Merge lp:~xianghui/charms/trusty/nova-cloud-controller/lp1476455 into lp:~openstack-charmers-archive/charms/trusty/nova-cloud-controller/next

[Xiang Hui]

Support nova console session to be encrypted without nova API SSL.

[uosci-testing-bot (uosci-testing-bot)]

charm_lint_check #6615 nova-cloud-controller-next for xianghui mp265496
    LINT OK: passed

Build: http://10.245.162.77:8080/job/charm_lint_check/6615/

[uosci-testing-bot (uosci-testing-bot)]

charm_unit_test #6247 nova-cloud-controller-next for xianghui mp265496
    UNIT OK: passed

Build: http://10.245.162.77:8080/job/charm_unit_test/6247/

[Edward Hope-Morley (hopem)]

See inline

review: Needs Fixing

[uosci-testing-bot (uosci-testing-bot)]

charm_lint_check #6618 nova-cloud-controller-next for xianghui mp265496
    LINT OK: passed

Build: http://10.245.162.77:8080/job/charm_lint_check/6618/

[uosci-testing-bot (uosci-testing-bot)]

charm_unit_test #6250 nova-cloud-controller-next for xianghui mp265496
    UNIT OK: passed

Build: http://10.245.162.77:8080/job/charm_unit_test/6250/

[uosci-testing-bot (uosci-testing-bot)]

charm_lint_check #6626 nova-cloud-controller-next for xianghui mp265496
    LINT OK: passed

Build: http://10.245.162.77:8080/job/charm_lint_check/6626/

[uosci-testing-bot (uosci-testing-bot)]

charm_unit_test #6253 nova-cloud-controller-next for xianghui mp265496
    UNIT OK: passed

Build: http://10.245.162.77:8080/job/charm_unit_test/6253/

[uosci-testing-bot (uosci-testing-bot)]

charm_amulet_test #5255 nova-cloud-controller-next for xianghui mp265496
    AMULET FAIL: amulet-test failed

AMULET Results (max last 2 lines):
make: *** [test] Error 1
ERROR:root:Make target returned non-zero.

Full amulet test output: http://paste.ubuntu.com/11921798/
Build: http://10.245.162.77:8080/job/charm_amulet_test/5255/

[Edward Hope-Morley (hopem)]

This all lgtm apart from one small comment. I'm gonna have a go at deploying it with your bundle before I +1 it tho. I also see that amulet failed but not sure if that is related.

[uosci-testing-bot (uosci-testing-bot)]

charm_lint_check #6781 nova-cloud-controller-next for xianghui mp265759
    LINT OK: passed

Build: http://10.245.162.77:8080/job/charm_lint_check/6781/

[uosci-testing-bot (uosci-testing-bot)]

charm_unit_test #6408 nova-cloud-controller-next for xianghui mp265759
    UNIT OK: passed

Build: http://10.245.162.77:8080/job/charm_unit_test/6408/

[uosci-testing-bot (uosci-testing-bot)]

charm_amulet_test #5278 nova-cloud-controller-next for xianghui mp265759
    AMULET OK: passed

Build: http://10.245.162.77:8080/job/charm_amulet_test/5278/

[lp:~xianghui/charms/trusty/nova-cloud-controller/lp1476455]

187. By Xiang Hui on 2015-07-24

decode before write file

[uosci-testing-bot (uosci-testing-bot)]

charm_lint_check #6886 nova-cloud-controller-next for xianghui mp265759
    LINT OK: passed

Build: http://10.245.162.77:8080/job/charm_lint_check/6886/

[uosci-testing-bot (uosci-testing-bot)]

charm_unit_test #6413 nova-cloud-controller-next for xianghui mp265759
    UNIT OK: passed

Build: http://10.245.162.77:8080/job/charm_unit_test/6413/

[uosci-testing-bot (uosci-testing-bot)]

charm_amulet_test #5328 nova-cloud-controller-next for xianghui mp265759
    AMULET OK: passed

