Nova isn't using rbd direct snapshot when config Nova, Glance to use Ceph storage

[Yaguang Tang]

Tested on MOS8.0, MOS 9.0

When using Ceph as storage backend for Nova,Glance and Cinder, instance snapshot doesn't take the benefit of Ceph rbd direct snapshot which is implemented by this blueprint https://blueprints.launchpad.net/nova/+spec/rbd-instance-snapshots, the root cause is that Nova's compute user of ceph storage has no write permission on Glance's images pool of Ceph.

Here is output of a MOS 8 env:

root@node-5:~# ceph auth list
installed auth entries:

osd.0
        key: AQAYIyBYoTKRFhAA/hX+kv9Ifbi3D7siaWxiUQ==
        caps: [mon] allow profile osd
        caps: [osd] allow *
osd.1
        key: AQAZIyBY+DzzIRAA4pRFbyZbOk4YluBcSDxc/g==
        caps: [mon] allow profile osd
        caps: [osd] allow *
osd.2
        key: AQAZIyBYUaFkIhAAXi0JqyzeOPcJtKu/im8+2w==
        caps: [mon] allow profile osd
        caps: [osd] allow *
osd.3
        key: AQAdIyBYYrvXHhAACMy/FVEGQjc/1eJ9dYbUAw==
        caps: [mon] allow profile osd
        caps: [osd] allow *
osd.4
        key: AQAfIyBYRJ4RAxAADRe0f9fL02jM8eYB+4fFiA==
        caps: [mon] allow profile osd
        caps: [osd] allow *
osd.5
        key: AQAoIyBYo2G1ARAAJFmruttfAWowpJ5jDRD8YA==
        caps: [mon] allow profile osd
        caps: [osd] allow *
osd.6
        key: AQAnIyBYxTWmOhAARt8PgeKacXkI46DcnGV/Ug==
        caps: [mon] allow profile osd
        caps: [osd] allow *
osd.7
        key: AQAsIyBYiPM3JRAAB6pqrrn3t4/sasCcEGOQlw==
        caps: [mon] allow profile osd
        caps: [osd] allow *
osd.8
        key: AQA2IyBY1OEsGRAAJK/ByRLpePiIKkyM4iNpBw==
        caps: [mon] allow profile osd
        caps: [osd] allow *
client.admin
        key: AQCbFiBYFpAPLhAAHHiuziNMdYvFi2ntYA3d4Q==
        caps: [mds] allow
        caps: [mon] allow *
        caps: [osd] allow *
client.backups
        key: AQBoJCBYFMazNBAApsoqmuSwGJk62GFk/VwG/w==
        caps: [mon] allow r
        caps: [osd] allow class-read object_prefix rbd_children, allow rwx pool=backups, allow rwx pool=volumes
client.bootstrap-mds
        key: AQCcFiBYzGe4GxAAEqHfAlZHhEF5/I8bCokrOg==
        caps: [mon] allow profile bootstrap-mds
client.bootstrap-osd
        key: AQCcFiBYUiXPABAAV7h+FzcgLBuWAjm4AkspBg==
        caps: [mon] allow profile bootstrap-osd
client.bootstrap-rgw
        key: AQCcFiBYEjI3DxAAL5Xgu31flbbSZq4HuXuxRg==
        caps: [mon] allow profile bootstrap-rgw
client.compute
        key: AQChJCBYmX6zORAAQkjpehi/Zu5tgaH0u9vlpg==
        caps: [mon] allow r
        caps: [osd] allow class-read object_prefix rbd_children, allow rwx pool=volumes, allow rx pool=images, allow rwx pool=compute
client.images
        key: AQBmJCBY/xp7ABAAVeNRf/312lAGyIf2e5eZkw==
        caps: [mon] allow r
        caps: [osd] allow class-read object_prefix rbd_children, allow rwx pool=images
client.radosgw.gateway
        key: AQCxFiBYhoqDIxAACJ+URYYxnZJUuOvE445zBQ==
        caps: [mon] allow rw
        caps: [osd] allow rwx
client.volumes
        key: AQBnJCBYw8GyBBAAsPsOlbRE4DRHt0kIBCuoqw==
        caps: [mon] allow r
        caps: [osd] allow class-read object_prefix rbd_children, allow rwx pool=volumes, allow rx pool=images

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/newton
Review: https://review.openstack.org/405062

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/397551
Committed: https://git.openstack.org/cgit/openstack/fuel-library/commit/?id=129fbe2a8f522bbe2ae96c1b23229b1fe3967c6c
Submitter: Jenkins
Branch: master

commit 129fbe2a8f522bbe2ae96c1b23229b1fe3967c6c
Author: Yaguang Tang <email address hidden>
Date: Tue Nov 15 14:33:52 2016 +0800

    Grant Compute user write permission to Glance images pool

    Nova has implemented instance rbd snapshot feature to reduce snapshot
    time, to use this feature, Nova requires write permission to Glance
    images pool.

    Closes-Bug: #1641815

    Change-Id: I0d57d3fb352c68309432084c68d1d24e4f6ce8b6

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/405062
Committed: https://git.openstack.org/cgit/openstack/fuel-library/commit/?id=e02f1b4cd70bff705bc5f187df042f5ff2388687
Submitter: Jenkins
Branch: stable/newton

commit e02f1b4cd70bff705bc5f187df042f5ff2388687
Author: Yaguang Tang <email address hidden>
Date: Tue Nov 15 14:33:52 2016 +0800

    Grant Compute user write permission to Glance images pool

    Nova has implemented instance rbd snapshot feature to reduce snapshot
    time, to use this feature, Nova requires write permission to Glance
    images pool.

    Closes-Bug: #1641815

    Change-Id: I0d57d3fb352c68309432084c68d1d24e4f6ce8b6

[Dmitry Pyzhov (dpyzhov)]

@Yaguang, could you create backport for stable/mitaka branch, please?

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/mitaka
Review: https://review.openstack.org/407410

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/407410
Committed: https://git.openstack.org/cgit/openstack/fuel-library/commit/?id=d891b4fd30677acb112e7e6b26e36e5c267028cf
Submitter: Jenkins
Branch: stable/mitaka

commit d891b4fd30677acb112e7e6b26e36e5c267028cf
Author: Yaguang Tang <email address hidden>
Date: Tue Dec 6 16:43:25 2016 +0800

    Grant Compute user write permission to Glance images pool

    Nova has implemented instance rbd snapshot feature to reduce snapshot
    time, to use this feature, Nova requires write permission to Glance
    images pool.

    Closes-Bug: #1641815

    Change-Id: I0d57d3fb352c68309432084c68d1d24e4f6ce8b6

[Ekaterina Shutova (eshutova)]

Verified on 9.2 snapshot #650.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/fuel-library 11.0.0.0rc1 release candidate.