Hi Rhos-Compute, Follwing QE steps would be good to verify this : env: ceph backened with barbician enabled 1. sudo crudini --set /var/lib/config-data/puppet-generated/nova_libvirt/etc/nova/nova.conf workarounds disable_native_luksv1 true Restart nova_compute to ensure these are picked up by the compute container: 2. $ sudo docker restart nova_compute 3. sudo docker exec -ti -u root nova_compute crudini --get /etc/nova/nova.conf workarounds disable_native_luksv1 4. Additionally we also need to set the following option in the /etc/ceph/ceph.conf of the controller running cinder-volume: [global] default features = 3 what is the best way to validate that this has not used luks_1 encryption but force it to use dm-crypt based os-brick encryptor to decrypt the LUKSv1 volume ? Is going to nova_virtlog container on hosted node and checking is good enough?? sudo cryptsetup status <crypt volume> ? to check the dm-crypt key is used or not??
(In reply to Paras Babbar from comment #9) > Hi Rhos-Compute, > > Follwing QE steps would be good to verify this : > > env: ceph backened with barbician enabled > > 1. sudo crudini --set > /var/lib/config-data/puppet-generated/nova_libvirt/etc/nova/nova.conf > workarounds disable_native_luksv1 true > Restart nova_compute to ensure these are picked up by the compute container: > > 2. $ sudo docker restart nova_compute > > 3. sudo docker exec -ti -u root nova_compute crudini --get > /etc/nova/nova.conf workarounds disable_native_luksv1 > > 4. Additionally we also need to set the following option in the > /etc/ceph/ceph.conf of the controller running cinder-volume: > > [global] > default features = 3 We don't need Ceph to validate this - that's covered by 1824120 and requires an additional configuration option, "[workarounds] rbd_volume_local_attach". You should configure with LVM. The suggested verification steps are otherwise correct. > what is the best way to validate that this has not used luks_1 encryption > but force it to use dm-crypt > based os-brick encryptor to decrypt the LUKSv1 volume ? > > Is going to nova_virtlog container on hosted node and checking is good > enough?? > sudo cryptsetup status <crypt volume> ? to check the dm-crypt key is used or > not?? The combination of logs and 'cryptsetup status' output should suffice, yes.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:2725