Chapter 1. The Image service (glance)

Procedure

1. Add a new interval with the ExtraConfig parameter in an environment file on the undercloud according to your requirements:

   parameter_defaults:
     ControllerExtraConfig:
       glance::config::glance_api_config:
         DEFAULT/cache_prefetcher_interval:
           value: '<300>'

   Replace <300> with the number of seconds that you want as an interval to pre-cache images.

2. After you adjust the interval in the environment file in /home/stack/templates/, log in as the stack user and deploy the configuration:

   $ openstack overcloud deploy --templates \
   -e /home/stack/templates/<env_file>.yaml

   Replace <env_file> with the name of the environment file that contains the ExtraConfig settings that you added.

   Important

   If you passed any extra environment files when you created the overcloud, pass them again here by using the -e option to avoid making undesired changes to the overcloud.

Procedure

1. Log in to the undercloud as the stack user and identify the provisioning IP address of controller-0:

   (undercloud) [stack@site-undercloud-0 ~]$ openstack server list -f value -c Name -c Networks | grep controller
   overcloud-controller-1 ctlplane=192.168.24.40
   overcloud-controller-2 ctlplane=192.168.24.13
   overcloud-controller-0 ctlplane=192.168.24.71
   (undercloud) [stack@site-undercloud-0 ~]$

2. To authenticate to the overcloud, copy the credentials that are stored in /home/stack/overcloudrc, by default, to controller-0:

   $ scp ~/overcloudrc heat-admin@192.168.24.71:/home/heat-admin/

3. Connect to controller-0:

   $ ssh heat-admin@192.168.24.71

4. On controller-0 as the heat-admin user, identify the IP address of the glance_api service. In the following example, the IP address is 172.25.1.105:

   (overcloud) [root@controller-0 ~]# grep -A 10 '^listen glance_api' /var/lib/config-data/puppet-generated/haproxy/etc/haproxy/haproxy.cfg
   listen glance_api
    server central-controller0-0.internalapi.redhat.local 172.25.1.105:9292 check fall 5 inter 2000 rise 2

5. Because the glance-cache-manage command is only available in the glance_api container, create a script to exec into that container where the environment variables to authenticate to the overcloud are already set. Create a script called glance_pod.sh in /home/heat-admin on controller-0 with the following contents:

   sudo podman exec -ti \
    -e NOVA_VERSION=$NOVA_VERSION \
    -e COMPUTE_API_VERSION=$COMPUTE_API_VERSION \
    -e OS_USERNAME=$OS_USERNAME \
    -e OS_PROJECT_NAME=$OS_PROJECT_NAME \
    -e OS_USER_DOMAIN_NAME=$OS_USER_DOMAIN_NAME \
    -e OS_PROJECT_DOMAIN_NAME=$OS_PROJECT_DOMAIN_NAME \
    -e OS_NO_CACHE=$OS_NO_CACHE \
    -e OS_CLOUDNAME=$OS_CLOUDNAME \
    -e no_proxy=$no_proxy \
    -e OS_AUTH_TYPE=$OS_AUTH_TYPE \
    -e OS_PASSWORD=$OS_PASSWORD \
    -e OS_AUTH_URL=$OS_AUTH_URL \
    -e OS_IDENTITY_API_VERSION=$OS_IDENTITY_API_VERSION \
    -e OS_COMPUTE_API_VERSION=$OS_COMPUTE_API_VERSION \
    -e OS_IMAGE_API_VERSION=$OS_IMAGE_API_VERSION \
    -e OS_VOLUME_API_VERSION=$OS_VOLUME_API_VERSION \
    -e OS_REGION_NAME=$OS_REGION_NAME \
   glance_api /bin/bash

6. Source the overcloudrc file and run the glance_pod.sh script to exec into the glance_api container with the necessary environment variables to authenticate to the overcloud Controller node.

   [heat-admin@controller-0 ~]$ source overcloudrc
   (overcloudrc) [heat-admin@central-controller-0 ~]$ bash glance_pod.sh
   ()[glance@controller-0 /]$

7. Use a command such as glance image-list to verify that the container can run authenticated commands against the overcloud.

   ()[glance@controller-0 /]$ glance image-list
   +--------------------------------------+----------------------------------+
   | ID                                   | Name                             |
   +--------------------------------------+----------------------------------+
   | ad2f8daf-56f3-4e10-b5dc-d28d3a81f659 | cirros-0.4.0-x86_64-disk.img       |
   +--------------------------------------+----------------------------------+
   ()[glance@controller-0 /]$

Procedure

1. As the admin user, queue an image to cache:

   $ glance-cache-manage --host=<host_ip> queue-image <image_id>

   • Replace <host_ip> with the IP address of the Controller node where the glance-api container is running.

   • Replace <image_id> with the ID of the image that you want to queue.

