<feature>[storage]: support ZBS volume encryption conversion

zhong.zhou · zhong.zhou · commit 2e62674ebf39 · 2026-07-15T15:59:58.000+08:00
Route ZBS conversion through a dedicated backend and KVM handler.

Tests: cbok zsv groovy_test ZbsVolumeEncryptionCase

Resolves: ZSV-12664

Change-Id: Ibd30f74dd17cb4dc817e57c713b0f32915487e7c
diff --git a/conf/springConfigXml/VolumeManager.xml b/conf/springConfigXml/VolumeManager.xml
@@ -104,6 +104,7 @@
     <bean id="VolumeSnapshotEncryptionHelper" class="org.zstack.storage.encrypt.VolumeSnapshotEncryptionHelper"/>
 
     <bean id="ZbsVolumeEncryptionMaterialFactory" class="org.zstack.storage.encrypt.ZbsVolumeEncryptionMaterialFactory"/>
+    <bean id="ZbsVolumeEncryptionConverter" class="org.zstack.storage.encrypt.ZbsVolumeEncryptionConverter"/>
     <bean id="ZbsVolumeEncryptionKvmCaller" class="org.zstack.storage.encrypt.ZbsVolumeEncryptionKvmCaller"/>
     <bean id="ZbsVolumeEncryptionCleanup" class="org.zstack.storage.encrypt.ZbsVolumeEncryptionCleanup"/>
     <bean id="ZbsEncryptedEmptyVolumeCreator" class="org.zstack.storage.encrypt.ZbsEncryptedEmptyVolumeCreator"/>
diff --git a/header/src/main/java/org/zstack/header/storage/addon/primary/CreateVolumeSpec.java b/header/src/main/java/org/zstack/header/storage/addon/primary/CreateVolumeSpec.java
@@ -10,6 +10,8 @@ public class CreateVolumeSpec {
     private boolean encrypted;
     private String hostUuid;
     private String encryptedDek;
+    private String encryptionKeyResourceType;
+    private String encryptionKeyResourceUuid;
 
     private String allocatedUrl;
     private boolean dryRun;
@@ -85,4 +87,20 @@ public String getEncryptedDek() {
     public void setEncryptedDek(String encryptedDek) {
         this.encryptedDek = encryptedDek;
     }
+
+    public String getEncryptionKeyResourceType() {
+        return encryptionKeyResourceType;
+    }
+
+    public void setEncryptionKeyResourceType(String encryptionKeyResourceType) {
+        this.encryptionKeyResourceType = encryptionKeyResourceType;
+    }
+
+    public String getEncryptionKeyResourceUuid() {
+        return encryptionKeyResourceUuid;
+    }
+
+    public void setEncryptionKeyResourceUuid(String encryptionKeyResourceUuid) {
+        this.encryptionKeyResourceUuid = encryptionKeyResourceUuid;
+    }
 }
diff --git a/header/src/main/java/org/zstack/header/storage/addon/primary/PrimaryStorageControllerSvc.java b/header/src/main/java/org/zstack/header/storage/addon/primary/PrimaryStorageControllerSvc.java
@@ -6,6 +6,8 @@
 import org.zstack.header.storage.addon.*;
 import org.zstack.header.storage.primary.EncryptVolumeBitsOnPrimaryStorageMsg;
 import org.zstack.header.storage.primary.EncryptVolumeBitsOnPrimaryStorageReply;
+import org.zstack.header.storage.primary.ConvertVolumeEncryptionOnPrimaryStorageMsg;
+import org.zstack.header.storage.primary.ConvertVolumeEncryptionOnPrimaryStorageReply;
 import org.zstack.header.storage.snapshot.VolumeSnapshotStats;
 import org.zstack.header.volume.VolumeInventory;
 import org.zstack.header.volume.VolumeProtocol;
@@ -34,6 +36,8 @@ public interface PrimaryStorageControllerSvc {
     void cloneVolume(String srcInstallPath, CreateVolumeSpec dst, ReturnValueCompletion<VolumeStats>comp);
     void copyVolume(String srcInstallPath, CreateVolumeSpec dst, ReturnValueCompletion<VolumeStats>comp);
     void encryptVolumeBits(EncryptVolumeBitsOnPrimaryStorageMsg msg, ReturnValueCompletion<EncryptVolumeBitsOnPrimaryStorageReply> comp);
+    void convertVolumeEncryption(ConvertVolumeEncryptionOnPrimaryStorageMsg msg,
+                                 ReturnValueCompletion<ConvertVolumeEncryptionOnPrimaryStorageReply> completion);
     void flattenVolume(String installPath, ReturnValueCompletion<VolumeStats>comp);
 
