Xenapi glance plugin should not try uploading when the auth token in invalid

[Sridevi Koushik]

The glance plugin tries to upload for invalid auth token.
In nova/image/glance, the X-Auth-Token is taken from the context, and passed on to upload. And in the upload_tarball method, the plugin starts to put the headers and upload the image, and only after all the chunks are uploaded it will receive an UnAuthorized response.

Suggested fix:
Suggested approach: Have a "HEAD" call made with the X-Auth-Token. If that returns a 401, then abandon the upload process.
Otherwise, continue with the upload.

[Zhi Yan Liu (lzy-dev)]

Good catch, after talking with basha in irc I know you found this problem in LOG and can't exactly know of the scenarios which caused these, so IMO the first thinking is let's try to reproduce this issue and make sure what's root cause about it? and then make sure why nova using a wrong token to upload image? Is it just since image upload operation take a long time and token expired during the progress? Thanks.

[Sridevi Koushik (sridevik)]

Zhi,

One of the common scenarios in which this occurs is when an image upload is retried.
For eg.
1 Upload returns a 500 and raises a retry able error.
2 While retrying, the auth token has expired. But, it's not identified before hand. Only after the whole upload process finishes, it raises a Unauthorised response.

[Joe Gordon (jogo)]

"Dead hack is a dead hack" https://review.openstack.org/#/c/51132/

[Sean Dague (sdague)]

There is actually an ML thread now about the general architecture issue here. It's way more complicated than a simple bug and probably a bit change to keystone auth protocol

[OpenStack Infra (hudson-openstack)]

Change abandoned by Dan Prince (<email address hidden>) on branch: master
Review: https://review.openstack.org/51132