Add Verify SSL to the providers that were missing it - #78
Merged
Conversation
The tab argument was inverted: an explicit tab was replaced by ADVANCED, while None and False produced no tab at all. Now None and False fall back to ADVANCED and any explicit tab is honoured. Default stays True, so verification behaviour is unchanged.
The client already accepted verify_ssl and used secure_requests_session, but the provider never exposed it and passed a hardcoded False. The field defaults to False so already stored providers keep working exactly as before after an upgrade.
Connections had insecure=True hardcoded, so certificates were never checked and there was no way to change it. ovirtsdk4.Connection takes insecure/ca_file and not an SSLContext, so the option is threaded down to that flag. It defaults to False, keeping the current behaviour for already stored providers.
ServerProxy got no ssl context, so Python applied its verifying default and this provider has been checking certificates all along. Same code in 3.6 and 4.0, so migrating with the option off would relax deployments instead of preserving them. The field defaults to True and drives create_client_sslcontext, keeping the current behaviour and making it switchable.
Support already knows these screens, so the checkbox must not move: the helper goes back to the 4.0 behaviour and the tests pin it, so a later change of placement fails instead of surprising them. OpenNebula now defaults to False like every other provider, even though it used to verify, so all providers read the same.
dkmstr
approved these changes
Aug 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the Verify SSL option to the providers that had no way to control certificate verification, one commit per provider, each with its own test.
verify_ssl, but the provider never exposed it and passed a hardcodedFalseinsecure=TruehardcodedEvery new field defaults to
False, so an upgraded installation keeps behaving exactly as before. The Proxmox test covers that directly: it deserializes a provider stored before the field existed and asserts it still does not verify.ovirtsdk4.Connectiontakesinsecure/ca_fileand not anSSLContext, so there the option drives that flag instead ofcreate_client_sslcontext.The helper keeps its 4.0 behaviour on purpose, and
tests/core/util/test_fields.pypins it: support already knows where this checkbox lives, so moving it would change every provider screen they have been trained on.Tests: 568 passed, 90 skipped across services, core and auths. Ruff reports no new findings.