From e5a3cd87d1fe70fac05893468ec6250949062a84 Mon Sep 17 00:00:00 2001 From: Wei Zhou Date: Tue, 10 Nov 2026 13:44:49 +0100 Subject: [PATCH] server: encrypt a volume created on a storage pool with an encrypted disk offering A volume created with a storageid is created on the pool right away, without the passphrase or the KMS key which an encrypted disk offering needs, so it was created without encryption. Set up its encryption before it is created. --- .../service/VolumeOrchestrationService.java | 5 +++++ .../engine/orchestration/VolumeOrchestrator.java | 9 +++++++++ .../java/com/cloud/storage/VolumeApiServiceImpl.java | 2 ++ 3 files changed, 16 insertions(+) diff --git a/engine/api/src/main/java/org/apache/cloudstack/engine/orchestration/service/VolumeOrchestrationService.java b/engine/api/src/main/java/org/apache/cloudstack/engine/orchestration/service/VolumeOrchestrationService.java index fc9245b89704..dd362554aad0 100644 --- a/engine/api/src/main/java/org/apache/cloudstack/engine/orchestration/service/VolumeOrchestrationService.java +++ b/engine/api/src/main/java/org/apache/cloudstack/engine/orchestration/service/VolumeOrchestrationService.java @@ -109,6 +109,11 @@ VolumeInfo moveVolume(VolumeInfo volume, long destPoolDcId, Long destPoolPodId, StoragePool findChildDataStoreInDataStoreCluster(DataCenter dc, Pod pod, Long clusterId, Long hostId, VirtualMachine vm, Long datastoreClusterId); + /** + * Sets up the encryption of a volume if its disk offering is encrypted and the volume has none yet. + */ + void setUpVolumeEncryption(long volumeId, DiskOffering diskOffering); + VolumeInfo createVolumeFromSnapshot(Volume volume, Snapshot snapshot, UserVm vm) throws StorageUnavailableException; Volume migrateVolume(Volume volume, StoragePool destPool) throws StorageUnavailableException; diff --git a/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/VolumeOrchestrator.java b/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/VolumeOrchestrator.java index da827b17ff34..933104b2ec12 100644 --- a/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/VolumeOrchestrator.java +++ b/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/VolumeOrchestrator.java @@ -1904,6 +1904,15 @@ private Pair recreateVolume(VolumeVO vol, VirtualMachinePro return new Pair<>(newVol, destPool); } + @Override + public void setUpVolumeEncryption(long volumeId, DiskOffering diskOffering) { + if (diskOffering == null || !diskOffering.getEncrypt()) { + return; + } + VolumeVO volume = _volsDao.findById(volumeId); + setPassphraseForVolumeEncryption(volume); + } + private VolumeVO setPassphraseForVolumeEncryption(VolumeVO volume) { if (volume.getPassphraseId() != null) { return volume; diff --git a/server/src/main/java/com/cloud/storage/VolumeApiServiceImpl.java b/server/src/main/java/com/cloud/storage/VolumeApiServiceImpl.java index 9b2f4f831d3e..2b9773f639ed 100644 --- a/server/src/main/java/com/cloud/storage/VolumeApiServiceImpl.java +++ b/server/src/main/java/com/cloud/storage/VolumeApiServiceImpl.java @@ -1090,6 +1090,8 @@ private VolumeVO createVolumeOnStoragePool(Long volumeId, Long storageId) throws throw new InvalidParameterValueException(String.format("Disk offering: %s is not compatible with the storage pool", diskOffering.getUuid())); } + _volumeMgr.setUpVolumeEncryption(volumeId, diskOffering); + DataStore dataStore = dataStoreMgr.getDataStore(storageId, DataStoreRole.Primary); VolumeInfo volumeInfo = volFactory.getVolume(volumeId, dataStore); AsyncCallFuture createVolumeFuture = volService.createVolumeAsync(volumeInfo, dataStore);