Build: http://10.245.162.77:8080/job/charm_amulet_test/5328/

=== modified file 'config.yaml'
--- config.yaml	2015-07-10 14:14:23 +0000
+++ config.yaml	2015-07-24 10:07:27 +0000
@@ -381,3 +381,17 @@
       
       If memcached is being used to store the tokens, then it's recommended to
       change this configuration to False.
+  console-access-ssl-cert:
+    type: string
+    default: 
+    description: |
+      Used for encrypting console connections. This differs from the SSL certificate
+      used for API endpoints and is used for console access session only. Setting
+      this value along with console-access-ssl-key will enable encrypted console
+      sessions. This has nothing to do with Nova API SSL and can be used
+      independently. This can be used in conjunction with console-access-protocol
+      set to 'novnc' or 'spice'.
+  console-access-ssl-key:
+    type: string
+    default:
+    description: SSL key to use with certificate specified as console-access-ssl-cert.

=== modified file 'hooks/nova_cc_context.py'
--- hooks/nova_cc_context.py	2015-04-08 12:10:09 +0000
+++ hooks/nova_cc_context.py	2015-07-24 10:07:27 +0000
@@ -1,5 +1,6 @@
 import os
 
+from base64 import b64decode
 from charmhelpers.core.hookenv import (
     config,
     relation_ids,
@@ -9,6 +10,8 @@
     related_units,
     relations_for_id,
     relation_get,
+    DEBUG,
+    unit_get,
 )
 from charmhelpers.fetch import (
     apt_install,
@@ -23,6 +26,7 @@
     determine_apache_port,
     determine_api_port,
     https,
+    is_clustered,
 )
 from charmhelpers.contrib.network.ip import (
     format_ipv6_addr,
@@ -30,6 +34,7 @@
 from charmhelpers.contrib.openstack.ip import (
     resolve_address,
     INTERNAL,
+    PUBLIC,
 )
 
 
@@ -350,3 +355,54 @@
                 ctxt['ssl_key'] = key
 
         return ctxt
+
+
+class ConsoleSSLContext(context.OSContextGenerator):
+    interfaces = []
+
+    def __call__(self):
+        ctxt = {}
+        from nova_cc_utils import console_attributes
+
+        if config('console-access-ssl-cert') \
+                and config('console-access-ssl-key') \
+                and config('console-access-protocol'):
+            ssl_dir = '/etc/nova/ssl/'
+            if not os.path.exists(ssl_dir):
+                log('Creating %s.' % ssl_dir, level=DEBUG)
+                os.mkdir(ssl_dir)
+
+            cert_path = os.path.join(ssl_dir, 'nova_cert.pem')
+            decode_ssl_cert = b64decode(config('console-access-ssl-cert'))
+
+            key_path = os.path.join(ssl_dir, 'nova_key.pem')
+            decode_ssl_key = b64decode(config('console-access-ssl-key'))
+
+            with open(cert_path, 'w') as fh:
+                fh.write(decode_ssl_cert)
+            with open(key_path, 'w') as fh:
+                fh.write(decode_ssl_key)
+
+            ctxt['ssl_only'] = True
+            ctxt['ssl_cert'] = cert_path
+            ctxt['ssl_key'] = key_path
+
+            if is_clustered():
+                ip_addr = resolve_address(endpoint_type=PUBLIC)
+            else:
+                ip_addr = unit_get('private-address')
+
+            ip_addr = format_ipv6_addr(ip_addr) or ip_addr
+
+            _proto = config('console-access-protocol')
+            url = "https://%s:%s%s" % (
+                ip_addr,
+                console_attributes('proxy-port', proto=_proto),
+                console_attributes('proxy-page', proto=_proto))
+
+            if _proto == 'novnc':
+                ctxt['novncproxy_base_url'] = url
+            elif _proto == 'spice':
+                ctxt['html5proxy_base_url'] = url
+
+            return ctxt

