Retry stdlib ssl.SSLError

Apparently, connection to the agent can fail with

    Unexpected error when processing next clean step.
    SSLError: ('timed out',): ssl.SSLError: ('timed out',)

This change adds SSLError to retriable errors since most of them are
related to temporary conditions, and the certificate validation failure
is handled by requests separately.

Change-Id: I4805d410b4bc98196e77d8c44a217e363dc88f0a
(cherry picked from commit 528eb9e4a9)

ironic/drivers/modules/agent_client.py

@@ -14,6 +14,7 @@
 
 from http import client as http_client
 import os
+import ssl
 
 from ironic_lib import metrics_utils
 from oslo_log import log
@@ -199,7 +200,7 @@ class AgentClient(object):
                 url, params=request_params, data=body,
                 verify=self._get_verify(node),
                 timeout=CONF.agent.command_timeout)
-        except (requests.ConnectionError, requests.Timeout) as e:
+        except (requests.ConnectionError, requests.Timeout, ssl.SSLError) as e:
             result = self._handle_timeout_on_command_execution(node, method,
                                                                params, e)
             response = None

ironic/tests/unit/drivers/modules/test_agent_client.py

@@ -14,6 +14,7 @@
 
 from http import client as http_client
 import json
+import ssl
 from unittest import mock
 
 import requests
@@ -816,10 +817,11 @@ class TestAgentClientAttempts(base.TestCase):
         method = 'standby.run_image'
         image_info = {'image_id': 'test_image'}
         params = {'image_info': image_info}
-        self.client.session.post.side_effect = [requests.Timeout(error),
-                                                requests.Timeout(error),
-                                                requests.Timeout(error),
-                                                requests.Timeout(error)]
+        self.client.session.post.side_effect = [
+            requests.Timeout(error),
+            ssl.SSLError('timed out'),
+            requests.ConnectionError(error),
+            requests.Timeout(error)]
         self.client._get_command_url(self.node)
         self.client._get_command_body(method, params)
 
@@ -840,7 +842,7 @@ class TestAgentClientAttempts(base.TestCase):
         image_info = {'image_id': 'test_image'}
         params = {'image_info': image_info}
         self.client.session.post.side_effect = [requests.Timeout(error),
-                                                requests.Timeout(error),
+                                                ssl.SSLError('timed out'),
                                                 MockResponse(response_data)]
 
         response = self.client._command(self.node, method, params)

releasenotes/notes/sslerror-287edf7f8b3c5f1c.yaml

@@ -0,0 +1,4 @@
+---
+fixes:
+  - |
+    Retries ``ssl.SSLError`` when connecting to the agent.