glance #443

Supports: xenial bionic focal trusty groovy
Add to new model

Description

The Glance project provides an image registration and discovery service and an image delivery service. These services are used in conjunction by Nova to deliver images from object stores, such as OpenStack's Swift service, to Nova's compute nodes.


Overview

The glance charm deploys Glance, the core OpenStack service that acts as the central repository for virtual machine (VM) images. The charm works alongside other Juju-deployed OpenStack services.

Usage

Configuration

This section covers common and/or important configuration options. See file config.yaml for the full list of options, along with their descriptions and default values. See the Juju documentation for details on configuring applications.

openstack-origin

The openstack-origin option states the software sources. A common value is an OpenStack UCA release (e.g. 'cloud:bionic-ussuri' or 'cloud:focal-victoria'). See Ubuntu Cloud Archive. The underlying host's existing apt sources will be used if this option is not specified (this behaviour can be explicitly chosen by using the value of 'distro').

pool-type

The pool-type option dictates the Ceph storage pool type. See sections 'Ceph pool type' and 'Ceph backed storage' for more information.

Deployment

This section includes four different deployment scenarios (with their respective backends). Each scenario requires these applications to be present: keystone, nova-cloud-controller, nova-compute, and a cloud database.

Note: The database application is determined by the series. Prior to focal percona-cluster is used, otherwise it is mysql-innodb-cluster. In the example deployments below mysql-innodb-cluster has been chosen.

Ceph-backed storage

Ceph is the recommended storage backend solution for Glance. The steps below assume a pre-existing Ceph cluster (see the ceph-mon and ceph-osd charms).

Here, Glance is deployed to a new container on machine '1' and related to the Ceph cluster via the ceph-mon charm:

juju deploy --to lxd:1 glance
juju add-relation glance:ceph ceph-mon:client

Proceed with a group of commands common to all three scenarios:

juju add-relation glance:identity-service keystone:identity-service
juju add-relation glance:image-service nova-cloud-controller:image-service
juju add-relation glance:image-service nova-compute:image-service

juju deploy mysql-router glance-mysql-router
juju add-relation glance-mysql-router:db-router mysql-innodb-cluster:db-router
juju add-relation glance-mysql-router:shared-db glance:shared-db

This configuration can be used to support Glance in HA/scale-out deployments.

Note: In this scenario Glance acts as a Ceph client, which requires L3 network connectivity to Ceph monitors and OSDs. For MAAS-based deployments this can be addressed with network spaces (see section 'Network spaces' below).

Object storage-backed storage

Glance can use Object storage as its storage backend. OpenStack Swift and Ceph RADOS Gateway are supported, and both resulting configurations can be used to support Glance in HA/scale-out deployments.

Swift

The steps below assume a pre-existing Swift deployment (see the swift-proxy and swift-storage charms).

Here, Glance is deployed to a new container on machine '1' and related to Swift via the swift-proxy charm:

juju deploy --to lxd:1 glance
juju add-relation glance:object-store swift-proxy:object-store

Proceed with the common group of commands from the Ceph scenario.

Ceph RADOS Gateway

The steps below assume a pre-existing Ceph RADOS Gateway deployment (see the ceph-radosgw).

Here, Glance is deployed to a new container on machine '1' and related to the ceph-radosgw application:

juju deploy --to lxd:1 glance
juju add-relation glance:object-store ceph-radosgw:object-store

Proceed with the common group of commands from the Ceph scenario.

Local storage

Glance can simply use the storage available on the application unit's machine to store image data. Here, Glance is deployed to a new container on machine '1':

juju deploy --to lxd:1 glance

Proceed with the common group of commands from the Ceph scenario.

Multiple backends

If multiple storage backends are configured the cloud operator can specify, at image upload time, which backend will be used to store the image. This is done by using the --store option to the glance CLI client:

glance image-create --store <backend-name> ...

Otherwise, the default backend is determined by the following precedence order of backend names: 'ceph', 'swift', and then 'local'.

Important: The backend name of 'swift' denotes both object storage solutions (i.e. Swift and Ceph RADOS Gateway).

Actions

This section covers Juju actions supported by the charm. Actions allow specific operations to be performed on a per-unit basis. To display action descriptions run juju actions glance. If the charm is not deployed then see file actions.yaml.

  • openstack-upgrade
  • pause
  • resume
  • security-checklist

Ceph pool type

Ceph storage pools can be configured to ensure data resiliency either through replication or by erasure coding. This charm supports both types via the pool-type configuration option, which can take on the values of 'replicated' and 'erasure-coded'. The default value is 'replicated'.

