Browse Source

Merge "Deprecate http_basic_username and http_basic_password in [json_rpc]"

changes/64/741064/4
Zuul 2 weeks ago
committed by Gerrit Code Review
parent
commit
3670be1283
8 changed files with 66 additions and 33 deletions
  1. +10
    -5
      devstack/lib/ironic
  2. +2
    -2
      doc/source/install/standalone.rst
  3. +13
    -13
      ironic/common/json_rpc/client.py
  4. +6
    -6
      ironic/conf/json_rpc.py
  5. +27
    -5
      ironic/tests/unit/common/test_json_rpc.py
  6. +1
    -1
      lower-constraints.txt
  7. +6
    -0
      releasenotes/notes/json_rpc_http_basic-42dfc6ca2471a30e.yaml
  8. +1
    -1
      requirements.txt

+ 10
- 5
devstack/lib/ironic View File

@@ -1410,10 +1410,15 @@ function configure_ironic {
if [[ "$IRONIC_JSON_RPC_AUTH_STRATEGY" != "" ]]; then
iniset $IRONIC_CONF_FILE json_rpc auth_strategy $IRONIC_JSON_RPC_AUTH_STRATEGY
fi
iniset $IRONIC_CONF_FILE json_rpc http_basic_username myName
iniset $IRONIC_CONF_FILE json_rpc http_basic_password myPassword
# json-rpc auth file with bcrypt hash of myPassword
echo 'myName:$2y$05$lE3eGtyj41jZwrzS87KTqe6.JETVCWBkc32C63UP2aYrGoYOEpbJm' > /etc/ironic/htpasswd-json-rpc
if [[ "$IRONIC_JSON_RPC_AUTH_STRATEGY" == "http_basic" ]]; then
iniset $IRONIC_CONF_FILE json_rpc username myName
iniset $IRONIC_CONF_FILE json_rpc password myPassword
# json-rpc auth file with bcrypt hash of myPassword
echo 'myName:$2y$05$lE3eGtyj41jZwrzS87KTqe6.JETVCWBkc32C63UP2aYrGoYOEpbJm' > /etc/ironic/htpasswd-json-rpc
fi
if [[ "$IRONIC_JSON_RPC_AUTH_STRATEGY" == "" ]] || [[ "$IRONIC_JSON_RPC_AUTH_STRATEGY" == "keystone" ]]; then
configure_client_for json_rpc
fi

# Set fast track options
iniset $IRONIC_CONF_FILE deploy fast_track $IRONIC_DEPLOY_FAST_TRACK
@@ -1547,7 +1552,7 @@ function configure_ironic_conductor {

# NOTE(pas-ha) service_catalog section is used to discover
# ironic API endpoint from keystone catalog
local client_sections="neutron swift glance inspector cinder service_catalog json_rpc nova"
local client_sections="neutron swift glance inspector cinder service_catalog nova"
for conf_section in $client_sections; do
configure_client_for $conf_section
done


+ 2
- 2
doc/source/install/standalone.rst View File

@@ -73,8 +73,8 @@ You should make the following changes to ``/etc/ironic/ironic.conf``:

[json_rpc]
auth_strategy=http_basic
http_basic_username=myName
http_basic_password=myPassword
username=myName
password=myPassword

Preparing images
----------------


+ 13
- 13
ironic/common/json_rpc/client.py View File

@@ -15,8 +15,6 @@
This client is compatible with any JSON RPC 2.0 implementation, including ours.
"""

import base64

from oslo_config import cfg
from oslo_log import log
from oslo_utils import importutils
@@ -38,23 +36,25 @@ def _get_session():
global _SESSION

if _SESSION is None:
kwargs = {}
auth_strategy = json_rpc.auth_strategy()
if auth_strategy == 'keystone':
auth = keystone.get_auth('json_rpc')
else:
auth = None
if auth_strategy != 'keystone':
auth_type = 'none' if auth_strategy == 'noauth' else auth_strategy
CONF.set_default('auth_type', auth_type, group='json_rpc')

# Deprecated, remove in W
if auth_strategy == 'http_basic':
if CONF.json_rpc.http_basic_username:
kwargs['username'] = CONF.json_rpc.http_basic_username
if CONF.json_rpc.http_basic_password:
kwargs['password'] = CONF.json_rpc.http_basic_password

auth = keystone.get_auth('json_rpc', **kwargs)

session = keystone.get_session('json_rpc', auth=auth)
headers = {
'Content-Type': 'application/json'
}
if auth_strategy == 'http_basic':
token = '{}:{}'.format(
CONF.json_rpc.http_basic_username,
CONF.json_rpc.http_basic_password
).encode('utf-8')
encoded = base64.b64encode(token).decode('utf-8')
headers['Authorization'] = 'Basic {}'.format(encoded)

