Chapter 1. Image service

Procedure

1. Add a new interval with the ExtraConfig parameter in an environment file on the undercloud according to your requirements:

   parameter_defaults:
     ControllerExtraConfig:
       glance::config::glance_api_config:
         DEFAULT/cache_prefetcher_interval:
           value: '<300>'

   Copy to Clipboard Toggle word wrap

   Replace <300> with the number of seconds that you want as an interval to pre-cache images.

2. After you adjust the interval in the environment file in /home/stack/templates/, log in as the stack user and deploy the configuration:

   $ openstack overcloud deploy --templates \
   -e /home/stack/templates/<ENV_FILE>.yaml

   Copy to Clipboard Toggle word wrap

   Replace <ENV_FILE> with the name of the environment file that contains the ExtraConfig settings that you added.

Procedure

1. Log in to the undercloud as the stack user and identify the provisioning IP address of controller-0:

   (undercloud) [stack@site-undercloud-0 ~]$ openstack server list -f value -c Name -c Networks | grep controller
   overcloud-controller-1 ctlplane=192.168.24.40
   overcloud-controller-2 ctlplane=192.168.24.13
   overcloud-controller-0 ctlplane=192.168.24.71
   (undercloud) [stack@site-undercloud-0 ~]$

   Copy to Clipboard Toggle word wrap

2. To authenticate to the overcloud, copy the credentials that are stored in /home/stack/overcloudrc, by default, to controller-0:

   $ scp ~/overcloudrc heat-admin@192.168.24.71:/home/heat-admin/

   Copy to Clipboard Toggle word wrap

3. Connect to controller-0:

   $ ssh heat-admin@192.168.24.71

   Copy to Clipboard Toggle word wrap

4. On controller-0 as the heat-admin user, identify the IP address of the glance_api service. In the following example, the IP address is 172.25.1.105:

   (overcloud) [root@controller-0 ~]# grep -A 10 '^listen glance_api' /var/lib/config-data/puppet-generated/haproxy/etc/haproxy/haproxy.cfg
   listen glance_api
    server central-controller0-0.internalapi.redhat.local 172.25.1.105:9292 check fall 5 inter 2000 rise 2

   Copy to Clipboard Toggle word wrap

5. Because the glance-cache-manage command is only available in the glance_api container, create a script to exec into that container where the environment variables to authenticate to the overcloud are already set. Create a script called glance_pod.sh in /home/heat-admin on controller-0 with the following contents:

   sudo podman exec -ti \
    -e NOVA_VERSION=$NOVA_VERSION \
    -e COMPUTE_API_VERSION=$COMPUTE_API_VERSION \
    -e OS_USERNAME=$OS_USERNAME \
    -e OS_PROJECT_NAME=$OS_PROJECT_NAME \
    -e OS_USER_DOMAIN_NAME=$OS_USER_DOMAIN_NAME \
    -e OS_PROJECT_DOMAIN_NAME=$OS_PROJECT_DOMAIN_NAME \
    -e OS_NO_CACHE=$OS_NO_CACHE \
    -e OS_CLOUDNAME=$OS_CLOUDNAME \
    -e no_proxy=$no_proxy \
    -e OS_AUTH_TYPE=$OS_AUTH_TYPE \
    -e OS_PASSWORD=$OS_PASSWORD \
    -e OS_AUTH_URL=$OS_AUTH_URL \
    -e OS_IDENTITY_API_VERSION=$OS_IDENTITY_API_VERSION \
    -e OS_COMPUTE_API_VERSION=$OS_COMPUTE_API_VERSION \
    -e OS_IMAGE_API_VERSION=$OS_IMAGE_API_VERSION \
    -e OS_VOLUME_API_VERSION=$OS_VOLUME_API_VERSION \
    -e OS_REGION_NAME=$OS_REGION_NAME \
   glance_api /bin/bash

   Copy to Clipboard Toggle word wrap

6. Source the overcloudrc file and run the glance_pod.sh script to exec into the glance_api container with the necessary environment variables to authenticate to the overcloud Controller node.

   [heat-admin@controller-0 ~]$ source overcloudrc
   (overcloudrc) [heat-admin@central-controller-0 ~]$ bash glance_pod.sh
   ()[glance@controller-0 /]$

   Copy to Clipboard Toggle word wrap

7. Use a command such as glance image-list to verify that the container can run authenticated commands against the overcloud.

   ()[glance@controller-0 /]$ glance image-list
   +--------------------------------------+----------------------------------+
   | ID                                   | Name                             |
   +--------------------------------------+----------------------------------+
   | ad2f8daf-56f3-4e10-b5dc-d28d3a81f659 | cirros-0.4.0-x86_64-disk.img       |
   +--------------------------------------+----------------------------------+
   ()[glance@controller-0 /]$

   Copy to Clipboard Toggle word wrap

Procedure

1. As the admin user, queue an image to cache:

   $ glance-cache-manage --host=<host_ip> queue-image <image_id>

   Copy to Clipboard Toggle word wrap
   • Replace <host_ip> with the IP address of the Controller node where the glance-api container is running.

