Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1554012

Summary: [RFE][Cinder] Cinder support for signed Glance images
Product: Red Hat OpenStack Reporter: Christian Schwede (cschwede) <cschwede>
Component: openstack-cinderAssignee: Eric Harney <eharney>
Status: CLOSED ERRATA QA Contact: Avi Avraham <aavraham>
Severity: medium Docs Contact: RHOS Documentation Team <rhos-docs>
Priority: medium    
Version: 14.0 (Rocky)CC: eharney, gcharot, mariel, scohen, srevivo, tshefi
Target Milestone: Upstream M2Keywords: FutureFeature, Triaged
Target Release: 14.0 (Rocky)   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: openstack-cinder-13.0.0-0.20180710093321.64bebcd.el7ost Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
: 1637780 (view as bug list) Environment:
Last Closed: 2019-01-11 11:49:11 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1625007, 1637780    

Description Christian Schwede (cschwede) 2018-03-10 18:32:36 UTC
Cinder currently does not support signature validation of downloaded signed images. Equipping Cinder with the ability to validate image signatures will provide end users with stronger assurances of the integrity of the image data they are using to create volumes.

Comment 7 Avi Avraham 2018-07-25 11:17:31 UTC
I'm looking for details,
Is there any configuration parameter is needed to enable this feature ? 
Is there any parameter was added to CLI that's needed to be use while creating volume from signed image?

Comment 8 Eric Harney 2018-10-15 20:37:25 UTC
(In reply to Avi Avraham from comment #7)
> I'm looking for details,
> Is there any configuration parameter is needed to enable this feature ? 

It works out of the box if Barbican is installed and the images are signed in Glance.

> Is there any parameter was added to CLI that's needed to be use while
> creating volume from signed image?

No, Cinder defaults to requiring the verification to succeed if the image is signed when creating a volume from the image.

The "volume_image_metadata" field in "cinder show" will indicate that the verification succeeded after the volume has been created.

Comment 12 Avi Avraham 2018-10-25 15:18:12 UTC
The feature was verified according to test run 
RPM package version: 
puppet-cinder-13.3.1-0.20181013114719.25b1ba3.el7ost.noarch
openstack-cinder-13.0.1-0.20181013185427.31ff628.el7ost.noarch
python2-cinderclient-4.0.1-0.20180809133302.460229c.el7ost.noarch
python-cinder-13.0.1-0.20181013185427.31ff628.el7ost.noarch

Comment 16 errata-xmlrpc 2019-01-11 11:49:11 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2019:0045