93c0f9bc74
This change tightens the validation around the attachment update API to ensure that it can only be called if the source volume has a non empty migration status. That means it will only accept a request to swap the volume if it is the result of a cinder volume migration. This change is being made to prevent the instance domain XML from getting out of sync with the nova BDM records and cinder connection info. In the future support for direct swap volume actions can be re-added if and only if the nova libvirt driver is updated to correctly modify the domain. The libvirt driver is the only driver that supported this API outside of a cinder orchestrated swap volume. By allowing the domain XML and BDMs to get out of sync if an admin later live-migrates the VM the host path will not be modified for the destination host. Normally this results in a live migration failure which often prompts the admin to cold migrate instead. however if the source device path exists on the destination the migration will proceed. This can lead to 2 VMs using the same host block device. At best this will cause a crash or data corruption. At worst it will allow one guest to access the data of another. Prior to this change there was an explicit warning in nova API ref stating that humans should never call this API because it can lead to this situation. Now it considered a hard error due to the security implications. Closes-Bug: #2112187 Depends-on: https://review.opendev.org/c/openstack/tempest/+/957753 Change-Id: I439338bd2f27ccd65a436d18c8cbc9c3127ee612 Signed-off-by: Sean Mooney <work@seanmooney.info>
121 lines
4.7 KiB
Python
121 lines
4.7 KiB
Python
# Copyright 2021, Red Hat, Inc. All Rights Reserved.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
# not use this file except in compliance with the License. You may obtain
|
|
# a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
# License for the specific language governing permissions and limitations
|
|
# under the License.
|
|
|
|
from oslo_serialization import jsonutils
|
|
|
|
from nova import context
|
|
from nova import objects
|
|
from nova.tests.functional.api import client
|
|
from nova.tests.functional import integrated_helpers
|
|
from nova.tests.functional.libvirt import base
|
|
from nova.virt import block_device as driver_block_device
|
|
|
|
|
|
class TestLibvirtROMultiattachMigrate(
|
|
base.ServersTestBase,
|
|
integrated_helpers.InstanceHelperMixin
|
|
):
|
|
"""Regression test for bug 1939545
|
|
|
|
This regression test asserts the now fixed behaviour of Nova during
|
|
a Cinder orchestrated volume migration that leaves the stashed
|
|
connection_info of the attachment pointing at the original
|
|
volume UUID used during the migration.
|
|
|
|
This is slightly different to the Nova orchestrated pure swap_volume
|
|
flow so an additional test is included to assert the current correct
|
|
behaviour there and to hopefully illustrate the differences better to
|
|
reviewers.
|
|
"""
|
|
|
|
microversion = 'latest'
|
|
ADMIN_API = True
|
|
|
|
def setUp(self):
|
|
super().setUp()
|
|
self.start_compute()
|
|
|
|
def test_ro_multiattach_swap_volume(self):
|
|
# NOTE(sean-k-mooney): This test is emulating calling swap volume
|
|
# directly instead of using cinder volume migrate or retype.
|
|
server_id = self._create_server(networks='none')['id']
|
|
self.api.post_server_volume(
|
|
server_id,
|
|
{
|
|
'volumeAttachment': {
|
|
'volumeId': self.cinder.MULTIATTACH_RO_SWAP_OLD_VOL
|
|
}
|
|
}
|
|
)
|
|
self._wait_for_volume_attach(
|
|
server_id, self.cinder.MULTIATTACH_RO_SWAP_OLD_VOL)
|
|
|
|
# NOTE(sean-k-mooney): because of bug 212187 directly using
|
|
# swap volume is not supported and should fail.
|
|
ex = self.assertRaises(
|
|
client.OpenStackApiException, self.api.put_server_volume,
|
|
server_id, self.cinder.MULTIATTACH_RO_SWAP_OLD_VOL,
|
|
self.cinder.MULTIATTACH_RO_SWAP_NEW_VOL)
|
|
self.assertIn("this api should only be called by Cinder", str(ex))
|
|
|
|
def test_ro_multiattach_migrate_volume(self):
|
|
server_id = self._create_server(networks='none')['id']
|
|
self.api.post_server_volume(
|
|
server_id,
|
|
{
|
|
'volumeAttachment': {
|
|
'volumeId': self.cinder.MULTIATTACH_RO_MIGRATE_OLD_VOL
|
|
}
|
|
}
|
|
)
|
|
self._wait_for_volume_attach(
|
|
server_id, self.cinder.MULTIATTACH_RO_MIGRATE_OLD_VOL)
|
|
|
|
# Mimic Cinder during the volume migration flow by calling swap_volume
|
|
# with a source volume that has a migration_status of migrating.
|
|
self.api.put_server_volume(
|
|
server_id,
|
|
self.cinder.MULTIATTACH_RO_MIGRATE_OLD_VOL,
|
|
self.cinder.MULTIATTACH_RO_MIGRATE_NEW_VOL)
|
|
|
|
bdm = objects.BlockDeviceMapping.get_by_volume_and_instance(
|
|
context.get_admin_context(),
|
|
self.cinder.MULTIATTACH_RO_MIGRATE_OLD_VOL,
|
|
server_id)
|
|
connection_info = jsonutils.loads(bdm.connection_info)
|
|
|
|
# Assert that only the old volume UUID is referenced within the stashed
|
|
# connection_info and returned by driver_block_device.get_volume_id
|
|
self.assertIn('serial', connection_info)
|
|
self.assertEqual(
|
|
self.cinder.MULTIATTACH_RO_MIGRATE_OLD_VOL,
|
|
connection_info.get('serial'))
|
|
self.assertIn('volume_id', connection_info)
|
|
self.assertEqual(
|
|
self.cinder.MULTIATTACH_RO_MIGRATE_OLD_VOL,
|
|
connection_info['volume_id'])
|
|
self.assertIn('volume_id', connection_info.get('data'))
|
|
self.assertEqual(
|
|
self.cinder.MULTIATTACH_RO_MIGRATE_OLD_VOL,
|
|
connection_info['data']['volume_id'])
|
|
self.assertEqual(
|
|
self.cinder.MULTIATTACH_RO_MIGRATE_OLD_VOL,
|
|
driver_block_device.get_volume_id(connection_info))
|
|
|
|
# Assert that the old volume can be detached from the instance
|
|
self.api.delete_server_volume(
|
|
server_id, self.cinder.MULTIATTACH_RO_MIGRATE_OLD_VOL)
|
|
self._wait_for_volume_detach(
|
|
server_id, self.cinder.MULTIATTACH_RO_MIGRATE_OLD_VOL)
|