)]}'
{"specs/mitaka/approved/inheritable-admin-image-properties.rst":[{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"1b23976d9d920a0480668694736e1a26723cda4b","unresolved":false,"context_lines":[{"line_number":21,"context_line":"When snapshotting or shelving an instance, nova creates a new image in glance"},{"line_number":22,"context_line":"using the user credentials. If the user does not have the permission to create"},{"line_number":23,"context_line":"one of the custom properties he is not able to create an image, thus he is not"},{"line_number":24,"context_line":"able to snapshot or shelve the instance."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"Use Cases"},{"line_number":27,"context_line":"----------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a1a9d01_f2f537cb","line":24,"updated":"2015-10-01 20:16:58.000000000","message":"shelve is only used for swap some space of system and snapshot is a temp to keep the instance, why need inherit image properties?","commit_id":"837ec89fc31441f7674aaba34ab5669b4974593e"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"2ce86e1fa89d4378b3a87ba7235eb1effeb59487","unresolved":false,"context_lines":[{"line_number":21,"context_line":"When snapshotting or shelving an instance, nova creates a new image in glance"},{"line_number":22,"context_line":"using the user credentials. If the user does not have the permission to create"},{"line_number":23,"context_line":"one of the custom properties he is not able to create an image, thus he is not"},{"line_number":24,"context_line":"able to snapshot or shelve the instance."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"Use Cases"},{"line_number":27,"context_line":"----------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a1a9d01_79dc9146","line":24,"in_reply_to":"9a1a9d01_d5da5de9","updated":"2015-10-02 12:53:50.000000000","message":"ok, make sense","commit_id":"837ec89fc31441f7674aaba34ab5669b4974593e"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"2dcb373dfa59bb91460b74ed6ce265e574e61091","unresolved":false,"context_lines":[{"line_number":21,"context_line":"When snapshotting or shelving an instance, nova creates a new image in glance"},{"line_number":22,"context_line":"using the user credentials. If the user does not have the permission to create"},{"line_number":23,"context_line":"one of the custom properties he is not able to create an image, thus he is not"},{"line_number":24,"context_line":"able to snapshot or shelve the instance."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"Use Cases"},{"line_number":27,"context_line":"----------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a1a9d01_d5da5de9","line":24,"in_reply_to":"9a1a9d01_f2f537cb","updated":"2015-10-01 21:02:46.000000000","message":"A snapshot is stored in Glance as an image.  Thus it inherits all the image_* properties in the instance_system_metadata table (except the ones enumerated in the non_inheritable_image_properties list in nova-api.conf).  If one of these properties is not writable by the user taking the snapshot, Glance will refuse to create the image, and then Nova will fail to complete the snapshot.\n\nThe current shelving code creates an image of the instance in Glance before it actually shelves the instance, so that operation will also fail under this scenario.\n\nSince Nova and Glance are separate systems, Nova doesn\u0027t know which image properties could cause a failure in Glance.  This spec proposes to get that info into Nova.","commit_id":"837ec89fc31441f7674aaba34ab5669b4974593e"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"1b23976d9d920a0480668694736e1a26723cda4b","unresolved":false,"context_lines":[{"line_number":27,"context_line":"----------"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"A cloud-administrator wants to store license-cost properties on a per-image"},{"line_number":30,"context_line":"basis (like how much to charge per hour per cpu). This property can be"},{"line_number":31,"context_line":"protected by role, but a cloud owner will want this property to be"},{"line_number":32,"context_line":"automatically inherited to child images."},{"line_number":33,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a1a9d01_525d03eb","line":30,"updated":"2015-10-01 20:16:58.000000000","message":"will this be a flavor related instead of image stuff?","commit_id":"837ec89fc31441f7674aaba34ab5669b4974593e"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"2dcb373dfa59bb91460b74ed6ce265e574e61091","unresolved":false,"context_lines":[{"line_number":27,"context_line":"----------"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"A cloud-administrator wants to store license-cost properties on a per-image"},{"line_number":30,"context_line":"basis (like how much to charge per hour per cpu). This property can be"},{"line_number":31,"context_line":"protected by role, but a cloud owner will want this property to be"},{"line_number":32,"context_line":"automatically inherited to child images."},{"line_number":33,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a1a9d01_7599111f","line":30,"in_reply_to":"9a1a9d01_525d03eb","updated":"2015-10-01 21:02:46.000000000","message":"This can\u0027t be a flavor property.  The number of CPUs is a flavor property, but having to pay an extra fee per CPU based on what software you\u0027re running is a property of the image that contains that software.  So the billing system needs to have both flavor and image info available when it bills for the instance.","commit_id":"837ec89fc31441f7674aaba34ab5669b4974593e"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"2ce86e1fa89d4378b3a87ba7235eb1effeb59487","unresolved":false,"context_lines":[{"line_number":27,"context_line":"----------"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"A cloud-administrator wants to store license-cost properties on a per-image"},{"line_number":30,"context_line":"basis (like how much to charge per hour per cpu). This property can be"},{"line_number":31,"context_line":"protected by role, but a cloud owner will want this property to be"},{"line_number":32,"context_line":"automatically inherited to child images."},{"line_number":33,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a1a9d01_3995b93f","line":30,"in_reply_to":"9a1a9d01_7599111f","updated":"2015-10-02 12:53:50.000000000","message":"ok","commit_id":"837ec89fc31441f7674aaba34ab5669b4974593e"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"0168da7dc97ab57e09d1686ee5e5bc4e2fa1bfd4","unresolved":false,"context_lines":[{"line_number":48,"context_line":"We propose to create the option \"inheritable_admin_image_properties\" containing"},{"line_number":49,"context_line":"a list of inheritable custom properties."