From 1c63eb20d92febabbcb0dacbc35b0c89771d7202 Mon Sep 17 00:00:00 2001
From: Mark Goddard <mark@stackhpc.com>
Date: Mon, 8 Apr 2019 12:18:52 +0100
Subject: [PATCH] Persist nova libvirt secrets in a Docker volume
Libvirt may reasonably expect that its secrets directory
(/etc/libvirt/secrets) is persistent. However, the nova_libvirt
container does not map the secrets directory to a volume, so it will not
survive a recreation of the container. Furthermore, if Cinder or Nova
Ceph RBD integration is enabled, nova_libvirt's config.json includes an
entry for /etc/libvirt/secrets which will wipe out the directory on a
restart of the container.
Previously, this appeared to cause an issue with encrypted volumes,
which could fail to attach in certain situations as described in bug
1821696. Nova has since made a related change, and the issue can no
longer be reproduced. However, making the secret store persistent seems
like a sensible thing to do, and may prevent hitting other corner cases.
This change maps /etc/libvirt/secrets to a Docker volume in the
nova_libvirt container. We also modify config.json for the nova_libvirt
container to merge the /etc/libvirt/secrets directory, to ensure that
secrets added in the container during runtime are not overwritten when
the container restarts.
Change-Id: Ia7e923dddb77ff6db3c9160af931354a2b305e8d
Related-Bug: #1821696
---
ansible/roles/nova-cell/defaults/main.yml | 1 +
ansible/roles/nova-cell/templates/nova-libvirt.json.j2 | 3 ++-
.../notes/persist-libvirt-secrets-6e07ab2914f40ad3.yaml | 6 ++++++
3 files changed, 9 insertions(+), 1 deletion(-)
create mode 100644 releasenotes/notes/persist-libvirt-secrets-6e07ab2914f40ad3.yaml
diff --git a/ansible/roles/nova-cell/defaults/main.yml b/ansible/roles/nova-cell/defaults/main.yml
index 0385ea2017..a8020904dc 100644
--- a/ansible/roles/nova-cell/defaults/main.yml
+++ b/ansible/roles/nova-cell/defaults/main.yml
@@ -333,6 +333,7 @@ nova_libvirt_default_volumes:
- "{{ nova_instance_datadir_volume }}:/var/lib/nova/"
- "{% if enable_shared_var_lib_nova_mnt | bool %}/var/lib/nova/mnt:/var/lib/nova/mnt:shared{% endif %}"
- "nova_libvirt_qemu:/etc/libvirt/qemu"
+ - "nova_libvirt_secrets:/etc/libvirt/secrets"
- "{{ kolla_dev_repos_directory ~ '/nova/nova:/var/lib/kolla/venv/lib/python' ~ distro_python_version ~ '/site-packages/nova' if nova_dev_mode | bool else '' }}"
nova_ssh_default_volumes:
- "{{ node_config_directory }}/nova-ssh/:{{ container_config_directory }}/:ro"
diff --git a/ansible/roles/nova-cell/templates/nova-libvirt.json.j2 b/ansible/roles/nova-cell/templates/nova-libvirt.json.j2
index 18fc69f85d..c2c5a50c51 100644
--- a/ansible/roles/nova-cell/templates/nova-libvirt.json.j2
+++ b/ansible/roles/nova-cell/templates/nova-libvirt.json.j2
@@ -53,7 +53,8 @@
"source": "{{ container_config_directory }}/ceph.conf",
"dest": "/etc/ceph/ceph.conf",
"owner": "nova",
- "perm": "0600"
+ "perm": "0600",
+ "merge": true
}{% endif %}
]
}
diff --git a/releasenotes/notes/persist-libvirt-secrets-6e07ab2914f40ad3.yaml b/releasenotes/notes/persist-libvirt-secrets-6e07ab2914f40ad3.yaml
new file mode 100644
index 0000000000..3bc48f5007
--- /dev/null
+++ b/releasenotes/notes/persist-libvirt-secrets-6e07ab2914f40ad3.yaml
@@ -0,0 +1,6 @@
+---
+fixes:
+ - |
+ Fixes an issue where Libvirt secrets were not persisted. There are no known
+ negative side-effects to this, however it was fixed as a precaution.
+ `LP#1821696 <https://launchpad.net/bugs/1821696>`__
--
GitLab