Red Hat Summit Red Hat Summitサポートコンソール開発者トライアルの開始お問い合わせ

Chapter 6. Customizing the Image service (glance) import workflow

You can configure the Image service (glance) import workflow to control image uploads and processing. Enable import methods like glance-direct, web-download, or copy-image, monitor staged images, and use plugins for metadata injection and format conversion.

Users can upload their own images to the Image service by using the default glance-direct or web-download import methods. If you have multiple Red Hat Ceph Storage back ends for the Image service, you can also enable the copy-image import method. You can monitor uploaded images in a staging area before they go active in a storage back end, and you can configure the import workflow to run plugins to make user images discoverable, for example, the Inject Image Metadata plugin for metadata or the Image Conversion plugin for image formats.

6.1. Prerequisites
リンクのコピー

  • You have the oc command line tool installed on your workstation.
  • You are logged on to a workstation that has access to the RHOSO control plane as a user with cluster-admin privileges.
  • To use Image service glance CLI commands, source the cloudrc file with the command $ source ./cloudrc before using them. If the cloudrc file does not exist, then you need to create it. For more information, see Creating the cloudrc file.

6.2. Distributed image import
リンクのコピー

Distributed image import works with the glance-direct image import method, and it is enabled by default in Red Hat OpenStack Services on OpenShift (RHOSO).

When using the glance-direct image import method, users can upload local images to the Image service (glance) without any requirement for a shared storage area where API worker nodes (or replicas) stage images. Instead, staging is distributed because individual API workers have their own local and unshared staging directory. The API worker that owns the image data is the same API worker that performs the image import.

When the image is created and staged, the Image service records the URL of the staging API worker in a database. With this URL, other API workers can proxy image import requests from clients to the worker that has the image data and can perform the import operation. This workflow allows API worker nodes to be isolated for High Availability (HA) and distributed geographically for a distributed compute node (DCN) environment.

6.3. URI allowlist and blocklist for web-download sources
リンクのコピー

You can limit the sources of web-download image imports by specifying a URI allowlist and blocklist in the glance template in your OpenStackControlPlane custom resource (CR) file.

You can allow or block image source URIs at three levels:

  • scheme (allowed_schemes, disallowed_schemes)
  • host (allowed_hosts, disallowed_hosts)
  • port (allowed_ports, disallowed_ports)

If you specify both an allowlist and a blocklist at any level, the allowlist is honored and the blocklist is ignored. For an example of a URI allowlist, see Configuring a URI allowlist for web-import sources.

6.3.1. Decision logic for URI validation
リンクのコピー

The Image service applies the following decision logic to validate image source URIs:

  1. The scheme is checked.

    1. Missing scheme: reject
    2. If there is an allowlist, and the scheme is not present in the allowlist: reject. Otherwise, skip C and continue on to 2.
    3. If there is a blocklist, and the scheme is present in the blocklist: reject.

  2. The host name is checked.

    1. Missing host name: reject
    2. If there is an allowlist, and the host name is not present in the allowlist: reject. Otherwise, skip C and continue on to 3.
    3. If there is a blocklist, and the host name is present in the blocklist: reject.

  3. If there is a port in the URI, the port is checked.

    1. If there is a allowlist, and the port is not present in the allowlist: reject. Otherwise, skip B and continue on to 4.
    2. If there is a blocklist, and the port is present in the blocklist: reject.
  4. The URI is accepted as valid.

If you allow a scheme, either by adding it to an allowlist or by not adding it to a blocklist, any URI that uses the default port for that scheme by not including a port is allowed. If the URI does include a port, the URI is validated according to the default decision logic.

6.3.2. Default settings for the URI allowlist and blocklist
リンクのコピー

The following allowlist and blocklist values are the default settings for the web-download image import method in your Red Hat OpenStack Services on OpenShift (RHOSO) deployment.

  • allowed_schemes - [http, https]
  • disallowed_schemes - empty list
  • allowed_hosts - empty list
  • disallowed_hosts - empty list
  • allowed_ports - [80, 443]
  • disallowed_ports - empty list

If you use the default values, users can only access URIs by using the http or https scheme, and they can only specify ports 80 and 443. Users do not have to specify a port, but if they do, it must be either 80 or 443.

6.3.3. Configuring a URI allowlist for web-import sources
リンクのコピー

You configure the sources of web-import image downloads by specifying URI allowlists and blocklists in the glance template in your OpenStackControlPlane custom resource (CR) file.

In this example, you are using an FTP server for image upload. The default port for FTP is 21.

Procedure

  1. Open your OpenStackControlPlane custom resource CR file, openstack_control_plane.yaml, and add the following parameters to the glance template:

    Example 

    glance:
  template:
    customServiceConfig: |
      [DEFAULT]
      allowed_schemes = [http,https,ftp]
      disallowed_schemes = []
      allowed_hosts = []
      disallowed_hosts = []
      allowed_ports = [80,443]
      disallowed_ports = []
    glanceAPIs:
      ...
    Copy to Clipboard Toggle word wrap

  2. Update the control plane: 

    $ oc apply -f openstack_control_plane.yaml -n openstack
    Copy to Clipboard Toggle word wrap

  3. Wait until RHOCP creates the resources related to the OpenStackControlPlane CR. Run the following command to check the status: 

    $ oc get openstackcontrolplane -n openstack
    Copy to Clipboard Toggle word wrap
    Tip

    Append the -w option to the end of the get command to track deployment progress.

