Prevent custom block volume sharing #13183

hamistao · 2024-03-20T13:53:19Z

Closes #12254.
Changes mostly based on lxc/incus#467 and lxc/incus#529.
This creates the security.shared config key for block volumes and adds checks for it during device creation and instance start.
This also includes checks for path definition when adding custom volume devices to profiles (filesystem volumes require a path and block volumes don't) and does some refactoring on the validateConfig function to make the disk validation process more readable.

lxd/device/config/devices.go

lxd/device/disk.go

lxd/storage/backend_lxd.go

lxd/storage/utils.go

tomponline

Mostly just nits and small tweaks to address.

github-actions · 2024-03-27T17:38:27Z

Heads up @ru-fu - the "Documentation" label was applied to this issue.

lxd/device/disk.go

tomponline

As you can create block volumes and attach them to profiles in the main test suite we should have a check for that in this PR too.

Also please can you add a check to https://github.com/canonical/lxd-ci/blob/main/tests/storage-volumes-vm for per-VM disk devices.

hamistao · 2024-07-04T16:41:15Z

@tomponline Requested changes made and pushed

lxd/device/disk.go

doc/api-extensions.md

ru-fu · 2024-07-05T08:25:33Z

doc/explanation/storage.md

@@ -154,7 +154,7 @@ Each storage volume uses one of the following content types:
  You can create a custom storage volume of type `block` by using the `--type=block` flag.

  Custom storage volumes of content type `block` can only be attached to virtual machines.
-  They should not be shared between instances, because simultaneous access can lead to data corruption.
+  By default they can only be attached to one instance at a time, because simultaneous access can lead to data corruption.


Suggested change

By default they can only be attached to one instance at a time, because simultaneous access can lead to data corruption.

By default, they can only be attached to one instance at a time, because simultaneous access can lead to data corruption.

Set the `security.shared` storage option to allow sharing volumes between instances.

ru-fu · 2024-07-05T08:26:15Z

doc/explanation/storage.md

@@ -154,7 +154,7 @@ Each storage volume uses one of the following content types:
  You can create a custom storage volume of type `block` by using the `--type=block` flag.

  Custom storage volumes of content type `block` can only be attached to virtual machines.
-  They should not be shared between instances, because simultaneous access can lead to data corruption.
+  By default they can only be attached to one instance at a time, because simultaneous access can lead to data corruption.


Sorry, missed your comment Tom! But yes, adding that here makes sense. Unfortunately we can't link to the option since it's specific to the storage driver. :(

ru-fu · 2024-07-05T08:27:52Z

doc/explanation/storage.md

@@ -154,7 +154,7 @@ Each storage volume uses one of the following content types:
  You can create a custom storage volume of type `block` by using the `--type=block` flag.

  Custom storage volumes of content type `block` can only be attached to virtual machines.
-  They should not be shared between instances, because simultaneous access can lead to data corruption.
+  By default they can only be attached to one instance at a time, because simultaneous access can lead to data corruption.


Regarding the profiles, I don't think it's needed here (because it's implied by saying they can only be attached to one instance). So it makes sense to add it to the how-to like you did.

Signed-off-by: Thomas Hipp <thomashipp@gmail.com> (cherry picked from commit b8d3d735dffe6c587ed0b8965288122f63dfc108) Signed-off-by: hamistao <pedro.ribeiro@canonical.com> License: Apache-2.0

The `Update` function returns `map[string]Device` values despite there being a `Devices` type which is the same thing. This commit changes the return types to be `Devices` instead. Signed-off-by: Thomas Hipp <thomashipp@gmail.com> (cherry picked from commit 6fff607f8462237843a590751d7afcb38335e3f4) Signed-off-by: hamistao <pedro.ribeiro@canonical.com> License: Apache-2.0

Signed-off-by: hamistao <pedro.ribeiro@canonical.com>

This validates shared custom block volumes. Such volumes can be attached to profiles only if `security.shared` is `true`. Also, they can only be attached to more than one instance if `security.shared` is `true`. Signed-off-by: Thomas Hipp <thomashipp@gmail.com> (cherry picked from commit 78315b5d6d8b1783604b482dec5c210767597098) Signed-off-by: hamistao <pedro.ribeiro@canonical.com> License: Apache-2.0

This handles the `security.shared` config key update. If a shared custom storage block volume is attached to a profile, this volume cannot be un-shared. Furthermore, if such a volume is attached to more than one instance, it also cannot be un-shared. Signed-off-by: Thomas Hipp <thomashipp@gmail.com> (cherry picked from commit 29b45bb029d3a447e80a3e6f20e19658183ffb36) Signed-off-by: hamistao <pedro.ribeiro@canonical.com> License: Apache-2.0

