Bug 1805666

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Release of components for Red Hat OpenStack Platform 17.0 (Wallaby)), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2022:6543

noting this here for prosperity

```
[workarounds]
disable_native_luksv1 = true
```

requires `rbd_volume_local_attach=true`

so it must be

```
[workarounds]
disable_native_luksv1 = true
rbd_volume_local_attach=true
```

otherwise it will not work correctly.


this is discussed in the help text for both options

```
    cfg.BoolOpt(
        'disable_native_luksv1',
        default=False,
        deprecated_for_removal=True,
        deprecated_since='23.0.0',
        deprecated_reason="""
The underlying performance regression within libgcrypt that prompted this
workaround has been resolved as of 1.8.5
""",
        help="""
When attaching encrypted LUKSv1 Cinder volumes to instances the Libvirt driver
configures the encrypted disks to be natively decrypted by QEMU.

A performance issue has been discovered in the libgcrypt library used by QEMU
that serverly limits the I/O performance in this scenario.

For more information please refer to the following bug report:

RFE: hardware accelerated AES-XTS mode
https://bugzilla.redhat.com/show_bug.cgi?id=1762765

Enabling this workaround option will cause Nova to use the legacy dm-crypt
based os-brick encryptor to decrypt the LUKSv1 volume.

Note that enabling this option while using volumes that do not provide a host
block device such as Ceph will result in a failure to boot from or attach the
volume to an instance. See the ``[workarounds]/rbd_block_device`` option for a
way to avoid this for RBD.

Related options:

* ``compute_driver`` (libvirt)
* ``rbd_block_device`` (workarounds)
"""),
    cfg.BoolOpt(
        'rbd_volume_local_attach',
        default=False,
        deprecated_for_removal=True,
        deprecated_since='23.0.0',
        deprecated_reason="""
The underlying performance regression within libgcrypt that prompted this
workaround has been resolved as of 1.8.5
""",
        help="""
Attach RBD Cinder volumes to the compute as host block devices.

When enabled this option instructs os-brick to connect RBD volumes locally on
the compute host as block devices instead of natively through QEMU.

This workaround does not currently support extending attached volumes.

This can be used with the disable_native_luksv1 workaround configuration
option to avoid the recently discovered performance issues found within the
libgcrypt library.

This workaround is temporary and will be removed during the W release once
all impacted distributions have been able to update their versions of the
libgcrypt library.

Related options:

* ``compute_driver`` (libvirt)
* ``disable_qemu_native_luksv1`` (workarounds)
"""),
```


https://github.com/openstack/nova/blob/unmaintained/wallaby/nova/conf/workarounds.py#L274-L337

also, form a purely downstream perspective both options are unsupported by RedHat and require a support exception to use
with our product.

both options have been removed in the later release of OpenStack

we do not support using either on rhel 9 deployment as they were a tempory workaround for specific customers
on rhel 8.4 due to the non-backportable libgcrypt issue with qemu on rhel 8.