=== modified file 'hooks/nova_cc_hooks.py'
--- hooks/nova_cc_hooks.py	2015-06-12 13:03:50 +0000
+++ hooks/nova_cc_hooks.py	2015-07-24 10:07:27 +0000
@@ -106,13 +106,15 @@
 from charmhelpers.contrib.hahelpers.cluster import (
     is_elected_leader,
     get_hacluster_config,
+    https,
 )
 
 from charmhelpers.payload.execd import execd_preinstall
 
 from charmhelpers.contrib.openstack.ip import (
     canonical_url,
-    PUBLIC, INTERNAL, ADMIN
+    PUBLIC, INTERNAL, ADMIN,
+    resolve_address,
 )
 
 from charmhelpers.contrib.network.ip import (
@@ -120,7 +122,8 @@
     get_netmask_for_address,
     get_address_in_network,
     get_ipv6_addr,
-    is_ipv6
+    is_ipv6,
+    format_ipv6_addr,
 )
 
 from charmhelpers.contrib.openstack.context import ADDRESS_TYPES
@@ -511,10 +514,26 @@
         return {}
     rel_settings['console_keymap'] = config('console-keymap')
     rel_settings['console_access_protocol'] = proto
+
+    console_ssl = False
+    if config('console-access-ssl-cert') and config('console-access-ssl-key'):
+        console_ssl = True
+
     if config('console-proxy-ip') == 'local':
-        proxy_base_addr = canonical_url(CONFIGS, PUBLIC)
+        if console_ssl:
+            address = resolve_address(endpoint_type=PUBLIC)
+            address = format_ipv6_addr(address) or address
+            proxy_base_addr = 'https://%s' % address
+        else:
+            # canonical_url will only return 'https:' if API SSL are enabled.
+            proxy_base_addr = canonical_url(CONFIGS, PUBLIC)
     else:
-        proxy_base_addr = "http://" + config('console-proxy-ip')
+        if console_ssl or https():
+            schema = "https"
+        else:
+            schema = "http"
+        proxy_base_addr = "%s://%s" % (schema, config('console-proxy-ip'))
+
     if proto == 'vnc':
         protocols = ['novnc', 'xvpvnc']
     else:

=== modified file 'hooks/nova_cc_utils.py'
--- hooks/nova_cc_utils.py	2015-07-16 20:51:15 +0000
+++ hooks/nova_cc_utils.py	2015-07-24 10:07:27 +0000
@@ -194,7 +194,8 @@
                      nova_cc_context.NovaIPv6Context(),
                      nova_cc_context.NeutronCCContext(),
                      nova_cc_context.NovaConfigContext(),
-                     nova_cc_context.InstanceConsoleContext()],
+                     nova_cc_context.InstanceConsoleContext(),
+                     nova_cc_context.ConsoleSSLContext()],
     }),
     (NOVA_API_PASTE, {
         'services': [s for s in BASE_SERVICES if 'api' in s],

=== modified file 'templates/icehouse/nova.conf'
--- templates/icehouse/nova.conf	2015-04-10 02:39:10 +0000
+++ templates/icehouse/nova.conf	2015-07-24 10:07:27 +0000
@@ -165,3 +165,5 @@
 
 [conductor]
 workers = {{ workers }}
+
+{% include "parts/spice" %}

=== modified file 'templates/juno/nova.conf'
--- templates/juno/nova.conf	2015-04-13 08:49:59 +0000
+++ templates/juno/nova.conf	2015-07-24 10:07:27 +0000
@@ -160,3 +160,5 @@
 
 [conductor]
 workers = {{ workers }}
+
+{% include "parts/spice" %}

=== modified file 'templates/kilo/nova.conf'
--- templates/kilo/nova.conf	2015-04-13 08:49:59 +0000
+++ templates/kilo/nova.conf	2015-07-24 10:07:27 +0000
@@ -155,3 +155,5 @@
 
