Table Of Contents

Previous topic

Authentication and Authorization

Next topic

Scheduler

This Page

Psst... hey. You're reading the latest content, but it might be out of sync with code. You can read Nova 2011.2 docs or all OpenStack docs too.

API Endpoint

Nova has a system for managing multiple APIs on different subdomains. Currently there is support for the OpenStack API, as well as the Amazon EC2 API.

Common Components

The nova.api Module

The nova.api.cloud Module

OpenStack API

The openstack Module

WSGI middleware for OpenStack API controllers.

class APIMapper(controller_scan=<function controller_scan at 0x3f530c8>, directory=None, always_scan=False, register=True, explicit=True)

Bases: routes.mapper.Mapper

APIMapper.routematch(url=None, environ=None)
class APIRouter(ext_mgr=None)

Bases: nova.wsgi.Router

Routes requests on the OpenStack API to the appropriate controller and method.

APIRouter.ExtensionManager = None
classmethod APIRouter.factory(global_config, **local_config)

Simple paste factory, nova.wsgi.Router doesn’t have one

class FaultWrapper(application)

Bases: nova.wsgi.Middleware

Calls down the middleware stack, making exceptions into faults.

class ProjectMapper(controller_scan=<function controller_scan at 0x3f530c8>, directory=None, always_scan=False, register=True, explicit=True)

Bases: nova.api.openstack.APIMapper

ProjectMapper.resource(member_name, collection_name, **kwargs)

The auth Module

class AuthMiddleware(application, db_driver=None)

Bases: nova.wsgi.Middleware

Authorize the openstack API request or return an HTTP Forbidden.

AuthMiddleware.authenticate(req)
AuthMiddleware.authorize_token(token_hash)

retrieves user information from the datastore given a token

If the token has expired, returns None If the token is not found, returns None Otherwise returns dict(id=(the authorized user’s id))

This method will also remove the token if the timestamp is older than 2 days ago.

AuthMiddleware.get_user_by_authentication(req)
AuthMiddleware.has_authentication(req)
class NoAuthMiddleware(application)

Bases: nova.wsgi.Middleware

Return a fake token if one isn’t specified.

The backup_schedules Module

The faults Module

The flavors Module

The images Module

The servers Module

The sharedipgroups Module

EC2 API

The nova.api.ec2 Module

Starting point for routing EC2 requests.

class Authenticate(application)

Bases: nova.wsgi.Middleware

Authenticate an EC2 request and add ‘nova.context’ to WSGI environ.

class Authorizer(application)

Bases: nova.wsgi.Middleware

Authorize an EC2 API request.

Return a 401 if ec2.controller and ec2.action in WSGI environ may not be executed in nova.context.

class EC2KeystoneAuth(application)

Bases: nova.wsgi.Middleware

Authenticate an EC2 request with keystone and convert to context.

class EC2Token(application)

Bases: nova.wsgi.Middleware

Deprecated, only here to make merging easier.

class Executor

Bases: nova.wsgi.Application

Execute an EC2 API request.

Executes ‘ec2.action’ upon ‘ec2.controller’, passing ‘nova.context’ and ‘ec2.action_args’ (all variables in WSGI environ.) Returns an XML response, or a 400 upon failure.

class FaultWrapper(application)

Bases: nova.wsgi.Middleware

Calls the middleware stack, captures any exceptions into faults.

class Lockout(application)

Bases: nova.wsgi.Middleware

Lockout for x minutes on y failed auths in a z minute period.

x = lockout_timeout flag y = lockout_window flag z = lockout_attempts flag

Uses memcached if lockout_memcached_servers flag is set, otherwise it uses a very simple in-process cache. Due to the simplicity of the implementation, the timeout window is started with the first failed request, so it will block if there are x failed logins within that period.

There is a possible race condition where simultaneous requests could sneak in before the lockout hits, but this is extremely rare and would only result in a couple of extra failed attempts.

class NoAuth(application)

Bases: nova.wsgi.Middleware

Add user:project as ‘nova.context’ to WSGI environ.

class RequestLogging(application)

Bases: nova.wsgi.Middleware

Access-Log akin logging for all EC2 API requests.

RequestLogging.log_request_completion(response, request, start)
class Requestify(app, controller)

Bases: nova.wsgi.Middleware

class Validator(application)

Bases: nova.wsgi.Middleware

Validator.validate_ec2_id(val)
ec2_error(req, request_id, code, message)

Helper to send an ec2_compatible error

The apirequest Module

APIRequest class

class APIRequest(controller, action, version, args)

Bases: object

APIRequest.invoke(context)

The cloud Module

Cloud Controller: Implementation of EC2 REST API calls, which are dispatched to other nodes via AMQP RPC. State is via distributed datastore.

class CloudController

Bases: object

CloudController provides the critical dispatch between inbound API calls through the endpoint and messages sent to the other nodes.

