Bug 1065604

Summary: [RFE][glance]: An Operation to Deactivate an Image in Glance
Product: Red Hat OpenStack Reporter: RHOS Integration <rhos-integ>
Component: openstack-glanceAssignee: Flavio Percoco <fpercoco>
Status: CLOSED ERRATA QA Contact: nlevinki <nlevinki>
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: eglynn, fpercoco, markmc, scohen, yeylon
Target Milestone: Upstream M3Keywords: FutureFeature, OtherQA
Target Release: 7.0 (Kilo)   
Hardware: Unspecified   
OS: Unspecified   
URL: https://blueprints.launchpad.net/glance/+spec/deactivate-image
Whiteboard: upstream_milestone_kilo-3 upstream_status_implemented upstream_definition_approved
Fixed In Version: openstack-glance-2015.1.0-6.el7ost Doc Type: Enhancement
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-08-05 13:11:40 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description RHOS Integration 2014-02-15 05:07:33 UTC 
Cloned from launchpad blueprint https://blueprints.launchpad.net/glance/+spec/deactivate-image.

Description:

The goal of this blueprint is to introduce a mechanism to deactivate an image.

An important usecase is as follows:
A "bad" image in a cloud, especially now with image sharing available, may cause a greater damage as more and more instances can be spun off of it. A "bad" image may get into a cloud in the following ways (there maybe other ways too) :
 - It was crafted outside the cloud and was imported into the cloud
 - It was crafted inside the cloud after booting off of a known good image

Once such an image is found inside the cloud, there is need for an operation to 'deactivate' it until further investigation can be performed. The investigation itself is outside the scope of this blueprint. Once a thourough investigation is performed, a deactivated image can be activated again or deleted depending on the investigation findings.

The proposed mechanism is to introduce a new image status, 'deactivated'.  When an image is in this state, access to its data would be prohibited for non-admin users.

Specification URL (additional information):

https://wiki.openstack.org/wiki/Glance-deactivate-image
Comment 6 errata-xmlrpc 2015-08-05 13:11:40 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2015:1548