 [oslo_concurrency]
 lock_path=/var/lock/nova
+
+{% include "parts/spice" %}

=== modified file 'templates/parts/novnc'
--- templates/parts/novnc	2015-04-08 12:10:09 +0000
+++ templates/parts/novnc	2015-07-24 10:07:27 +0000
@@ -7,3 +7,6 @@
 {% if ssl_key -%}
 key={{ ssl_key }}
 {% endif %}
+{% if novncproxy_base_url -%}
+novncproxy_base_url={{ novncproxy_base_url }}
+{% endif %}

=== added file 'templates/parts/spice'
--- templates/parts/spice	1970-01-01 00:00:00 +0000
+++ templates/parts/spice	2015-07-24 10:07:27 +0000
@@ -0,0 +1,4 @@
+[spice]
+{% if html5proxy_base_url -%}
+html5proxy_base_url = {{ html5proxy_base_url }}
+{% endif -%}

=== modified file 'unit_tests/test_nova_cc_contexts.py'
--- unit_tests/test_nova_cc_contexts.py	2015-06-11 13:33:42 +0000
+++ unit_tests/test_nova_cc_contexts.py	2015-07-24 10:07:27 +0000
@@ -148,3 +148,151 @@
         self.assertTrue(context.use_local_neutron_api())
         self.related_units.return_value = ['unit/0']
         self.assertFalse(context.use_local_neutron_api())
+
+    @mock.patch.object(context, 'config')
+    def test_console_access_ssl_disabled(self, mock_config):
+        config = {'console-access-ssl_cert': 'LS0tLS1CRUdJTiBDRV',
+                  'console-access-ssl_key': 'LS0tLS1CRUdJTiBQUk'}
+        mock_config.side_effect = lambda key: config.get(key)
+
+        ctxt = context.ConsoleSSLContext()()
+        self.assertEqual(ctxt, None)
+
+        config = {'console-access-ssl_cert': None,
+                  'console-access-ssl_key': None}
+        mock_config.side_effect = lambda key: config.get(key)
+
+        ctxt = context.ConsoleSSLContext()()
+        self.assertEqual(ctxt, None)
+
+        config = {'console-access-protocol': 'novnc',
+                  'console-access-ssl_cert': None,
+                  'console-access-ssl_key': None}
+        mock_config.side_effect = lambda key: config.get(key)
+
+        ctxt = context.ConsoleSSLContext()()
+        self.assertEqual(ctxt, None)
+
+    @mock.patch('__builtin__.open')
+    @mock.patch('os.path.exists')
+    @mock.patch.object(context, 'config')
+    @mock.patch.object(context, 'unit_get')
+    @mock.patch.object(context, 'is_clustered')
+    @mock.patch.object(context, 'resolve_address')
+    @mock.patch.object(context, 'b64decode')
+    def test_noVNC_ssl_enabled(self, mock_b64decode,
+                               mock_resolve_address,
+                               mock_is_clustered, mock_unit_get,
+                               mock_config, mock_exists, mock_open):
+        config = {'console-access-ssl-cert': 'LS0tLS1CRUdJTiBDRV',
+                  'console-access-ssl-key': 'LS0tLS1CRUdJTiBQUk',
+                  'console-access-protocol': 'novnc'}
+        mock_config.side_effect = lambda key: config.get(key)
+        mock_exists.return_value = True
+        mock_unit_get.return_value = '127.0.0.1'
+        mock_is_clustered.return_value = True
+        mock_resolve_address.return_value = '10.5.100.1'
+        mock_b64decode.return_value = 'decode_success'
+
+        mock_open.return_value.__enter__ = lambda s: s
+        mock_open.return_value.__exit__ = mock.Mock()
+
+        ctxt = context.ConsoleSSLContext()()
+        self.assertTrue(ctxt['ssl_only'])
+        self.assertEqual(ctxt['ssl_cert'], '/etc/nova/ssl/nova_cert.pem')
+        self.assertEqual(ctxt['ssl_key'], '/etc/nova/ssl/nova_key.pem')
+        self.assertEqual(ctxt['novncproxy_base_url'],
+                         'https://10.5.100.1:6080/vnc_auto.html')
+
+    @mock.patch('__builtin__.open')
+    @mock.patch('os.path.exists')
+    @mock.patch.object(context, 'config')
+    @mock.patch.object(context, 'unit_get')
+    @mock.patch.object(context, 'is_clustered')
+    @mock.patch.object(context, 'resolve_address')
+    @mock.patch.object(context, 'b64decode')
+    def test_noVNC_ssl_enabled_no_cluster(self, mock_b64decode,
+                                          mock_resolve_address,
+                                          mock_is_clustered, mock_unit_get,
+                                          mock_config, mock_exists, mock_open):
