FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

Don't allow vmsnapshot and volume snapshot operations on a vm which has encrypted volumes attached · Issue #13188 · apache/cloudstack · GitHub

  1. apache
  2. cloudstack

Repository navigation

Don't allow vmsnapshot and volume snapshot operations on a vm which has encrypted volumes attached #13188

New issue
New issue
Open
Bug
#13228
Open
Don't allow vmsnapshot and volume snapshot operations on a vm which has encrypted volumes attached#13188
Bug
#13228
Assignees
Labels
Severity:Majorcomponent:kvmcomponent:snapshot
Milestone
4.22.3

Description

kiranchavala
opened on May 19, 2026

problem

Don't allow vmsnapshot and volume snapshot operation on a vm which has encrypted volumes attached

versions

ACS 4.22

The steps to reproduce the bug

  1. Have a Cloudstack kvm host which supports volume encryption
  1. Create a compute offering and disk offering which has encryption enabled

  1. Launch a vm with encrypted compute offering and data disk offering > vm launched successfullt

  2. Take a vm snapshot of the vm

  1. Stop the vm

  2. Start the vm > Exception

2026-05-19 08:12:53,372 WARN  [resource.wrapper.LibvirtStartCommandWrapper] (AgentRequest-Handler-2:[]) (logid:757a3937) LibvirtException org.libvirt.LibvirtException: internal error: Unexpected enum value 0 for virStorageEncryptionEngine
	at org.libvirt.ErrorHandler.processError(Unknown Source)
	at org.libvirt.ErrorHandler.processError(Unknown Source)
	at org.libvirt.Connect.domainCreateXML(Unknown Source)
	at com.cloud.hypervisor.kvm.resource.LibvirtComputingResource.startVM(LibvirtComputingResource.java:2241)
	at com.cloud.hypervisor.kvm.resource.LibvirtComputingResource.startVM(LibvirtComputingResource.java:2210)
	at com.cloud.hypervisor.kvm.resource.wrapper.LibvirtStartCommandWrapper.execute(LibvirtStartCommandWrapper.java:91)
	at com.cloud.hypervisor.kvm.resource.wrapper.LibvirtStartCommandWrapper.execute(LibvirtStartCommandWrapper.java:52)
	at com.cloud.hypervisor.kvm.resource.wrapper.LibvirtRequestWrapper.execute(LibvirtRequestWrapper.java:78)
	at com.cloud.hypervisor.kvm.resource.LibvirtComputingResource.executeRequest(LibvirtComputingResource.java:2280)
	at com.cloud.agent.Agent.processRequest(Agent.java:813)
	at com.cloud.agent.Agent$AgentRequestHandler.doTask(Agent.java:1295)
	at com.cloud.utils.nio.Task.call(Task.java:83)
	at com.cloud.utils.nio.Task.call(Task.java:29)
	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
	at java.base/java.lang.Thread.run(Thread.java:840)
  1. Try to destroy/expunge the vm >> Exception
2026-05-19 08:15:08,143 DEBUG [c.c.a.t.Request] (AgentManager-Handler-8:[]) (logid:) Seq 1-6388356071425053772: Processing:  { Ans: , MgmtId: 32988351955983, via: 1, Ver: v1, Flags: 10, [{"com.cloud.agent.api.Answer":{"result":"false","details":"Exception: org.apache.cloudstack.utils.qemu.QemuImgException
Message: qemu-img: Could not open '/mnt/c2498341-cfff-3eee-86df-fff0fcae419d/7b84527f-6513-4138-a477-6187b880af77': Could not open backing file: Parameter 'encrypt.key-secret' is required for cipher
Stack: org.apache.cloudstack.utils.qemu.QemuImgException: qemu-img: Could not open '/mnt/c2498341-cfff-3eee-86df-fff0fcae419d/7b84527f-6513-4138-a477-6187b880af77': Could not open backing file: Parameter 'encrypt.key-secret' is required for cipher
	at org.apache.cloudstack.utils.qemu.QemuImg.commit(QemuImg.java:871)
	at com.cloud.hypervisor.kvm.resource.wrapper.LibvirtMergeDiskOnlyVMSnapshotCommandWrapper.mergeDiskOnlySnapshotsForStoppedVM(LibvirtMergeDiskOnlyVMSnapshotCommandWrapper.java:86)
	at com.cloud.hypervisor.kvm.resource.wrapper.LibvirtMergeDiskOnlyVMSnapshotCommandWrapper.execute(LibvirtMergeDiskOnlyVMSnapshotCommandWrapper.java:62)
	at com.cloud.hypervisor.kvm.resource.wrapper.LibvirtMergeDiskOnlyVMSnapshotCommandWrapper.execute(LibvirtMergeDiskOnlyVMSnapshotCommandWrapper.java:51)
	at com.cloud.hypervisor.kvm.resource.wrapper.LibvirtRequestWrapper.execute(LibvirtRequestWrapper.java:78)
	at com.cloud.hypervisor.kvm.resource.LibvirtComputingResource.executeRequest(LibvirtComputingResource.java:2280)
	at com.cloud.agent.Agent.processRequest(Agent.java:813)
	at com.cloud.agent.Agent$AgentRequestHandler.doTask(Agent.java:1295)
	at com.cloud.utils.nio.Task.call(Task.java:83)
	at com.cloud.utils.nio.Task.call(Task.java:29)
	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
	at java.base/java.lang.Thread.run(Thread.java:840)

