Chapter 1. Image Service
This chapter discusses the steps you can follow to manage images and storage in Red Hat OpenStack Platform.
A virtual machine image is a file that contains a virtual disk which has a bootable operating system installed on it. Virtual machine images are supported in different formats. The following are the formats available on Red Hat OpenStack Platform:
-
RAW
- Unstructured disk image format. -
QCOW2
- Disk format supported by QEMU emulator. -
ISO
- Sector-by-sector copy of the data on a disk, stored in a binary file. -
AKI
- Indicates an Amazon Kernel Image. -
AMI
- Indicates an Amazon Machine Image. -
ARI
- Indicates an Amazon RAMDisk Image. -
VDI
- Disk format supported by VirtualBox virtual machine monitor and the QEMU emulator. -
VHD
- Common disk format used by virtual machine monitors from VMware, VirtualBox, and others. -
VMDK
- Disk format supported by many common virtual machine monitors.
While ISO
is not normally considered a virtual machine image format, since ISOs contain bootable filesystems with an installed operating system, you can treat them the same as you treat other virtual machine image files.
To download the official Red Hat Enterprise Linux cloud images, your account must have a valid Red Hat Enterprise Linux subscription:
You will be prompted to enter your Red Hat account credentials if you are not logged in to the Customer Portal.
1.1. Understanding the Image Service
The following notable OpenStack Image service (glance) features are available.
1.1.1. Image conversion
Image conversion converts images by calling the task API while importing an image.
As part of the import workflow, a plugin provides the image conversion. This plugin can be activated or deactivated based on the deployer configuration. Therefore, the deployer needs to specify the preferred format of images for the deployment.
Internally, the Image service receives the bits of the image in a particular format. These bits are stored in a temporary location. The plugin is then triggered to convert the image to the target format, and moved to a final destination. When the task is finished, the temporary location is deleted. As a result, the format uploaded initially is not retained by the Image service.
The conversion can be triggered only when importing an image (the old copy-from). It does not run when uploading an image. For example:
$ glance task-create --type import --input '{"import_from_format": "qcow2", "import_from": "http://127.0.0.1:8000/test.qcow2", "image_properties": {"disk_format": "qcow2", "container_format": "bare"}}'
1.1.2. Image introspection
Every image format comes with a set of metadata embedded inside the image itself. For example, a stream optimized vmdk
would contain the following parameters:
$ head -20 so-disk.vmdk # Disk DescriptorFile version=1 CID=d5a0bce5 parentCID=ffffffff createType="streamOptimized" # Extent description RDONLY 209714 SPARSE "generated-stream.vmdk" # The Disk Data Base #DDB ddb.adapterType = "buslogic" ddb.geometry.cylinders = "102" ddb.geometry.heads = "64" ddb.geometry.sectors = "32" ddb.virtualHWVersion = "4"
By introspecting this vmdk, you can easily know that the disk_type is streamOptimized, and the adapter_type is buslogic. These metadata parameters are useful for the consumer of the image. In Compute, the workflow to instantiate a streamOptimized disk is different from the one to instantiate a flat disk. This feature allows metadata extraction. You can achieve image introspection by calling the task API while importing the image. An administrator can override metadata settings.
1.1.3. Harden the Image Service
The copy_from
feature in the Image Service API v1 allows an attacker to perform masked network port scans. It is possible to create images with a URL such as http://localhost:22. This could allow an attacker to enumerate internal network details, because the scan appears to originate from the Image Service. This is classified as a Server-Side Request Forgery (SSRF).
1.1.3.1. Diagnose Vulnerability
All copy_from
calls are logged by the Image Service. This makes it possible to link the abuser of this vulnerability to the cloud user exploiting it. For this flaw to be exploited, image creation must be enabled and non-admin users must be able to use the copy_from
function.
To diagnose this vulnerability, review the /etc/glance/policy.json
file. If the file has the following settings, your deployment is vulnerable:
"add_image": "", "copy_from": "",
1.1.3.2. Mitigate Vulnerability
To prevent attackers from exploiting this flaw, restrict the policy for the copy_from
function to the admin
role.
Add the following setting to the copy_from
line of the /etc/glance/policy.json
file:
"copy_from": "role:admin",
Limiting the copy_from function to admin users impacts Orchestration and dashboard usage. For example: Any Orchestration stacks for non-admin users that create images will break. Non-admin users will not be able to create images in the dashboard by providing an image-data URI.
