diff --git a/glance/templates/configmap-etc.yaml b/glance/templates/configmap-etc.yaml index 9b622b1785..ba8b86c42e 100644 --- a/glance/templates/configmap-etc.yaml +++ b/glance/templates/configmap-etc.yaml @@ -13,5 +13,7 @@ data: {{ tuple "etc/_glance-api-paste.ini.tpl" . | include "template" | indent 4 }} glance-registry.conf: |+ {{ tuple "etc/_glance-registry.conf.tpl" . | include "template" | indent 4 }} + glance-registry-paste.ini: |+ +{{ tuple "etc/_glance-registry-paste.ini.tpl" . | include "template" | indent 4 }} policy.json: |+ {{ tuple "etc/_policy.json.tpl" . | include "template" | indent 4 }} diff --git a/glance/templates/deployment-api.yaml b/glance/templates/deployment-api.yaml index e150aa5a94..46086de678 100644 --- a/glance/templates/deployment-api.yaml +++ b/glance/templates/deployment-api.yaml @@ -34,24 +34,29 @@ spec: image: {{ .Values.images.api }} imagePullPolicy: {{ .Values.images.pull_policy }} command: - - glance-api --config-dir /etc/glance + - glance-api + - --config-file + - /etc/glance/glance-api.conf ports: - containerPort: {{ .Values.network.port.api }} readinessProbe: tcpSocket: port: {{ .Values.network.port.api }} volumeMounts: + - name: etcglance + mountPath: /etc/glance - name: glanceapiconf mountPath: /etc/glance/glance-api.conf subPath: glance-api.conf + readOnly: true - name: glanceapipaste mountPath: /etc/glance/glance-api-paste.ini subPath: glance-api-paste.ini - - name: etcglance - mountPath: /etc/glance + readOnly: true - name: glancepolicy mountPath: /etc/glance/policy.json subPath: policy.json + readOnly: true {{- if .Values.development.enabled }} - name: glance-data mountPath: /var/lib/glance/images @@ -59,9 +64,11 @@ spec: - name: cephconf mountPath: /etc/ceph/ceph.conf subPath: ceph.conf + readOnly: true - name: cephclientglancekeyring mountPath: /etc/ceph/ceph.client.{{ .Values.ceph.glance_user }}.keyring subPath: ceph.client.{{ .Values.ceph.glance_user }}.keyring + readOnly: true {{- end }} volumes: - name: glanceapiconf diff --git a/glance/templates/deployment-registry.yaml b/glance/templates/deployment-registry.yaml index f8f6c6327e..e6ab5cd79e 100644 --- a/glance/templates/deployment-registry.yaml +++ b/glance/templates/deployment-registry.yaml @@ -27,16 +27,37 @@ spec: imagePullPolicy: {{ .Values.images.pull_policy }} command: - glance-registry + - --config-file + - /etc/glance/glance-registry.conf ports: - containerPort: {{ .Values.network.port.registry }} readinessProbe: tcpSocket: port: {{ .Values.network.port.registry }} volumeMounts: + - name: etcglance + mountPath: /etc/glance - name: glanceregistryconf mountPath: /etc/glance/glance-registry.conf subPath: glance-registry.conf + readOnly: true + - name: glanceregistrypaste + mountPath: /etc/glance/glance-registry-paste.ini + subPath: glance-registry-paste.ini + readOnly: true + - name: glancepolicy + mountPath: /etc/glance/policy.json + subPath: policy.json + readOnly: true volumes: + - name: etcglance + emptyDir: {} - name: glanceregistryconf configMap: name: glance-etc + - name: glanceregistrypaste + configMap: + name: glance-etc + - name: glancepolicy + configMap: + name: glance-etc diff --git a/glance/templates/etc/_glance-registry-paste.ini.tpl b/glance/templates/etc/_glance-registry-paste.ini.tpl new file mode 100644 index 0000000000..492dbc6f53 --- /dev/null +++ b/glance/templates/etc/_glance-registry-paste.ini.tpl @@ -0,0 +1,35 @@ +# Use this pipeline for no auth - DEFAULT +[pipeline:glance-registry] +pipeline = healthcheck osprofiler unauthenticated-context registryapp + +# Use this pipeline for keystone auth +[pipeline:glance-registry-keystone] +pipeline = healthcheck osprofiler authtoken context registryapp + +# Use this pipeline for authZ only. This means that the registry will treat a +# user as authenticated without making requests to keystone to reauthenticate +# the user. +[pipeline:glance-registry-trusted-auth] +pipeline = healthcheck osprofiler context registryapp + +[app:registryapp] +paste.app_factory = glance.registry.api:API.factory + +[filter:healthcheck] +paste.filter_factory = oslo_middleware:Healthcheck.factory +backends = disable_by_file +disable_by_file_path = /etc/glance/healthcheck_disable + +[filter:context] +paste.filter_factory = glance.api.middleware.context:ContextMiddleware.factory + +[filter:unauthenticated-context] +paste.filter_factory = glance.api.middleware.context:UnauthenticatedContextMiddleware.factory + +[filter:authtoken] +paste.filter_factory = keystonemiddleware.auth_token:filter_factory + +[filter:osprofiler] +paste.filter_factory = osprofiler.web:WsgiMiddleware.factory +hmac_keys = SECRET_KEY #DEPRECATED +enabled = yes #DEPRECATED