glance — Interactions

Interactions — glance — branch stable/2026.2

Branch stable/2026.2 @ a3e5f490b7a2 — repository https://opendev.org/openstack/glance — analysed on 2026-10-28

Library versions in the analysis venv (upper-constraints of requirements stable/2026.2): glance_store 5.7.0, oslo.messaging, oslo.db, oslo.limit, castellan, keystonemiddleware at their constrained versions. Prefixed references glance_store: point to openstack/glance_store stable/2026.2.

Database

Tables

The model DDL (glance/db/sqlalchemy/models.py, glance/db/sqlalchemy/models_metadef.py) matches the migrated schema on SQLite: 15 tables, 11 foreign keys, 28 indexes and 9 unique constraints on both sides, 0 difference (see 07 § 5). Every table except task_info, node_reference and cached_images is soft-deleted (deleted, deleted_at columns, glance/db/sqlalchemy/models.py:62).

Notable transactions

• Retries: image_create, image_update and image_destroy retry up to 50 times, every 0.5 s, on deadlock and disconnect (glance/db/sqlalchemy/api.py:148-149, glance/db/sqlalchemy/api.py:165-166, glance/db/sqlalchemy/api.py:203-204).
• Status compare-and-swap: image_update(..., from_state=…) adds WHERE status = :from_state and raises Conflict when no row matches (glance/db/sqlalchemy/api.py:1036-1054). Upload uses it twice: queued → saving, then saving → active (glance/api/v2/image_data.py:161, glance/api/v2/image_data.py:167). A concurrent delete therefore makes the upload fail with 410 instead of resurrecting the image. sql UPDATE images SET status = 'saving', updated_at = :now WHERE id = :image_id AND status = 'queued' -- 0 rows → Conflict → HTTP 409/410
• Atomic properties (import lock): image_set_property_atomic inserts image_properties(image_id, name, value) and relies on the unique constraint (image_id, name) to fail with Duplicate when the property exists (glance/db/sqlalchemy/api.py:891); image_delete_property_atomic deletes only if the value still matches (glance/db/sqlalchemy/api.py:946).
• Visibility of the image list (glance/db/sqlalchemy/api.py:588-627): for a non-admin, the list is the union of public and community images, images owned by the caller's project, and shared images where the project is a member with the requested member_status (default accepted). Without a visibility filter, community images are excluded unless owned by the caller (glance/db/sqlalchemy/api.py:697-713).
• Usage queries for quotas: image_size_total sums the sizes of the owner's non-deleted images (glance/db/sqlalchemy/api.py:770), image_stage_total the sizes of uploading/importing images (glance/db/sqlalchemy/api.py:788), image_count_total and image_count_uploading count rows (glance/db/sqlalchemy/api.py:823, glance/db/sqlalchemy/api.py:831). They run on each quota check when use_keystone_limits is true.
• Purge: glance-manage db purge --age_in_days N --max_rows M hard-deletes soft-deleted rows; images rows are purged by the separate glance-manage db purge_images_table (default age 180 days, glance/cmd/manage.py:371), as image IDs must not be reused [inferred: reason from the command split] (glance/db/sqlalchemy/api.py:1561, glance/db/sqlalchemy/api.py:1660).

Image stores (glance_store)

glance_store is a separate library with one driver per backend (glance_store:glance_store/_drivers/: filesystem.py, rbd.py, swift/, s3.py, cinder/, http.py, vmware_datastore.py). Glance calls it for:

• Multi-store: with enabled_backends = id:type,…, each location carries metadata.store = <id>; the upload target comes from the X-Image-Meta-Store header (default [glance_store]/default_backend), the import targets from stores/all_stores in the body (glance/api/v2/image_data.py:117-127).
• Location URL schemes: file://, rbd://<fsid>/<pool>/<image>/<snap>, swift+https://…, s3://…, cinder://<volume_id>, http(s)://… (read-only). Swift and S3 URLs may embed credentials, which is why notifications never include locations (glance/notifier.py:138-143).
• Error mapping: the store exceptions are translated into HTTP statuses by the handlers and by the notifier layer (glance/notifier.py:436-503); see 02.

RabbitMQ (notifications)

Glance sends no RPC. It only publishes notifications through oslo_messaging.Notifier on the notification transport (glance/notifier.py:94-104), with publisher_id = [DEFAULT]/default_publisher_id (default image.localhost, glance/notifier.py:33). Every event is sent synchronously, in the API worker, after the database change. [DEFAULT]/disabled_notifications drops an event or a whole group (image, task, metadef_namespace…) (glance/notifier.py:121-135).

Notifications

Image payload (glance/notifier.py:138-165): id, name, status, created_at, updated_at, min_disk, min_ram, protected, checksum, owner, disk_format, container_format, size, virtual_size, is_public, visibility, properties, tags, deleted, deleted_at. No locations.

Sample frame

Message published to exchange glance (or [DEFAULT]/control_exchange), routing key notifications.info:

{"oslo.version": "2.0",
 "oslo.message": "{\"message_id\": \"6c1f…\", \"publisher_id\": \"image.localhost\", \"event_type\": \"image.activate\", \"priority\": \"INFO\", \"timestamp\": \"2026-10-28 21:00:00.000000\", \"payload\": {\"id\": \"8c4a…\", \"name\": \"cirros\", \"status\": \"active\", \"disk_format\": \"qcow2\", \"container_format\": \"bare\", \"size\": 21430272, \"virtual_size\": 117440512, \"checksum\": \"c8fc…\", \"visibility\": \"private\", \"is_public\": false, \"owner\": \"5ef7…\", \"properties\": {\"os_hash_algo\": \"sha512\"}, \"tags\": [], \"deleted\": false, \"deleted_at\": null}, \"_context_…\": {}}"}

The context is empty: Notifier.info/warn/error pass {} as context (glance/notifier.py:107-114), so no _context_* user or project fields travel with Glance notifications.

Outbound REST calls

**Endpoint discovery for glance-download** is done in the X-Service-Catalog header that keystonemiddleware adds: the first image service endpoint whose region matches glance_region, with interface glance_service_interface (default public) (glance/async_/utils.py:81-95). Missing endpoint → GlanceEndpointNotFound.

URL filtering ([import_filtering_opts], glance/async_/flows/_internal_plugins/__init__.py:26-173): schemes allowed by default http, https; ports 80 and 443; allow-lists win over deny-lists. Loopback and link-local addresses (including 169.254.169.254) are refused unless the host is allow-listed; the TCP connection is pinned to the validated IP so that DNS cannot rebind during the download (glance/common/utils.py:229-260, glance/common/scripts/utils.py:246-258).

Other

• Files: staging (node_staging_uri, default file:///tmp/staging/, glance/common/config.py:585, or the reserved os_glance_staging_store with enabled_backends); legacy task work dir ([task]/work_dir); image cache (image_cache_dir); cancellation markers of hash operations in the tasks store (glance/task_cancellation_tracker.py:29-36).
• Processes: qemu-img info --output=json and qemu-img convert for image_conversion, run with processutils and the [wsgi]/python_interpreter prlimit wrapper (glance/async_/flows/plugins/image_conversion.py:150, glance/async_/flows/plugins/image_conversion.py:212); glance-control starts daemons with subprocess (glance/cmd/control.py:130).
• Format inspection: every bare upload goes through oslo_utils.imageutils.format_inspector on the fly; the detected format must match disk_format when [image_format]/require_image_format_match is true (default), and GPT/MBR safety checks apply (glance/location.py:596-700).

Source: reverse-spec-glance/03-interactions_stable-2026.2.md. The _rewrite/ and _inventory/ files are not published on the site.