For this charm, the pool type will be associated with Glance images.

Note: Erasure-coded pools are supported starting with Ceph Luminous.

Replicated pools

Replicated pools use a simple replication strategy in which each written object is copied, in full, to multiple OSDs within the cluster.

The ceph-osd-replication-count option sets the replica count for any object stored within the 'glance' rbd pool. Increasing this value increases data resilience at the cost of consuming more real storage in the Ceph cluster. The default value is '3'.

Important: The ceph-osd-replication-count option must be set prior to adding the relation to the ceph-mon (or ceph-proxy) application. Otherwise, the pool's configuration will need to be set by interfacing with the cluster directly.

Erasure coded pools

Erasure coded pools use a technique that allows for the same resiliency as replicated pools, yet reduces the amount of space required. Written data is split into data chunks and error correction chunks, which are both distributed throughout the cluster.

Note: Erasure coded pools require more memory and CPU cycles than replicated pools do.

When using erasure coded pools for Glance images two pools will be created: a replicated pool (for storing RBD metadata) and an erasure coded pool (for storing the data written into the RBD). The ceph-osd-replication-count configuration option only applies to the metadata (replicated) pool.

Erasure coded pools can be configured via options whose names begin with the ec- prefix.

Important: It is strongly recommended to tailor the ec-profile-k and ec-profile-m options to the needs of the given environment. These latter options have default values of '1' and '2' respectively, which result in the same space requirements as those of a replicated pool.

See Ceph Erasure Coding in the OpenStack Charms Deployment Guide for more information.

Ceph BlueStore compression

This charm supports BlueStore inline compression for its associated Ceph storage pool(s). The feature is enabled by assigning a compression mode via the bluestore-compression-mode configuration option. The default behaviour is to disable compression.

The efficiency of compression depends heavily on what type of data is stored in the pool and the charm provides a set of configuration options to fine tune the compression behaviour.

Note: BlueStore compression is supported starting with Ceph Mimic.

High availability

When more than one unit is deployed with the hacluster application the charm will bring up an HA active/active cluster.

There are two mutually exclusive high availability options: using virtual IP(s) or DNS. In both cases the hacluster subordinate charm is used to provide the Corosync and Pacemaker backend HA functionality.

See OpenStack high availability in the OpenStack Charms Deployment Guide for details.

Important: Glance in an HA configuration must be backed by either Ceph or Swift.

Glance metering

Glance metering can be achieved with Ceilometer. The rabbitmq-server and ceilometer-agent applications are required to be present.

Assuming Glance is deployed, add two relations:

juju add-relation glance:amqp rabbitmq-server:amqp
juju add-relation glance:amqp ceilometer-agent:amqp
juju add-relation glance:juju-info ceilometer-agent:container

Network spaces

This charm supports the use of Juju network spaces. This feature optionally allows specific types of the application's network traffic to be bound to subnets that the underlying hardware is connected to.

Note: Spaces must be configured in the backing cloud prior to deployment.

API endpoints can be bound to distinct network spaces supporting the network separation of public, internal and admin endpoints.

Glance acts as a Ceph client and needs IP connectivity to Ceph monitors and OSDs. Binding the ceph endpoint to a space can solve this problem in case monitors and OSDs are located on a single L2 broadcast domain (if they are not, static or dynamic routes need to be used in addition to spaces).

Access to the underlying MySQL instance can also be bound to a specific space using the shared-db relation.

To use this feature, use the --bind option when deploying the charm:

juju deploy glance --bind \
   "public=public-space \
    internal=internal-space \
    admin=admin-space \
    shared-db=internal-space \
    ceph=ceph-access-space"

Alternatively, these can also be provided as part of a juju native bundle configuration:

    glance:
      charm: cs:xenial/glance
      num_units: 1
      bindings:
        public: public-space
        admin: admin-space
        internal: internal-space
        shared-db: internal-space
        ceph: ceph-access-space

Note: Existing glance units configured with the os-admin-network, os-internal-network, or os-public-network options will continue to honour them. Furthermore, these options override any space bindings, if set.

Policy overrides

Policy overrides is an advanced feature that allows an operator to override the default policy of an OpenStack service. The policies that the service supports, the defaults it implements in its code, and the defaults that a charm may include should all be clearly understood before proceeding.

Caution: It is possible to break the system (for tenants and other services) if policies are incorrectly applied to the service.

Policy statements are placed in a YAML file. This file (or files) is then (ZIP) compressed into a single file and used as an application resource. The override is then enabled via a Boolean charm option.

