By default show_image_direct_url MUST be set to False

[Pranali Deore]

Revealing image locations can present a GRAVE SECURITY RISK as image locations can sometimes include credentials.
Hence, this is set to 'False' by default in glance-api.conf from the beginning. Set this to True with EXTREME CAUTION and ONLY IF you know what you are doing.

Ref: https://docs.openstack.org/glance/pike/configuration/glance_api.html#DEFAULT.show_image_direct_url

In tripleo, this is set to "True" by default in patch[1]
[1]: https://review.openstack.org/#/c/226324/

But this should be requirement specific rather than setting to 'true' by default to prevent security risk.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/tripleo-heat-templates/+/863142

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/tripleo-heat-templates/+/863142
Committed: https://opendev.org/openstack/tripleo-heat-templates/commit/d60969cb55344e9004721dee04ed1d685d95a39f
Submitter: "Zuul (22348)"
Branch: master

commit d60969cb55344e9004721dee04ed1d685d95a39f
Author: Alan Bishop <email address hidden>
Date: Thu Nov 24 10:06:19 2022 -0800

    Deploy separate glance-api services for OSSN-0090

    This patch adopts the recommendation outlined in OSSN-0090 [1], in
    which two instances of the glance-api service are deployed:
    - A "user facing" glance-api service, accessible via the Public
      keystone endpoint.
    - An "internal facing only" service, accessible via the Admin and
      Internal keystone endpoints.

    The user facing instance is configured so it does not report any image
    location information. This is achieved by configuring glance-api.conf
    with the show_image_direct_url and show_multiple_locations set to False.

    The internal service operates on a separate TCP port (defaults to 9293)
    with its own glance-api.conf that configures show_image_direct_url and
    show_multiple_locations set to True.

    In order for cinder and nova to have access to the image location data,
    both services are configured to access glance via the internal service.

    [1] https://wiki.openstack.org/wiki/OSSN/OSSN-0090

    Closes-Bug: #1822540
    Depends-On: Ideb5a951d538d9e2c7cca11dfe0e8b99520de959
    Depends-On: Ib6188505197d0a267dbd8c4d96f12f31f7b5c9f0
    Change-Id: Id093613f9d410eb3fe5564a724c0f75275eeb4e8

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/zed
Review: https://review.opendev.org/c/openstack/tripleo-heat-templates/+/865875

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/wallaby
Review: https://review.opendev.org/c/openstack/tripleo-heat-templates/+/865885

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/tripleo-heat-templates 18.0.0 release.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/tripleo-heat-templates/+/865875
Committed: https://opendev.org/openstack/tripleo-heat-templates/commit/0ba612d07de84e95c0e11ef090bcd22f1da584e7
Submitter: "Zuul (22348)"
Branch: stable/zed

commit 0ba612d07de84e95c0e11ef090bcd22f1da584e7
Author: Alan Bishop <email address hidden>
Date: Thu Nov 24 10:06:19 2022 -0800

    Deploy separate glance-api services for OSSN-0090

    This patch adopts the recommendation outlined in OSSN-0090 [1], in
    which two instances of the glance-api service are deployed:
    - A "user facing" glance-api service, accessible via the Public
      keystone endpoint.
    - An "internal facing only" service, accessible via the Admin and
      Internal keystone endpoints.

    The user facing instance is configured so it does not report any image
    location information. This is achieved by configuring glance-api.conf
    with the show_image_direct_url and show_multiple_locations set to False.

    The internal service operates on a separate TCP port (defaults to 9293)
    with its own glance-api.conf that configures show_image_direct_url and
    show_multiple_locations set to True.

    In order for cinder and nova to have access to the image location data,
    both services are configured to access glance via the internal service.

    [1] https://wiki.openstack.org/wiki/OSSN/OSSN-0090

    stable/zed:
      Backports include I456b4235242cae125f5ad4cd9cc7415f2699462c, which
      fixed a typo in the original patch.

    Closes-Bug: #1822540
    Depends-On: https://review.opendev.org/c/openstack/puppet-tripleo/+/865874
    Depends-On: https://review.opendev.org/c/openstack/tripleo-common/+/865873
    Change-Id: Id093613f9d410eb3fe5564a724c0f75275eeb4e8
    (cherry picked from commit d60969cb55344e9004721dee04ed1d685d95a39f)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/tripleo-heat-templates/+/865885
Committed: https://opendev.org/openstack/tripleo-heat-templates/commit/3605d45e417a77a1d0f153fbeffcbb283ec85fe6
Submitter: "Zuul (22348)"
Branch: stable/wallaby

commit 3605d45e417a77a1d0f153fbeffcbb283ec85fe6
Author: Alan Bishop <email address hidden>
Date: Thu Nov 24 10:06:19 2022 -0800

    Deploy separate glance-api services for OSSN-0090

    This patch adopts the recommendation outlined in OSSN-0090 [1], in
    which two instances of the glance-api service are deployed:
    - A "user facing" glance-api service, accessible via the Public
      keystone endpoint.
    - An "internal facing only" service, accessible via the Admin and
      Internal keystone endpoints.

    The user facing instance is configured so it does not report any image
    location information. This is achieved by configuring glance-api.conf
    with the show_image_direct_url and show_multiple_locations set to False.

    The internal service operates on a separate TCP port (defaults to 9293)
    with its own glance-api.conf that configures show_image_direct_url and
    show_multiple_locations set to True.

    In order for cinder and nova to have access to the image location data,
    both services are configured to access glance via the internal service.

    [1] https://wiki.openstack.org/wiki/OSSN/OSSN-0090

    stable/zed:
      Backports include I456b4235242cae125f5ad4cd9cc7415f2699462c, which
      fixed a typo in the original patch.

    stable/wallaby:
      Minor conflicts were due to using the hiera() versus lookup() functions.
      The biggest conflict was due to Ibf2e0d183dd51421c4feb7467c3c01fb416d2965,
      in which the endpoint map is no longer generated from endpoint_data.yaml
      (as it is in wallaby).

    Closes-Bug: #1822540
    Depends-On: https://review.opendev.org/c/openstack/puppet-tripleo/+/865884
    Depends-On: https://review.opendev.org/c/openstack/tripleo-common/+/865883
    Change-Id: Id093613f9d410eb3fe5564a724c0f75275eeb4e8
    (cherry picked from commit d60969cb55344e9004721dee04ed1d685d95a39f)
    (cherry picked from commit 0ba612d07de84e95c0e11ef090bcd22f1da584e7)