2026-05-19 08:15:08,180 ERROR [c.c.a.ApiAsyncJobDispatcher] (API-Job-Executor-56:[ctx-5f20d751, job-219]) (logid:c1458150) Unexpected exception while executing org.apache.cloudstack.api.command.admin.vm.DestroyVMCmdByAdmin com.cloud.utils.exception.CloudRuntimeException: Failed to destroy vm with specified vmId
	at com.cloud.vm.UserVmManagerImpl.destroyVm(UserVmManagerImpl.java:5999)
	at com.cloud.vm.UserVmManagerImpl.destroyVm(UserVmManagerImpl.java:3545)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:569)
	at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:344)
	at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:198)
	at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java

Currently, we disallow the following operations on encrypted volumes, and provide a exception message when user tries to perform the following operation

2026-05-19 08:23:10,479 ERROR [c.c.a.ApiServer] (qtp253011924-26:[ctx-fda2c601, ctx-8fb1e3bd]) (logid:5c23248f) unhandled exception executing api command: [Ljava.lang.String;@5a733241 java.lang.UnsupportedOperationException: Cannot create new volumes from encrypted volume snapshots

Try to revert volume snapshot which was created from an encrypted volume when the vm is in stopped state

Exception

logs

2026-05-19 08:35:01,120 DEBUG [o.a.c.s.s.SnapshotServiceImpl] (API-Job-Executor-69:[ctx-f8fad827, job-251, ctx-c5c1b411]) (logid:d410fd2d) revert snapshot failedcom.cloud.utils.exception.CloudRuntimeException: Unable to revert volume [volumeTO {"dataStore":"PrimaryDataStoreTO {\"id\":2,\"name\":\"ref-trl-11676-k-Mol8-kiran-chavala-kvm-pri2\",\"poolType\":\"NetworkFilesystem\",\"uuid\":\"100681f3-60a3-33de-a7d7-2f203d2e299e\"}","id":28,"name":"ROOT-20","path":"a7b4cdfc-a3a4-406a-8853-fa63f73992cf","uuid":"a7b4cdfc-a3a4-406a-8853-fa63f73992cf"}] to snapshot [SnapshotTO[datastore=NfsTO {"_role":"Image","_url":"NFS:\/\/10.0.32.4\/acs\/secondary\/ref-trl-11676-k-Mol8-kiran-chavala\/ref-trl-11676-k-Mol8-kiran-chavala-sec1","nfsVersion":null,"uuid":null}|volume=volumeTO {"dataStore":"PrimaryDataStoreTO {\"id\":2,\"name\":\"ref-trl-11676-k-Mol8-kiran-chavala-kvm-pri2\",\"poolType\":\"NetworkFilesystem\",\"uuid\":\"100681f3-60a3-33de-a7d7-2f203d2e299e\"}","id":28,"name":"ROOT-20","path":"a7b4cdfc-a3a4-406a-8853-fa63f73992cf","uuid":"a7b4cdfc-a3a4-406a-8853-fa63f73992cf"}|pathsnapshots/2/28/0c96fbe0-0149-4eef-b8c3-a34b8e99028d]] due to [qemu-img: Could not open 'driver=qcow2,file.filename=/mnt/f179ad17-99de-3f02-81ae-88f4dd0c11d7/snapshots/2/28/0c96fbe0-0149-4eef-b8c3-a34b8e99028d': Parameter 'encrypt.key-secret' is required for cipher].
2026-05-19 08:35:01,130 ERROR [c.c.a.ApiAsyncJobDispatcher] (API-Job-Executor-69:[ctx-f8fad827, job-251]) (logid:d410fd2d) Unexpected exception while executing org.apache.cloudstack.api.command.user.snapshot.RevertSnapshotCmd com.cloud.utils.exception.CloudRuntimeException: com.cloud.utils.exception.CloudRuntimeException: Unable to revert volume [volumeTO {"dataStore":"PrimaryDataStoreTO {\"id\":2,\"name\":\"ref-trl-11676-k-Mol8-kiran-chavala-kvm-pri2\",\"poolType\":\"NetworkFilesystem\",\"uuid\":\"100681f3-60a3-33de-a7d7-2f203d2e299e\"}","id":28,"name":"ROOT-20","path":"a7b4cdfc-a3a4-406a-8853-fa63f73992cf","uuid":"a7b4cdfc-a3a4-406a-8853-fa63f73992cf"}] to snapshot [SnapshotTO[datastore=NfsTO {"_role":"Image","_url":"NFS:\/\/10.0.32.4\/acs\/secondary\/ref-trl-11676-k-Mol8-kiran-chavala\/ref-trl-11676-k-Mol8-kiran-chavala-sec1","nfsVersion":null,"uuid":null}|volume=volumeTO {"dataStore":"PrimaryDataStoreTO {\"id\":2,\"name\":\"ref-trl-11676-k-Mol8-kiran-chavala-kvm-pri2\",\"poolType\":\"NetworkFilesystem\",\"uuid\":\"100681f3-60a3-33de-a7d7-2f203d2e299e\"}","id":28,"name":"ROOT-20","path":"a7b4cdfc-a3a4-406a-8853-fa63f73992cf","uuid":"a7b4cdfc-a3a4-406a-8853-fa63f73992cf"}|pathsnapshots/2/28/0c96fbe0-0149-4eef-b8c3-a34b8e99028d]] due to [qemu-img: Could not open 'driver=qcow2,file.filename=/mnt/f179ad17-99de-3f02-81ae-88f4dd0c11d7/snapshots/2/28/0c96fbe0-0149-4eef-b8c3-a34b8e99028d': Parameter 'encrypt.key-secret' is required for cipher].
	at org.apache.cloudstack.storage.snapshot.SnapshotServiceImpl.revertSnapshot(SnapshotServiceImpl.java:699)
	at org.apache.cloudstack.storage.snapshot.DefaultSnapshotStrategy.revertSnapshot(DefaultSnapshotStrategy.java:519)
	at com.cloud.storage.snapshot.SnapshotManagerImpl.revertSnapshot(SnapshotManagerImpl.java:405)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)