1.1.3.2.1. Partial Mitigation
Optionally, instead of restricting the copy_from
function, you can partially mitigate the vulnerability by:
- Rate-limiting calls to the Image Service, which makes network probing extremely slow and may deter attacks.
- Limiting connections from the control-plane node that runs the glance-api server to the ports required for the services and ports 80 and 443 towards the external network. This action would significantly limit the scope of an attack without affecting the majority of users.
1.2. Managing images
The OpenStack Image service (glance) provides discovery, registration, and delivery services for disk and server images. It provides the ability to copy or snapshot a server image, and immediately store it away. Stored images can be used as a template to get new servers up and running quickly and more consistently, than installing a server operating system and individually configuring additional services.
1.2.1. Creating an image
This section provides you with the steps to manually create OpenStack-compatible images in the QCOW2 format using Red Hat Enterprise Linux 7 ISO files, Red Hat Enterprise Linux 6 ISO files, or Windows ISO files.
1.2.1.1. Using a KVM guest image with Red Hat OpenStack Platform
You can use a ready RHEL KVM guest QCOW2 image:
These images are configured with cloud-init
and must take advantage of ec2-compatible metadata services for provisioning SSH keys in order to function properly.
Ready Windows KVM guest QCOW2 images are not available.
For the KVM guest images:
-
The
root
account in the image is disabled, butsudo
access is granted to a special user namedcloud-user
. -
There is no
root
password set for this image.
The root
password is locked in /etc/shadow
by placing !!
in the second field.
For an OpenStack instance, it is recommended that you generate an ssh keypair from the OpenStack dashboard or command line and use that key combination to perform an SSH public authentication to the instance as root.
When the instance is launched, this public key will be injected to it. You can then authenticate using the private key downloaded while creating the keypair.
If you do not want to use keypairs, you can use the admin
password that has been set using the Inject an admin
Password Into an Instance procedure.
If you want to create custom Red Hat Enterprise Linux or Windows images, see Create a Red Hat Enterprise Linux 7 Image, Create a Red Hat Enterprise Linux 6 Image, or Create a Windows Image.
1.2.1.2. Creating custom Red Hat Enterprise Linux or Windows images
Prerequisites:
- Linux host machine to create an image. This can be any machine on which you can install and run the Linux packages.
-
libvirt, virt-manager (run command
yum groupinstall -y @virtualization
). This installs all packages necessary for creating a guest operating system. -
Libguestfs tools (run command
yum install -y libguestfs-tools-c
). This installs a set of tools for accessing and modifying virtual machine images. - A Red Hat Enterprise Linux 7 or 6 ISO file (see RHEL 7.2 Binary DVD or RHEL 6.8 Binary DVD) or a Windows ISO file. If you do not have a Windows ISO file, visit the Microsoft TechNet Evaluation Center and download an evaluation image.
-
Text editor, if you want to change the
kickstart
files (RHEL only).
In the following procedures, all commands with the [root@host]#
prompt should be run on your host machine.
1.2.1.2.1. Creating a Red Hat Enterprise Linux 7 image
This section provides you with the steps to manually create an OpenStack-compatible image in the QCOW2 format using a Red Hat Enterprise Linux 7 ISO file.
Start the installation using
virt-install
as shown below:[root@host]# qemu-img create -f qcow2 rhel7.qcow2 8G [root@host]# virt-install --virt-type kvm --name rhel7 --ram 2048 \ --cdrom /tmp/rhel-server-7.2-x86_64-dvd.iso \ --disk rhel7.qcow2,format=qcow2 \ --network=bridge:virbr0 --graphics vnc,listen=0.0.0.0 \ --noautoconsole --os-type=linux --os-variant=rhel7
This launches an instance and starts the installation process.
NoteIf the instance does not launch automatically, run the
virt-viewer
command to view the console:[root@host]# virt-viewer rhel7
Set up the virtual machine as follows:
-
At the initial Installer boot menu, choose the
Install Red Hat Enterprise Linux 7
.X option. - Choose the appropriate Language and Keyboard options.
- When prompted about which type of devices your installation uses, choose Auto-detected installation media.
- When prompted about which type of installation destination, choose Local Standard Disks. For other storage options, choose Automatically configure partitioning.
- For software selection, choose Minimal Install.
-
For network and host name, choose
eth0
for network and choose ahostname
for your device. The default host name islocalhost.localdomain
. -
Choose the
root
password. The installation process completes and the Complete! screen appears.
-
At the initial Installer boot menu, choose the
- After the installation is complete, reboot the instance and log in as the root user.
