RHOSP should adopt the recommendation described in OSSN-0090 [1], and deploy two separate instances of the glance-api service: 1. A "user facing" glance-api service, accessible via the Public and Admin keystone endpoints 2. An "internal facing only" service, accessible via the Internal keystone endpoint [1] https://wiki.openstack.org/wiki/OSSN/OSSN-0090 The user facing service should be configured to not expose image locations, namely by setting the following options in glance-api.conf: [DEFAULT] show_image_direct_url = False show_multiple_locations = False The internal service, operating on a different port (e.g. 9293), should be configured identically to the public facing service, except for the following: [DEFAULT] show_image_direct_url = True show_multiple_locations = True OpenStack services that use glance (cinder and nova) should be configured to access it via the new internal service. That way both cinder and nova will have access to the image location data.
@James: This is an accurate summary. I agree with Greg, if our architecture is described somewhere, it should be updated.
Tested on: Red Hat OpenStack Platform release 17.1.0 Beta (Wallaby) openstack-tripleo-heat-templates-14.3.1-1.20230519151004.f602c2b.el9ost.noarch Both flags "show_image_direct_url" and "show_multiple_locations" are set to _False_ on glance-api.conf The same flags are set to _True_ on internal glance-api.conf Also, the "GlanceInternal" entry is found under "EndpointMapOverride" in /home/stack/overcloud-deploy/overcloud/overcloud-export.yaml Used the same "curl" command from comment #1: Public endpoint returned: HTTP/1.1 200 OK content-length: 861 content-type: application/json x-openstack-request-id: req-8ab8869b-6e59-44b5-a65d-fa237df12870 date: Thu, 08 Jun 2023 17:54:55 GMT {"hw_rng_model": "virtio", "name": "cirros-0.5.2-x86_64-disk.img", "disk_format": "qcow2", "container_format": "bare", "visibility": "public", "size": 16300544, "virtual_size": 117440512, "status": "active", "checksum": "b874c39491a2377b8490f5f1e89761a4", "protected": false, "min_ram": 0, "min_disk": 0, "owner": "2434d4521f90471ea24aed710f72d455", "os_hidden": false, "os_hash_algo": "sha512", "os_hash_value": "6b813aa46bb90b4da216a4d19376593fa3f4fc7e617f03a92b7fe11e9a3981cbe8f0959dbebe36225e5f53dc4492341a4863cac4ed1ee0909f3fc78ef9c3e869", "id": "925dceb9-44b9-4901-8f78-a9d11431fa79", "created_at": "2023-05-29T07:22:40Z", "updated_at": "2023-05-29T07:22:42Z", "tags": [], "self": "/v2/images/925dceb9-44b9-4901-8f78-a9d11431fa79", "file": "/v2/images/925dceb9-44b9-4901-8f78-a9d11431fa79/file", "schema": "/v2/schemas/image", "stores": "default_backend"} *** No "locations" Admin/internal endpoint returned: HTTP/1.1 200 OK content-length: 1131 content-type: application/json x-openstack-request-id: req-a35406d3-bc87-40e1-a2f8-fad5690afdad date: Thu, 08 Jun 2023 17:57:51 GMT {"hw_rng_model": "virtio", "name": "cirros-0.5.2-x86_64-disk.img", "disk_format": "qcow2", "container_format": "bare", "visibility": "public", "size": 16300544, "virtual_size": 117440512, "status": "active", "checksum": "b874c39491a2377b8490f5f1e89761a4", "protected": false, "min_ram": 0, "min_disk": 0, "owner": "2434d4521f90471ea24aed710f72d455", "os_hidden": false, "os_hash_algo": "sha512", "os_hash_value": "6b813aa46bb90b4da216a4d19376593fa3f4fc7e617f03a92b7fe11e9a3981cbe8f0959dbebe36225e5f53dc4492341a4863cac4ed1ee0909f3fc78ef9c3e869", "id": "925dceb9-44b9-4901-8f78-a9d11431fa79", "created_at": "2023-05-29T07:22:40Z", "updated_at": "2023-05-29T07:22:42Z", "locations": [{"url": "rbd://4e5cc9f9-7b68-53f7-8a61-f7c92a81a960/images/925dceb9-44b9-4901-8f78-a9d11431fa79/snap", "metadata": {"store": "default_backend"}}], "direct_url": "rbd://4e5cc9f9-7b68-53f7-8a61-f7c92a81a960/images/925dceb9-44b9-4901-8f78-a9d11431fa79/snap", "tags": [], "self": "/v2/images/925dceb9-44b9-4901-8f78-a9d11431fa79", "file": "/v2/images/925dceb9-44b9-4901-8f78-a9d11431fa79/file", "schema": "/v2/schemas/image", "stores": "default_backend"} *** "locations" exists including "direct_url" Moving to VERIFIED
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Release of components for Red Hat OpenStack Platform 17.1 (Wallaby)), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2023:4577
The needinfo request[s] on this closed bug have been removed as they have been unresolved for 120 days