<div dir="ltr"><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, 1 Jul 2022 at 07:17, Massimo Sgaravatto <<a href="mailto:massimo.sgaravatto@gmail.com">massimo.sgaravatto@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Converting the image from public to private seems indeed a good idea.<div>Thanks a lot for the hint !</div><div>Cheers, Massimo</div></div><br></blockquote><div><br></div><div>Hi Massimo,</div><div><br></div><div>Turning it into private will cause the very same issue for anyone using the image who was consuming it outside of the project that owns the image. The "hidden" [0] flag was developed for this purpose. Even it does not prevent one to launch new instances from the said image, it will strongly discourage it as the image is not listed in the normal image listings. So if you have a new up to date version of the image, but the old one is still widely in use, turn the old image hidden and unless someone is specifically launching the instance with that old image ID, they will be directed towards your new version.</div><div><br></div><div>As we don't currently have any mechanism separating a user making a call to Glance with one of the clients vs. Nova making the call on behalf of the user, we also have no means to ensure that the image would be consumable for housekeeping purposes while new instances would be prevented. So this was the most user friendly solution we came up with at the time.<br></div><div><br></div><div>[0] <a href="https://specs.openstack.org/openstack/glance-specs/specs/rocky/implemented/glance/operator-image-workflow.html">https://specs.openstack.org/openstack/glance-specs/specs/rocky/implemented/glance/operator-image-workflow.html</a></div><div><br></div><div>- jokke<br> </div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Jun 30, 2022 at 2:56 PM Sean Mooney <<a href="mailto:smooney@redhat.com" target="_blank">smooney@redhat.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On Thu, 2022-06-30 at 14:37 +0200, Massimo Sgaravatto wrote:<br>
> No: I really mean resize<br>
i guess for resize we need to pcy the backing file which we preusmabel <br>
are doing by redownloading the orginal image. it could technically be copied form the souce<br>
host instead but i think if you change the visiableity rahter then blocking download that would<br>
hide it form peopel lookign to create new vms with it in the image list but allow it to consiute<br>
to be used by exsiting instace for rebuild and resize.<br>
> <br>
> On Thu, Jun 30, 2022 at 1:42 PM Sean Mooney <<a href="mailto:smooney@redhat.com" target="_blank">smooney@redhat.com</a>> wrote:<br>
> <br>
> > On Thu, 2022-06-30 at 10:09 +0200, Massimo Sgaravatto wrote:<br>
> > > Dear all<br>
> > > <br>
> > > What is the blessed method to avoid using an image for new virtual<br>
> > machines<br>
> > > without causing problems for existing instances using that image ?<br>
> > > <br>
> > > If I deactivate the image, I then have problems resizing instances using<br>
> > > that image [*]: it claims that image download is forbidden since the<br>
> > image<br>
> > > was deactivated<br>
> > i think you mean rebuilding the instance not resizeing right?<br>
> > resize should not need the image since it should use the image info we<br>
> > embed in the nova<br>
> > in the instance_system_metadata table.<br>
> > <br>
> > im not sure if there is a blessed way but i proably would have changed the<br>
> > visablity to private.<br>
> > <br>
> > <br>
> > > <br>
> > > Thanks, Massimo<br>
> > > <br>
> > > [*]<br>
> > > <br>
> > > <br>
> > > | fault | {'code': 500, 'created':<br>
> > > '2022-06-30T07:57:30Z', 'message': 'Not authorized for image<br>
> > > dd1492d5-17a2-4dc2-a4e3-ec6c99255e4b.', 'details': 'Traceback (most<br>
> > recent<br>
> > > call last):\n File<br>
> > > "/usr/lib/python3.6/site-packages/nova/image/glance.py", line 377, in<br>
> > > download\n context, 2, \'data\', args=(image_id,))\n File<br>
> > > "/usr/lib/python3.6/site-packages/nova/image/glance.py", line 191, in<br>
> > > call\n result = getattr(controller, method)(*args, **kwargs)\n File<br>
> > > "/usr/lib/python3.6/site-packages/glanceclient/common/utils.py", line<br>
> > 670,<br>
> > > in inner\n return RequestIdProxy(wrapped(*args, **kwargs))\n File<br>
> > > "/usr/lib/python3.6/site-packages/glanceclient/v2/images.py", line 255,<br>
> > in<br>
> > > data\n resp, body = self.http_client.get(url)\n File<br>
> > > "/usr/lib/python3.6/site-packages/keystoneauth1/adapter.py", line 395, in<br>
> > > get\n return self.request(url, \'GET\', **kwargs)\n File<br>
> > > "/usr/lib/python3.6/site-packages/glanceclient/common/http.py", line 380,<br>
> > > in request\n return self._handle_response(resp)\n File<br>
> > > "/usr/lib/python3.6/site-packages/glanceclient/common/http.py", line 120,<br>
> > > in _handle_response\n raise exc.from_response(resp,<br>
> > > resp.content)\nglanceclient.exc.HTTPForbidden: HTTP 403 Forbidden: The<br>
> > > requested image has been deactivated. Image data download is<br>
> > > forbidden.\n\nDuring handling of the above exception, another exception<br>