+        config = {'console-access-ssl-cert': 'LS0tLS1CRUdJTiBDRV',
+                  'console-access-ssl-key': 'LS0tLS1CRUdJTiBQUk',
+                  'console-access-protocol': 'novnc'}
+        mock_config.side_effect = lambda key: config.get(key)
+        mock_exists.return_value = True
+        mock_unit_get.return_value = '10.5.0.1'
+        mock_is_clustered.return_value = False
+        mock_b64decode.return_value = 'decode_success'
+
+        mock_open.return_value.__enter__ = lambda s: s
+        mock_open.return_value.__exit__ = mock.Mock()
+
+        ctxt = context.ConsoleSSLContext()()
+        self.assertTrue(ctxt['ssl_only'])
+        self.assertEqual(ctxt['ssl_cert'], '/etc/nova/ssl/nova_cert.pem')
+        self.assertEqual(ctxt['ssl_key'], '/etc/nova/ssl/nova_key.pem')
+        self.assertEqual(ctxt['novncproxy_base_url'],
+                         'https://10.5.0.1:6080/vnc_auto.html')
+
+    @mock.patch('__builtin__.open')
+    @mock.patch('os.path.exists')
+    @mock.patch.object(context, 'config')
+    @mock.patch.object(context, 'unit_get')
+    @mock.patch.object(context, 'is_clustered')
+    @mock.patch.object(context, 'resolve_address')
+    @mock.patch.object(context, 'b64decode')
+    def test_spice_html5_ssl_enabled(self, mock_b64decode,
+                                     mock_resolve_address,
+                                     mock_is_clustered, mock_unit_get,
+                                     mock_config, mock_exists, mock_open):
+        config = {'console-access-ssl-cert': 'LS0tLS1CRUdJTiBDRV',
+                  'console-access-ssl-key': 'LS0tLS1CRUdJTiBQUk',
+                  'console-access-protocol': 'spice'}
+        mock_config.side_effect = lambda key: config.get(key)
+        mock_exists.return_value = True
+        mock_unit_get.return_value = '127.0.0.1'
+        mock_is_clustered.return_value = True
+        mock_resolve_address.return_value = '10.5.100.1'
+        mock_b64decode.return_value = 'decode_success'
+
+        mock_open.return_value.__enter__ = lambda s: s
+        mock_open.return_value.__exit__ = mock.Mock()
+
+        ctxt = context.ConsoleSSLContext()()
+        self.assertTrue(ctxt['ssl_only'])
+        self.assertEqual(ctxt['ssl_cert'], '/etc/nova/ssl/nova_cert.pem')
+        self.assertEqual(ctxt['ssl_key'], '/etc/nova/ssl/nova_key.pem')
+        self.assertEqual(ctxt['html5proxy_base_url'],
+                         'https://10.5.100.1:6082/spice_auto.html')
+
+    @mock.patch('__builtin__.open')
+    @mock.patch('os.path.exists')
+    @mock.patch.object(context, 'config')
+    @mock.patch.object(context, 'unit_get')
+    @mock.patch.object(context, 'is_clustered')
+    @mock.patch.object(context, 'resolve_address')
+    @mock.patch.object(context, 'b64decode')
+    def test_spice_html5_ssl_enabled_no_cluster(self, mock_b64decode,
+                                                mock_resolve_address,
+                                                mock_is_clustered,
+                                                mock_unit_get,
+                                                mock_config, mock_exists,
+                                                mock_open):
+        config = {'console-access-ssl-cert': 'LS0tLS1CRUdJTiBDRV',
+                  'console-access-ssl-key': 'LS0tLS1CRUdJTiBQUk',
+                  'console-access-protocol': 'spice'}
+        mock_config.side_effect = lambda key: config.get(key)
+        mock_exists.return_value = True
+        mock_unit_get.return_value = '10.5.0.1'
+        mock_is_clustered.return_value = False
+        mock_b64decode.return_value = 'decode_success'
+
+        mock_open.return_value.__enter__ = lambda s: s
+        mock_open.return_value.__exit__ = mock.Mock()
+
+        ctxt = context.ConsoleSSLContext()()
+        self.assertTrue(ctxt['ssl_only'])
+        self.assertEqual(ctxt['ssl_cert'], '/etc/nova/ssl/nova_cert.pem')
+        self.assertEqual(ctxt['ssl_key'], '/etc/nova/ssl/nova_key.pem')
+        self.assertEqual(ctxt['html5proxy_base_url'],
+                         'https://10.5.0.1:6082/spice_auto.html')

