Focus is on usability, by default in a stable/pike cloud taken with minimal knowledge of openstack-ansible and openstack the user isn't allowed to upload images to Glance from Horizon.
I run stable/pike of openstack-ansible but I don't think this is fixed in Master either.
Default Values:
horizon_images_upload_mode: 'direct'
glance_show_multiple_locations: False
No CORS override in GLANCE
Changes I made:
glance_show_multiple_locations: True
Add ORIGIN to CORS:
# Please define external_horizon_fqdn below
#external_horizon_fqdn:
cors_overrides:
cors:
# LP bug 1680062
allow_headers: origin,content-md5,x-image-meta-checksum,x-storage-token,accept-encoding,x-auth-token,x-identity-status,x-roles,x-service-catalog,x-user-id,x-tenant-id,x-openstack-request-id
# if you don't define external_horizon_fqdn, this will default to any ip, which is insecure.
allowed_origin: "{{ external_horizon_fqdn | default('*') }}"
allow_methods: "GET,POST,PUT,PATCH,DELETE"
## Glance
glance_glance_api_conf_overrides: "{{ cors_overrides }}"
glance_show_multiple_locations: True
## Horizon
horizon_images_upload_mode: 'direct'
# Skip verification of SSL certs (Set to True when using self-signed certs)
horizon_ssl_no_verify: True
The horizon_ssl_no_verify: True was required for me because I used self-signed certs. It'd be nice if we can detect if self-signed certs were gen'd and toggle that to True. Only needed for this bug in the case of glance-api using self-signed certs but if self-signed certs are used for the other api's it may be best to toggle this.
From Freenode #openstack-glance.
<me>
hey, running stable/pike from openstack-ansible ... in glance i have show_multiple_locations = False and i have policy.json configured for "" for (delete, get, set)_image_location and i get 403 Forbidden: It's not allowed to add locations if locations are invisible. (HTTP 403) ... if i set show_image_location to True it all works but it get a log message about deprecation ... at point does show_image_location go away and defer to rbac?
<rosmaita>
idlemind show_multiple_locations will not go away for queens, there are some complications making it difficult to remove that setting and use rbac only ... we plan to come up with a solution during the Rocky planning sessions at the PTG in Dublin at the end of february
So based on the comment from rosmaita this won't be fixed until Rocky. Fixed being relying on RBAC which is configured correctly in policy.json. At which point we could drop glance_show_multiple_locations = True.
Possible Solutions:
glance_show_multiple_locations: {{ horizon_image_upload_mode == 'direct' }}
horizon_ssl_no_verify: {{ <True if Self-Signed Certs Are Used, Self-Signed Certs are the Default, so Default this to True???> }}
Include the CORS blob at least for openstack-ansible stable/pike
Similar discussion in https:/
Not as detailed of a fix and suggests setting the upload_mode to 'remote' which I'm thinking causes it to actually default to 'legacy'