CloudController.allocate_address(context, **kwargs)
CloudController.associate_address(context, instance_id, public_ip, **kwargs)
CloudController.attach_volume(context, volume_id, instance_id, device, **kwargs)
CloudController.authorize_security_group_ingress(context, group_name=None, group_id=None, **kwargs)
CloudController.create_image(context, instance_id, **kwargs)
CloudController.create_key_pair(context, key_name, **kwargs)
CloudController.create_security_group(context, group_name, group_description)
CloudController.create_snapshot(context, volume_id, **kwargs)
CloudController.create_volume(context, **kwargs)
CloudController.delete_key_pair(context, key_name, **kwargs)
CloudController.delete_security_group(context, group_name=None, group_id=None, **kwargs)
CloudController.delete_snapshot(context, snapshot_id, **kwargs)
CloudController.delete_volume(context, volume_id, **kwargs)
CloudController.deregister_image(context, image_id, **kwargs)
CloudController.describe_addresses(context, **kwargs)
CloudController.describe_availability_zones(context, **kwargs)
CloudController.describe_image_attribute(context, image_id, attribute, **kwargs)
CloudController.describe_images(context, image_id=None, **kwargs)
CloudController.describe_instance_attribute(context, instance_id, attribute, **kwargs)
CloudController.describe_instances(context, **kwargs)
CloudController.describe_instances_v6(context, **kwargs)
CloudController.describe_key_pairs(context, key_name=None, **kwargs)
CloudController.describe_regions(context, region_name=None, **kwargs)
CloudController.describe_security_groups(context, group_name=None, group_id=None, **kwargs)
CloudController.describe_snapshots(context, snapshot_id=None, owner=None, restorable_by=None, **kwargs)
CloudController.describe_volumes(context, volume_id=None, **kwargs)
CloudController.detach_volume(context, volume_id, **kwargs)
CloudController.disassociate_address(context, public_ip, **kwargs)
CloudController.format_addresses(context)
CloudController.get_console_output(context, instance_id, **kwargs)
CloudController.import_key_pair(context, key_name, public_key_material, **kwargs)
CloudController.modify_image_attribute(context, image_id, attribute, operation_type, **kwargs)
CloudController.reboot_instances(context, instance_id, **kwargs)

instance_id is a list of instance ids

CloudController.register_image(context, image_location=None, **kwargs)
CloudController.release_address(context, public_ip, **kwargs)
CloudController.revoke_security_group_ingress(context, group_name=None, group_id=None, **kwargs)
CloudController.run_instances(context, **kwargs)
CloudController.start_instances(context, instance_id, **kwargs)

Start each instances in instance_id. Here instance_id is a list of instance ids

CloudController.stop_instances(context, instance_id, **kwargs)

Stop each instances in instance_id. Here instance_id is a list of instance ids

CloudController.terminate_instances(context, instance_id, **kwargs)

Terminate each instance in instance_id, which is a list of ec2 ids. instance_id is a kwarg so its name cannot be modified.

CloudController.update_image(context, image_id, **kwargs)
validate_ec2_id(val)

The images Module

The metadatarequesthandler Module

Tests

The api_unittest Module

The api_integration Module

The cloud_unittest Module

The api.fakes Module

The api.test_wsgi Module

Test WSGI basics and provide some helper functions for other WSGI tests.

class Test(methodName='runTest')

Bases: nova.test.TestCase

Test.test_debug()
Test.test_router()

The test_api Module

The test_auth Module

The test_faults Module

class FaultsXMLSerializationTestV11(methodName='runTest')

Bases: nova.test.TestCase

Tests covering nova.api.openstack.faults:Fault class.

FaultsXMLSerializationTestV11.test_400_fault()
FaultsXMLSerializationTestV11.test_404_fault()
FaultsXMLSerializationTestV11.test_413_fault()
class TestFaults(methodName='runTest')

Bases: nova.test.TestCase

Tests covering nova.api.openstack.faults:Fault class.

TestFaults.test_400_fault_json()

Test fault serialized to JSON via file-extension and/or header.

TestFaults.test_413_fault_json()

Test fault serialized to JSON via file-extension and/or header.

TestFaults.test_fault_has_status_int()

Ensure the status_int is set correctly on faults

TestFaults.test_raise()

Ensure the ability to raise Fault in WSGI-ified methods.

TestFaults.test_raise_403()

Ensure the ability to raise Fault in WSGI-ified methods.

TestFaults.test_xml_serializer()

Ensure that a v1.1 request responds with a v1.1 xmlns

The test_flavors Module

The test_images Module

The test_servers Module

The test_sharedipgroups Module