Ambigous error when trying to boot SEV based instances from volume

[Alexey Stupnikov]

More image_meta.name use in hardware.py causing failures when presented with an empty ImageMeta object:

$ openstack flavor show m1.sev_med
+----------------------------+--------------------------------------+
| Field | Value |
+----------------------------+--------------------------------------+
| OS-FLV-DISABLED:disabled | False |
| OS-FLV-EXT-DATA:ephemeral | 0 |
| access_project_ids | None |
| description | None |
| disk | 2 |
| extra_specs | {'hw:mem_encryption': 'True'} |
| id | 3952db4d-e71a-4669-9bb7-666adaef6c36 |
| name | m1.sev_med |
| os-flavor-access:is_public | True |
| properties | hw:mem_encryption='True' |
| ram | 2048 |
| rxtx_factor | 1.0 |
| swap | 0 |
| vcpus | 4 |
+----------------------------+--------------------------------------+
$ openstack volume create --bootable --size 1 blank
$ openstack server create --volume blank --flavor m1.sev_med --network private test
Unexpected API Error. Please report this at http://bugs.launchpad.net/nova/ and attach the Nova API log if possible.
<class 'NotImplementedError'> (HTTP 500) (Request-ID: req-c6d1a319-b4b0-4d1f-869c-dcbec2fd2554)

2021-06-03 12:29:28.207 12 ERROR nova.api.openstack.wsgi [req-c6d1a319-b4b0-4d1f-869c-dcbec2fd2554 cd40fe796ff84e3a8ba5e473a6d61f05 025f8a0d412642f693782ae20ba415ec - default default] Unexpected exception in API method: NotImplementedError: Cannot load 'name' in the base class
2021-06-03 12:29:28.207 12 ERROR nova.api.openstack.wsgi Traceback (most recent call last):
2021-06-03 12:29:28.207 12 ERROR nova.api.openstack.wsgi File "/usr/lib/python3.6/site-packages/nova/api/openstack/wsgi.py", line 671, in wrapped
2021-06-03 12:29:28.207 12 ERROR nova.api.openstack.wsgi return f(*args, **kwargs)
2021-06-03 12:29:28.207 12 ERROR nova.api.openstack.wsgi File "/usr/lib/python3.6/site-packages/nova/api/validation/__init__.py", line 110, in wrapper
2021-06-03 12:29:28.207 12 ERROR nova.api.openstack.wsgi return func(*args, **kwargs)
2021-06-03 12:29:28.207 12 ERROR nova.api.openstack.wsgi File "/usr/lib/python3.6/site-packages/nova/api/validation/__init__.py", line 110, in wrapper
2021-06-03 12:29:28.207 12 ERROR nova.api.openstack.wsgi return func(*args, **kwargs)
2021-06-03 12:29:28.207 12 ERROR nova.api.openstack.wsgi File "/usr/lib/python3.6/site-packages/nova/api/validation/__init__.py", line 110, in wrapper
2021-06-03 12:29:28.207 12 ERROR nova.api.openstack.wsgi return func(*args, **kwargs)
2021-06-03 12:29:28.207 12 ERROR nova.api.openstack.wsgi [Previous line repeated 9 more times]
2021-06-03 12:29:28.207 12 ERROR nova.api.openstack.wsgi File "/usr/lib/python3.6/site-packages/nova/api/openstack/compute/servers.py", line 712, in create
2021-06-03 12:29:28.207 12 ERROR nova.api.openstack.wsgi **create_kwargs)
2021-06-03 12:29:28.207 12 ERROR nova.api.openstack.wsgi File "/usr/lib/python3.6/site-packages/nova/hooks.py", line 154, in inner
2021-06-03 12:29:28.207 12 ERROR nova.api.openstack.wsgi rv = f(*args, **kwargs)
2021-06-03 12:29:28.207 12 ERROR nova.api.openstack.wsgi File "/usr/lib/python3.6/site-packages/nova/compute/api.py", line 1932, in create
2021-06-03 12:29:28.207 12 ERROR nova.api.openstack.wsgi requested_hypervisor_hostname=requested_hypervisor_hostname)
2021-06-03 12:29:28.207 12 ERROR nova.api.openstack.wsgi File "/usr/lib/python3.6/site-packages/nova/compute/api.py", line 1411, in _create_instance
2021-06-03 12:29:28.207 12 ERROR nova.api.openstack.wsgi block_device_mapping.root_bdm(), validate_numa=False)
2021-06-03 12:29:28.207 12 ERROR nova.api.openstack.wsgi File "/usr/lib/python3.6/site-packages/nova/compute/api.py", line 912, in _checks_for_create_and_rebuild
2021-06-03 12:29:28.207 12 ERROR nova.api.openstack.wsgi validate_numa=validate_numa)
2021-06-03 12:29:28.207 12 ERROR nova.api.openstack.wsgi File "/usr/lib/python3.6/site-packages/nova/compute/api.py", line 577, in _validate_flavor_image
2021-06-03 12:29:28.207 12 ERROR nova.api.openstack.wsgi root_bdm, validate_numa)
2021-06-03 12:29:28.207 12 ERROR nova.api.openstack.wsgi File "/usr/lib/python3.6/site-packages/nova/compute/api.py", line 723, in _validate_flavor_image_nostatus
2021-06-03 12:29:28.207 12 ERROR nova.api.openstack.wsgi validate_pci=validate_pci)
2021-06-03 12:29:28.207 12 ERROR nova.api.openstack.wsgi File "/usr/lib/python3.6/site-packages/nova/compute/api.py", line 747, in _validate_flavor_image_numa_pci
2021-06-03 12:29:28.207 12 ERROR nova.api.openstack.wsgi API._validate_flavor_image_mem_encryption(instance_type, image_meta)
2021-06-03 12:29:28.207 12 ERROR nova.api.openstack.wsgi File "/usr/lib/python3.6/site-packages/nova/compute/api.py", line 778, in _validate_flavor_image_mem_encryption
2021-06-03 12:29:28.207 12 ERROR nova.api.openstack.wsgi hardware.get_mem_encryption_constraint(instance_type, image)
2021-06-03 12:29:28.207 12 ERROR nova.api.openstack.wsgi File "/usr/lib/python3.6/site-packages/nova/virt/hardware.py", line 1273, in get_mem_encryption_constraint
2021-06-03 12:29:28.207 12 ERROR nova.api.openstack.wsgi _check_mem_encryption_uses_uefi_image(requesters, image_meta)
2021-06-03 12:29:28.207 12 ERROR nova.api.openstack.wsgi File "/usr/lib/python3.6/site-packages/nova/virt/hardware.py", line 1310, in _check_mem_encryption_uses_uefi_image
2021-06-03 12:29:28.207 12 ERROR nova.api.openstack.wsgi 'image_name': image_meta.name}
2021-06-03 12:29:28.207 12 ERROR nova.api.openstack.wsgi File "/usr/lib/python3.6/site-packages/oslo_versionedobjects/base.py", line 67, in getter
2021-06-03 12:29:28.207 12 ERROR nova.api.openstack.wsgi self.obj_load_attr(name)
2021-06-03 12:29:28.207 12 ERROR nova.api.openstack.wsgi File "/usr/lib/python3.6/site-packages/oslo_versionedobjects/base.py", line 603, in obj_load_attr
2021-06-03 12:29:28.207 12 ERROR nova.api.openstack.wsgi _("Cannot load '%s' in the base class") % attrname)
2021-06-03 12:29:28.207 12 ERROR nova.api.openstack.wsgi NotImplementedError: Cannot load 'name' in the base class
2021-06-03 12:29:28.207 12 ERROR nova.api.openstack.wsgi