Update the
/etc/sysconfig/network-scripts/ifcfg-eth0
file so it only contains the following values:TYPE=Ethernet DEVICE=eth0 ONBOOT=yes BOOTPROTO=dhcp NM_CONTROLLED=no
- Reboot the machine.
- Register the machine with the Content Delivery Network. For details, see Subscribe to the Required Channels in Manual Installation Procedures.
Update the system:
# yum -y update
Install the
cloud-init
packages:# yum install -y cloud-utils-growpart cloud-init
Edit the
/etc/cloud/cloud.cfg
configuration file and undercloud_init_modules
add:- resolv-conf
The
resolv-conf
option automatically configures theresolv.conf
when an instance boots for the first time. This file contains information related to the instance such asnameservers
,domain
and other options.Add the following line to
/etc/sysconfig/network
to avoid problems accessing the EC2 metadata service:NOZEROCONF=yes
To ensure the console messages appear in the
Log
tab on the dashboard and thenova console-log
output, add the following boot option to the/etc/default/grub
file:GRUB_CMDLINE_LINUX_DEFAULT="console=tty0 console=ttyS0,115200n8"
Run the
grub2-mkconfig
command:# grub2-mkconfig -o /boot/grub2/grub.cfg
The output is as follows:
Generating grub configuration file ... Found linux image: /boot/vmlinuz-3.10.0-229.7.2.el7.x86_64 Found initrd image: /boot/initramfs-3.10.0-229.7.2.el7.x86_64.img Found linux image: /boot/vmlinuz-3.10.0-121.el7.x86_64 Found initrd image: /boot/initramfs-3.10.0-121.el7.x86_64.img Found linux image: /boot/vmlinuz-0-rescue-b82a3044fb384a3f9aeacf883474428b Found initrd image: /boot/initramfs-0-rescue-b82a3044fb384a3f9aeacf883474428b.img done
Un-register the virtual machine so that the resulting image does not contain the same subscription details for every instance cloned based on it:
# subscription-manager repos --disable=* # subscription-manager unregister # yum clean all
Power off the instance:
# poweroff
Reset and clean the image using the
virt-sysprep
command so it can be used to create instances without issues:[root@host]# virt-sysprep -d rhel7
Reduce image size using the
virt-sparsify
command. This command converts any free space within the disk image back to free space within the host:[root@host]# virt-sparsify --compress /tmp/rhel7.qcow2 rhel7-cloud.qcow2
This creates a new
rhel7-cloud.qcow2
file in the location from where the command is run.
The rhel7-cloud.qcow2
image file is ready to be uploaded to the Image service. For more information on uploading this image to your OpenStack deployment using the dashboard, see Upload an Image.
1.2.1.2.2. Creating a Red Hat Enterprise Linux 6 image
This section provides you with the steps to manually create an OpenStack-compatible image in the QCOW2 format using a Red Hat Enterprise Linux 6 ISO file.
Start the installation using
virt-install
:[root@host]# qemu-img create -f qcow2 rhel6.qcow2 4G [root@host]# virt-install --connect=qemu:///system --network=bridge:virbr0 \ --name=rhel6 --os-type linux --os-variant rhel6 \ --disk path=rhel6.qcow2,format=qcow2,size=10,cache=none \ --ram 4096 --vcpus=2 --check-cpu --accelerate \ --hvm --cdrom=rhel-server-6.8-x86_64-dvd.iso
This launches an instance and starts the installation process.
NoteIf the instance does not launch automatically, run the
virt-viewer
command to view the console:[root@host]# virt-viewer rhel6
Set up the virtual machines as follows:
At the initial Installer boot menu, choose the Install or upgrade an existing system option. Step through the installation prompts. Accept the defaults.
The installer checks for the disc and lets you decide whether you want to test your installation media before installation. Select OK to run the test or Skip to proceed without testing.
- Choose the appropriate Language and Keyboard options.
- When prompted about which type of devices your installation uses, choose Basic Storage Devices.
-
Choose a
hostname
for your device. The default host name islocalhost.localdomain
. -
Set timezone and
root
password. - Based on the space on the disk, choose the type of installation.
- Choose the Basic Server install, which installs an SSH server.
- The installation process completes and Congratulations, your Red Hat Enterprise Linux installation is complete screen appears.
-
Reboot the instance and log in as the
root
user. Update the
/etc/sysconfig/network-scripts/ifcfg-eth0
file so it only contains the following values:TYPE=Ethernet DEVICE=eth0 ONBOOT=yes BOOTPROTO=dhcp NM_CONTROLLED=no
- Reboot the machine.
