Merge "Fix heat WSGI script paths in TLS override"

heat/templates/bin/_heat-api.sh.tpl

@@ -20,10 +20,6 @@ COMMAND="${@:-start}"
 function start () {
 
 {{- if .Values.manifests.certificates }}
-  for WSGI_SCRIPT in heat-wsgi-api; do
-    cp -a $(type -p ${WSGI_SCRIPT}) /var/www/cgi-bin/heat/
-  done
-
   if [ -f /etc/apache2/envvars ]; then
     # Loading Apache2 ENV variables
     source /etc/apache2/envvars

heat/templates/bin/_heat-cfn.sh.tpl

@@ -19,10 +19,6 @@ COMMAND="${@:-start}"
 
 function start () {
 {{- if .Values.manifests.certificates }}
-  for WSGI_SCRIPT in heat-wsgi-api-cfn; do
-    cp -a $(type -p ${WSGI_SCRIPT}) /var/www/cgi-bin/heat/
-  done
-
   if [ -f /etc/apache2/envvars ]; then
     # Loading Apache2 ENV variables
     source /etc/apache2/envvars

heat/templates/deployment-api.yaml

@@ -107,8 +107,6 @@ spec:
               mountPath: {{ .Values.conf.heat.oslo_concurrency.lock_path }}
             - name: pod-etc-heat
               mountPath: /etc/heat
-            - name: wsgi-heat
-              mountPath: /var/www/cgi-bin/heat
             - name: heat-bin
               mountPath: /tmp/heat-api.sh
               subPath: heat-api.sh
@@ -162,8 +160,6 @@ spec:
           emptyDir: {}
         - name: pod-etc-heat
           emptyDir: {}
-        - name: wsgi-heat
-          emptyDir: {}
         - name: heat-bin
           configMap:
             name: heat-bin

heat/templates/deployment-cfn.yaml

@@ -106,8 +106,6 @@ spec:
               mountPath: {{ .Values.conf.heat.oslo_concurrency.lock_path }}
             - name: pod-etc-heat
               mountPath: /etc/heat
-            - name: wsgi-heat
-              mountPath: /var/www/cgi-bin/heat
             - name: heat-bin
               mountPath: /tmp/heat-cfn.sh
               subPath: heat-cfn.sh
@@ -160,8 +158,6 @@ spec:
           emptyDir: {}
         - name: pod-etc-heat
           emptyDir: {}
-        - name: wsgi-heat
-          emptyDir: {}
         - name: heat-bin
           configMap:
             name: heat-bin

values_overrides/heat/tls.yaml

@@ -23,11 +23,14 @@ conf:
   wsgi_heat: |
     {{- $portInt := tuple "orchestration" "internal" "api" $ | include "helm-toolkit.endpoints.endpoint_port_lookup" }}
     Listen {{ $portInt }}
+    <Directory /var/lib/openstack/bin>
+        Require all granted
+    </Directory>
     <VirtualHost *:{{ $portInt }}>
       ServerName {{ printf "%s.%s.svc.%s" "heat-api" .Release.Namespace .Values.endpoints.cluster_domain_suffix }}
       WSGIDaemonProcess heat-api processes=1 threads=1 user=heat display-name=%{GROUP}
       WSGIProcessGroup heat-api
-      WSGIScriptAlias /  /var/www/cgi-bin/heat/heat-wsgi-api
+      WSGIScriptAlias /  /var/lib/openstack/bin/heat-wsgi-api
       WSGIApplicationGroup %{GLOBAL}
       WSGIPassAuthorization On
       AllowEncodedSlashes On
@@ -48,11 +51,14 @@ conf:
   wsgi_cfn: |
     {{- $portInt := tuple "cloudformation" "internal" "api" $ | include "helm-toolkit.endpoints.endpoint_port_lookup" }}
     Listen {{ $portInt }}
+    <Directory /var/lib/openstack/bin>
+        Require all granted
+    </Directory>
     <VirtualHost *:{{ $portInt }}>
       ServerName {{ printf "%s.%s.svc.%s" "heat-api-cfn" .Release.Namespace .Values.endpoints.cluster_domain_suffix }}
       WSGIDaemonProcess heat-api-cfn processes=1 threads=1 user=heat display-name=%{GROUP}
       WSGIProcessGroup heat-api-cfn
-      WSGIScriptAlias / /var/www/cgi-bin/heat/heat-wsgi-api-cfn
+      WSGIScriptAlias / /var/lib/openstack/bin/heat-wsgi-api-cfn
       WSGIApplicationGroup %{GLOBAL}
       WSGIPassAuthorization On
       AllowEncodedSlashes On