Add option restrict regular users from upload public images

[Miguel Meneses]

Glance service has policy.json which defines policies for accessing API. If you don't want others to upload the images than you can allow only admin to upload images by modifying the /etc/glance/policy.json file such that users having admin role only they can use add_image api. So this way you can restrict users other than admin to upload images.

Source: https://ask.openstack.org/en/question/52593/how-to-restrict-tenants-from-uploading-images-in-horizon/
https://docs.openstack.org/ocata/config-reference/image/policy.json.html

Can we please have configuration option to restricting tenants/user from uploading the images? and just the admin will do

Kind Regards

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/650408

[James Page (james-page)]

Note that only an admin can make and image public already - this is part of the default glance policy:

    "add_image": "",
    "delete_image": "",
    "get_image": "",
    "get_images": "",
    "modify_image": "",
    "publicize_image": "role:admin",
    "communitize_image": "",
    "copy_from": "",

a regular user can 'communitize_image' which is a bit different.

[James Page (james-page)]

There is a good question in the linked ask.openstack.org question:

"Let's assume you made this change so only admins could upload images. Would this affect non-admin users' ability to take snapshots?"

that's a really good question - its possible that because the service account for nova is actually creating the snapshot of a vm, this just works but that would need to be validated.

[David Coronel (davecore)]

Concerning the ask.openstack.org question:

"Let's assume you made this change so only admins could upload images. Would this affect non-admin users' ability to take snapshots?"

I just tested and indeed making this change does block non-admin users from taking a snapshot of an instance.

[David Coronel (davecore)]

I didn't realise there were publicize_image and communitize_image policies. Maybe the publicize_image policy is enough for the original requestor?

[James Page (james-page)]

@miguel.meneses

There is already some level of protection of making an image 'public' - restricting the other access permissions has some side effects that might not be desirable - see #4 - is the existing protection sufficient? We could implement more restriction via policy but it may have other un-forseen side effects due to the way that policy is implemented in glance.

[Launchpad Janitor (janitor)]

[Expired for OpenStack glance charm because there has been no activity for 60 days.]

[OpenStack Infra (hudson-openstack)]

Change abandoned by "Billy Olsen <email address hidden>" on branch: master
Review: https://review.opendev.org/c/openstack/charm-glance/+/650408
Reason: Change has not been updated to address feedback in > 180 days