6.4. Configuring the copy-image import method for images
リンクのコピー

You can configure the Image service (glance) to copy existing images to multiple Red Hat Ceph Storage stores.

Procedure

  1. Open your OpenStackControlPlane CR file, openstack_control_plane.yaml, and add the following parameters to the customServiceConfig in the glance template: 

    apiVersion: core.openstack.org/v1beta1
kind: OpenStackControlPlane
spec:
    ...
  glance:
    enabled: true
    template:
      customServiceConfig: |
        [DEFAULT]
        enabled_import_methods=web-download,glance-direct,copy-image
      glanceAPIs:
        ...
    Copy to Clipboard Toggle word wrap

  2. Update the control plane: 

    $ oc apply -f openstack_control_plane.yaml -n openstack
    Copy to Clipboard Toggle word wrap

  3. Wait until RHOCP creates the resources related to the OpenStackControlPlane CR. Run the following command to check the status: 

    $ oc get openstackcontrolplane -n openstack
    Copy to Clipboard Toggle word wrap

    The OpenStackControlPlane resources are created when the status is "Setup complete".

    Tip

    Append the -w option to the end of the get command to track deployment progress.

6.5. Enabling or rejecting virtual machine image disk formats
リンクのコピー

You can configure the Image service (glance) to enable or reject disk formats. For example, you can enable only RAW and ISO disk formats or reject images in QCOW2 disk format.

Procedure

  1. Open your OpenStackControlPlane CR file, openstack_control_plane.yaml, and add the following parameters to the glance template: 

    apiVersion: core.openstack.org/v1beta1
kind: OpenStackControlPlane
spec:
    ...
  glance:
    enabled: true
    template:
      databaseInstance: openstack
      databaseUser: glance
      customServiceConfig: |
         [image_format]
        disk_formats=<raw>,<iso>
      glanceAPIs:
        ...
    Copy to Clipboard Toggle word wrap
    • Replace <raw> and <iso> with the formats you want to enable from the following supported supported disk formats: none, ami, ari, aki, vhd, vhdx, vmdk, raw, qcow2, vdi, iso, ploop.

  2. Update the control plane: 

    $ oc apply -f openstack_control_plane.yaml -n openstack
    Copy to Clipboard Toggle word wrap

  3. Wait until RHOCP creates the resources related to the OpenStackControlPlane CR. Run the following command to check the status: 

    $ oc get openstackcontrolplane -n openstack
    Copy to Clipboard Toggle word wrap

    The OpenStackControlPlane resources are created when the status is "Setup complete".

    Tip

    Append the -w option to the end of the get command to track deployment progress.

6.6. Enabling plugins for the image import workflow
リンクのコピー

You can enable plugins for the image import workflow by configuring the image_import_plugins option in the glance-image-import.conf file. The plugins do not run in parallel; they run in the order in which they appear in the image_import_plugins list.

Image conversion is enabled by default when you use Red Hat Ceph Storage as the back end for the Image service.

Procedure

  • Configure plugins in the glance-image-import.conf file. In this example, you convert the images to RAW format before you inject metadata properties. 

    [image_import_opts]
image_import_plugins = ['image_conversion','inject_image_metadata']

[image_conversion]
output_format = raw

[inject_metadata_properties]
ignore_user_roles = admin,...
inject = "property1":"value1","property2":"value2",...
    Copy to Clipboard Toggle word wrap

6.6.1. Injecting metadata to control instance placement
リンクのコピー

You can enable the Inject Image Metadata plugin to apply metadata properties to images that are imported by cloud users so that instances that are launched from the images are located on specific Compute nodes.

The Inject Image Metadata plugin contains two parameters:

  • ignore_user_roles is a comma-separated list of Identity service (keystone) roles that the plugin will ignore. If the user making the image import call has any of these roles, the plugin will not inject any properties into the image.
  • inject is a comma-separated list of properties and values that will be injected into the image record for the imported image.

Procedure

  1. Open your OpenStackControlPlane CR file, openstack_control_plane.yaml, and add the following parameters to the glance template: 

    apiVersion: core.openstack.org/v1beta1
kind: OpenStackControlPlane
spec:
    ...
  glance:
    enabled: true
    template:
      databaseInstance: openstack
      databaseUser: glance
      customServiceConfig: |
        [DEFAULT]
        enabled_backends = <backend_name>:rbd
        enabled_import_methods=[web-download,glance-direct]
        [image_import_opts]
        image_import_plugins = ['inject_image_metadata']
        [inject_metadata_properties]
        ignore_user_roles = <admin>,...
        inject = "<property1>":"<value1>","<property2>":"<value2>",...
  ...
    Copy to Clipboard Toggle word wrap
    • Replace <backend_name> with the name of the default back end.
    • Replace <admin> with the user roles you want the plugin to ignore.
    • Replace <property1>, <value1>, <property2>, <value2>, and so on with the properties and values that you want to inject to the image.

