VM unshelve failed if verify_glance_signatures enabled

[Andrey Volkov]

Description

If CONF.glance.verify_glance_signatures = True, then it's required
image to have properties related to signature. `nova shelve` command
creates an image without those properties. Thus, `nova unshelve` fails.

Steps to reproduce

1. Set

  [glance]
  verify_glance_signatures = True

and restart Nova compute.

3. nova shelve vm1; nova unshelve vm1

Expected result

vm1 status ACTIVE.

Actual result

vm1 status SHELVED_OFFLOADED and error in log:
ERROR oslo_messaging.rpc.server
cursive.exception.SignatureVerificationError: Signature verification
for the image failed: Required image properties for signature
verification do not exist. Cannot verify signature. Missing property:
img_signature_uuid.

http://ix.io/2jKs

Environment: master

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/723320

[Andrey Volkov (avolkov)]

The following options are available:
1. Add image auto signature for any image Nova puts to Glance.
2. Disable image signature validation for specific operations like unshelve.
3. Make signature for images created by nova manually or e.g. cron script (there could be a race).

For 1. there is a PoC: https://review.opendev.org/723320

[Balazs Gibizer (balazs-gibizer)]

Could you please fix the reproduction steps in your report. What I see there as "[glance]/enable_image_auto_signature = True" is not a valid nova config option.

[Andrey Volkov (avolkov)]

Yeah, bad copy-paste.

s/enable_image_auto_signature/verify_glance_signatures

[Balazs Gibizer (balazs-gibizer)]

Thanks. Now I can reproduce the bug locally.