Here are the essential commands (filenames are arbitrary):

zip overrides.zip override-file.yaml
juju attach-resource glance policyd-override=overrides.zip
juju config glance use-policyd-override=true

See Policy overrides in the OpenStack Charms Deployment Guide for a thorough treatment of this feature.

Bugs

Please report bugs on Launchpad.

For general charm questions refer to the OpenStack Charm Guide.


Configuration

action-managed-upgrade
(boolean) If True enables openstack upgrades for this charm via juju actions. You will still need to set openstack-origin to the new repository but instead of an upgrade running automatically across all units, it will wait for you to execute the openstack-upgrade action for this charm on each unit. If False it will revert to existing behavior of upgrading all units on config change.
api-config-flags
(string) Comma-separated list of key=value pairs to be added to glance-api.conf where 'value' may itself be a comma-separated list of values to be assigned to the 'key'.
bluestore-compression-algorithm
(string) Compressor to use (if any) for pools requested by this charm. . NOTE: The ceph-osd charm sets a global default for this value (defaults to 'lz4' unless configured by the end user) which will be used unless specified for individual pools.
bluestore-compression-max-blob-size
(int) Chunks larger than this are broken into smaller blobs sizing bluestore compression max blob size before being compressed on pools requested by this charm.
bluestore-compression-max-blob-size-hdd
(int) Value of bluestore compression max blob size for rotational media on pools requested by this charm.
bluestore-compression-max-blob-size-ssd
(int) Value of bluestore compression max blob size for solid state media on pools requested by this charm.
bluestore-compression-min-blob-size
(int) Chunks smaller than this are never compressed on pools requested by this charm.
bluestore-compression-min-blob-size-hdd
(int) Value of bluestore compression min blob size for rotational media on pools requested by this charm.
bluestore-compression-min-blob-size-ssd
(int) Value of bluestore compression min blob size for solid state media on pools requested by this charm.
bluestore-compression-mode
(string) Policy for using compression on pools requested by this charm. . 'none' means never use compression. 'passive' means use compression when clients hint that data is compressible. 'aggressive' means use compression unless clients hint that data is not compressible. 'force' means use compression under all circumstances even if the clients hint that the data is not compressible.
bluestore-compression-required-ratio
(float) The ratio of the size of the data chunk after compression relative to the original size must be at least this small in order to store the compressed version on pools requested by this charm.
ceph-osd-replication-count
(int) This value dictates the number of replicas ceph must make of any object it stores within the images rbd pool. Of course, this only applies if using Ceph as a backend store. Note that once the images rbd pool has been created, changing this value will not have any effect (although it can be changed in ceph by manually configuring your ceph cluster).
3
ceph-pool-weight
(int) Defines a relative weighting of the pool as a percentage of the total amount of data in the Ceph cluster. This effectively weights the number of placement groups for the pool created to be appropriately portioned to the amount of data expected. For example, if the compute images for the OpenStack compute instances are expected to take up 20% of the overall configuration then this value would be specified as 20. Note - it is important to choose an appropriate value for the pool weight as this directly affects the number of placement groups which will be created for the pool. The number of placement groups for a pool can only be increased, never decreased - so it is important to identify the percent of data that will likely reside in the pool.
5
container-formats
(string) Comma separated list of container formats that Glance will support.
database
(string) Glance database name.
glance
database-user
(string) Database username
glance
debug
(boolean) Enable debug logging.
disk-formats
(string) Comma separated list of disk formats that Glance will support.
ami,ari,aki,vhd,vmdk,raw,qcow2,vdi,iso,root-tar
dns-ha
(boolean) Use DNS HA with MAAS 2.0. Note if this is set do not set vip settings below.
ec-profile-crush-locality
(string) (lrc plugin) The type of the crush bucket in which each set of chunks defined by l will be stored. For instance, if it is set to rack, each group of l chunks will be placed in a different rack. It is used to create a CRUSH rule step such as step choose rack. If it is not set, no such grouping is done.
ec-profile-device-class
(string) Device class from CRUSH map to use for placement groups for erasure profile - valid values: ssd, hdd or nvme (or leave unset to not use a device class).
ec-profile-durability-estimator
(int) (shec plugin - c) The number of parity chunks each of which includes each data chunk in its calculation range. The number is used as a durability estimator. For instance, if c=2, 2 OSDs can be down without losing data.
