René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Don't allow vmsnapshot and volume snapshot operations on a vm which has encrypted volumes attached","articleBody":"### problem\n\nDon't allow vmsnapshot and volume snapshot operation on a vm which has encrypted volumes attached\n\n### versions\n\nACS 4.22 \n\n### The steps to reproduce the bug\n\n\n1.  Have a Cloudstack kvm host which supports volume encryption \n\n\u003cimg width=\"1038\" height=\"491\" alt=\"Image\" src=\"https://github.com/user-attachments/assets/a741ea9c-9805-426d-aa15-6e3a9634c917\" /\u003e\n\n\n2. Create a compute offering and disk offering which has encryption enabled \n\n\u003cimg width=\"796\" height=\"512\" alt=\"Image\" src=\"https://github.com/user-attachments/assets/9525262e-6804-4147-ae7d-590fc986f261\" /\u003e\n\n\u003cimg width=\"643\" height=\"430\" alt=\"Image\" src=\"https://github.com/user-attachments/assets/4ef6eca7-2832-4e00-89ec-c46aa8bc822d\" /\u003e\n\n3. Launch a vm with encrypted compute offering and data disk offering \u003e vm launched successfullt \n\n4. Take a vm snapshot of the vm \n\n\u003cimg width=\"639\" height=\"496\" alt=\"Image\" src=\"https://github.com/user-attachments/assets/2468028f-6ace-40ad-8f1e-54e43c11035a\" /\u003e\n\n\u003cimg width=\"1158\" height=\"338\" alt=\"Image\" src=\"https://github.com/user-attachments/assets/030362cb-087c-4cf6-a5ce-549b9c1df00b\" /\u003e\n\n5. Stop the vm \n\n6. Start the vm \u003e Exception \n\n\n\u003cimg width=\"702\" height=\"280\" alt=\"Image\" src=\"https://github.com/user-attachments/assets/e958c73a-829b-4458-9a2f-470280b31323\" /\u003e\n\n```\n2026-05-19 08:12:53,372 WARN  [resource.wrapper.LibvirtStartCommandWrapper] (AgentRequest-Handler-2:[]) (logid:757a3937) LibvirtException org.libvirt.LibvirtException: internal error: Unexpected enum value 0 for virStorageEncryptionEngine\n\tat org.libvirt.ErrorHandler.processError(Unknown Source)\n\tat org.libvirt.ErrorHandler.processError(Unknown Source)\n\tat org.libvirt.Connect.domainCreateXML(Unknown Source)\n\tat com.cloud.hypervisor.kvm.resource.LibvirtComputingResource.startVM(LibvirtComputingResource.java:2241)\n\tat com.cloud.hypervisor.kvm.resource.LibvirtComputingResource.startVM(LibvirtComputingResource.java:2210)\n\tat com.cloud.hypervisor.kvm.resource.wrapper.LibvirtStartCommandWrapper.execute(LibvirtStartCommandWrapper.java:91)\n\tat com.cloud.hypervisor.kvm.resource.wrapper.LibvirtStartCommandWrapper.execute(LibvirtStartCommandWrapper.java:52)\n\tat com.cloud.hypervisor.kvm.resource.wrapper.LibvirtRequestWrapper.execute(LibvirtRequestWrapper.java:78)\n\tat com.cloud.hypervisor.kvm.resource.LibvirtComputingResource.executeRequest(LibvirtComputingResource.java:2280)\n\tat com.cloud.agent.Agent.processRequest(Agent.java:813)\n\tat com.cloud.agent.Agent$AgentRequestHandler.doTask(Agent.java:1295)\n\tat com.cloud.utils.nio.Task.call(Task.java:83)\n\tat com.cloud.utils.nio.Task.call(Task.java:29)\n\tat java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)\n\tat java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)\n\tat java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)\n\tat java.base/java.lang.Thread.run(Thread.java:840)\n\n\n```\n\n\n7. Try to destroy/expunge the vm  \u003e\u003e Exception \n\n\u003cimg width=\"702\" height=\"280\" alt=\"Image\" src=\"https://github.com/user-attachments/assets/219dd624-6295-4308-9d21-711ac325226a\" /\u003e\n\n```\n2026-05-19 08:15:08,143 DEBUG [c.c.a.t.Request] (AgentManager-Handler-8:[]) (logid:) Seq 1-6388356071425053772: Processing:  { Ans: , MgmtId: 32988351955983, via: 1, Ver: v1, Flags: 10, [{\"com.cloud.agent.api.Answer\":{\"result\":\"false\",\"details\":\"Exception: org.apache.cloudstack.utils.qemu.QemuImgException\nMessage: qemu-img: Could not open '/mnt/c2498341-cfff-3eee-86df-fff0fcae419d/7b84527f-6513-4138-a477-6187b880af77': Could not open backing file: Parameter 