- Register the machine with the Content Delivery Network. For details, see Subscribe to the Required Channels in the Manual Installation Procedures guide.
Update the system:
# yum -y update
Install the
cloud-init
packages:# yum install -y cloud-utils-growpart cloud-init
Edit the
/etc/cloud/cloud.cfg
configuration file and undercloud_init_modules
add:- resolv-conf
The
resolv-conf
option automatically configures theresolv.conf
configuration file when an instance boots for the first time. This file contains information related to the instance such asnameservers
,domain
, and other options.To prevent network issues, create the
/etc/udev/rules.d/75-persistent-net-generator.rules
file as follows:# echo "#" > /etc/udev/rules.d/75-persistent-net-generator.rules
This prevents
/etc/udev/rules.d/70-persistent-net.rules
file from being created. If/etc/udev/rules.d/70-persistent-net.rules
is created, networking may not function properly when booting from snapshots (the network interface is created as "eth1" rather than "eth0" and IP address is not assigned).Add the following line to
/etc/sysconfig/network
to avoid problems accessing the EC2 metadata service:NOZEROCONF=yes
To ensure the console messages appear in the
Log
tab on the dashboard and thenova console-log
output, add the following boot option to the/etc/grub.conf
:console=tty0 console=ttyS0,115200n8
Un-register the virtual machine so that the resulting image does not contain the same subscription details for every instance cloned based on it:
# subscription-manager repos --disable=* # subscription-manager unregister # yum clean all
Power off the instance:
# poweroff
Reset and clean the image using the
virt-sysprep
command so it can be used to create instances without issues:[root@host]# virt-sysprep -d rhel6
Reduce image size using the
virt-sparsify
command. This command converts any free space within the disk image back to free space within the host:[root@host]# virt-sparsify --compress rhel6.qcow2 rhel6-cloud.qcow2
This creates a new
rhel6-cloud.qcow2
file in the location from where the command is run.NoteYou will need to manually resize the partitions of instances based on the image in accordance with the disk space in the flavor that is applied to the instance.
The rhel6-cloud.qcow2
image file is ready to be uploaded to the Image service. For more information on uploading this image to your OpenStack deployment using the dashboard, see Upload an Image
1.2.1.2.3. Creating a Windows image
This section provides you with the steps to manually create an OpenStack-compatible image in the QCOW2 format using a Windows ISO file.
Start the installation using
virt-install
as shown below:[root@host]# virt-install --name=name \ --disk size=size \ --cdrom=path \ --os-type=windows \ --network=bridge:virbr0 \ --graphics spice \ --ram=RAM
Replace the values of the
virt-install
parameters as follows:- name — the name that the Windows guest should have.
- size — disk size in GB.
- path — the path to the Windows installation ISO file.
RAM — the requested amount of RAM in MB.
NoteThe
--os-type=windows
parameter ensures that the clock is set up correctly for the Windows guest, and enables its Hyper-V enlightenment features.Note that
virt-install
saves the guest image as/var/lib/libvirt/images/
name
.qcow2
by default. If you want to keep the guest image elsewhere, change the parameter of the--disk
option as follows:--disk path=filename,size=size
Replace filename with the name of the file which should store the guest image (and optionally its path); for example
path=win8.qcow2,size=8
creates an 8 GB file namedwin8.qcow2
in the current working directory.TipIf the guest does not launch automatically, run the
virt-viewer
command to view the console:[root@host]# virt-viewer name
- Installation of Windows systems is beyond the scope of this document. For instructions on how to install Windows, see the relevant Microsoft documentation.
-
To allow the newly installed Windows system to use the virtualized hardware, you may need to install virtio drivers in it. To so do, first install the
virtio-win
package on the host system. This package contains the virtio ISO image, which is to be attached as a CD-ROM drive to the Windows guest. See Chapter 8. KVM Para-virtualized (virtio) Drivers in the Virtualization Deployment and Administration Guide for detailed instructions on how to install thevirtio-win
package, add the virtio ISO image to the guest, and install the virtio drivers. To complete the setup, download and execute Cloudbase-Init on the Windows system. At the end of the installation of Cloudbase-Init, select the
Run Sysprep
andShutdown
check boxes. TheSysprep
tool makes the guest unique by generating an OS ID, which is used by certain Microsoft services.ImportantRed Hat does not provide technical support for Cloudbase-Init. If you encounter an issue, contact Cloudbase Solutions.
