)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":27665,"name":"Markus Hentsch","email":"markus.hentsch@cloudandheat.com","username":"mhen"},"change_message_id":"d58206e3dd4c49dba2198ae4fa53caf1a24ef7cc","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":4,"id":"2684c298_0ab3f4ba","updated":"2026-08-04 15:47:26.000000000","message":"This does fix encrypted NFS volume creation on DevStack but seems to introduce incompatibility with Nova while also breaking the `os-volume_upload_image` volume action. See my code comment.","commit_id":"80dbabff82b9b106213414fb43fa70ff85dcfdbe"}],"cinder/image/image_utils.py":[{"author":{"_account_id":4523,"name":"Eric Harney","email":"eharney@redhat.com","username":"eharney"},"change_message_id":"903cef0e430ccbc58b21b6777aecda3918461367","unresolved":true,"context_lines":[{"line_number":371,"context_line":"            disable_sparse\u003ddisable_sparse)"},{"line_number":372,"context_line":""},{"line_number":373,"context_line":"    if passphrase_file is not None:"},{"line_number":374,"context_line":"        assert out_format \u003d\u003d \u0027qcow2\u0027"},{"line_number":375,"context_line":"        return _get_qemu_convert_luks_onlydest_cmd("},{"line_number":376,"context_line":"            src,"},{"line_number":377,"context_line":"            dest,"}],"source_content_type":"text/x-python","patch_set":3,"id":"573512ff_b233179b","line":374,"updated":"2026-04-14 20:33:06.000000000","message":"This assertion is only valid for NFS - it breaks the RBD driver.","commit_id":"472e58db65bb196ac5fdd3971f113046b9a28c87"}],"cinder/volume/drivers/nfs.py":[{"author":{"_account_id":27665,"name":"Markus Hentsch","email":"markus.hentsch@cloudandheat.com","username":"mhen"},"change_message_id":"d58206e3dd4c49dba2198ae4fa53caf1a24ef7cc","unresolved":true,"context_lines":[{"line_number":774,"context_line":"                    f.write(passphrase)"},{"line_number":775,"context_line":"                image_utils.convert_image(tmp.name,"},{"line_number":776,"context_line":"                                          path_to_new_vol,"},{"line_number":777,"context_line":"                                          \u0027qcow2\u0027,"},{"line_number":778,"context_line":"                                          src_format\u003d\u0027raw\u0027,"},{"line_number":779,"context_line":"                                          cipher_spec\u003dcipher_spec,"},{"line_number":780,"context_line":"                                          passphrase_file\u003dpassfile.name)"}],"source_content_type":"text/x-python","patch_set":4,"id":"d923c431_09cca9b7","line":777,"updated":"2026-08-04 15:47:26.000000000","message":"Introducing encrypted qcow2 in addition to raw LUKS as an alternative encryption provider in Cinder currently seems to break at least two things: 1) usage in Nova and 2) image creation from volume.\n\nFrom what I can tell, encrypted qcow2 is not established as a known encryption provider in os-brick yet: https://opendev.org/openstack/os-brick/src/commit/379b7a5fe27ee22148fe48b68c454059485b8ec9/os_brick/encryptors/__init__.py#L31-L35\n\n### 1) usage in Nova\n\nWhile this makes creation of encrypted NFS-backed volumes work again (on DevStack at least), as in them reaching \"available\" state, instances created from such volumes fail to boot.\n\nNova always expects raw LUKS from Cinder when it attaches a volume with the \"luks\" encryption provider specified.\n\nHere is the encryption type used:\n\n```\n$ openstack volume type show -f json nfs-encrypted --encryption-type\n{\n  \"access_project_ids\": null,\n  \"description\": null,\n  \"encryption\": {\n    \"cipher\": \"aes-xts-plain64\",\n    \"control_location\": \"front-end\",\n    \"encryption_id\": \"dacbc809-d005-413c-9d96-358f5783570d\",\n    \"key_size\": 256,\n    \"provider\": \"luks\"\n  },\n  \"id\": \"657e2644-ec84-4ec3-9fb9-cf616e7ff286\",\n  \"is_public\": true,\n  \"name\": \"nfs-encrypted\",\n  \"properties\": {\n    \"volume_backend_name\": \"nfs\"\n  }\n}\n```\n\nCreating a Nova instance with a volume of this type as root device, this ends up in the guest XML:\n\n```\n\u003cdisk type\u003d\"file\" device\u003d\"disk\"\u003e\n  \u003cdriver name\u003d\"qemu\" type\u003d\"raw\" cache\u003d\"none\" io\u003d\"native\"/\u003e\n  \u003calias name\u003d\"ua-1dbef2c8-3bc5-4297-b1e3-474536c920c3\"/\u003e\n  \u003csource file\u003d\"/opt/stack/data/nova/mnt/896fb15da6036b68a917322e72ebfe57/volume-1dbef2c8-3bc5-4297-b1e3-474536c920c3\"/\u003e\n  \u003ctarget dev\u003d\"vda\" bus\u003d\"virtio\"/\u003e\n  \u003cserial\u003e1dbef2c8-3bc5-4297-b1e3-474536c920c3\u003c/serial\u003e\n  \u003cencryption format\u003d\"luks\"\u003e\n    \u003csecret type\u003d\"passphrase\" uuid\u003d\"f7436740-382c-4bb3-97cc-1e73bd50ac48\"/\u003e\n  \u003c/encryption\u003e\n\u003c/disk\u003e\n```\n\nNote the `type\u003d\"raw\"` and `format\u003d\"luks\"`.