Chapter 6. Configuring the Image service (glance)

Procedure

1. Open your OpenStackControlPlane CR file, openstack_control_plane.yaml, and add the following parameters to the glance template to configure the Block Storage service as the back end for the Image service:

   apiVersion: core.openstack.org/v1beta1
   kind: OpenStackControlPlane
   spec:
     ...
     glance:
       template:
         glanceAPIs:
           default:
             replicas: 3 # Configure back end; set to 3 when deploying service
         ...
         customServiceConfig: |
           [DEFAULT]
           enabled_backends = <backend_name>:cinder
           [glance_store]
           default_backend = <backend_name>
           [<backend_name>]
           description = Default cinder backend
           cinder_store_auth_address = {{ .KeystoneInternalURL }}
           cinder_store_user_name = {{ .ServiceUser }}
           cinder_store_password = {{ .ServicePassword }}
           cinder_store_project_name = service
           cinder_catalog_info = volumev3::internalURL
           cinder_use_multipath = true
   ...

   Copy to Clipboard Toggle word wrap
   • Set replicas to 3 for high availability across APIs.
   • Replace <backend_name> with the name of the default cinder back end, for example nfs_store.

2. Update the control plane:

   $ oc apply -f openstack_control_plane.yaml -n openstack

   Copy to Clipboard Toggle word wrap

3. Wait until RHOCP creates the resources related to the OpenStackControlPlane CR. Run the following command to check the status:

   $ oc get openstackcontrolplane -n openstack

   Copy to Clipboard Toggle word wrap

   The OpenStackControlPlane resources are created when the status is "Setup complete".

   Tip

   Append the -w option to the end of the get command to track deployment progress.

Procedure

1. Open your OpenStackControlPlane CR file, openstack_control_plane.yaml, and add the following parameters to the glance template to configure the Object Storage service as the back end:

   apiVersion: core.openstack.org/v1beta1
   kind: OpenStackControlPlane
   spec:
     ...
     glance:
       template:
         glanceAPIs:
           default:
             replicas: 3 # Configure back end; set to 3 when deploying service
         ...
         customServiceConfig: |
           [DEFAULT]
           enabled_backends = <backend_name>:swift
           [glance_store]
           default_backend = <backend_name>
           [<backend_name>]
           swift_store_create_container_on_put = True
           swift_store_auth_version = 3
           swift_store_auth_address = {{ .KeystoneInternalURL }}
           swift_store_key = {{ .ServicePassword }}
           swift_store_user = service:glance
           swift_store_endpoint_type = internalURL
   ...

   Copy to Clipboard Toggle word wrap
   • Set replicas to 3 for high availability across APIs.
   • Replace <backend_name> with the name of the default back end.

2. Update the control plane:

   $ oc apply -f openstack_control_plane.yaml -n openstack

   Copy to Clipboard Toggle word wrap

3. Wait until RHOCP creates the resources related to the OpenStackControlPlane CR. Run the following command to check the status:

   $ oc get openstackcontrolplane -n openstack

   Copy to Clipboard Toggle word wrap

   The OpenStackControlPlane resources are created when the status is "Setup complete".

   Tip

   Append the -w option to the end of the get command to track deployment progress.

Procedure

1. Create a configuration file, for example, glance-s3.conf, where you can store the S3 configuration details.

2. Generate the secret and access keys for your S3 storage.

   • If your S3 storage is provisioned by the Ceph Object Gateway (RGW), run the following command to generate the secret and access keys:

     $ radosgw-admin user create --uid="<user_1>" \
     --display-name="<Jane Doe>"

     Copy to Clipboard Toggle word wrap
     • Replace <user_1> with the user ID.
     • Replace <Jane Doe> with a display name for the user.

   • If your S3 storage is provisioned by the Object Storage service (swift), run the following command to generate the secret and access keys:

     $ openstackclient openstack credential create --type ec2 \
     --project admin admin \
     '{"access": "<access_key>", "secret": "<secret_key>"}'

     Copy to Clipboard Toggle word wrap
     • Replace <access_key> with the user ID.
     • Replace <secret_key> with a display name for the user.

3. Add the S3 configuration details to your glance-s3.conf configuration file:

   [default_backend]
   s3_store_host = <_s3_endpoint_>
   s3_store_access_key = <_s3_access_key_>
   s3_store_secret_key = <_s3_secret_key_>
   s3_store_bucket = <_s3_bucket_>

   Copy to Clipboard Toggle word wrap
   • Replace <_s3_endpoint_> with the host where the S3 server is listening. This option can contain a DNS name, for example, _s3.amazonaws.com_, or an IP address.
   • Replace <_s3_access_key_> and <_s3_secret_key_> with the data generated by the S3 back end.
   • Replace <_s3_bucket_> with the bucket name where you want to store images in the S3 back end. If you set s3_store_create_bucket_on_put to True in your OpenStackControlPlane CR file, the bucket name is created automatically, even if the bucket does not already exist.

