Copilot commented on code in PR #12898:
URL: https://github.com/apache/cloudstack/pull/12898#discussion_r3663607499
##########
plugins/backup/nas/src/main/java/org/apache/cloudstack/backup/NASBackupProvider.java:
##########
@@ -254,6 +297,32 @@ public Pair<Boolean, Backup> takeBackup(final
VirtualMachine vm, Boolean quiesce
}
}
+ /**
+ * Translates the zone-scoped backup-enhancement settings (compression,
encryption,
+ * bandwidth limit, integrity check) into details on the {@link
TakeBackupCommand}.
+ * Fails fast if encryption is enabled without a configured passphrase.
+ */
+ protected void applyBackupEnhancementDetails(TakeBackupCommand command,
Long zoneId) {
+ if (Boolean.TRUE.equals(NASBackupCompressionEnabled.valueIn(zoneId))) {
+ command.addDetail(TakeBackupCommand.DETAIL_COMPRESSION, "true");
+ }
+ if (Boolean.TRUE.equals(NASBackupEncryptionEnabled.valueIn(zoneId))) {
+ String passphrase = NASBackupEncryptionPassphrase.valueIn(zoneId);
+ if (passphrase == null || passphrase.isEmpty()) {
+ throw new CloudRuntimeException("NAS backup encryption is
enabled but no passphrase is configured (nas.backup.encryption.passphrase)");
+ }
Review Comment:
Encryption is now enabled by sending a passphrase to the KVM host and
producing LUKS-encrypted qcow2 backups. However, the restore path still
verifies backups via plain `qemu-img check <path>` and converts qcow2 to RAW
without providing a LUKS secret (see
LibvirtRestoreBackupCommandWrapper.checkBackupFileImage() and
replaceBlockDeviceWithBackup()). As a result, restores (and even restore-time
verification) will fail for encrypted backups, which conflicts with the PR note
that restore should still work. The restore command/wrapper needs a way to pass
the secret (or key file) so qemu-img can open encrypted images.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