},{"line_number":50,"context_line":"After creation of the image from snapshotting or shelving the instance, those"},{"line_number":51,"context_line":"properties will be set by nova using its admin credentials."},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"Alternatives"},{"line_number":54,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba8a016a_26e575a7","line":51,"updated":"2015-11-23 16:20:49.000000000","message":"I do think we need to discuss the service token idea here.","commit_id":"837ec89fc31441f7674aaba34ab5669b4974593e"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"1b23976d9d920a0480668694736e1a26723cda4b","unresolved":false,"context_lines":[{"line_number":93,"context_line":"---------------------"},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"A new option will be available in the config file of nova :"},{"line_number":96,"context_line":"inheritable_admin_image_properties"},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"Developer impact"},{"line_number":99,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a1a9d01_f21c5715","line":96,"updated":"2015-10-01 20:16:58.000000000","message":"need DocImpact because of the proposed item?\n\nand how can you control it? suppose image A has property A, image B has B then you configure this to [A , B] ? \nwhat about another image C need property C?","commit_id":"837ec89fc31441f7674aaba34ab5669b4974593e"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"2ce86e1fa89d4378b3a87ba7235eb1effeb59487","unresolved":false,"context_lines":[{"line_number":93,"context_line":"---------------------"},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"A new option will be available in the config file of nova :"},{"line_number":96,"context_line":"inheritable_admin_image_properties"},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"Developer impact"},{"line_number":99,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a1a9d01_94728cac","line":96,"in_reply_to":"9a1a9d01_080e7ce5","updated":"2015-10-02 12:53:50.000000000","message":"so those configurations can\u0027t be changed ,right? If I defined some images then suddenly I found I need another option to be set int he image (e.g image that make for Customer XXX), unless all nova/glance service restart, I can\u0027t snapshot/shelve them, right?\n\nAnd I agree with most of the comments above, how about include some into the specs?","commit_id":"837ec89fc31441f7674aaba34ab5669b4974593e"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"fe96c7723edc53a124c3fe84a9ea8555a7e62f09","unresolved":false,"context_lines":[{"line_number":93,"context_line":"---------------------"},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"A new option will be available in the config file of nova :"},{"line_number":96,"context_line":"inheritable_admin_image_properties"},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"Developer impact"},{"line_number":99,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a1a9d01_f39ac26d","line":96,"in_reply_to":"9a1a9d01_94728cac","updated":"2015-10-05 13:51:21.000000000","message":"You\u0027re right, the configs can\u0027t be changed in-flight without coordination between the Glance and Nova deployments.  I think this issue (Glance property protections not allowing image creation) is also a problem for Cinder.  (I\u0027m not sure how they\u0027re dealing with it, I think the deployer is supposed to give Cinder a copy of the Glance property protections config or something like that.)\n\nSo maybe this would be better worked as a collaboration between Glance, Nova, and Cinder to see what we can come up with to really fix this.","commit_id":"837ec89fc31441f7674aaba34ab5669b4974593e"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"2dcb373dfa59bb91460b74ed6ce265e574e61091","unresolved":false,"context_lines":[{"line_number":93,"context_line":"---------------------"},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"A new option will be available in the config file of nova :"},{"line_number":96,"context_line":"inheritable_admin_image_properties"},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"Developer impact"},{"line_number":99,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a1a9d01_080e7ce5","line":96,"in_reply_to":"9a1a9d01_f21c5715","updated":"2015-10-01 21:02:46.000000000","message":"DocImpact wouldn\u0027t hurt, though I think this part of the docs is generated from the option definitions in the code.\n\nI think it would work like this: In Glance, we have defined properties A, B, C that can only be written with admin credentials.  (This doesn\u0027t mean that all images have all these properties, it just means that these properties are \"protected\").  We set inheritable_admin_image_properties \u003d [A,B,C] in Nova.  When Nova creates an image from an instance, it grabs all the image properties from the instance_system_metadata table.  It partitions the list into the admin properties and the non-admin properties.  It creates the image the normal way passing the non-admin properties.  Then it updates the image with the admin properties using Glance admin credentials.  But it will only pass Glance the properties that actually exist for that instance.\n\nIn other words, the deployer can control this because he knows how Glance is configured, so he uses that knowledge to define the Nova option.","commit_id":"837ec89fc31441f7674aaba34ab5669b4974593e"},{"author":{"_account_id":6159,"name":"Flavio Percoco Premoli","display_name":"flaper87","email":"flavio.percoco@flyrlabs.com","username":"flaper87"},"change_message_id":"0e4a4e646de6411e4d8fc38101161f5801205970","unresolved":false,"context_lines":[{"line_number":93,"context_line":"---------------------"},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"A new option will be available in the config file of nova :"},{"line_number":96,"context_line":"inheritable_admin_image_properties"},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"Developer impact"},{"line_number":99,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a29b11f_04411b38","line":96,"in_reply_to":"9a1a9d01_f39ac26d","updated":"2015-10-21 05:35:28.000000000","message":"This is what I don\u0027t like about this spec. The fact that it depends on a config option to know what properties should be set by admins. It also requires an extra call using admin credentials to make this work.\n\nI wonder if Keystone trusts could be used here? I\u0027m not an expert on how trusts work but I\u0027ll do my homework","commit_id":"837ec89fc31441f7674aaba34ab5669b4974593e"}]}