When the Windows system shuts down, the name.qcow2
image file is ready to be uploaded to the Image service. For more information on uploading this image to your OpenStack deployment using the dashboard or the command line, see Upload an Image.
1.2.1.3. Using libosinfo
Image Service (glance) can process libosinfo data for images, making it easier to configure the optimal virtual hardware for an instance. This can be done by adding the libosinfo-formatted operating system name to the glance image.
This example specifies that the image with ID
654dbfd5-5c01-411f-8599-a27bd344d79b
uses the libosinfo value ofrhel7.2
:$ openstack image set 654dbfd5-5c01-411f-8599-a27bd344d79b --property os_name=rhel7.2
As a result, Compute will supply virtual hardware optimized for
rhel7.2
whenever an instance is built using the654dbfd5-5c01-411f-8599-a27bd344d79b
image.NoteFor a complete list of
libosinfo
values, refer to the libosinfo project: https://gitlab.com/libosinfo/osinfo-db/tree/master/data/os
1.2.2. Uploading an image
- In the dashboard, select Project > Compute > Images.
- Click Create Image.
- Fill out the values, and click Create Image when finished.
Field | Notes |
---|---|
Name | Name for the image. The name must be unique within the project. |
Description | Brief description to identify the image. |
Image Source | Image source: Image Location or Image File. Based on your selection, the next field is displayed. |
Image Location or Image File |
|
Format | Image format (for example, qcow2). |
Architecture | Image architecture. For example, use i686 for a 32-bit architecture or x86_64 for a 64-bit architecture. |
Minimum Disk (GB) | Minimum disk size required to boot the image. If this field is not specified, the default value is 0 (no minimum). |
Minimum RAM (MB) | Minimum memory size required to boot the image. If this field is not specified, the default value is 0 (no minimum). |
Public | If selected, makes the image public to all users with access to the project. |
Protected | If selected, ensures only users with specific permissions can delete this image. |
When the image has been successfully uploaded, its status is changed to active
, which indicates that the image is available for use. Note that the Image service can handle even large images that take a long time to upload — longer than the lifetime of the Identity service token which was used when the upload was initiated. This is due to the fact that the Image service first creates a trust with the Identity service so that a new token can be obtained and used when the upload is complete and the status of the image is to be updated.
You can also use the glance image-create
command with the property
option to upload an image. More values are available on the command line. For a complete listing, see Image Configuration Parameters.
1.2.3. Updating an image
- In the dashboard, select Project > Compute > Images.
Click Edit Image from the dropdown list.
NoteThe Edit Image option is available only when you log in as an
admin
user. When you log in as ademo
user, you have the option to Launch an instance or Create Volume.- Update the fields and click Update Image when finished. You can update the following values - name, description, kernel ID, ramdisk ID, architecture, format, minimum disk, minimum RAM, public, protected.
- Click the drop-down menu and select Update Metadata option.
- Specify metadata by adding items from the left column to the right one. In the left column, there are metadata definitions from the Image Service Metadata Catalog. Select Other to add metadata with the key of your choice and click Save when finished.
You can also use the glance image-update
command with the property
option to update an image. More values are available on the command line; for a complete listing, see Image Configuration Parameters.
1.2.4. Deleting an image
- In the dashboard, select Project > Compute > Images.
- Select the image you want to delete and click Delete Images.
1.2.5. Converting an image to RAW format
Red Hat Ceph can store, but does not support using, QCOW2 images to host virtual machine (VM) disks.
When you upload a QCOW2 image and create a VM from it, the compute node downloads the image, converts the image to RAW, and uploads it back into Ceph, which can then use it. This process affects the time it takes to create VMs, especially during parallel VM creation.
For example, when you create multiple VMs simultaneously, uploading the converted image to the Ceph cluster may impact already running workloads. The upload process can starve those workloads of IOPS and impede storage responsiveness.
To boot VMs in Ceph more efficiently (ephemeral back end or boot from volume), the glance image format must be RAW.
Converting an image to RAW may yield an image that is larger in size than the original QCOW2 image file. Run the following command before the conversion to determine the final RAW image size:
qemu-img info <image>.qcow2
To convert an image from QCOW2 to RAW format, do the following:
qemu-img convert -p -f qcow2 -O raw <original qcow2 image>.qcow2 <new raw image>.raw
1.2.5.1. Configuring Image Service to accept RAW and ISO only
Optionally, to configure the Image Service to accept only RAW and ISO image formats, deploy using an additional environment file that contains the following:
parameter_defaults: ExtraConfig: glance::config::api_config: image_format/disk_formats: value: "raw,iso"