\n\nWhen connecting to the VNC console of the server instance:\n\n```\nBooting from Hard Disk...\nBoot failed: not a bootable disk\n\nNo bootable device.\n```\n\n### 2) image creation from volume\n\nOn another note, this also breaks image creation from volume:\n\n```\n$ openstack volume create --size 1 --image cirros-0.6.3-x86_64-disk --type nfs-encrypted nfs-luks-test2\n$ openstack image create --volume nfs-luks-test2 encrypted-nfs-image\n```\n\nThe image never appears in Glance. Cinder log:\n\n```\n...\nFile \"/opt/stack/cinder/cinder/volume/drivers/remotefs.py\", line 2178, in copy_volume_to_image\n return self._copy_volume_to_image(context, volume, image_service,\n        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\nFile \"/opt/stack/cinder/cinder/volume/drivers/remotefs.py\", line 1114, in _copy_volume_to_image\n image_utils.convert_image(active_file_path, temp_path, \u0027raw\u0027,\nFile \"/opt/stack/cinder/cinder/image/image_utils.py\", line 641, in convert_image\n _convert_image(tuple(throttle_cmd[\u0027prefix\u0027]),\nFile \"/opt/stack/cinder/cinder/image/image_utils.py\", line 539, in _convert_image\n utils.execute(*cmd, run_as_root\u003drun_as_root)\nFile \"/opt/stack/cinder/cinder/utils.py\", line 189, in execute\n return processutils.execute(*cmd, **kwargs)\n        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n\noslo_concurrency.processutils.ProcessExecutionError: Unexpected error while running a command.\nCommand: sudo cinder-rootwrap /etc/cinder/rootwrap.conf qemu-img convert -O raw\n/opt/stack/data/cinder/mnt/896fb15da6036b68a917322e72ebfe57/volume-915ce6ad-4016-4d73-9aa6-cad2dd0c81a5\n/opt/stack/data/cinder/conversion/915ce6ad-4016-4d73-9aa6-cad2dd0c81a5.temp_image.76662334-24b6-436c-a504-6b942aaa97cav55jriqe.img\nExit code: 1\nStdout: \u0027\u0027\nStderr: \"qemu-img: Could not open \u0027/opt/stack/data/cinder/mnt/896fb15da6036b68a917322e72ebfe57/volume-915ce6ad-4016-4d73-9aa6-cad2dd0c81a5\u0027: Parameter \u0027encrypt.key-secret\u0027 is required for cipher\\n\"\n```\n\n---\n\nFwiw, this would also undermine some core assumptions about Cinder in the image encryption spec [1] [2] as we never expect Cinder to use encrypted Qcow2 as a backend format choice in addition to raw LUKS.\n\n[1] https://opendev.org/openstack/glance-specs/src/branch/master/specs/2026.2/approved/glance/standardized_image_encryption.rst?display\u003dsource#L160\n\n[2] https://opendev.org/openstack/glance-specs/src/branch/master/specs/2026.2/approved/glance/standardized_image_encryption.rst?display\u003dsource#L343-L348","commit_id":"80dbabff82b9b106213414fb43fa70ff85dcfdbe"},{"author":{"_account_id":27665,"name":"Markus Hentsch","email":"markus.hentsch@cloudandheat.com","username":"mhen"},"change_message_id":"f328726850caa1d50517ba5dbea86937d82c610d","unresolved":true,"context_lines":[{"line_number":774,"context_line":"                    f.write(passphrase)"},{"line_number":775,"context_line":"                image_utils.convert_image(tmp.name,"},{"line_number":776,"context_line":"                                          path_to_new_vol,"},{"line_number":777,"context_line":"                                          \u0027qcow2\u0027,"},{"line_number":778,"context_line":"                                          src_format\u003d\u0027raw\u0027,"},{"line_number":779,"context_line":"                                          cipher_spec\u003dcipher_spec,"},{"line_number":780,"context_line":"                                          passphrase_file\u003dpassfile.name)"}],"source_content_type":"text/x-python","patch_set":4,"id":"fcd62a85_ee79f369","line":777,"in_reply_to":"d923c431_09cca9b7","updated":"2026-08-19 12:46:03.000000000","message":"I dug a bit further and discovered that encrypted qcow2 *is* already used in the existing RemoteFS base driver (inherited by NFS), so my statement\n\n\u003e Introducing encrypted qcow2 in addition to raw LUKS as an alternative encryption provider in Cinder\n\nwas not entirely correct.\nHowever, I believe this never actually worked in the first place and only appeared to work because os-brick immediately reformats it upon first use: https://bugs.launchpad.net/cinder/+bug/2164526\n\nGiven all the implications in os-brick, Nova and Glance I still think we should think twice if we really want to add encrypted qcow2 to the mix here in contrast to relying on raw LUKS as already established everywhere else instead.\n\nNote qemu-img should be able to produce raw LUKS just as well as it is able to produce the encrypted qcow2 format.","commit_id":"80dbabff82b9b106213414fb43fa70ff85dcfdbe"}]}