Comment 21 for bug 1463525

Reviewed: https://review.openstack.org/193830
Committed: https://git.openstack.org/cgit/openstack/nova/commit/?id=ac8a7e91e33abe4089cafb2ffa0509b5ce02039c
Submitter: Jenkins
Branch: master

commit ac8a7e91e33abe4089cafb2ffa0509b5ce02039c
Author: Matt Riedemann <email address hidden>
Date: Sat Jun 20 13:33:06 2015 -0700

    Handle KeyError when volume encryption is not supported

    When attaching a volume, after the connection is initialized to the
    volume in Cinder, the nova.volume.encryptors.get_encryption_metadata
    method is called to get encryption metadata for the volume. That call is
    based on the 'encrypted' key in connection_info['data'] returned from
    the os-initialize_connection Cinder API.

    However, just because the volume has an encryption key in Cinder does
    not mean that the corresponding volume driver in Nova supports
    encrypting the volume, like in the case of RBD volumes.

    Tempest has tests for encrypted volumes which succeed today in the Ceph
    job but they are actually false positives since without Cinder change
    I03f8cae05cc117e14f7482115de685fc9f3fa54a, the 'encrypted' key is not
    set in the connection_info dict and Nova doesn't attempt encryption of
    the volume during attach.

    The Ceph job fails when encrypted=True is in connection_info because
    cryptsetup (and luks which extends cryptsetup) requires the
    'device_path' key in the connection_info dict, which is set when
    connecting the volume during attach via the corresponding Nova volume
    driver. In the case of RBD and libvirt, the LibvirtNetVolumeDriver is
    used and the 'device_path' key isn't set, so a KeyError is raised when
    trying to construct the CryptsetupEncryptor or LuksEncryptor objects.

    This change adds a check in CryptsetupEncryptor such that if the
    device_path is not in connection_info, a VolumeEcnryptionNotSupported
    error is raised rather than KeyError.

    Note that this doesn't fix the encrypted volume tests in Tempest. Those
    tests fail due to a timeout waiting for the volume status to be 'in-use'
    which doesn't happen since the compute manager rolls back the
    reservation on the volume when the error occurs. The Tempest tests will
    have to be skipped in the Ceph job until volume encryption is supported
    for RBD in Nova, which will be a separate set of changes.

    Related-Bug: #1463525

    Change-Id: I8efc2628b09d4e9e59831353daa080b20e17ccde