   • Replace <image_id> with the ID of the image that you want to queue.

     When you have queued the images that you want to pre-cache, the cache_images periodic job prefetches all queued images concurrently.

     Note

     Because the image cache is local to each node, if your Red Hat OpenStack Platform is deployed with HA (with 3, 5, or 7 Controllers) then you must specify the host address with the --host option when you run the glance-cache-manage command.

2. Run the following command to view the images in the image cache:

   $ glance-cache-manage --host=<host_ip> list-cached

   Copy to Clipboard Toggle word wrap

   Replace <host_ip> with the IP address of the host in your environment.

Procedure

1. As a cloud administrator, create a separate heat template environment file, such as lock-down-glance-metadef-api.yaml, to contain policy overrides for the Image service metadef API:

   ...
   parameter_defaults:
     GlanceApiPolicies: {
   	glance-metadef_default: { key: 'metadef_default', value: '' },
   	glance-metadef_admin: { key: 'metadef_admin', value: 'role:admin' },
   	glance-get_metadef_namespace: { key: 'get_metadef_namespace', value: 'rule:metadef_default' },
   	glance-get_metadef_namespaces: { key: 'get_metadef_namespaces', value: 'rule:metadef_default' },
   	glance-modify_metadef_namespace: { key: 'modify_metadef_namespace', value: 'rule:metadef_admin' },
   	glance-add_metadef_namespace: { key: 'add_metadef_namespace', value: 'rule:metadef_admin' },
   	glance-delete_metadef_namespace: { key: 'delete_metadef_namespace', value: 'rule:metadef_admin' },
   	glance-get_metadef_object: { key: 'get_metadef_object', value: 'rule:metadef_default' },
   	glance-get_metadef_objects: { key: 'get_metadef_objects', value: 'rule:metadef_default' },
   	glance-modify_metadef_object: { key: 'modify_metadef_object', value: 'rule:metadef_admin' },
   	glance-add_metadef_object: { key: 'add_metadef_object', value: 'rule:metadef_admin' },
   	glance-delete_metadef_object: { key: 'delete_metadef_object', value: 'rule:metadef_admin' },
   	glance-list_metadef_resource_types: { key: 'list_metadef_resource_types', value: 'rule:metadef_default' },
   	glance-get_metadef_resource_type: { key: 'get_metadef_resource_type', value: 'rule:metadef_default' },
   	glance-add_metadef_resource_type_association: { key: 'add_metadef_resource_type_association', value: 'rule:metadef_admin' },
   	glance-remove_metadef_resource_type_association: { key: 'remove_metadef_resource_type_association', value: 'rule:metadef_admin' },
   	glance-get_metadef_property: { key: 'get_metadef_property', value: 'rule:metadef_default' },
   	glance-get_metadef_properties: { key: 'get_metadef_properties', value: 'rule:metadef_default' },
   	glance-modify_metadef_property: { key: 'modify_metadef_property', value: 'rule:metadef_admin' },
   	glance-add_metadef_property: { key: 'add_metadef_property', value: 'rule:metadef_admin' },
   	glance-remove_metadef_property: { key: 'remove_metadef_property', value: 'rule:metadef_admin' },
   	glance-get_metadef_tag: { key: 'get_metadef_tag', value: 'rule:metadef_default' },
   	glance-get_metadef_tags: { key: 'get_metadef_tags', value: 'rule:metadef_default' },
   	glance-modify_metadef_tag: { key: 'modify_metadef_tag', value: 'rule:metadef_admin' },
   	glance-add_metadef_tag: { key: 'add_metadef_tag', value: 'rule:metadef_admin' },
   	glance-add_metadef_tags: { key: 'add_metadef_tags', value: 'rule:metadef_admin' },
   	glance-delete_metadef_tag: { key: 'delete_metadef_tag', value: 'rule:metadef_admin' },
   	glance-delete_metadef_tags: { key: 'delete_metadef_tags', value: 'rule:metadef_admin' }
     }
   
   …

   Copy to Clipboard Toggle word wrap

2. Include the environment file that contains the policy overrides in the deployment command with the -e option when you deploy the overcloud:

