)]}'
{"releasenotes/notes/qemu-native-luks-decryption-6e9ad8cc658be14d.yaml":[{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"2b0b446fe2defe1a46892a88ce37f372a54ea8f6","unresolved":false,"context_lines":[{"line_number":10,"context_line":"    will use the secret to generate the required encryption XML for the disk."},{"line_number":11,"context_line":"    QEMU will then be able to read from and write to the encrypted disk"},{"line_number":12,"context_line":"    natively, without the need of os-brick encryptors."},{"line_number":13,"context_line":"    NOTE: Swapping of encrypted volumes while using native QEMU decryption is"},{"line_number":14,"context_line":"    not allowed as further implementation work in Libvirt is required to"},{"line_number":15,"context_line":"    support it."}],"source_content_type":"text/x-yaml","patch_set":1,"id":"5f93b717_89369cb4","line":13,"range":{"start_line":13,"start_character":10,"end_line":13,"end_character":18},"updated":"2018-01-24 20:32:10.000000000","message":"Does \u0027swapping\u0027 mean volume swap? Meaning you can\u0027t do volume retype or migration of a luks-encrypted volume if you\u0027re using new enough qemu/libvirt? But it would work before? That seems like a regression.","commit_id":"50a489ec6803184aa09ee76668e3df9a7ee70681"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"2b0b446fe2defe1a46892a88ce37f372a54ea8f6","unresolved":false,"context_lines":[{"line_number":10,"context_line":"    will use the secret to generate the required encryption XML for the disk."},{"line_number":11,"context_line":"    QEMU will then be able to read from and write to the encrypted disk"},{"line_number":12,"context_line":"    natively, without the need of os-brick encryptors."},{"line_number":13,"context_line":"    NOTE: Swapping of encrypted volumes while using native QEMU decryption is"},{"line_number":14,"context_line":"    not allowed as further implementation work in Libvirt is required to"},{"line_number":15,"context_line":"    support it."}],"source_content_type":"text/x-yaml","patch_set":1,"id":"5f93b717_89d1bc5a","line":13,"range":{"start_line":13,"start_character":4,"end_line":13,"end_character":8},"updated":"2018-01-24 20:32:10.000000000","message":"Use the .. note:: notation?","commit_id":"50a489ec6803184aa09ee76668e3df9a7ee70681"},{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"19aa0c09f1d70823f9590b801f65ac3a32e69f3f","unresolved":false,"context_lines":[{"line_number":10,"context_line":"    will use the secret to generate the required encryption XML for the disk."},{"line_number":11,"context_line":"    QEMU will then be able to read from and write to the encrypted disk"},{"line_number":12,"context_line":"    natively, without the need of os-brick encryptors."},{"line_number":13,"context_line":"    NOTE: Swapping of encrypted volumes while using native QEMU decryption is"},{"line_number":14,"context_line":"    not allowed as further implementation work in Libvirt is required to"},{"line_number":15,"context_line":"    support it."}],"source_content_type":"text/x-yaml","patch_set":1,"id":"5f93b717_9688dec6","line":13,"range":{"start_line":13,"start_character":10,"end_line":13,"end_character":18},"in_reply_to":"5f93b717_7b609bcf","updated":"2018-01-25 16:22:06.000000000","message":"Just to document in here from the openstack-dev ML, swap volume with encrypted volumes has never worked until a recent patch [1] that merged 3 days ago, so we won\u0027t consider it regressed.\n\nI\u0027ll remove this note.\n\n[1] https://review.openstack.org/#/c/460243","commit_id":"50a489ec6803184aa09ee76668e3df9a7ee70681"},{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"5f086d1ea4c5d9d7339811f1b0ce3fe7d84b97bd","unresolved":false,"context_lines":[{"line_number":10,"context_line":"    will use the secret to generate the required encryption XML for the disk."},{"line_number":11,"context_line":"    QEMU will then be able to read from and write to the encrypted disk"},{"line_number":12,"context_line":"    natively, without the need of os-brick encryptors."},{"line_number":13,"context_line":"    NOTE: Swapping of encrypted volumes while using native QEMU decryption is"},{"line_number":14,"context_line":"    not allowed as further implementation work in Libvirt is required to"},{"line_number":15,"context_line":"    support it."