[ops][glance][security] looking for metadefs users

Sean Mooney smooney at redhat.com
Thu Mar 11 17:24:26 UTC 2021


On Thu, 2021-03-11 at 21:34 +0530, Abhishek Kekane wrote:
> Hello operators and other people interested in metadefs,
> 
> The Glance team will be giving the metadefs some love in the Xena
> development cycle in order to address OSSN-0088 [0].
> 
> The people who designed and implemented metadefs are long gone, and in
> determining how to fix OSSN-0088, we would like to understand how people
> are actually using them in the wild so we don't restrict them so much as to
> make them useless.

the metadef api was orginally created as a centralised catalog for defineing all
teh tuneable that can be defiend via metadata,extra specs or as attibutes on vairous resouces
across multipel porjects.

https://docs.openstack.org/glance/latest/user/metadefs-concepts.html#background
has a table covering most of them

it was intended to provide a programitc way for clients to discover what option are valid
and is use by horizon and heat to generate uis and validate input.
https://pasteboard.co/JS99sgU.png

the list of available extra specs for the flavor metadta api is generated dirctly form
the metadefs api including the desciption we se for "hw:mem_page_size".

wehere a validator is specifd such as for hw:cpu_policy a drop down list in the case of enums
or other validation can be applied by horizon to the parmaters.
https://github.com/openstack/glance/blob/45749c30c1c02375a85eb17be0ccd983c695953f/etc/metadefs/compute-cpu-pinning.json#L23-L31
        "cpu_policy": {
            "title": "CPU Pinning policy",
            "description": "Type of CPU pinning policy.",
            "type": "string",
            "enum": [
              "shared",
              "dedicated"
            ]
        },


this same information used to be used in heat whan you a heat template to generate and validat
the allowed values for some parmater although i dont knwo if that is still used.
heat certely uses info form nova to get the list of flavor exctra but i belive it also used
this informate when generation the ui for templates that defiled new flavors.

while this was never integratein into the unified openstack client to enabel validation of
flavors,images ectra that was part of the eventual design goal.

at present this is the only openstack api i am currently aware of that allows you to programaticaly
diccover this informateion.

> 
> We are looking for an operator who uses metadefs to give us a walkthrough
> on how you are using them at the Xena (virtual) PTG.  We are planning to
> have this session on 23rd April around 1400 UTC. You can find more details
> about the same in PTG planning etherpad [1]. We are also willing to meet
> outside the PTG schedule in case the current scheduled time might be
> blocking the people. I will also reply to this as a reminder mail once our
> PTG schedule is final.
> 
> If you do not use the metadef API for some reason related to its inability
> to solve a problem, lack of flexibility, or other reasons (but wish you
> could), we would also like to hear about that. We need to know if the
> feature is worth fixing and maintaining going forward.
i still think this is a valueable feature that i which was used more often
it may seam odd now that galce was choosen as the central registry for
storing this information but if this api was removed i think it would be
important for all project that have this type of metadta to have an alternitve metond
to advertise this info.
> 
> And when we say "an operator", we don't mean just one ... ideally, we'd
> like to have a few real-life use cases to consider.
looking at the OSSN https://wiki.openstack.org/wiki/OSSN/OSSN-0088
i am rather suprised that writing to this api was not admin only.
i had alway tought that it was in the past and that readign form it was the only thing
that was globally accessable as a normal user.

i would suggest that one possible fix would be to alter the policy so that writing to this api
is admin only. at the ptg we coudl discuss shoudl that be extended to user too but i dont personally
see a good usecase for normally users to be able to create new metadefs.

disableing it would break the current functionaliyt in horizon so i do not think that would be a good
ensuer experince.

> 
> If this is affecting you (as an operator) then you can reach us either by
> mail or #openstack-glance IRC channel or glance weekly meeting [2] which
> will be held every Thursday around 1400 UTC.
> 
> [0] https://wiki.openstack.org/wiki/OSSN/OSSN-0088
> [1] https://etherpad.opendev.org/p/xena-ptg-glance-planning
> [2] https://etherpad.opendev.org/p/glance-team-meeting-agenda
> 
> 
> Thank you and Best Regards,
> 
> Abhishek Kekane





More information about the openstack-discuss mailing list