Hide Forgot
Description of problem: If the project name is the same the previously shared image is displayed. Version-Release number of selected component (if applicable): openstack-glance-11.0.1-4.el7ost.noarch How reproducible: I was able to reproduce it every time Steps to Reproduce: [heat-admin@overcloud-controller-0 ~]$ glance image-list +--------------------------------------+--------------------------+ | ID | Name | +--------------------------------------+--------------------------+ | 3474b0f3-5851-4b2b-8825-2ab383b26716 | centos | | b9de2f1c-dc0a-4bc3-bc3b-377db877e68d | cirros | | b1dee2f8-682a-4119-9649-b9bc2b2149aa | cirros-0.3.4-x86_64-disk | | ef2d8b65-08d4-4b1e-afd2-fc8b0aaac2bc | rhel | +--------------------------------------+--------------------------+ [stack@undercloud-3 ~]$ openstack project list +----------------------------------+---------+ | ID | Name | +----------------------------------+---------+ | 21471b4ab6ef48f1bf35605c958d5c59 | admin | | 99fbb683147a4a3d98a4e5ed6189bc00 | service | +----------------------------------+---------+ [heat-admin@overcloud-controller-0 ~]$ openstack project create test-project-01 +-------------+----------------------------------+ | Field | Value | +-------------+----------------------------------+ | description | None | | enabled | True | | id | 78ffc3bb914b4aee8e05e22e444fedd2 | | name | test-project-01 | +-------------+----------------------------------+ [heat-admin@overcloud-controller-0 ~]$ openstack user create --password-prompt test-user-01 User Password: Repeat User Password: +----------+----------------------------------+ | Field | Value | +----------+----------------------------------+ | email | None | | enabled | True | | id | 17f6419d5ac9405790dfb5f0232f6e09 | | name | test-user-01 | | username | test-user-01 | +----------+----------------------------------+ [heat-admin@overcloud-controller-0 ~]$ openstack role add --project 78ffc3bb914b4aee8e05e22e444fedd2 --user 17f6419d5ac9405790dfb5f0232f6e09 admin +-------+----------------------------------+ | Field | Value | +-------+----------------------------------+ | id | 52062f482f8244b1a7e47007fbb9e9fc | | name | admin | +-------+----------------------------------+ [heat-admin@overcloud-controller-0 ~]$ openstack image list --property owner=21471b4ab6ef48f1bf35605c958d5c59 +--------------------------------------+--------------------------+ | ID | Name | +--------------------------------------+--------------------------+ | b1dee2f8-682a-4119-9649-b9bc2b2149aa | cirros-0.3.4-x86_64-disk | | ef2d8b65-08d4-4b1e-afd2-fc8b0aaac2bc | rhel | | 3474b0f3-5851-4b2b-8825-2ab383b26716 | centos | | b9de2f1c-dc0a-4bc3-bc3b-377db877e68d | cirros | +--------------------------------------+--------------------------+ [heat-admin@overcloud-controller-0 ~]$ openstack image add project b1dee2f8-682a-4119-9649-b9bc2b2149aa 78ffc3bb914b4aee8e05e22e444fedd2 _info [heat-admin@overcloud-controller-0 ~]$ glance member-list --image-id b1dee2f8-682a-4119-9649-b9bc2b2149aa +--------------------------------------+----------------------------------+---------+ | Image ID | Member ID | Status | +--------------------------------------+----------------------------------+---------+ | b1dee2f8-682a-4119-9649-b9bc2b2149aa | 78ffc3bb914b4aee8e05e22e444fedd2 | pending | +--------------------------------------+----------------------------------+---------+ [heat-admin@overcloud-controller-0 ~]$ glance member-update b1dee2f8-682a-4119-9649-b9bc2b2149aa 78ffc3bb914b4aee8e05e22e444fedd2 accepted +--------------------------------------+----------------------------------+----------+ | Image ID | Member ID | Status | +--------------------------------------+----------------------------------+----------+ | b1dee2f8-682a-4119-9649-b9bc2b2149aa | 78ffc3bb914b4aee8e05e22e444fedd2 | accepted | +--------------------------------------+----------------------------------+----------+ [heat-admin@overcloud-controller-0 ~]$ openstack --os-project-id 78ffc3bb914b4aee8e05e22e444fedd2 --os-username test-user-01 --os-password q1w2e3r4 image list --shared +--------------------------------------+--------------------------+ | ID | Name | +--------------------------------------+--------------------------+ | b1dee2f8-682a-4119-9649-b9bc2b2149aa | cirros-0.3.4-x86_64-disk | +--------------------------------------+--------------------------+ [heat-admin@overcloud-controller-0 ~]$ openstack user delete test-user-01 [heat-admin@overcloud-controller-0 ~]$ openstack project delete test-project-01 [heat-admin@overcloud-controller-0 ~]$ openstack project create test-project-01 +-------------+----------------------------------+ | Field | Value | +-------------+----------------------------------+ | description | None | | enabled | True | | id | 5d9605a37ad3446481a21e98d0d996ab | | name | test-project-01 | +-------------+----------------------------------+ [heat-admin@overcloud-controller-0 ~]$ openstack user create --password-prompt test-user-01 User Password: Repeat User Password: +----------+----------------------------------+ | Field | Value | +----------+----------------------------------+ | email | None | | enabled | True | | id | 9c2950657a7f49a3be09011ef639d177 | | name | test-user-01 | | username | test-user-01 | +----------+----------------------------------+ [heat-admin@overcloud-controller-0 ~]$ openstack role add --project 5d9605a37ad3446481a21e98d0d996ab --user 9c2950657a7f49a3be09011ef639d177 admin +-------+----------------------------------+ | Field | Value | +-------+----------------------------------+ | id | 52062f482f8244b1a7e47007fbb9e9fc | | name | admin | +-------+----------------------------------+ [heat-admin@overcloud-controller-0 ~]$ openstack --os-project-id 5d9605a37ad3446481a21e98d0d996ab --os-username test-user-01 --os-password q1w2e3r4 image list --shared +--------------------------------------+--------------------------+ | ID | Name | +--------------------------------------+--------------------------+ | b1dee2f8-682a-4119-9649-b9bc2b2149aa | cirros-0.3.4-x86_64-disk | +--------------------------------------+--------------------------+ Actual results: Previously shared images are still available even though the new project has a different UUID. Expected results: Shared images no longer available. Additional info: openstack-glance-11.0.1-4.el7ost.noarch python-glance-11.0.1-4.el7ost.noarch python-glance-store-0.9.1-3.el7ost.noarch python-glanceclient-1.1.1-1.el7ost.noarch Red Hat Enterprise Linux Server release 7.2 (Maipo)
I've been able to reproduce the behavior in RHOSP9 [root@rhosp9 ~(keystone_admin)]# glance image-list +--------------------------------------+---------+ | ID | Name | +--------------------------------------+---------+ | 040b3489-ecae-4039-a190-1b61baa258db | cirros | | 1be74ef8-405c-4b23-9d33-e5afd980f4a5 | rhel7.3 | +--------------------------------------+---------+ [root@rhosp9 ~(keystone_admin)]# openstack project list +----------------------------------+----------+ | ID | Name | +----------------------------------+----------+ | 1cdbdb3b0e4e4ec89b52fb1a05e19ca6 | admin | | 76d13c2d6bb040b19654b4938a7441cf | services | +----------------------------------+----------+ [root@rhosp9 ~(keystone_admin)]# openstack project create test-project-01 +-------------+----------------------------------+ | Field | Value | +-------------+----------------------------------+ | description | None | | enabled | True | | id | c8cd9c8dbddc4fb8b2271dd58c737236 | | name | test-project-01 | +-------------+----------------------------------+ [root@rhosp9 ~(keystone_admin)]# openstack user create --password-prompt test-user-01 User Password: Repeat User Password: +----------+----------------------------------+ | Field | Value | +----------+----------------------------------+ | email | None | | enabled | True | | id | 9449b233efc340aa8f14310241d73e3f | | name | test-user-01 | | username | test-user-01 | +----------+----------------------------------+ [root@rhosp9 ~(keystone_admin)]# openstack role add --project c8cd9c8dbddc4fb8b2271dd58c737236 --user 9449b233efc340aa8f14310241d73e3f admin +-----------+----------------------------------+ | Field | Value | +-----------+----------------------------------+ | domain_id | None | | id | a7a418b69b2d4b3fafab47532548dc54 | | name | admin | +-----------+----------------------------------+ [root@rhosp9 ~(keystone_admin)]# openstack image add project 1be74ef8-405c-4b23-9d33-e5afd980f4a5 c8cd9c8dbddc4fb8b2271dd58c737236 +------------+--------------------------------------+ | Field | Value | +------------+--------------------------------------+ | created_at | 2016-12-05T18:45:22Z | | image_id | 1be74ef8-405c-4b23-9d33-e5afd980f4a5 | | member_id | c8cd9c8dbddc4fb8b2271dd58c737236 | | schema | /v2/schemas/member | | status | pending | | updated_at | 2016-12-05T18:45:22Z | +------------+--------------------------------------+ [root@rhosp9 ~(keystone_admin)]# glance member-list --image-id 1be74ef8-405c-4b23-9d33-e5afd980f4a5 +--------------------------------------+----------------------------------+---------+ | Image ID | Member ID | Status | +--------------------------------------+----------------------------------+---------+ | 1be74ef8-405c-4b23-9d33-e5afd980f4a5 | c8cd9c8dbddc4fb8b2271dd58c737236 | pending | +--------------------------------------+----------------------------------+---------+ [root@rhosp9 ~(keystone_admin)]# glance member-update 1be74ef8-405c-4b23-9d33-e5afd980f4a5 c8cd9c8dbddc4fb8b2271dd58c737236 accepted +--------------------------------------+----------------------------------+----------+ | Image ID | Member ID | Status | +--------------------------------------+----------------------------------+----------+ | 1be74ef8-405c-4b23-9d33-e5afd980f4a5 | c8cd9c8dbddc4fb8b2271dd58c737236 | accepted | +--------------------------------------+----------------------------------+----------+ [root@rhosp9 ~(keystone_admin)]# openstack --os-project-id c8cd9c8dbddc4fb8b2271dd58c737236 --os-username test-user-01 --os-password q1w2e3r4 image list --shared +--------------------------------------+---------+--------+ | ID | Name | Status | +--------------------------------------+---------+--------+ | 1be74ef8-405c-4b23-9d33-e5afd980f4a5 | rhel7.3 | active | +--------------------------------------+---------+--------+ [root@rhosp9 ~(keystone_admin)]# openstack user delete test-user-01 [root@rhosp9 ~(keystone_admin)]# openstack project delete test-project-01 [root@rhosp9 ~(keystone_admin)]# openstack project create test-project-01 +-------------+----------------------------------+ | Field | Value | +-------------+----------------------------------+ | description | None | | enabled | True | | id | 60e82f4c545346ecaf86a0f876e23c78 | | name | test-project-01 | +-------------+----------------------------------+ [root@rhosp9 ~(keystone_admin)]# openstack user create --password-prompt test-user-01 User Password: Repeat User Password: +----------+----------------------------------+ | Field | Value | +----------+----------------------------------+ | email | None | | enabled | True | | id | 4a5fd36564454fd78f6c131ca2cb5d86 | | name | test-user-01 | | username | test-user-01 | +----------+----------------------------------+ [root@rhosp9 ~(keystone_admin)]# openstack role add --project 60e82f4c545346ecaf86a0f876e23c78 --user 4a5fd36564454fd78f6c131ca2cb5d86 admin +-----------+----------------------------------+ | Field | Value | +-----------+----------------------------------+ | domain_id | None | | id | a7a418b69b2d4b3fafab47532548dc54 | | name | admin | +-----------+----------------------------------+ [root@rhosp9 ~(keystone_admin)]# openstack --os-project-id 60e82f4c545346ecaf86a0f876e23c78 --os-username test-user-01 --os-password q1w2e3r4 image list --shared +--------------------------------------+---------+--------+ | ID | Name | Status | +--------------------------------------+---------+--------+ | 1be74ef8-405c-4b23-9d33-e5afd980f4a5 | rhel7.3 | active | +--------------------------------------+---------+--------+ python-glanceclient-2.0.0-1.el7ost.noarch openstack-glance-12.0.0-1.el7ost.noarch python-glance-12.0.0-1.el7ost.noarch python-glance-store-0.13.1-2.el7ost.noarch Red Hat Enterprise Linux Server release 7.3 (Maipo)
