functional tests: fix tests work over SSL OpenStack Cloud

Change-Id: I3a6e02e96ed807ce4305876fe3c5798449fedc24

base.py

@@ -231,12 +231,14 @@ class EC2TestCase(base.BaseTestCase):
     @safe_setup
     def setUpClass(cls):
         super(EC2TestCase, cls).setUpClass()
-        cls.client = botocoreclient._get_ec2_client(
+        cls.client = botocoreclient.get_ec2_client(
             CONF.aws.ec2_url, CONF.aws.aws_region,
-            CONF.aws.aws_access, CONF.aws.aws_secret)
-        cls.s3_client = botocoreclient._get_s3_client(
+            CONF.aws.aws_access, CONF.aws.aws_secret,
+            CONF.aws.ca_bundle)
+        cls.s3_client = botocoreclient.get_s3_client(
             CONF.aws.s3_url, CONF.aws.aws_region,
-            CONF.aws.aws_access, CONF.aws.aws_secret)
+            CONF.aws.aws_access, CONF.aws.aws_secret,
+            CONF.aws.ca_bundle)
         TesterStateHolder().ec2_client = cls.client
 
     @classmethod

botocoreclient.py

@@ -16,20 +16,26 @@
 import botocore.session
 
 
-def _get_client(client_name, url, region, access, secret):
+def _get_client(client_name, url, region, access, secret, ca_bundle):
     connection_data = {
         'config_file': (None, 'AWS_CONFIG_FILE', None, None),
         'region': ('region', 'BOTO_DEFAULT_REGION', region, None),
     }
     session = botocore.session.get_session(connection_data)
-    return session.create_client(
-        client_name, region_name=region, endpoint_url=url,
-        aws_access_key_id=access, aws_secret_access_key=secret)
+    kwargs = {
+        'region_name': region,
+        'endpoint_url': url,
+        'aws_access_key_id': access,
+        'aws_secret_access_key': secret
+    }
+    if ca_bundle:
+        kwargs['verify'] = ca_bundle
+    return session.create_client(client_name, **kwargs)
 
 
-def _get_ec2_client(url, region, access, secret):
-    return _get_client('ec2', url, region, access, secret)
+def get_ec2_client(url, region, access, secret, ca_bundle=None):
+    return _get_client('ec2', url, region, access, secret, ca_bundle)
 
 
-def _get_s3_client(url, region, access, secret):
-    return _get_client('s3', url, region, access, secret)
+def get_s3_client(url, region, access, secret, ca_bundle=None):
+    return _get_client('s3', url, region, access, secret, ca_bundle)

config.py

@@ -35,6 +35,10 @@ AWSGroup = [
     cfg.StrOpt('s3_url',
                default="http://localhost:3334/",
                help="S3 URL"),
+    cfg.StrOpt('ca_bundle',
+               default=None,
+               help="The CA certificate bundle to use when verifying "
+                    "SSL certificates."),
     cfg.StrOpt('aws_secret',
                default=None,
                help="AWS Secret Key",