     // support uri or path
diff --git a/header/src/main/java/org/zstack/header/storage/addon/primary/ZbsVolumeEncryptionBackend.java b/header/src/main/java/org/zstack/header/storage/addon/primary/ZbsVolumeEncryptionBackend.java
@@ -21,5 +21,12 @@ public interface ZbsVolumeEncryptionBackend {
 
     void checkNoSnapshots(String installPath, Completion completion);
 
+    void validateConversionPaths(String sourceInstallPath, String targetInstallPath);
+
+    void createConversionTarget(String targetInstallPath, long virtualSize, boolean targetEncrypted,
+                                ReturnValueCompletion<String> completion);
+
+    void deleteConversionTarget(String targetInstallPath, Completion completion);
+
     void stats(String installPath, ReturnValueCompletion<VolumeStats> completion);
 }
diff --git a/header/src/main/java/org/zstack/header/storage/addon/primary/ZbsVolumeEncryptionExtensionPoint.java b/header/src/main/java/org/zstack/header/storage/addon/primary/ZbsVolumeEncryptionExtensionPoint.java
@@ -3,6 +3,8 @@
 import org.zstack.header.core.ReturnValueCompletion;
 import org.zstack.header.storage.primary.EncryptVolumeBitsOnPrimaryStorageMsg;
 import org.zstack.header.storage.primary.EncryptVolumeBitsOnPrimaryStorageReply;
+import org.zstack.header.storage.primary.ConvertVolumeEncryptionOnPrimaryStorageMsg;
+import org.zstack.header.storage.primary.ConvertVolumeEncryptionOnPrimaryStorageReply;
 import org.zstack.header.storage.snapshot.VolumeSnapshotInventory;
 import org.zstack.header.volume.VolumeInventory;
 import org.zstack.header.volume.VolumeStats;
@@ -23,6 +25,9 @@ void copyEncryptedVolumeFromSnapshot(ZbsVolumeEncryptionBackend backend, String
     void encryptVolumeBits(ZbsVolumeEncryptionBackend backend, EncryptVolumeBitsOnPrimaryStorageMsg msg,
                            ReturnValueCompletion<EncryptVolumeBitsOnPrimaryStorageReply> completion);
 
+    void convertVolumeEncryption(ZbsVolumeEncryptionBackend backend, ConvertVolumeEncryptionOnPrimaryStorageMsg msg,
+                                 ReturnValueCompletion<ConvertVolumeEncryptionOnPrimaryStorageReply> completion);
+
     void resizeEncryptedVolume(String primaryStorageUuid, VolumeInventory volume, long size,
                                ReturnValueCompletion<VolumeStats> completion);
 
diff --git a/plugin/expon/src/main/java/org/zstack/expon/ExponStorageController.java b/plugin/expon/src/main/java/org/zstack/expon/ExponStorageController.java
@@ -37,6 +37,8 @@
 import org.zstack.header.storage.addon.primary.*;
 import org.zstack.header.storage.primary.EncryptVolumeBitsOnPrimaryStorageMsg;
 import org.zstack.header.storage.primary.EncryptVolumeBitsOnPrimaryStorageReply;
+import org.zstack.header.storage.primary.ConvertVolumeEncryptionOnPrimaryStorageMsg;
+import org.zstack.header.storage.primary.ConvertVolumeEncryptionOnPrimaryStorageReply;
 import org.zstack.header.storage.primary.ImageCacheInventory;
 import org.zstack.header.storage.primary.VolumeSnapshotCapability;
 import org.zstack.header.storage.snapshot.VolumeSnapshotStats;
@@ -1102,6 +1104,13 @@ public void encryptVolumeBits(EncryptVolumeBitsOnPrimaryStorageMsg msg, ReturnVa
         comp.fail(new ErrorCode(SysErrors.UNIMPLEMENTED_OPERATION_ERROR.toString(), "unimplemented operation", details));
     }
 