  2. Update the control plane: 

    $ oc apply -f openstack_control_plane.yaml -n openstack
    Copy to Clipboard Toggle word wrap

  3. Wait until RHOCP creates the resources related to the OpenStackControlPlane CR. Run the following command to check the status: 

    $ oc get openstackcontrolplane -n openstack
    Copy to Clipboard Toggle word wrap

    The OpenStackControlPlane resources are created when the status is "Setup complete".

    Tip

    Append the -w option to the end of the get command to track deployment progress.

6.7. Enabling Image service change notifications
リンクのコピー

You can enable notifications in the Image service (glance) for various events that occur during the image lifecycle. These notifications provide telemetry data that you can use for the following:

  • Auditing, troubleshooting, and monitoring operations
  • Integrating with other services such as Ceilometer for metrics collection and processing

The Image service uses the RabbitMQ message broker software for notification delivery to a configured message queue. When you specify a RabbitMQ instance to use for notifications, the glance-operator automatically updates the oslo_notifications section in the 00-config.conf file. This update switches the notification driver from noop (no notifications) to messagingv2 (notifications).

To enable notifications in the Image service, you add the notificationsBusInstance parameter to the glance template in your OpenStackControlPlane custom resource (CR) file. You use this parameter to specify the RabbitMQ instance name to use for requesting a transport URL.

Procedure

  1. Open your OpenStackControlPlane CR file, openstack_control_plane.yaml, and add the notificationsBusInstance parameter to the glance template: 

    apiVersion: core.openstack.org/v1beta1
kind: OpenStackControlPlane
spec:
  ...
  glance:
    template:
      databaseInstance: openstack
      databaseUser: glance
      notificationsBusInstance: rabbitmq
      customServiceConfig: |
  ...
    Copy to Clipboard Toggle word wrap

  2. Update the control plane: 

    $ oc apply -f openstack_control_plane.yaml -n openstack
    Copy to Clipboard Toggle word wrap

  3. Wait until Red Hat OpenShift Container Platform (RHOCP) creates the resources related to the OpenStackControlPlane CR. Run the following command to check the status: 

    $ oc get openstackcontrolplane -n openstack
    Copy to Clipboard Toggle word wrap

    The OpenStackControlPlane resources are created when the status is "Setup complete".

    Tip

    Append the -w option to the end of the get command to track deployment progress.

  4. Optional: Check the 00-config.conf file to verify the notification settings have been updated:

    Example: 

    $ oc rsh -c glance-httpd <glance-default-external-api-0> grep "oslo_messaging_notifications" /etc/glance/glance.conf.d/00-config.conf -A 2
    Copy to Clipboard Toggle word wrap

    • Replace <glance-default-external-api-0> with the pod name.

      Example output: 

      [oslo_messaging_notifications]
driver=messagingv2
transport_url = rabbit://<user>:<pwd>@rabbitmq.openstack.svc:5671/?ssl=1
      Copy to Clipboard Toggle word wrap

      You can turn off notifications by removing the notificationsBusInstance parameter from the glance template and updating the control plane.

6.8. Creating the cloudrc file
リンクのコピー

The Image service (glance) uses both openstack and glance client commands, within the openstackclient pod. When glance client commands are required, then the cloudrc file must be created on the openstackclient pod to enable their usage. Once created, the cloudrc file persists for the lifetime of the openstackclient pod.

Procedure

  • If the cloudrc does not exist, for instance it cannot be sourced, then use the following command to create it: 

    $ oc rsh openstackclient bash -c '
cat .config/openstack/* | while read key val; do
    case $key in
        "auth_url:") var=OS_AUTH_URL ;;
        "username:") var=OS_USERNAME ;;
        "password:") var=OS_PASSWORD ;;
        "project_name:") var=OS_PROJECT_NAME ;;
        "project_domain_name:") var=OS_PROJECT_DOMAIN_NAME ;;
        "user_domain_name:") var=OS_USER_DOMAIN_NAME ;;
        *) var="" ;;
    esac
    [ -z "$var" ] || echo "export ${var}=${val}"
done > cloudrc
'
    Copy to Clipboard Toggle word wrap
Red Hat logoGithubredditYoutubeTwitter

詳細情報

試用、購入および販売

コミュニティー

Red Hat ドキュメントについて

Red Hat をお使いのお客様が、信頼できるコンテンツが含まれている製品やサービスを活用することで、イノベーションを行い、目標を達成できるようにします。 最新の更新を見る.

多様性を受け入れるオープンソースの強化

Red Hat では、コード、ドキュメント、Web プロパティーにおける配慮に欠ける用語の置き換えに取り組んでいます。このような変更は、段階的に実施される予定です。詳細情報: Red Hat ブログ.

会社概要

Red Hat は、企業がコアとなるデータセンターからネットワークエッジに至るまで、各種プラットフォームや環境全体で作業を簡素化できるように、強化されたソリューションを提供しています。

Theme

© 2026 Red Hatトップに戻る