Red Hat Bugzilla – Bug 1285089
[RFE] Boot instance from encrypted volume [iSCSI]
Last modified: 2018-02-05 14:02:04 EST
(In reply to Jeremy from comment #0) > Description of problem: Can not boot instance from encrypted volume > > Version-Release number of selected component (if applicable): > > instance : uuid=99ea08e5-97b8-4b30-9dd3-abe0f6cbcce4 > volume-80fdf401-f069-4ee5-8686-3f4e00cb375f Can we confirm how the customer is creating the image, volume and instance here? I think the issue is that Cinder is copying the image data into the volume unencrypted causing Nova to re-encrypt the volume prior to use. This is covered in the following Nova bug and recently associated Cinder spec : Booting encrypted volume with whole image fails https://bugs.launchpad.net/nova/+bug/1465656 Convert encrypted data to encrypted volumes with encrypted image https://blueprints.launchpad.net/cinder/+spec/encrypt-volume-with-image
The ability for users to even create encrypted volumes from images is now being blocked by cinder-api with the following changes : master - Prevent creating encrypted volume with image https://review.openstack.org/#/c/210219/ stable/kilo - Prevent creating encrypted volume with image https://review.openstack.org/#/c/217365/
I'm closing this out as CANTFIX as the fault here is with Cinder and not Nova. I suggest that we create a Cinder RFE to follow the progress of the encryption improvements in M : Improvement about encrypted volume https://blueprints.launchpad.net/cinder/+spec/improve-encrypted-volume
*** Bug 1262121 has been marked as a duplicate of this bug. ***
*** Bug 1230402 has been marked as a duplicate of this bug. ***
verified Package installed openstack-tripleo-heat-templates-7.0.3-0.20171024200825.el7ost.noarch openstack-cinder-11.0.0-0.20170611191457.3dacd2a.el7ost successfully create an encrypted volume from image, boot instance from encrypted volume and ssh login to the instance.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2017:3462