From 1c63eb20d92febabbcb0dacbc35b0c89771d7202 Mon Sep 17 00:00:00 2001 From: Mark Goddard Date: Mon, 8 Apr 2019 12:18:52 +0100 Subject: [PATCH] Persist nova libvirt secrets in a Docker volume Libvirt may reasonably expect that its secrets directory (/etc/libvirt/secrets) is persistent. However, the nova_libvirt container does not map the secrets directory to a volume, so it will not survive a recreation of the container. Furthermore, if Cinder or Nova Ceph RBD integration is enabled, nova_libvirt's config.json includes an entry for /etc/libvirt/secrets which will wipe out the directory on a restart of the container. Previously, this appeared to cause an issue with encrypted volumes, which could fail to attach in certain situations as described in bug 1821696. Nova has since made a related change, and the issue can no longer be reproduced. However, making the secret store persistent seems like a sensible thing to do, and may prevent hitting other corner cases. This change maps /etc/libvirt/secrets to a Docker volume in the nova_libvirt container. We also modify config.json for the nova_libvirt container to merge the /etc/libvirt/secrets directory, to ensure that secrets added in the container during runtime are not overwritten when the container restarts. Change-Id: Ia7e923dddb77ff6db3c9160af931354a2b305e8d Related-Bug: #1821696 --- ansible/roles/nova-cell/defaults/main.yml | 1 + ansible/roles/nova-cell/templates/nova-libvirt.json.j2 | 3 ++- .../notes/persist-libvirt-secrets-6e07ab2914f40ad3.yaml | 6 ++++++ 3 files changed, 9 insertions(+), 1 deletion(-) create mode 100644 releasenotes/notes/persist-libvirt-secrets-6e07ab2914f40ad3.yaml diff --git a/ansible/roles/nova-cell/defaults/main.yml b/ansible/roles/nova-cell/defaults/main.yml index 0385ea2017..a8020904dc 100644 --- a/ansible/roles/nova-cell/defaults/main.yml +++ b/ansible/roles/nova-cell/defaults/main.yml @@ -333,6 +333,7 @@ nova_libvirt_default_volumes: - "{{ nova_instance_datadir_volume }}:/var/lib/nova/" - "{% if enable_shared_var_lib_nova_mnt | bool %}/var/lib/nova/mnt:/var/lib/nova/mnt:shared{% endif %}" - "nova_libvirt_qemu:/etc/libvirt/qemu" + - "nova_libvirt_secrets:/etc/libvirt/secrets" - "{{ kolla_dev_repos_directory ~ '/nova/nova:/var/lib/kolla/venv/lib/python' ~ distro_python_version ~ '/site-packages/nova' if nova_dev_mode | bool else '' }}" nova_ssh_default_volumes: - "{{ node_config_directory }}/nova-ssh/:{{ container_config_directory }}/:ro" diff --git a/ansible/roles/nova-cell/templates/nova-libvirt.json.j2 b/ansible/roles/nova-cell/templates/nova-libvirt.json.j2 index 18fc69f85d..c2c5a50c51 100644 --- a/ansible/roles/nova-cell/templates/nova-libvirt.json.j2 +++ b/ansible/roles/nova-cell/templates/nova-libvirt.json.j2 @@ -53,7 +53,8 @@ "source": "{{ container_config_directory }}/ceph.conf", "dest": "/etc/ceph/ceph.conf", "owner": "nova", - "perm": "0600" + "perm": "0600", + "merge": true }{% endif %} ] } diff --git a/releasenotes/notes/persist-libvirt-secrets-6e07ab2914f40ad3.yaml b/releasenotes/notes/persist-libvirt-secrets-6e07ab2914f40ad3.yaml new file mode 100644 index 0000000000..3bc48f5007 --- /dev/null +++ b/releasenotes/notes/persist-libvirt-secrets-6e07ab2914f40ad3.yaml @@ -0,0 +1,6 @@ +--- +fixes: + - | + Fixes an issue where Libvirt secrets were not persisted. There are no known + negative side-effects to this, however it was fixed as a precaution. + `LP#1821696 `__