Enable LVM2 filtering on OpenStack 16 overcloud nodes - Tech Preview

Updated -

By default the OpenStack 16 overcloud nodes do not use LVM2 volumes but it is possible with some Cinder backends, for example iSCSI or FC, that LVM2 volumes created inside OpenStack guests become visible on the overcloud nodes where the cinder-volume or nova-compute containers are hosted.

The following issues may appear on computes or controllers:

  • LVM appears to see volume groups from my guests
  • LVM is reporting that there are duplicate volume group names
  • Volume detachments fail because LVM is accessing the storage
  • My guests fail to boot due to problems with LVM
  • The LVM on my guest machine is in a partial state due to a missing disk that actually exists
  • Cinder actions fail on devices that have LVM built on them
  • Cinder snapshots fail to remove correctly
  • Error during live-migration with error /etc/multipath.conf does not exist

To prevent this, it is possible to use a new feature, released as Tech Preview in OpenStack Director 16.1z3, which configures an LVM2 filter when deploying or updating the overcloud stack. The feature is, by default, disabled and should be enabled passing LVMFilterEnabled: true in a Heat environment file.

When enabled, the LVM2 global_filter will be computed starting from the list of physical devices hosting active LVM2 volumes on the host which should be sufficient for the majority of the use cases. When it isn't, the list can be extended further, manually, listing any additional block device via LVMFilterAllowlist parameter, which supports regexp. A deny list can be configured as well, via LVMFilterDenylist parameter; the deny list defaults to [‘.*’] so that any block device which isn’t in the allow list will be in fact ignored and not scanned by the LVM2 tools.

Any of the template parameters can also be set per-role; for example, to enable the feature only on "Compute" nodes and deny to it access to any device name starting with /dev/sd, use the following:

$ cat ~/lvm2_filter.yaml
    LVMFilterEnabled: true
      - /dev/sd.*

Then add the following argument to your openstack overcloud deploy command:

-e lvm2_filter.yaml

After the deployment, to confirm the filter being set up, log any target overcloud node, for example a Compute node when using the above snippet and use the following:

# grep global_filter  /etc/lvm/lvm.conf
global_filter = [ "a|/dev/sd.*|","r|.*|" ]