calvix commented on code in PR #13556:
URL: https://github.com/apache/cloudstack/pull/13556#discussion_r3788635427
##########
plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/LibvirtStorageAdaptor.java:
##########
@@ -1493,9 +1518,126 @@ private KVMPhysicalDisk
createDiskFromTemplateOnRBD(KVMPhysicalDisk template,
disk = null;
}
}
+
+ // Encrypted volumes are handled by the early return above (create
empty -> luks2 format ->
+ // import template through encryption); the clone/convert path here is
for plaintext volumes.
+ return disk;
+ }
+
+ /**
+ * Option A (thin CoW encrypted root), used when the template already
lives on the same RBD cluster
+ * as the destination pool. Per the Ceph "Image Encryption" clone recipe:
grow the template base to
+ * reserve LUKS2-header space, snapshot+protect that grown state, clone
from it, apply a LUKS2 header,
+ * then resize the clone to the requested size. The inherited (plaintext)
template data stays readable
+ * through the clone's encryption, and the clone is a thin CoW image (only
the header is written).
+ *
+ * @return the encrypted CoW clone, or {@code null} if the Ceph operations
failed
+ */
+ private KVMPhysicalDisk createEncryptedRootCoWClone(KVMPhysicalDisk
template, KVMStoragePool destPool,
+ String newUuid, KVMPhysicalDisk disk, byte[] passphrase) {
+ String encSnap = rbdTemplateSnapName + "-luks";
+ Rados r = null;
+ IoCTX io = null;
+ Rbd rbd = null;
+ RbdImage base = null;
+ try {
+ r = new Rados(destPool.getAuthUserName());
+ r.confSet("mon_host", destPool.getSourceHost() + ":" +
destPool.getSourcePort());
+ r.confSet("key", destPool.getAuthSecret());
+ r.confSet("client_mount_timeout", "30");
+ r.connect();
+ io = r.ioCtxCreate(destPool.getSourceDir());
+ rbd = new Rbd(io);
+ base = rbd.open(template.getName());
+ boolean haveEncSnap = false;
+ for (RbdSnapInfo s : base.snapList()) {
Review Comment:
Same as above
https://github.com/apache/cloudstack/blob/main/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/KVMStorageProcessor.java#L3063
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
