From a8c5d06a075aa53775b2e386a0d60648934d6420 Mon Sep 17 00:00:00 2001 From: Alex Welsh Date: Thu, 9 Jul 2026 11:43:26 +0100 Subject: Add openstack cacert to uwsgi env for Glance This change ensures REQUESTS_CA_BUNDLE and SSL_CERT_FILE environment variables are exported in uWSGI conf, fixing SSL validation errors in Glance. By default it doesn't inherit from the host, so these must be included explicitly, otherwise internal communication between glance api instances will always fail when internal TLS is enabled. Change-Id: Ifbe3547ba6b933bb1e4d5599be94ba428c4f49c5 Closes-Bug: #2160218 Signed-off-by: Alex Welsh (cherry picked from commit 9c41bdca79d4c7267beeece141909e679f70dea8) --- ansible/roles/glance/tasks/config.yml | 4 ++++ releasenotes/notes/bug-2160218-b10b519917e28110.yaml | 8 ++++++++ 2 files changed, 12 insertions(+) create mode 100644 releasenotes/notes/bug-2160218-b10b519917e28110.yaml diff --git a/ansible/roles/glance/tasks/config.yml b/ansible/roles/glance/tasks/config.yml index 2362c046c..c7e91de5b 100644 --- a/ansible/roles/glance/tasks/config.yml +++ b/ansible/roles/glance/tasks/config.yml @@ -50,10 +50,14 @@ ansible.builtin.include_role: name: service-uwsgi-config vars: + _glance_uwsgi_cacert_env: + REQUESTS_CA_BUNDLE: "{{ openstack_cacert }}" + SSL_CERT_FILE: "{{ openstack_cacert }}" project_services: "{{ glance_services }}" service: "{{ glance_services['glance-api'] }}" service_name: "glance-api" service_uwsgi_config_chunked_input_limit: "{{ '64M' | human_to_bytes }}" + service_uwsgi_config_env: "{{ _glance_uwsgi_cacert_env if kolla_enable_tls_internal else {} }}" service_uwsgi_config_http_port: "{{ glance_api_listen_port }}" service_uwsgi_config_log_file_chmod: "644" service_uwsgi_config_module: "{{ service.wsgi }}" diff --git a/releasenotes/notes/bug-2160218-b10b519917e28110.yaml b/releasenotes/notes/bug-2160218-b10b519917e28110.yaml new file mode 100644 index 000000000..0456c1d37 --- /dev/null +++ b/releasenotes/notes/bug-2160218-b10b519917e28110.yaml @@ -0,0 +1,8 @@ +--- +fixes: + - | + This resolves an issue in Glance multinode deployments with internal TLS + enabled. Some concurrent image operations, such as deleting an image while + it is actively uploading or staging, could fail with an HTTP 500 Internal + Server Error. + `LP#2160218 `__ -- cgit v1.2.3