ec-profile-helper-chunks
(int) (clay plugin - d) Number of OSDs requested to send data during recovery of a single chunk. d needs to be chosen such that k+1 <= d <= k+m-1. Larger the d, the better the savings.
ec-profile-k
(int) Number of data chunks that will be used for EC data pool. K+M factors should never be greater than the number of available zones (or hosts) for balancing.
1
ec-profile-locality
(int) (lrc plugin - l) Group the coding and data chunks into sets of size l. For instance, for k=4 and m=2, when l=3 two groups of three are created. Each set can be recovered without reading chunks from another set. Note that using the lrc plugin does incur more raw storage usage than isa or jerasure in order to reduce the cost of recovery operations.
ec-profile-m
(int) Number of coding chunks that will be used for EC data pool. K+M factors should never be greater than the number of available zones (or hosts) for balancing.
2
ec-profile-name
(string) Name for the EC profile to be created for the EC pools. If not defined a profile name will be generated based on the name of the pool used by the application.
ec-profile-plugin
(string) EC plugin to use for this applications pool. The following list of plugins acceptable - jerasure, lrc, isa, shec, clay.
jerasure
ec-profile-scalar-mds
(string) (clay plugin) specifies the plugin that is used as a building block in the layered construction. It can be one of jerasure, isa, shec (defaults to jerasure).
ec-profile-technique
(string) EC profile technique used for this applications pool - will be validated based on the plugin configured via ec-profile-plugin. Supported techniques are ‘reed_sol_van’, ‘reed_sol_r6_op’, ‘cauchy_orig’, ‘cauchy_good’, ‘liber8tion’ for jerasure, ‘reed_sol_van’, ‘cauchy’ for isa and ‘single’, ‘multiple’ for shec.
ec-rbd-metadata-pool
(string) Name of the metadata pool to be created (for RBD use-cases). If not defined a metadata pool name will be generated based on the name of the data pool used by the application. The metadata pool is always replicated, not erasure coded.
expose-image-locations
(boolean) Expose underlying image locations via the API when using Ceph for image storage. Only disable this option if you do not wish to use copy-on-write clones of RAW format images with Ceph in Cinder and Nova.
True
filesystem-store-datadir
(string) Directory to which the filesystem backend store writes images. Upon start up, Glance creates the directory if it doesn’t already exist and verifies write access to the user under which glance-api runs. If the write access isn’t available, a BadStoreConfiguration exception is raised and the filesystem store may not be available for adding new images. NOTE: This directory is used only when filesystem store is used as a storage backend.
/var/lib/glance/images/
ha-bindiface
(string) Default network interface on which HA cluster will bind to communication with the other members of the HA Cluster.
eth0
ha-mcastport
(int) Default multicast port number that will be used to communicate between HA Cluster nodes.
5444
haproxy-client-timeout
(int) Client timeout configuration in ms for haproxy, used in HA configurations. If not provided, default value of 90000ms is used.
haproxy-connect-timeout
(int) Connect timeout configuration in ms for haproxy, used in HA configurations. If not provided, default value of 9000ms is used.
haproxy-queue-timeout
(int) Queue timeout configuration in ms for haproxy, used in HA configurations. If not provided, default value of 9000ms is used.
haproxy-server-timeout
(int) Server timeout configuration in ms for haproxy, used in HA configurations. If not provided, default value of 90000ms is used.
harden
(string) Apply system hardening. Supports a space-delimited list of modules to run. Supported modules currently include os, ssh, apache and mysql.
image-size-cap
(string) Maximum size of image a user can upload. Defaults to 1TB (1099511627776 bytes). Example values: 500M, 500MB, 5G, 5TB. Valid units: K, KB, M, MB, G, GB, T, TB, P, PB. If no units provided, bytes are assumed. . WARNING: this value should only be increased after careful consideration and must be set to a value under 8EB (9223372036854775808 bytes).
1TB
nagios_context
(string) Used by the nrpe-external-master subordinate charm. A string that will be prepended to instance name to set the host name in nagios. So for instance the hostname would be something like 'juju-myservice-0'. If you are running multiple environments with the same services in them this allows you to differentiate between them.
juju
nagios_servicegroups
(string) A comma-separated list of nagios service groups. If left empty, the nagios_context will be used as the servicegroup
openstack-origin
(string) Repository from which to install. May be one of the following: distro (default), ppa:somecustom/ppa, a deb url sources entry, or a supported Ubuntu Cloud Archive e.g. . cloud:<series>-<openstack-release> cloud:<series>-<openstack-release>/updates cloud:<series>-<openstack-release>/staging cloud:<series>-<openstack-release>/proposed . See https://wiki.ubuntu.com/OpenStack/CloudArchive for info on which cloud archives are available and supported. . NOTE: updating this setting to a source that is known to provide a later version of OpenStack will trigger a software upgrade unless action-managed-upgrade is set to True.
