Split swift and glance storages

[Ivan Berezovskiy]

Fuel deploys glance storage on separate partition mounted to /var/lib/glance. This directory is always owned by glance user. But in case of swift deployment we use /var/lib/glance/node as swift storage directory - it was suggested and implemented as a bug fix for https://bugs.launchpad.net/fuel/+bug/1508482. The problem here that there are permissions conflict for this directory (e.g. https://bugs.launchpad.net/fuel/+bug/1618553). Update or reinstall action with glance-common package triggers post-install script for glance https://review.fuel-infra.org/gitweb?p=openstack-build/glance-build.git;a=blob;f=trusty/debian/glance-common.postinst.in;h=653360ff11a7a11148afc2a996a5ca25d65f5d84;hb=refs/heads/9.0/mitaka#l102
which does:
chown glance:glance -R /var/lib/glance/ /etc/glance/

Anyway it's not a good idea to mix working directories for different services. We need to have separate partition for swift mounted to /var/lib/swift in case of swift enabled.

[Ivan Berezovskiy (iberezovskiy)]

Set Won't fix for 9.X because it will broke possibility to upgrade environments if swift is enabled.

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: stable/mitaka
Review: https://review.openstack.org/364288

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/363820
Committed: https://git.openstack.org/cgit/openstack/fuel-library/commit/?id=1e520c05ee221955adcf545b5a43b046d2e80233
Submitter: Jenkins
Branch: master

commit 1e520c05ee221955adcf545b5a43b046d2e80233
Author: iberezovskiy <email address hidden>
Date: Wed Aug 31 20:10:19 2016 +0300

    Restore swift storage directory permissions after upgrade

    Any update or reinstall glance-common package triggers
    its postinst action with following command:
    chown glance:glance -R /var/lib/glance/ /etc/glance/
    We use /var/lib/glance/node by default as swift storage
    folder http://goo.gl/97VJG2, and reinstallation of
    glance-common breaks swift user access to it, so swift
    services stop working. So, we need to fix /var/lib/glance/node
    folder permissions right after upgrade command.
    Also, the case of adding new controller node for already
    updated cluster is covered.
    This workaround is applied on when swift is enabled.

    Closes-bug: #1618553
    Related-bug: #1619282

    Change-Id: Iea6ce51d6ed9fe42bba1b26b58ba43268a7f880c

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/364288
Committed: https://git.openstack.org/cgit/openstack/fuel-library/commit/?id=a02f3892a93705020b3f18b650f44bbd376b115f
Submitter: Jenkins
Branch: stable/mitaka

commit a02f3892a93705020b3f18b650f44bbd376b115f
Author: iberezovskiy <email address hidden>
Date: Wed Aug 31 20:10:19 2016 +0300

    Restore swift storage directory permissions after upgrade

    Any update or reinstall glance-common package triggers
    its postinst action with following command:
    chown glance:glance -R /var/lib/glance/ /etc/glance/
    We use /var/lib/glance/node by default as swift storage
    folder http://goo.gl/97VJG2, and reinstallation of
    glance-common breaks swift user access to it, so swift
    services stop working. So, we need to fix /var/lib/glance/node
    folder permissions right after upgrade command.
    Also, the case of adding new controller node for already
    updated cluster is covered.
    This workaround is applied on when swift is enabled.

    Closes-bug: #1618553
    Related-bug: #1619282

    Change-Id: Iea6ce51d6ed9fe42bba1b26b58ba43268a7f880c

[Igor Yozhikov (iyozhikov)]

We should not use common directory already assigned for dedicated service, here it is glance.
If we have limitations with partitioning, and we still want to use one storage partition for glance and swift, I'm proposing to do next:

1st variant:
- create /var/lib/storage and mount it as storage partition
- create /var/lib/storage/glance, symlink it to /var/lib/glance and set proper access permissions
- create /var/lib/storage/swift, symlink it to /var/lib/swift and set proper access permissions

