Fix trailing comma bug in DockerWorker.generate_tls()

In generate_tls(), tls_cert and tls_key were assigned with trailing
commas, which caused them to become single-element tuples (None,)
instead of None. This made the if tls_cert: check always true,
leading to TypeError when check_file() received a tuple instead
of a string path.

Remove the trailing commas so tls_cert and tls_key are plain values.

Remove TestTLS.setUp(_get_host_timezone) for stable branches:
_get_host_timezone does not exist in kolla_container_worker.py
on older branches, causing AttributeError in TestTLS setUp.

Closes-Bug: #2166845
Change-Id: I06b8876838ee2ec3c20c9a98448fc9e5588f32cd
Signed-off-by: Tikhon Masalov <t.masalov@maxima-int.com>
(cherry picked from commit 2f8958235bc16a89a33c0711f1dfcb7bca87a1a9)

2 files changed, 62 insertions, 2 deletions

diff --git a/ansible/module_utils/kolla_docker_worker.py b/ansible/module_utils/kolla_docker_worker.py
index f488bab66..db41d5599 100644
--- a/ansible/module_utils/kolla_docker_worker.py
+++ b/ansible/module_utils/kolla_docker_worker.py
@@ -41,8 +41,8 @@ class DockerWorker(ContainerWorker):
 
     def generate_tls(self):
         tls = {'verify': self.params.get('tls_verify')}
-        tls_cert = self.params.get('tls_cert'),
-        tls_key = self.params.get('tls_key'),
+        tls_cert = self.params.get('tls_cert')
+        tls_key = self.params.get('tls_key')
         tls_cacert = self.params.get('tls_cacert')
 
         if tls['verify']:
diff --git a/tests/kolla_container_tests/test_docker_worker.py b/tests/kolla_container_tests/test_docker_worker.py
index e32da66cb..90f1a2d41 100644
--- a/tests/kolla_container_tests/test_docker_worker.py
+++ b/tests/kolla_container_tests/test_docker_worker.py
@@ -1161,6 +1161,66 @@ class TestVolume(base.BaseTestCase):
         )
 
 
+class TestTLS(base.BaseTestCase):
+
+    @mock.patch('docker.tls.TLSConfig')
+    def test_tls_disabled_by_default(self, mock_tls_config):
+        self.dw = get_DockerWorker({'name': 'test_container'})
+        self.dw.generate_tls()
+        mock_tls_config.assert_called_once_with(verify=None)
+
+    @mock.patch('docker.tls.TLSConfig')
+    def test_tls_verify_enabled_no_certs(self, mock_tls_config):
+        self.dw = get_DockerWorker({
+            'name': 'test_container',
+            'tls_verify': True})
+        self.dw.generate_tls()
+        mock_tls_config.assert_called_once_with(verify=True)
+
+    @mock.patch('os.path.isfile', return_value=True)
+    @mock.patch('os.access', return_value=True)
+    @mock.patch('docker.tls.TLSConfig')
+    def test_tls_verify_with_client_cert_and_key(self, mock_tls_config,
+                                                 mock_access, mock_isfile):
+        self.dw = get_DockerWorker({
+            'name': 'test_container',
+            'tls_verify': True,
+            'tls_cert': '/path/to/cert.pem',
+            'tls_key': '/path/to/key.pem'})
+        self.dw.generate_tls()
+        mock_tls_config.assert_called_once_with(
+            verify=True,
+            client_cert=('/path/to/cert.pem', '/path/to/key.pem'))
+
+    @mock.patch('os.path.isfile', return_value=True)
+    @mock.patch('os.access', return_value=True)
+    @mock.patch('docker.tls.TLSConfig')
+    def test_tls_verify_with_cacert(self, mock_tls_config,
+                                    mock_access, mock_isfile):
+        self.dw = get_DockerWorker({
+            'name': 'test_container',
+            'tls_verify': True,
+            'tls_cacert': '/path/to/ca.pem'})
+        self.dw.generate_tls()
+        mock_tls_config.assert_called_once_with(
+            verify='/path/to/ca.pem')
+
+    @mock.patch('os.path.isfile', return_value=False)
+    @mock.patch('os.access', return_value=True)
+    @mock.patch('docker.tls.TLSConfig')
+    def test_tls_verify_cert_file_missing_fails(self, mock_tls_config,
+                                                mock_access, mock_isfile):
+        self.dw = get_DockerWorker({
+            'name': 'test_container',
+            'tls_verify': True,
+            'tls_cert': '/missing/cert.pem',
+            'tls_key': '/missing/key.pem'})
+        self.dw.generate_tls()
+        self.dw.module.fail_json.assert_any_call(
+            failed=True,
+            msg='There is no file at "/missing/cert.pem"')
+
+
 class TestAttrComp(base.BaseTestCase):
 
     def setUp(self):