=== modified file 'unit_tests/test_nova_cc_hooks.py'
--- unit_tests/test_nova_cc_hooks.py	2015-06-12 13:03:50 +0000
+++ unit_tests/test_nova_cc_hooks.py	2015-07-24 10:07:27 +0000
@@ -681,16 +681,14 @@
         }
         self.assertEqual(_con_sets, console_settings)
 
-    @patch.object(hooks, 'canonical_url')
+    @patch.object(hooks, 'https')
     @patch.object(utils, 'config')
-    def test_console_settings_explicit_ip(self, _utils_config,
-                                          _canonical_url):
+    def test_console_settings_explicit_ip(self, _utils_config, _https):
         _utils_config.return_value = 'spice'
+        _https.return_value = False
         _cc_public_host = "public-host"
-        _cc_private_host = "private-host"
         self.test_config.set('console-proxy-ip', _cc_public_host)
         _con_sets = hooks.console_settings()
-        _canonical_url.return_value = 'http://' + _cc_private_host
         console_settings = {
             'console_proxy_spice_address': 'http://%s:6082/spice_auto.html' %
                                            (_cc_public_host),
@@ -701,6 +699,25 @@
         }
         self.assertEqual(_con_sets, console_settings)
 
+    @patch.object(hooks, 'https')
+    @patch.object(utils, 'config')
+    def test_console_settings_explicit_ip_with_https(self, _utils_config,
+                                                     _https):
+        _utils_config.return_value = 'spice'
+        _https.return_value = True
+        _cc_public_host = "public-host"
+        self.test_config.set('console-proxy-ip', _cc_public_host)
+        _con_sets = hooks.console_settings()
+        console_settings = {
+            'console_proxy_spice_address': 'https://%s:6082/spice_auto.html' %
+                                           (_cc_public_host),
+            'console_proxy_spice_host': _cc_public_host,
+            'console_proxy_spice_port': 6082,
+            'console_access_protocol': 'spice',
+            'console_keymap': 'en-us'
+        }
+        self.assertEqual(_con_sets, console_settings)
+
     def test_conditional_neutron_migration(self):
         self.os_release.return_value = 'juno'
         self.services.return_value = ['neutron-server']