aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rwxr-xr-xdocker/prepare_env.sh15
-rw-r--r--docs/configguide/configguide.rst16
-rw-r--r--testcases/functest_utils.py13
3 files changed, 32 insertions, 12 deletions
diff --git a/docker/prepare_env.sh b/docker/prepare_env.sh
index 542df0e7..58fa514e 100755
--- a/docker/prepare_env.sh
+++ b/docker/prepare_env.sh
@@ -210,8 +210,10 @@ mkdir -p ${FUNCTEST_RESULTS_DIR}/ODL
# Create Openstack credentials file
-if [ ! -f ${FUNCTEST_CONF_DIR}/openstack.creds ]; then
- ${REPOS_DIR}/releng/utils/fetch_os_creds.sh -d ${FUNCTEST_CONF_DIR}/openstack.creds \
+# $creds is an env varialbe in the docker container pointing to
+# /home/opnfv/functest/conf/openstack.creds
+if [ ! -f ${creds} ]; then
+ ${REPOS_DIR}/releng/utils/fetch_os_creds.sh -d ${creds} \
-i ${INSTALLER_TYPE} -a ${INSTALLER_IP}
retval=$?
if [ $retval != 0 ]; then
@@ -221,8 +223,15 @@ if [ ! -f ${FUNCTEST_CONF_DIR}/openstack.creds ]; then
else
info "OpenStack credentials file given to the docker and stored in ${FUNCTEST_CONF_DIR}/openstack.creds."
fi
+
+# If we use SSL, by default use option OS_INSECURE=true which means that
+# the cacert will be self-signed
+if grep -Fq "OS_CACERT" ${creds}; then
+ echo "OS_INSECURE=true">>${creds};
+fi
+
# Source credentials
-source ${FUNCTEST_CONF_DIR}/openstack.creds
+source ${creds}
# Check OpenStack
info "Checking that the basic OpenStack services are functional..."
diff --git a/docs/configguide/configguide.rst b/docs/configguide/configguide.rst
index b7a25c7d..120951c4 100644
--- a/docs/configguide/configguide.rst
+++ b/docs/configguide/configguide.rst
@@ -234,10 +234,10 @@ environment variable. Check the deployment settings.
SSL Support
-----------
-If the OpenStack deployment is defined to use HTTPS endpoints, a certificate
-will be needed in the container in order to launch any command.
-
-The OS variable will point to that file. For example::
+If you need to connect to a server that is TLS-enabled (the auth URL begins with ‘https’)
+and it uses a certificate from a private CA or a self-signed certificate you will
+need to specify the path to an appropriate CA certificate to use to validate the
+server certificate with the environment variable OS_CACERT::
echo $OS_CACERT
/etc/ssl/certs/ca.crt
@@ -252,7 +252,15 @@ be copied manually from the OpenStack deployment. This can be done in 2 ways:
-v <path_to_your_cert_file>:/etc/ssl/certs/ca.cert
+You might need to export OS_CACERT environment variable inside the container::
+
+ export OS_CACERT=/etc/ssl/certs/ca.crt
+
+
+Certificate verification can be turned off using OS_INSECURE=true.
+For example, Fuel uses self-signed cacerts by default, so an pre step would be::
+ export OS_INSECURE=true
Additional Options
diff --git a/testcases/functest_utils.py b/testcases/functest_utils.py
index 9a5d718b..5d380ab3 100644
--- a/testcases/functest_utils.py
+++ b/testcases/functest_utils.py
@@ -67,12 +67,15 @@ def get_credentials(service):
"http://192.168.20.71:5000/v2.0"),
tenant: os.environ.get("OS_TENANT_NAME", "admin"),
})
- ssl = os.environ.get("OS_CACERT")
- if ssl is not None:
- creds.update({"ca_cert": ssl})
- if not os.path.isfile(ssl):
+ cacert = os.environ.get("OS_CACERT")
+ if cacert != None:
+ # each openstack client uses differnt kwargs for this
+ creds.update({"cacert":cacert,"ca_cert":cacert,"https_ca_cert":cacert, \
+ "https_cacert":cacert,"ca_file":cacert})
+ creds.update({"insecure":"True","https_insecure":"True"})
+ if not os.path.isfile(cacert):
print "WARNING: The 'OS_CACERT' environment variable is set to %s "\
- "but the file does not exist." % ssl
+ "but the file does not exist." % cacert
return creds