gian/cloudstack-mirror
1
0
Fork 0
mirror of https://github.com/apache/cloudstack synced 2026-08-02 05:26:35 +00:00
Code Issues Actions 8 Packages Projects Releases Wiki Activity
57671274d8
cloudstack-mirror/test/integration/plugins/linstor/README.md
Rene Peinthor 57671274d8
linstor: fix encrypted volume snapshot backup and restore (#13486) 
Encrypted Linstor volumes use a LUKS layer inside the DRBD stack, so
the storage-layer snapshot device holds ciphertext while the DRBD
device CloudStack restores to is the decrypted view. Backing up the
raw snapshot and writing it back to the decrypted device corrupted the
volume (different data, unbootable root).

Back up encrypted snapshots from the decrypted DRBD device (forcing
the temporary-resource path) and store them as a LUKS-encrypted qcow2
using the volume passphrase, so snapshots are not kept in clear text
on secondary storage. On revert, decrypt the qcow2 and write plaintext
to the DRBD device; the LUKS layer re-encrypts it. The qemu-img shrink
is skipped for encrypted volumes (the DRBD device is already
net-sized).

Add an integration test (test_linstor_encrypted_snapshots.py): the
encrypted-root snapshot revert round-trip, that
create-volume-from-encrypted-snapshot is rejected by CloudStack core,
and a best-effort check that the backed-up qcow2 is LUKS-encrypted at
rest.
2026-07-10 12:50:33 +02:00

2.8 KiB
Raw Blame History

Linstor storage plugin

This directory contains the basic VM, Volume life cycle tests for Linstor storage pool (in KVM hypervisor).

Running tests

To run the basic volume tests, first update the below test data of the CloudStack environment

TestData.zoneId: <id of zone>
TestData.clusterId: <id of cluster>
TestData.domainId: <id of domain>
TestData.url: <management server IP>
TestData.primaryStorage "url": <Linstor storage pool url (see the format below) to use as primary storage>

and to enable and run volume migration tests, update the below test data

TestData.migrationTests: True
TestData.primaryStorageSameInstance "url": <Linstor url (see the format below) of the pool on same storage cluster as TestData.primaryStorage>
TestData.primaryStorageDistinctInstance "url": <Linstor url (see the format below) of the pool not on the same storage cluster as TestData.primaryStorage>

Then run the tests using python unittest runner: nosetests

nosetests --with-marvin --marvin-config=<marvin-cfg-file> <cloudstack-dir>/test/integration/plugins/linstor/test_linstor_volumes.py --zone=<zone> --hypervisor=kvm

You can also run these tests out of the box with PyDev or PyCharm or whatever.

Encrypted snapshot tests

test_linstor_encrypted_snapshots.py covers the encrypted-volume snapshot round trip (create encrypted root disk -> snapshot -> revert / create-volume-from-snapshot) and that the backed-up qcow2 on secondary storage is itself LUKS encrypted.

Extra prerequisites:

  • At least one KVM host with volume-encryption support (host.encryptionsupported == true, i.e. cryptsetup/qemu LUKS available). Tests self-skip if none is found.
  • The Linstor resource group used (acs-basic) must be able to add a LUKS layer to its volumes.
  • lin.backup.snapshots must be enabled (default) so snapshots are backed up to secondary storage; the test sets it. With it disabled the qcow2 path is not exercised.
nosetests --with-marvin --marvin-config=<marvin-cfg-file> <cloudstack-dir>/test/integration/plugins/linstor/test_linstor_encrypted_snapshots.py --zone=<zone> --hypervisor=kvm