5.4. Configure the Image Service
- Configure the Identity service for Image service authentication (create database entries, set connection strings, and update configuration files).
- Configure the disk-image storage back end (this guide uses the Object Storage service).
- Configure the firewall for Image service access.
- Configure TLS/SSL.
- Populate the Image service database.
5.4.1. Configure the Image Service Database Connection
/etc/glance/glance-api.conf
and /etc/glance/glance-registry.conf
files. It must be updated to point to a valid database server before starting the service.
root
user.
Procedure 5.2. Configuring the Image Service SQL Database Connection
- Set the value of the
sql_connection
configuration key in theglance-api.conf
file:#
openstack-config --set /etc/glance/glance-api.conf \
DEFAULT sql_connection mysql://USER:PASS@IP/DB
Replace the following values:- Replace USER with the Image service database user name, usually
glance
. - Replace PASS with the password of the database user.
- Replace IP with the IP address or host name of the server hosting the database service.
- Replace DB with the name of the Image service database, usually
glance
.
- Set the value of the
sql_connection
configuration key in theglance-registry.conf
file:#
openstack-config --set /etc/glance/glance-registry.conf \
DEFAULT sql_connection mysql://USER:PASS@IP/DB
Replace USER, PASS, IP, and DB with the same values used in the previous step.
Important
5.4.2. Create the Image Service Identity Records
services
tenant. For more information, see:
keystonerc_admin
file and on which the keystone command-line utility is installed.
Procedure 5.3. Creating Identity Records for the Image Service
- Set up the shell to access Keystone as the admin user:
#
source ~/keystonerc_admin
- Create the
glance
user:[(keystone_admin)]#
keystone user-create --name glance --pass PASSWORD
+----------+----------------------------------+ | Property | Value | +----------+----------------------------------+ | email | | | enabled | True | | id | 8091eaf121b641bf84ce73c49269d2d1 | | name | glance | | username | glance | +----------+----------------------------------+Replace PASSWORD with a secure password that will be used by the Image Service when authenticating with the Identity service. - Link the
glance
user and theadmin
role together within the context of theservices
tenant:[(keystone_admin)]#
keystone user-role-add --user glance --role admin --tenant services
- Create the
glance
Image service entry:[(keystone_admin)]#
keystone service-create --name glance \
--type image \
--description "Glance Image Service"
+-------------+----------------------------------+ | Property | Value | +-------------+----------------------------------+ | description | Glance Image Service | | enabled | True | | id | 7461b83f96bd497d852fb1b85d7037be | | name | glance | | type | image | +-------------+----------------------------------+ - Create the
glance
endpoint entry:[(keystone_admin)]#
keystone endpoint-create \
--service glance \
--publicurl 'http://
IP
:9292' \--adminurl 'http://
IP
:9292' \--internalurl 'http://
IP
:9292' \--region 'RegionOne'
Replace IP with the IP address or host name of the server hosting the Image service.
5.4.3. Configure Image Service Authentication
root
user.
Procedure 5.4. Configuring the Image Service to Authenticate through the Identity Service
- Configure the
glance-api
service:#
openstack-config --set /etc/glance/glance-api.conf \
paste_deploy flavor keystone
#
openstack-config --set /etc/glance/glance-api.conf \
keystone_authtoken auth_host IP
#
openstack-config --set /etc/glance/glance-api.conf \
keystone_authtoken auth_port 35357
#
openstack-config --set /etc/glance/glance-api.conf \
keystone_authtoken auth_protocol http
#
openstack-config --set /etc/glance/glance-api.conf \
keystone_authtoken admin_tenant_name services
#
openstack-config --set /etc/glance/glance-api.conf \
keystone_authtoken admin_user glance
#
openstack-config --set /etc/glance/glance-api.conf \
keystone_authtoken admin_password PASSWORD
- Configure the
glance-registry
service:#
openstack-config --set /etc/glance/glance-registry.conf \
paste_deploy flavor keystone
#
openstack-config --set /etc/glance/glance-registry.conf \
keystone_authtoken auth_host IP
#
openstack-config --set /etc/glance/glance-registry.conf \
keystone_authtoken auth_port 35357
#
openstack-config --set /etc/glance/glance-registry.conf \
keystone_authtoken auth_protocol http
#
openstack-config --set /etc/glance/glance-registry.conf \
keystone_authtoken admin_tenant_name services
#
openstack-config --set /etc/glance/glance-registry.conf \
keystone_authtoken admin_user glance
#
openstack-config --set /etc/glance/glance-registry.conf \
keystone_authtoken admin_password PASSWORD
- Replace IP with the IP address or host name of the Identity server.