   $ openstack overcloud deploy -e lock-down-glance-metadef-api.yaml

   Copy to Clipboard Toggle word wrap

Procedure

1. As a cloud administrator, log in to the undercloud and create a file for policy overrides. For example:

   $ cat open-up-glance-api-metadef.yaml

   Copy to Clipboard Toggle word wrap

2. Configure the policy override file to allow metadef API read-write access to all users:

   GlanceApiPolicies: {
       glance-metadef_default: { key: 'metadef_default', value: '' },
       glance-get_metadef_namespace: { key: 'get_metadef_namespace', value: 'rule:metadef_default' },
       glance-get_metadef_namespaces: { key: 'get_metadef_namespaces', value: 'rule:metadef_default' },
       glance-modify_metadef_namespace: { key: 'modify_metadef_namespace', value: 'rule:metadef_default' },
       glance-add_metadef_namespace: { key: 'add_metadef_namespace', value: 'rule:metadef_default' },
       glance-delete_metadef_namespace: { key: 'delete_metadef_namespace', value: 'rule:metadef_default' },
       glance-get_metadef_object: { key: 'get_metadef_object', value: 'rule:metadef_default' },
       glance-get_metadef_objects: { key: 'get_metadef_objects', value: 'rule:metadef_default' },
       glance-modify_metadef_object: { key: 'modify_metadef_object', value: 'rule:metadef_default' },
       glance-add_metadef_object: { key: 'add_metadef_object', value: 'rule:metadef_default' },
       glance-delete_metadef_object: { key: 'delete_metadef_object', value: 'rule:metadef_default' },
       glance-list_metadef_resource_types: { key: 'list_metadef_resource_types', value: 'rule:metadef_default' },
       glance-get_metadef_resource_type: { key: 'get_metadef_resource_type', value: 'rule:metadef_default' },
       glance-add_metadef_resource_type_association: { key: 'add_metadef_resource_type_association', value: 'rule:metadef_default' },
       glance-remove_metadef_resource_type_association: { key: 'remove_metadef_resource_type_association', value: 'rule:metadef_default' },
       glance-get_metadef_property: { key: 'get_metadef_property', value: 'rule:metadef_default' },
       glance-get_metadef_properties: { key: 'get_metadef_properties', value: 'rule:metadef_default' },
       glance-modify_metadef_property: { key: 'modify_metadef_property', value: 'rule:metadef_default' },
       glance-add_metadef_property: { key: 'add_metadef_property', value: 'rule:metadef_default' },
       glance-remove_metadef_property: { key: 'remove_metadef_property', value: 'rule:metadef_default' },
       glance-get_metadef_tag: { key: 'get_metadef_tag', value: 'rule:metadef_default' },
       glance-get_metadef_tags: { key: 'get_metadef_tags', value: 'rule:metadef_default' },
       glance-modify_metadef_tag: { key: 'modify_metadef_tag', value: 'rule:metadef_default' },
       glance-add_metadef_tag: { key: 'add_metadef_tag', value: 'rule:metadef_default' },
       glance-add_metadef_tags: { key: 'add_metadef_tags', value: 'rule:metadef_default' },
       glance-delete_metadef_tag: { key: 'delete_metadef_tag', value: 'rule:metadef_default' },
       glance-delete_metadef_tags: { key: 'delete_metadef_tags', value: 'rule:metadef_default' }
     }

   Copy to Clipboard Toggle word wrap
   Note

   You must configure all metadef policies to use rule:metadeta_default.

3. Include the new policy file in the deployment command with the -e option when you deploy the overcloud:

   $ openstack overcloud deploy -e open-up-glance-api-metadef.yaml

   Copy to Clipboard Toggle word wrap

1. Create an image and specify the URI of the image to import:

   $ glance image-create-via-import \
       --container-format <CONTAINER FORMAT> \
       --disk-format <DISK-FORMAT> \
       --name <NAME> \
       --import-method web-download \
       --uri <URI>

   Copy to Clipboard Toggle word wrap
   • Replace <CONTAINER FORMAT> with the container format that you are setting set for your image (None, ami, ari, aki, bare, ovf, ova, docker).
   • Replace <DISK-FORMAT> with the disk format that you are setting set for your image (None, ami, ari, aki, vhd, vhdx, vmdk, raw, qcow2, vdi, iso, ploop).
   • Replace <NAME> with a descriptive name for your image.
   • Replace <URI> with the URI of your image.

2. You can check the availability of the image by using the glance image-show <IMAGE_ID> command.

   • Replace <IMAGE_ID> with the ID you provided during image creation.

1. The web download method creates an image record.
2. The web download method retrieves the image from the specified URI.

Procedure

1. Log in to the undercloud host as the stack user.

2. Source the undercloud credentials file:

   $ source ~/stackrc

   Copy to Clipboard Toggle word wrap

3. Include the GlanceDiskFormats parameter in an environment file, for example, glance_disk_formats.yaml:

   parameter_defaults:
     GlanceDiskFormats:
       - <disk_format>

   Copy to Clipboard Toggle word wrap

   • For example, use the following configuration to enable only RAW and ISO disk formats:

     parameter_defaults:
       GlanceDiskFormats:
       - raw
       - iso

     Copy to Clipboard Toggle word wrap

   • Use the following example configuration to reject QCOW2 disk images:

     parameter_defaults:
       GlanceDiskFormats:
       - raw
       - iso
       - aki
       - ari
       - ami

     Copy to Clipboard Toggle word wrap

4. Include the environment file that contains your new configuration in the openstack overcloud deploy command with any other environment files that are relevant to your environment:

   $ openstack overcloud deploy --templates \
     -e <overcloud_environment_files> \
     -e <new_environment_file> \
     …

   Copy to Clipboard Toggle word wrap
   • Replace <overcloud_environment_files> with the list of environment files that are part of your deployment.
   • Replace <new_environment_file> with the environment file that contains your new configuration.