gian/cloudstack-mirror
1
0
Fork 0
mirror of https://github.com/apache/cloudstack synced 2026-08-02 05:26:35 +00:00
Code Issues Actions 8 Packages Projects Releases Wiki Activity
57671274d8
cloudstack-mirror/plugins/storage/volume/linstor/CHANGELOG.md
Rene Peinthor 57671274d8
linstor: fix encrypted volume snapshot backup and restore (#13486) 
Encrypted Linstor volumes use a LUKS layer inside the DRBD stack, so
the storage-layer snapshot device holds ciphertext while the DRBD
device CloudStack restores to is the decrypted view. Backing up the
raw snapshot and writing it back to the decrypted device corrupted the
volume (different data, unbootable root).

Back up encrypted snapshots from the decrypted DRBD device (forcing
the temporary-resource path) and store them as a LUKS-encrypted qcow2
using the volume passphrase, so snapshots are not kept in clear text
on secondary storage. On revert, decrypt the qcow2 and write plaintext
to the DRBD device; the LUKS layer re-encrypts it. The qemu-img shrink
is skipped for encrypted volumes (the DRBD device is already
net-sized).

Add an integration test (test_linstor_encrypted_snapshots.py): the
encrypted-root snapshot revert round-trip, that
create-volume-from-encrypted-snapshot is rejected by CloudStack core,
and a best-effort check that the backed-up qcow2 is LUKS-encrypted at
rest.
2026-07-10 12:50:33 +02:00

3.0 KiB
Raw Blame History

Changelog

All notable changes to Linstor CloudStack plugin will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[2026-06-24]

Fixed

  • Restore of encrypted volume snapshots: snapshots of encrypted volumes are now stored as LUKS-encrypted qcow2 files and decrypted on revert (previously the restored data was corrupted and the root device unbootable).

[2026-06-03]

Added

  • Support Linstor bearer token authentication (Linstor 1.34.0) and HTTPS controller connections

[2026-01-17]

Added

  • Support live migrate from other primary storage

[2025-12-18]

Changed

  • Provide /dev/drbd/by-res/ resource paths to CloudStack for usage.

[2025-10-03]

Changed

  • Revert qcow2 snapshot now use sparse/discard options to convert on thin devices.

[2025-08-05]

Fixed

  • getVolumeStats wasn't correctly working if multiple Linstor clusters/primary storages are used.

[2025-07-01]

Fixed

  • Regression in 4.19.3 and 4.21.0 with templates from snapshots

[2025-05-07]

Added

  • Implemented storage/volume stats

[2025-03-13]

Fixed

  • Implemented missing delete datastore, to correctly cleanup on datastore removal

[2025-02-21]

Fixed

  • Always try to delete cs-...-rst resource before doing a snapshot backup

[2025-01-27]

Fixed

  • Use of multiple primary storages on the same linstor controller

[2025-01-20]

Fixed

  • Volume snapshots on zfs used the wrong dataset path to hide/unhide snapdev

[2024-12-19]

Added

  • Native CloudStack encryption support

[2024-12-13]

Fixed

  • Linstor heartbeat check now also ask linstor-controller if there is no connection between nodes

[2024-12-11]

Fixed

  • Only set allow-two-primaries if a live migration is performed

[2024-10-28]

Fixed

[2024-10-14]

Added

  • Support for ISO direct download to primary storage

[2024-10-04]

Added

  • Enable qemu discard="unmap" for Linstor block disks

[2024-08-27]

Changed

  • Allow two primaries(+protocol c) is now set on resource-connection level instead of rd