Problem description

Keystone tokens have some restricted lifetime. After the user token has expired, any request initiated by Glance which needs a valid user token will fail. This causes the original user’s request to also fail, even though the token was originally valid when passed to Glance.

This this spec intends to address the specific case where a token expires during image upload causing the call to the registry to set the image state ‘active’ to fail:

    User requests image-upload.
    Keystone Middleware accepts the request and passes the request to Glance.
    Glance passes all required data to glance_store.
    glance_store uploads an image but it takes a lot of time (more than token expiration time)
    Glance sends a request to registry to change image status.
    Keystone Middleware rejects the request because user token has expired.

As a result the image never transitions to ‘active’ status and so isn’t usable.

Increasing the token expiration time doesn’t seem to be a good long-term solution.

Full spec: https://specs.openstack.org/openstack/glance-specs/specs/mitaka/glance-trusts.html