Skip to content

stop start issue fix for EnableEncryptionFormatAll #1753

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: ade-singlepass-dev
Choose a base branch
from
Open

stop start issue fix for EnableEncryptionFormatAll #1753

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion VMEncryption/main/handle.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -751,7 +751,11 @@ def enable():
encryption_config = EncryptionConfig(encryption_environment=encryption_environment, logger=logger)
if encryption_config.config_file_exists():
existing_volume_type = encryption_config.get_volume_type()

#log to capture lsblk before encryption view.
disk_util.log_lsblk_output()
if public_settings.get(CommonVariables.EncryptionEncryptionOperationKey) == CommonVariables.EnableEncryptionFormatAll:
Copy link
Member

@canfikret canfikret Jul 7, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is the incident reported for EncryptFormalAll scenarios only?

Copy link
Author

@pankajosh pankajosh Jul 7, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes, in standard VM resource disk encryption is supported only for EncryptFormalAll scenario. issue has been seen on stop start.

Copy link

@bamuir bamuir Jul 10, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is the resource disk still getting encrypted if it is unmounted?

Copy link
Author

@pankajosh pankajosh Jul 11, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes, resource disk got encrypted if EFA is there, irrespective of disk mount.

Copy link
Member

@canfikret canfikret Aug 30, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Perhaps, we should consider mounting BEK volume on /bekvolume

Copy link

@bamuir bamuir Aug 30, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@canfikret yeah, we have been wanting to move it. For new VM's, it is an easy change, but for existing VM's, snapshots/backups/etc we would need to think about a solution that wont break those.

#in case of stop start unmount /mnt to avoid resource disk encryption issues.
disk_util.umount('/mnt')
Copy link
Member

@canfikret canfikret Jul 11, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

where will the resource disk get mounted again?

Have you considered creating a separate mount point for BEK which is not under /mnt? For example, /azure_bek_disk ?

is_migrate_operation = False
if CommonVariables.MigrateKey in public_settings:
if public_settings.get(CommonVariables.MigrateKey) == CommonVariables.MigrateValue:
Expand Down