     When you have queued the images that you want to pre-cache, the cache_images periodic job prefetches all queued images concurrently.

     Note

     Because the image cache is local to each node, if your Red Hat OpenStack Platform is deployed with HA (with 3, 5, or 7 Controllers) then you must specify the host address with the --host option when you run the glance-cache-manage command.

2. Run the following command to view the images in the image cache:

   $ glance-cache-manage --host=<host_ip> list-cached

   Replace <host_ip> with the IP address of the host in your environment.

Procedure

1. As a cloud administrator, create a separate heat template environment file, such as lock-down-glance-metadef-api.yaml, to contain policy overrides for the Image service metadef API:

   ...
   parameter_defaults:
     GlanceApiPolicies: {
   	glance-metadef_default: { key: 'metadef_default', value: '' },
   	glance-metadef_admin: { key: 'metadef_admin', value: 'role:admin' },
   	glance-get_metadef_namespace: { key: 'get_metadef_namespace', value: 'rule:metadef_default' },
   	glance-get_metadef_namespaces: { key: 'get_metadef_namespaces', value: 'rule:metadef_default' },
   	glance-modify_metadef_namespace: { key: 'modify_metadef_namespace', value: 'rule:metadef_admin' },
   	glance-add_metadef_namespace: { key: 'add_metadef_namespace', value: 'rule:metadef_admin' },
   	glance-delete_metadef_namespace: { key: 'delete_metadef_namespace', value: 'rule:metadef_admin' },
   	glance-get_metadef_object: { key: 'get_metadef_object', value: 'rule:metadef_default' },
   	glance-get_metadef_objects: { key: 'get_metadef_objects', value: 'rule:metadef_default' },
   	glance-modify_metadef_object: { key: 'modify_metadef_object', value: 'rule:metadef_admin' },
   	glance-add_metadef_object: { key: 'add_metadef_object', value: 'rule:metadef_admin' },
   	glance-delete_metadef_object: { key: 'delete_metadef_object', value: 'rule:metadef_admin' },
   	glance-list_metadef_resource_types: { key: 'list_metadef_resource_types', value: 'rule:metadef_default' },
   	glance-get_metadef_resource_type: { key: 'get_metadef_resource_type', value: 'rule:metadef_default' },
   	glance-add_metadef_resource_type_association: { key: 'add_metadef_resource_type_association', value: 'rule:metadef_admin' },
   	glance-remove_metadef_resource_type_association: { key: 'remove_metadef_resource_type_association', value: 'rule:metadef_admin' },
   	glance-get_metadef_property: { key: 'get_metadef_property', value: 'rule:metadef_default' },
   	glance-get_metadef_properties: { key: 'get_metadef_properties', value: 'rule:metadef_default' },
   	glance-modify_metadef_property: { key: 'modify_metadef_property', value: 'rule:metadef_admin' },
   	glance-add_metadef_property: { key: 'add_metadef_property', value: 'rule:metadef_admin' },
   	glance-remove_metadef_property: { key: 'remove_metadef_property', value: 'rule:metadef_admin' },
   	glance-get_metadef_tag: { key: 'get_metadef_tag', value: 'rule:metadef_default' },
   	glance-get_metadef_tags: { key: 'get_metadef_tags', value: 'rule:metadef_default' },
   	glance-modify_metadef_tag: { key: 'modify_metadef_tag', value: 'rule:metadef_admin' },
   	glance-add_metadef_tag: { key: 'add_metadef_tag', value: 'rule:metadef_admin' },
   	glance-add_metadef_tags: { key: 'add_metadef_tags', value: 'rule:metadef_admin' },
   	glance-delete_metadef_tag: { key: 'delete_metadef_tag', value: 'rule:metadef_admin' },
   	glance-delete_metadef_tags: { key: 'delete_metadef_tags', value: 'rule:metadef_admin' }
     }
   
   …

   For information about policies and policy syntax, see this Policies chapter.

2. Include the environment file that contains the policy overrides in the deployment command with the -e option when you deploy the overcloud:

