Add config for boto https_validate_certificates

Boto does not, by default, validate https ceritificates on endpoints. We
now provide a way to specify it in the heat configuration along side
is_secure. Heat deployers may also need to turn this off if boto ever
does make it default and they want to use self signed certs.

Fixes bug #1130345

Change-Id: I09b684dd28a8a57c6ce514d1df1e699e7c8b182e

diff --git a/etc/heat/heat-engine.conf b/etc/heat/heat-engine.conf
index 8d97de5c7ba989fcc7a31af134859ca6a2ffca06..cc10966cc9681fa884acac98d8526dedd6ab8ae5 100644 (file)
--- a/etc/heat/heat-engine.conf
+++ b/etc/heat/heat-engine.conf
@@ -19,6 +19,10 @@ heat_stack_user_role = heat_stack_user
 # to be configured correctly to support ssl connections
 instance_connection_is_secure = 0
 
+# If is_secure is set to 1, certificate validation can
+# be enabled or disabled
+instance_connection_https_validate_certificates = 1
+
 # URL for instances to connect for metadata
 # ie the IP of the bridge device connecting the
 # instances with the host and the bind_port of

diff --git a/heat/common/config.py b/heat/common/config.py
index cc054fe0f9e8ae12eb26a52e354c7c790b779b67..2618eb914691ceebcecf3753016f2798ab7dc0aa 100644 (file)
--- a/heat/common/config.py
+++ b/heat/common/config.py
@@ -79,6 +79,9 @@ service_opts = [
     cfg.StrOpt('instance_connection_is_secure',
                default="0",
                help='Instance connection to cfn/cw API via https'),
+    cfg.StrOpt('instance_connection_https_validate_certificates',
+               default="1",
+               help='Instance connection to cfn/cw API validate certs if ssl'),
     cfg.StrOpt('heat_stack_user_role',
                default="heat_stack_user",
                help='Keystone role for heat template-defined users')]

diff --git a/heat/engine/resources/instance.py b/heat/engine/resources/instance.py
index 1b626bcba6cd4ffe74d141ffeb1a8ef247fbb9c3..f5c1b9fa5fe3896e0f2fb2ce2b6cb3822782e123 100644 (file)
--- a/heat/engine/resources/instance.py
+++ b/heat/engine/resources/instance.py
@@ -195,9 +195,11 @@ class Instance(resource.Resource):
             cfn_url = urlparse(cfg.CONF.heat_metadata_server_url)
             cw_url = urlparse(cfg.CONF.heat_watch_server_url)
             is_secure = cfg.CONF.instance_connection_is_secure
+            vcerts = cfg.CONF.instance_connection_https_validate_certificates
             boto_cfg = "\n".join(["[Boto]",
                                   "debug = 0",
                                   "is_secure = %s" % is_secure,
+                                  "https_validate_certificates = %s" % vcerts,
                                   "cfn_region_name = heat",
                                   "cfn_region_endpoint = %s" %
                                   cfn_url.hostname,