consul_session: ensure certificate is checked when HTTPS is used

[pilou-]

SUMMARY

consul_session: ensure that:

• cert is checked when HTTPS is used
• cert isn't checked when validate_certs is disabled

ISSUE TYPE

• Bugfix Pull Request

COMPONENT NAME

consul_session

ADDITIONAL INFORMATION

Depends on #58692. Currently fails with:

Could not retrieve session info 400 Client sent an HTTP request to an HTTPS server

[ansibot]

cc @sgargan
click here for bot help

[pilou-]

pull-request rebased since #58692 has been merged.

As expected, integration test failed:

TASK [consul : ensure SSL certificate isn't checked when validate_certs is disabled] ***
task path: /root/.ansible/test/tmp/consul-2os7by9u-ÅÑŚÌβŁÈ/test/integration/targets/consul/tasks/consul_session.yml:100
<testhost> ESTABLISH LOCAL CONNECTION FOR USER: root
<testhost> EXEC /bin/sh -c 'echo ~root && sleep 0'
<testhost> EXEC /bin/sh -c '( umask 77 && mkdir -p "` echo /root/.ansible/tmp/ansible-tmp-1563744820.3596995-8858196606187 `" && echo ansible-tmp-1563744820.3596995-8858196606187="` echo /root/.ansible/tmp/ansible-tmp-1563744820.3596995-8858196606187 `" ) && sleep 0'
Using module file /root/ansible/lib/ansible/modules/clustering/consul_session.py
<testhost> PUT /root/.ansible/tmp/ansible-local-150861doyicl6/tmpv7wj6ink TO /root/.ansible/tmp/ansible-tmp-1563744820.3596995-8858196606187/AnsiballZ_consul_session.py
<testhost> EXEC /bin/sh -c 'chmod u+x /root/.ansible/tmp/ansible-tmp-1563744820.3596995-8858196606187/ /root/.ansible/tmp/ansible-tmp-1563744820.3596995-8858196606187/AnsiballZ_consul_session.py && sleep 0'
<testhost> EXEC /bin/sh -c '/usr/bin/python3.6 /root/.ansible/tmp/ansible-tmp-1563744820.3596995-8858196606187/AnsiballZ_consul_session.py && sleep 0'
<testhost> EXEC /bin/sh -c 'rm -f -r /root/.ansible/tmp/ansible-tmp-1563744820.3596995-8858196606187/ > /dev/null 2>&1 && sleep 0'
The full traceback is:
  File "/tmp/ansible_consul_session_payload_bsftroy_/__main__.py", line 178, in lookup_sessions
    session_by_id = consul_client.session.info(session_id, dc=datacenter)
  File "/usr/local/lib/python3.6/site-packages/consul/base.py", line 1894, in info
    params=params)
  File "/usr/local/lib/python3.6/site-packages/consul/std.py", line 22, in get
    self.session.get(uri, verify=self.verify, cert=self.cert)))
  File "/usr/lib/python3.6/site-packages/requests/sessions.py", line 537, in get
    return self.request('GET', url, **kwargs)
  File "/usr/lib/python3.6/site-packages/requests/sessions.py", line 524, in request
    resp = self.send(prep, **send_kwargs)
  File "/usr/lib/python3.6/site-packages/requests/sessions.py", line 637, in send
    r = adapter.send(request, **kwargs)
  File "/usr/lib/python3.6/site-packages/requests/adapters.py", line 514, in send
    raise SSLError(e, request=request)

fatal: [testhost]: FAILED! => {
    "changed": false,
    "invocation": {
        "module_args": {
            "behavior": "release",
            "checks": null,
            "datacenter": null,
            "delay": 15,
            "host": "localhost",
            "id": "71998cee-d817-0edd-da7a-4dc1b2fa1042",
            "name": null,
            "node": null,
            "port": 8501,
            "scheme": "https",
            "state": "info",
            "validate_certs": false
        }
    },
    "msg": "Could not retrieve session info HTTPSConnectionPool(host='localhost', port=8501): Max retries exceeded with url: /v1/session/info/71998cee-d817-0edd-da7a-4dc1b2fa1042 (Caused by SSLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:877)'),))

bugfix will follow.

[felixfontein]

Looks good. Added some comments about the tests.

[felixfontein]

Ah, one thing that definitely has to be added: a changelog fragment.

[pilou-]

Changelog fragment added

[felixfontein]

@pilou- thanks for fixing this!