<div dir="ltr">I agree that this is a big deal. I also agree that I don't want to deploy Havana until this is resolved.<div><br></div><div>Worst case scenario: User 1 creates an instance that contains sensitive information then creates a snapshot for backup purposes. User 2 sees User 1's snapshot and launches it. <br>
<div><br></div><div>Can any of the Glance devs chime in on this? Can you confirm reproduction of the issue we have described and explain what's going on here?</div></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">
On Tue, Jan 21, 2014 at 12:04 AM, Scott Devoid <span dir="ltr"><<a href="mailto:devoid@anl.gov" target="_blank">devoid@anl.gov</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">Yup, this is a big deal for us. I can't realistically deploy Havana to my users until this is resolved.<div><br></div><div>Note that my bug reports also cover a number of other undesirable behaviors on the part of glance(-client).</div>
<div><br></div><div>- No checking of the "owner" field against keystone.</div><div>- Listing images does not query for "owner" tenant or username field at the SQL level.</div><div>- By default images are not given an "owner" with "glance image-create".</div>
<div><br></div><div>Presumably there is something wrong with my configuration, but I've followed the Ubuntu installation guide. [1]</div><div><br></div><div>Any help would be appreciated. Otherwise I'll probably disable public access to glance. :(</div>
<div><br></div><div>~ Scott</div><div><br></div><div>[1] <a href="http://docs.openstack.org/havana/install-guide/install/apt/content/" target="_blank">http://docs.openstack.org/havana/install-guide/install/apt/content/</a></div>
</div><div class="HOEnZb"><div class="h5"><div class="gmail_extra">
<br><br><div class="gmail_quote">On Mon, Jan 20, 2014 at 1:22 PM, Joe Topjian <span dir="ltr"><<a href="mailto:joe@topjian.net" target="_blank">joe@topjian.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">I'm running into a similar issue. <div><br></div><div>In a fresh Ubuntu 12.04 Havana environment, do the following, either as an admin user or regular user:</div><div><br></div><div><div>glance image-create --name "CirrOS 1" --disk-format qcow2 --container-format bare --is-public true < cirros-0.3.1-x86_64-disk.img</div>
<div>glance image-list</div><div>glance image-create --name "CirrOS 2" --disk-format qcow2 --container-format bare --is-public false < cirros-0.3.1-x86_64-disk.img</div><div>glance image-list</div></div><div>
<br></div><div>Prior to Havana, the second image-list would display two images: CirrOS 1 and CirrOS 2. Now only the public image is being displayed. </div><div><br></div><div>Additionally, Horizon is only showing one image under Public and no images under "Project".</div>
<div><br></div><div>Someone opened a bug report about this here (<a href="https://bugs.launchpad.net/glance/+bug/1245865" target="_blank">https://bugs.launchpad.net/glance/+bug/1245865</a>) but it was closed. I think it should be re-opened.</div>
<div><br></div><div>This next part probably isn't very good:</div><div><br></div><div>glance image-list --is-public=False</div><div><br></div><div>This will display CirrOS 2. But switch to another user in another tenant and run the command again. CirrOS 2 is still shown. Create a third user in a third tenant, upload CirrOS 3 as private, switch back to user 2, and run the command again. Both private images are shown.</div>
<div><br></div><div>This is the behavior that Scott is describing in this bug report:</div><div><br></div><div><a href="https://bugs.launchpad.net/glance/+bug/1258342" target="_blank">https://bugs.launchpad.net/glance/+bug/1258342</a></div>
<div><br></div><div>So either this is a serious bug in Glance or the way to store and hide images in Glance has changed -- but I have found no documentation supporting that.</div><span><font color="#888888"><div>
<br></div><div>Joe</div></font></span></div><div><div><div class="gmail_extra">
<br><br><div class="gmail_quote">On Mon, Jan 20, 2014 at 4:46 PM, Narayanan, Krishnaprasad <span dir="ltr"><<a href="mailto:narayana@uni-mainz.de" target="_blank">narayana@uni-mainz.de</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hallo all,<br>
<br>
Thanks for your response about the problem "Private images aren't displayed in Horizon".<br>
<br>
Can I know does this bug exist and if not, can I know the procedure for raising it as a bug?<br>
<br>
Best regards,<br>
Krishnaprasad<br>
<br>
-----Original Message-----<br>
From: Jay Pipes [mailto:<a href="mailto:jaypipes@gmail.com" target="_blank">jaypipes@gmail.com</a>]<br>
Sent: Donnerstag, 16. Januar 2014 16:30<br>
To: Narayanan, Krishnaprasad<br>
Cc: Li Ma; <a href="mailto:openstack@lists.openstack.org" target="_blank">openstack@lists.openstack.org</a><br>
Subject: Re: [Openstack] Private images are not displayed in Horizon<br>
<br>
On Thu, 2014-01-16 at 13:59 +0000, Narayanan, Krishnaprasad wrote:<br>
> Hi,<br>
><br>
> The problem that I am facing is as the user who uploaded the image, I am unable to see it in the users account.<br>
<br>
If this is indeed the case, then that is a bug.<br>
<br>
However... make really sure that you are indeed logged in as the tenant that added the image. If you are using something like nova image-list to see your images, ensure that you are not using a cached tenant token by issuing the nova image-list commands with the --no-cache CLI option.<br>
<br>
To set the image as a public image, as an admin, issue the following command with the glance CLI tool:<br>
<br>
glance image-update --is-public=True <IMAGE_UUID><br>
<br>
Best,<br>
-jay<br>
<br>
_______________________________________________<br>
Mailing list: <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a><br>
Post to : <a href="mailto:openstack@lists.openstack.org" target="_blank">openstack@lists.openstack.org</a><br>
Unsubscribe : <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a><br>
</blockquote></div><br></div>
</div></div><br>_______________________________________________<br>
Mailing list: <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a><br>
Post to : <a href="mailto:openstack@lists.openstack.org" target="_blank">openstack@lists.openstack.org</a><br>
Unsubscribe : <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a><br>
<br></blockquote></div><br></div>
</div></div></blockquote></div><br></div>