Encrypted volume attachment fails when nova-compute is containerized

[Eric Harney]

Encrypted volume attachment fails when nova-compute is running in a container (Pike). The compute service runs "cryptsetup luksOpen" which hangs waiting for some udev device creation to complete. This never finishes and the command hangs.

Changing the nova compute service to run with "--ipc=host" allows devicemapper in the container to see the udev device process finish, and resolves this issue.

This will be needed for any services attaching encrypted Cinder volumes: nova compute and cinder volume at a minimum.

[Eric Harney (eharney)]

Some info from Kolla here: https://www.redhat.com/archives/linux-lvm/2016-March/msg00019.html

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/517096

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/pike
Review: https://review.openstack.org/517209

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/517096
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=05b61472463d5dbde3f1b1285819044409a80e2e
Submitter: Zuul
Branch: master

commit 05b61472463d5dbde3f1b1285819044409a80e2e
Author: Eric Harney <email address hidden>
Date: Wed Nov 1 15:47:01 2017 -0400

    Set ipc=host for services attaching encrypted volumes

    Without ipc=host set, cryptsetup/devicemapper will never
    see devices created when running "cryptsetup luksOpen",
    causing the command to hang.

    This is required for attaching encrypted Cinder volumes.

    Closes-Bug: #1729419
    Change-Id: Ic7184b1fbbafea266f8ec1e7974d0a4a2cf4d750

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/517209
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=4d5686b6ad85d52c8359885bc8fc74cb525f6f76
Submitter: Zuul
Branch: stable/pike

commit 4d5686b6ad85d52c8359885bc8fc74cb525f6f76
Author: Eric Harney <email address hidden>
Date: Wed Nov 1 15:47:01 2017 -0400

    Set ipc=host for services attaching encrypted volumes

    Without ipc=host set, cryptsetup/devicemapper will never
    see devices created when running "cryptsetup luksOpen",
    causing the command to hang.

    This is required for attaching encrypted Cinder volumes.

    Closes-Bug: #1729419
    Change-Id: Ic7184b1fbbafea266f8ec1e7974d0a4a2cf4d750
    (cherry picked from commit 05b61472463d5dbde3f1b1285819044409a80e2e)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/tripleo-heat-templates 7.0.4 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/tripleo-heat-templates 8.0.0.0b2 development milestone.