)]}'
{"specs/mitaka/glance-trusts.rst":[{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"869a3cdcae7682c329c3450ba6b5f581a04845c5","unresolved":false,"context_lines":[{"line_number":21,"context_line":"fails with Unauthorized error because Glance backend (f.e. Swift) cannot"},{"line_number":22,"context_line":"authorize in Keystone. As a result a user have to restart image upload."},{"line_number":23,"context_line":"Sometimes he have to extend expiration time in Keystone because Glance uploads"},{"line_number":24,"context_line":"the image too long. Both cases do not make users happy."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"Proposed change"},{"line_number":27,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a2ca52d_175a8a2a","line":24,"updated":"2015-10-16 13:34:54.000000000","message":"The problem is more general than uploading big images.\n\nStrictly speaking, any time Glance makes an OpenStack API request using a token it can potentially fail if the user\u0027s token expires.\n\nThis includes both short lived requests such as:\n\n* API -\u003e registry requests (image list, show, update etc)\n* Sharing images (multi-tenant Swift case) \n\nAnd (more likely) long lived requests such as:\n\n* image download (via swift, not cache or other backing store)\n* image upload (via swift)\n* image import\n\nIf we\u0027re scoping this to just image upload that\u0027s ok, but we should be clear about which of these we\u0027re trying to address.","commit_id":"84c3294b6edca4ebe8122e0a8ebce959ca2d330f"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"869a3cdcae7682c329c3450ba6b5f581a04845c5","unresolved":false,"context_lines":[{"line_number":38,"context_line":"created during deployment. So only this service user can impersonate the true"},{"line_number":39,"context_line":"user with trusts."},{"line_number":40,"context_line":"If other services (like Nova, Cinder) will use trusts authentication for"},{"line_number":41,"context_line":"Glance then the generated trust should support re-delegation. Re-delegation"},{"line_number":42,"context_line":"allows to use trusts passed to other services for Glance."},{"line_number":43,"context_line":"Please also note that trusts is part of Keystone v3 API so Glance should"},{"line_number":44,"context_line":"support V3 API to receive a token."}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a2ca52d_b704f649","line":41,"updated":"2015-10-16 13:34:54.000000000","message":"I\u0027m new to trusts delegation so may be misunderstanding here ...\n\n(Everything I know about trusts is covered in this really good explanation:  https://elmiko.github.io/2014/06/10/keystone-trust-delegation.html)\n\nAre Nova/Cinder (as users of the Glance API) relevant here?\n\nIf Nova sends us a trust based token -- that they created -- don\u0027t *they* have to ensure that it is \u0027redelegatable[1]\u0027?\n\nAny trust created by Glance would only need to be redelegatable if, for example, Swift needed to make a potentially long lived API call to another OpenStack service. But I don\u0027t think that is the case.\n\n[1] Is that a word? :-)","commit_id":"84c3294b6edca4ebe8122e0a8ebce959ca2d330f"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"869a3cdcae7682c329c3450ba6b5f581a04845c5","unresolved":false,"context_lines":[{"line_number":59,"context_line":"---------------"},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"REST API will extract value of X-Auth-Token header from request and use it"},{"line_number":62,"context_line":"as trust_id if trust authorization is turned on in Glance."},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"Security impact"},{"line_number":65,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a2ca52d_9701ba08","line":62,"updated":"2015-10-16 13:34:54.000000000","message":"I\u0027d like us to provide details of the specific keystone trust API calls which will be used to generate and use trusts, including examples (eg for an upload).\n\nWe should include details of trustor, trustee, relevant project ids, roles etc.\n\nThis helps to understand exactly what we\u0027re proposing.","commit_id":"84c3294b6edca4ebe8122e0a8ebce959ca2d330f"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"869a3cdcae7682c329c3450ba6b5f581a04845c5","unresolved":false,"context_lines":[{"line_number":65,"context_line":"---------------"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"Heat already supports trusts by default. To prevent from impersonating users"},{"line_number":68,"context_line":"by malefactors Glance delegates a trust role to glance_service_user only."},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"Notifications impact"},{"line_number":71,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a2ca52d_faf013ff","line":68,"updated":"2015-10-16 13:34:54.000000000","message":"Who is the glance_service_user?\nWhat is a trust role? (Do you mean \u0027role\u0027 as in keystone \u0027role\u0027 here?)\nExamples will probably help clear this up.","commit_id":"84c3294b6edca4ebe8122e0a8ebce959ca2d330f"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"869a3cdcae7682c329c3450ba6b5f581a04845c5","unresolved":false,"context_lines":[{"line_number":77,"context_line":""},{"line_number":78,"context_line":"Trust authentication must be also implemented by python-glanceclient."},{"line_number":79,"context_line":"The client will generate a trust based on user credentials and passes it to"},{"line_number":80,"context_line":"Glance."},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"Performance Impact"},{"line_number":83,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a2ca52d_7a53a3e2","line":80,"updated":"2015-10-16 13:34:54.000000000","message":"I don\u0027t quite follow this. (Again my understanding may just be wrong.)\n\nWhy doesn\u0027t glance use the user\u0027s token to generate a trust?\n\nHow can the user know who the trustee should be?","commit_id":"84c3294b6edca4ebe8122e0a8ebce959ca2d330f"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"869a3cdcae7682c329c3450ba6b5f581a04845c5","unresolved":false,"context_lines":[{"line_number":89,"context_line":""},{"line_number":90,"context_line":"To deploy Glance with trusts the following config should be defined:"},{"line_number":91,"context_line":"- glance_service_user must be created in Keystone"},{"line_number":92,"context_line":"- glance_image_owner must be created in Keystone and assigned to user"},{"line_number":93,"context_line":"- trust authorization must be turned on in Glance"},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"Developer impact"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a2ca52d_3a91ab47","line":92,"updated":"2015-10-16 13:34:54.000000000","message":"Is this a role? A user? A project?","commit_id":"84c3294b6edca4ebe8122e0a8ebce959ca2d330f"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"869a3cdcae7682c329c3450ba6b5f581a04845c5","unresolved":false,"context_lines":[{"line_number":97,"context_line":""},{"line_number":98,"context_line":"Nova, Cinder and other third party software that using Glance should"},{"line_number":99,"context_line":"support trust authorization also. Moreover, the trust generated by these"},{"line_number":100,"context_line":"programs should support trust re-delegation."},{"line_number":101,"context_line":""},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"Implementation"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a2ca52d_7a1e43bc","line":100,"updated":"2015-10-16 13:34:54.000000000","message":"More information why this is being proposed rather than using the standard token by the service to generate the trust would be helpful.\n\nIn a world where Glance must expect either a \u0027trust scoped token\u0027 or an old-fashioned token, how do we distinguish between them? (Would we need to?)