<html><body>
<p><font size="2" face="sans-serif">I'll start by saying that we don't need this ported to icehouse as we've</font><br>
<font size="2" face="sans-serif">included it in our distro, as Alan suggested.</font><br>
<br>
<font size="2" face="sans-serif">However, I would like to explain why we needed it. We do generate</font><br>
<font size="2" face="sans-serif">cert files for the controller node. However, for cases where the different</font><br>
<font size="2" face="sans-serif">services are all running on the controller node, we use 127.0.0.1 as the</font><br>
<font size="2" face="sans-serif">address they communicate on. Since the cert was based on hostname,</font><br>
<font size="2" face="sans-serif">this will fail unless we have the api_insecure flag set. And since we're</font><br>
<font size="2" face="sans-serif">communicating on 127.0.0.1, it's ok to ignore ssl errors.</font><br>
<br>
<font size="2" face="sans-serif">Since this is in Juno, and we've patched it in Icehouse for our distro, we</font><br>
<font size="2" face="sans-serif">have no pressing need to backport this one. Thanks for keeping an</font><br>
<font size="2" face="sans-serif">eye on it!</font><br>
<br>
<font size="2" face="sans-serif">Alan Pevec wrote:</font><br>
<font size="2" face="sans-serif">> <a href="https://bugs.launchpad.net/neutron/+bug/1306822">https://bugs.launchpad.net/neutron/+bug/1306822</a></font><br>
<font size="2" face="sans-serif">> <a href="https://bugs.launchpad.net/neutron/+bug/1309694">https://bugs.launchpad.net/neutron/+bug/1309694</a></font><br>
<font size="2" face="sans-serif">></font><br>
<font size="2" face="sans-serif">> Those bugs describe the missing options, but do not do a great job of</font><br>
<font size="2" face="sans-serif">> describing the impact of not having them. My guess is that without those</font><br>
<font size="2" face="sans-serif">> parameters, you have to rely on system certificates (as you can't</font><br>
<font size="2" face="sans-serif">> provide your own and you can't disable the check). Is that a correct</font><br>
<font size="2" face="sans-serif">> assumption ? Who is impacted by these bugs ?</font><br>
<br>
<font size="2" face="sans-serif">I think you're right that 1309694 can be worked around by using system</font><br>
<font size="2" face="sans-serif">cert store.</font><br>
<font size="2" face="sans-serif">Disabling cert check bug 1306822 is definitely not needed - why would</font><br>
<font size="2" face="sans-serif">you use certs if you don't check them?</font><br>
<font size="2" face="sans-serif">So unless more justification is provided in the bugs (importance of</font><br>
<font size="2" face="sans-serif">both is Undecided) I don't think we have the case for granting the</font><br>
<font size="2" face="sans-serif">exception.</font><br>
<br>
<font size="2" face="sans-serif">Distributions are of course free to take those patches, if it suits</font><br>
<font size="2" face="sans-serif">their policies.</font><br>
<font size="2" face="sans-serif">BTW having such backports proposed is fine even if denied for stable</font><br>
<font size="2" face="sans-serif">merge, we can use stable reviews as a mean to share patches among</font><br>
<font size="2" face="sans-serif">distros.</font><br>
<br>
<font size="2" face="sans-serif">> If my interpretation is correct, then this falls a bit in a grey area:</font><br>
<font size="2" face="sans-serif">> it is a "feature" to allow your own certificate to be provided, but it</font><br>
<font size="2" face="sans-serif">> could be seen as a bug (feature gap) if Neutron was the only project in</font><br>
<font size="2" face="sans-serif">> Icehouse not having that feature (and people would generally expect</font><br>
<font size="2" face="sans-serif">> those parameters to be present). Is Neutron the only project that misses</font><br>
<font size="2" face="sans-serif">> those parameters ?</font><br>
<br>
<font size="2" face="sans-serif">Currently yes, only Neutron has a new feature in Icehouse to send port</font><br>
<font size="2" face="sans-serif">events to Nova but Cinder will need to same to properly fix the race</font><br>
<font size="2" face="sans-serif">with volumes during VM setup.</font><br>
<br>
<font size="2" face="sans-serif">Cheers,</font><br>
<font size="2" face="sans-serif">Alan</font></body></html>