diff options
| author | Piotr Milewski <vurmil@gmail.com> | 2026-07-28 15:30:14 +0200 |
|---|---|---|
| committer | Piotr Milewski <vurmil@gmail.com> | 2026-09-01 13:07:55 +0000 |
| commit | d2f3fa49db3a7ac69382cae1a0019665bfea4eb2 (patch) | |
| tree | ee85c425e2ce8f075ff3d7ac007334319021152f | |
| parent | 2a76a1f0b98de0ed035224f6cdd02edee99d2dfc (diff) | |
| download | kolla-ansible-d2f3fa49db3a7ac69382cae1a0019665bfea4eb2.tar.gz kolla-ansible-d2f3fa49db3a7ac69382cae1a0019665bfea4eb2.zip | |
Register keystoneauth options for [glance] config group
Cinder requires service-to-service authentication with Glance to
fetch direct image locations (e.g., for RBD CoW cloning). Because
keystoneauth parameters were not explicitly registered for the
[glance] section, they could not be properly configured and loaded.
This lack of authentication led to HTTP 403 Forbidden errors
during fetch_image_location, forcing a fallback to slow image
downloads.
This patch registers the required keystoneauth options in the
[glance] group, enabling proper service-to-service communication.
Closes-Bug: #2161971
Change-Id: I2cae59b34b1fbd4fa3bf1c5b2da5277ef4712916
Signed-off-by: Piotr Milewski <vurmil@gmail.com>
(cherry picked from commit 1056bc652b148bddc5d4cb667c8d3ef26a322aa9)
| -rw-r--r-- | ansible/roles/cinder/templates/cinder.conf.j2 | 12 | ||||
| -rw-r--r-- | releasenotes/notes/bug-2161971-1f167e47f9740326.yaml | 9 |
2 files changed, 21 insertions, 0 deletions
diff --git a/ansible/roles/cinder/templates/cinder.conf.j2 b/ansible/roles/cinder/templates/cinder.conf.j2 index 5e9fb5337..106091073 100644 --- a/ansible/roles/cinder/templates/cinder.conf.j2 +++ b/ansible/roles/cinder/templates/cinder.conf.j2 @@ -107,6 +107,18 @@ username = {{ nova_keystone_user }} password = {{ nova_keystone_password }} cafile = {{ openstack_cacert }} +[glance] +interface = internal +auth_url = {{ keystone_internal_url }} +auth_type = password +project_domain_id = {{ default_project_domain_id }} +user_domain_id = {{ default_user_domain_id }} +region_name = {{ openstack_region_name }} +project_name = service +username = {{ cinder_keystone_user }} +password = {{ cinder_keystone_password }} +cafile = {{ openstack_cacert }} + [database] connection = mysql+pymysql://{{ cinder_database_user }}:{{ cinder_database_password }}@{{ cinder_database_address }}/{{ cinder_database_name }}{{ '?ssl_ca=' ~ openstack_cacert if cinder_database_enable_tls_internal | bool }} connection_recycle_time = {{ database_connection_recycle_time }} diff --git a/releasenotes/notes/bug-2161971-1f167e47f9740326.yaml b/releasenotes/notes/bug-2161971-1f167e47f9740326.yaml new file mode 100644 index 000000000..e57a8a0bf --- /dev/null +++ b/releasenotes/notes/bug-2161971-1f167e47f9740326.yaml @@ -0,0 +1,9 @@ +--- +fixes: + - | + Fixes service-to-service authentication between Cinder and + Glance. This resolves ``HTTP 403 Forbidden`` errors during + ``fetch_image_location`` and restores fast volume cloning + (Copy-on-Write) for backends like RBD, preventing an + unnecessary fallback to slow image downloads. + `LP#2161971 <https://launchpad.net/bugs/2161971>`__ |