Uploaded image for project: 'Data Foundation Bugs'
  1. Data Foundation Bugs
  2. DFBUGS-718

[1928076] Storagecluster deletion should remove dm-crypt managed device-mapper mapping from OSD devices

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Critical Critical
    • None
    • None
    • ocs-operator
    • None
    • False
    • False
    • Proposed
    • Not Set
    • Not Set
    • Not Set
    • Undefined
    • None

      Description of problem (please be detailed as possible and provide log
      snippests):
      ======================================================================
      This bug is being raised based on a discussion in encryption sync up

      it was suggested to raise a request to include cleanup of dm-crypt managed device mapper mapping from OSD devices as part of Storage cluster deletion task itself (i.e. automate the process, the way wipefs of disks are now automated)

      Currently, if someone has encryption enabled and wants to uninstall, he has to follow multiple manual steps to clean up the leftovers of dmcrypt in both dynamic and LSO clusters.

      Version of all relevant components (if applicable):
      =====================================================
      OCS 4.7 = 4.7.0-258.ci

      Does this issue impact your ability to continue to work with the product
      (please explain in detail what is the user impact)?
      ================================================
      No. we have manual documented steps as of now

      Is there any workaround available to the best of your knowledge?
      =====================================================
      Manual steps are documented.

      Rate from 1 - 5 the complexity of the scenario you performed that caused this
      bug (1 - very simple, 5 - very complex)?
      ========================================
      3

      Can this issue reproducible?
      =================================
      yes , always

      Can this issue reproduce from the UI?
      ====================================

      If this is a regression, please provide more details to justify this:
      ===================================================
      No, an enhancement request to uninstall process

      Steps to Reproduce:
      =========================
      1. Install OCS with either cluster-wide encryption at rest or encryption using KMS vault
      2. Delete storagecluster
      3. Check the device mappings in the compute nodes

      Actual results:
      ===================
      "dmsetup ls" still lists leftover dmcrypt mapping and one has to remove them manually.

      Expected results:
      ======================
      Storagecluster deletion in 4.7 with KMS: already it deletes the keys from vault, better it can also remove dm-crypt managed device-mapper mapping from OSD devices from compute nodes (where OSD was hosted.)

      Additional info:
      ========================
      doc content
      ===================

      https://access.redhat.com/documentation/en-us/red_hat_openshift_container_storage/4.6/html-single/deploying_openshift_container_storage_on_vmware_vsphere/index?lb_target=preview#uninstalling-openshift-container-storage-in-internal-mode_rhocs

      Step 6: If encryption was enabled at the time of install, remove dm-crypt managed device-mapper mapping from OSD devices on all the OpenShift Container Storage nodes.

      Create a debug pod and chroot to the host on the storage node.

      $ oc debug node <node name>
      $ chroot /host
      Get Device names and make note of the OpenShift Container Storage devices.

      $ dmsetup ls
      ocs-deviceset-0-data-0-57snx-block-dmcrypt (253:1)

      Remove the mapped device.

      $ cryptsetup luksClose --debug --verbose ocs-deviceset-0-data-0-57snx-block-dmcrypt

      If the above command gets stuck due to insufficient privileges, run the following commands:

      Press CTRL+Z to exit the above command.
      Find PID of the cryptsetup process which was stuck.

      $ ps
      Example output:

      PID TTY TIME CMD
      778825 ? 00:00:00 cryptsetup
      Take a note of the PID number to kill. In this example, PID is 778825.

      Terminate the process using kill command.

      $ kill -9 <PID>

      Verify that the device name is removed.

      $ dmsetup ls

              mparida@redhat.com Malay Kumar Parida
              nberry@redhat.com Neha Berry
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated: