Comment 1 for bug 1992153

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to kolla-ansible (master)

Reviewed: https://review.opendev.org/c/openstack/kolla-ansible/+/860097
Committed: https://opendev.org/openstack/kolla-ansible/commit/da292982b179d690778fbaaedbe3f9775261150f
Submitter: "Zuul (22348)"
Branch: master

commit da292982b179d690778fbaaedbe3f9775261150f
Author: Radosław Piliszek <email address hidden>
Date: Mon Oct 3 16:49:27 2022 +0200

    Stop showing image locations

    This is generally considered insecure because it may reveal
    sensitive data [1].
    Furthermore, it happens that the default Ceph perms cause fatal
    ERRORs with this setting:
    1) when Glance wants to remove an image, it cannot list children
    because Cinder or Nova might have created a linked volume clone
    behind the scenes and it is put in another pool (volumes/vms)
    which Glance cannot normally access;
    2) when Nova wants to create an image, it lacks permissions
    to write to the images pool.

    Thus, I propose that Kolla Ansible stops setting this by default
    and relies on the working defaults.
    The downside is that this disables optimisations in Cinder and Nova.
    On the other hand, these optimisations have nasty behaviour of
    being linked directly to the original image, preventing its removal.

    [1] https://docs.openstack.org/glance/yoga/configuration/glance_api.html#DEFAULT.show_multiple_locations

    Change-Id: I63ee9a6eefd8593f2169bba34dbb699f413d7cf8
    Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/860093
    Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/860291
    Closes-Bug: #1992153