So, I can reproduce this issue upstream, but I can also do this: $ openstack project create test-project-02 +-------------+----------------------------------+ | Field | Value | +-------------+----------------------------------+ | description | | | domain_id | default | | enabled | True | | id | 31facf04e16d4fc0a5aca368bdb0fa9a | | is_domain | False | | name | test-project-02 | | parent_id | default | +-------------+----------------------------------+ $ openstack user create --password test-password-02 test-user-02 +---------------------+----------------------------------+ | Field | Value | +---------------------+----------------------------------+ | domain_id | default | | enabled | True | | id | 0a336ab3f36a4557ab1d647e69e76986 | | name | test-user-02 | | password_expires_at | None | +---------------------+----------------------------------+ $ openstack role add --project test-project-02 --user test-user-02 admin $ openstack --os-project-name test-project-02 --os-username test-user-02 --os-password test-password-02 image list --shared +--------------------------------------+-------------+--------+ | ID | Name | Status | +--------------------------------------+-------------+--------+ | 25105c0f-6284-4fd4-abbc-d92be525cbff | test-img-01 | queued | +--------------------------------------+-------------+--------+ So, with a different user and a different project, I can still see my shared image. Does this happen to you as well? Do you think I might be doing something wrong when reproducing the issue?
Apart from the status of the image ("queued: The image identifier has been reserved for an image in the Glance registry. No image data has been uploaded to Glance and the image size was not explicitly set to zero on creation.) which im not entirely sure if it makes a difference or not since is not technically a image but sort of a placeholder for one, is not clear to me if you simply created a user and listed shared images or if you explicitly shared an image with test-project-01 (or other user) and then listed the shared images with a new ID. The steps are: 1) list all images in glance. 2) list images for the projects. 3) create a new project. 4) create a new user for the project. 5) add admin role to that user. 6) add image to project. 7) accept image. 8) list images for the project. 9) destroy project and user. 10) recreate project, user, role. 11) list images. So your question is if i can do steps (1) to (9) and then create a new project and list the images shared to the one i just deleted?
So, this is my test script (works with ustream, as I think this might be an upstream issu): http://pastebin.test.redhat.com/437982 Does this look OK for you? Can you reproduce your issue using this? Notice that I replaced the IDs/UUIDs by human-readable strings in a lot of places :) Yes, the image is just a "placeholder", here (see the script). Yes, this is what I'd like you to do. Do everything as you did, witness the bug, and then list the shared images with another user and another project, tell me if this returns anything. In my case, it still shows my test image.
Apparently running your script on RHOSP8 with RHEL 7.3 fails due to https://bugs.launchpad.net/glance/+bug/1499368 basically running: openstack image create --private --property owner=admin test-img-01 returns: 403 Forbidden: Attribute 'owner' is reserved. (HTTP 403) on my test system. which version of RHOSP are you using to test the script? Thanks.
