Skip to content

StorPool: keep the LUKS header allowance when resizing encrypted volumes - #14698

Open
slavkap wants to merge 1 commit into
apache:4.22from
storpool:fix-resize-encrypted-volume
Open

slavkap wants to merge 1 commit into
apache:4.22from
storpool:fix-resize-encrypted-volume

Conversation

@slavkap

@slavkap slavkap commented Nov 13, 2026

Copy link
Copy Markdown
Contributor

Description

Fixes #14695.

When an encrypted volume is created on StorPool, its StorPool volume is 2 MiB
bigger than the requested size to hold the LUKS header. Resize (and the
rollback after a failed resize) set the StorPool volume to the bare CloudStack
size, so after a resize the guest saw 2 MiB less than requested.

Changes in the StorPool plug-in:

  • resize and rollback add the LUKS header allowance for encrypted volumes
  • the rollback runs for every failure of the agent command, including a failed
    send or a generic error answer
  • the pool capacity is updated only after a successful create/copy/resize, and
    resize uses the size before the change
  • a StorPool volume is deleted when its encryption fails
  • the KVM agent returns the encryption error instead of losing it, and always
    detaches the template snapshot and the resized volume; a failed detach no
    longer replaces the result of the resize

Types of changes

  • Breaking change (fix or feature that would cause existing functionality to change)
  • New feature (non-breaking change which adds functionality)
  • Bug fix (non-breaking change which fixes an issue)
  • Enhancement (improves an existing feature and functionality)
  • Cleanup (Code refactoring and cleanup, that may add test cases)
  • Build/CI
  • Test (unit or integration test code)

Bug Severity

  • BLOCKER
  • Critical
  • Major
  • Minor
  • Trivial

How Has This Been Tested?

  • Unit tests for the driver and the KVM wrappers (resize with/without
    encryption, rollback on all failure paths, failed encryption cleanup,
    failed detach)
  • test/integration/plugins/storpool/TestEncryptedVolumes.py: new tests for
    live, offline and ROOT volume resize of encrypted volumes, which check both
    the StorPool volume size and the size seen in the guest. The ROOT disk size
    now follows the template size, test_05 checks that the snapshot is backed up
    to secondary, and all created objects are cleaned up even when a test fails.

The StorPool volume of an encrypted volume is created 2 MiB bigger than
the requested size for the LUKS header, but resize and its rollback set
it to the bare CloudStack size, so the guest lost the header space.

- add the LUKS header allowance on resize and on rollback
- always roll back when the agent fails or can not be reached
- update the pool capacity only after a successful operation
- delete the StorPool volume when encryption fails and return the
  encryption error from the agent
- detach the template snapshot and the volume even on failures
- add unit tests and smoke tests for live, offline and ROOT resize,
  and clean up all objects created by the smoke tests

Fixes apache#14695
@codecov

codecov Bot commented Nov 13, 2026 •

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 68.85246% with 19 lines in your changes missing coverage. Please review.
✅ Project coverage is 18.36%. Comparing base (b56bbc2) to head (0148241).

Files with missing lines Patch % Lines
...tastore/driver/StorPoolPrimaryDataStoreDriver.java 75.55% 10 Missing and 1 partial ⚠️
...per/StorPoolSetVolumeEncryptionCommandWrapper.java 45.45% 6 Missing ⚠️
...ce/wrapper/StorPoolResizeVolumeCommandWrapper.java 60.00% 2 Missing ⚠️
Additional details and impacted files
@@             Coverage Diff              @@
##               4.22   #14698      +/-   ##
============================================
+ Coverage     18.32%   18.36%   +0.04%     
- Complexity    16644    16687      +43     
============================================
  Files          5939     5939              
  Lines        537787   537816      +29     
  Branches      65932    65933       +1     
============================================
+ Hits          98544    98773     +229     
+ Misses       428033   427812     -221     
- Partials      11210    11231      +21     
Flag Coverage Δ
uitests 4.08% <ø> (ø)
unittests 19.45% <68.85%> (+0.04%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant