kolla-ansible/releasenotes/notes/persist-libvirt-secrets-6e07ab2914f40ad3.yaml

---
fixes:
  - |
    Fixes an issue where Libvirt secrets were not persisted. There are no known
    negative side-effects to this, however it was fixed as a precaution.
    `LP#1821696 <https://launchpad.net/bugs/1821696>`__
Persist nova libvirt secrets in a Docker volume Libvirt may reasonably expect that its secrets directory (/etc/libvirt/secrets) is persistent. However, the nova_libvirt container does not map the secrets directory to a volume, so it will not survive a recreation of the container. Furthermore, if Cinder or Nova Ceph RBD integration is enabled, nova_libvirt's config.json includes an entry for /etc/libvirt/secrets which will wipe out the directory on a restart of the container. Previously, this appeared to cause an issue with encrypted volumes, which could fail to attach in certain situations as described in bug 1821696. Nova has since made a related change, and the issue can no longer be reproduced. However, making the secret store persistent seems like a sensible thing to do, and may prevent hitting other corner cases. This change maps /etc/libvirt/secrets to a Docker volume in the nova_libvirt container. We also modify config.json for the nova_libvirt container to merge the /etc/libvirt/secrets directory, to ensure that secrets added in the container during runtime are not overwritten when the container restarts. Change-Id: Ia7e923dddb77ff6db3c9160af931354a2b305e8d Related-Bug: #1821696 2019-04-08 12:18:52 +01:00			`---`
			`fixes:`
			`- \|`
			`Fixes an issue where Libvirt secrets were not persisted. There are no known`
			`negative side-effects to this, however it was fixed as a precaution.`
			`LP#1821696 <https://launchpad.net/bugs/1821696>`__