4. Create a secret from the glance-s3.conf file:

   $ oc create secret generic glances3  \
   --from-file s3glance.conf

   Copy to Clipboard Toggle word wrap

5. Open your OpenStackControlPlane CR file, openstack_control_plane.yaml, and add the following parameters to the glance template to configure S3 as the back end:

   apiVersion: core.openstack.org/v1beta1
   kind: OpenStackControlPlane
   spec:
     ...
     glance:
       template:
         ...
         customServiceConfig: |
           [DEFAULT]
           enabled_backends = <backend_name>:s3
           [glance_store]
           default_backend = <backend_name>
           [<backend_name>]
           s3_store_create_bucket_on_put = True
           s3_store_bucket_url_format = "path"
           s3_store_cacert = "/etc/pki/tls/certs/ca-bundle.crt
           s3_store_large_object_size = 0
         glanceAPIs:
           default:
             customServiceConfigSecrets:
             - glances3
   ...

   Copy to Clipboard Toggle word wrap
   • Replace <backend_name> with the name of the default back end.
   • Optional: If your S3 storage is accessed by HTTPS, you must set the s3_store_cacert field and point it to the ca-bundle.crt path. The OpenStack control plane is deployed by default with TLS enabled, and a CA certificate is mounted to the pod in /etc/pki/tls/certs/ca-bundle.crt.
   • Optional: Set s3_store_large_object_size to 0 to force multipart upload when you create an image in the S3 back end from a Block Storage service (cinder) volume.

6. Update the control plane:

   $ oc apply -f openstack_control_plane.yaml -n openstack

   Copy to Clipboard Toggle word wrap

7. Wait until RHOCP creates the resources related to the OpenStackControlPlane CR. Run the following command to check the status:

   $ oc get openstackcontrolplane -n openstack

   Copy to Clipboard Toggle word wrap

   The OpenStackControlPlane resources are created when the status is "Setup complete".

   Tip

   Append the -w option to the end of the get command to track deployment progress.

Procedure

1. Open your OpenStackControlPlane CR file, openstack_control_plane.yaml, and add the extraMounts parameter in the spec section to add the export path and IP address of the NFS share. The path is mapped to /var/lib/glance/images, where the Image service API (glanceAPI) stores and retrieves images:

   apiVersion: core.openstack.org/v1beta1
   kind: OpenStackControlPlane
   metadata:
     name: openstack
   ...
   spec:
     extraMounts:
     - extraVol:
       - extraVolType: Nfs
         mounts:
         - mountPath: /var/lib/glance/images
           name: nfs
         propagation:
         - Glance
         volumes:
         - name: nfs
           nfs:
             path: <nfs_export_path>
             server: <nfs_ip_address>
       name: r1
       region: r1
   ...

   Copy to Clipboard Toggle word wrap
   • Replace <nfs_export_path> with the export path of your NFS share.
   • Replace <nfs_ip_address> with the IP address of your NFS share. This IP address must be part of the overlay network that is reachable by the Image service.

2. Add the following parameters to the glance template to configure NFS as the back end:

   ...
   spec:
     extraMounts:
     ...
     glance:
       template:
         glanceAPIs:
           default:
             type: single
             replicas: 3 # Configure back end; set to 3 when deploying service
         ...
         customServiceConfig: |
           [DEFAULT]
           enabled_backends = <backend_name>:file
           [glance_store]
           default_backend = <backend_name>
           [<backend_name>]
           filesystem_store_datadir = /var/lib/glance/images
         databaseInstance: openstack
   ...

   Copy to Clipboard Toggle word wrap
   • Set replicas to 3 for high availability across APIs.

   • Replace <backend_name> with the name of the default back end.

     Note

     When you configure an NFS back end, you must set the type to single. By default, the Image service has a split deployment type for an external API service, which is accessible through the public and administrator endpoints for the Identity service (keystone), and an internal API service, which is accessible only through the internal endpoint for the Identity service. The split deployment type is invalid for a file back end because different pods access the same file share.

3. Update the control plane:

   $ oc apply -f openstack_control_plane.yaml -n openstack

   Copy to Clipboard Toggle word wrap

4. Wait until RHOCP creates the resources related to the OpenStackControlPlane CR. Run the following command to check the status:

   $ oc get openstackcontrolplane -n openstack

   Copy to Clipboard Toggle word wrap

   The OpenStackControlPlane resources are created when the status is "Setup complete".

   Tip

   Append the -w option to the end of the get command to track deployment progress.

Procedure

1. Open your OpenStackControlPlane CR file, openstack_control_plane.yaml, and add the parameters to the glance template to configure the back ends. In the following example, there are two Ceph RBD stores and one Object Storage service (swift) store:

   ...
   spec:
     glance:
       template:
         customServiceConfig: |
           [DEFAULT]
           debug=True
           enabled_backends = ceph-0:rbd,ceph-1:rbd,swift-0:swift
   ...

   Copy to Clipboard Toggle word wrap

2. Specify the back end to use as the default back end. In the following example, the default back end is ceph-1:

   ...
         customServiceConfig: |
           [DEFAULT]
           debug=True
           enabled_backends = ceph-0:rbd,ceph-1:rbd,swift-0:swift
           [glance_store]
           default_backend = ceph-1
   ...

