yahoo-eng-team team mailing list archive

[Matt Riedemann <mriedem@xxxxxxxxxx>]

Public bug reported:

Nova sends the entire serialized service catalog in the http header to
glance requests:

https://github.com/openstack/nova/blob/icehouse-
eol/nova/image/glance.py#L136

If you have a lot of endpoints in your service catalog this can make
glance fail with "400 Header Line TooLong".

Per bknudson: "Any service using the auth_token middleware has no use
for the x-service-catalog header. All that auth_token middleware uses is
x-auth-token. The auth_token middleware will actually strip the x
-service-catalog from the request before it sends the request on to the
rest of the pipeline, so the application will never see it."

If glance needs the service catalog it will get it from keystone when it
auths the tokens, so nova shouldn't be sending this.

** Affects: nova
     Importance: High
     Assignee: Matt Riedemann (mriedem)
         Status: In Progress


** Tags: juno-backport-potential kilo-backport-potential

** Changed in: nova
       Status: New => In Progress

** Changed in: nova
   Importance: Undecided => High

** Changed in: nova
     Assignee: (unassigned) => Matt Riedemann (mriedem)

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Compute (nova).
https://bugs.launchpad.net/bugs/1482699

Title:
  glance requests from nova fail if there are too many endpoints in the
  service catalog

Status in OpenStack Compute (nova):
  In Progress

Bug description:
  Nova sends the entire serialized service catalog in the http header to
  glance requests:

  https://github.com/openstack/nova/blob/icehouse-
  eol/nova/image/glance.py#L136

  If you have a lot of endpoints in your service catalog this can make
  glance fail with "400 Header Line TooLong".

  Per bknudson: "Any service using the auth_token middleware has no use
  for the x-service-catalog header. All that auth_token middleware uses
  is x-auth-token. The auth_token middleware will actually strip the x
  -service-catalog from the request before it sends the request on to
  the rest of the pipeline, so the application will never see it."

  If glance needs the service catalog it will get it from keystone when
  it auths the tokens, so nova shouldn't be sending this.

To manage notifications about this bug go to:
https://bugs.launchpad.net/nova/+bug/1482699/+subscriptions