Enable admin access to EC2 API server

Add a flag which allows you to enable or disable EC2 admin api through
nova flag. Is is similar to allow_admin_api for OS API.
Fixes bug 869908.

Change-Id: I0c786f7cd5f5c3470edc23f0b9b84e5dff1714e2

nova/api/ec2/__init__.py

@@ -391,6 +391,10 @@ def __call__(self, req):
             LOG.info(_('NotAuthorized raised: %s'), unicode(ex),
                     context=context)
             return self._error(req, context, type(ex).__name__, unicode(ex))
+        except exception.InvalidRequest as ex:
+            LOG.debug(_('InvalidRequest raised: %s'), unicode(ex),
+                     context=context)
+            return self._error(req, context, type(ex).__name__, unicode(ex))
         except Exception as ex:
             extra = {'environment': req.environ}
             LOG.exception(_('Unexpected error raised: %s'), unicode(ex),

nova/api/ec2/apirequest.py

@@ -24,10 +24,14 @@
 # TODO(termie): replace minidom with etree
 from xml.dom import minidom
 
+from nova import flags
 from nova import log as logging
+from nova import exception
 from nova.api.ec2 import ec2utils
+from nova.api.ec2.admin import AdminController
 
 LOG = logging.getLogger("nova.api.request")
+FLAGS = flags.FLAGS
 
 
 def _underscore_to_camelcase(str):
@@ -53,6 +57,14 @@ def __init__(self, controller, action, version, args):
 
     def invoke(self, context):
         try:
+            # Raise NotImplemented exception for Admin specific request if
+            # admin flag is set to false in nova.conf
+            if (isinstance(self.controller, AdminController) and
+                          (not FLAGS.allow_ec2_admin_api)):
+                ## Raise InvalidRequest exception for EC2 Admin interface ##
+                LOG.exception("Unsupported API request")
+                raise exception.InvalidRequest()
+
             method = getattr(self.controller,
                              ec2utils.camelcase_to_underscore(self.action))
         except AttributeError:
@@ -63,7 +75,7 @@ def invoke(self, context):
             LOG.exception(_error)
             # TODO: Raise custom exception, trap in apiserver,
             #       and reraise as 400 error.
-            raise Exception(_error)
+            raise exception.InvalidRequest()
 
         args = ec2utils.dict_from_dotted_str(self.args.items())
 

nova/exception.py

@@ -206,6 +206,10 @@ class Invalid(NovaException):
     message = _("Unacceptable parameters.")
 
 
+class InvalidRequest(Invalid):
+    message = _("The request is invalid.")
+
+
 class InvalidSignature(Invalid):
     message = _("Invalid signature %(signature)s for user %(user)s.")
 

nova/flags.py

@@ -442,3 +442,5 @@ def _get_my_ip():
 DEFINE_integer('zombie_instance_updated_at_window', 172800,
                'Limit in seconds that a zombie instance can exist before '
                'being cleaned up.')
+
+DEFINE_boolean('allow_ec2_admin_api', False, 'Enable/Disable EC2 Admin API')