\n\n(Or are we saying we only support one of these auth modes at a time?)","commit_id":"84c3294b6edca4ebe8122e0a8ebce959ca2d330f"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"e922ea70e354f1c4bae6820edf96b72362b7a0a7","unresolved":false,"context_lines":[{"line_number":17,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"Keystone tokens have some restricted lifetime. As soon as token expired a user"},{"line_number":20,"context_line":"cannot execute any Glance operation that requires Keystone authentication."},{"line_number":21,"context_line":"That\u0027s not convenient for long-lived request where a token expires during"},{"line_number":22,"context_line":"request execution. In the current implementation we have two types of"},{"line_number":23,"context_line":"long-lived requests:"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a29b11f_8c8726b4","line":20,"updated":"2015-10-23 11:51:48.000000000","message":"\"As soon as token expired a user cannot execute any Glance operation that requires Keystone authentication.\"\n\nThis wording is a little unclear. It seems to suggest that there is a problem if a user supplies Glance with an already expired token. There is nothing Glance can do if a user gives glance a token which has already expired. We are handling the case where a user gives us a token which has not yet expired.\n\nMaybe something like:\n\n\"After the user token has expired any request initiated by Glance which needs a valid user token will fail. This will cause the original user\u0027s request to also fail, even though the token was originally valid when passed to Glance.\"","commit_id":"ceb18bc58daad9dd45bf5f487ceeec7283c22c8b"},{"author":{"_account_id":14676,"name":"Kairat Kushaev","email":"kkushaev@mirantis.com","username":"kairat_kushaev"},"change_message_id":"0405583e848ebc66bb11b1dc2dc3e06bc7a35294","unresolved":false,"context_lines":[{"line_number":17,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"Keystone tokens have some restricted lifetime. As soon as token expired a user"},{"line_number":20,"context_line":"cannot execute any Glance operation that requires Keystone authentication."},{"line_number":21,"context_line":"That\u0027s not convenient for long-lived request where a token expires during"},{"line_number":22,"context_line":"request execution. In the current implementation we have two types of"},{"line_number":23,"context_line":"long-lived requests:"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a29b11f_18823ec9","line":20,"in_reply_to":"3a29b11f_8c8726b4","updated":"2015-10-26 12:57:23.000000000","message":"Done.","commit_id":"ceb18bc58daad9dd45bf5f487ceeec7283c22c8b"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"e922ea70e354f1c4bae6820edf96b72362b7a0a7","unresolved":false,"context_lines":[{"line_number":19,"context_line":"Keystone tokens have some restricted lifetime. As soon as token expired a user"},{"line_number":20,"context_line":"cannot execute any Glance operation that requires Keystone authentication."},{"line_number":21,"context_line":"That\u0027s not convenient for long-lived request where a token expires during"},{"line_number":22,"context_line":"request execution. In the current implementation we have two types of"},{"line_number":23,"context_line":"long-lived requests:"},{"line_number":24,"context_line":"- image-upload needs to authenticate in Glance Registry when changing image"},{"line_number":25,"context_line":"status. It also requires an authentication in glance_store when storage"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a29b11f_3fb3924e","line":22,"updated":"2015-10-23 11:51:48.000000000","message":"It\u0027s also not convenient for short-lived requests where a token expires during request execution.\n\nWe should state that, and say whether or not we plan to fix the short-lived requests.","commit_id":"ceb18bc58daad9dd45bf5f487ceeec7283c22c8b"},{"author":{"_account_id":14676,"name":"Kairat Kushaev","email":"kkushaev@mirantis.com","username":"kairat_kushaev"},"change_message_id":"0405583e848ebc66bb11b1dc2dc3e06bc7a35294","unresolved":false,"context_lines":[{"line_number":19,"context_line":"Keystone tokens have some restricted lifetime. As soon as token expired a user"},{"line_number":20,"context_line":"cannot execute any Glance operation that requires Keystone authentication."},{"line_number":21,"context_line":"That\u0027s not convenient for long-lived request where a token expires during"},{"line_number":22,"context_line":"request execution. In the current implementation we have two types of"},{"line_number":23,"context_line":"long-lived requests:"},{"line_number":24,"context_line":"- image-upload needs to authenticate in Glance Registry when changing image"},{"line_number":25,"context_line":"status. It also requires an authentication in glance_store when storage"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a29b11f_98e40ead","line":22,"in_reply_to":"3a29b11f_3fb3924e","updated":"2015-10-26 12:57:23.000000000","message":"I know that pre-mature optimization is a bad idea:) but it seems that short-lived requests should be managed without trust creation (another alternative would be create separate config for long-lived and short-lived requests). Otherwise we potentially could have performance troubles because token operations will take a lot of time for each request.","commit_id":"ceb18bc58daad9dd45bf5f487ceeec7283c22c8b"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"e922ea70e354f1c4bae6820edf96b72362b7a0a7","unresolved":false,"context_lines":[{"line_number":23,"context_line":"long-lived requests:"},{"line_number":24,"context_line":"- image-upload needs to authenticate in Glance Registry when changing image"},{"line_number":25,"context_line":"status. It also requires an authentication in glance_store when storage"},{"line_number":26,"context_line":"backend is Swift and Glance uploads an image in chunks."},{"line_number":27,"context_line":"- image-download needs to authenticate when downloading image  in chunks from"},{"line_number":28,"context_line":"Swift backend."},{"line_number":29,"context_line":"Once token expired user have to re-execute the request again which is not"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a29b11f_1f1fb6b7","line":26,"updated":"2015-10-23 11:51:48.000000000","message":"When talking about Swift Large Objects, the \"sub objects\" are called \"segments\" rather than chunks (despite what our code may say) :-)\n\nFor each segment that Glance writes, the token needs to be valid at that point in time -- swift will validate it using the keystone middleware. (The auth is not done in glance_store per se.)","commit_id":"ceb18bc58daad9dd45bf5f487ceeec7283c22c8b"},{"author":{"_account_id":14676,"name":"Kairat Kushaev","email":"kkushaev@mirantis.com","username":"kairat_kushaev"},"change_message_id":"0405583e848ebc66bb11b1dc2dc3e06bc7a35294","unresolved":false,"context_lines":[{"line_number":23,"context_line":"long-lived requests:"},{"line_number":24,"context_line":"- image-upload needs to authenticate in Glance Registry when changing image"},{"line_number":25,"context_line":"status. It also requires an authentication in glance_store when storage"},{"line_number":26,"context_line":"backend is Swift and Glance uploads an image in chunks."},{"line_number":27,"context_line":"- image-download needs to authenticate when downloading image  in chunks from"},{"line_number":28,"context_line":"Swift backend."},{"line_number":29,"context_line":"Once token expired user have to re-execute the request again which is not"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a29b11f_531097a8","line":26,"in_reply_to":"3a29b11f_1f1fb6b7","updated":"2015-10-26 12:57:23.000000000","message":"Hmm, AFAIK glance_store creates a chunk(\u003dsegment) when uploading large object in glance:\nhttps://github.com/openstack/glance_store/blob/master/glance_store/_drivers/swift/store.py#L551-L553","commit_id":"ceb18bc58daad9dd45bf5f487ceeec7283c22c8b"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"e922ea70e354f1c4bae6820edf96b72362b7a0a7","unresolved":false,"context_lines":[{"line_number":25,"context_line":"status. It also requires an authentication in glance_store when storage"},{"line_number":26,"context_line":"backend is Swift and Glance uploads an image in chunks."},{"line_number":27,"context_line":"- image-download needs to authenticate when downloading image  in chunks from"},{"line_number":28,"context_line":"Swift backend."},{"line_number":29,"context_line":"Once token expired user have to re-execute the request again which is not"},{"line_number":30,"context_line":"good in cases when Glance uploads big images. In order to prevent this"},{"line_number":31,"context_line":"situation Glance requires some mechanism that allow to finish the request if"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a29b11f_c2a6450e","line":28,"updated":"2015-10-23 11:51:48.000000000","message":"To expand on this a little:\n\nWhen we download a Large Object from Swift, the fact that it is made of segments is hidden from us. From a user and auth point of view it is no different from downloading a non-Large Object. Swift will only validate the token once (not once per segment).\n\nWhere trusts will help is (as you say above) when updating the state with the registry, and also we do have some retry logic where we re-connect to swift in the case of a dropped connection. When we reconnect Swift will repeat the token auth.","commit_id":"ceb18bc58daad9dd45bf5f487ceeec7283c22c8b"},{"author":{"_account_id":14676,"name":"Kairat Kushaev","email":"kkushaev@mirantis.com","username":"kairat_kushaev"},"change_message_id":"0405583e848ebc66bb11b1dc2dc3e06bc7a35294","unresolved":false,"context_lines":[{"line_number":25,"context_line":"status. It also requires an authentication in glance_store when storage"},{"line_number":26,"context_line":"backend is Swift and Glance uploads an image in chunks."},{"line_number":27,"context_line":"- image-download needs to authenticate when downloading image  in chunks from"},{"line_number":28,"context_line":"Swift backend."},{"line_number":29,"context_line":"Once token expired user have to re-execute the request again which is not"},{"line_number":30,"context_line":"good in cases when Glance uploads big images. In order to prevent this"},{"line_number":31,"context_line":"situation Glance requires some mechanism that allow to finish the request if"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a29b11f_6e4ccc76","line":28,"in_reply_to":"3a29b11f_c2a6450e","updated":"2015-10-26 12:57:23.000000000","message":"Agree. Will refine the spec description to include this case.","commit_id":"ceb18bc58daad9dd45bf5f487ceeec7283c22c8b"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"e922ea70e354f1c4bae6820edf96b72362b7a0a7","unresolved":false,"context_lines":[{"line_number":44,"context_line":"Step 2. Glance extracts user token from a request and makes another request"},{"line_number":45,"context_line":"to Keystone to receive user_id and project_id."},{"line_number":46,"context_line":"Step 3. Glance sends a request to Keystone with username/password of"},{"line_number":47,"context_line":"glance_admin user (This user needs to be created by default). Glance extracts"},{"line_number":48,"context_line":"user_id and token from Keystone response."},{"line_number":49,"context_line":"Step 4. Glance requests roles of the user that initially started the scenario"},{"line_number":50,"context_line":"execution (not glance_admin)."}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a29b11f_42d555e2","line":47,"updated":"2015-10-23 11:51:48.000000000","message":"glance_admin user: does this need to be an admin user? If so, why?\n\n\n(https://en.wikipedia.org/wiki/Principle_of_least_privilege)","commit_id":"ceb18bc58daad9dd45bf5f487ceeec7283c22c8b"},{"author":{"_account_id":14676,"name":"Kairat Kushaev","email":"kkushaev@mirantis.com","username":"kairat_kushaev"},"change_message_id":"0405583e848ebc66bb11b1dc2dc3e06bc7a35294","unresolved":false,"context_lines":[{"line_number":44,"context_line":"Step 2. Glance extracts user token from a request and makes another request"},{"line_number":45,"context_line":"to Keystone to receive user_id and project_id."},{"line_number":46,"context_line":"Step 3. Glance sends a request to Keystone with username/password of"},{"line_number":47,"context_line":"glance_admin user (This user needs to be created by default). Glance extracts"},{"line_number":48,"context_line":"user_id and token from Keystone response."},{"line_number":49,"context_line":"Step 4. Glance requests roles of the user that initially started the scenario"},{"line_number":50,"context_line":"execution (not glance_admin)."}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a29b11f_2ee6d4e8","line":47,"in_reply_to":"3a29b11f_42d555e2","updated":"2015-10-26 12:57:23.000000000","message":"AFAIK, there is no possibility for non-admin user to request all roles in Keystone(I have tried it and didn\u0027t succeed).","commit_id":"ceb18bc58daad9dd45bf5f487ceeec7283c22c8b"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"e922ea70e354f1c4bae6820edf96b72362b7a0a7","unresolved":false,"context_lines":[{"line_number":59,"context_line":"Step 8. If glance_store backend is Swift then glance_store also generates a"},{"line_number":60,"context_line":"trust as described in steps 2-5 but the user will be swift_store_user."},{"line_number":61,"context_line":"Step 9. If uploading to glance_store failed with Unauthorized error then"},{"line_number":62,"context_line":"glance_store creates a new keystone client with swift_store_user credentials"},{"line_number":63,"context_line":"and trust_id. After that glance_store can receive a new token and proceed with"},{"line_number":64,"context_line":"uploading."},{"line_number":65,"context_line":"Image-download case is the same as for glance_store part of workflow above but"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a29b11f_4200f501","line":62,"updated":"2015-10-23 11:51:48.000000000","message":"In the case of the single tenant store (where we have a username and password) doesn\u0027t the swift client automatically create a new token from the supplied credentials?\n\nhttps://github.com/openstack/python-swiftclient/blob/master/swiftclient/client.py#L1416\n\nThe expiration of the original user token is not a problem for the swift requests.\n\nIsn\u0027t the trusts approach only required for Swift in the multi-tenant store case? (Where we are using the orignal token for Swift requests.)","commit_id":"ceb18bc58daad9dd45bf5f487ceeec7283c22c8b"},{"author":{"_account_id":14676,"name":"Kairat Kushaev","email":"kkushaev@mirantis.com","username":"kairat_kushaev"},"change_message_id":"0405583e848ebc66bb11b1dc2dc3e06bc7a35294","unresolved":false,"context_lines":[{"line_number":59,"context_line":"Step 8. If glance_store backend is Swift then glance_store also generates a"},{"line_number":60,"context_line":"trust as described in steps 2-5 but the user will be swift_store_user."},{"line_number":61,"context_line":"Step 9. If uploading to glance_store failed with Unauthorized error then"},{"line_number":62,"context_line":"glance_store creates a new keystone client with swift_store_user credentials"},{"line_number":63,"context_line":"and trust_id. After that glance_store can receive a new token and proceed with"},{"line_number":64,"context_line":"uploading."},{"line_number":65,"context_line":"Image-download case is the same as for glance_store part of workflow above but"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a29b11f_8e084893","line":62,"in_reply_to":"3a29b11f_4200f501","updated":"2015-10-26 12:57:23.000000000","message":"I think so, we need to handle it for multi-tenant case only, thanks for comments.","commit_id":"ceb18bc58daad9dd45bf5f487ceeec7283c22c8b"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"e922ea70e354f1c4bae6820edf96b72362b7a0a7","unresolved":false,"context_lines":[{"line_number":64,"context_line":"uploading."},{"line_number":65,"context_line":"Image-download case is the same as for glance_store part of workflow above but"},{"line_number":66,"context_line":"it does not interact with glance-registry cause it does not change image"},{"line_number":67,"context_line":"attributes. So steps 1-7 steps will be omitted."