From 402769f9add8f0eaa36a6a54ee7cb26823db96e1 Mon Sep 17 00:00:00 2001
From: Anton Arefiev <aarefiev@mirantis.com>
Date: Fri, 24 Mar 2017 11:20:33 +0200
Subject: [PATCH] Use eventlet version of subprocess

Eventlet doesn't patch subprocess module, see bug [1]. As result
trying to catch subprocess.CalledProcessError exception wouldn't
work. So use subprocess module from eventlet.

[1] https://github.com/eventlet/eventlet/issues/357

Closes-Bug: #1675744
Change-Id: I4a744cef35e9f58c532d979ce61c912cfdfccd97
---
 ironic_inspector/firewall.py                             | 2 +-
 ironic_inspector/test/unit/test_firewall.py              | 5 ++---
 ...x-CalledProcessError-on-startup-28d9dbed85a81542.yaml | 9 +++++++++
 3 files changed, 12 insertions(+), 4 deletions(-)
 create mode 100644 releasenotes/notes/fix-CalledProcessError-on-startup-28d9dbed85a81542.yaml

diff --git a/ironic_inspector/firewall.py b/ironic_inspector/firewall.py
index 62da7a5c6..f27885b6b 100644
--- a/ironic_inspector/firewall.py
+++ b/ironic_inspector/firewall.py
@@ -14,8 +14,8 @@
 import contextlib
 import os
 import re
-import subprocess
 
+from eventlet.green import subprocess
 from eventlet import semaphore
 from oslo_config import cfg
 from oslo_log import log
diff --git a/ironic_inspector/test/unit/test_firewall.py b/ironic_inspector/test/unit/test_firewall.py
index 15ea42677..387068ce3 100644
--- a/ironic_inspector/test/unit/test_firewall.py
+++ b/ironic_inspector/test/unit/test_firewall.py
@@ -13,7 +13,6 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
-import subprocess
 
 import mock
 from oslo_config import cfg
@@ -34,7 +33,7 @@ EMAC=02:00:00:61:00:02 IMAC=61:fe:80:00:00:00:00:00:00:7c:fe:90:03:00:29:24:4f
 
 @mock.patch.object(firewall, '_iptables')
 @mock.patch.object(ir_utils, 'get_client')
-@mock.patch.object(subprocess, 'check_call')
+@mock.patch.object(firewall.subprocess, 'check_call')
 class TestFirewall(test_base.NodeTest):
     CLIENT_ID = 'ff:00:00:00:00:00:02:00:00:02:c9:00:7c:fe:90:03:00:29:24:4f'
 
@@ -69,7 +68,7 @@ class TestFirewall(test_base.NodeTest):
                                     mock_iptables):
         rootwrap_path = '/some/fake/path'
         CONF.set_override('rootwrap_config', rootwrap_path)
-        mock_call.side_effect = subprocess.CalledProcessError(2, '')
+        mock_call.side_effect = firewall.subprocess.CalledProcessError(2, '')
         firewall.init()
         init_expected_args = [
             ('-D', 'INPUT', '-i', 'br-ctlplane', '-p', 'udp', '--dport', '67',
diff --git a/releasenotes/notes/fix-CalledProcessError-on-startup-28d9dbed85a81542.yaml b/releasenotes/notes/fix-CalledProcessError-on-startup-28d9dbed85a81542.yaml
new file mode 100644
index 000000000..2ed504824
--- /dev/null
+++ b/releasenotes/notes/fix-CalledProcessError-on-startup-28d9dbed85a81542.yaml
@@ -0,0 +1,9 @@
+---
+fixes:
+  - |
+    Exception CalledProcessError is raised when running `iptables` cmd on start up.
+    The issue is caused by eventlet bug, see:
+    https://github.com/eventlet/eventlet/issues/357
+    The issue affects *ironic-inspector* only if it manages firewall - configured
+    with ``manage_firewall = True`` configuration option.
+