+    @Override
+    public void convertVolumeEncryption(ConvertVolumeEncryptionOnPrimaryStorageMsg msg,
+                                        ReturnValueCompletion<ConvertVolumeEncryptionOnPrimaryStorageReply> completion) {
+        String details = String.format("primary storage controller[%s] does not support volume encryption conversion", getIdentity());
+        completion.fail(new ErrorCode(SysErrors.UNIMPLEMENTED_OPERATION_ERROR.toString(), "unimplemented operation", details));
+    }
+
     @Override
     public void flattenVolume(String installPath, ReturnValueCompletion<VolumeStats> comp) {
         // TODO flatten snapshot
diff --git a/plugin/zbs/src/main/java/org/zstack/storage/zbs/ZbsStorageController.java b/plugin/zbs/src/main/java/org/zstack/storage/zbs/ZbsStorageController.java
@@ -789,6 +789,16 @@ public void encryptVolumeBits(EncryptVolumeBitsOnPrimaryStorageMsg msg, ReturnVa
         }
     }
 
+    @Override
+    public void convertVolumeEncryption(ConvertVolumeEncryptionOnPrimaryStorageMsg msg,
+                                        ReturnValueCompletion<ConvertVolumeEncryptionOnPrimaryStorageReply> completion) {
+        try {
+            getVolumeEncryptionExtension().convertVolumeEncryption(encryptionBackend(), msg, completion);
+        } catch (OperationFailureException e) {
+            completion.fail(e.getErrorCode());
+        }
+    }
+
     @Override
     public void flattenVolume(String installPath, ReturnValueCompletion<VolumeStats> comp) {
         FlattenVolumeCmd cmd = new FlattenVolumeCmd();
diff --git a/plugin/zbs/src/main/java/org/zstack/storage/zbs/ZbsVolumeEncryptionBackendImpl.java b/plugin/zbs/src/main/java/org/zstack/storage/zbs/ZbsVolumeEncryptionBackendImpl.java
@@ -13,6 +13,8 @@
 import org.zstack.header.storage.addon.primary.ZbsVolumeEncryptionBackend;
 import org.zstack.header.volume.VolumeConstant;
 import org.zstack.header.volume.VolumeStats;
+import org.zstack.utils.Utils;
+import org.zstack.utils.logging.CLogger;
 
 import java.util.UUID;
 
@@ -22,6 +24,7 @@
 import static org.zstack.storage.zbs.ZbsHelper.getSizeUnit;
 
 class ZbsVolumeEncryptionBackendImpl implements ZbsVolumeEncryptionBackend {
+    private static final CLogger logger = Utils.getLogger(ZbsVolumeEncryptionBackendImpl.class);
     private static final String QUERY_SNAPSHOT_PATH = "/zbs/primarystorage/snapshot/query";
     private static final long LUKS_PAYLOAD_OFFSET = 8L * 1024 * 1024;
 
@@ -178,6 +181,90 @@ public void fail(ErrorCode errorCode) {
                 });
     }
 