# Adds options like connect_retries
_SESSION = keystone.get_adapter('json_rpc', session=session,


+ 6
- 6
ironic/conf/json_rpc.py View File

@@ -38,16 +38,16 @@ opts = [
default=False,
help=_('Whether to use TLS for JSON RPC')),
cfg.StrOpt('http_basic_username',
default='',
deprecated_for_removal=True,
deprecated_reason=_("Use username instead"),
help=_("Name of the user to use for HTTP Basic authentication "
"client requests. Required when "
"auth_strategy=http_basic.")),
"client requests.")),
cfg.StrOpt('http_basic_password',
default='',
deprecated_for_removal=True,
deprecated_reason=_("Use password instead"),
secret=True,
help=_("Password to use for HTTP Basic authentication "
"client requests. Required when "
"auth_strategy=http_basic.")),
"client requests.")),
]




+ 27
- 5
ironic/tests/unit/common/test_json_rpc.py View File

@@ -584,9 +584,11 @@ class TestSession(test_base.TestCase):
self.config(auth_strategy='noauth', group='json_rpc')
session = client._get_session()

mock_keystone.get_auth.assert_not_called()
mock_keystone.get_auth.assert_called_once_with('json_rpc')
auth = mock_keystone.get_auth.return_value

mock_keystone.get_session.assert_called_once_with(
'json_rpc', auth=None)
'json_rpc', auth=auth)

internal_session = mock_keystone.get_session.return_value

@@ -619,14 +621,35 @@ class TestSession(test_base.TestCase):
self.assertEqual(mock_keystone.get_adapter.return_value, session)

def test_http_basic(self, mock_keystone):
self.config(auth_strategy='http_basic', group='json_rpc')
session = client._get_session()

mock_keystone.get_auth.assert_called_once_with('json_rpc')
auth = mock_keystone.get_auth.return_value
mock_keystone.get_session.assert_called_once_with(
'json_rpc', auth=auth)

internal_session = mock_keystone.get_session.return_value

mock_keystone.get_adapter.assert_called_once_with(
'json_rpc',
session=internal_session,
additional_headers={
'Content-Type': 'application/json'
})
self.assertEqual(mock_keystone.get_adapter.return_value, session)

def test_http_basic_deprecated(self, mock_keystone):
self.config(auth_strategy='http_basic', group='json_rpc')
self.config(http_basic_username='myName', group='json_rpc')
self.config(http_basic_password='myPassword', group='json_rpc')
session = client._get_session()

mock_keystone.get_auth.assert_not_called()
mock_keystone.get_auth.assert_called_once_with(
'json_rpc', username='myName', password='myPassword')
auth = mock_keystone.get_auth.return_value
mock_keystone.get_session.assert_called_once_with(
'json_rpc', auth=None)
'json_rpc', auth=auth)

internal_session = mock_keystone.get_session.return_value

@@ -634,7 +657,6 @@ class TestSession(test_base.TestCase):
'json_rpc',
session=internal_session,
additional_headers={
'Authorization': 'Basic bXlOYW1lOm15UGFzc3dvcmQ=',
'Content-Type': 'application/json'
})
self.assertEqual(mock_keystone.get_adapter.return_value, session)

+ 1
- 1
lower-constraints.txt View File

@@ -42,7 +42,7 @@ jmespath==0.9.5
jsonpatch==1.16
jsonpointer==2.0
jsonschema==3.2.0
keystoneauth1==3.18.0
keystoneauth1==4.2.0
keystonemiddleware==4.17.0
kombu==4.6.8
linecache2==1.0.0


+ 6
- 0
releasenotes/notes/json_rpc_http_basic-42dfc6ca2471a30e.yaml View File

@@ -0,0 +1,6 @@
---
deprecations:
- |
The configuration options ``[json_rpc]http_basic_username`` and
``[json_rpc]http_basic_password`` have been deprecated in favour of the
more generic ``[json_rpc]username`` and ``[json_rpc]password``.

+ 1
- 1
requirements.txt View File

@@ -10,7 +10,7 @@ WebOb>=1.7.1 # MIT
python-cinderclient!=4.0.0,>=3.3.0 # Apache-2.0
python-neutronclient>=6.7.0 # Apache-2.0
python-glanceclient>=2.8.0 # Apache-2.0
keystoneauth1>=3.18.0 # Apache-2.0
keystoneauth1>=4.2.0 # Apache-2.0
ironic-lib>=4.3.0 # Apache-2.0
python-swiftclient>=3.2.0 # Apache-2.0
pytz>=2013.6 # MIT


Loading…
Cancel
Save