This bug was fixed in the package neutron - 2:12.0.5-0ubuntu1 --------------- neutron (2:12.0.5-0ubuntu1) bionic; urgency=medium
* New stable point release for OpenStack Queens (LP: #1795424). * d/p/metadata-use-requests-for-comms-with-nova-api.patch: Cherry-picked from https://review.openstack.org/#/c/599541/ to enable cert management where IP addresses are used in subject alternate names (LP: #1790598). -- Corey Bryant <corey.bry...@canonical.com> Tue, 06 Nov 2018 11:43:51 -0500 ** Changed in: neutron (Ubuntu Bionic) Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of नेपाली भाषा समायोजकहरुको समूह, which is subscribed to Xenial. Matching subscriptions: Ubuntu 16.04 Bugs https://bugs.launchpad.net/bugs/1790598 Title: metadata service calls to nova-api-metadata with IP based SAN's fails Status in neutron: Fix Committed Status in neutron package in Ubuntu: Fix Released Status in neutron source package in Xenial: Triaged Status in neutron source package in Bionic: Fix Released Status in neutron source package in Cosmic: Fix Released Bug description: [Impact] If the nova-api-metadata service is secured with a certificate that makes use of IP based SAN's, under Python 2 certificate validation will fail as the ssl module does not support use of IP addresses in cert SAN fields (and httplib2 which is used to make the request uses ssl directly). Master branch of neutron has switched (see [0]) to using requests to make these calls, supporting use of certs with IP address based SAN's (via urllib3 which does support IP address based SAN's under Python 2). [0] https://github.com/openstack/neutron/commit/7e0dd2f18d4919964655cfce7a282d1c5c131fc4 [Test Case] Deploy OpenStack, securing metadata service using certs with IPAddress based SAN's (openstack charms + vault can do this). Boot instance - instance will fail to get metadata due to neutron->nova cert verification failure. [Regression Potential] Patch switches communication between neutron and nova for metadata queries to use requests over httplib2; so its a fairly like-for-like switch - both are used across openstack for various purposes. To manage notifications about this bug go to: https://bugs.launchpad.net/neutron/+bug/1790598/+subscriptions _______________________________________________ Mailing list: https://launchpad.net/~group.of.nepali.translators Post to : group.of.nepali.translators@lists.launchpad.net Unsubscribe : https://launchpad.net/~group.of.nepali.translators More help : https://help.launchpad.net/ListHelp