2nd variant:
- add user swift into group glance

Otherwise issue will not disappeared because systemd units are checking permissions in pre start stage.
Example:
# systemctl status glance-registry.service
● glance-registry.service - OpenStack Image Service Registry
   Loaded: loaded (/lib/systemd/system/glance-registry.service; enabled; vendor preset: enabled)
   Active: active (running) since Fri 2016-09-16 12:02:18 UTC; 1h 10min ago
  Process: 4547 ExecStartPre=/bin/chown glance:adm /var/log/glance (code=exited, status=0/SUCCESS)
  Process: 4343 ExecStartPre=/bin/chown glance:glance /var/lock/glance /var/lib/glance (code=exited, status=0/SUCCESS)
  Process: 4135 ExecStartPre=/bin/mkdir -p /var/lock/glance /var/log/glance /var/lib/glance (code=exited, status=0/SUCCESS)
 Main PID: 4798 (glance-registry)
   CGroup: /system.slice/glance-registry.service

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/381101

[OpenStack Infra (hudson-openstack)]

Change abandoned by Oleksiy Molchanov (<email address hidden>) on branch: master
Review: https://review.openstack.org/381101

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/382482

[Oleksiy Molchanov (omolchanov)]

We have choosen 1-st approach, Igor proposed at https://bugs.launchpad.net/fuel/+bug/1619282/comments/5

but it seems to be overhead (/var/lib/glance is created by package, so we need to remove it and make a symlink, etc.). So it seems we should implement approach #2.

[Oleksiy Molchanov (omolchanov)]

https://review.openstack.org/382482

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/382482
Committed: https://git.openstack.org/cgit/openstack/fuel-library/commit/?id=6611159b3d0a3d85ec40d843bdfc5a34c7a31f4a
Submitter: Jenkins
Branch: master

commit 6611159b3d0a3d85ec40d843bdfc5a34c7a31f4a
Author: Oleksiy Molchanov <email address hidden>
Date: Wed Oct 5 17:46:04 2016 +0300

    Add swift to glance group

    * Add swift to glance group for proper upgrade process
    * Change swift rsync group
    * Revert Iea6ce51d6ed9fe42bba1b26b58ba43268a7f880c

    Change-Id: I57b4dbaf9838c15612d60846ae27b0fdd01409cc
    Closes-Bug: 1619282

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/newton
Review: https://review.openstack.org/411301

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/mitaka
Review: https://review.openstack.org/411302

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/411302
Committed: https://git.openstack.org/cgit/openstack/fuel-library/commit/?id=7bb9fd2c242c20c24290cf949047ad1b522bd023
Submitter: Jenkins
Branch: stable/mitaka

commit 7bb9fd2c242c20c24290cf949047ad1b522bd023
Author: Oleksiy Molchanov <email address hidden>
Date: Wed Oct 5 17:46:04 2016 +0300

    Add swift to glance group

    * Add swift to glance group for proper upgrade process
    * Change swift rsync group
    * Revert Iea6ce51d6ed9fe42bba1b26b58ba43268a7f880c

    Change-Id: I57b4dbaf9838c15612d60846ae27b0fdd01409cc
    Closes-Bug: 1619282
    Closes-Bug: 1647480
    (cherry picked from commit 6611159b3d0a3d85ec40d843bdfc5a34c7a31f4a)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/411301
Committed: https://git.openstack.org/cgit/openstack/fuel-library/commit/?id=c87a441ec72f5f21d1363d62ab01cd298368584e
Submitter: Jenkins
Branch: stable/newton

commit c87a441ec72f5f21d1363d62ab01cd298368584e
Author: Oleksiy Molchanov <email address hidden>
Date: Wed Oct 5 17:46:04 2016 +0300

    Add swift to glance group

    * Add swift to glance group for proper upgrade process
    * Change swift rsync group
    * Revert Iea6ce51d6ed9fe42bba1b26b58ba43268a7f880c

    Change-Id: I57b4dbaf9838c15612d60846ae27b0fdd01409cc
    Closes-Bug: 1619282
    Closes-Bug: 1647480
    (cherry picked from commit 6611159b3d0a3d85ec40d843bdfc5a34c7a31f4a)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/fuel-library 11.0.0.0rc1 release candidate.