Remove the legacy v2 API entry from api-paste.ini

The api sample tests and functional tests already stopped to
run against with legacy v2 API. This patch removes the legacy
V2 API entry from api-paste.ini, it stops user from using
legacy V2 API. This patch also adds deprecated report in pipeline
factory method to notice the user update their api-paste.ini
after upgrade code.

Partially implements blueprint remove-legacy-v2-api-code

Change-Id: I1476b2e364032d7c98f71df0cd61f1d1c19e005d

etc/nova/api-paste.ini

@@ -18,15 +18,6 @@ paste.app_factory = nova.api.metadata.handler:MetadataRequestHandler.factory
 [composite:osapi_compute]
 use = call:nova.api.openstack.urlmap:urlmap_factory
 /: oscomputeversions
-# starting in Liberty the v21 implementation replaces the v2
-# implementation and is suggested that you use it as the default. If
-# this causes issues with your clients you can rollback to the
-# *frozen* v2 api by commenting out the above stanza and using the
-# following instead::
-# /v2: openstack_compute_api_legacy_v2
-# if rolling back to v2 fixes your issue please file a critical bug
-# at - https://bugs.launchpad.net/nova/+bugs
-#
 # v21 is an exactly feature match for v2, except it has more stringent
 # input validation on the wsgi surface (prevents fuzzing early on the
 # API). It also provides new features via API microversions which are
@@ -35,13 +26,6 @@ use = call:nova.api.openstack.urlmap:urlmap_factory
 /v2: openstack_compute_api_v21_legacy_v2_compatible
 /v2.1: openstack_compute_api_v21
 
-# NOTE: this is deprecated in favor of openstack_compute_api_v21_legacy_v2_compatible
-[composite:openstack_compute_api_legacy_v2]
-use = call:nova.api.auth:pipeline_factory
-noauth2 = cors compute_req_id faultwrap sizelimit noauth2 legacy_ratelimit osapi_compute_app_legacy_v2
-keystone = cors compute_req_id faultwrap sizelimit authtoken keystonecontext legacy_ratelimit osapi_compute_app_legacy_v2
-keystone_nolimit = cors compute_req_id faultwrap sizelimit authtoken keystonecontext osapi_compute_app_legacy_v2
-
 [composite:openstack_compute_api_v21]
 use = call:nova.api.auth:pipeline_factory_v21
 noauth2 = cors compute_req_id faultwrap sizelimit noauth2 osapi_compute_app_v21

nova/api/auth.py

@@ -18,6 +18,7 @@ Common Auth Middleware.
 
 from oslo_config import cfg
 from oslo_log import log as logging
+from oslo_log import versionutils
 from oslo_middleware import request_id
 from oslo_serialization import jsonutils
 import webob.dec
@@ -25,6 +26,7 @@ import webob.exc
 
 from nova import context
 from nova.i18n import _
+from nova.i18n import _LW
 from nova import wsgi
 
 
@@ -65,13 +67,12 @@ def _load_pipeline(loader, pipeline):
 
 def pipeline_factory(loader, global_conf, **local_conf):
     """A paste pipeline replica that keys off of auth_strategy."""
-
+    versionutils.report_deprecated_feature(
-    pipeline = local_conf[CONF.auth_strategy]
+        LOG,
-    if not CONF.api_rate_limit:
+        _LW("The legacy V2 API code tree has been removed in Newton. "
-        limit_name = CONF.auth_strategy + '_nolimit'
+            "Please remove legacy v2 API entry from api-paste.ini, and use "
-        pipeline = local_conf.get(limit_name, pipeline)
+            "V2.1 API or V2.1 API compat mode instead")
-    pipeline = pipeline.split()
+    )
-    return _load_pipeline(loader, pipeline)
 
 
 def pipeline_factory_v21(loader, global_conf, **local_conf):

nova/tests/unit/api/test_auth.py

@@ -12,6 +12,7 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
+import mock
 from oslo_config import cfg
 from oslo_middleware import request_id
 from oslo_serialization import jsonutils
@@ -152,13 +153,6 @@ class TestPipeLineFactory(test.NoDBTestCase):
         self.assertEqual(app.name, pipeline.split()[-1])
         self.assertIsInstance(app, TestPipeLineFactory.FakeApp)
 
-    def test_pipeline_factory(self):
-        fake_pipeline = 'test1 test2 test3'
-        CONF.set_override('auth_strategy', 'noauth2')
-        app = nova.api.auth.pipeline_factory(
-            TestPipeLineFactory.FakeLoader(), None, noauth2=fake_pipeline)
-        self._test_pipeline(fake_pipeline, app)
-
     def test_pipeline_factory_v21(self):
         fake_pipeline = 'test1 test2 test3'
         CONF.set_override('auth_strategy', 'noauth2')
@@ -166,28 +160,10 @@ class TestPipeLineFactory(test.NoDBTestCase):
             TestPipeLineFactory.FakeLoader(), None, noauth2=fake_pipeline)
         self._test_pipeline(fake_pipeline, app)
 
-    def test_pipeline_factory_with_rate_limits(self):
+    @mock.patch('oslo_log.versionutils.report_deprecated_feature')
-        CONF.set_override('api_rate_limit', True)
+    def test_pipeline_factory_legacy_v2_deprecated(self,
-        CONF.set_override('auth_strategy', 'keystone')
+                                                   mock_report_deprecated):
         fake_pipeline = 'test1 test2 test3'
-        app = nova.api.auth.pipeline_factory(
+        nova.api.auth.pipeline_factory(TestPipeLineFactory.FakeLoader(),
-            TestPipeLineFactory.FakeLoader(), None, keystone=fake_pipeline)
+            None, noauth2=fake_pipeline)
-        self._test_pipeline(fake_pipeline, app)
+        self.assertTrue(mock_report_deprecated.called)
-
-    def test_pipeline_factory_without_rate_limits(self):
-        CONF.set_override('auth_strategy', 'keystone')
-        fake_pipeline1 = 'test1 test2 test3'
-        fake_pipeline2 = 'test4 test5 test6'
-        app = nova.api.auth.pipeline_factory(
-            TestPipeLineFactory.FakeLoader(), None,
-            keystone_nolimit=fake_pipeline1,
-            keystone=fake_pipeline2)
-        self._test_pipeline(fake_pipeline1, app)
-
-    def test_pipeline_factory_missing_nolimits_pipeline(self):
-        CONF.set_override('api_rate_limit', False)
-        CONF.set_override('auth_strategy', 'keystone')
-        fake_pipeline = 'test1 test2 test3'
-        app = nova.api.auth.pipeline_factory(
-            TestPipeLineFactory.FakeLoader(), None, keystone=fake_pipeline)
-        self._test_pipeline(fake_pipeline, app)

releasenotes/notes/remove-legacy-v2-api-7ac6d74edaedf011.yaml

@@ -0,0 +1,10 @@
+---
+upgrade:
+    - The legacy v2 API code was deprecated since Liberty release. The legacy
+      v2 API code was removed in Newton release. We suggest that user should
+      move to v2.1 API which compatible v2 API with more restrict input
+      validation and microversions support. If user is still looking for v2
+      compatible API before switch to v2.1 API, user can use v2.1 API code as
+      v2 API compatible mode. That compatible mode is closer to v2 API
+      behaviour which is v2 API compatible without restrict input validation
+      and microversions support.