}],"source_content_type":"text/x-yaml","patch_set":1,"id":"5f93b717_a90a7887","line":13,"range":{"start_line":13,"start_character":10,"end_line":13,"end_character":18},"in_reply_to":"5f93b717_89369cb4","updated":"2018-01-24 21:05:46.000000000","message":"Yes, swap_volume. To be honest, I\u0027m not sure. It does look like it would be a regression. I can only assume the thinking was that using newer qemu and libvirt isn\u0027t officially supported and opting in would come with the caveat.","commit_id":"50a489ec6803184aa09ee76668e3df9a7ee70681"},{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"5f086d1ea4c5d9d7339811f1b0ce3fe7d84b97bd","unresolved":false,"context_lines":[{"line_number":10,"context_line":"    will use the secret to generate the required encryption XML for the disk."},{"line_number":11,"context_line":"    QEMU will then be able to read from and write to the encrypted disk"},{"line_number":12,"context_line":"    natively, without the need of os-brick encryptors."},{"line_number":13,"context_line":"    NOTE: Swapping of encrypted volumes while using native QEMU decryption is"},{"line_number":14,"context_line":"    not allowed as further implementation work in Libvirt is required to"},{"line_number":15,"context_line":"    support it."}],"source_content_type":"text/x-yaml","patch_set":1,"id":"5f93b717_7c751098","line":13,"range":{"start_line":13,"start_character":4,"end_line":13,"end_character":8},"in_reply_to":"5f93b717_89d1bc5a","updated":"2018-01-24 21:05:46.000000000","message":"Sorry, didn\u0027t remember about it.","commit_id":"50a489ec6803184aa09ee76668e3df9a7ee70681"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"c8a055f8ae797eb8cf3cf8d6762d23b4a8f1d20a","unresolved":false,"context_lines":[{"line_number":10,"context_line":"    will use the secret to generate the required encryption XML for the disk."},{"line_number":11,"context_line":"    QEMU will then be able to read from and write to the encrypted disk"},{"line_number":12,"context_line":"    natively, without the need of os-brick encryptors."},{"line_number":13,"context_line":"    NOTE: Swapping of encrypted volumes while using native QEMU decryption is"},{"line_number":14,"context_line":"    not allowed as further implementation work in Libvirt is required to"},{"line_number":15,"context_line":"    support it."}],"source_content_type":"text/x-yaml","patch_set":1,"id":"5f93b717_7b609bcf","line":13,"range":{"start_line":13,"start_character":10,"end_line":13,"end_character":18},"in_reply_to":"5f93b717_904a2625","updated":"2018-01-25 15:21:38.000000000","message":"Note to self, this is the BZ for the swap volume issue with encrypted volumes:\n\nhttps://bugzilla.redhat.com/show_bug.cgi?id\u003d760547","commit_id":"50a489ec6803184aa09ee76668e3df9a7ee70681"},{"author":{"_account_id":10135,"name":"Lee Yarwood","display_name":"Lee Yarwood","email":"lyarwood@redhat.com","username":"lyarwood"},"change_message_id":"b5e22ea894f4df48d3501d7531586a85911d03a6","unresolved":false,"context_lines":[{"line_number":10,"context_line":"    will use the secret to generate the required encryption XML for the disk."},{"line_number":11,"context_line":"    QEMU will then be able to read from and write to the encrypted disk"},{"line_number":12,"context_line":"    natively, without the need of os-brick encryptors."},{"line_number":13,"context_line":"    NOTE: Swapping of encrypted volumes while using native QEMU decryption is"},{"line_number":14,"context_line":"    not allowed as further implementation work in Libvirt is required to"},{"line_number":15,"context_line":"    support it."}],"source_content_type":"text/x-yaml","patch_set":1,"id":"5f93b717_bf206af9","line":13,"range":{"start_line":13,"start_character":10,"end_line":13,"end_character":18},"in_reply_to":"5f93b717_a90a7887","updated":"2018-01-24 21:53:21.000000000","message":"It\u0027s a regression now that bug #1739593 has been resolved when using the os-brick encryptors. We did flirt with the idea of using a config option to allow users to disable the QEMU approach to workaround this. \n\nIf this is an issue I can spin a change to reintroduce this option, allowing users to use the old style encryptors until the required libvirt changes, that are yet to be written, land somewhere for us to use.","commit_id":"50a489ec6803184aa09ee76668e3df9a7ee70681"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"b4f9b41a7841c7de59c30a5ef2ab8b030d646640","unresolved":false,"context_lines":[{"line_number":10,"context_line":"    will use the secret to generate the required encryption XML for the disk."