Description of problem: While using self-signed SSL certs and adjusting local_settings to use "OPENSTACK_SSL_NO_VERIFY = True", we are failing to retrieve API versions using cinderclient (see lp#1815635 for full description) . Version-Release number of selected component (if applicable): Horizon container: rhosp13/openstack-horizon/images/13.0-109 Package: openstack-dashboard-13.0.3-1.el7ost.noarch How reproducible: Steps to Reproduce: 1. Adjust /etc/openstack-dashboard/local_settings to include: # Disable SSL certificate checks (useful for self-signed certificates): OPENSTACK_SSL_NO_VERIFY = True 2. Restart horizon container on controllers Actual results: Observe failed SSL connection attempts to retrieve API versions using cinderclient Expected results: No verify ssl connections should be respected throughout the request initiated from the Horizon dashboard. Additional info:
Basically duplicate of https://bugs.launchpad.net/horizon/+bug/1744670 Should be fixed by: - https://github.com/openstack/horizon/commit/285c51f7e1b27a786fa9684abdc489998285b4e2 - https://review.opendev.org/#/c/675894/ Upstream fix of cinderclient (added an insecure flag) which is a version bump for horizon to get the applied upstream fix: - https://review.opendev.org/#/c/675891/ For RH OSP13 we would need to bump a lot: < python-cinderclient>=3.3.0 # Apache-2.0 > python-cinderclient>=5.0.0 # Apache-2.0 Cheers, Marc Methot
To be honest, I don't think we can bump cinderclient like that. I will see if we could get the cinderclient patch backported instead.
We will know as soon as we get a reply to comment 3.