From fdd11b54a5e3d7a9ee89628baba2990e4e00abdd Mon Sep 17 00:00:00 2001 From: Pavlo Shchelokovskyy Date: Thu, 17 Nov 2016 13:26:28 +0200 Subject: Configure and use SSL-related requests options This patch adds standard SSL options to IPA config and makes use of them when making HTTP requests. For now, a single set of certificates is used when needed. In the future configuration can be expanded to allow per-service certificates. Besides, the 'insecure' option (defaults to False) can be overridden through kernel command line parameter 'ipa-insecure'. This will allow running IPA in CI-like environments with self-signed SSL certificates. Change-Id: I259d9b3caa9ba1dc3d7382f375b8e086a5348d80 Closes-Bug: #1642515 --- ironic_python_agent/utils.py | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) (limited to 'ironic_python_agent/utils.py') diff --git a/ironic_python_agent/utils.py b/ironic_python_agent/utils.py index 6045f6b4..ddfe25ca 100644 --- a/ironic_python_agent/utils.py +++ b/ironic_python_agent/utils.py @@ -416,3 +416,20 @@ def collect_system_logs(journald_max_lines=None): try_get_command_output(io_dict, name, cmd) return gzip_and_b64encode(io_dict=io_dict, file_list=file_list) + + +def get_ssl_client_options(conf): + """Format SSL-related requests options. + + :param conf: oslo_config CONF object + :returns: tuple of 'verify' and 'cert' values to pass to requests + """ + if conf.insecure: + verify = False + else: + verify = conf.cafile or True + if conf.certfile and conf.keyfile: + cert = (conf.certfile, conf.keyfile) + else: + cert = None + return verify, cert -- cgit v1.2.1