},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"Alternatives"},{"line_number":70,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a29b11f_6205f143","line":67,"updated":"2015-10-23 11:51:48.000000000","message":"When will the trust expire?\n\nWill we revoke the trust once the request has completed?","commit_id":"ceb18bc58daad9dd45bf5f487ceeec7283c22c8b"},{"author":{"_account_id":14676,"name":"Kairat Kushaev","email":"kkushaev@mirantis.com","username":"kairat_kushaev"},"change_message_id":"0405583e848ebc66bb11b1dc2dc3e06bc7a35294","unresolved":false,"context_lines":[{"line_number":64,"context_line":"uploading."},{"line_number":65,"context_line":"Image-download case is the same as for glance_store part of workflow above but"},{"line_number":66,"context_line":"it does not interact with glance-registry cause it does not change image"},{"line_number":67,"context_line":"attributes. So steps 1-7 steps will be omitted."},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"Alternatives"},{"line_number":70,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a29b11f_2e0b347f","line":67,"in_reply_to":"3a29b11f_6205f143","updated":"2015-10-26 12:57:23.000000000","message":"AFAIK, by default trust will expire in 1 day (24 hrs).\nSo we need to revoke the trusts once the Glance operation has been finished.","commit_id":"ceb18bc58daad9dd45bf5f487ceeec7283c22c8b"},{"author":{"_account_id":14962,"name":"ologvinova","email":"ologvinova@mirantis.com","username":"ologvinova"},"change_message_id":"e3e65dfaa39f581038407b10408140be464fe1aa","unresolved":false,"context_lines":[{"line_number":16,"context_line":"Problem description"},{"line_number":17,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"Keystone tokens have some restricted lifetime. After the user token has expired"},{"line_number":20,"context_line":"any request initiated by Glance which needs a valid user token will fail. This"},{"line_number":21,"context_line":"will cause the original user\u0027s request to also fail, even though the token was"},{"line_number":22,"context_line":"originally valid when passed to Glance."}],"source_content_type":"text/x-rst","patch_set":6,"id":"3a29b11f_8a6cb109","line":19,"updated":"2015-10-26 15:19:58.000000000","message":"A comma after \u0027expired\u0027, please.","commit_id":"6800867f727411688f8ac61bdb235cc95d251aaa"},{"author":{"_account_id":14962,"name":"ologvinova","email":"ologvinova@mirantis.com","username":"ologvinova"},"change_message_id":"e3e65dfaa39f581038407b10408140be464fe1aa","unresolved":false,"context_lines":[{"line_number":22,"context_line":"originally valid when passed to Glance."},{"line_number":23,"context_line":"That\u0027s especially leads to troubles for long-lived requests because there is"},{"line_number":24,"context_line":"no way to execute these requests if they take more time than token expiration"},{"line_number":25,"context_line":"time(imagine uploading of 100Gb image that fails)."},{"line_number":26,"context_line":"In the current implementation we have several cases where long-lived requests"},{"line_number":27,"context_line":"requires authentication during request execution:"},{"line_number":28,"context_line":"- Glance needs to authenticate in Glance Registry when changing image"}],"source_content_type":"text/x-rst","patch_set":6,"id":"3a29b11f_0d1d1b66","line":25,"updated":"2015-10-26 15:19:58.000000000","message":"It especially affects long-lived requests that fail if they take more time than the token expiration time (for example, uploading of a 100 GB image).","commit_id":"6800867f727411688f8ac61bdb235cc95d251aaa"},{"author":{"_account_id":14962,"name":"ologvinova","email":"ologvinova@mirantis.com","username":"ologvinova"},"change_message_id":"e3e65dfaa39f581038407b10408140be464fe1aa","unresolved":false,"context_lines":[{"line_number":23,"context_line":"That\u0027s especially leads to troubles for long-lived requests because there is"},{"line_number":24,"context_line":"no way to execute these requests if they take more time than token expiration"},{"line_number":25,"context_line":"time(imagine uploading of 100Gb image that fails)."},{"line_number":26,"context_line":"In the current implementation we have several cases where long-lived requests"},{"line_number":27,"context_line":"requires authentication during request execution:"},{"line_number":28,"context_line":"- Glance needs to authenticate in Glance Registry when changing image"},{"line_number":29,"context_line":"status after image-upload."}],"source_content_type":"text/x-rst","patch_set":6,"id":"3a29b11f_4a2539c0","line":26,"updated":"2015-10-26 15:19:58.000000000","message":"A comma after \u0027implementation\u0027, please.","commit_id":"6800867f727411688f8ac61bdb235cc95d251aaa"},{"author":{"_account_id":14962,"name":"ologvinova","email":"ologvinova@mirantis.com","username":"ologvinova"},"change_message_id":"e3e65dfaa39f581038407b10408140be464fe1aa","unresolved":false,"context_lines":[{"line_number":24,"context_line":"no way to execute these requests if they take more time than token expiration"},{"line_number":25,"context_line":"time(imagine uploading of 100Gb image that fails)."},{"line_number":26,"context_line":"In the current implementation we have several cases where long-lived requests"},{"line_number":27,"context_line":"requires authentication during request execution:"},{"line_number":28,"context_line":"- Glance needs to authenticate in Glance Registry when changing image"},{"line_number":29,"context_line":"status after image-upload."},{"line_number":30,"context_line":"- glance_store needs to authenticate with user token when uploading images in"}],"source_content_type":"text/x-rst","patch_set":6,"id":"3a29b11f_cdb963ee","line":27,"updated":"2015-10-26 15:19:58.000000000","message":"1) requires -\u003e require\n\n2) add a new blank line after line 27 (so that the below bulletted list displays correctly).\n    Now the items go as a plain text ( http://docs-draft.openstack.org/78/229878/6/check/gate-glance-specs-docs/b2f0829//doc/build/html/specs/mitaka/glance-trusts.html )","commit_id":"6800867f727411688f8ac61bdb235cc95d251aaa"},{"author":{"_account_id":14962,"name":"ologvinova","email":"ologvinova@mirantis.com","username":"ologvinova"},"change_message_id":"e3e65dfaa39f581038407b10408140be464fe1aa","unresolved":false,"context_lines":[{"line_number":27,"context_line":"requires authentication during request execution:"},{"line_number":28,"context_line":"- Glance needs to authenticate in Glance Registry when changing image"},{"line_number":29,"context_line":"status after image-upload."},{"line_number":30,"context_line":"- glance_store needs to authenticate with user token when uploading images in"},{"line_number":31,"context_line":"segments (chunks) to Swift (please take note that we need to authenticate with"},{"line_number":32,"context_line":"user token fot multi-tenant storage-mode only)."},{"line_number":33,"context_line":"If downloading/uploading images is too long then the token will expire and"}],"source_content_type":"text/x-rst","patch_set":6,"id":"3a29b11f_f0867264","line":30,"updated":"2015-10-26 15:19:58.000000000","message":"Indent all the subsequent lines by 2 spaces for this bulletted item.","commit_id":"6800867f727411688f8ac61bdb235cc95d251aaa"},{"author":{"_account_id":14962,"name":"ologvinova","email":"ologvinova@mirantis.com","username":"ologvinova"},"change_message_id":"e3e65dfaa39f581038407b10408140be464fe1aa","unresolved":false,"context_lines":[{"line_number":28,"context_line":"- Glance needs to authenticate in Glance Registry when changing image"},{"line_number":29,"context_line":"status after image-upload."},{"line_number":30,"context_line":"- glance_store needs to authenticate with user token when uploading images in"},{"line_number":31,"context_line":"segments (chunks) to Swift (please take note that we need to authenticate with"},{"line_number":32,"context_line":"user token fot multi-tenant storage-mode only)."