Codebase list glance / 8140abe
Remove secure_proxy_ssl_header opt from Glance Glance uses http-proxy-to-wsgi middleware from oslo.middleware in its pipeline in order to efficiently forward request headers in case of load balancer style deployments. Hence, the configuration option ``secure_proxy_ssl_header`` was marked as deprecated. This patch removes the option and the support for it within Glance to entirely rely on oslo middleware. This will ensure that the related headers set by oslo.middleware:HTTPProxyToWSGI is never modified in Glance. Change-Id: I11d41bb736bbfd90030d88245c11642823e4c400 Closes-Bug: 1673908 Dharini Chandrasekar authored 7 years ago Cyril Roelandt committed 1 year, 10 months ago
5 changed file(s) with 9 addition(s) and 80 deletion(s). Raw diff Collapse all Expand all
+0
-8
etc/glance-api.conf less more
792792 # (integer value)
793793 # Minimum value: 1
794794 #tcp_keepidle = 600
795
796 # DEPRECATED: The HTTP header used to determine the scheme for the original
797 # request, even if it was removed by an SSL terminating proxy. Typical value is
798 # "HTTP_X_FORWARDED_PROTO". (string value)
799 # This option is deprecated for removal.
800 # Its value may be silently ignored in the future.
801 # Reason: Use the http_proxy_to_wsgi middleware instead.
802 #secure_proxy_ssl_header = <None>
803795
804796 # Key:Value pair of store identifier and store type. In case of multiple
805797 # backends should be separated using comma. (dict value)
+0
-16
glance/common/wsgi.py less more
244244 """)),
245245 ]
246246
247 wsgi_opts = [
248 cfg.StrOpt('secure_proxy_ssl_header',
249 deprecated_for_removal=True,
250 deprecated_reason=_('Use the http_proxy_to_wsgi middleware '
251 'instead.'),
252 help=_('The HTTP header used to determine the scheme for the '
253 'original request, even if it was removed by an SSL '
254 'terminating proxy. Typical value is '
255 '"HTTP_X_FORWARDED_PROTO".')),
256 ]
257
258247 store_opts = [
259248 cfg.DictOpt('enabled_backends',
260249 help=_('Key:Value pair of store identifier and store type. '
292281 CONF.register_opts(bind_opts)
293282 CONF.register_opts(socket_opts)
294283 CONF.register_opts(eventlet_opts)
295 CONF.register_opts(wsgi_opts)
296284 CONF.register_opts(store_opts)
297285 CONF.register_opts(cache_opts)
298286 profiler_opts.set_defaults(CONF)
10831071 """Add some OpenStack API-specific logic to the base webob.Request."""
10841072
10851073 def __init__(self, environ, *args, **kwargs):
1086 if CONF.secure_proxy_ssl_header:
1087 scheme = environ.get(CONF.secure_proxy_ssl_header)
1088 if scheme:
1089 environ['wsgi.url_scheme'] = scheme
10901074 super(Request, self).__init__(environ, *args, **kwargs)
10911075
10921076 @property
+0
-1
glance/opts.py less more
5252 glance.common.wsgi.bind_opts,
5353 glance.common.wsgi.eventlet_opts,
5454 glance.common.wsgi.socket_opts,
55 glance.common.wsgi.wsgi_opts,
5655 glance.common.wsgi.store_opts,
5756 glance.common.wsgi.cache_opts,
5857 glance.common.wsgi.cli_opts,
+0
-55
glance/tests/unit/test_versions.py less more
2121
2222 from glance.api.middleware import version_negotiation
2323 from glance.api import versions
24 from glance.common.wsgi import Request as WsgiRequest
2524 from glance.tests.unit import base
2625
2726
208207 res = versions.Controller().index(req)
209208 results = jsonutils.loads(res.body)['versions']
210209 expected = get_versions_list('https://example.com:9292',
211 enabled_backends=True,
212 enabled_cache=True)
213 self.assertEqual(expected, results)
214
215 def test_get_version_list_secure_proxy_ssl_header(self):
216 self.config(secure_proxy_ssl_header='HTTP_X_FORWARDED_PROTO')
217 url = 'http://localhost:9292'
218 environ = webob.request.environ_from_url(url)
219 req = WsgiRequest(environ)
220 res = versions.Controller().index(req)
221 self.assertEqual(http.MULTIPLE_CHOICES, res.status_int)
222 self.assertEqual('application/json', res.content_type)
223 results = jsonutils.loads(res.body)['versions']
224 expected = get_versions_list(url)
225 self.assertEqual(expected, results)
226
227 self.config(enabled_backends='slow:one,fast:two')
228 res = versions.Controller().index(req)
229 results = jsonutils.loads(res.body)['versions']
230 expected = get_versions_list(url, enabled_backends=True)
231 self.assertEqual(expected, results)
232
233 self.config(image_cache_dir='/tmp/cache')
234 res = versions.Controller().index(req)
235 results = jsonutils.loads(res.body)['versions']
236 expected = get_versions_list(url,
237 enabled_backends=True,
238 enabled_cache=True)
239 self.assertEqual(expected, results)
240
241 def test_get_version_list_secure_proxy_ssl_header_https(self):
242 self.config(secure_proxy_ssl_header='HTTP_X_FORWARDED_PROTO')
243 url = 'http://localhost:9292'
244 ssl_url = 'https://localhost:9292'
245 environ = webob.request.environ_from_url(url)
246 environ['HTTP_X_FORWARDED_PROTO'] = "https"
247 req = WsgiRequest(environ)
248 res = versions.Controller().index(req)
249 self.assertEqual(http.MULTIPLE_CHOICES, res.status_int)
250 self.assertEqual('application/json', res.content_type)
251 results = jsonutils.loads(res.body)['versions']
252 expected = get_versions_list(ssl_url)
253 self.assertEqual(expected, results)
254
255 self.config(enabled_backends='slow:one,fast:two')
256 res = versions.Controller().index(req)
257 results = jsonutils.loads(res.body)['versions']
258 expected = get_versions_list(ssl_url, enabled_backends=True)
259 self.assertEqual(expected, results)
260
261 self.config(image_cache_dir='/tmp/cache')
262 res = versions.Controller().index(req)
263 results = jsonutils.loads(res.body)['versions']
264 expected = get_versions_list(ssl_url,
265210 enabled_backends=True,
266211 enabled_cache=True)
267212 self.assertEqual(expected, results)
+9
-0
releasenotes/notes/remove_secure_proxy_ssl_header-2a95ad48ffa471ad.yaml less more
0 ---
1 deprecations:
2 - |
3 Removed the deprecated 'secure_proxy_ssl_header' config option. Image import
4 will be always enabled from this release onwards as designed.
5 upgrade:
6 - |
7 As Glance relies on oslo.middleware for this feature, care needs to be taken
8 that it is configured properly from this release forward.