- Replace services with the name of the tenant that was created for the use of the Image service (previous examples set this to
services
). - Replace glance with the name of the service user that was created for the Image service (previous examples set this to
glance
). - Replace PASSWORD with the password associated with the service user.
5.4.4. Use the Object Storage Service for Image Storage
file
) for its storage back end; however, either of the following storage back ends can be used to store uploaded disk images:
file
- Local file system of the Image server (/var/lib/glance/images/
directory)swift
- OpenStack Object Storage service
Note
openstack-config
command; however, you can also manually update the /etc/glance/glance-api.conf
file. If manually updating the file, ensure that the default_store
parameter is set to the correct back end (for example, 'default_store=rbd
'), and update the parameters in that back end's section (for example, under 'RBD Store Options
').
Procedure 5.5. Configuring the Image Service to use the Object Storage Service
- Set the
default_store
configuration key toswift
:#
openstack-config --set /etc/glance/glance-api.conf \
DEFAULT default_store swift
- Set the
swift_store_auth_address
configuration key to the public endpoint for the Identity service:#
openstack-config --set /etc/glance/glance-api.conf \
DEFAULT swift_store_auth_address http://IP:5000/v2.0/
- Add the container for storing images in the Object Storage service:
#
openstack-config --set /etc/glance/glance-api.conf \
DEFAULT swift_store_create_container_on_put True
- Set the
swift_store_user
configuration key, in the format TENANT:USER, to contain the tenant and user to use for authentication:#
openstack-config --set /etc/glance/glance-api.conf \
DEFAULT swift_store_user services:swift
- If you followed the instructions in this guide to deploy Object Storage, replace these values with the
services
tenant and theswift
user respectively (as shown in the command example above). - If you did not follow the instructions in this guide to deploy Object Storage, replace these values with the appropriate Object Storage tenant and user for your environment.
- Set the
swift_store_key
configuration key to the password that was set for theswift
user when deploying the Object Storage service:#
openstack-config --set /etc/glance/glance-api.conf \
DEFAULT swift_store_key PASSWORD
5.4.5. Configure the Firewall to Allow Image Service Traffic
9292
. All steps in this procedure must be performed on the server hosting the Image service, while logged in as the root
user.
Procedure 5.6. Configuring the Firewall to Allow Image Service Traffic
- Open the
/etc/glance/glance-api.conf
file in a text editor, and remove any comment characters preceding the following parameters:bind_host = 0.0.0.0 bind_port = 9292
- Open the
/etc/sysconfig/iptables
file in a text editor. - Add an INPUT rule allowing TCP traffic on port
9292
. The new rule must appear before any INPUT rules that REJECT traffic:-A INPUT -p tcp -m multiport --dports 9292 -j ACCEPT
- Save the changes to the
/etc/sysconfig/iptables
file. - Restart the
iptables
service to ensure that the change takes effect:#
systemctl restart iptables.service
5.4.6. Configure RabbitMQ Message Broker Settings for the Image Service
root
user.
Procedure 5.7. Configuring the Image Service (glance) to Use the RabbitMQ Message Broker
- Set RabbitMQ as the notifier:
#
openstack-config --set /etc/glance/glance-api.conf \
DEFAULT notification_driver messaging
- Set the name of the RabbitMQ host:
#
openstack-config --set /etc/glance/glance-api.conf \
DEFAULT rabbit_host RABBITMQ_HOST
Replace RABBITMQ_HOST with the IP address or host name of the message broker. - Set the message broker port to
5672
:#
openstack-config --set /etc/glance/glance-api.conf \
DEFAULT rabbit_port 5672
- Set the RabbitMQ user name and password created for the Image service when RabbitMQ was configured:
#
openstack-config --set /etc/glance/glance-api.conf \
DEFAULT rabbit_userid glance
#
openstack-config --set /etc/glance/glance-api.conf \
DEFAULT rabbit_password GLANCE_PASS
Replaceglance
and GLANCE_PASS with the RabbitMQ user name and password created for the Image service. - When RabbitMQ was launched, the
glance
user was granted read and write permissions to all resources: specifically, through the virtual host/
. Configure the Image service to connect to this virtual host:#
openstack-config --set /etc/glance/glance-api.conf \
DEFAULT rabbit_virtual_host /
5.4.7. Configure the Image Service to Use SSL
glance-api.conf
file to configure SSL.