},{"line_number":33,"context_line":"If downloading/uploading images is too long then the token will expire and"},{"line_number":34,"context_line":"where is no way to upload image except increasing token expiration"}],"source_content_type":"text/x-rst","patch_set":6,"id":"3a29b11f_50c40691","line":31,"updated":"2015-10-26 15:19:58.000000000","message":"please take note that we need to authenticate with user token for -\u003e authentication with user token is required for","commit_id":"6800867f727411688f8ac61bdb235cc95d251aaa"},{"author":{"_account_id":14962,"name":"ologvinova","email":"ologvinova@mirantis.com","username":"ologvinova"},"change_message_id":"e3e65dfaa39f581038407b10408140be464fe1aa","unresolved":false,"context_lines":[{"line_number":30,"context_line":"- glance_store needs to authenticate with user token when uploading images in"},{"line_number":31,"context_line":"segments (chunks) to Swift (please take note that we need to authenticate with"},{"line_number":32,"context_line":"user token fot multi-tenant storage-mode only)."},{"line_number":33,"context_line":"If downloading/uploading images is too long then the token will expire and"},{"line_number":34,"context_line":"where is no way to upload image except increasing token expiration"},{"line_number":35,"context_line":"time in Keystone for all users. That makes trusts crucial for long-lived"},{"line_number":36,"context_line":"requests in Glance."}],"source_content_type":"text/x-rst","patch_set":6,"id":"3a29b11f_d036d6b3","line":33,"updated":"2015-10-26 15:19:58.000000000","message":"too long then the -\u003e too long, the","commit_id":"6800867f727411688f8ac61bdb235cc95d251aaa"},{"author":{"_account_id":14962,"name":"ologvinova","email":"ologvinova@mirantis.com","username":"ologvinova"},"change_message_id":"e3e65dfaa39f581038407b10408140be464fe1aa","unresolved":false,"context_lines":[{"line_number":31,"context_line":"segments (chunks) to Swift (please take note that we need to authenticate with"},{"line_number":32,"context_line":"user token fot multi-tenant storage-mode only)."},{"line_number":33,"context_line":"If downloading/uploading images is too long then the token will expire and"},{"line_number":34,"context_line":"where is no way to upload image except increasing token expiration"},{"line_number":35,"context_line":"time in Keystone for all users. That makes trusts crucial for long-lived"},{"line_number":36,"context_line":"requests in Glance."},{"line_number":37,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"3a29b11f_7048222e","line":34,"updated":"2015-10-26 15:19:58.000000000","message":"where is no way to upload image except increasing... -\u003e you cannot upload an image unless you increase...","commit_id":"6800867f727411688f8ac61bdb235cc95d251aaa"},{"author":{"_account_id":14962,"name":"ologvinova","email":"ologvinova@mirantis.com","username":"ologvinova"},"change_message_id":"e3e65dfaa39f581038407b10408140be464fe1aa","unresolved":false,"context_lines":[{"line_number":39,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Glance API configuration must support additional configuration option in"},{"line_number":42,"context_line":"config file: use_trusts (false by default). If that option is false then"},{"line_number":43,"context_line":"no changes in Glance behavior."},{"line_number":44,"context_line":"The algorithm to execute the authentication with trust in Glance"},{"line_number":45,"context_line":"is the following:"}],"source_content_type":"text/x-rst","patch_set":6,"id":"3a29b11f_d02b3632","line":42,"updated":"2015-10-26 15:19:58.000000000","message":"config -\u003e the configuration\n\nuse_trusts -\u003e ``use_trusts``","commit_id":"6800867f727411688f8ac61bdb235cc95d251aaa"},{"author":{"_account_id":14962,"name":"ologvinova","email":"ologvinova@mirantis.com","username":"ologvinova"},"change_message_id":"e3e65dfaa39f581038407b10408140be464fe1aa","unresolved":false,"context_lines":[{"line_number":43,"context_line":"no changes in Glance behavior."},{"line_number":44,"context_line":"The algorithm to execute the authentication with trust in Glance"},{"line_number":45,"context_line":"is the following:"},{"line_number":46,"context_line":"Step 1. Glance checks that authentication against registry is required."},{"line_number":47,"context_line":"Step 2. Glance extracts user token from a request and makes another request"},{"line_number":48,"context_line":"to Keystone to receive user_id and project_id."},{"line_number":49,"context_line":"Step 3. Glance sends a request to Keystone with username/password of"}],"source_content_type":"text/x-rst","patch_set":6,"id":"3a29b11f_733eecb9","line":46,"updated":"2015-10-26 15:19:58.000000000","message":"Instead of \u0027Step 1.\u0027, \u0027Step 2.\u0027 etc., use #. to create a procedure list. The \u0027#.\u0027 sign automatically enumerates your items. Also, indent each 2nd line of the item by 2 spaces.","commit_id":"6800867f727411688f8ac61bdb235cc95d251aaa"},{"author":{"_account_id":14962,"name":"ologvinova","email":"ologvinova@mirantis.com","username":"ologvinova"},"change_message_id":"e3e65dfaa39f581038407b10408140be464fe1aa","unresolved":false,"context_lines":[{"line_number":47,"context_line":"Step 2. Glance extracts user token from a request and makes another request"},{"line_number":48,"context_line":"to Keystone to receive user_id and project_id."},{"line_number":49,"context_line":"Step 3. Glance sends a request to Keystone with username/password of"},{"line_number":50,"context_line":"glance_admin user (This user needs to be created by default). Glance extracts"},{"line_number":51,"context_line":"user_id and token from Keystone response."},{"line_number":52,"context_line":"Step 4. Glance requests roles of the user who initially started the scenario"},{"line_number":53,"context_line":"execution (not glance_admin)."}],"source_content_type":"text/x-rst","patch_set":6,"id":"3a29b11f_f39f5cb2","line":50,"updated":"2015-10-26 15:19:58.000000000","message":"This -\u003e this)","commit_id":"6800867f727411688f8ac61bdb235cc95d251aaa"},{"author":{"_account_id":14962,"name":"ologvinova","email":"ologvinova@mirantis.com","username":"ologvinova"},"change_message_id":"e3e65dfaa39f581038407b10408140be464fe1aa","unresolved":false,"context_lines":[{"line_number":51,"context_line":"user_id and token from Keystone response."},{"line_number":52,"context_line":"Step 4. Glance requests roles of the user who initially started the scenario"},{"line_number":53,"context_line":"execution (not glance_admin)."},{"line_number":54,"context_line":"Step 5. Glance passes project_id, user_id, glance_admin user_id and list of"},{"line_number":55,"context_line":"delegating roles to create trust. Glance extracts and keeps"},{"line_number":56,"context_line":"trust_id from Keystone response."},{"line_number":57,"context_line":"Step 6. Glance passes initial token of the user to registry when uploading"}],"source_content_type":"text/x-rst","patch_set":6,"id":"3a29b11f_93c948af","line":54,"updated":"2015-10-26 15:19:58.000000000","message":"user_id and -\u003e user_id, and","commit_id":"6800867f727411688f8ac61bdb235cc95d251aaa"},{"author":{"_account_id":14962,"name":"ologvinova","email":"ologvinova@mirantis.com","username":"ologvinova"},"change_message_id":"e3e65dfaa39f581038407b10408140be464fe1aa","unresolved":false,"context_lines":[{"line_number":52,"context_line":"Step 4. Glance requests roles of the user who initially started the scenario"},{"line_number":53,"context_line":"execution (not glance_admin)."},{"line_number":54,"context_line":"Step 5. Glance passes project_id, user_id, glance_admin user_id and list of"},{"line_number":55,"context_line":"delegating roles to create trust. Glance extracts and keeps"},{"line_number":56,"context_line":"trust_id from Keystone response."},{"line_number":57,"context_line":"Step 6. Glance passes initial token of the user to registry when uploading"},{"line_number":58,"context_line":"image and it also passes that token to glance_store."}],"source_content_type":"text/x-rst","patch_set":6,"id":"3a29b11f_33bb9410","line":55,"updated":"2015-10-26 15:19:58.000000000","message":"create trust -\u003e create a trust","commit_id":"6800867f727411688f8ac61bdb235cc95d251aaa"},{"author":{"_account_id":14962,"name":"ologvinova","email":"ologvinova@mirantis.com","username":"ologvinova"},"change_message_id":"e3e65dfaa39f581038407b10408140be464fe1aa","unresolved":false,"context_lines":[{"line_number":57,"context_line":"Step 6. Glance passes initial token of the user to registry when uploading"},{"line_number":58,"context_line":"image and it also passes that token to glance_store."},{"line_number":59,"context_line":"Step 7. If the token is expired when trying to execute a request against"},{"line_number":60,"context_line":"registry then Glance initializes a new keystone client with glance_admin"},{"line_number":61,"context_line":"credentials and trust_id."},{"line_number":62,"context_line":"Step 8. If glance_store backend is Swift and Swift storage mode is configured"},{"line_number":63,"context_line":"as multi-tenant in glance_store then glance_store also generates a trust as"}],"source_content_type":"text/x-rst","patch_set":6,"id":"3a29b11f_330074aa","line":60,"updated":"2015-10-26 15:19:58.000000000","message":"registry then Glance... -\u003e registry, Glance...","commit_id":"6800867f727411688f8ac61bdb235cc95d251aaa"},{"author":{"_account_id":14962,"name":"ologvinova","email":"ologvinova@mirantis.com","username":"ologvinova"},"change_message_id":"e3e65dfaa39f581038407b10408140be464fe1aa","unresolved":false,"context_lines":[{"line_number":60,"context_line":"registry then Glance initializes a new keystone client with glance_admin"},{"line_number":61,"context_line":"credentials and trust_id."},{"line_number":62,"context_line":"Step 8. If glance_store backend is Swift and Swift storage mode is configured"},{"line_number":63,"context_line":"as multi-tenant in glance_store then glance_store also generates a trust as"},{"line_number":64,"context_line":"described in steps 2-5 but the user will be swift_store_user."},{"line_number":65,"context_line":"Step 9. If glance_store uploads images in segments(chunks) and glance_store"},{"line_number":66,"context_line":"receives Unauthorized error (or lose the connection) then glance_store"}],"source_content_type":"text/x-rst","patch_set":6,"id":"3a29b11f_331714ef","line":63,"updated":"2015-10-26 15:19:58.000000000","message":"glance_store then glance_store -\u003e glance_store, glance_store","commit_id":"6800867f727411688f8ac61bdb235cc95d251aaa"},{"author":{"_account_id":14962,"name":"ologvinova","email":"ologvinova@mirantis.com","username":"ologvinova"},"change_message_id":"e3e65dfaa39f581038407b10408140be464fe1aa","unresolved":false,"context_lines":[{"line_number":63,"context_line":"as multi-tenant in glance_store then glance_store also generates a trust as"},{"line_number":64,"context_line":"described in steps 2-5 but the user will be swift_store_user."},{"line_number":65,"context_line":"Step 9. If glance_store uploads images in segments(chunks) and glance_store"},{"line_number":66,"context_line":"receives Unauthorized error (or lose the connection) then glance_store"},{"line_number":67,"context_line":"initializes a new client and passes a new token to Swift to proceed the"},{"line_number":68,"context_line":"image-upload."},{"line_number":69,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"3a29b11f_53ce5084","line":66,"updated":"2015-10-26 15:19:58.000000000","message":"Unauthorized error (or lose the connection) then glance_store... -\u003e an *Unauthorized* error (or loses the connection), glance_store...","commit_id":"6800867f727411688f8ac61bdb235cc95d251aaa"},{"author":{"_account_id":14962,"name":"ologvinova","email":"ologvinova@mirantis.com","username":"ologvinova"},"change_message_id":"e3e65dfaa39f581038407b10408140be464fe1aa","unresolved":false,"context_lines":[{"line_number":74,"context_line":"expiration time to allow Glance upload the image. This solution affects all"},{"line_number":75,"context_line":"services and it does not look like long term solution."},{"line_number":76,"context_line":"The second alternative is available for glance_store uploading/downloading"},{"line_number":77,"context_line":"mechanism: we can ask swift guys to implement trust authentication inside"},{"line_number":78,"context_line":"swiftclient. It allows glance_store to get rid of trust logic and pass"},{"line_number":79,"context_line":"responsibility of this to swiftclient. But it seems that this is not"},{"line_number":80,"context_line":"implemented and we don\u0027t if it will be implemented by somebody."}],"source_content_type":"text/x-rst","patch_set":6,"id":"3a29b11f_f38c3c37","line":77,"updated":"2015-10-26 15:19:58.000000000","message":"we can ask swift guys -\u003e ask the Swift developers\u0027 team","commit_id":"6800867f727411688f8ac61bdb235cc95d251aaa"},{"author":{"_account_id":14962,"name":"ologvinova","email":"ologvinova@mirantis.com","username":"ologvinova"},"change_message_id":"abb7e3fdfe24dcf5515556afa46ab455d2b20879","unresolved":false,"context_lines":[{"line_number":76,"context_line":"The second alternative is available for glance_store uploading/downloading"},{"line_number":77,"context_line":"mechanism: we can ask swift guys to implement trust authentication inside"},{"line_number":78,"context_line":"swiftclient. It allows glance_store to get rid of trust logic and pass"},{"line_number":79,"context_line":"responsibility of this to swiftclient. But it seems that this is not"},{"line_number":80,"context_line":"implemented and we don\u0027t if it will be implemented by somebody."},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"Data model impact"}],"source_content_type":"text/x-rst","patch_set":6,"id":"3a29b11f_936ce809","line":79,"updated":"2015-10-26 15:32:08.000000000","message":"But it seems that this is not - But it seems not to be implemented yet. \n\n...and we don\u0027t if it will be implemented by somebody. - a verb is missing in the 1st part of the sentence. Do you mean \"...and we don\u0027t MIND if it will be implemented by somebody.\"?","commit_id":"6800867f727411688f8ac61bdb235cc95d251aaa"},{"author":{"_account_id":14962,"name":"ologvinova","email":"ologvinova@mirantis.com","username":"ologvinova"},"change_message_id":"abb7e3fdfe24dcf5515556afa46ab455d2b20879","unresolved":false,"context_lines":[{"line_number":114,"context_line":"Other deployer impact"},{"line_number":115,"context_line":"---------------------"},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"To deploy Glance with trusts the following config should be defined:"},{"line_number":118,"context_line":"- enable_trusts must be specified if deployer would like to use trusts."},{"line_number":119,"context_line":"- enable_trusts must be Trus only if back-end is Swift or user need to"},{"line_number":120,"context_line":"authenticate against registry."}],"source_content_type":"text/x-rst","patch_set":6,"id":"3a29b11f_f308bc93","line":117,"updated":"2015-10-26 15:32:08.000000000","message":"add a blank new line before the 1st item of the list","commit_id":"6800867f727411688f8ac61bdb235cc95d251aaa"},{"author":{"_account_id":14962,"name":"ologvinova","email":"ologvinova@mirantis.com","username":"ologvinova"},"change_message_id":"abb7e3fdfe24dcf5515556afa46ab455d2b20879","unresolved":false,"context_lines":[{"line_number":144,"context_line":"Work Items"},{"line_number":145,"context_line":"----------"},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"The list of the items is following:"},{"line_number":148,"context_line":"* Add trust authorization module to Glance"},{"line_number":149,"context_line":"* Implement trust authorization between Glance and Glance registry"},{"line_number":150,"context_line":"* Implement trust authorization between glance_store and Swift"}],"source_content_type":"text/x-rst","patch_set":6,"id":"3a29b11f_d3034075","line":147,"updated":"2015-10-26 15:32:08.000000000","message":"add a blank new line before the 1st item of the list","commit_id":"6800867f727411688f8ac61bdb235cc95d251aaa"},{"author":{"_account_id":9303,"name":"Abhishek Kekane","email":"akekane@redhat.com","username":"abhishekkekane"},"change_message_id":"9498a6b6f78465cd9138b70b365da50301532ce9","unresolved":false,"context_lines":[{"line_number":113,"context_line":"---------------------"},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"To deploy Glance with trusts the following config should be defined:"},{"line_number":116,"context_line":"* enable_trusts must be specified if deployer would like to use trusts."