calvix commented on code in PR #13556:
URL: https://github.com/apache/cloudstack/pull/13556#discussion_r3794740412
##########
plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java:
##########
@@ -6164,10 +6167,28 @@ public boolean isHostSecured() {
}
/**
- * Test host for volume encryption support
+ * Test host for volume encryption support. A host is considered
encryption-capable if it
+ * supports EITHER mechanism CloudStack can use:
+ * - qemu-native LUKS (qemu-img LUKS + cryptsetup) for file/block backed
pools, or
+ * - librbd native encryption (rbd encryption format) for RBD/Ceph pools.
+ * NOTE: HOST_VOLUME_ENCRYPTION is a single host-wide flag and is not
per-pool, so a host that
+ * advertises encryption via only one mechanism could still be selected
for a volume that needs
+ * the other. In practice hosts that do encryption have the qemu-native
stack; the librbd branch
+ * additionally covers Ceph-only hosts.
* @return boolean
*/
public boolean hostSupportsVolumeEncryption() {
+ boolean supported = hostSupportsQemuNativeVolumeEncryption() ||
hostSupportsRbdVolumeEncryption();
+ if (!supported) {
+ LOGGER.info("Host does not support volume encryption (no
qemu-native LUKS + cryptsetup, and no librbd rbd encryption)");
+ }
+ return supported;
+ }
Review Comment:
Yeah, that's a good idea actually. WDYT about this:
`host.volume.encryption` - same as before, qemu-native LUKS only volumes
`host.volume.encryption.rbd` - new flag, reports whether the host's rbd CLI
supports rbd encryption format
in `DeploymentPlanningManagerImpl.java` - checks the flag that matches
the volume's pool type - an encrypted volume on RBD pool requires the rbd flag,
any other pool type requires the qemu one
Or did you have anything else in mind?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
