[feature] allow for glance to install in a privileged container

[Jeff Hillman]

There is a need for Glance to be able to mount an NFS share while in an LXD container.

Specifically if there is no Ceph in the environment to relate Glance to.

Deployed in an LXD container, Glance will not have permissions, by default, to be able to mount an NFS share, due to the default posture of it being an unprivileged container.

creating an lxd-profile.yaml file with the following contents will make this a possability.

---

config:
  security.privileged: true

---

[Ryan Beisner (1chb1n)]

From a security perspective, this is a big change that should be discussed further before proceeding. The impact is that all glance deployments, whether they need it or not, would run in privileged containers. That seems like a lot of added risk, especially given a corner case use case.

[Chris MacNaughton (chris.macnaughton)]

I think that, if mounting NFS is required, FUSE NFS should be used if in a container or the glance units should be placed on bare metal. I will argue fairly strongly against making the glance API service be run in a privileged container just because sometimes NFS is required.

[Jeff Hillman (jhillman)]

FUSE NFS is not in any package repo, so it would be an unsupported method at any handover time.

I'm open to any other suggestions on using NFS with clustered glance.

[Chris MacNaughton (chris.macnaughton)]

In addition to suggesting FUSE, I did propose another solution in my initial response: put Glance on metal if it needs access to true NFS. Removing security controls for the world to ease deployment placing seems like a bad trade-off to me.

[James Page (james-page)]

The trilio-wlm charm uses NFS via the kernel:

config:
  raw.apparmor: mount fstype=nfs,
  security.privileged: "true"

that appears to work fine and if there are deployment scenarios where glance may need to access an NFS share I'm not against adding this generally to the glance charm.

[Chris MacNaughton (chris.macnaughton)]

My concern with adding it to the charm is that it removes any potential security gains that the glance application gains by being contained

[Michael Iatrou (michael.iatrou)]

Is there a specific benefit to enable this as a charm feature, or is it enough to use a custom lxd profile, only when needed, as Juju allows us to do?

Would it be sufficient to document the NFS use case for Glance, as a combination of using https://jaas.ai/u/bootstack-charmers/fstab-config/ for handling the NFS share and the appropriate
lxd-profile.yaml?

[Jeff Hillman (jhillman)]

RE: Comment #5, This MR was submitted earlier this week:

https://review.opendev.org/#/c/737366/

[Chris Sanders (chris.sanders)]

@michael.iatrou

"use a custom lxd profile, only when needed, as Juju allows us to do?"
Unfortunately I believe this to be incorrect. [0][1]

To my knowledge and by those bugs still being open I believe the options are all or nothing for every deploy. That being the case I think the suggesting in comment #5 above is the most sensible approach to supporting NFS for glance.

[0]: https://bugs.launchpad.net/juju/+bug/1844937
[1]: https://bugs.launchpad.net/juju/+bug/1822016

[OpenStack Infra (hudson-openstack)]

Change abandoned by "James Page <email address hidden>" on branch: master
Review: https://review.opendev.org/c/openstack/charm-glance/+/737366