+    @Override
+    public void validateConversionPaths(String sourceInstallPath, String targetInstallPath) {
+        CbdPath source = parseConversionCbdPath(sourceInstallPath);
+        CbdPath target = parseConversionCbdPath(targetInstallPath);
+        if (!source.physicalPool.equals(target.physicalPool) || !source.logicalPool.equals(target.logicalPool)) {
+            throw new OperationFailureException(operr(
+                    "ZBS volume encryption conversion requires source[%s] and target[%s] in the same physical and logical pool",
+                    sourceInstallPath, targetInstallPath));
+        }
+        if (source.volume.equals(target.volume)) {
+            throw new OperationFailureException(operr(
+                    "ZBS volume encryption conversion requires different source and target volumes, but both are[%s]",
+                    sourceInstallPath));
+        }
+    }
+
+    @Override
+    public void createConversionTarget(String targetInstallPath, long virtualSize, boolean targetEncrypted,
+                                       ReturnValueCompletion<String> completion) {
+        CbdPath target;
+        try {
+            target = parseConversionCbdPath(targetInstallPath);
+        } catch (OperationFailureException e) {
+            completion.fail(e.getErrorCode());
+            return;
+        }
+
+        ZbsStorageController.CreateVolumeCmd cmd = new ZbsStorageController.CreateVolumeCmd();
+        cmd.setLogicalPool(target.logicalPool);
+        cmd.setVolume(target.volume);
+        cmd.setUnit(getSizeUnit(addonInfo.getClusterInfo().getVersion()));
+        long allocatedSize = targetEncrypted ? luksBackingSize(virtualSize) : virtualSize;
+        cmd.setSize(alignSizeTo(allocatedSize, cmd.getUnit()));
+        cmd.setSkipIfExisting(false);
+
+        controller.httpCall(ZbsStorageController.CREATE_VOLUME_PATH, cmd, ZbsStorageController.CreateVolumeRsp.class,
+                new ReturnValueCompletion<ZbsStorageController.CreateVolumeRsp>(completion) {
+                    @Override
+                    public void success(ZbsStorageController.CreateVolumeRsp returnValue) {
+                        String createdInstallPath = returnValue.getInstallPath();
+                        if (targetInstallPath.equals(createdInstallPath)) {
+                            completion.success(createdInstallPath);
+                            return;
+                        }
+
+                        ErrorCode error = operr(
+                                "ZBS volume encryption conversion target[%s] was created at unexpected path[%s]",
+                                targetInstallPath, createdInstallPath);
+                        String cleanupInstallPath = targetInstallPath;
+                        try {
+                            deleteConversionTarget(cleanupInstallPath, new Completion(completion) {
+                                @Override
+                                public void success() {
+                                    completion.fail(error);
+                                }
+
+                                @Override
+                                public void fail(ErrorCode cleanupError) {
+                                    logger.warn(String.format(
+                                            "failed to cleanup unexpected ZBS conversion target[installPath:%s] after create path mismatch: %s",
+                                            cleanupInstallPath, cleanupError));
+                                    completion.fail(error);
+                                }
+                            });
+                        } catch (Exception e) {
+                            logger.warn(String.format(
+                                    "failed to cleanup unexpected ZBS conversion target[installPath:%s] after create path mismatch: %s",
+                                    cleanupInstallPath, e.getMessage()));
+                            completion.fail(error);
+                        }
+                    }
+
+                    @Override
+                    public void fail(ErrorCode errorCode) {
+                        completion.fail(errorCode);
+                    }
+                });
+    }
+
+    @Override
+    public void deleteConversionTarget(String targetInstallPath, Completion completion) {
+        controller.doDeleteVolume(targetInstallPath, true, completion);
+    }
+
     @Override
     public void stats(String installPath, ReturnValueCompletion<VolumeStats> completion) {
         controller.stats(installPath, completion);
@@ -207,6 +294,25 @@ private CbdPath parseActiveCbdPath(String installPath) {
         return path;
     }
 
+    private CbdPath parseConversionCbdPath(String installPath) {
+        if (StringUtils.isBlank(installPath) || !installPath.startsWith("cbd:") || installPath.contains("@")) {
+            throw new OperationFailureException(operr(
+                    "ZBS volume encryption conversion requires an active CBD path, but got[%s]", installPath));
+        }
+
+        String[] parts = installPath.substring("cbd:".length()).split("/", -1);
+        if (parts.length != 3 || StringUtils.isBlank(parts[0]) || StringUtils.isBlank(parts[1]) ||
+                StringUtils.isBlank(parts[2])) {
+            throw new OperationFailureException(operr("invalid ZBS CBD path[%s]", installPath));
+        }
+
+        CbdPath path = new CbdPath();
+        path.physicalPool = parts[0];
+        path.logicalPool = parts[1];
+        path.volume = parts[2];
+        return path;
+    }
+
     private long luksBackingSize(long virtualSize) {
         return virtualSize + LUKS_PAYLOAD_OFFSET;
     }
diff --git a/storage/src/main/java/org/zstack/storage/addon/primary/ExternalPrimaryStorage.java b/storage/src/main/java/org/zstack/storage/addon/primary/ExternalPrimaryStorage.java
@@ -460,6 +460,24 @@ public void fail(ErrorCode errorCode) {
         });
     }
 
