[BUG] image-lookup recipes match snapshots

[mbuechse]

The image-lookup-via-metadata recipes seem to have a defect whereby they also match snapshots. It seems like they could be fixed by adding a filter on visibility 'public' or 'community' (or, if possible, on type 'image').

At the same time, it became apparent that the respective standards should be made more explicit about the fact that all standard images are expected to be public and not hidden.

[mbuechse]

@toothstone can you please check whether I summarized this correctly?

[toothstone]

AFAIK this affects the base logic and thus all possible implementations, not just OpenTofu.

We implemented the lookup in Golang. Line 78 contains my quick fix to get rid of snapshots, since I wanted to avoid any reliance on non-standardized behavior such as the visibility. Unfortunately, the Glance API does not seem to have a simple "type" field, Horizon goes through two layers of "source_type" to deduce the type properly, see also gophercloud/gophercloud#3830.

[toothstone]

As a quick check you can use the openstackclient version to verify this:

openstack image list --property os_distro="ubuntu" --property os_purpose="generic" -f value -c ID -c Name --sort name:desc,created_at:desc

returns private snapshots created from the "generic" Ubuntu image on my cloud.

[mbuechse]

The lines in the Horizon code have moved since the comment you referred to was posted. Here is a permalink: https://github.com/openstack/horizon/blob/e7c9e39182dcb74579f227b1e61b30b8fa5b4ceb/openstack_dashboard/dashboards/project/images/images/tables.py#L261

[mbuechse]

The first half of the problem should be solved with #1260 (still to be debated in the SIG). The second half is to update the recipes so the visibility is taken into account.

@toothstone You don't seem to be using server-side filtering in your Go code. Is that a restriction of the library?

[toothstone]

@toothstone You don't seem to be using server-side filtering in your Go code. Is that a restriction of the library?

It's a combination of the library, the Glance API and the code being a PoC. All the metadata we care about comes as a second-level attribute, in the "Properties" field, which just makes it cumbersome to access. The library (gophercloud) offers no filter for it out of the box, but if understand this comment correctly it should still be possible to implement.

However, regarding your proposed solution to this issue via the visibility attribute, that is a first-level attribute and as such easily accessible for server-side filtering.

[toothstone]

The first half of the problem should be solved with #1260 (still to be debated in the SIG).

I was able to create a snapshot with a visibility of "community", so the change proposed in #1260 is unfortunately not a solution.