Glance now depends on the oslo.limit library to support the unified
quota[1], but parameters of the library are still missing from
glance-api.conf.
This change ensures the parameter of the oslo.limit library are
included in glance-api.conf generated by oslo-config-generator.
[1] 06e6542f153a1ba197361f3f8cb0010c7d2d4285
Closes-Bug: #1946100
Change-Id: I56a2a9d8184f50624239b90dd9bef671c195fb90
oslo.config 4.5.1 contains change I2e1f187feaf4, which makes
the workaround introduced by change Ic40f582f83e0 unnecessary.
Change-Id: Ib7fc2f2082981b1765e901ca5b277fce08221ba8
Related-bug: #1962581
Related-bug: #1962603
This adds a /v2/info/usage API endpoint which exposes to the user
their current limits and usage.
The discovery API does not (appear to) have existing tests, so this
adds a module for that, although only usage tests are added currently.
Implements: blueprint quota-api
Change-Id: I50c98bac50f815bdb9baae024e77afd388f74554
We also update docs since guidance has necessarily changed here.
Change-Id: I7c24a1aa3545f3499a7a2ce30b73e2656666c764
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
Bumping SQLAlchemy to 1.3.14, which is first version supporting
Python 3.9 runtime, this hopefully addresses the issue reported.
Change-Id: I73f0c7c067fcab00a97cd925cad19edd64b6eb45
Closes-Bug: #1957167
This adds some infrastructure to be able to query and honor limits
declared in keystone. It adds a single initial quota value for the
total size of all active images for bootstrapping the tests.
Checking these values is controlled by a new configuration option
that globally enables and disables the checking, defaulting to
False.
Related to blueprint glance-unified-quotas
Change-Id: I8d8f4aaed465486e80be85bc9a5d2c2be7f1ecad
This reverts commit 810417df865c7b4eb71cee4dfee843d65972852b.
The Swift driver not being able to use Trusts had nothing to do
about the store driver itself nor that keystoneauth1 would have
broken the feature, but rather it not having the functionality
in the first place and us not catching that on reviews.
We should figure out how to test this before we try to replace
this code again.
Change-Id: If12a013404296486dc387b099477d1608b24ba63
Closes-Bug: #1916052
To implement proper scope checking, we need some updated libraries that
properly handle tokens and relay that information to the underlying
service. This commit updates the oslo.policy, oslo.context, oslo.log,
and keystonemiddleware requirements to versions that understand all the
various scopes so that we can update the default policies.
Additionally, this commit updates transitive dependencies in
requirements.txt and lower-constraints.txt to install properly with
lower-constraints defined.
Implements: blueprint secure-rbac
Change-Id: I7dec6b9919e7679aff1a0bb5db1e806384730386
As per the community goal of migrating the policy file
the format from JSON to YAML[1], we need to do two things:
1. Change the default value of '[oslo_policy] policy_file''
config option from 'policy.json' to 'policy.yaml' with
upgrade checks.
2. Deprecate the JSON formatted policy file on the project side
via warning in doc and releasenotes.
Also convert the ./glance/tests/etc/policy.json to policy.yaml
file. Replace policy.json to policy.yaml ref from doc and tests.
[1]https://governance.openstack.org/tc/goals/selected/wallaby/migrate-policy-format-from-json-to-yaml.html
Depends-On: https://review.opendev.org/c/openstack/nova/+/773192
Change-Id: I17d0374dd4223688e5f95253802a4ae87377953a
md5 is not an approved algorithm in FIPS mode, and trying to
instantiate a hashlib.md5() will fail when the system is running in
FIPS mode.
md5 is allowed when in a non-security context. There is a plan to
add a keyword parameter (usedforsecurity) to hashlib.md5() to annotate
whether or not the instance is being used in a security context.
In the case where it is not, the instantiation of md5 will be allowed.
See https://bugs.python.org/issue9216 for more details.
Some downstream python versions already support this parameter. To
support these versions, a new encapsulation of md5() has been added to
oslo_utils. See https://review.opendev.org/#/c/750031/
This patch is to replace the instances of hashlib.md5() with this new
encapsulation, adding an annotation indicating whether the usage is
a security context or not.
Reviewers need to pay particular attention as to whether the keyword
parameter (usedforsecurity) is set correctly.
It looks like the usage of md5() here is solely to determine a checksum
of an image.
With this patch and the dependent patch for glance_store, all the
unit and functional tests pass on a FIPS enabled system.
Depends-On: https://review.opendev.org/#/c/756157
Depends-On: https://review.opendev.org/#/c/760160
Change-Id: I3b6d78d9792d4655bf0f4989cf82aced3f27491b
This patch updates the location URL of the legacy images while
upgrading from single cinder store to multiple stores.
It does that with the help of lazy loading logic i.e. while
GET images call, it checks the location URL and metadata
of the image against the configured store ids and updates
images to respective stores on the basis of volume type (comparing
image-volume's type with the configured cinder_volume_type).
Legacy image URL:
cinder://<volume-id>
New image URL:
cinder://<store-id>/<volume-id>
NOTE: bumping lower-constraints/requirements of glance-store to 2.3.0 as
it includes changes[1] that are a hard requirement for cinder multiple
stores to work with glance
[1] https://review.opendev.org/#/c/746556/
Change-Id: I087a89c20813378fea8ff22ddf81d7a10c220db3
Implements: blueprint multiple-cinder-backend-support
This updates lower constraints to versions that will work with py38 so
that when we move to running on focal nodes, which has py38 as its
default py3 runtime, the lower-constraints job will continue to pass.
