github-actions[bot] commented on issue #14662: URL: https://github.com/apache/cloudstack/issues/14662#issuecomment-6802609369
> [!WARNING] > threat detection engine error > The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding. > > <!-- gh-aw-threat-engine-error --> > > <details> > <summary>What happened</summary> > > The threat detection engine failed to produce results. > > Review the [workflow run logs](https://github.com/apache/cloudstack/actions/runs/43029422543) for details. > > </details> ## 🎯 Triage report When an encrypted disk offering is used with an explicit `storageid`, the volume is created as plain qcow2 with no LUKS header and `passphrase_id` NULL, and no error is returned. Allocation by storage tag produces a LUKS volume. The reporter ran the manual-selection test 11 times across NFS and SharedMountPoint pools with the same result. The request is that the encryption decision not depend on how the pool was chosen: either apply LUKS on this path, or fail the request. ### 📊 Assessment | Dimension | Value | Reasoning | | --- | --- | --- | | **Type** | type:bug | Silent loss of the requested encryption | | **Component** | component:kvm, component:primary-storage | Pool selection in the management server; disk creation on KVM | | **Severity** | Severity:Major | Users believe data is encrypted when it is not; no error | | **Labels** | type:bug, component:kvm, component:primary-storage, Severity:Major | | | **Coding agent** | Needs more info | The fix point is on the management server; a maintainer should confirm whether #14667 covers this path | ### 🔗 Similar issues - #14663 (related) — same encrypted offering on SharedMountPoint; fails at attach rather than silently - #14313 (related, closed) — volume creation on an explicitly selected pool does not validate capacity; same manual-pool path <details> <summary>💡 Notes and suggestions</summary> - A maintainer comment on #14663 points to PR #14667 for this path; check that it covers manual pool selection. - Reproduction: encrypted offering, `createVolume storageid=<pool>`, attach, then check `volumes.passphrase_id` and the agent's disk XML. - Consider a regression test that compares allocation by tag with allocation by pool. </details> > Generated by [Daily Issue Triage](https://github.com/apache/cloudstack/actions/runs/43029422543) · copilot · haiku55 · \~6 AIC · ⊞ 3.8K · [◷](https://github.com/search?q=repo%3Aapache%2Fcloudstack+%22gh-aw-workflow-call-id%3A+apache%2Fcloudstack%2Fdaily-issue-triage%22&type=issues) <details> <summary><sub>Add this agentic workflow to your repo</sub></summary> To install this agentic workflow, run ``` gh aw add githubnext/agentics/workflows/daily-issue-triage.md@139fa09ef17cde4135e696ff8e7af09bc5ddfa6e ``` </details> <!-- gh-aw-workflow-call-id: apache/cloudstack/daily-issue-triage --> <!-- gh-aw-agentic-workflow: Daily Issue Triage, engine: copilot, model: claude-haiku-5.5, id: 43029422543, workflow_id: daily-issue-triage, run: https://github.com/apache/cloudstack/actions/runs/43029422543 --> <!-- gh-aw-execution: {"version":1,"repo_id":"9759448","repository":"apache/cloudstack","aw_workflow_id":"daily-issue-triage","run_id":"43029422543","run_attempt":"1","run_url":"https://github.com/apache/cloudstack/actions/runs/43029422543","publishing_job":{"key":"safe_outputs","check_run_id":"130687254582"}} --> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
