urrently fence_compute's --insecure option has the exact opposite effect of what it is meant.
The help page states:
   --insecure                     Explicitly allow agent to perform "insecure" TLS
                                        (https) requests
                
Which assumes that when we do not specify it we make secure requests. Which is not the case:
[root@database-2 ~]# /usr/sbin/fence_compute -o list --auth-url=https://overcloud.redhat.local:13000 --username=admin --password=$(hiera -c /etc/puppet/hiera.yaml keystone::admin_password) --domain=redhat.local --project-domain=Default --user-domain=Default --region-name=regionOne --tenant-name=admin 
/usr/lib/python3.6/site-packages/urllib3/connectionpool.py:847: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/adva
nced-usage.html#ssl-warnings
  InsecureRequestWarning)
...             
compute-0.redhat.local,
compute-0,      
compute-1.redhat.local,
compute-1,      
                
The reason for this is that when we do *not* specify --insecure, then options['--insecure'] is set to the
string 'False' and when we pass "verify=(not options['--insecure'])" to the keystone session class,
we basically always pass the False boolean value (because not of a string is always False).
Whereas when we do specify --insecure then options['--insecure'] is set to the empty string
which becomes the True bool value when passing verify==(not options['--insecure']).
                
This is all the exact opposite of what we want.


Before the patch:
[root@database-2 ~]# /usr/sbin/fence_compute -o list --auth-url=https://overcloud.redhat.local:13000 --username=admin --password=$(hiera -c /etc/puppet/hiera.yaml keystone::admin_password) --domain=redhat.local --project-domain=Default --user-domain=Default --region-name=regionOne --tenant-name=admin --insecure                                                                                                                                                      
compute-0.redhat.local,
compute-0,      
compute-1.redhat.local,
compute-1,      
[root@database-2 ~]# /usr/sbin/fence_compute -o list --auth-url=https://overcloud.redhat.local:13000 --username=admin --password=$(hiera -c /etc/puppet/hiera.yaml keystone::admin_password) --domain=redhat.local --project-domain=Default --user-domain=Default --region-name=regionOne --tenant-name=admin 
/usr/lib/python3.6/site-packages/urllib3/connectionpool.py:847: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings InsecureRequestWarning)
...             
compute-0.redhat.local,
compute-0,      
compute-1.redhat.local,
compute-1,      
                
After the patch:
[root@database-2 ~]# ./test -o list --auth-url=https://overcloud.redhat.local:13000 --username=admin --password=$(hiera -c /etc/puppet/hiera.yaml keystone::admin_password) --domain=redhat.local --project-domain=Default --user-domain=Default --region-name=regionOne --tenant-name=admin          
compute-0.redhat.local,
compute-0,      
compute-1.redhat.local,
compute-1,      
[root@database-2 ~]# ./test -o list --auth-url=https://overcloud.redhat.local:13000 --username=admin --password=$(hiera -c /etc/puppet/hiera.yaml keystone::admin_password) --domain=redhat.local --project-domain=Default --user-domain=Default --region-name=regionOne --tenant-name=admin --insecure
/usr/lib/python3.6/site-packages/urllib3/connectionpool.py:847: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings InsecureRequestWarning)
...             
compute-0.redhat.local,
compute-0,      
compute-1.redhat.local,
compute-1,     

[root@database-2 ~]# diff -u /usr/sbin/fence_compute  test      
--- /usr/sbin/fence_compute     2020-02-13 15:15:09.000000000 +0000             
+++ test        2020-05-03 18:19:57.923253223 +0000       
@@ -281,7 +281,13 @@     
                                 
        loader = loading.get_plugin_loader('password')    
        keystone_auth = loader.load_from_options(**kwargs)      
-       keystone_session = session.Session(auth=keystone_auth, verify=(not options["--insecure"]))
+       verify_tls = True        
+        # When --insecure is not specified the value is the string 'False'     
+        # Otherwise when it is added to the command line the option is set to ''
+       if options['--insecure'].lower().strip() in ['', 'true']:
+               verify_tls = False
+                                   
+       keystone_session = session.Session(auth=keystone_auth, verify=verify_tls)
                                    
        nova_versions = [ "2.11", "2" ]
        for version in nova_versions: