** Description changed:
********** SRU TEMPLATE AT THE BOTTOM *********
- This bug seems to be a corner case or side effect of the changes
+ This bug seems to be a corner case or side effect of the changes
in [1] and [2] which fixed bugs LP#1527324 and LP#1823445.
- The code in _translate_to_glance() (coming from the patch in [1]
- addressing bug LP1527324), removes the 'properties' key from the
+ The code in _translate_to_glance() (coming from the patch in [1]
+ addressing bug LP1527324), removes the 'properties' key from the
image metadata dict:
- def _translate_to_glance(image_meta):
- image_meta = _convert_to_string(image_meta)
+ def _translate_to_glance(image_meta):
+ image_meta = _convert_to_string(image_meta)
image_meta = _remove_read_only(image_meta)
- # NOTE(tsekiyama): From the Image API v2, custom properties must
- # be stored in image_meta directly, instead of the 'properties' key.
- properties = image_meta.get('properties')
- if properties:
- image_meta.update(properties)
+ # NOTE(tsekiyama): From the Image API v2, custom properties must
+ # be stored in image_meta directly, instead of the 'properties' key.
+ properties = image_meta.get('properties')
+ if properties:
+ image_meta.update(properties)
del image_meta['properties']
- This patch ensured that the 'properties' key is removed from the
+ This patch ensured that the 'properties' key is removed from the
image metadata dict before it is sent to Glance.
- Now, there may be scenarios where 'properties: {}' which would cause
+ Now, there may be scenarios where 'properties: {}' which would cause
upload-to-image to fail as below:
- On instance['properties']:
- {} (HTTP 400) (Request-ID: req-e3203748-8e6a-4dae-a4fa-7cc90c978ee2)
- ...
+ On instance['properties']:
+ {} (HTTP 400) (Request-ID: req-e3203748-8e6a-4dae-a4fa-7cc90c978ee2)
+ ...
BadRequest: Unable to set 'properties' to {}. Reason: {} is not of type
'string'
- Failed validating 'type' in schema['additionalProperties']:
+ Failed validating 'type' in schema['additionalProperties']:
{'type': 'string'}
- One of such scenarios is when filter_out_reserved_namespaces_metadata() is
- called with a key/value in the 'properties' field that's also in the
- reserved name spaces (as added by [2]). This would cause filtering out
- all the properties, resulting in 'properties: {}'. Sample log message from
+ One of such scenarios is when filter_out_reserved_namespaces_metadata() is
+ called with a key/value in the 'properties' field that's also in the
+ reserved name spaces (as added by [2]). This would cause filtering out
+ all the properties, resulting in 'properties: {}'. Sample log message from
such a scenario is as below:
2026-03-13 12:14:24.459998 2026-03-13 12:14:24.459 3916766 DEBUG
cinder.image.image_utils [req-be108cd8-1897-4ae8-a68d-14349a52a51e ...]
The metadata set [{'container_format': 'bare', 'disk_format': 'raw',
'name': 'test', 'properties': {'signature_verified': 'False'}}] was
filtered using the reserved name spaces [['os_glance', 'img_signature',
'signature_verified']], and the result is [{'container_format': 'bare',
'disk_format': 'raw', 'name': 'test', 'properties': {}}].
filter_out_reserved_namespaces_metadata /usr/lib/python3/dist-
packages/cinder/image/image_utils.py:1380
- IN the scenario above, signature_verified is likely added by
- _create_from_image_cache_or_download() when creating a volume
+ IN the scenario above, signature_verified is likely added by
+ _create_from_image_cache_or_download() when creating a volume
from an image.
- A quick workaround in this case should be to remove signature_verified
+ A quick workaround in this case should be to remove signature_verified
from volume image metadata before running openstack image create:
openstack volume unset --image-property signature_verified <VOLUME_ID>
- Affected versions:
+ Affected versions:
------------------
The code that leads to this is still present in the master branch.
- Reproducer:
+ Reproducer:
-----------
- openstack volume create --image <image> --size <size> testvol
- # set signature_verified if not in volume_image_metadata already
- openstack volume set --image-property signature_verified=False testvol
+ openstack volume create --image <image> --size <size> testvol
+ # set signature_verified if not in volume_image_metadata already
+ openstack volume set --image-property signature_verified=False testvol
openstack image create --disk-format raw --container-format bare --private
--volume testvol testimg
- [1]
[https://review.opendev.org/c/openstack/cinder/+/259405](https://review.opendev.org/c/openstack/cinder/+/259405)
+ [1]
[https://review.opendev.org/c/openstack/cinder/+/259405](https://review.opendev.org/c/openstack/cinder/+/259405)
[2]
[https://review.opendev.org/c/openstack/cinder/+/936993](https://review.opendev.org/c/openstack/cinder/+/936993)
********** SRU TEMPLATE *********
[ Impact ]
- Creating an image from a volume ("openstack image create --volume <vol-id>",)
- fails with an HTTP 400 error code from Glance whenever the volume image
+ Creating an image from a volume ("openstack image create --volume <vol-id>",)
+ fails with an HTTP 400 error code from Glance whenever the volume image
metadata ends up producing an empty 'properties' dict:
- On instance['properties']:
- {} (HTTP 400) (Request-ID: req-e3203748-8e6a-4dae-a4fa-7cc90c978ee2)
- ...
+ On instance['properties']:
+ {} (HTTP 400) (Request-ID: req-e3203748-8e6a-4dae-a4fa-7cc90c978ee2)
+ ...
BadRequest: Unable to set 'properties' to {}. Reason: {} is not of type
'string'
- cinder.image.glance._translate_to_glance() is supposed to flatten the
- custom properties into the top level image metadata so when 'properties'
- is an empty dict the key is not removed and 'properties': {} is sent to
+ cinder.image.glance._translate_to_glance() is supposed to flatten the
+ custom properties into the top level image metadata so when 'properties'
+ is an empty dict the key is not removed and 'properties': {} is sent to
Glance, which rejects it and causes the image creation to fail.
- The fix is a simple change in _translate_to_glance() to test for
- 'properties' being present (not None), so that an empty properties dict
+ The fix is a simple change in _translate_to_glance() to test for
+ 'properties' being present (not None), so that an empty properties dict
is removed from the metadata before the request is sent to Glance.
[ Test Plan ]
Steps to reproduce the issue in an Openstack cloud:
- 1. Create a volume:
- openstack volume create --image <image> --size <size> testvol
- 2. Set signature_verified if not set in volume_image_metadata already:
- openstack volume set --image-property signature_verified=False testvol
- 3. Create an image from the created volume:
+ 1. Create a volume:
+ openstack volume create --image <image> --size <size> testvol
+ 2. Set signature_verified if not set in volume_image_metadata already:
+ openstack volume show testvol -c volume_image_metadata -f yaml
+ volume_image_metadata:
+ checksum: 87617e24a5e30cb3b87fda8c0764838f
+ container_format: bare
+ disk_format: qcow2
+ image_id: ff8a94b6-18d1-4a6e-a01e-94f60ca43cd6
+ image_name: cirros
+ min_disk: '0'
+ min_ram: '0'
+ signature_verified: 'False'
+ size: '21692416'
+ openstack volume set --image-property signature_verified=False testvol
+ 3. Create an image from the created volume:
openstack image create --disk-format raw --container-format bare
--private --volume testvol testimg
[ Where problems could occur ]
- The change affects a single function _translate_to_glance() and
- considering it maintains the same logic and functionality, adding
- only extra safety measures, the risk of regressions or potential issues
+ The change affects a single function _translate_to_glance() and
+ considering it maintains the same logic and functionality, adding
+ only extra safety measures, the risk of regressions or potential issues
is minimal.
[ Other Info ]
None.
** Description changed:
********** SRU TEMPLATE AT THE BOTTOM *********
This bug seems to be a corner case or side effect of the changes
in [1] and [2] which fixed bugs LP#1527324 and LP#1823445.
The code in _translate_to_glance() (coming from the patch in [1]
addressing bug LP1527324), removes the 'properties' key from the
image metadata dict:
def _translate_to_glance(image_meta):
image_meta = _convert_to_string(image_meta)
image_meta = _remove_read_only(image_meta)
# NOTE(tsekiyama): From the Image API v2, custom properties must
# be stored in image_meta directly, instead of the 'properties' key.
properties = image_meta.get('properties')
if properties:
image_meta.update(properties)
del image_meta['properties']
This patch ensured that the 'properties' key is removed from the
image metadata dict before it is sent to Glance.
Now, there may be scenarios where 'properties: {}' which would cause
upload-to-image to fail as below:
On instance['properties']:
{} (HTTP 400) (Request-ID: req-e3203748-8e6a-4dae-a4fa-7cc90c978ee2)
...
BadRequest: Unable to set 'properties' to {}. Reason: {} is not of type
'string'
Failed validating 'type' in schema['additionalProperties']:
{'type': 'string'}
One of such scenarios is when filter_out_reserved_namespaces_metadata() is
called with a key/value in the 'properties' field that's also in the
reserved name spaces (as added by [2]). This would cause filtering out
all the properties, resulting in 'properties: {}'. Sample log message from
such a scenario is as below:
2026-03-13 12:14:24.459998 2026-03-13 12:14:24.459 3916766 DEBUG
cinder.image.image_utils [req-be108cd8-1897-4ae8-a68d-14349a52a51e ...]
The metadata set [{'container_format': 'bare', 'disk_format': 'raw',
'name': 'test', 'properties': {'signature_verified': 'False'}}] was
filtered using the reserved name spaces [['os_glance', 'img_signature',
'signature_verified']], and the result is [{'container_format': 'bare',
'disk_format': 'raw', 'name': 'test', 'properties': {}}].
filter_out_reserved_namespaces_metadata /usr/lib/python3/dist-
packages/cinder/image/image_utils.py:1380
IN the scenario above, signature_verified is likely added by
_create_from_image_cache_or_download() when creating a volume
from an image.
A quick workaround in this case should be to remove signature_verified
from volume image metadata before running openstack image create:
openstack volume unset --image-property signature_verified <VOLUME_ID>
Affected versions:
------------------
The code that leads to this is still present in the master branch.
Reproducer:
-----------
openstack volume create --image <image> --size <size> testvol
# set signature_verified if not in volume_image_metadata already
openstack volume set --image-property signature_verified=False testvol
openstack image create --disk-format raw --container-format bare --private
--volume testvol testimg
[1]
[https://review.opendev.org/c/openstack/cinder/+/259405](https://review.opendev.org/c/openstack/cinder/+/259405)
[2]
[https://review.opendev.org/c/openstack/cinder/+/936993](https://review.opendev.org/c/openstack/cinder/+/936993)
********** SRU TEMPLATE *********
[ Impact ]
Creating an image from a volume ("openstack image create --volume <vol-id>",)
fails with an HTTP 400 error code from Glance whenever the volume image
metadata ends up producing an empty 'properties' dict:
On instance['properties']:
{} (HTTP 400) (Request-ID: req-e3203748-8e6a-4dae-a4fa-7cc90c978ee2)
...
BadRequest: Unable to set 'properties' to {}. Reason: {} is not of type
'string'
cinder.image.glance._translate_to_glance() is supposed to flatten the
custom properties into the top level image metadata so when 'properties'
is an empty dict the key is not removed and 'properties': {} is sent to
Glance, which rejects it and causes the image creation to fail.
The fix is a simple change in _translate_to_glance() to test for
'properties' being present (not None), so that an empty properties dict
is removed from the metadata before the request is sent to Glance.
[ Test Plan ]
Steps to reproduce the issue in an Openstack cloud:
1. Create a volume:
openstack volume create --image <image> --size <size> testvol
2. Set signature_verified if not set in volume_image_metadata already:
+ openstack volume set --image-property signature_verified=False testvol
openstack volume show testvol -c volume_image_metadata -f yaml
- volume_image_metadata:
- checksum: 87617e24a5e30cb3b87fda8c0764838f
- container_format: bare
- disk_format: qcow2
- image_id: ff8a94b6-18d1-4a6e-a01e-94f60ca43cd6
- image_name: cirros
- min_disk: '0'
- min_ram: '0'
- signature_verified: 'False'
- size: '21692416'
- openstack volume set --image-property signature_verified=False testvol
+ volume_image_metadata:
+ checksum: 87617e24a5e30cb3b87fda8c0764838f
+ container_format: bare
+ disk_format: qcow2
+ image_id: ff8a94b6-18d1-4a6e-a01e-94f60ca43cd6
+ image_name: cirros
+ min_disk: '0'
+ min_ram: '0'
+ signature_verified: 'False'
+ size: '21692416'
3. Create an image from the created volume:
openstack image create --disk-format raw --container-format bare
--private --volume testvol testimg
[ Where problems could occur ]
The change affects a single function _translate_to_glance() and
considering it maintains the same logic and functionality, adding
only extra safety measures, the risk of regressions or potential issues
is minimal.
[ Other Info ]
None.
** Description changed:
********** SRU TEMPLATE AT THE BOTTOM *********
This bug seems to be a corner case or side effect of the changes
in [1] and [2] which fixed bugs LP#1527324 and LP#1823445.
The code in _translate_to_glance() (coming from the patch in [1]
addressing bug LP1527324), removes the 'properties' key from the
image metadata dict:
def _translate_to_glance(image_meta):
image_meta = _convert_to_string(image_meta)
image_meta = _remove_read_only(image_meta)
# NOTE(tsekiyama): From the Image API v2, custom properties must
# be stored in image_meta directly, instead of the 'properties' key.
properties = image_meta.get('properties')
if properties:
image_meta.update(properties)
del image_meta['properties']
This patch ensured that the 'properties' key is removed from the
image metadata dict before it is sent to Glance.
Now, there may be scenarios where 'properties: {}' which would cause
upload-to-image to fail as below:
On instance['properties']:
{} (HTTP 400) (Request-ID: req-e3203748-8e6a-4dae-a4fa-7cc90c978ee2)
...
BadRequest: Unable to set 'properties' to {}. Reason: {} is not of type
'string'
Failed validating 'type' in schema['additionalProperties']:
{'type': 'string'}
One of such scenarios is when filter_out_reserved_namespaces_metadata() is
called with a key/value in the 'properties' field that's also in the
reserved name spaces (as added by [2]). This would cause filtering out
all the properties, resulting in 'properties: {}'. Sample log message from
such a scenario is as below:
2026-03-13 12:14:24.459998 2026-03-13 12:14:24.459 3916766 DEBUG
cinder.image.image_utils [req-be108cd8-1897-4ae8-a68d-14349a52a51e ...]
The metadata set [{'container_format': 'bare', 'disk_format': 'raw',
'name': 'test', 'properties': {'signature_verified': 'False'}}] was
filtered using the reserved name spaces [['os_glance', 'img_signature',
'signature_verified']], and the result is [{'container_format': 'bare',
'disk_format': 'raw', 'name': 'test', 'properties': {}}].
filter_out_reserved_namespaces_metadata /usr/lib/python3/dist-
packages/cinder/image/image_utils.py:1380
IN the scenario above, signature_verified is likely added by
_create_from_image_cache_or_download() when creating a volume
from an image.
A quick workaround in this case should be to remove signature_verified
from volume image metadata before running openstack image create:
openstack volume unset --image-property signature_verified <VOLUME_ID>
Affected versions:
------------------
The code that leads to this is still present in the master branch.
Reproducer:
-----------
openstack volume create --image <image> --size <size> testvol
# set signature_verified if not in volume_image_metadata already
openstack volume set --image-property signature_verified=False testvol
openstack image create --disk-format raw --container-format bare --private
--volume testvol testimg
[1]
[https://review.opendev.org/c/openstack/cinder/+/259405](https://review.opendev.org/c/openstack/cinder/+/259405)
[2]
[https://review.opendev.org/c/openstack/cinder/+/936993](https://review.opendev.org/c/openstack/cinder/+/936993)
********** SRU TEMPLATE *********
[ Impact ]
Creating an image from a volume ("openstack image create --volume <vol-id>",)
fails with an HTTP 400 error code from Glance whenever the volume image
metadata ends up producing an empty 'properties' dict:
On instance['properties']:
{} (HTTP 400) (Request-ID: req-e3203748-8e6a-4dae-a4fa-7cc90c978ee2)
...
BadRequest: Unable to set 'properties' to {}. Reason: {} is not of type
'string'
cinder.image.glance._translate_to_glance() is supposed to flatten the
custom properties into the top level image metadata so when 'properties'
is an empty dict the key is not removed and 'properties': {} is sent to
Glance, which rejects it and causes the image creation to fail.
The fix is a simple change in _translate_to_glance() to test for
'properties' being present (not None), so that an empty properties dict
is removed from the metadata before the request is sent to Glance.
[ Test Plan ]
Steps to reproduce the issue in an Openstack cloud:
1. Create a volume:
openstack volume create --image <image> --size <size> testvol
2. Set signature_verified if not set in volume_image_metadata already:
openstack volume set --image-property signature_verified=False testvol
- openstack volume show testvol -c volume_image_metadata -f yaml
- volume_image_metadata:
- checksum: 87617e24a5e30cb3b87fda8c0764838f
- container_format: bare
- disk_format: qcow2
- image_id: ff8a94b6-18d1-4a6e-a01e-94f60ca43cd6
- image_name: cirros
- min_disk: '0'
- min_ram: '0'
- signature_verified: 'False'
- size: '21692416'
+ openstack volume show testvol -c volume_image_metadata -f yaml
+ volume_image_metadata:
+ checksum: 87617e24a5e30cb3b87fda8c0764838f
+ container_format: bare
+ disk_format: qcow2
+ image_id: ff8a94b6-18d1-4a6e-a01e-94f60ca43cd6
+ image_name: cirros
+ min_disk: '0'
+ min_ram: '0'
+ signature_verified: 'False'
+ size: '21692416'
3. Create an image from the created volume:
openstack image create --disk-format raw --container-format bare
--private --volume testvol testimg
[ Where problems could occur ]
The change affects a single function _translate_to_glance() and
considering it maintains the same logic and functionality, adding
only extra safety measures, the risk of regressions or potential issues
is minimal.
[ Other Info ]
None.
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2144550
Title:
[SRU] Create image from volume fails due to properties key being empty
To manage notifications about this bug go to:
https://bugs.launchpad.net/cinder/+bug/2144550/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