I'm using OpenStack vanilla, from (almost) the latest commits :) How was your image created? Could you give me the ouptut of "glance image-show <IMG>" ? I'm trying to see whether the image you use and the one I use have different properties.
[root@rhosp8 ~(keystone_admin)]# openstack image create --private test-img-01 +------------------+------------------------------------------------------+ | Field | Value | +------------------+------------------------------------------------------+ | checksum | None | | container_format | bare | | created_at | 2016-12-09T16:13:10Z | | disk_format | raw | | file | /v2/images/4b7bf6e3-cdda-4f1d-98d8-d4e01a2ca30b/file | | id | 4b7bf6e3-cdda-4f1d-98d8-d4e01a2ca30b | | min_disk | 0 | | min_ram | 0 | | name | test-img-01 | | owner | 4e1fab9437cf479980aabdc1b0286cdd | | protected | False | | schema | /v2/schemas/image | | size | None | | status | queued | | updated_at | 2016-12-09T16:13:10Z | | virtual_size | None | | visibility | private | +------------------+------------------------------------------------------+ You have new mail in /var/spool/mail/root [root@rhosp8 ~(keystone_admin)]# glance image-list +--------------------------------------+-------------+ | ID | Name | +--------------------------------------+-------------+ | b575dea1-de63-4dfa-aa66-7adb32a63a29 | cirros | | 4b7bf6e3-cdda-4f1d-98d8-d4e01a2ca30b | test-img-01 | +--------------------------------------+-------------+ [root@rhosp8 ~(keystone_admin)]# glance image-show b575dea1-de63-4dfa-aa66-7adb32a63a29 +------------------+--------------------------------------+ | Property | Value | +------------------+--------------------------------------+ | checksum | 133eae9fb1c98f45894a4e60d8736619 | | container_format | bare | | created_at | 2016-11-16T15:25:17Z | | disk_format | qcow2 | | id | b575dea1-de63-4dfa-aa66-7adb32a63a29 | | min_disk | 0 | | min_ram | 0 | | name | cirros | | owner | ca8501ef6ad34538a9c9e2d9862ebedc | | protected | False | | size | 13200896 | | status | active | | tags | [] | | updated_at | 2016-11-16T15:27:16Z | | virtual_size | None | | visibility | public | +------------------+--------------------------------------+ [root@rhosp8 ~(keystone_admin)]# glance image-show 4b7bf6e3-cdda-4f1d-98d8-d4e01a2ca30b +------------------+--------------------------------------+ | Property | Value | +------------------+--------------------------------------+ | checksum | None | | container_format | bare | | created_at | 2016-12-09T16:13:10Z | | disk_format | raw | | id | 4b7bf6e3-cdda-4f1d-98d8-d4e01a2ca30b | | min_disk | 0 | | min_ram | 0 | | name | test-img-01 | | owner | 4e1fab9437cf479980aabdc1b0286cdd | | protected | False | | size | None | | status | queued | | tags | [] | | updated_at | 2016-12-09T16:13:10Z | | virtual_size | None | | visibility | private | +------------------+--------------------------------------+ The VM where i originally tested the bug was destroyed. I can try to reproduce the issue one more time following the steps shared before. but just to clarify this happened in both RHOSP8 and RHOSP9 following the exact steps detailed before. In both cases since you can't share a public image (like cirros) i uploaded an actual RHEL image. thanks.