distro
os-admin-hostname
(string) The hostname or address of the admin endpoints created for glance in the keystone identity provider. . This value will be used for admin endpoints. For example, an os-admin-hostname set to 'glance.admin.example.com' with ssl enabled will create a admin endpoint for glance of: . https://glance.admin.example.com:9292/
os-admin-network
(string) The IP address and netmask of the OpenStack Admin network (e.g. 192.168.0.0/24) . This network will be used for admin endpoints.
os-internal-hostname
(string) The hostname or address of the internal endpoints created for glance in the keystone identity provider. . This value will be used for internal endpoints. For example, an os-internal-hostname set to 'glance.internal.example.com' with ssl enabled will create a internal endpoint for glance of: . https://glance.internal.example.com:9292/
os-internal-network
(string) The IP address and netmask of the OpenStack Internal network (e.g. 192.168.0.0/24) . This network will be used for internal endpoints.
os-public-hostname
(string) The hostname or address of the public endpoints created for glance in the keystone identity provider. . This value will be used for public endpoints. For example, an os-public-hostname set to 'glance.example.com' with ssl enabled will create a public endpoint for glance of: . https://glance.example.com:9292/
os-public-network
(string) The IP address and netmask of the OpenStack Public network (e.g. 192.168.0.0/24) . This network will be used for public endpoints.
pool-type
(string) Ceph pool type to use for storage - valid values include ‘replicated’ and ‘erasure-coded’.
replicated
prefer-ipv6
(boolean) If True enables IPv6 support. The charm will expect network interfaces to be configured with an IPv6 address. If set to False (default) IPv4 is expected. . NOTE: these charms do not currently support IPv6 privacy extension. In order for this charm to function correctly, the privacy extension must be disabled and a non-temporary address must be configured/available on your network interface.
rabbit-user
(string) Username to request access on rabbitmq-server.
glance
rabbit-vhost
(string) RabbitMQ virtual host to request access on rabbitmq-server.
openstack
rbd-pool-name
(string) Optionally specify an existing rbd pool that cinder should map to.
region
(string) OpenStack Region
RegionOne
registry-config-flags
(string) Comma-separated list of key=value pairs to be added to glance-registry.conf where 'value' may itself be a comma-separated list of values to be assigned to the 'key'.
restrict-ceph-pools
(boolean) Optionally restrict Ceph key permissions to access pools as required.
restrict-image-location-operations
(boolean) If this is set to True, all *_image_location operations in the Glance api will be restricted to role:admin which will result in non-admin users no longer being able to view the "locations" information for an image. This only affects environments that have expose-image-locations set to True. WARNING: enabling this restriction will cause Nova to no longer be able to create COW clones or snapshots for non-admin users when using the RBDImageBackend in the nova-compute charm.
ssl_ca
(string) SSL CA to use with the certificate and key provided - this is only required if you are providing a privately signed ssl_cert and ssl_key.
ssl_cert
(string) SSL certificate to install and use for API ports. Setting this value and ssl_key will enable reverse proxying, point Glance's entry in the Keystone catalog to use https, and override any certificate and key issued by Keystone (if it is configured to do so).
ssl_key
(string) SSL key to use with certificate specified as ssl_cert.
use-internal-endpoints
(boolean) Openstack mostly defaults to using public endpoints for internal communication between services. If set to True this option will configure services to use internal endpoints where possible.
use-policyd-override
(boolean) If True then use the resource file named 'policyd-override' to install override YAML files in the service's policy.d directory. The resource file should be a ZIP file containing at least one yaml file with a .yaml or .yml extension. If False then remove the overrides.
use-syslog
(boolean) Setting this to True will allow supporting services to log to syslog.
verbose
(boolean) Enable verbose logging.
vip
(string) Virtual IP(s) to use to front API services in HA configuration. . If multiple networks are being used, a VIP should be provided for each network, separated by spaces.
vip_cidr
(int) Default CIDR netmask to use for HA vip when it cannot be automatically determined.
24
vip_iface
(string) Default network interface to use for HA vip when it cannot be automatically determined.
eth0
worker-multiplier
(float) The CPU core multiplier to use when configuring worker processes for Glance. By default, the number of workers for each daemon is set to twice the number of CPU cores a service unit has. When deployed in a LXD container, this default value will be capped to 4 workers unless this configuration option is set.