From 89e9c59d49e944c315ef43d3ddf227ebbf625968 Mon Sep 17 00:00:00 2001 From: Tikhon Masalov Date: Mon, 31 Aug 2026 16:51:09 +0400 Subject: Fix trailing comma bug in DockerWorker.generate_tls() In generate_tls(), tls_cert and tls_key were assigned with trailing commas, which caused them to become single-element tuples (None,) instead of None. This made the if tls_cert: check always true, leading to TypeError when check_file() received a tuple instead of a string path. Remove the trailing commas so tls_cert and tls_key are plain values. Remove TestTLS.setUp(_get_host_timezone) for stable branches: _get_host_timezone does not exist in kolla_container_worker.py on older branches, causing AttributeError in TestTLS setUp. Closes-Bug: #2166845 Change-Id: I06b8876838ee2ec3c20c9a98448fc9e5588f32cd Signed-off-by: Tikhon Masalov (cherry picked from commit 2f8958235bc16a89a33c0711f1dfcb7bca87a1a9) --- tests/kolla_container_tests/test_docker_worker.py | 60 +++++++++++++++++++++++ 1 file changed, 60 insertions(+) (limited to 'tests') diff --git a/tests/kolla_container_tests/test_docker_worker.py b/tests/kolla_container_tests/test_docker_worker.py index e32da66cb..90f1a2d41 100644 --- a/tests/kolla_container_tests/test_docker_worker.py +++ b/tests/kolla_container_tests/test_docker_worker.py @@ -1161,6 +1161,66 @@ class TestVolume(base.BaseTestCase): ) +class TestTLS(base.BaseTestCase): + + @mock.patch('docker.tls.TLSConfig') + def test_tls_disabled_by_default(self, mock_tls_config): + self.dw = get_DockerWorker({'name': 'test_container'}) + self.dw.generate_tls() + mock_tls_config.assert_called_once_with(verify=None) + + @mock.patch('docker.tls.TLSConfig') + def test_tls_verify_enabled_no_certs(self, mock_tls_config): + self.dw = get_DockerWorker({ + 'name': 'test_container', + 'tls_verify': True}) + self.dw.generate_tls() + mock_tls_config.assert_called_once_with(verify=True) + + @mock.patch('os.path.isfile', return_value=True) + @mock.patch('os.access', return_value=True) + @mock.patch('docker.tls.TLSConfig') + def test_tls_verify_with_client_cert_and_key(self, mock_tls_config, + mock_access, mock_isfile): + self.dw = get_DockerWorker({ + 'name': 'test_container', + 'tls_verify': True, + 'tls_cert': '/path/to/cert.pem', + 'tls_key': '/path/to/key.pem'}) + self.dw.generate_tls() + mock_tls_config.assert_called_once_with( + verify=True, + client_cert=('/path/to/cert.pem', '/path/to/key.pem')) + + @mock.patch('os.path.isfile', return_value=True) + @mock.patch('os.access', return_value=True) + @mock.patch('docker.tls.TLSConfig') + def test_tls_verify_with_cacert(self, mock_tls_config, + mock_access, mock_isfile): + self.dw = get_DockerWorker({ + 'name': 'test_container', + 'tls_verify': True, + 'tls_cacert': '/path/to/ca.pem'}) + self.dw.generate_tls() + mock_tls_config.assert_called_once_with( + verify='/path/to/ca.pem') + + @mock.patch('os.path.isfile', return_value=False) + @mock.patch('os.access', return_value=True) + @mock.patch('docker.tls.TLSConfig') + def test_tls_verify_cert_file_missing_fails(self, mock_tls_config, + mock_access, mock_isfile): + self.dw = get_DockerWorker({ + 'name': 'test_container', + 'tls_verify': True, + 'tls_cert': '/missing/cert.pem', + 'tls_key': '/missing/key.pem'}) + self.dw.generate_tls() + self.dw.module.fail_json.assert_any_call( + failed=True, + msg='There is no file at "/missing/cert.pem"') + + class TestAttrComp(base.BaseTestCase): def setUp(self): -- cgit v1.2.3