glance-api does not support iscsi cinder backend

[Danny Webb]

There are currently 2 issues stopping glance from being able to use an iscsi backend for cinder:

1) The glance_api container is setup as an unprivileged container which means glance can't use an iscsi cinder backend as it's store.
2) the glance api container is missing mounts for /dev/:/dev/ and iscsi_info:/etc/iscsi which it needs to be able use iscsi

It would be simple enough to add to the volumes:

      - "{{ 'iscsi_info:/etc/iscsi' if enable_cinder | bool and enable_cinder_backend_iscsi | bool }} "
      - "{{ '/dev/:/dev/' if enable_cinder | bool and enable_cinder_backend_iscsi | bool }}"

and to the glance-api service:

  privileged: "{{ True if enable_cinder | bool and enable_cinder_backend_iscsi | bool | else False}}"

** https://bugzilla.redhat.com/show_bug.cgi?id=1658367

[Danny Webb (dannyswebb)]

worth mentioning that although the redhat triple-o setup has an additional mount (/var/lib/iscsi) I've tested with only /dev/ and iscsi_info and it works fine

**https://github.com/openstack/tripleo-heat-templates/blob/stable/queens/docker/services/glance-api.yaml#L201

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/699910

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/699910
Committed: https://git.openstack.org/cgit/openstack/kolla-ansible/commit/?id=fa49b2692de1b38bfdf47e1468296770d5dfff89
Submitter: Zuul
Branch: master

commit fa49b2692de1b38bfdf47e1468296770d5dfff89
Author: chenxing <email address hidden>
Date: Thu Dec 19 12:03:54 2019 +0800

    Enable Glance to use Cinder iSCSI backend

    To use an iSCSI Cinder backend as its store, glance_api must run
    privileged and have /dev and /etc/iscsi properly mounted

    Co-authored-by: Radosław Piliszek <email address hidden>
    Change-Id: I988d3c9d0564483440ae17203ad88a8049abbea4
    Closes-Bug: #1855695

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/train
Review: https://review.opendev.org/704607

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/stein
Review: https://review.opendev.org/704608

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/704608
Committed: https://git.openstack.org/cgit/openstack/kolla-ansible/commit/?id=be4daa5b4ee968f23083023f4840ac9838391993
Submitter: Zuul
Branch: stable/stein

commit be4daa5b4ee968f23083023f4840ac9838391993
Author: chenxing <email address hidden>
Date: Thu Dec 19 12:03:54 2019 +0800

    Enable Glance to use Cinder iSCSI backend

    To use an iSCSI Cinder backend as its store, glance_api must run
    privileged and have /dev and /etc/iscsi properly mounted

    Co-authored-by: Radosław Piliszek <email address hidden>
    Change-Id: I988d3c9d0564483440ae17203ad88a8049abbea4
    Closes-Bug: #1855695
    (cherry picked from commit fa49b2692de1b38bfdf47e1468296770d5dfff89)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/704607
Committed: https://git.openstack.org/cgit/openstack/kolla-ansible/commit/?id=7c60631e0b46b20ea9462912f23a02a78688aa1b
Submitter: Zuul
Branch: stable/train

commit 7c60631e0b46b20ea9462912f23a02a78688aa1b
Author: chenxing <email address hidden>
Date: Thu Dec 19 12:03:54 2019 +0800

    Enable Glance to use Cinder iSCSI backend

    To use an iSCSI Cinder backend as its store, glance_api must run
    privileged and have /dev and /etc/iscsi properly mounted

    Co-authored-by: Radosław Piliszek <email address hidden>
    Change-Id: I988d3c9d0564483440ae17203ad88a8049abbea4
    Closes-Bug: #1855695
    (cherry picked from commit fa49b2692de1b38bfdf47e1468296770d5dfff89)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/kolla-ansible 8.1.0 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/kolla-ansible 9.0.1 release.

[Radosław Piliszek (yoctozepto)]

Glance still cannot do this:

2020-03-25 17:45:30.418 20 INFO oslo.privsep.daemon [req-e2d4f418-0012-4db5-a7dc-3f65eeb07054 609684595a074556be10f586f5e52fbc 15daa19f9fd742948eda9651dbccd3b4 - default default] Running privsep helper: ['sudo', 'glance-rootwrap', '/etc/glance/rootwrap.conf', 'privsep-helper', '--config-file', '/etc/glance/glance-api.conf', '--privsep_context', 'os_brick.privileged.default', '--privsep_sock_path', '/tmp/tmp2c0ocddc/privsep.sock']
2020-03-25 17:45:30.430 20 WARNING oslo.privsep.daemon [-] privsep log: sudo: no tty present and no askpass program specified
2020-03-25 17:45:30.434 20 CRITICAL oslo.privsep.daemon [req-e2d4f418-0012-4db5-a7dc-3f65eeb07054 609684595a074556be10f586f5e52fbc 15daa19f9fd742948eda9651dbccd3b4 - default default] privsep helper command exited non-zero (1)
2020-03-25 17:45:30.435 20 DEBUG os_brick.utils [req-e2d4f418-0012-4db5-a7dc-3f65eeb07054 609684595a074556be10f586f5e52fbc 15daa19f9fd742948eda9651dbccd3b4 - default default] <== get_connector_properties: exception (17ms) FailedToDropPrivileges('privsep helper command exited non-zero (1)',) trace_logging_wrapper /var/lib/kolla/venv/lib/python3.6/site-packages/os_brick/utils.py:156
2020-03-25 17:45:30.435 20 ERROR glance_store._drivers.cinder [req-e2d4f418-0012-4db5-a7dc-3f65eeb07054 609684595a074556be10f586f5e52fbc 15daa19f9fd742948eda9651dbccd3b4 - default default] Failed to write to volume 305f97f2-3a52-4810-87ba-71df7834617e.: oslo_privsep.daemon.FailedToDropPrivileges: privsep helper command exited non-zero (1)
2020-03-25 17:45:35.641 20 ERROR glance.api.v2.image_data [req-e2d4f418-0012-4db5-a7dc-3f65eeb07054 609684595a074556be10f586f5e52fbc 15daa19f9fd742948eda9651dbccd3b4 - default default] Failed to upload image data due to internal error: oslo_privsep.daemon.FailedToDropPrivileges: privsep helper command exited non-zero (1)
2020-03-25 17:45:35.685 20 ERROR glance.common.wsgi [req-e2d4f418-0012-4db5-a7dc-3f65eeb07054 609684595a074556be10f586f5e52fbc 15daa19f9fd742948eda9651dbccd3b4 - default default] Caught error: privsep helper command exited non-zero (1): oslo_privsep.daemon.FailedToDropPrivileges: privsep helper command exited non-zero (1)

will open new bug.

[Radosław Piliszek (yoctozepto)]

reported: https://bugs.launchpad.net/kolla-ansible/+bug/1869072