Bug 1285089

Summary: [RFE] Boot instance from encrypted volume [iSCSI]
Product: Red Hat OpenStack Reporter: Jeremy <jmelvin>
Component: openstack-cinderAssignee: Eric Harney <eharney>
Status: CLOSED ERRATA QA Contact: Avi Avraham <aavraham>
Severity: high Docs Contact:
Priority: high    
Version: 7.0 (Kilo)CC: acanan, berrange, brault, cschwede, dasmith, ealcaniz, eglynn, eharney, jdonohue, jmelvin, jobernar, jschluet, kchamart, lyarwood, nlevine, pablo.iranzo, panbalag, pbrady, pgrist, sbauza, scohen, sferdjao, sgordon, srevivo, tshefi, vromanso, yaron.aboodaga, yves.brissette
Target Milestone: Upstream M2Keywords: FutureFeature, Triaged
Target Release: 12.0 (Pike)Flags: scohen: needinfo+
Hardware: Unspecified   
OS: Unspecified   
Fixed In Version: openstack-cinder-11.0.0-0.20170611191457.3dacd2a.el7ost Doc Type: Enhancement
Doc Text:
Story Points: ---
Clone Of:
: 1471627 (view as bug list) Environment:
Last Closed: 2017-12-13 20:37:32 UTC Type: Feature Request
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1302261, 1406802, 1487920    
Bug Blocks: 1230402, 1262120, 1389435, 1389441, 1442136, 1471627    

Comment 3 Lee Yarwood 2015-12-04 16:14:33 UTC
(In reply to Jeremy from comment #0)
> Description of problem: Can not boot instance from encrypted volume
> Version-Release number of selected component (if applicable):
> instance : uuid=99ea08e5-97b8-4b30-9dd3-abe0f6cbcce4
> volume-80fdf401-f069-4ee5-8686-3f4e00cb375f

Can we confirm how the customer is creating the image, volume and instance here?

I think the issue is that Cinder is copying the image data into the volume unencrypted causing Nova to re-encrypt the volume prior to use. 

This is covered in the following Nova bug and recently associated Cinder spec :

Booting encrypted volume with whole image fails

Convert encrypted data to encrypted volumes with encrypted image

Comment 4 Lee Yarwood 2015-12-04 16:32:29 UTC
The ability for users to even create encrypted volumes from images is now being blocked by cinder-api with the following changes :

master - Prevent creating encrypted volume with image

stable/kilo - Prevent creating encrypted volume with image

Comment 6 Lee Yarwood 2015-12-22 09:59:12 UTC
I'm closing this out as CANTFIX as the fault here is with Cinder and not Nova. I suggest that we create a Cinder RFE to follow the progress of the encryption improvements in M :

Improvement about encrypted volume

Comment 12 Lee Yarwood 2016-05-09 09:55:10 UTC
*** Bug 1262121 has been marked as a duplicate of this bug. ***

Comment 21 Sean Cohen 2016-12-05 16:15:05 UTC
*** Bug 1230402 has been marked as a duplicate of this bug. ***

Comment 32 Avi Avraham 2017-11-13 10:16:26 UTC
Package installed 

successfully create an encrypted volume from image,
boot instance from encrypted volume and ssh login to the instance.

Comment 35 errata-xmlrpc 2017-12-13 20:37:32 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.