Handle KeyError when volume encryption is not supported

When attaching a volume, after the connection is initialized to the
volume in Cinder, the nova.volume.encryptors.get_encryption_metadata
method is called to get encryption metadata for the volume. That call is
based on the 'encrypted' key in connection_info['data'] returned from
the os-initialize_connection Cinder API.

However, just because the volume has an encryption key in Cinder does
not mean that the corresponding volume driver in Nova supports
encrypting the volume, like in the case of RBD volumes.

Tempest has tests for encrypted volumes which succeed today in the Ceph
job but they are actually false positives since without Cinder change
I03f8cae05cc117e14f7482115de685fc9f3fa54a, the 'encrypted' key is not
set in the connection_info dict and Nova doesn't attempt encryption of
the volume during attach.

The Ceph job fails when encrypted=True is in connection_info because
cryptsetup (and luks which extends cryptsetup) requires the
'device_path' key in the connection_info dict, which is set when
connecting the volume during attach via the corresponding Nova volume
driver. In the case of RBD and libvirt, the LibvirtNetVolumeDriver is
used and the 'device_path' key isn't set, so a KeyError is raised when
trying to construct the CryptsetupEncryptor or LuksEncryptor objects.

This change adds a check in CryptsetupEncryptor such that if the
device_path is not in connection_info, a VolumeEcnryptionNotSupported
error is raised rather than KeyError.

Note that this doesn't fix the encrypted volume tests in Tempest. Those
tests fail due to a timeout waiting for the volume status to be 'in-use'
which doesn't happen since the compute manager rolls back the
reservation on the volume when the error occurs. The Tempest tests will
have to be skipped in the Ceph job until volume encryption is supported
for RBD in Nova, which will be a separate set of changes.

Related-Bug: #1463525

Change-Id: I8efc2628b09d4e9e59831353daa080b20e17ccde

nova/tests/unit/volume/encryptors/test_cryptsetup.py

@@ -17,7 +17,9 @@
 import array
 
 import mock
+import six
 
+from nova import exception
 from nova.keymgr import key
 from nova.tests.unit.volume.encryptors import test_base
 from nova.volume.encryptors import cryptsetup
@@ -89,3 +91,14 @@ class CryptsetupEncryptorTestCase(test_base.VolumeEncryptorTestCase):
                       run_as_root=True, check_exit_code=True),
         ])
         self.assertEqual(1, mock_execute.call_count)
+
+    def test_init_volume_encryption_not_supported(self):
+        # Tests that creating a CryptsetupEncryptor fails if there is no
+        # device_path key.
+        type = 'unencryptable'
+        data = dict(volume_id='a194699b-aa07-4433-a945-a5d23802043e')
+        connection_info = dict(driver_volume_type=type, data=data)
+        exc = self.assertRaises(exception.VolumeEncryptionNotSupported,
+                                cryptsetup.CryptsetupEncryptor,
+                                connection_info)
+        self.assertIn(type, six.text_type(exc))

nova/volume/encryptors/cryptsetup.py

@@ -18,6 +18,7 @@ import os
 
 from oslo_log import log as logging
 
+from nova import exception
 from nova import utils
 from nova.volume.encryptors import base
 
@@ -34,6 +35,15 @@ class CryptsetupEncryptor(base.VolumeEncryptor):
     def __init__(self, connection_info, **kwargs):
         super(CryptsetupEncryptor, self).__init__(connection_info, **kwargs)
 
+        # Fail if no device_path was set when connecting the volume, e.g. in
+        # the case of libvirt network volume drivers.
+        data = connection_info['data']
+        if not data.get('device_path'):
+            volume_id = data.get('volume_id') or connection_info.get('serial')
+            raise exception.VolumeEncryptionNotSupported(
+                volume_id=volume_id,
+                volume_type=connection_info['driver_volume_type'])
+
         # the device's path as given to libvirt -- e.g., /dev/disk/by-path/...
         self.symlink_path = connection_info['data']['device_path']