[Bug 1947518] [NEW] [RBD] Cinder started requiring write access to glance images RBD pool

[Launchpad Bug Tracker]

You have been subscribed to a public bug:

Bug summary:

Cinder started requiring write access to glance images RBD pool (on creating volume from image).
See the log excerpt at the report's bottom for the error message.

Identified cause:

I identified the following change as introducing this issue.
"RBD: use correct stripe unit in clone operation"
Change-Id: Iec111ab83e9ed8182c9679c911e3d90927d5a7c3
https://review.opendev.org/c/openstack/cinder/+/786260

Unfortunately, it has been backported back to Train and broke stable
deployments. :-(

The `self.rbd.Image` invocation requires write privileges to the image's pool.
This goes against the recommended caps set: https://docs.ceph.com/en/pacific/rbd/rbd-openstack/
The workaround is to revert the change or temporarily set the write access as allowed for Cinder.

Tested versions:
Cinder Victoria + Ceph Nautilus
Cinder Xena + Ceph Octopus

QA suggestions:

Ensure that cinder backend is tested with the recommended caps (images read-only).
Ensure that a raw image is tested (the default qcow2 image of cirros gets copied, not cloned).

Log excerpt:

2021-10-17 19:58:58.820 28 ERROR oslo_messaging.rpc.server   File "/var/lib/kolla/venv/lib/python3.7/site-packages/cinder/volume/flows/manager/create_volume.py", line 1032, in _create_from_image
2021-10-17 19:58:58.820 28 ERROR oslo_messaging.rpc.server     image_service)
2021-10-17 19:58:58.820 28 ERROR oslo_messaging.rpc.server   File "/var/lib/kolla/venv/lib/python3.7/site-packages/cinder/volume/drivers/rbd.py", line 1584, in clone_image
2021-10-17 19:58:58.820 28 ERROR oslo_messaging.rpc.server     volume_update = self._clone(volume, pool, image, snapshot)
2021-10-17 19:58:58.820 28 ERROR oslo_messaging.rpc.server   File "/var/lib/kolla/venv/lib/python3.7/site-packages/cinder/volume/drivers/rbd.py", line 1034, in _clone
2021-10-17 19:58:58.820 28 ERROR oslo_messaging.rpc.server     stripe_unit = self._get_stripe_unit(src_client.ioctx, src_image)
2021-10-17 19:58:58.820 28 ERROR oslo_messaging.rpc.server   File "/var/lib/kolla/venv/lib/python3.7/site-packages/cinder/volume/drivers/rbd.py", line 1018, in _get_stripe_unit
2021-10-17 19:58:58.820 28 ERROR oslo_messaging.rpc.server     image = self.rbd.Image(ioctx, volume_name)
2021-10-17 19:58:58.820 28 ERROR oslo_messaging.rpc.server   File "rbd.pyx", line 2960, in rbd.Image.__init__
2021-10-17 19:58:58.820 28 ERROR oslo_messaging.rpc.server rbd.PermissionError: [errno 1] error opening image b'XXX' at snapshot None

** Affects: cinder
     Importance: High
     Assignee: Eric Harney (eharney)
         Status: Fix Released

** Affects: cloud-archive
     Importance: Undecided
         Status: New


** Tags: cinder glance in-stable-train in-stable-ussuri in-stable-victoria in-stable-wallaby in-stable-xena rbd
-- 
[RBD] Cinder started requiring write access to glance images RBD pool
https://bugs.launchpad.net/bugs/1947518
You received this bug notification because you are a member of Ubuntu OpenStack, which is subscribed to Ubuntu Cloud Archive.