It also cleans out some secondary requirements that are no longer needed
due to our direct dependencies being updated.
Linters are removed that are kept in the global requirements blacklist
as those are not version tracked and are not relevant for our
lower-constraints unit test runs.
Change-Id: Ie3698c7334b31c2291b41fd3f7e21add0dd6a19b
Signed-off-by: Sean McGinnis <sean.mcginnis@gmail.com>
The default check_str for the "default" policy rule has changed. From
the Queens release until this series it was "role:admin" (prior to
Queens it was "@", which means allow all requests). In order to
accomodate existing policies as best as possible, the default check_str
has been changed back to "".
In the unlikely event that any existing policies are relying on the
default check_str for the "default" rule, they need to start explicitly
specifying it to maintain similar behaviour. This patch adds a
deprecation warning when using the "default" rule without overriding the
value in the policy file.
This will result in users who carry over an unsafe policy file from the
Queens-Train error seeing a warning. Unfortunately it will also result
in a warning for users who no longer supply a policy file and are
relying on the default policies in code.
Change-Id: I3d3ab9b0172521fb42314f2de33ff02985ad4864
Depends-On: https://review.opendev.org/698790
Depends-On: https://review.opendev.org/699299
Oslo Reports enables OpenStack projects to dump Guru Meditation
Reports with useful debugging information on live services
to files or stderr.
Change-Id: I33b6e52870b583c70aa8141ab55d8738beaf5c59
Kombu 4.6.4 causes issues with eventlet 0.23.0 and 0.25.0[1].
Due to an upper-constraint version bump, we're seeing failures
on openstack gate.
This patch fixes the issue.
[1] https://review.opendev.org/#/c/678078
Change-Id: I7e89a9710b6be8b58872d4f44168fcf92b15f711
We add two extra properties for images:
- cinder_encryption_key_id, which stores the encryption key id;
- cinder_encryption_key_deletion_policy, which states whether the secret
key should be deleted on image deletion.
This feature uses the Castellan key manager, and will therefore work
with all its supported backends.
Implements: blueprint barbican-secret-deletion-support
DocImpact
Change-Id: Iacd0b3785ad4cdd06961e6d11967775806e009ff
As a part of vocabulary correction, changed the location
metadata key name from 'backend' to 'store'. Modified
corresponding tests as well.
bp:multi-store-vocabulary-correction
Change-Id: Iae3503cba6be362b372e1fc3e75c2ddb1e99b763
glance_store 0.29.0 introduced backwards incompatible change
breaking multi-store feature that was supposed to be included in
1.0.0 release without any mention in release notes. Revert is in
process and 0.29.1 will be released after. 0.29.0 should not be
used.
Change-Id: I82e0438de5aaed2ef1975a5aa61062637e32a69e
The current cap on jsonschema is breaking
the requirements test.
The global cap was removed with this change
https://review.openstack.org/#/c/649669/
Change-Id: I4dc433267b123e5396e378dfda2e05551896d62a
This change will allow glance services to run on Windows, using
eventlet wsgi for API services.
This change will:
* avoid monkey patching the os module on Windows (which causes Popen
to fail)
* avoiding unavailable signals
* avoid renaming in-use files or leaking handles
* update the check that ensures that just one scrubber process may
run at a time. We can't rely on process names as there might be
wrapper processes that have similar names (no she-bangs on Windows,
so the scripts are called a bit differently). We'll use a global
named mutex instead.
A subsequent change will leverage Windows job objects as a
replacement for process groups, also avoiding forking when spawning
workers.
At the moment, some Glance tests cannot run on Windows, which is
also covered by subsequent patches.
DocImpact
blueprint windows-support
Change-Id: I3bca69638685ceb11a1a316511ad9a298c630ad5
One of the community goals for Stein is to implement a command-line
tool for operators that runs programmable checks that might impact
upgradability.
This commit lays down the basic structure for the upgrade checks and
ties it up to `glance-status` command.
Change-Id: I7fcf5235a76d15dbcb2c49255bc26c2b586cd71c
Story: 2003657
Task: 26135
Since it's no longer used we can stop requiring it.
This also fixes the requirements check job after
change Ib8c1bf08f5fa7463911602b0df19315907c81e04.
Change-Id: I2f165999fbcc208067a265a3bba049fc86943a47
The requirements/upper-constraints file was modified to allow WebOb
1.8.1 by commit 88bafa11deb9bd7595983d97ffabca338f073ba3. This
patch simplifies some Glance code that could handle both WebOb
1.7.4 and 1.8.1 so that it now only handles the latter, and updates
the glance/requirements.txt and glance/lower-constraints.txt to
reflect that we support WebOb 1.8.1+ only.
Change-Id: I03e03013927cc5434aa0d97657d5e7efd8223ee5
Closes-bug: #1770410
Requirement for package eventlet has an exclusion not found in
the global list: set(['<0.21.0', '!=0.20.1', '!=0.18.3'])
vs. set(['!=0.20.1', '!=0.18.3'])
Change-Id: Ieb6f40efde78fc0df42c395f0ed650df5b2d0f77
A lot of keystoneclient has been long deprecated and is slated
for removal. This change removes two usages of keystoneclient
and replaces them with similar functionality in keystoneauth.
Change-Id: I0128a7bb42b0d691600fdd03aac287633c8b2451
xml was considered as vulnerable to different atacks.
It is recommended to replace this library with defused_xml
Change-Id: I2b146dc34ada37a3ed9ecf49513d024a8ca2fb19
Related-Bug: #1625402