Image members CRUD doesn't generate notifications which impacts searchlight RBAC.

[Lakshmi N Sampath]

Image members CRUD doesn't generate notifications which will impact searchlight service by not having latest changes to Image memberships.

If you create an image and later change its members, the members are not updated via notifications. You have to run the index sync again to get the updated member list.

See: https://bugs.launchpad.net/searchlight/+bug/1490697

Membership information is critical for horizon filtering. Typically, a person is allowed to view an image under the following conditions:

 1) The image is owned by the project I am currently logged into.
 2) The image is public
 3) The image is owned by another project which has added me as a member and I have accepted membership to it.

Without current membership information, 3) above is not possible.

See: https://bugs.launchpad.net/searchlight/+bug/1491085

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/221307

[Nikhil Komawar (nikhil-komawar)]

Looks like it's missing vital information in the notifications. So, a good candidate for the RC.

[Flavio Percoco (flaper87)]

I don't think this is an liberty-rc-potential. I'm copying here my feedback on the review:

TBH,

I don't feel comfortable merging this patch as part of RC2. I'm happy to be convinced otherwise but it seems to me it's a bit invasive and it does not feel like a bug fix but rather a "feature" implementation.

I understand this is needed by SearchLight and the motivations behind it but:

1) It's refactoring part of the image members code (specifically the MemberRepo) 2) It adds a new MemberRepo for sending notifications, which is required for this to work but, there hasn't been a bit of discussion on whether sending members information is fine and nor about the format of these notifications.

If you think I'm being super paranoid, please, let me know. But, for an RC2, this just feels too much and it doesn't feel like a bug fix but rather like something that could use a lite-spec (if we had them).

[Flavio Percoco (flaper87)]

After having discussed this a bit further in the drivers meeting, I still think we shouldn't backport this patch. The impact and amount of code seems to be high for an RC2 proposal.

[Ian Cordasco (icordasc)]

I agree with not backporting this patch. I know this complicates things for us in Searchlight, but this isn't the right thing for Glance to do at this stage of the cycle.

[Nikhil Komawar (nikhil-komawar)]

As agreed at the various Glance meetings, this seems an unlikely candidate for liberty RC2 (backport). Hence, removing that tag. (adding it here -- for future ref)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/221307
Committed: https://git.openstack.org/cgit/openstack/glance/commit/?id=4b0ce57c736d406d7a757b2aefb399fe58e3b0ec
Submitter: Jenkins
Branch: master

commit 4b0ce57c736d406d7a757b2aefb399fe58e3b0ec
Author: Lakshmi N Sampath <email address hidden>
Date: Tue Sep 8 19:08:36 2015 +0530

    Fix for Image members not generating notifications

    Image members CRUD doesn't generate notifications which
    is impacting searchlight service by not having latest
    changes to Image memberships.

    If you create an image and later change its members,
    the members are not updated via notifications.
    You have to run the index sync again to get the updated
    member list.

    See: https://bugs.launchpad.net/searchlight/+bug/1490697

    Membership information is critical for horizon filtering.
    Typically, a person is allowed to view an image under the
    following conditions:

    1) The image is owned by the project I am currently logged into.
    2) The image is public
    3) The image is owned by another project which has added me
        as a member and I have accepted membership to it.

    Without current membership information, 3) above is not possible.

    See: https://bugs.launchpad.net/searchlight/+bug/1491085

    Change-Id: Ia56e42d3d8da36cfa419d5c3c7d69c9ccf8974fd
    Closes-Bug: #1441453

[Thierry Carrez (ttx)]

This issue was fixed in the openstack/glance 12.0.0.0b3 development milestone.