<html><body>
<p><font size="2" face="sans-serif">Sent this to the wrong list the first time, my bad. See below.</font><br>
<br>
<br>
<tt><font size="2">Paul Ward/Rochester/IBM wrote on 05/28/2014 02:12:10 PM:<br>
<br>
> From: Paul Ward/Rochester/IBM</font></tt><br>
<tt><font size="2">> To: openstack-dev@lists.openstack.org, </font></tt><br>
<tt><font size="2">> Date: 05/28/2014 02:12 PM</font></tt><br>
<tt><font size="2">> Subject: [Openstack-stable-maint] Stable exception</font></tt><br>
<tt><font size="2">> <br>
> I'll start by saying that we don't need this ported to icehouse as we've</font></tt><br>
<tt><font size="2">> included it in our distro, as Alan suggested.</font></tt><br>
<tt><font size="2">> <br>
> However, I would like to explain why we needed it. We do generate</font></tt><br>
<tt><font size="2">> cert files for the controller node. However, for cases where the different</font></tt><br>
<tt><font size="2">> services are all running on the controller node, we use 127.0.0.1 as the</font></tt><br>
<tt><font size="2">> address they communicate on. Since the cert was based on hostname,</font></tt><br>
<tt><font size="2">> this will fail unless we have the api_insecure flag set. And since we're</font></tt><br>
<tt><font size="2">> communicating on 127.0.0.1, it's ok to ignore ssl errors.</font></tt><br>
<tt><font size="2">> <br>
> Since this is in Juno, and we've patched it in Icehouse for our distro, we</font></tt><br>
<tt><font size="2">> have no pressing need to backport this one. Thanks for keeping an</font></tt><br>
<tt><font size="2">> eye on it!</font></tt><br>
<tt><font size="2">> <br>
> Alan Pevec wrote:</font></tt><br>
<tt><font size="2">> > <a href="https://bugs.launchpad.net/neutron/+bug/1306822">https://bugs.launchpad.net/neutron/+bug/1306822</a></font></tt><br>
<tt><font size="2">> > <a href="https://bugs.launchpad.net/neutron/+bug/1309694">https://bugs.launchpad.net/neutron/+bug/1309694</a></font></tt><br>
<tt><font size="2">> ></font></tt><br>
<tt><font size="2">> > Those bugs describe the missing options, but do not do a great job of</font></tt><br>
<tt><font size="2">> > describing the impact of not having them. My guess is that without those</font></tt><br>
<tt><font size="2">> > parameters, you have to rely on system certificates (as you can't</font></tt><br>
<tt><font size="2">> > provide your own and you can't disable the check). Is that a correct</font></tt><br>
<tt><font size="2">> > assumption ? Who is impacted by these bugs ?</font></tt><br>
<tt><font size="2">> <br>
> I think you're right that 1309694 can be worked around by using system</font></tt><br>
<tt><font size="2">> cert store.</font></tt><br>
<tt><font size="2">> Disabling cert check bug 1306822 is definitely not needed - why would</font></tt><br>
<tt><font size="2">> you use certs if you don't check them?</font></tt><br>
<tt><font size="2">> So unless more justification is provided in the bugs (importance of</font></tt><br>
<tt><font size="2">> both is Undecided) I don't think we have the case for granting the</font></tt><br>
<tt><font size="2">> exception.</font></tt><br>
<tt><font size="2">> <br>
> Distributions are of course free to take those patches, if it suits</font></tt><br>
<tt><font size="2">> their policies.</font></tt><br>
<tt><font size="2">> BTW having such backports proposed is fine even if denied for stable</font></tt><br>
<tt><font size="2">> merge, we can use stable reviews as a mean to share patches among</font></tt><br>
<tt><font size="2">> distros.</font></tt><br>
<tt><font size="2">> <br>
> > If my interpretation is correct, then this falls a bit in a grey area:</font></tt><br>
<tt><font size="2">> > it is a "feature" to allow your own certificate to be provided, but it</font></tt><br>
<tt><font size="2">> > could be seen as a bug (feature gap) if Neutron was the only project in</font></tt><br>
<tt><font size="2">> > Icehouse not having that feature (and people would generally expect</font></tt><br>
<tt><font size="2">> > those parameters to be present). Is Neutron the only project that misses</font></tt><br>
<tt><font size="2">> > those parameters ?</font></tt><br>
<tt><font size="2">> <br>
> Currently yes, only Neutron has a new feature in Icehouse to send port</font></tt><br>
<tt><font size="2">> events to Nova but Cinder will need to same to properly fix the race</font></tt><br>
<tt><font size="2">> with volumes during VM setup.</font></tt><br>
<tt><font size="2">> <br>
> Cheers,</font></tt><br>
<tt><font size="2">> Alan</font></tt></body></html>