Split off the finalization part of the volume manager's
extend_volume method and make it externally callable as the new
os-extend_volume_completion admin volume action.
This is the first part of a feature that will allow volume drivers
to rely on feedback from Nova when extending attached volumes,
allowing e.g. NFS-based drivers to support online extend.
See the linked blueprint for details.
Implements: bp extend-volume-completion-action
Change-Id: I4aaa5da1ad67a948102c498483de318bd245d86b
Due to how the Linux SCSI kernel driver works there are some storage
systems, such as iSCSI with shared targets, where a normal user can
access other projects' volume data connected to the same compute host
using the attachments REST API.
This affects both single and multi-pathed connections.
To prevent users from doing this, unintentionally or maliciously,
cinder-api will now reject some delete attachment requests that are
deemed unsafe.
Cinder will process the delete attachment request normally in the
following cases:
- The request comes from an OpenStack service that is sending the
service token that has one of the roles in `service_token_roles`.
- Attachment doesn't have an instance_uuid value
- The instance for the attachment doesn't exist in Nova
- According to Nova the volume is not connected to the instance
- Nova is not using this attachment record
There are 3 operations in the actions REST API endpoint that can be used
for an attack:
- `os-terminate_connection`: Terminate volume attachment
- `os-detach`: Detach a volume
- `os-force_detach`: Force detach a volume
In this endpoint we just won't allow most requests not coming from a
service. The rules we apply are the same as for attachment delete
explained earlier, but in this case we may not have the attachment id
and be more restrictive. This should not be a problem for normal
operations because:
- Cinder backup doesn't use the REST API but RPC calls via RabbitMQ
- Glance doesn't use this interface anymore
Checking whether it's a service or not is done at the cinder-api level
by checking that the service user that made the call has at least one of
the roles in the `service_token_roles` configuration. These roles are
retrieved from keystone by the keystone middleware using the value of
the "X-Service-Token" header.
If Cinder is configured with `service_token_roles_required = true` and
an attacker provides non-service valid credentials the service will
return a 401 error, otherwise it'll return 409 as if a normal user had
made the call without the service token.
Closes-Bug: #2004555
Change-Id: I612905a1bf4a1706cce913c0d8a6df7a240d599a
This patch adds volume re-image API to enable the ability to
re-image a specific volume.
Implements: blueprint add-volume-re-image-api
Co-Authored-by: Rajat Dhasmana <rajatdhasmana@gmail.com>
Change-Id: I031aae50ee82198648f46c503bba04c6e231bbe5
Cinder only supports uploading volumes of encrypted volume types as
images with disk format 'raw' and container format 'bare'. Screen
for this at the REST API layer when the request is made.
Change-Id: Ibb77b8b1be6c35c5db3b07fdc4056afd51d48782
Closes-bug: #1935688
As end user can use either of "policy.json" or "policy.yaml" , so need
replace the mentioning of "policy.json" to the just "policy
configuration file" in api-ref.
Change-Id: Ibb8f56a89d3f188be18cc4ee7de493910a02fb98
Closes-Bug: #1875643
This admin API is only called externally by Nova at present when
finishing the migration or retype of an attached volume. However for
future reference it would be really useful to have this listed in the
official API reference guide.
Change-Id: I5fad6eb4903784870aa26fa0996a391bbbbb9276
This cleans up the cases where we had D001 violations so we can stop
skipping that check in doc8 runs.
Change-Id: Ie52f6ecac1a645fcbcc643b9ca63e033b622d830
Signed-off-by: Sean McGinnis <sean.mcginnis@gmail.com>
The value of os-vol-image-meta is not in parameters.yaml, so use
os-show_image_metadata to replace it.
Change-Id: I0400a1bf8dbe34f4b857e62832d11b098a8a2d2f
The response 'status' of initialize connection is 200, and the
"connector" parameter is required in initialize/terminate connection
API request.
This patch try to fix these wrong content.
Change-Id: I9d8c7c951b03f10fa29e3b3cc107a17e37b0e2bc
The parameters with name like example_1, example_2 ... etc. cause
confusion while updating the api-ref docs like the examples below:
https://review.openstack.org/#/c/609639/https://review.openstack.org/#/c/609611/
This patch does the following changes :
1) Replace numbering in the parameter with relevant names
2) Clean up unused parameters
Change-Id: I35b343bf068281d729576e5ecc209bda60c28680
Adds the v2 and v3 API reference documentation for the
admin-only (by default) os-migrate_volume volume action
API. The only major difference with the v3 API is the
cluster parameter introduced in the 3.16 microversion.
Change-Id: I70f6b2cc4d25ea155ce09ddeec26b995890a2db3
Partial-Bug: #1607539
A bunch of volume APIs are missing in current documentation, such
as os-reserve/os-unreserve/os-begin_detaching/os-roll_detaching
os-initialize_connection/os-terminate_connection, this patch is aim to
add the missing APIs.
Change-Id: If0732aa94db4e8cdef30a2be0c53314b507ee002
Closes-bug: #1761049
Using the wrong character resulted in the wrong title level
being used for the response codes, which in turn caused the
"detail" show/hide toggle to not be able to hide all of the
per-endpoint details. This corrects these to be at the correct
level.
Also ran into issues after changing them where sphinx was not
happy with the random title levels. This appears to be due to
the order processed and whether not earlier included files had
all subsequent levels. Adding an additional title in our first
included file resolved that problem.