},{"line_number":117,"context_line":"* trustee user grants should be specified in CONF.keystone_authtoken group:"},{"line_number":118,"context_line":"username, password, auth_uri, ssl options."},{"line_number":119,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"fa80f949_8dd1d659","line":116,"updated":"2015-11-05 13:21:17.000000000","message":"enable_trusts or use_trusts???","commit_id":"3db398cc8842dcbeaf6e18dd178f9067b2fdcfe5"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"edd777fc89c1c067745c971c4493f028caa35655","unresolved":false,"context_lines":[{"line_number":20,"context_line":"expired, any request initiated by Glance which needs a valid user token will"},{"line_number":21,"context_line":"fail. This causes the original user\u0027s request to also fail, even though the"},{"line_number":22,"context_line":"token was originally valid when passed to Glance."},{"line_number":23,"context_line":"The case above leads to issues when a user is trying to upload big images and"},{"line_number":24,"context_line":"Glance Registry requires additional authentication after image-upload."},{"line_number":25,"context_line":"Let\u0027s consider the following case:"},{"line_number":26,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"da85f559_71b80fe6","line":23,"updated":"2015-11-10 11:38:35.000000000","message":"I\u0027ve cut and paste the following from my comment on patch set 2:\n\n-----------------\n\n The problem is more general than uploading big images.\n Strictly speaking, any time Glance makes an OpenStack API request using a token it can potentially fail if the user\u0027s token expires.\n This includes both short lived requests such as:\n API -\u003e registry requests (image list, show, update etc) \n Sharing images (multi-tenant Swift case)\n And (more likely) long lived requests such as:\n image download (via swift, not cache or other backing store)\n image upload (via swift)\n image import\n If we\u0027re scoping this to just image upload that\u0027s ok, but we should be clear about which of these we\u0027re trying to address.\n\n-----------------\n\nIn this section we need to be clearer about which problem(s) we plan to address.\n\nIn the commit message download is mentioned ... here we only mention upload. It\u0027s not clear to the reader which problems we\u0027re trying to address. Can we please specify (1) what we plan to address and (2) what we do not plan to address. Thanks.","commit_id":"aa30412a461a859bf2e71a28740c711a79c90fc0"},{"author":{"_account_id":14676,"name":"Kairat Kushaev","email":"kkushaev@mirantis.com","username":"kairat_kushaev"},"change_message_id":"e31008f98d699584293a9ac6f057d81ca5596731","unresolved":false,"context_lines":[{"line_number":20,"context_line":"expired, any request initiated by Glance which needs a valid user token will"},{"line_number":21,"context_line":"fail. This causes the original user\u0027s request to also fail, even though the"},{"line_number":22,"context_line":"token was originally valid when passed to Glance."},{"line_number":23,"context_line":"The case above leads to issues when a user is trying to upload big images and"},{"line_number":24,"context_line":"Glance Registry requires additional authentication after image-upload."},{"line_number":25,"context_line":"Let\u0027s consider the following case:"},{"line_number":26,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"da85f559_8789b128","line":23,"in_reply_to":"da85f559_71b80fe6","updated":"2015-11-10 12:13:37.000000000","message":"AFAIU, it was decided to split the spec into 2 specs: for glance and glance_store. The current spec is related to glance and it defines trusts implementation for communication with glance registry. Trusts for image-upload, image-download (via swift) must be defined in spec for glance_store. I wrote below: Please note that implementation of trusts in glance_store is out of scope for this specification but I think I need to refine the scope definition.\nAlso, we need to consider image import case which I forgot to mention.\nThanks for comments.","commit_id":"aa30412a461a859bf2e71a28740c711a79c90fc0"},{"author":{"_account_id":11391,"name":"Mikhail Fedosin","email":"mfedosin@redhat.com","username":"fedosinme"},"change_message_id":"26897c3343c2d8160f1cb7890f74a351c481bc8d","unresolved":false,"context_lines":[{"line_number":20,"context_line":"expired, any request initiated by Glance which needs a valid user token will"},{"line_number":21,"context_line":"fail. This causes the original user\u0027s request to also fail, even though the"},{"line_number":22,"context_line":"token was originally valid when passed to Glance."},{"line_number":23,"context_line":"The case above leads to issues when a user is trying to upload big images and"},{"line_number":24,"context_line":"Glance Registry requires additional authentication after image-upload."},{"line_number":25,"context_line":"Let\u0027s consider the following case:"},{"line_number":26,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"da85f559_c2cb271d","line":23,"in_reply_to":"da85f559_8789b128","updated":"2015-11-10 12:42:52.000000000","message":"Yes, during the session we had an agreement to split the spec in two: for glance and glance_store. It\u0027s done because glance_store case is trick and has to be discussed more detailed.\n\nIt\u0027s better to merge the existing code for glance and backport it to stable releases right now. It will allow non-swift deployments to work correctly and they don\u0027t have to wait while we implement solution for swift,","commit_id":"aa30412a461a859bf2e71a28740c711a79c90fc0"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"edd777fc89c1c067745c971c4493f028caa35655","unresolved":false,"context_lines":[{"line_number":31,"context_line":"5. Glance sends a request to registry to change image status."},{"line_number":32,"context_line":"6. Keystone Middleware rejects the request because user token has expired."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"As a result we have angry user who will never succeed to upload big image to"},{"line_number":35,"context_line":"Glance. He can increase token expiration time but it doesn\u0027t seem to be"},{"line_number":36,"context_line":"long-term solution."},{"line_number":37,"context_line":"Please note that implementation of trusts in glance_store is out of scope for"}],"source_content_type":"text/x-rst","patch_set":10,"id":"da85f559_7186cf14","line":34,"updated":"2015-11-10 11:38:35.000000000","message":"Why \"never\"? Don\u0027t most uploads currently work?","commit_id":"aa30412a461a859bf2e71a28740c711a79c90fc0"},{"author":{"_account_id":11391,"name":"Mikhail Fedosin","email":"mfedosin@redhat.com","username":"fedosinme"},"change_message_id":"26897c3343c2d8160f1cb7890f74a351c481bc8d","unresolved":false,"context_lines":[{"line_number":31,"context_line":"5. Glance sends a request to registry to change image status."},{"line_number":32,"context_line":"6. Keystone Middleware rejects the request because user token has expired."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"As a result we have angry user who will never succeed to upload big image to"},{"line_number":35,"context_line":"Glance. He can increase token expiration time but it doesn\u0027t seem to be"},{"line_number":36,"context_line":"long-term solution."