Glance client doesn't properly honor noauth

[Josh Gachnang]

There is no way to set the Glance client to use noauth. service_utils.py currently sets auth_strategy to None, which 'noauth' is more appropriate. If setting auth_strategy to None is valid in some cases, then there should be a separate way to signal noauth when communicating with Glance.

[Josh Gachnang (joshnang)]

I've been using noauth for some of our testing and have the fix for this in the agent driver patch, but it should be broken out to address this separately.

[Dmitry Tantsur (divius)]

Hi Josh! You're assigned to this bug, but status is New. Could you update either status or assignee accordingly?

[Dmitry Tantsur (divius)]

Also, auth_strategy seems to be set from configuration inside image_service.py. There's nothing related in service_utils.py. Could you specify what exactly the problem is?

[Josh Gachnang (joshnang)]

Ahh yes I wasn't very clear here. So, is_image_available does some checks, and really, the whole thing should be short circuited if CONF.glance.auth_strategy == 'noauth'. The current change is here: https://review.openstack.org/#/c/84795/96/ironic/common/glance_service/service_utils.py. I'm not convinced that is the best way to handle it, but it did work in my testing.

[Dmitry Tantsur (divius)]

Got it, thank you. Please separate that change from the agent patch and mark it as fixing this bug

[Dmitry Tantsur (divius)]

Hi Josh! Could you give a status update on this bug? Does it still need to be fixed?

[Josh Gachnang (joshnang)]

It should be fixed! I'll propose something today (since I already wrote the code and just need to pull it from the abandoned patch)

[Josh Gachnang (joshnang)]

Looking at the code, it already handles noauth. I think we had something misconfigured in our Glance that made me think there was a bug.