[WIP] Ceph improvements

PendingReleaseNotes

@@ -39,3 +39,12 @@ example.ver.1 > example.ver.2:
     which can now be attached to Instances. This is to prevent the Secondary
     Storage to grow to enormous sizes as Linux Distributions keep growing in
     size while a stripped down Linux should fit on a 2.88MB floppy.
+
+4.23.0.0 > 24.0.0:
+  * KVM/Ceph: RBD volumes can now be encrypted at rest using native librbd
+    LUKS2 (<encryption format='luks2' engine='librbd'>), for both data disks
+    and root disks. Encryption is transparent to the guest and reuses the
+    existing CloudStack volume-encryption passphrase handling, so no
+    additional key store is required. Note: attaching an encrypted RBD volume
+    to a running Instance requires libvirt >= 10.1.0; booting an Instance from
+    an encrypted RBD root disk works on older libvirt.

api/src/main/java/com/cloud/host/Host.java

@@ -56,6 +56,7 @@ public static String[] toStrings(Host.Type... types) {
 
     String HOST_UEFI_ENABLE = "host.uefi.enable";
     String HOST_VOLUME_ENCRYPTION = "host.volume.encryption";
+    String HOST_RBD_VOLUME_ENCRYPTION = "host.volume.encryption.rbd";
     String HOST_INSTANCE_CONVERSION = "host.instance.conversion";
     String HOST_VDDK_SUPPORT = "host.vddk.support";
     String HOST_VDDK_LIB_DIR = "vddk.lib.dir";

api/src/main/java/com/cloud/storage/Storage.java

@@ -20,6 +20,7 @@
 
 import java.util.ArrayList;
 import java.util.List;
+import java.util.Set;
 
 public class Storage {
     public static enum ImageFormat {
@@ -172,7 +173,7 @@ public static enum StoragePoolType {
         LVM(false, false, EncryptionSupport.Unsupported), // XenServer local LVM SR
         CLVM(true, false, EncryptionSupport.Unsupported),
         CLVM_NG(true, false, EncryptionSupport.Hypervisor),
-        RBD(true, true, EncryptionSupport.Unsupported), // http://libvirt.org/storage.html#StorageBackendRBD
+        RBD(true, true, EncryptionSupport.Hypervisor), // http://libvirt.org/storage.html#StorageBackendRBD ; encrypted natively by librbd (LUKS2, engine='librbd')
         SharedMountPoint(true, true, EncryptionSupport.Hypervisor),
         VMFS(true, true, EncryptionSupport.Unsupported), // VMware VMFS storage
         PreSetup(true, true, EncryptionSupport.Unsupported), // for XenServer, Storage Pool is set up by customers.
@@ -225,6 +226,47 @@ public static List<StoragePoolType> getNonSharedStoragePoolTypes() {
 
     }
 
+    // pool types whose volumes are files, on KVM
+    public static final Set<StoragePoolType> KVM_FILE_BASED_POOL_TYPES = Set.of(StoragePoolType.NetworkFilesystem, StoragePoolType.SharedMountPoint,
+            StoragePoolType.Filesystem);
+
+    /**
+     * True if a volume is migrated between two pools of the same type.
+     */
+    public static boolean arePoolsSameType(StoragePoolType srcType, StoragePoolType destType) {
+        return srcType != null && srcType.equals(destType);
+    }
+
+    /**
+     * True if at least one of the pools is file based (NFS, SharedMountPoint or local) on KVM, whether it is the
+     * source or the destination, and whether the other one is file based as well.
+     */
+    public static boolean isAnyPoolFileBased(StoragePoolType srcType, StoragePoolType destType) {
+        return KVM_FILE_BASED_POOL_TYPES.contains(srcType) || KVM_FILE_BASED_POOL_TYPES.contains(destType);
+    }
+
+    /**
+     * True if KVM copies a volume in place with a libvirt block copy: between two RBD pools, or between an RBD pool and
+     * a file based pool (NFS, SharedMountPoint or local). Both pools are then reachable from the host the Instance runs
+     * on, so the volume of a running Instance can be copied without moving the Instance.
+     */
+    public static boolean isCopiedInPlaceOnKvm(StoragePoolType srcType, StoragePoolType destType) {
+        if (!StoragePoolType.RBD.equals(srcType) && !StoragePoolType.RBD.equals(destType)) {
+            return false;
+        }
+        return arePoolsSameType(srcType, destType) || isAnyPoolFileBased(srcType, destType);
+    }
+
+    /**
+     * True if a volume is migrated between two file based pools (NFS, SharedMountPoint or local) on KVM. Such a volume
+     * is copied with qemu-img, which reads and writes an encrypted volume with its passphrase, so it is not limited to
+     * the pools a libvirt block copy can reach. It is the way a volume is moved when it is not in use by a running
+     * Instance.
+     */
+    public static boolean areBothPoolsFileBased(StoragePoolType srcType, StoragePoolType destType) {
+        return KVM_FILE_BASED_POOL_TYPES.contains(srcType) && KVM_FILE_BASED_POOL_TYPES.contains(destType);
+    }
+
     public static enum StorageResourceType {
         STORAGE_POOL, STORAGE_HOST, SECONDARY_STORAGE, LOCAL_SECONDARY_STORAGE
     }

api/src/main/java/org/apache/cloudstack/api/command/admin/vm/ImportVmCmd.java

@@ -92,7 +92,7 @@ public class ImportVmCmd extends ImportUnmanagedInstanceCmd {
 
     @Parameter(name = ApiConstants.DISK_PATH,
             type = CommandType.STRING,
-            description = "path of the disk image")
+            description = "path of the disk image. It is the file name on file based storage pools (NFS, Local, SharedMountPoint), and the image name on RBD storage pools")
     private String diskPath;
 
