FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

server: encrypt a volume created on a storage pool with an encrypted disk offering by weizhouapache · Pull Request #14667 · apache/cloudstack · GitHub

  1. apache
  2. cloudstack

Repository navigation

server: encrypt a volume created on a storage pool with an encrypted disk offering - #14667

Open
weizhouapache wants to merge 1 commit into
apache:4.22from
weizhouapache:4.22-encrypt-volume-on-pool
ConversationCommits (1)ChecksFiles changed
Open

server: encrypt a volume created on a storage pool with an encrypted disk offering#14667
weizhouapache wants to merge 1 commit into
apache:4.22from
weizhouapache:4.22-encrypt-volume-on-pool

Conversation

weizhouapache commented Nov 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Description

A volume created with a storageid is created on the pool right away, without the passphrase or the KMS key which an encrypted disk offering needs, so it was created without encryption. Set up its encryption before it is created.

Types of changes

  • Breaking change (fix or feature that would cause existing functionality to change)
  • New feature (non-breaking change which adds functionality)
  • Bug fix (non-breaking change which fixes an issue)
  • Enhancement (improves an existing feature and functionality)
  • Cleanup (Code refactoring and cleanup, that may add test cases)
  • Build/CI
  • Test (unit or integration test code)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

  • Major
  • Minor

Bug Severity

  • BLOCKER
  • Critical
  • Major
  • Minor
  • Trivial

Screenshots (if appropriate):

How Has This Been Tested?

Environment: Trillian test env pr147-n88 (Ubuntu 26.04, KVM, two management servers, two KVM hosts, Ceph RBD primary pools ceph-pri1 and ceph-pri2, plus an NFS primary pool). The management servers ran a 4.23 build with the same change, not this 4.22 branch. The KVM agents were not changed.

Steps: create an encrypted disk offering (encrypt=true), then create a volume from it with an explicit storageid on each pool. The volumes were not attached to a VM.

Pool Type passphrase_id in DB encrypt_format in DB On disk
nfs-n88 NetworkFilesystem set (363) luks qcow2 with LUKS: qemu-img info reports encrypted: yes
ceph-pri1 RBD set (364) luks2 image starts with a LUKS2 header
ceph-pri2 RBD set (365) luks2 image starts with a LUKS2 header

Not covered by these tests:

  • Attaching or detaching the encrypted volume to a running VM.
  • SharedMountPoint pools.
  • The pre-fix behaviour on the same environment. The passphrase was set on all three pools with the change applied, but the bug was not reproduced before the change.
  • A build or test run of this 4.22 branch.

How did you try to break this feature and the system with this change?

Not yet tested beyond the cases above.

server: encrypt a volume created on a storage pool with an encrypted …
e5a3cd8 
…disk offering

A volume created with a storageid is created on the pool right away, without the passphrase or the KMS key which an encrypted disk offering needs, so it was created without encryption. Set up its encryption before it is created.
weizhouapache linked an issue Nov 10, 2026 that may be closed by this pull request
[KVM] Encrypted disk offering: volume created on a manually selected primary storage pool (NFS and SharedMountPoint) is not encrypted (no LUKS, no error) #14662
Open
weizhouapache mentioned this pull request Nov 10, 2026
Open
weizhouapache removed a link to an issue Nov 10, 2026
[KVM] Encrypted disk offering: volume created on a manually selected primary storage pool (NFS and SharedMountPoint) is not encrypted (no LUKS, no error) #14662
Open
weizhouapache linked an issue Nov 10, 2026 that may be closed by this pull request
[KVM] Encrypted volume on SharedMountPoint pool is created without LUKS and attach fails with "No encryption in image header" #14663
Open

codecov Bot commented Nov 10, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 0% with 7 lines in your changes missing coverage. Please review.
✅ Project coverage is 18.31%. Comparing base (b56bbc2) to head (e5a3cd8).

Files with missing lines Patch % Lines
...stack/engine/orchestration/VolumeOrchestrator.java 0.00% 6 Missing ⚠️
...n/java/com/cloud/storage/VolumeApiServiceImpl.java 0.00% 1 Missing ⚠️
Additional details and impacted files 
@@             Coverage Diff              @@
##               4.22   #14667      +/-   ##
============================================
- Coverage     18.32%   18.31%   -0.01%     
+ Complexity    16644    16642       -2     
============================================
  Files          5939     5939              
  Lines        537787   537794       +7     
  Branches      65932    65932              
============================================
- Hits          98544    98511      -33     
- Misses       428033   428079      +46     
+ Partials      11210    11204       -6
Flag Coverage Δ
uitests 4.08% <ø> (ø)
unittests 19.40% <0.00%> (-0.01%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

This was referenced Nov 11, 2026
Open
Draft
weizhouapache marked this pull request as ready for review November 11, 2026 15:02

weizhouapache commented Nov 11, 2026

Copy link
Copy Markdown
Member Author

@blueorangutan package

blueorangutan commented Nov 11, 2026

Copy link
Copy Markdown

@weizhouapache a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan commented Nov 11, 2026

Copy link
Copy Markdown

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 19996

github-actions Bot mentioned this pull request Nov 11, 2026
Open
weizhouapache linked an issue Nov 12, 2026 that may be closed by this pull request
[KVM] Encrypted disk offering: volume created on a manually selected primary storage pool (NFS and SharedMountPoint) is not encrypted (no LUKS, no error) #14662
Open
weizhouapache removed a link to an issue Nov 12, 2026
[KVM] Encrypted volume on SharedMountPoint pool is created without LUKS and attach fails with "No encryption in image header" #14663
Open
weizhouapache commented Nov 12, 2026
View reviewed changes
Comment thread ...chestration/src/main/java/org/apache/cloudstack/engine/orchestration/VolumeOrchestrator.java
return;
}
VolumeVO volume = _volsDao.findById(volumeId);
setPassphraseForVolumeEncryption(volume);

weizhouapache Nov 12, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

for main/24, this line should be

setPassphraseForVolumeEncryption(volume, getKmsKeyFromVolume(volume), volume.getAccountId());

weizhouapache commented Nov 12, 2026

Copy link
Copy Markdown
Member Author

@blueorangutan test

blueorangutan commented Nov 12, 2026

Copy link
Copy Markdown

@weizhouapache a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

blueorangutan commented Nov 13, 2026

Copy link
Copy Markdown

[SF] Trillian test result (tid-17563)
Environment: kvm-ol8 (x2), zone: Advanced Networking with Mgmt server ol8
Total time taken: 65692 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr14667-t17563-kvm-ol8.zip
Smoke tests completed. 148 look OK, 1 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test Result Time (s) Test File
test_08_upgrade_kubernetes_ha_cluster Failure 1008.90 test_kubernetes_clusters.py

This branch has not been deployed

No deployments
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

component:orchestration component:storage

Projects

None yet

Milestone

No milestone

2 participants

Back | FazBrowse Home | New Git URL