Signed-off-by: Thomas Hipp <thomashipp@gmail.com> (cherry picked from commit 6e4e6b6b2061ad719ec576ee143e20f1b208b411) Signed-off-by: hamistao <pedro.ribeiro@canonical.com> License: Apache-2.0

Signed-off-by: Thomas Hipp <thomashipp@gmail.com> (cherry picked from commit 606b833d1a67a3d8bc3e7cec032889c372229242) Signed-off-by: hamistao <pedro.ribeiro@canonical.com> License: Apache-2.0

Signed-off-by: Stéphane Graber <stgraber@stgraber.org> (cherry picked from commit 32a4beecbf8098fdbb15ef5f36088956922630f7) Signed-off-by: hamistao <pedro.ribeiro@canonical.com> License: Apache-2.0

This check is not for when the path property is missing, but to check if a device that is not a root disk (and therefore its path is different from '/') has a source property defined Signed-off-by: hamistao <pedro.ribeiro@canonical.com>

Signed-off-by: hamistao <pedro.ribeiro@canonical.com>

tomponline · 2024-07-08T14:49:48Z

@hamistao did you address @ru-fu suggestions yet on this? Thanks

hamistao · 2024-07-08T15:00:50Z

@ru-fu Thanks for the suggestions, the changes were made.
@tomponline Suggested changes were made, how should we proceed regarding having VMs with shared block volumes not starting after the update?

ru-fu

Docs looks good. :)

tomponline

Thanks!

We discussed this and because it will only affect custom block volumes that are actively shared with multiple VMs already, this is likely very niche (due to the risk of data corruption) and thus we would expect the operator to update the volume with security.share=true if they really intend to do this.

hamistao requested a review from tomponline as a code owner March 20, 2024 13:53

github-actions bot added Documentation Documentation needs updating API Changes to the REST API labels Mar 20, 2024

hamistao force-pushed the issue12254/check_custom_block_storage_volume_sharing branch from 0488bfa to 087ec55 Compare March 20, 2024 14:11

hamistao marked this pull request as draft March 20, 2024 14:17

hamistao force-pushed the issue12254/check_custom_block_storage_volume_sharing branch 8 times, most recently from 28a7e15 to e7b3abb Compare March 21, 2024 11:45

hamistao marked this pull request as ready for review March 21, 2024 13:42

hamistao force-pushed the issue12254/check_custom_block_storage_volume_sharing branch from e7b3abb to ecf80be Compare March 21, 2024 20:42

hamistao mentioned this pull request Mar 22, 2024

Storage: Remove unused parameters #13205

Merged

tomponline reviewed Mar 27, 2024

View reviewed changes

lxd/device/config/devices.go Outdated Show resolved Hide resolved

tomponline reviewed Mar 27, 2024

View reviewed changes

lxd/device/disk.go Outdated Show resolved Hide resolved

tomponline reviewed Mar 27, 2024

View reviewed changes

lxd/device/disk.go Outdated Show resolved Hide resolved

tomponline reviewed Mar 27, 2024

View reviewed changes

lxd/storage/backend_lxd.go Outdated Show resolved Hide resolved

tomponline reviewed Mar 27, 2024

View reviewed changes

lxd/storage/utils.go Show resolved Hide resolved

tomponline requested changes Mar 27, 2024

View reviewed changes

hamistao force-pushed the issue12254/check_custom_block_storage_volume_sharing branch 5 times, most recently from e1dbfa5 to 1ab84a8 Compare March 28, 2024 10:39

tomponline reviewed Mar 28, 2024

View reviewed changes

lxd/device/disk.go Outdated Show resolved Hide resolved

tomponline requested changes Mar 28, 2024

View reviewed changes

hamistao force-pushed the issue12254/check_custom_block_storage_volume_sharing branch 3 times, most recently from a6b885b to 60b18a7 Compare July 4, 2024 16:09

hamistao force-pushed the issue12254/check_custom_block_storage_volume_sharing branch from 60b18a7 to ea842ab Compare July 4, 2024 16:55