},{"line_number":11,"context_line":"    QEMU will then be able to read from and write to the encrypted disk"},{"line_number":12,"context_line":"    natively, without the need of os-brick encryptors."},{"line_number":13,"context_line":"    NOTE: Swapping of encrypted volumes while using native QEMU decryption is"},{"line_number":14,"context_line":"    not allowed as further implementation work in Libvirt is required to"},{"line_number":15,"context_line":"    support it."}],"source_content_type":"text/x-yaml","patch_set":1,"id":"5f93b717_fad600f2","line":13,"range":{"start_line":13,"start_character":10,"end_line":13,"end_character":18},"in_reply_to":"5f93b717_bf206af9","updated":"2018-01-24 22:17:29.000000000","message":"\u003e If this is an issue I can spin a change to reintroduce this option, allowing users to use the old style encryptors until the required libvirt changes, that are yet to be written, land somewhere for us to use.\n\nYeah...hmm, if we know when we\u0027ll be using native luks, and we don\u0027t know when libvirt will work with this for blockRebase (swap volume right? - does that also impact guest-assisted snapshots of native luks encrypted volumes for things like NFS and gluster?), then couldn\u0027t we have a check in that code that basically says if native luks, use the old way until we have a set of known good versions that we can check for libvirt/qemu to allow it?","commit_id":"50a489ec6803184aa09ee76668e3df9a7ee70681"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"11cb5cd0881dbd161c9fc94b6a75237a73332922","unresolved":false,"context_lines":[{"line_number":10,"context_line":"    will use the secret to generate the required encryption XML for the disk."},{"line_number":11,"context_line":"    QEMU will then be able to read from and write to the encrypted disk"},{"line_number":12,"context_line":"    natively, without the need of os-brick encryptors."},{"line_number":13,"context_line":"    NOTE: Swapping of encrypted volumes while using native QEMU decryption is"},{"line_number":14,"context_line":"    not allowed as further implementation work in Libvirt is required to"},{"line_number":15,"context_line":"    support it."}],"source_content_type":"text/x-yaml","patch_set":1,"id":"5f93b717_904a2625","line":13,"range":{"start_line":13,"start_character":10,"end_line":13,"end_character":18},"in_reply_to":"5f93b717_d1ed2626","updated":"2018-01-25 14:51:22.000000000","message":"IF swap volume with encrypted volumes never worked until this series, then we shouldn\u0027t probably mention this caveat at all, because it will be alarming and confusing, like it is to me. Instead, we should probably put something in the Cinder API reference for volume retype/migration saying that it won\u0027t work for an attached encrypted volume, at least until some bug is fixed. That would be more discoverable from an end-user POV than a release note.","commit_id":"50a489ec6803184aa09ee76668e3df9a7ee70681"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"f9cb85628b583fa3a023e483097b5d25ce7931fc","unresolved":false,"context_lines":[{"line_number":10,"context_line":"    will use the secret to generate the required encryption XML for the disk."},{"line_number":11,"context_line":"    QEMU will then be able to read from and write to the encrypted disk"},{"line_number":12,"context_line":"    natively, without the need of os-brick encryptors."},{"line_number":13,"context_line":"    NOTE: Swapping of encrypted volumes while using native QEMU decryption is"},{"line_number":14,"context_line":"    not allowed as further implementation work in Libvirt is required to"},{"line_number":15,"context_line":"    support it."