Configuration Option | Description |
---|---|
cert_file
|
The path to the certificate file to use when starting the API server securely.
|
key_file
|
The path to the private key file to use when starting the API server securely.
|
ca_file
|
The path to the CA certificate file to use to verify connecting clients.
|
5.4.8. Populate the Image Service Database
Procedure 5.8. Populating the Image Service Database
- Log in to the system hosting the Image service.
- Switch to the
glance
user:#
su glance -s /bin/sh
- Initialize and populate the database identified in
/etc/glance/glance-api.conf
and/etc/glance/glance-registry.conf
:$
glance-manage db_sync
5.4.9. Enable Image Loading Through the Local File System
Note
Procedure 5.9. Configuring Image and Compute Services to Send and Receive Images through the Local File System
- Create a JSON document that exposes the Image file system metadata required by
openstack-nova-compute
. - Configure the Image service to use the JSON document.
- Configure
openstack-nova-compute
to use the file system metadata provided by the Image service.
5.4.9.1. Configure the Image Service to Provide Images Through the Local File System
openstack-nova-compute
service.
Procedure 5.10. Configuring the Image Service to Expose Local File System Metadata to the Compute Service
- Determine the mount point of the file system used by the Image service:
#
df
Filesystem 1K-blocks Used Available Use% Mounted on /dev/sda3 51475068 10905752 37947876 23% / devtmpfs 2005504 0 2005504 0% /dev tmpfs 2013248 668 2012580 1% /dev/shmFor example, if the Image service uses the/dev/sda3
file system, its corresponding mount point is/
. - Create a unique ID for the mount point:
#
uuidgen
ad5517ae-533b-409f-b472-d82f91f41773Note the output of theuuidgen
, as this will be used in the next step. - Create a file with the
.json
extension. - Open the file in a text editor, and add the following information:
{ "id": "UID", "mountpoint": "MOUNTPT" }
Replace the following values:- Replace UID with the unique ID created in the previous step.
- Replace MOUNTPT with the mount point of the Image service's file system, as determined in the first step.
- Configure the Image service to use this JSON file:
#
openstack-config --set /etc/glance/glance-api.conf \
DEFAULT show_multiple_locations True
#
openstack-config --set /etc/glance/glance-api.conf \
DEFAULT filesystem_store_metadata_file JSON_PATH
Replace JSON_PATH with the full path to the JSON file. - Restart the Image service (if it is already running):
#
systemctl restart openstack-glance-registry.service
#
systemctl restart openstack-glance-api.service
5.4.9.2. Configure the Compute Service to Use Local File System Metadata
openstack-nova-compute
to load images from the local file system.
Procedure 5.11. Configuring the Compute Service to use File System Metadata Provided by the Image Service
- Configure
openstack-nova-compute
to enable the use of direct URLs that have thefile://
scheme:#
openstack-config --set /etc/nova/nova.conf \
DEFAULT allowed_direct_url_schemes file
- Create an entry for the Image service's file system:
#
openstack-config --set /etc/nova/nova.conf \
image_file_url filesystems FSENTRY
Replace FSENTRY with a name to assign to the Image service's file system. - Open the
.json
file used by the Image service to expose its local file-system metadata. The information in this file will be used in the next step. - Associate the entry for Image service's file system to the file system metadata exposed by the Image service:
#
openstack-config --set /etc/nova/nova.conf \
image_file_url:FSENTRY id UID
#
openstack-config --set /etc/nova/nova.conf \
image_file_url:FSENTRY mountpoint MOUNTPT
Replace the following values:- Replace UID with the unique ID used by the Image service. In the
.json
file used by the Image service, the UID is the"id"
value. - Replace MOUNTPT with the mount point used by the Image service's file system. In the
.json
file used by the Image service, the MOUNTPT is the"mountpoint"
value.