tomponline reviewed Jul 5, 2024

View reviewed changes

lxd/device/disk.go Outdated Show resolved Hide resolved

tomponline reviewed Jul 5, 2024

View reviewed changes

lxd/device/disk.go Outdated Show resolved Hide resolved

tomponline reviewed Jul 5, 2024

View reviewed changes

lxd/device/disk.go Show resolved Hide resolved

tomponline reviewed Jul 5, 2024

View reviewed changes

lxd/device/disk.go Outdated Show resolved Hide resolved

ru-fu reviewed Jul 5, 2024

View reviewed changes

monstermunchkin and others added 13 commits July 8, 2024 09:58

api: Add shared_custom_block_volumes API extension

70d8d2e

Signed-off-by: Thomas Hipp <thomashipp@gmail.com> (cherry picked from commit b8d3d735dffe6c587ed0b8965288122f63dfc108) Signed-off-by: hamistao <pedro.ribeiro@canonical.com> License: Apache-2.0

lxd: Rename ErrInstanceListStop to ErrListStop

a295e4f

Signed-off-by: hamistao <pedro.ribeiro@canonical.com>

lxd/storage: Allow security.shared key for custom block volumes

40a1293

Signed-off-by: Thomas Hipp <thomashipp@gmail.com> (cherry picked from commit 6e4e6b6b2061ad719ec576ee143e20f1b208b411) Signed-off-by: hamistao <pedro.ribeiro@canonical.com> License: Apache-2.0

lxd/storage/drivers: Handle security.shared in fillVolumeConfig

07d06aa

Signed-off-by: Thomas Hipp <thomashipp@gmail.com> (cherry picked from commit 606b833d1a67a3d8bc3e7cec032889c372229242) Signed-off-by: hamistao <pedro.ribeiro@canonical.com> License: Apache-2.0

lxd/device/disk: Fix incorrect block volume usage

fb1cbbd

Signed-off-by: Stéphane Graber <stgraber@stgraber.org> (cherry picked from commit 32a4beecbf8098fdbb15ef5f36088956922630f7) Signed-off-by: hamistao <pedro.ribeiro@canonical.com> License: Apache-2.0

lxd/device: Update confusing error message

1465885

This check is not for when the path property is missing, but to check if a device that is not a root disk (and therefore its path is different from '/') has a source property defined Signed-off-by: hamistao <pedro.ribeiro@canonical.com>

lxd/storage: Add comments for metadata generation

362734e

Signed-off-by: hamistao <pedro.ribeiro@canonical.com>

metadata: Add references to security.shared

3fd9768

Signed-off-by: hamistao <pedro.ribeiro@canonical.com>

test: Add test for adding block volumes to profile

090c35a

Signed-off-by: hamistao <pedro.ribeiro@canonical.com>

doc: Update block volume usage

911b153

Signed-off-by: hamistao <pedro.ribeiro@canonical.com>

hamistao force-pushed the issue12254/check_custom_block_storage_volume_sharing branch from ea842ab to 911b153 Compare July 8, 2024 14:19

ru-fu approved these changes Jul 9, 2024

View reviewed changes

tomponline approved these changes Jul 11, 2024

View reviewed changes

tomponline merged commit 533ff3d into canonical:main Jul 11, 2024
29 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Prevent custom block volume sharing #13183

Prevent custom block volume sharing #13183

hamistao commented Mar 20, 2024 •

edited

Loading

tomponline left a comment

github-actions bot commented Mar 27, 2024

tomponline left a comment

hamistao commented Jul 4, 2024

ru-fu Jul 5, 2024

ru-fu Jul 5, 2024

ru-fu Jul 5, 2024

tomponline commented Jul 8, 2024

hamistao commented Jul 8, 2024

ru-fu left a comment

tomponline left a comment

	By default they can only be attached to one instance at a time, because simultaneous access can lead to data corruption.
	By default, they can only be attached to one instance at a time, because simultaneous access can lead to data corruption.
	Set the `security.shared` storage option to allow sharing volumes between instances.

Prevent custom block volume sharing #13183

Prevent custom block volume sharing #13183

Conversation

hamistao commented Mar 20, 2024 • edited Loading

tomponline left a comment

Choose a reason for hiding this comment

github-actions bot commented Mar 27, 2024

tomponline left a comment

Choose a reason for hiding this comment

hamistao commented Jul 4, 2024

ru-fu Jul 5, 2024

Choose a reason for hiding this comment

ru-fu Jul 5, 2024

Choose a reason for hiding this comment

ru-fu Jul 5, 2024

Choose a reason for hiding this comment

tomponline commented Jul 8, 2024

hamistao commented Jul 8, 2024

ru-fu left a comment

Choose a reason for hiding this comment

tomponline left a comment

Choose a reason for hiding this comment

hamistao commented Mar 20, 2024 •

edited

Loading