Attaching read-only volumes fails

[Lucian Petrut]

The introduction of "new style volume attachments" seems to have caused a regression, breaking read-only volume attachments.

Trace: http://paste.openstack.org/raw/639120/

The reason seems to be the fact that Cinder expects the connector provided through the "attachment_update" call to include the requested attach mode [1], otherwise assuming it to be 'rw'. As Nova won't provide it, Cinder will then error because of an access mode mismatch.

[1] https://github.com/openstack/cinder/blob/d96b6dfba03424baf8b3ddc7539347554892e941/cinder/volume/manager.py#L4374-L4393

[Matt Riedemann (mriedem)]

Seems Cinder should just default the attach mode based on whether or not readonly is True if the connector doesn't have a specific mode set in it.

[Matt Riedemann (mriedem)]

(3:21:42 PM) jgriffith: I think I'll have Cinder check for the metadata setting and use it

Given ^ I'm going to confirm this for Cinder and mark it as invalid for Nova.

[Steve Noyes (steve-noyes)]

for those who may want to recreate this. To set a volume read-only from the cli:

$ cinder readonly-mode-update vol1 true

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/532645

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/532645
Committed: https://git.openstack.org/cgit/openstack/cinder/commit/?id=e69a6a5e0626177c70ed0eafa3be6a45fbfb3f05
Submitter: Zuul
Branch: master

commit e69a6a5e0626177c70ed0eafa3be6a45fbfb3f05
Author: John Griffith <email address hidden>
Date: Wed Jan 10 14:24:11 2018 -0700

    Fix readonly mode for new attachment API calls

    The introduction of the new attachment API's doesn't
    know how to deal with RO volumes that don't use the
    connector to set their values.

    One of the ways to do RO volumes in cinder is to set
    a parameter in the admin_metadata of the volume. If
    this is set, we expect the connector to have a matching
    mode setting in it's parameters. During finalizing of
    an attachment this values are compared and if they don't
    match the attach fails.

    The New attachment calls from the Nova side don't set
    this information; and honestly using the connector for
    this isn't such a great idea anyway. To address this
    change in behavior/bug however we'll default to the
    settings of the volume admin_metadata.

    When an attachment is created, we'll check the volumes
    admin_metadata and set the attach_mode of the attach
    object to ro if required. Additionally, when the
    attachment-completion is performed in the manager, we'll
    use the attach_mode setting of the attachment object to
    override and force any settings in the connector.

    This seems like a better option than forcing Nova to check
    and set based on the metadata, and there's no real value
    in having an extra lever or requirement during attach that
    can go wrong. There's no case where seting the admin_metadata
    to Read Only on a volume and attaching it any other way than
    'ro' is valid, so just use the metdata directly.

    Going forward we deprecate the use of admin_metadata for
    Read Only settings and replace it with an attachment-create
    option.

    Closes-Bug: # 1741476

    Change-Id: Id0aea58f7091c78fcd38a47e475384807f1c04c7

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/cinder 12.0.0.0b3 development milestone.

[Matt Riedemann (mriedem)]

Created related blueprint: https://blueprints.launchpad.net/nova/+spec/volume-multiattach-enhancements