}],"source_content_type":"text/x-yaml","patch_set":1,"id":"5f93b717_d1ed2626","line":13,"range":{"start_line":13,"start_character":10,"end_line":13,"end_character":18},"in_reply_to":"5f93b717_fad600f2","updated":"2018-01-25 02:41:11.000000000","message":"Also, this should probably go into a separate \"issues\" release note if we\u0027ve knowingly regressed functionality - it needs to be called out as a known issue and tracked with a bug.","commit_id":"50a489ec6803184aa09ee76668e3df9a7ee70681"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"2b0b446fe2defe1a46892a88ce37f372a54ea8f6","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"5f93b717_49409408","line":16,"updated":"2018-01-24 20:32:10.000000000","message":"Anything to mention about live migration caveats in here, or it should all just work?","commit_id":"50a489ec6803184aa09ee76668e3df9a7ee70681"},{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"5f086d1ea4c5d9d7339811f1b0ce3fe7d84b97bd","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"5f93b717_9c649cbb","line":16,"in_reply_to":"5f93b717_49409408","updated":"2018-01-24 21:05:46.000000000","message":"I think the only requirement is that the key_manager fixed_key be the same across hosts as shown here [1]. It wasn\u0027t clear to me if that\u0027s the usual way to deploy already or not.\n\n[1] https://review.openstack.org/#/c/536844","commit_id":"50a489ec6803184aa09ee76668e3df9a7ee70681"},{"author":{"_account_id":10135,"name":"Lee Yarwood","display_name":"Lee Yarwood","email":"lyarwood@redhat.com","username":"lyarwood"},"change_message_id":"b5e22ea894f4df48d3501d7531586a85911d03a6","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"5f93b717_dff9b64d","line":16,"in_reply_to":"5f93b717_9c649cbb","updated":"2018-01-24 21:53:21.000000000","message":"Yes we should document how instances using encrypted volumes initially booted on P will continue use os-brick encryptors after a LM or direct upgrade to Q. It will take a full reboot or another migration between Q computes before the instance will attempt to use the new approach.","commit_id":"50a489ec6803184aa09ee76668e3df9a7ee70681"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"bc513dfef8b3a09626c87b0d5ac4583e94e88a6a","unresolved":false,"context_lines":[{"line_number":11,"context_line":"    QEMU will then be able to read from and write to the encrypted disk"},{"line_number":12,"context_line":"    natively, without the need of os-brick encryptors."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"    Instances that have been booted before Queens will continue to use os-brick"},{"line_number":15,"context_line":"    encryptors after a live migration or direct upgrade to Queens. A full"},{"line_number":16,"context_line":"    reboot or another live migration between Queens compute hosts is required"},{"line_number":17,"context_line":"    before the instance will attempt to use QEMU native LUKS decryption."}],"source_content_type":"text/x-yaml","patch_set":2,"id":"5f93b717_c39d415a","line":14,"range":{"start_line":14,"start_character":4,"end_line":14,"end_character":35},"updated":"2018-01-25 18:54:46.000000000","message":"Isn\u0027t it really more about attachments made to encrypted volumes before Queens?","commit_id":"c16883433d136e23889c5a9a530b9e6efb2fee52"},{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"0fc8d702abbdf7236d6acbf2effdf2646071bac5","unresolved":false,"context_lines":[{"line_number":11,"context_line":"    QEMU will then be able to read from and write to the encrypted disk"},{"line_number":12,"context_line":"    natively, without the need of os-brick encryptors."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"    Instances that have been booted before Queens will continue to use os-brick"},{"line_number":15,"context_line":"    encryptors after a live migration or direct upgrade to Queens. A full"},{"line_number":16,"context_line":"    reboot or another live migration between Queens compute hosts is required"},{"line_number":17,"context_line":"    before the instance will attempt to use QEMU native LUKS decryption."}],"source_content_type":"text/x-yaml","patch_set":2,"id":"5f93b717_23c5053d","line":14,"range":{"start_line":14,"start_character":4,"end_line":14,"end_character":35},"in_reply_to":"5f93b717_c39d415a","updated":"2018-01-25 18:56:37.000000000","message":"I think so, yes. This wording could be clearer.","commit_id":"c16883433d136e23889c5a9a530b9e6efb2fee52"}]}