   $ openstack overcloud deploy -e lock-down-glance-metadef-api.yaml

Procedure

1. As a cloud administrator, log in to the undercloud and create a file for policy overrides. For example:

   $ cat open-up-glance-api-metadef.yaml

2. Configure the policy override file to allow metadef API read-write access to all users:

   GlanceApiPolicies: {
       glance-metadef_default: { key: 'metadef_default', value: '' },
       glance-get_metadef_namespace: { key: 'get_metadef_namespace', value: 'rule:metadef_default' },
       glance-get_metadef_namespaces: { key: 'get_metadef_namespaces', value: 'rule:metadef_default' },
       glance-modify_metadef_namespace: { key: 'modify_metadef_namespace', value: 'rule:metadef_default' },
       glance-add_metadef_namespace: { key: 'add_metadef_namespace', value: 'rule:metadef_default' },
       glance-delete_metadef_namespace: { key: 'delete_metadef_namespace', value: 'rule:metadef_default' },
       glance-get_metadef_object: { key: 'get_metadef_object', value: 'rule:metadef_default' },
       glance-get_metadef_objects: { key: 'get_metadef_objects', value: 'rule:metadef_default' },
       glance-modify_metadef_object: { key: 'modify_metadef_object', value: 'rule:metadef_default' },
       glance-add_metadef_object: { key: 'add_metadef_object', value: 'rule:metadef_default' },
       glance-delete_metadef_object: { key: 'delete_metadef_object', value: 'rule:metadef_default' },
       glance-list_metadef_resource_types: { key: 'list_metadef_resource_types', value: 'rule:metadef_default' },
       glance-get_metadef_resource_type: { key: 'get_metadef_resource_type', value: 'rule:metadef_default' },
       glance-add_metadef_resource_type_association: { key: 'add_metadef_resource_type_association', value: 'rule:metadef_default' },
       glance-remove_metadef_resource_type_association: { key: 'remove_metadef_resource_type_association', value: 'rule:metadef_default' },
       glance-get_metadef_property: { key: 'get_metadef_property', value: 'rule:metadef_default' },
       glance-get_metadef_properties: { key: 'get_metadef_properties', value: 'rule:metadef_default' },
       glance-modify_metadef_property: { key: 'modify_metadef_property', value: 'rule:metadef_default' },
       glance-add_metadef_property: { key: 'add_metadef_property', value: 'rule:metadef_default' },
       glance-remove_metadef_property: { key: 'remove_metadef_property', value: 'rule:metadef_default' },
       glance-get_metadef_tag: { key: 'get_metadef_tag', value: 'rule:metadef_default' },
       glance-get_metadef_tags: { key: 'get_metadef_tags', value: 'rule:metadef_default' },
       glance-modify_metadef_tag: { key: 'modify_metadef_tag', value: 'rule:metadef_default' },
       glance-add_metadef_tag: { key: 'add_metadef_tag', value: 'rule:metadef_default' },
       glance-add_metadef_tags: { key: 'add_metadef_tags', value: 'rule:metadef_default' },
       glance-delete_metadef_tag: { key: 'delete_metadef_tag', value: 'rule:metadef_default' },
       glance-delete_metadef_tags: { key: 'delete_metadef_tags', value: 'rule:metadef_default' }
     }

   Note

   You must configure all metadef policies to use rule:metadef_default. For information about policies and policy syntax, see this Policies chapter.

3. Include the new policy file in the deployment command with the -e option when you deploy the overcloud:

   $ openstack overcloud deploy -e open-up-glance-api-metadef.yaml

1. Create an image and specify the URI of the image to import:

   $ glance image-create-via-import \
       --container-format <CONTAINER FORMAT> \
       --disk-format <DISK-FORMAT> \
       --name <NAME> \
       --import-method web-download \
       --uri <URI>

   • Replace <CONTAINER FORMAT> with the container format that you are setting set for your image (None, ami, ari, aki, bare, ovf, ova, docker).
   • Replace <DISK-FORMAT> with the disk format that you are setting set for your image (None, ami, ari, aki, vhd, vhdx, vmdk, raw, qcow2, vdi, iso, ploop).
   • Replace <NAME> with a descriptive name for your image.
   • Replace <URI> with the URI of your image.

2. You can check the availability of the image by using the glance image-show <IMAGE_ID> command.

   • Replace <IMAGE_ID> with the ID you provided during image creation.

1. The web download method creates an image record.
2. The web download method retrieves the image from the specified URI.

Procedure

1. Log in to the undercloud host as the stack user.

2. Source the undercloud credentials file:

   $ source ~/stackrc

3. Include the GlanceDiskFormats parameter in an environment file, for example, glance_disk_formats.yaml:

   parameter_defaults:
     GlanceDiskFormats:
       - <disk_format>

   • For example, use the following configuration to enable only RAW and ISO disk formats:

     parameter_defaults:
       GlanceDiskFormats:
       - raw
       - iso

   • Use the following example configuration to reject QCOW2 disk images:

     parameter_defaults:
       GlanceDiskFormats:
       - raw
       - iso
       - aki
       - ari
       - ami

4. Include the environment file that contains your new configuration in the openstack overcloud deploy command with any other environment files that are relevant to your environment:

   $ openstack overcloud deploy --templates \
     -e <overcloud_environment_files> \
     -e <new_environment_file> \
     …

   • Replace <overcloud_environment_files> with the list of environment files that are part of your deployment.
   • Replace <new_environment_file> with the environment file that contains your new configuration.