Copy-on-write cloning of images stopped working

This document (7022657) is provided subject to the disclaimer at the end of this document.

Environment

SUSE OpenStack Cloud 7

Situation

On SOC7 integrated with an external ceph cluster the image in raw format is copied to /var/lib/nova/instances/_base directory on a compute node. Nova-compute.log is showing:

2018-02-05 14:12:47.815 22226 DEBUG oslo_concurrency.processutils [req-8ee777d5-1456-4639-bf31-92feeb4e745f 5a11b2a4399f9246e8b1a6266eb032d6f5c75600ef7555905b0abbf74e14962e e4804e650e7b4197b359ebfd62e5328c - - -] Running cmd (subprocess): rbd import --pool region-2.vms /var/lib/nova/instances/_base/314bf3a91cc2487d593bd699d88f8a7fc6bb26fe 00407ed2-fc37-4c3b-afac-440a464e941b_disk --image-format=2 --id cinder execute /usr/lib/python2.7/site-packages/oslo_concurrency/processutils.py:344

Resolution

Update the corresponding values in /etc/glance/policy.json with:

"delete_image_location": "",
"get_image_location": "",
"set_image_location": "",

Restart the service. Images should be cloned internally now.

Cause

Hardened glance policy.json added the following entries to prevent attacks when "show_multiple_locations" option is being used:

"delete_image_location": "role:admin",
"get_image_location": "role:admin",
"set_image_location": "role:admin",

This change prevents access to the location parameter with default configuration, therefore image is not found for copy-on-write procedure. Instead it is copied to the compute node and back to ceph cluster. Therefore node may run out of disk space and crash.

Additional Information

Option "show_multiple_locations" is marked as deprecated in OpenStack Newton. More information can be found here.

Disclaimer

This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.