[Bug 1790598] Related fix merged to neutron (stable/rocky)

[OpenStack Infra]

Reviewed:  https://review.openstack.org/632072
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=9f003cf497fd4f4ffcdd5c633824531b465aa69c
Submitter: Zuul
Branch:    stable/rocky

commit 9f003cf497fd4f4ffcdd5c633824531b465aa69c
Author: Pawel Suder <pawel at suder.info>
Date:   Thu Jan 17 07:30:45 2019 +0100

    Use status_code instead of status in requests
    
    It fixes raising exception for response with not recognized
    status code.
    
    Co-Authored-By: Brian Haley <haleyb.dev at gmail.com>
    Change-Id: I174ff62cb6599e4c7bdc86cb2d0786f9f2499b00
    Related-Bug: 1790598
    (cherry picked from commit 1685982a97f1bc82698724eb9a47e92416dc0aac)

-- 
You received this bug notification because you are a member of Ubuntu
OpenStack, which is subscribed to neutron in Ubuntu.
https://bugs.launchpad.net/bugs/1790598

Title:
  metadata service calls to nova-api-metadata with IP based SAN's fails

Status in neutron:
  Fix Committed
Status in neutron package in Ubuntu:
  Fix Released
Status in neutron source package in Xenial:
  Triaged
Status in neutron source package in Bionic:
  Fix Released
Status in neutron source package in Cosmic:
  Fix Released

Bug description:
  [Impact]
  If the nova-api-metadata service is secured with a certificate that makes use of IP based SAN's, under Python 2 certificate validation will fail as the ssl module does not support use of IP addresses in cert SAN fields (and httplib2 which is used to make the request uses ssl directly).

  Master branch of neutron has switched (see [0]) to using requests to
  make these calls, supporting use of certs with IP address based SAN's
  (via urllib3 which does support IP address based SAN's under Python
  2).

  [0]
  https://github.com/openstack/neutron/commit/7e0dd2f18d4919964655cfce7a282d1c5c131fc4

  [Test Case]
  Deploy OpenStack, securing metadata service using certs with IPAddress based SAN's (openstack charms + vault can do this).
  Boot instance - instance will fail to get metadata due to neutron->nova cert verification failure.

  [Regression Potential]
  Patch switches communication between neutron and nova for metadata queries to use requests over httplib2; so its a fairly like-for-like switch - both are used across openstack for various purposes.

To manage notifications about this bug go to:
https://bugs.launchpad.net/neutron/+bug/1790598/+subscriptions