yahoo-eng-team team mailing list archive

[OpenStack Infra <1590608@xxxxxxxxxxxxxxxxxx>]

Reviewed:  https://review.openstack.org/384482
Committed: https://git.openstack.org/cgit/openstack/senlin/commit/?id=8542ba8457d93a14e22f7c7b771d4ac629b77142
Submitter: Jenkins
Branch:    master

commit 8542ba8457d93a14e22f7c7b771d4ac629b77142
Author: pallavi <pallavi.s@xxxxxxxxxxxxxxxxxx>
Date:   Mon Oct 10 18:16:09 2016 +0530

    Add http_proxy_to_wsgi to api-paste
    
    This sets up the HTTPProxyToWSGI middleware in front of senlin-api. The
    purpose of this middleware is to set up the request URL correctly in
    the case there is a proxy (For instance, a loadbalancer such as HAProxy)
    in front of senlin-api.
    
    So, when TLS connections are terminated at the proxy, and one tries to
    get the versions from the '/' resource from senlin-api, one will notice
    that the protocol is incorrect; It will show 'http' instead of 'https'.
    So this middleware handles such cases, thus helping Keystone discovery
    work correctly.
    
    The HTTPProxyToWSGI is off by default and needs to be enabled via a
    configuration value.
    
    Change-Id: Ia65ecdcc07084514884258661f840e6edcb200a4
    Closes-Bug: #1590608
    Co-Authored-By: pallavi <pallavi.s@xxxxxxxxxxxxxxxxxx>


** Changed in: senlin
       Status: In Progress => Fix Released

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to neutron.
https://bugs.launchpad.net/bugs/1590608

Title:
  Services should use http_proxy_to_wsgi middleware

Status in Aodh:
  Fix Released
Status in Barbican:
  Fix Released
Status in Ceilometer:
  Fix Released
Status in Cinder:
  Fix Released
Status in cloudkitty:
  In Progress
Status in congress:
  New
Status in Freezer:
  Fix Released
Status in Glance:
  Fix Released
Status in Gnocchi:
  Fix Committed
Status in heat:
  Fix Released
Status in OpenStack Identity (keystone):
  Fix Released
Status in Magnum:
  Fix Released
Status in neutron:
  Fix Released
Status in Panko:
  Fix Released
Status in Sahara:
  Fix Released
Status in OpenStack Search (Searchlight):
  Fix Released
Status in senlin:
  Fix Released
Status in OpenStack DBaaS (Trove):
  Fix Released

Bug description:
  It's a common problem when putting a service behind a load balancer to
  need to forward the Protocol and hosts of the original request so that
  the receiving service can construct URLs to the loadbalancer and not
  the private worker node.

  Most services have implemented some form of secure_proxy_ssl_header =
  HTTP_X_FORWARDED_PROTO handling however exactly how this is done is
  dependent on the service.

  oslo.middleware provides the http_proxy_to_wsgi middleware that
  handles these headers and the newer RFC7239 forwarding header and
  completely hides the problem from the service.

  This middleware should be adopted by all services in preference to
  their own HTTP_X_FORWARDED_PROTO handling.

To manage notifications about this bug go to:
https://bugs.launchpad.net/aodh/+bug/1590608/+subscriptions