+    @Override
+    protected void handle(ConvertVolumeEncryptionOnPrimaryStorageMsg msg) {
+        ConvertVolumeEncryptionOnPrimaryStorageReply reply = new ConvertVolumeEncryptionOnPrimaryStorageReply();
+        controller.convertVolumeEncryption(msg,
+                new ReturnValueCompletion<ConvertVolumeEncryptionOnPrimaryStorageReply>(msg) {
+                    @Override
+                    public void success(ConvertVolumeEncryptionOnPrimaryStorageReply returnValue) {
+                        bus.reply(msg, returnValue);
+                    }
+
+                    @Override
+                    public void fail(ErrorCode errorCode) {
+                        reply.setError(errorCode);
+                        bus.reply(msg, reply);
+                    }
+                });
+    }
+
     protected void handle(final SetTrashExpirationTimeMsg msg) {
         controller.setTrashExpireTime(msg.getExpirationTime(), new Completion(msg) {
             @Override
diff --git a/storage/src/main/java/org/zstack/storage/encrypt/ZbsEncryptedEmptyVolumeCreator.java b/storage/src/main/java/org/zstack/storage/encrypt/ZbsEncryptedEmptyVolumeCreator.java
@@ -57,7 +57,7 @@ private void createOnPreparedBacking(String primaryStorageUuid, String installPa
                                          ReturnValueCompletion<VolumeStats> completion) {
         ZbsVolumeEncryptionMaterial material;
         try {
-            material = materialFactory.prepareVolumeEncryption(primaryStorageUuid, spec.getUuid(),
+            material = materialFactory.prepareVolumeEncryption(primaryStorageUuid, spec,
                     String.format("create encrypted volume[uuid:%s]", spec.getUuid()));
         } catch (OperationFailureException e) {
             completion.fail(e.getErrorCode());
diff --git a/storage/src/main/java/org/zstack/storage/encrypt/ZbsVolumeEncryptionCommands.java b/storage/src/main/java/org/zstack/storage/encrypt/ZbsVolumeEncryptionCommands.java
@@ -42,6 +42,16 @@ static class KVMHostLuksResizeCmd extends KVMAgentCommands.AgentCommand implemen
         public Long virtualSize;
     }
 
+    static class KVMHostLuksConvertCmd extends KVMAgentCommands.AgentCommand implements Serializable {
+        public String psUuid;
+        @NoLogging
+        public String encryptedDek;
+        public String installPath;
+        public String targetInstallPath;
+        public boolean targetEncrypted;
+        public long virtualSize;
+    }
+
     static class KVMHostLuksRsp extends KVMAgentCommands.AgentResponse {
         public Long actualSize;
         public String installPath;
diff --git a/storage/src/main/java/org/zstack/storage/encrypt/ZbsVolumeEncryptionConstants.java b/storage/src/main/java/org/zstack/storage/encrypt/ZbsVolumeEncryptionConstants.java
@@ -4,6 +4,7 @@ final class ZbsVolumeEncryptionConstants {
     static final String KVM_HOST_LUKS_CLONE_PATH = "/zbs/primarystorage/kvmhost/luksclone";
     static final String KVM_HOST_LUKS_CREATE_EMPTY_PATH = "/zbs/primarystorage/kvmhost/lukscreateempty";
     static final String KVM_HOST_LUKS_ENCRYPT_IN_PLACE_PATH = "/zbs/primarystorage/kvmhost/encryptinplace";
+    static final String KVM_HOST_LUKS_CONVERT_PATH = "/zbs/primarystorage/kvmhost/luksconvert";
     static final String KVM_HOST_LUKS_RESIZE_PATH = "/zbs/primarystorage/kvmhost/luksresize";
 
     private ZbsVolumeEncryptionConstants() {
diff --git a/storage/src/main/java/org/zstack/storage/encrypt/ZbsVolumeEncryptionConverter.java b/storage/src/main/java/org/zstack/storage/encrypt/ZbsVolumeEncryptionConverter.java
diff --git a/storage/src/main/java/org/zstack/storage/encrypt/ZbsVolumeEncryptionExtension.java b/storage/src/main/java/org/zstack/storage/encrypt/ZbsVolumeEncryptionExtension.java
diff --git a/storage/src/main/java/org/zstack/storage/encrypt/ZbsVolumeEncryptionMaterialFactory.java b/storage/src/main/java/org/zstack/storage/encrypt/ZbsVolumeEncryptionMaterialFactory.java
diff --git a/storage/src/main/java/org/zstack/storage/volume/VolumeBase.java b/storage/src/main/java/org/zstack/storage/volume/VolumeBase.java
diff --git a/test/src/test/groovy/org/zstack/test/integration/storage/primary/addon/zbs/ZbsVolumeEncryptionCase.groovy b/test/src/test/groovy/org/zstack/test/integration/storage/primary/addon/zbs/ZbsVolumeEncryptionCase.groovy