Change-Id: I19405778980310f2d6d06eb7b23102f74a3d6e03
Closes-bug: #1755566
Rather than our freeform way of listing response codes in our
api-ref, we should be using the os-api-ref extension option to
get nicely formatted response code listings.
https://docs.openstack.org/os-api-ref/latest/usage.html#rest-status-code
Change-Id: Iee21f54fe7cf0ea28258966e2d0f8fa2849c83f2
I had to dig into the code to figure out that the force
detach volume action was for admins by default. We should
make that clear in the API reference.
Change-Id: I3493e23dba8267fb7e403d30dd0d1e90c8f7726b
This adds some notes about two things to consider with a volume
retype operation on an in-use multiattach volume:
1. The volume API will reject a retype operation on an in-use volume
where the volume's multiattach value would change.
2. Retyping an in-use volume that has more than one active read/write
attachment is not recommended because on the nova side the swap
volume operation performs a blockRebase which could potentially
lead to data corruption.
In the future, we (nova or cinder or both) will likely need to make
some changes as to what the default attach_mode is for secondary
attachments to a multiattach volume, since today we default to read/write
if it's not specified by the caller when making the attachment.
Change-Id: Ib5a2830ea3cd37236947677225252ef42edaa347
Client can still receive the 404/NotFound when attempting
the fetch of the volume.
Change-Id: Ieafaae5ccb5a23b4d3ad37b8e7eee40484346cfc
Signed-off-by: Xiaojun Liao <xiaojunliao85@gmail.com>
Some request details provided information about the other
JSON value while others didn't. To make things consistent
and to make sure API consumers understand how the requests
need to be structured, this adds missing instances. It also
reorders some parameter lists to be a little more logical,
so even though we can't show the nested nature of some of
these, it at least doesn't show inner values before outer
ones.
This also corrects many errors seen while going through
the API ref. This is by no means exhaustive, and is already
somewhat out of the scope for this patch, so it is expected
that there are some (many) cases that are not addressed by
this patch. Those will be fixed with ongoing effort in
future patches.
Partial-bug: #1713517
Change-Id: I30964ba8d829778fd01174d639d44ba07e4b77a6
The 'os-show_image_metadata' API is outdated.
Rewrite the document, also correct the response
codes for image metadata's create/delete APIs.
Change-Id: I50a5b3571973564b8b5010b412d94303866e8dcd
This change adds the ability to extend 'in-use' volume.
Once the volume size is extended, Nova is informed of the size change
through the external-event extension so the virt driver can perform
the appropriate actions for the host and guest to detect the new volume size.
Tempest related patches:
1. https://review.openstack.org/#/c/480746/
2. https://review.openstack.org/#/c/480778/
Depends-On: If10cffd0dc4c9879f6754ce39bee5fae1d04f474
Blueprint: extend-attached-volume
Co-Authored-By: TommyLike <tommylikehu@gmail.com>
APIImpact
Change-Id: I60c8ea9eb0bbcfe41f5f0a30ed8dc67bdcab3ebc
This patch implements the spec of reverting volume to
latest snapshot.
Related tempest and client patches:
[1] https://review.openstack.org/#/c/463906/
[2] https://review.openstack.org/#/c/464903/
APIImpact
DocImpact
Partial-Implements: blueprint revert-volume-to-snapshot
Change-Id: Ib20d749c2118c350b5fa0361ed1811296d518a17
Cinder's default policy allows the owner of a volume to initiate
a retype, even if they aren't an admin. However, if the volume
is going to be migrated during the retype operation, then Cinder
is going to call the Nova swap volume API, which by default is
admin-only. So if a non-admin user tries to retype and migrate
their volume, which is attached to a server instance, then it's
going to fail with a 403 error from Nova.
En lieu of a more complete solution, like Cinder using an
elevated service token to call Nova, this change just attempts
to document the restriction in the API reference.
Change-Id: I6282a6d319beead979780a33880947987906c2f3
Related-Bug: #1698224
There is no document about update a volume's bootable status,
so add the missing doc.
Change-Id: If706205678cfd7a803e2d7733bec34494b47fc66
Partial-Bug: #1607539
There is no API doc found for force-delete volume in cinder.
We need to add the API doc for the operation with its description,
request and response parameters.
Change-Id: Id25b4070a3946d2d7d89f44bdc81039286a5d8fe
Closes-bug: #1673644
Now some API documents for volume actions like
extending volume(https://developer.openstack.org/api-ref/
block-storage/v3/?expanded=extend-a-volume-size-detail) are
using incorrect request argument description
'volume_id in body'.
It should be 'in path'.
Change-Id: I2006b4af4dfc09fb0403c1a78ecef4ac920a51c4
Closes-Bug: #1691358
When the volume_id is in the path for an API, it is
required. This fixes the volume_id_1 parameter for the
path argument by making it required and also renaming
it to be more clear of what it's used for. And finally,
this fixes the os-attach parameter to indicate volume_id
is in the path and is required, not optional.
Change-Id: I0e8868d35b5ea06ef809c896f943d92ad8e71e3e
Modifies heading levels in .inc files to allow nested display in
table of contents. Table of contents depth has been changed to allow
this.
Change-Id: I3d8c9cf38a12272f0d32d3aa183d741277767535
Keystone API v2 was deprecated in Mitaka and uses "project"
instead of "tenant" in V3 now.
This patch change the "tenant" to "project" in Cinder API v3 doc.
Change-Id: I06d400f3e38d78014e9eae89b29b075adaecffe4
In the api ref most of our references to the status parameter are wrong,
since they are all referencing `status`, which in most cases is:
status:
description: |
The ``status`` of the consistency group snapshot.
This patch fixes this by referencing the right status parameter.
TrivialFix
Change-Id: I3f76ad10bacd8c75f742efc3ff3395a7effc31b5
Konrad Gube