From fdd11b54a5e3d7a9ee89628baba2990e4e00abdd Mon Sep 17 00:00:00 2001 From: Pavlo Shchelokovskyy Date: Thu, 17 Nov 2016 13:26:28 +0200 Subject: Configure and use SSL-related requests options This patch adds standard SSL options to IPA config and makes use of them when making HTTP requests. For now, a single set of certificates is used when needed. In the future configuration can be expanded to allow per-service certificates. Besides, the 'insecure' option (defaults to False) can be overridden through kernel command line parameter 'ipa-insecure'. This will allow running IPA in CI-like environments with self-signed SSL certificates. Change-Id: I259d9b3caa9ba1dc3d7382f375b8e086a5348d80 Closes-Bug: #1642515 --- ironic_python_agent/extensions/standby.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'ironic_python_agent/extensions') diff --git a/ironic_python_agent/extensions/standby.py b/ironic_python_agent/extensions/standby.py index 1ba396ea..be9a1952 100644 --- a/ironic_python_agent/extensions/standby.py +++ b/ironic_python_agent/extensions/standby.py @@ -19,6 +19,7 @@ import six import time from oslo_concurrency import processutils +from oslo_config import cfg from oslo_log import log from ironic_lib import disk_utils @@ -27,6 +28,7 @@ from ironic_python_agent.extensions import base from ironic_python_agent import hardware from ironic_python_agent import utils +CONF = cfg.CONF LOG = log.getLogger(__name__) IMAGE_CHUNK_SIZE = 1024 * 1024 # 1MB @@ -227,7 +229,9 @@ class ImageDownload(object): if no_proxy: os.environ['no_proxy'] = no_proxy proxies = image_info.get('proxies', {}) - resp = requests.get(url, stream=True, proxies=proxies) + verify, cert = utils.get_ssl_client_options(CONF) + resp = requests.get(url, stream=True, proxies=proxies, + verify=verify, cert=cert) if resp.status_code != 200: msg = ('Received status code {} from {}, expected 200. Response ' 'body: {}').format(resp.status_code, url, resp.text) -- cgit v1.2.1