RH BZ: https://bugzilla.redhat.com/show_bug.cgi?id=1967606

[Alexey Stupnikov (astupnikov)]

This problem is rather cosmetic: memory encryption is only supported for instances with ephemeral root disks created from images:

Documentation: https://docs.openstack.org/nova/latest/admin/sev.html

Quote:

In all cases, SEV instances can only be booted from images which have the hw_firmware_type property set to uefi, and only when the machine type is set to q35. This can be set per image by setting the image property hw_machine_type=q35, or per compute node by the operator via libvirt.hw_machine_type as explained above.

As a result, we are talking about flavor/image check not being able to handle cinder volume-based image objects.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/nova/+/873388

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/nova/+/873388
Committed: https://opendev.org/openstack/nova/commit/54faea0196c96ae55a58cab4326277d48a59afb0
Submitter: "Zuul (22348)"
Branch: master

commit 54faea0196c96ae55a58cab4326277d48a59afb0
Author: Alexey Stupnikov <email address hidden>
Date: Fri Feb 10 17:14:17 2023 +0100

    Fix logging in MemEncryption-related checks

    Currently Nova produces ambigous error when volume-backed instance
    is started using flavor with hw:mem_encryption extra_specs flag:
    ImageMeta doesn't contain name if it represents Cinder volume.

    This fix sligtly changes steps to get image_meta.name for
    some MemEncryption-related checks where it could make any
    difference.

    Closes-bug: #2006952
    Change-Id: Ia69e7cb18cd862f01ecfdbdc358c87af1ab8fbf6

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/nova 27.0.0.0rc1 release candidate.