Try to revert volume snapshot which was created from an encrypted volume when the vm is in stopped state

Exception

What to do about it?

Don't allow volume and vm snapshot operation on encrypted volumes

Activity

  1. kiranchavala
    added
    component:kvm
    component:snapshot
    bug
    on May 19, 2026
  2. kiranchavala
    added the
    Bug
    issue type on May 19, 2026
  3. kiranchavala
    changed the title [-]Don't allow vmsnapshot and volume snapshot operation on a vm which has encrypted volumes attached[/-] [+]Don't allow vmsnapshot and volume snapshot operations on a vm which has encrypted volumes attached[/+] on May 19, 2026
  4. kiranchavala
    added
    Severity:Major
    on May 19, 2026
  5. DaanHoogland
    added this to Apache CloudStack BugFest - Issueson May 19, 2026
  6. DaanHoogland
    moved this to Todo in Apache CloudStack BugFest - Issueson May 19, 2026
  7. DaanHoogland
    added this to the 4.20.4 milestone on May 19, 2026

  8. vishesh92 commented on May 20, 2026

    vishesh92
    on May 20, 2026
    Member

    I tested with @sureshanaparti . This wasn't present in 4.20 and seems to have been introduced as part of #10632

  9. DaanHoogland
    modified the milestones: 4.20.4, 4.22.2 on May 21, 2026
  10. sureshanaparti
    linked a pull request that will close this issueRestrict VM snapshot without memory for VM with encrypted volumes using KvmFileBasedStorageVmSnapshotStrategy, and Use file copy for revert to snapshot from encrypted volumes (as earlier) #13228on May 25, 2026
  11. sureshanaparti
    self-assigned this
    on May 25, 2026
  12. sureshanaparti
    moved this from Todo to ready for Review in Apache CloudStack BugFest - Issueson May 25, 2026
  13. DaanHoogland
    removed
    bug
    on Jun 15, 2026

  14. github-actions commented on Oct 15, 2026

    github-actionsBot
    on Oct 15, 2026 – with GitHub Actions

    This issue is stale because it has been open for 120 days with no activity. It may be removed by administrators of this project at any time. Remove the stale label or comment to request for removal of it to prevent this.

  15. github-actions
    added
    no-issue-activity
    on Oct 15, 2026
  16. nvazquez
    modified the milestones: 4.22.2, 4.22.3 on Nov 9, 2026
  17. github-actions
    removed
    no-issue-activity
    on Nov 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

Severity:Majorcomponent:kvmcomponent:snapshot

Type

Bug

Projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions

Back | FazBrowse Home | New Git URL