mirror of
https://github.com/apache/cloudstack
synced 2026-08-02 05:26:35 +00:00
57671274d8
Encrypted Linstor volumes use a LUKS layer inside the DRBD stack, so the storage-layer snapshot device holds ciphertext while the DRBD device CloudStack restores to is the decrypted view. Backing up the raw snapshot and writing it back to the decrypted device corrupted the volume (different data, unbootable root). Back up encrypted snapshots from the decrypted DRBD device (forcing the temporary-resource path) and store them as a LUKS-encrypted qcow2 using the volume passphrase, so snapshots are not kept in clear text on secondary storage. On revert, decrypt the qcow2 and write plaintext to the DRBD device; the LUKS layer re-encrypts it. The qemu-img shrink is skipped for encrypted volumes (the DRBD device is already net-sized). Add an integration test (test_linstor_encrypted_snapshots.py): the encrypted-root snapshot revert round-trip, that create-volume-from-encrypted-snapshot is rejected by CloudStack core, and a best-effort check that the backed-up qcow2 is LUKS-encrypted at rest.
69 lines
2.8 KiB
Markdown
69 lines
2.8 KiB
Markdown
<!--
|
|
Licensed to the Apache Software Foundation (ASF) under one
|
|
or more contributor license agreements. See the NOTICE file
|
|
distributed with this work for additional information
|
|
regarding copyright ownership. The ASF licenses this file
|
|
to you under the Apache License, Version 2.0 (the
|
|
"License"); you may not use this file except in compliance
|
|
with the License. You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing,
|
|
software distributed under the License is distributed on an
|
|
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
|
KIND, either express or implied. See the License for the
|
|
specific language governing permissions and limitations
|
|
under the License.
|
|
-->
|
|
|
|
# Linstor storage plugin
|
|
|
|
This directory contains the basic VM, Volume life cycle tests for Linstor storage pool (in KVM hypervisor).
|
|
|
|
## Running tests
|
|
|
|
To run the basic volume tests, first update the below test data of the CloudStack environment
|
|
|
|
```
|
|
TestData.zoneId: <id of zone>
|
|
TestData.clusterId: <id of cluster>
|
|
TestData.domainId: <id of domain>
|
|
TestData.url: <management server IP>
|
|
TestData.primaryStorage "url": <Linstor storage pool url (see the format below) to use as primary storage>
|
|
```
|
|
|
|
and to enable and run volume migration tests, update the below test data
|
|
|
|
```
|
|
TestData.migrationTests: True
|
|
TestData.primaryStorageSameInstance "url": <Linstor url (see the format below) of the pool on same storage cluster as TestData.primaryStorage>
|
|
TestData.primaryStorageDistinctInstance "url": <Linstor url (see the format below) of the pool not on the same storage cluster as TestData.primaryStorage>
|
|
```
|
|
|
|
Then run the tests using python unittest runner: nosetests
|
|
|
|
```
|
|
nosetests --with-marvin --marvin-config=<marvin-cfg-file> <cloudstack-dir>/test/integration/plugins/linstor/test_linstor_volumes.py --zone=<zone> --hypervisor=kvm
|
|
```
|
|
|
|
You can also run these tests out of the box with PyDev or PyCharm or whatever.
|
|
|
|
## Encrypted snapshot tests
|
|
|
|
`test_linstor_encrypted_snapshots.py` covers the encrypted-volume snapshot round trip
|
|
(create encrypted root disk -> snapshot -> revert / create-volume-from-snapshot) and that the
|
|
backed-up qcow2 on secondary storage is itself LUKS encrypted.
|
|
|
|
Extra prerequisites:
|
|
|
|
* At least one KVM host with volume-encryption support (`host.encryptionsupported == true`, i.e.
|
|
cryptsetup/qemu LUKS available). Tests self-skip if none is found.
|
|
* The Linstor resource group used (`acs-basic`) must be able to add a LUKS layer to its volumes.
|
|
* `lin.backup.snapshots` must be enabled (default) so snapshots are backed up to secondary storage;
|
|
the test sets it. With it disabled the qcow2 path is not exercised.
|
|
|
|
```
|
|
nosetests --with-marvin --marvin-config=<marvin-cfg-file> <cloudstack-dir>/test/integration/plugins/linstor/test_linstor_encrypted_snapshots.py --zone=<zone> --hypervisor=kvm
|
|
```
|
