Attaching read-only volumes fails

Bug #1741476 reported by Lucian Petrut
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Fix Released
John Griffith
OpenStack Compute (nova)

Bug Description

The introduction of "new style volume attachments" seems to have caused a regression, breaking read-only volume attachments.


The reason seems to be the fact that Cinder expects the connector provided through the "attachment_update" call to include the requested attach mode [1], otherwise assuming it to be 'rw'. As Nova won't provide it, Cinder will then error because of an access mode mismatch.


Tags: volumes
description: updated
Revision history for this message
Matt Riedemann (mriedem) wrote :

Seems Cinder should just default the attach mode based on whether or not readonly is True if the connector doesn't have a specific mode set in it.

tags: added: volumes
Revision history for this message
Matt Riedemann (mriedem) wrote :

(3:21:42 PM) jgriffith: I think I'll have Cinder check for the metadata setting and use it

Given ^ I'm going to confirm this for Cinder and mark it as invalid for Nova.

Changed in nova:
status: New → Invalid
Changed in cinder:
status: New → Confirmed
importance: Undecided → High
Revision history for this message
Steve Noyes (steve-noyes) wrote :

for those who may want to recreate this. To set a volume read-only from the cli:

$ cinder readonly-mode-update vol1 true

Changed in cinder:
assignee: nobody → John Griffith (john-griffith)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to cinder (master)

Fix proposed to branch: master

Changed in cinder:
status: Confirmed → In Progress
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to cinder (master)

Submitter: Zuul
Branch: master

commit e69a6a5e0626177c70ed0eafa3be6a45fbfb3f05
Author: John Griffith <email address hidden>
Date: Wed Jan 10 14:24:11 2018 -0700

    Fix readonly mode for new attachment API calls

    The introduction of the new attachment API's doesn't
    know how to deal with RO volumes that don't use the
    connector to set their values.

    One of the ways to do RO volumes in cinder is to set
    a parameter in the admin_metadata of the volume. If
    this is set, we expect the connector to have a matching
    mode setting in it's parameters. During finalizing of
    an attachment this values are compared and if they don't
    match the attach fails.

    The New attachment calls from the Nova side don't set
    this information; and honestly using the connector for
    this isn't such a great idea anyway. To address this
    change in behavior/bug however we'll default to the
    settings of the volume admin_metadata.

    When an attachment is created, we'll check the volumes
    admin_metadata and set the attach_mode of the attach
    object to ro if required. Additionally, when the
    attachment-completion is performed in the manager, we'll
    use the attach_mode setting of the attachment object to
    override and force any settings in the connector.

    This seems like a better option than forcing Nova to check
    and set based on the metadata, and there's no real value
    in having an extra lever or requirement during attach that
    can go wrong. There's no case where seting the admin_metadata
    to Read Only on a volume and attaching it any other way than
    'ro' is valid, so just use the metdata directly.

    Going forward we deprecate the use of admin_metadata for
    Read Only settings and replace it with an attachment-create

    Closes-Bug: # 1741476

    Change-Id: Id0aea58f7091c78fcd38a47e475384807f1c04c7

Changed in cinder:
status: In Progress → Fix Released
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix included in openstack/cinder

This issue was fixed in the openstack/cinder development milestone.

Revision history for this message
Matt Riedemann (mriedem) wrote :
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Related blueprints

Remote bug watches

Bug watches keep track of this bug in other bug trackers.