Input validation for command encryption-type-create

[Lisa Li]

Currently when creating a encryption type, it uses following command:
cinder encryption-type-create --cipher aes-xts-plain64 --key_size 512 \
  --control_location front-end LUKS nova.volume.encryptors.luks.LuksEncryptor

The problem is that cinder doesn't check the validation of the provider. Giving a invalid provider, the encryption type can be created successfully, and a volume can be created with the volume type. Only when attaching the volume to a VM, it fails.

This bug is raised to do validation check of the input.

[Joel Coffman (joel-coffman)]

Validating the encryption provider is tricky because Cinder cannot verify that a module does or does not exist in Nova (e.g., nova.volume.encryptors.luks.LuksEncryptor).

Perhaps it would be better to move the encryptors to oslo so they can be shared more easily. In addition, assuming that Nova and Cinder both require some minimum version of the resulting oslo library (e.g., oslo.encryptors), then Cinder could validate the input immediately as suggested in this bug report.

[wanghao (wanghao749)]

Agree with Joel, If cinder also need to encrypt/decrypt volume which is attached to host like what nova did, we should share the code to oslo library.

[Lisa Li (lisali)]

Thanks, I am considering and talking to oslo people.

[Duncan Thomas (duncan-thomas)]

After discussion, we're leaning towards brick rather than OSLO.

[Sean McGinnis (sean-mcginnis)]

Lisa, is this still an issue?

[Lisa Li (lisali)]

I think this is still a problem, but it doesn't have a high severity.

The problem is that:

1. Create an encryption type with invalid encryptor "nova.volume.encryptors.luks.TestEncryptor", and it succeeds.

cinder encryption-type-create --cipher aes-xts-plain64 --key_size 512 --control_location front-end test nova.volume.encryptors.luks.TestEncryptor

2. Create a volume with the type, which also succeeds.

3. When attaching the volume to an instance, it fails with the error:

2016-10-08 09:17:31.040 ERROR nova.volume.encryptors [req-cd9220df-5a71-4751-b06b-c1aefbd0d3ce admin admin] Error instantiating nova.volume.encryptors.luks.TestEncryptor: Class TestEncryptor cannot be found (['Traceback (most recent call last):\n', ' File "/usr/local/lib/python2.7/dist-packages/oslo_utils/importutils.py", line 32, in import_class\n return getattr(sys.modules[mod_str], class_str)\n', "AttributeError: 'module' object has no attribute 'TestEncryptor'\n"])

I think we can prohibit the case in step 1.

[Sean McGinnis (sean-mcginnis)]

Unassigning due to no activity for > 6 months.