     @Parameter(name = ApiConstants.IMPORT_SOURCE,

api/src/main/java/org/apache/cloudstack/api/command/admin/volume/ImportVolumeCmd.java

@@ -63,7 +63,7 @@ public class ImportVolumeCmd extends BaseAsyncCmd {
     @Parameter(name = ApiConstants.PATH,
             type = BaseCmd.CommandType.STRING,
             required = true,
-            description = "the path of the volume")
+            description = "the path of the volume. It is the file name on file based storage pools (NFS, Local, SharedMountPoint), and the image name on RBD storage pools")
     private String path;
 
     @Parameter(name = ApiConstants.NAME,

api/src/test/java/com/cloud/storage/StorageTest.java

@@ -83,4 +83,82 @@ public void equalityTest() {
         Assert.assertTrue(t1.equals(StoragePoolType.NetworkFilesystem));
         Assert.assertFalse(t1.equals(StoragePoolType.EXT));
     }
+
+    @Test
+    public void arePoolsSameTypeForTwoPoolsOfThatType() {
+        for (StoragePoolType poolType : StoragePoolType.values()) {
+            Assert.assertTrue(poolType + " -> " + poolType, Storage.arePoolsSameType(poolType, poolType));
+            for (StoragePoolType other : StoragePoolType.values()) {
+                if (other.equals(poolType)) {
+                    continue;
+                }
+                Assert.assertFalse(poolType + " -> " + other, Storage.arePoolsSameType(poolType, other));
+            }
+        }
+    }
+
+    @Test
+    public void isAnyPoolFileBasedForOneFileBasedPool() {
+        for (StoragePoolType fileBased : Storage.KVM_FILE_BASED_POOL_TYPES) {
+            Assert.assertTrue("RBD -> " + fileBased, Storage.isAnyPoolFileBased(StoragePoolType.RBD, fileBased));
+            Assert.assertTrue(fileBased + " -> RBD", Storage.isAnyPoolFileBased(fileBased, StoragePoolType.RBD));
+            for (StoragePoolType otherFileBased : Storage.KVM_FILE_BASED_POOL_TYPES) {
+                Assert.assertTrue(fileBased + " -> " + otherFileBased, Storage.isAnyPoolFileBased(fileBased, otherFileBased));
+            }
+        }
+        Assert.assertFalse("RBD -> RBD", Storage.isAnyPoolFileBased(StoragePoolType.RBD, StoragePoolType.RBD));
+    }
+
+    @Test
+    public void isCopiedInPlaceOnKvmForRbdAndForRbdAndFileBasedPools() {
+        Assert.assertTrue("RBD -> RBD", Storage.isCopiedInPlaceOnKvm(StoragePoolType.RBD, StoragePoolType.RBD));
+        for (StoragePoolType fileBased : Storage.KVM_FILE_BASED_POOL_TYPES) {
+            Assert.assertTrue("RBD -> " + fileBased, Storage.isCopiedInPlaceOnKvm(StoragePoolType.RBD, fileBased));
+            Assert.assertTrue(fileBased + " -> RBD", Storage.isCopiedInPlaceOnKvm(fileBased, StoragePoolType.RBD));
+        }
+    }
+
+    @Test
+    public void isCopiedInPlaceOnKvmNotBetweenTwoFileBasedPools() {
+        for (StoragePoolType srcType : Storage.KVM_FILE_BASED_POOL_TYPES) {
+            for (StoragePoolType destType : Storage.KVM_FILE_BASED_POOL_TYPES) {
+                Assert.assertFalse(srcType + " -> " + destType, Storage.isCopiedInPlaceOnKvm(srcType, destType));
+            }
+        }
+    }
+
+    @Test
+    public void isCopiedInPlaceOnKvmNotWithOtherPoolTypes() {
+        for (StoragePoolType other : StoragePoolType.values()) {
+            if (StoragePoolType.RBD.equals(other) || Storage.KVM_FILE_BASED_POOL_TYPES.contains(other)) {
+                continue;
+            }
+            Assert.assertFalse(other + " -> " + other, Storage.isCopiedInPlaceOnKvm(other, other));
+            Assert.assertFalse("RBD -> " + other, Storage.isCopiedInPlaceOnKvm(StoragePoolType.RBD, other));
+            Assert.assertFalse(other + " -> RBD", Storage.isCopiedInPlaceOnKvm(other, StoragePoolType.RBD));
+        }
+    }
+
+    @Test
+    public void areBothPoolsFileBasedBetweenTwoFileBasedPools() {
+        for (StoragePoolType srcType : Storage.KVM_FILE_BASED_POOL_TYPES) {
+            for (StoragePoolType destType : Storage.KVM_FILE_BASED_POOL_TYPES) {
+                Assert.assertTrue(srcType + " -> " + destType, Storage.areBothPoolsFileBased(srcType, destType));
+            }
+        }
+    }
+
+    @Test
+    public void areBothPoolsFileBasedNotWithOtherPoolTypes() {
+        for (StoragePoolType other : StoragePoolType.values()) {
+            if (Storage.KVM_FILE_BASED_POOL_TYPES.contains(other)) {
+                continue;
+            }
+            Assert.assertFalse(other + " -> " + other, Storage.areBothPoolsFileBased(other, other));
+            for (StoragePoolType fileBased : Storage.KVM_FILE_BASED_POOL_TYPES) {
+                Assert.assertFalse(fileBased + " -> " + other, Storage.areBothPoolsFileBased(fileBased, other));
+                Assert.assertFalse(other + " -> " + fileBased, Storage.areBothPoolsFileBased(other, fileBased));
+            }
+        }
+    }
 }