},{"line_number":37,"context_line":"Please note that implementation of trusts in glance_store is out of scope for"}],"source_content_type":"text/x-rst","patch_set":10,"id":"da85f559_82ec3f90","line":34,"in_reply_to":"da85f559_477d096d","updated":"2015-11-10 12:42:52.000000000","message":"Or use v2 without registry.","commit_id":"aa30412a461a859bf2e71a28740c711a79c90fc0"},{"author":{"_account_id":14676,"name":"Kairat Kushaev","email":"kkushaev@mirantis.com","username":"kairat_kushaev"},"change_message_id":"e31008f98d699584293a9ac6f057d81ca5596731","unresolved":false,"context_lines":[{"line_number":31,"context_line":"5. Glance sends a request to registry to change image status."},{"line_number":32,"context_line":"6. Keystone Middleware rejects the request because user token has expired."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"As a result we have angry user who will never succeed to upload big image to"},{"line_number":35,"context_line":"Glance. He can increase token expiration time but it doesn\u0027t seem to be"},{"line_number":36,"context_line":"long-term solution."},{"line_number":37,"context_line":"Please note that implementation of trusts in glance_store is out of scope for"}],"source_content_type":"text/x-rst","patch_set":10,"id":"da85f559_477d096d","line":34,"in_reply_to":"da85f559_7186cf14","updated":"2015-11-10 12:13:37.000000000","message":"If uploading takes more than 1 hours you never succeed to upload it. \nThe only workaround here is to extend expiration time or disable registry.","commit_id":"aa30412a461a859bf2e71a28740c711a79c90fc0"},{"author":{"_account_id":6159,"name":"Flavio Percoco Premoli","display_name":"flaper87","email":"flavio.percoco@flyrlabs.com","username":"flaper87"},"change_message_id":"d65f2d1d9489d5c9215e3e05dafb116760f73447","unresolved":false,"context_lines":[{"line_number":79,"context_line":"expiration time to allow Glance upload the image. This solution affects all"},{"line_number":80,"context_line":"services and it does not look like long term solution."},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"Another possible solution is to use `service tokens`. But until this feature is"},{"line_number":83,"context_line":"finalized in Keystone, it\u0027s recommended to use trusts. In the future this may"},{"line_number":84,"context_line":"be superseded by the use of `service tokens` but it\u0027ll have to be discussed when"},{"line_number":85,"context_line":"that time comes."}],"source_content_type":"text/x-rst","patch_set":10,"id":"da85f559_fbd52842","line":82,"updated":"2015-11-12 18:18:10.000000000","message":"The reason we decided on going forward w/ trusts is that service tokens are not ready yet. As soon as those will be ready to be used, we can consider deprecating trusts in favor of service tokens.","commit_id":"aa30412a461a859bf2e71a28740c711a79c90fc0"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"edd777fc89c1c067745c971c4493f028caa35655","unresolved":false,"context_lines":[{"line_number":79,"context_line":"expiration time to allow Glance upload the image. This solution affects all"},{"line_number":80,"context_line":"services and it does not look like long term solution."},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"Another possible solution is to use `service tokens`. But until this feature is"},{"line_number":83,"context_line":"finalized in Keystone, it\u0027s recommended to use trusts. In the future this may"},{"line_number":84,"context_line":"be superseded by the use of `service tokens` but it\u0027ll have to be discussed when"},{"line_number":85,"context_line":"that time comes."}],"source_content_type":"text/x-rst","patch_set":10,"id":"da85f559_8e322e0f","line":82,"updated":"2015-11-10 11:38:35.000000000","message":"We should be a little clearer here.\n\nService tokens are an existing feature of keystone (and have been for a couple of years). It is not accurate to say that this feature is not finalized.\n\nService tokens do not provide a way to work around token expiration.\n\nThere has been some discussion around updating how the keystone middleware interprets a combination of a valid service token and expired user token -- but this is in the discussion/pre-design stage and is not guaranteed to be implemented. Therefore we cannot currently base our solution on it.","commit_id":"aa30412a461a859bf2e71a28740c711a79c90fc0"},{"author":{"_account_id":11391,"name":"Mikhail Fedosin","email":"mfedosin@redhat.com","username":"fedosinme"},"change_message_id":"26897c3343c2d8160f1cb7890f74a351c481bc8d","unresolved":false,"context_lines":[{"line_number":79,"context_line":"expiration time to allow Glance upload the image. This solution affects all"},{"line_number":80,"context_line":"services and it does not look like long term solution."},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"Another possible solution is to use `service tokens`. But until this feature is"},{"line_number":83,"context_line":"finalized in Keystone, it\u0027s recommended to use trusts. In the future this may"},{"line_number":84,"context_line":"be superseded by the use of `service tokens` but it\u0027ll have to be discussed when"},{"line_number":85,"context_line":"that time comes."}],"source_content_type":"text/x-rst","patch_set":10,"id":"da85f559_427417ce","line":82,"in_reply_to":"da85f559_276565e0","updated":"2015-11-10 12:42:52.000000000","message":"Guys from Keystone said that soon it will be possible to get user context from expired token (in Fernets). This combination with service tokens will allow us to use it instead of trusts.","commit_id":"aa30412a461a859bf2e71a28740c711a79c90fc0"},{"author":{"_account_id":14676,"name":"Kairat Kushaev","email":"kkushaev@mirantis.com","username":"kairat_kushaev"},"change_message_id":"e31008f98d699584293a9ac6f057d81ca5596731","unresolved":false,"context_lines":[{"line_number":79,"context_line":"expiration time to allow Glance upload the image. This solution affects all"},{"line_number":80,"context_line":"services and it does not look like long term solution."},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"Another possible solution is to use `service tokens`. But until this feature is"},{"line_number":83,"context_line":"finalized in Keystone, it\u0027s recommended to use trusts. In the future this may"},{"line_number":84,"context_line":"be superseded by the use of `service tokens` but it\u0027ll have to be discussed when"},{"line_number":85,"context_line":"that time comes."}],"source_content_type":"text/x-rst","patch_set":10,"id":"da85f559_276565e0","line":82,"in_reply_to":"da85f559_8e322e0f","updated":"2015-11-10 12:13:37.000000000","message":"So I have heard that Keystone guys recommended to deprecate keystone trusts in favor of service tokens. After some discussion, community decided to stay with trusts in Glance. Unfortunately I was not able to attend summit. So it is possible that my understanding is incorrect. Thanks for the comment.\nI will refine my definition here.","commit_id":"aa30412a461a859bf2e71a28740c711a79c90fc0"},{"author":{"_account_id":9303,"name":"Abhishek Kekane","email":"akekane@redhat.com","username":"abhishekkekane"},"change_message_id":"65e5cb3ddbbef17eb26772e78458af9ae04f7899","unresolved":false,"context_lines":[{"line_number":21,"context_line":"fail. This causes the original user\u0027s request to also fail, even though the"},{"line_number":22,"context_line":"token was originally valid when passed to Glance."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"This this spec intends to address the specific case where a token expires"},{"line_number":25,"context_line":"during image upload causing the call to the registry to set the image"},{"line_number":26,"context_line":"state \u0027active\u0027 to fail:"},{"line_number":27,"context_line":""}],"source_content_type":"text/x-rst","patch_set":12,"id":"ba8a016a_77a37f9f","line":24,"updated":"2015-11-16 11:51:31.000000000","message":"Remove second occurrence of \u0027this\u0027","commit_id":"07c467571ce6d97648451fa8d6a1614f6654bbfb"}]}