Uploading an encrypted LVM volume to Glance as qcow2 fails

[Eric Harney]

Uploading as a raw image works, but uploading as qcow2 fails because qemu-img convert does not have a passphrase passed in to read the source volume and convert it to encrypted qcow2.

Not sure if we should do this conversion, or reject this scenario.

$ cinder upload-to-image --container-format bare --disk-format raw 23236a93-96d9-440c-b440-a26c550bf9d0 myimage

Sep 19 14:44:37 centos7vm1.localdomain cinder-volume[3921568]: ERROR oslo_messaging.rpc.server Command: sudo cinder-rootwrap /etc/cinder/rootwrap.conf qemu-img convert -O qcow2 -c /dev/mapper/stack--volumes--lvmdriver--1-volume--23236a93--96d9--440c--b440--a26c550bf9d0 /opt/stack/data/cinder/conversion/tmpNDx8fF
Sep 19 14:44:37 centos7vm1.localdomain cinder-volume[3921568]: ERROR oslo_messaging.rpc.server Exit code: 1
Sep 19 14:44:37 centos7vm1.localdomain cinder-volume[3921568]: ERROR oslo_messaging.rpc.server Stdout: u''
Sep 19 14:44:37 centos7vm1.localdomain cinder-volume[3921568]: ERROR oslo_messaging.rpc.server Stderr: u"qemu-img: Could not open '/dev/mapper/stack--volumes--lvmdriver--1-volume--23236a93--96d9--440c--b440--a26c550bf9d0': Parameter 'key-secret' is required for cipher\n"

[Brian Rosmaita (brian-rosmaita)]

> Not sure if we should do this conversion, or reject this scenario.

My thought is that short-term, reject the conversion. I can see people wanting this ability (to save storage space/cost), but that puts pressure on the c-vol nodes do to the conversion for upload and download (and I don't know whether for most images, the extra time in conversion would be greater or less than the transfer time difference between raw and qcow2). There's also the issue of whether nova can handle an encrypted qcow2. So I'm thinking we can improve the user experience now but wait for clear demand before implementing the conversion. Unless it's super simple to implement. But then I'm still worried about the extra CPU time--I don't think we want to add a config option to allow/disallow this, like we did with the hardware compression accelerator spec. So I'm no help at all here.

[Brian Rosmaita (brian-rosmaita)]

Marking as "Confirmed" instead of "Triaged" because we still need to figure out what direction this will take.