'encrypt.key-secret' is required for cipher\nStack: org.apache.cloudstack.utils.qemu.QemuImgException: qemu-img: Could not open '/mnt/c2498341-cfff-3eee-86df-fff0fcae419d/7b84527f-6513-4138-a477-6187b880af77': Could not open backing file: Parameter 'encrypt.key-secret' is required for cipher\n\tat org.apache.cloudstack.utils.qemu.QemuImg.commit(QemuImg.java:871)\n\tat com.cloud.hypervisor.kvm.resource.wrapper.LibvirtMergeDiskOnlyVMSnapshotCommandWrapper.mergeDiskOnlySnapshotsForStoppedVM(LibvirtMergeDiskOnlyVMSnapshotCommandWrapper.java:86)\n\tat com.cloud.hypervisor.kvm.resource.wrapper.LibvirtMergeDiskOnlyVMSnapshotCommandWrapper.execute(LibvirtMergeDiskOnlyVMSnapshotCommandWrapper.java:62)\n\tat com.cloud.hypervisor.kvm.resource.wrapper.LibvirtMergeDiskOnlyVMSnapshotCommandWrapper.execute(LibvirtMergeDiskOnlyVMSnapshotCommandWrapper.java:51)\n\tat com.cloud.hypervisor.kvm.resource.wrapper.LibvirtRequestWrapper.execute(LibvirtRequestWrapper.java:78)\n\tat com.cloud.hypervisor.kvm.resource.LibvirtComputingResource.executeRequest(LibvirtComputingResource.java:2280)\n\tat com.cloud.agent.Agent.processRequest(Agent.java:813)\n\tat com.cloud.agent.Agent$AgentRequestHandler.doTask(Agent.java:1295)\n\tat com.cloud.utils.nio.Task.call(Task.java:83)\n\tat com.cloud.utils.nio.Task.call(Task.java:29)\n\tat java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)\n\tat java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)\n\tat java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)\n\tat java.base/java.lang.Thread.run(Thread.java:840)\n\n2026-05-19 08:15:08,180 ERROR [c.c.a.ApiAsyncJobDispatcher] (API-Job-Executor-56:[ctx-5f20d751, job-219]) (logid:c1458150) Unexpected exception while executing org.apache.cloudstack.api.command.admin.vm.DestroyVMCmdByAdmin com.cloud.utils.exception.CloudRuntimeException: Failed to destroy vm with specified vmId\n\tat com.cloud.vm.UserVmManagerImpl.destroyVm(UserVmManagerImpl.java:5999)\n\tat com.cloud.vm.UserVmManagerImpl.destroyVm(UserVmManagerImpl.java:3545)\n\tat java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)\n\tat java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)\n\tat java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)\n\tat java.base/java.lang.reflect.Method.invoke(Method.java:569)\n\tat org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:344)\n\tat org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:198)\n\tat org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java\n\n\n\n```\n\nCurrently, we disallow the following operations on encrypted volumes, and provide a exception message when user tries to perform the following  operation \n\n\u003cimg width=\"940\" height=\"375\" alt=\"Image\" src=\"https://github.com/user-attachments/assets/ebc0bb38-d47c-4a2e-80c1-0a8b936a9123\" /\u003e\n\n\n\u003cimg width=\"491\" height=\"233\" alt=\"Image\" src=\"https://github.com/user-attachments/assets/50e29f7b-8f3b-49d9-afbb-847e8ffc6271\" /\u003e\n\n\n```\n2026-05-19 08:23:10,479 ERROR [c.c.a.ApiServer] (qtp253011924-26:[ctx-fda2c601, ctx-8fb1e3bd]) (logid:5c23248f) unhandled exception executing api command: [Ljava.lang.String;@5a733241 java.lang.UnsupportedOperationException: Cannot create new volumes from encrypted volume snapshots\n\n```\n\u003cimg width=\"1581\" height=\"344\" alt=\"Image\" src=\"https://github.com/user-attachments/assets/17dc973c-0ff9-4d9a-a64f-19a2edfd1492\" /\u003e\n\nTry to revert volume snapshot which was created from an encrypted volume when the vm is in stopped state \n\nException \n\n\u003cimg width=\"434\" height=\"893\" alt=\"Image\" src=\"https://github.com/user-attachments/assets/786f8835-a630-434f-9e4b-246b0fac016a\" /\u003e\n\nlogs \n\n```\n2026-05-19 08:35:01,120 DEBUG [o.a.c.s.s.SnapshotServiceImpl] (API-Job-Executor-69:[ctx-f8fad827, job-251, ctx-c5c1b411]) (logid:d410fd2d) revert snapshot failedcom.cloud.utils.exception.CloudRuntimeException: