Summary
The glance_image role only checks whether an image with the given name already exists in Glance and skips the upload entirely if one is found. It does not compare the image content, checksum, URL, or any versioning metadata against the existing image.
This means that during an Atmosphere upgrade (for example, upgrading from one release to another), service images such as the Manila service image will not be replaced even though the upstream image URL has changed to point to a newer version.
Affected role
roles/glance_image/tasks/main.yml — line 29:
- name: Download image and upload into Glance
run_once: true
when: _image_info.images | length == 0
The condition _image_info.images | length == 0 causes the entire upload block to be skipped whenever an image with the matching name exists, with no further validation.
Steps to reproduce
- Deploy Atmosphere at version N (e.g. 5.6.0). The Manila service image is uploaded as
manila-service-image.
- Upgrade Atmosphere to version N+1 (e.g. 5.8.0). The
manila_image_url now points to a newer image artifact.
- Run the Manila role /
generate_resources tasks.
- Observe that the existing
manila-service-image in Glance is not replaced, because the name-existence check returns true.
Expected behaviour
When the source image URL or content changes between Atmosphere versions, the glance_image role should detect the change and replace (or update) the existing Glance image to ensure the correct version is in use.
Suggested fix
One or more of the following strategies could be used:
- Store the source URL as a Glance image property (e.g.
atmosphere_source_url) at upload time, and compare it on subsequent runs. If the URL differs, delete the old image and upload the new one.
- Compare a checksum of the downloaded file against the checksum stored by Glance.
- Use image tags or a dedicated property to carry a version identifier that can be compared across runs.
Impact
Service images (such as the Manila generic-driver service image) continue running the old version after an Atmosphere upgrade, potentially causing incompatibilities with the newly deployed service containers.
Summary
The
glance_imagerole only checks whether an image with the given name already exists in Glance and skips the upload entirely if one is found. It does not compare the image content, checksum, URL, or any versioning metadata against the existing image.This means that during an Atmosphere upgrade (for example, upgrading from one release to another), service images such as the Manila service image will not be replaced even though the upstream image URL has changed to point to a newer version.
Affected role
roles/glance_image/tasks/main.yml— line 29:The condition
_image_info.images | length == 0causes the entire upload block to be skipped whenever an image with the matching name exists, with no further validation.Steps to reproduce
manila-service-image.manila_image_urlnow points to a newer image artifact.generate_resourcestasks.manila-service-imagein Glance is not replaced, because the name-existence check returnstrue.Expected behaviour
When the source image URL or content changes between Atmosphere versions, the
glance_imagerole should detect the change and replace (or update) the existing Glance image to ensure the correct version is in use.Suggested fix
One or more of the following strategies could be used:
atmosphere_source_url) at upload time, and compare it on subsequent runs. If the URL differs, delete the old image and upload the new one.Impact
Service images (such as the Manila generic-driver service image) continue running the old version after an Atmosphere upgrade, potentially causing incompatibilities with the newly deployed service containers.