Keep session transport options

currently there's no way to use observabilityclient against Keystone
endpoint (Aetos) that uses self-signed TLS cert,
as verify/insecure option set by clouds.yaml/openstackclient
is effectively overridden based solely on endpoint URL scheme.

Instead, presume that all transport options are already properly set,
and do not touch them at all when working with pre-created session.

Assisted-By: Cursor + Grok 4.5 High
Change-Id: I423f1f444c4d5ac4357db6e3c57c0e486c61c79d
Signed-off-by: Pavlo Shchelokovskyy <shchelokovskyy@gmail.com>

Author: pshchelo

observabilityclient/prometheus_client.py

@@ -53,15 +53,16 @@ def __init__(self, input):
 
 
 class PrometheusAPIClient:
-    def __init__(self, host, session=None, root_path=""):
+    def __init__(self, host, session=None, root_path="", scheme=None):
+        self._scheme = scheme
         self._host = host
         if not self._host.endswith('/'):
             self._host += '/'
         if session is None:
             self._session = requests.Session()
+            self._session.verify = False
         else:
             self._session = session
-        self._session.verify = False
         self._root_path = root_path
         if root_path != "" and not self._root_path.endswith('/'):
             self._root_path += '/'
@@ -76,7 +77,10 @@ def set_basic_auth(self, auth_user, auth_password):
         self._session.auth = (auth_user, auth_password)
 
     def _get_url(self, endpoint):
-        scheme = 'https' if self._session.verify else 'http'
+        if self._scheme is None:
+            scheme = 'https' if self._session.verify else 'http'
+        else:
+            scheme = self._scheme
         return f"{scheme}://{self._host}{self._root_path}api/v1/{endpoint}"
 
     def _get(self, endpoint, params=None):

observabilityclient/tests/unit/test_prometheus_client.py

@@ -83,6 +83,34 @@ def json(self):
 
 
 class PrometheusAPIClientTest(PrometheusAPIClientTestBase):
+    def test_init_scheme_default(self):
+        c = client.PrometheusAPIClient("localhost:9090")
+        self.assertIsNone(c._scheme)
+
+    def test_init_scheme_passed(self):
+        c = client.PrometheusAPIClient("localhost:9090", scheme="https")
+        self.assertEqual("https", c._scheme)
+
+    def test_get_url_without_scheme_uses_verify(self):
+        c = client.PrometheusAPIClient("localhost:9090")
+        c._session.verify = False
+        self.assertEqual("http://localhost:9090/api/v1/query",
+                         c._get_url("query"))
+        c._session.verify = True
+        self.assertEqual("https://localhost:9090/api/v1/query",
+                         c._get_url("query"))
+
+    def test_get_url_with_scheme_ignores_verify(self):
+        c = client.PrometheusAPIClient("localhost:9090", scheme="https")
+        c._session.verify = False
+        self.assertEqual("https://localhost:9090/api/v1/query",
+                         c._get_url("query"))
+
+        c = client.PrometheusAPIClient("localhost:9090", scheme="http")
+        c._session.verify = True
+        self.assertEqual("http://localhost:9090/api/v1/query",
+                         c._get_url("query"))
+
     def test_get(self):
         url = "test"
         root_path = "root_path"

observabilityclient/tests/unit/test_utils.py

@@ -115,7 +115,7 @@ def test_get_prometheus_client_from_keystone_http(self):
                                   "set_ca_cert") as ca_m:
             metric_utils.get_prometheus_client(keystone_session)
         init_m.assert_called_with(
-            "localhost:1234", keystone_session, "prometheus"
+            "localhost:1234", keystone_session, "prometheus", scheme="http"
         )
         ca_m.assert_not_called()
 
@@ -133,9 +133,11 @@ def test_get_prometheus_client_from_keystone_https(self):
                                   "set_ca_cert") as ca_m:
             metric_utils.get_prometheus_client(keystone_session)
         init_m.assert_called_with(
-            "localhost:1234", keystone_session, "prometheus"
+            "localhost:1234", keystone_session, "prometheus", scheme="https"
         )
-        ca_m.assert_called_with(True)
+        # Session transport options (verify/insecure) must be preserved;
+        # do not override them based on the endpoint URL scheme.
+        ca_m.assert_not_called()
 
     def test_get_prometheus_client_from_env_vars_ipv6(self):
         patched_env = {'PROMETHEUS_HOST': '2607:5300:201:2000::654',
@@ -178,7 +180,8 @@ def test_get_prometheus_client_from_keystone_ipv6(self):
                                   "set_ca_cert") as ca_m:
             metric_utils.get_prometheus_client(keystone_session)
         init_m.assert_called_with(
-            "[2607:5300:201:2000::654]:80", keystone_session, "prometheus"
+            "[2607:5300:201:2000::654]:80", keystone_session, "prometheus",
+            scheme="http"
         )
         ca_m.assert_not_called()
 

observabilityclient/utils/metric_utils.py

@@ -59,18 +59,14 @@ def get_prom_client_from_keystone(session, adapter_options=None):
 
     escaped_host = netutils.escape_ipv6(parsed_url.hostname)
     root_path = parsed_url.path.strip('/')
-    tls = parsed_url.scheme == "https"
 
     if parsed_url.port is not None:
         url = f'{escaped_host}:{parsed_url.port}'
     else:
         url = escaped_host
 
-    client = PrometheusAPIClient(url, session, root_path)
-
-    if tls:
-        client.set_ca_cert(True)
-    return client
+    return PrometheusAPIClient(
+        url, session, root_path, scheme=parsed_url.scheme)
 
 
 def get_prom_client_from_file_or_env():

releasenotes/notes/keep-session-transport-options-6ad0880b46c8b1e1.yaml

@@ -0,0 +1,8 @@
+---
+fixes:
+  - |
+    Preserve transport options (such as ``verify`` / ``insecure``) on a
+    pre-created Keystone session when talking to Aetos. Previously, TLS
+    verification was forced on solely from the endpoint URL scheme, which
+    prevented using observabilityclient against endpoints with self-signed
+    certificates configured via ``clouds.yaml`` / openstackclient.