Unable to revert volume [volumeTO {\"dataStore\":\"PrimaryDataStoreTO {\\\"id\\\":2,\\\"name\\\":\\\"ref-trl-11676-k-Mol8-kiran-chavala-kvm-pri2\\\",\\\"poolType\\\":\\\"NetworkFilesystem\\\",\\\"uuid\\\":\\\"100681f3-60a3-33de-a7d7-2f203d2e299e\\\"}\",\"id\":28,\"name\":\"ROOT-20\",\"path\":\"a7b4cdfc-a3a4-406a-8853-fa63f73992cf\",\"uuid\":\"a7b4cdfc-a3a4-406a-8853-fa63f73992cf\"}] to snapshot [SnapshotTO[datastore=NfsTO {\"_role\":\"Image\",\"_url\":\"NFS:\\/\\/10.0.32.4\\/acs\\/secondary\\/ref-trl-11676-k-Mol8-kiran-chavala\\/ref-trl-11676-k-Mol8-kiran-chavala-sec1\",\"nfsVersion\":null,\"uuid\":null}|volume=volumeTO {\"dataStore\":\"PrimaryDataStoreTO {\\\"id\\\":2,\\\"name\\\":\\\"ref-trl-11676-k-Mol8-kiran-chavala-kvm-pri2\\\",\\\"poolType\\\":\\\"NetworkFilesystem\\\",\\\"uuid\\\":\\\"100681f3-60a3-33de-a7d7-2f203d2e299e\\\"}\",\"id\":28,\"name\":\"ROOT-20\",\"path\":\"a7b4cdfc-a3a4-406a-8853-fa63f73992cf\",\"uuid\":\"a7b4cdfc-a3a4-406a-8853-fa63f73992cf\"}|pathsnapshots/2/28/0c96fbe0-0149-4eef-b8c3-a34b8e99028d]] due to [qemu-img: Could not open 'driver=qcow2,file.filename=/mnt/f179ad17-99de-3f02-81ae-88f4dd0c11d7/snapshots/2/28/0c96fbe0-0149-4eef-b8c3-a34b8e99028d': Parameter 'encrypt.key-secret' is required for cipher].\n2026-05-19 08:35:01,130 ERROR [c.c.a.ApiAsyncJobDispatcher] (API-Job-Executor-69:[ctx-f8fad827, job-251]) (logid:d410fd2d) Unexpected exception while executing org.apache.cloudstack.api.command.user.snapshot.RevertSnapshotCmd com.cloud.utils.exception.CloudRuntimeException: com.cloud.utils.exception.CloudRuntimeException: Unable to revert volume [volumeTO {\"dataStore\":\"PrimaryDataStoreTO {\\\"id\\\":2,\\\"name\\\":\\\"ref-trl-11676-k-Mol8-kiran-chavala-kvm-pri2\\\",\\\"poolType\\\":\\\"NetworkFilesystem\\\",\\\"uuid\\\":\\\"100681f3-60a3-33de-a7d7-2f203d2e299e\\\"}\",\"id\":28,\"name\":\"ROOT-20\",\"path\":\"a7b4cdfc-a3a4-406a-8853-fa63f73992cf\",\"uuid\":\"a7b4cdfc-a3a4-406a-8853-fa63f73992cf\"}] to snapshot [SnapshotTO[datastore=NfsTO {\"_role\":\"Image\",\"_url\":\"NFS:\\/\\/10.0.32.4\\/acs\\/secondary\\/ref-trl-11676-k-Mol8-kiran-chavala\\/ref-trl-11676-k-Mol8-kiran-chavala-sec1\",\"nfsVersion\":null,\"uuid\":null}|volume=volumeTO {\"dataStore\":\"PrimaryDataStoreTO {\\\"id\\\":2,\\\"name\\\":\\\"ref-trl-11676-k-Mol8-kiran-chavala-kvm-pri2\\\",\\\"poolType\\\":\\\"NetworkFilesystem\\\",\\\"uuid\\\":\\\"100681f3-60a3-33de-a7d7-2f203d2e299e\\\"}\",\"id\":28,\"name\":\"ROOT-20\",\"path\":\"a7b4cdfc-a3a4-406a-8853-fa63f73992cf\",\"uuid\":\"a7b4cdfc-a3a4-406a-8853-fa63f73992cf\"}|pathsnapshots/2/28/0c96fbe0-0149-4eef-b8c3-a34b8e99028d]] due to [qemu-img: Could not open 'driver=qcow2,file.filename=/mnt/f179ad17-99de-3f02-81ae-88f4dd0c11d7/snapshots/2/28/0c96fbe0-0149-4eef-b8c3-a34b8e99028d': Parameter 'encrypt.key-secret' is required for cipher].\n\tat org.apache.cloudstack.storage.snapshot.SnapshotServiceImpl.revertSnapshot(SnapshotServiceImpl.java:699)\n\tat org.apache.cloudstack.storage.snapshot.DefaultSnapshotStrategy.revertSnapshot(DefaultSnapshotStrategy.java:519)\n\tat com.cloud.storage.snapshot.SnapshotManagerImpl.revertSnapshot(SnapshotManagerImpl.java:405)\n\tat java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)\n\tat java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)\n```\n\nTry to revert volume snapshot which was created from an encrypted volume when the vm is in stopped state \n\nException \n\n\u003cimg width=\"477\" height=\"137\" alt=\"Image\" src=\"https://github.com/user-attachments/assets/0a41a036-b585-4a23-bc5e-dcd1106bb29c\" /\u003e\n\n\n\n### What to do about it?\n\nDon't allow volume and vm snapshot operation on encrypted volumes ","author":{"url":"https://github.com/kiranchavala","@type":"Person","name":"kiranchavala"},"datePublished":"2026-05-19T08:36:29.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":1},"url":"https://github.com/13188/cloudstack/issues/13188"}