OK, so I've got something similar. $ openstack image show test-img-01 +------------------+------------------------------------------------------+ | Field | Value | +------------------+------------------------------------------------------+ | checksum | None | | container_format | bare | | created_at | 2016-12-12T18:34:36Z | | disk_format | raw | | file | /v2/images/6bd65ea5-2bae-4a89-8b6b-2cbae5fdd03f/file | | id | 6bd65ea5-2bae-4a89-8b6b-2cbae5fdd03f | | min_disk | 0 | | min_ram | 0 | | name | test-img-01 | | owner | fc7301f899314ee18a4497ecbef7c8c8 | | protected | False | | schema | /v2/schemas/image | | size | None | | status | queued | | tags | | | updated_at | 2016-12-12T18:34:36Z | | virtual_size | None | | visibility | private | +------------------+------------------------------------------------------+ I can witness your issue by going through all the steps you wrote (just replacing UUIDs with human-readable identifiers), but I still manage to see the shared image with a completely different user/project: $ openstack project create test-project-02 ... $ openstack user create --password test-password-02 test-user-02 ... $ openstack role add --project test-project-02 --user test-user-02 admin $ openstack --os-project-name test-project-02 --os-username test-user-02 --os-password test-password-02 image list --shared +--------------------------------------+-------------+--------+ | ID | Name | Status | +--------------------------------------+-------------+--------+ | 6bd65ea5-2bae-4a89-8b6b-2cbae5fdd03f | test-img-01 | queued | +--------------------------------------+-------------+--------+ Does this happen to you as well?
Sorry to keep you waiting. My test environment was destryed once agfain so i'll try to reproduce the issue and see if i see the same behavior. A quick question though: > $ openstack image show test-img-01 > +------------------+------------------------------------------------------+ > | Field | Value | > +------------------+------------------------------------------------------+ > | name | test-img-01 | > | owner | fc7301f899314ee18a4497ecbef7c8c8 | > +------------------+------------------------------------------------------+ The owner uuid is the same as the user created for the project? What does the output of openstack user list shows on your system? My understanding is that the image can be shared with a specific project and that relationship should be destroyed along with the project or tied to the project UUID. It seems that it's tied to the project name instead. Assuming the image you shared with the project is indeed available to other projects even after the owner has been deleted seems to suggest that the images, once shared, are accessible to any project. I assume that this is a real bug. If private images are required for a specific project such images should be uploaded and marked as private for that project however if an image can be shared specifying an owner and a project i have to assume the intended functionality is for that image to be only accessible to the specific project and the relationship destroyed along with the project. I'll try to re create and reproduce my issue and your observations and i'll update this BZ Thanks.
Isn't your issue really just what Victor explained at https://bugzilla.redhat.com/show_bug.cgi?id=1404326#c15 ? Or is it more specific?
Feel free to re-open this bug if you feel it is not truly a duplicate of 1404326. *** This bug has been marked as a duplicate of bug 1404326 ***
I'm not really sure this bug is a duplicate of bug 1404326. The issue is different than what Victor explained: "The reported problem is that if the user is admin in the tenant "demo", he/she see all images, including images of the tenant "alt_demo" where he/she doesn't have the admin role." The problem I'm reporting is: "If the project name is the same the previously shared image is displayed." Or, to be more specific, If i create project X and i add user X as admin of that project and i create an image, once the project X is destroyed the image remains and if i create another project named X the image becomes available to the "new" project.
The status this bug is not clear is it duplicated or not. Is there is a fix for this bug what is the RPM version it was included in ? If there is no fix for it yet it is not to be in ON_QA status
We closed it as a duplicate of another bug, but it seems wrong to Siggy. @Siggy: this really needs to be reported upstream. This is such a weird issue that it has to be fixed there anyway. Re-closing it.
i can still reproduce the behavior described which is not the same as that described on https://bugzilla.redhat.com/show_bug.cgi?id=1404326 Status shouldn't be closed unless there's a fix for the issue described here (which it may be weird but is also real). Images associated to a specific project should be destroyed along with the project and / or it's association to a specific project be destroyed once the project is deleted. If there's a fix that will address this issue as well as the one described in the other bug report it should be fine but i still don't think this should be closed as a duplicate of a bug that is just different to the one reported here.