Glance-v2-community-image-sharing-faq

What is a "community" image?
Talking v2 here, we have "public" images that are (usually) created and maintained by the cloud provider (publicizing an image is protected by policy, default is glance admin only). We have "private" images that are owned by a specific tenant and cannot be viewed/used by other tenants. We have "shared" images that are private images that can be viewed/used by specific other tenants that the image owner adds as "members" to the image.

A missing use case is for a tenant who (a) has created an image that she wants other tenants to use, and (b) isn't interested in maintaining a relationship with these tenants by making them image members. We don't want to make such an image public because it would conflict with the use case of a cloud provider who wants to provide sanctioned/supported/approved images. Sharing won't work because of the overhead. Hence, "community" images.

I get the idea, but isn't there a better name than "community" for this purpose?
Nope. We tried, but no one could come up with anything better in a reasonable time frame. You can check out the discussion in #openstack-glance IRC logs, the meeting logs, and on this patch set: https://review.openstack.org/#/c/74438/

Where's the BP and spec for this?
BP: https://blueprints.launchpad.net/glance/+spec/community-level-v2-image-sharing Full spec: https://wiki.openstack.org/wiki/Glance-v2-community-image-sharing

How will this look from the image producer side?
You make an image a "community" image by updating the 'visibility' property to the value 'community'.

How will this look from the image consumer side?
You can do image discovery by doing an image list and filtering with appropriate values for 'visibility' and 'owner'.

Can a consumer make a community image appear in their image list?
Yes, they can use the v2 image sharing calls to make themselves a member of the image (this will be allowed for community images) and then to set their member_status on the image.

What happens when a producer wants to withdraw a community image?
They can update the 'visibility' property to 'private'. The member-list on the image, if any, will remain. As a private image, however, the image owner will have the ability to modify the member-list. Non-owners will not be able to add themselves.

What happens if I have a shared image and decide to make it a community image?
The member list will stay the same, so current "subscribers" will not be affected.