openstack/kolla-ansible
Code Issues Proposed changes

Enable heat-api proxy header parsing

Browse Source 
heat-api kept redirecting clients to use http:// instead of https://
when communicating with our https:// only loadbalancer

Please examine the logic for enabling it carefully, it's hard to know
if it should be enabled or not, potenitially it could be a security
risk.

Based on openstack-ansible-os_heat:
commit 4033a0f854cba6719c61812ef5b553e932a6c6c2
Author: Kyle L. Henderson <kyleh@us.ibm.com>

    Enable oslo_middleware proxy header parsing

"Heat has moved to using oslo_middleware for the http proxy header
parsing, however the default is to not parse the headers.  When
the external protocol differs from the internal protocol this
parsing is required in order for heat to work properly since it
will return 302 redirects to the client during some operations
(such as delete stack).

An example of this is when using haproxy with https configured
for the external protocol and http for the internal protocol.
If the oslo_middleware does not parse the headers, then any
302 redirects would specify a url with http rather than
correctly specifying https and the heat client would fail to
connect on the redirect url."

Change-Id: I38661a0bc2163a7f72febd98b7ae6f51c5d45ad5
This commit is contained in:
pomac 2017-03-01 09:40:45 +01:00
parent 71aab9392c
commit 63e5c444dd
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
ansible/roles/heat/templates/heat.conf.j2
View File

@ -89,3 +89,8 @@ driver = noop
[clients]
endpoint_type = internalURL
{% if public_protocol != internal_protocol and kolla_external_fqdn != kolla_internal_fqdn %}
[oslo_middleware]
enable_proxy_headers_parsing = True
{% endif %}