0902cd6439bc2f66e797293fc)