   Copy to Clipboard Toggle word wrap

3. Add the configuration for each back end type you want to use:

   • Add the configuration for the first Ceph RBD store, ceph-0:

     ...
           customServiceConfig: |
             [DEFAULT]
             ...
             [ceph-0]
             rbd_store_ceph_conf = /etc/ceph/ceph-0.conf
             store_description = "RBD backend"
             rbd_store_pool = images
             rbd_store_user = openstack
     ...

     Copy to Clipboard Toggle word wrap

   • Add the configuration for the second Ceph RBD store, ceph-1:

     ...
           customServiceConfig: |
             [DEFAULT]
             ...
             [ceph-0]
             ...
             [ceph-1]
             rbd_store_ceph_conf = /etc/ceph/ceph-1.conf
             store_description = "RBD backend 1"
             rbd_store_pool = images
             rbd_store_user = openstack
     ...

     Copy to Clipboard Toggle word wrap

   • Add the configuration for the Object Storage service store, swift-0:

     ...
           customServiceConfig: |
             [DEFAULT]
             ...
             [ceph-0]
             ...
             [ceph-1]
             ...
             [swift-0]
             swift_store_create_container_on_put = True
             swift_store_auth_version = 3
             swift_store_auth_address = {{ .KeystoneInternalURL }}
             swift_store_key = {{ .ServicePassword }}
             swift_store_user = service:glance
             swift_store_endpoint_type = internalURL
     ...

     Copy to Clipboard Toggle word wrap

4. Update the control plane:

   $ oc apply -f openstack_control_plane.yaml -n openstack

   Copy to Clipboard Toggle word wrap

5. Wait until RHOCP creates the resources related to the OpenStackControlPlane CR. Run the following command to check the status:

   $ oc get openstackcontrolplane -n openstack

   Copy to Clipboard Toggle word wrap

   The OpenStackControlPlane resources are created when the status is "Setup complete".

   Tip

   Append the -w option to the end of the get command to track deployment progress.

Procedure

1. Open your OpenStackControlPlane CR file, openstack_control_plane.yaml, and add the glanceAPIs parameter to the glance template to configure multiple glanceAPI instances. In the following example, you create three glanceAPI instances that are named api0, api1, and api2:

   ...
   spec:
     glance:
       template:
         customServiceConfig: |
           [DEFAULT]
           enabled_backends = <backend_name>:rbd
           [glance_store]
           default_backend = <backend_name>
           [<backend_name>]
           rbd_store_ceph_conf = /etc/ceph/ceph.conf
           store_description = "RBD backend"
           rbd_store_pool = images
           rbd_store_user = openstack
         databaseInstance: openstack
         databaseUser: glance
         keystoneEndpoint: api0
         glanceAPIs:
           api0:
             replicas: 1
           api1:
             replicas: 1
           api2:
             replicas: 1
       ...

   Copy to Clipboard Toggle word wrap
   • Replace <backend_name> with the name of the default back end.
   • api0 is registered in the Keystone catalog and is the default endpoint for OpenStack CLI operations.
   • api1 and api2 are not default endpoints, but they are active APIs that users can use for image uploads by specifying the --os-image-url parameter when they upload an image.
   • You can update the keystoneEndpoint parameter to change the default endpoint in the Keystone catalog.

2. Add the extraMounts parameter to connect the three glanceAPI instances to a different back end. In the following example, you connect api0, api1, and api2 to three different Ceph Storage clusters that are named ceph0, ceph1, and ceph2:

   spec:
     glance:
       template:
         customServiceConfig: |
           [DEFAULT]
           ...
         extraMounts:
           - name: api0
             region: r1
             extraVol:
               - propagation:
                 - api0
                 volumes:
                 - name: ceph0
                   secret:
                     secretName: <secret_name>
                 mounts:
                 - name: ceph0
                   mountPath: "/etc/ceph"
                   readOnly: true
           - name: api1
             region: r1
             extraVol:
               - propagation:
                 - api1
                 volumes:
                 - name: ceph1
                   secret:
                     secretName: <secret_name>
                 mounts:
                 - name: ceph1
                   mountPath: "/etc/ceph"
                   readOnly: true
           - name: api2
             region: r1
             extraVol:
               - propagation:
                 - api2
                 volumes:
                 - name: ceph2
                   secret:
                     secretName: <secret_name>
                 mounts:
                 - name: ceph2
                   mountPath: "/etc/ceph"
                   readOnly: true
   ...

   Copy to Clipboard Toggle word wrap
   • Replace <secret_name> with the name of the secret associated to the Ceph Storage cluster that you are using as the back end for the specific glanceAPI, for example, ceph-conf-files-0 for the ceph0 cluster.

3. Update the control plane:

   $ oc apply -f openstack_control_plane.yaml -n openstack

   Copy to Clipboard Toggle word wrap

4. Wait until RHOCP creates the resources related to the OpenStackControlPlane CR. Run the following command to check the status:

   $ oc get openstackcontrolplane -n openstack

   Copy to Clipboard Toggle word wrap

   The OpenStackControlPlane resources are created when the status is "Setup complete".

   Tip

   Append the -w option to the end of the get command to track deployment progress.