> > > occurred:\n\nTraceback (most recent call last):\n File<br>
> > > "/usr/lib/python3.6/site-packages/nova/compute/manager.py", line 201, in<br>
> > > decorated_function\n return function(self, context, *args, **kwargs)\n<br>
> > > File "/usr/lib/python3.6/site-packages/nova/compute/manager.py", line<br>
> > > 5950, in finish_resize\n context, instance, migration)\n File<br>
> > > "/usr/lib/python3.6/site-packages/oslo_utils/excutils.py", line 227, in<br>
> > > __exit__\n self.force_reraise()\n File<br>
> > > "/usr/lib/python3.6/site-packages/oslo_utils/excutils.py", line 200, in<br>
> > > force_reraise\n raise self.value\n File<br>
> > > "/usr/lib/python3.6/site-packages/nova/compute/manager.py", line 5932, in<br>
> > > finish_resize\n migration, request_spec)\n File<br>
> > > "/usr/lib/python3.6/site-packages/nova/compute/manager.py", line 5966, in<br>
> > > _finish_resize_helper\n request_spec)\n File<br>
> > > "/usr/lib/python3.6/site-packages/nova/compute/manager.py", line 5902, in<br>
> > > _finish_resize\n self._set_instance_info(instance, old_flavor)\n File<br>
> > > "/usr/lib/python3.6/site-packages/oslo_utils/excutils.py", line 227, in<br>
> > > __exit__\n self.force_reraise()\n File<br>
> > > "/usr/lib/python3.6/site-packages/oslo_utils/excutils.py", line 200, in<br>
> > > force_reraise\n raise self.value\n File<br>
> > > "/usr/lib/python3.6/site-packages/nova/compute/manager.py", line 5890, in<br>
> > > _finish_resize\n block_device_info, power_on)\n File<br>
> > > "/usr/lib/python3.6/site-packages/nova/virt/libvirt/driver.py", line<br>
> > 11343,<br>
> > > in finish_migration\n fallback_from_host=migration.source_compute)\n<br>
> > > File "/usr/lib/python3.6/site-packages/nova/virt/libvirt/driver.py",<br>
> > line<br>
> > > 4703, in _create_image\n injection_info, fallback_from_host)\n File<br>
> > > "/usr/lib/python3.6/site-packages/nova/virt/libvirt/driver.py", line<br>
> > 4831,<br>
> > > in _create_and_inject_local_root\n instance, size,<br>
> > fallback_from_host)\n<br>
> > > File "/usr/lib/python3.6/site-packages/nova/virt/libvirt/driver.py",<br>
> > line<br>
> > > 10625, in _try_fetch_image_cache\n<br>
> > > trusted_certs=instance.trusted_certs)\n File<br>
> > > "/usr/lib/python3.6/site-packages/nova/virt/libvirt/imagebackend.py",<br>
> > line<br>
> > > 275, in cache\n *args, **kwargs)\n File<br>
> > > "/usr/lib/python3.6/site-packages/nova/virt/libvirt/imagebackend.py",<br>
> > line<br>
> > > 638, in create_image\n prepare_template(target=base, *args,<br>
> > **kwargs)\n<br>
> > > File "/usr/lib/python3.6/site-packages/oslo_concurrency/lockutils.py",<br>
> > > line 391, in inner\n return f(*args, **kwargs)\n File<br>
> > > "/usr/lib/python3.6/site-packages/nova/virt/libvirt/imagebackend.py",<br>
> > line<br>
> > > 271, in fetch_func_sync\n fetch_func(target=target, *args, **kwargs)\n<br>
> > > File "/usr/lib/python3.6/site-packages/nova/virt/libvirt/utils.py", line<br>
> > > 395, in fetch_image\n images.fetch_to_raw(context, image_id, target,<br>
> > > trusted_certs)\n File<br>
> > > "/usr/lib/python3.6/site-packages/nova/virt/images.py", line 115, in<br>
> > > fetch_to_raw\n fetch(context, image_href, path_tmp, trusted_certs)\n<br>
> > > File "/usr/lib/python3.6/site-packages/nova/virt/images.py", line 106,<br>
> > in<br>
> > > fetch\n trusted_certs=trusted_certs)\n File<br>
> > > "/usr/lib/python3.6/site-packages/nova/image/glance.py", line 1300, in<br>
> > > download\n trusted_certs=trusted_certs)\n File<br>
> > > "/usr/lib/python3.6/site-packages/nova/image/glance.py", line 379, in<br>
> > > download\n _reraise_translated_image_exception(image_id)\n File<br>
> > > "/usr/lib/python3.6/site-packages/nova/image/glance.py", line 1031, in<br>
> > > _reraise_translated_image_exception\n raise<br>
> > > new_exc.with_traceback(exc_trace)\n File<br>
> > > "/usr/lib/python3.6/site-packages/nova/image/glance.py", line 377, in<br>
> > > download\n context, 2, \'data\', args=(image_id,))\n File<br>
> > > "/usr/lib/python3.6/site-packages/nova/image/glance.py", line 191, in<br>
> > > call\n result = getattr(controller, method)(*args, **kwargs)\n File<br>
> > > "/usr/lib/python3.6/site-packages/glanceclient/common/utils.py", line<br>
> > 670,<br>
> > > in inner\n return RequestIdProxy(wrapped(*args, **kwargs))\n File<br>
> > > "/usr/lib/python3.6/site-packages/glanceclient/v2/images.py", line 255,<br>
> > in<br>
> > > data\n resp, body = self.http_client.get(url)\n File<br>
> > > "/usr/lib/python3.6/site-packages/keystoneauth1/adapter.py", line 395, in<br>
> > > get\n return self.request(url, \'GET\', **kwargs)\n File<br>
> > > "/usr/lib/python3.6/site-packages/glanceclient/common/http.py", line 380,<br>
> > > in request\n return self._handle_response(resp)\n File<br>
> > > "/usr/lib/python3.6/site-packages/glanceclient/common/http.py", line 120,<br>
> > > in _handle_response\n raise exc.from_response(resp,<br>
> > > resp.content)\nnova.exception.ImageNotAuthorized: Not authorized for<br>
> > image<br>
> > > dd1492d5-17a2-4dc2-a4e3-ec6c99255e4b.\n'} |<br>
> > <br>
> > <br>
<br>
</blockquote></div>
</blockquote></div></div>