<p dir="ltr">Brick does not have to take over the decisions in order to be a useful repository for the code. The motivation for this work is to avoid having the dm setup code copied wholesale into cinder, where it becomes difficult to keep in sync with the code in nova. </p>
<p dir="ltr">Cinder needs a copy of this code since it is on the data path for certain operations (create from image, copy to image, backup/restore, migrate). </p>
<p dir="ltr">I suggest a design where the worker code is in brick but the decisions stay in nova. This enables code sharing while not substantially altering the nova plan - it also encourages strong back-compatibility guarantees with on disk formats since the dm setup part off the code will be slightly more difficult to modify.</p>
<div class="gmail_quote">On 20 Nov 2015 13:10, "Daniel P. Berrange" <<a href="mailto:berrange@redhat.com">berrange@redhat.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On Fri, Nov 20, 2015 at 03:22:04AM +0000, Li, Xiaoyan wrote:<br>
> Hi all,<br>
><br>
> To fix bug [1][2] in Cinder, Cinder needs to use nova/volume/encryptors[3]<br>
> to attach/detach encrypted volumes.<br>
><br>
> To decrease the code duplication, I raised a BP[4] to move encryptors to<br>
> os-brick[5].<br>
><br>
> Once it is done, Nova needs to update to use the common library. This<br>
> is BP raised. [6]<br>
<br>
You need to proposal a more detailed spec for this, not merely a blueprint<br>
as there are going to be significant discussion points here.<br>
<br>
In particular for the QEMU/KVM nova driver, this proposal is not really<br>
moving in a direction that is aligned with our long term desire/plan for<br>
volume encryption and/or storage management in Nova with KVM. While we<br>
currently use dm-crypt with volumes that are backed by block devices,<br>
this is not something we wish to use long term. Increasingly the storage<br>
used is network based, and while we use in-kernel network clients for<br>
iSCSI/NFS, we use an in-QEMU client for RBD/Gluster storage. QEMU also<br>
has support for in-QEMU clients for iSCSI/NFS and it is likely we'll use<br>
them in Nova in future too.<br>
<br>
Now encryption throws a (small) spanner in the works as the only way to<br>
access encrypted data right now is via dm-crypt, which obviously doesn't<br>
fly when there's no kernel block device to attach it to. Hence we are<br>
working in enhancement to QEMU to let it natively handle LUKS format<br>
volumes. At which point we'll stop using dm-crypt for for anything and<br>
do it all in QEMU.<br>
<br>
Nova currently decides whether it wants to use the in-kernel network<br>
client, or an in-QEMU network client for the various network backed<br>
storage drivers. If os-brick takes over encryption setup with dm-crypt,<br>
then it would potentially be taking the decision away from Nova about<br>
whether to use in-kernel or in-QEMU clients, which is not desirable.<br>
Nova must retain control over which configuration approach is best<br>
for the hypervisor it is using.<br>
<br>
Regards,<br>
Daniel<br>
--<br>
|: <a href="http://berrange.com" rel="noreferrer" target="_blank">http://berrange.com</a> -o- <a href="http://www.flickr.com/photos/dberrange/" rel="noreferrer" target="_blank">http://www.flickr.com/photos/dberrange/</a> :|<br>
|: <a href="http://libvirt.org" rel="noreferrer" target="_blank">http://libvirt.org</a> -o- <a href="http://virt-manager.org" rel="noreferrer" target="_blank">http://virt-manager.org</a> :|<br>
|: <a href="http://autobuild.org" rel="noreferrer" target="_blank">http://autobuild.org</a> -o- <a href="http://search.cpan.org/~danberr/" rel="noreferrer" target="_blank">http://search.cpan.org/~danberr/</a> :|<br>
|: <a href="http://entangle-photo.org" rel="noreferrer" target="_blank">http://entangle-photo.org</a> -o- <a href="http://live.gnome.org/gtk-vnc" rel="noreferrer" target="_blank">http://live.gnome.org/gtk-vnc</a> :|<br>
<br>
__________________________________________________________________________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" rel="noreferrer" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
</blockquote></div>