Don't allow vmsnapshot and volume snapshot operations on a vm which has encrypted volumes attached

[kiranchavala]

problem

Don't allow vmsnapshot and volume snapshot operation on a vm which has encrypted volumes attached

versions

ACS 4.22

The steps to reproduce the bug

1. Have a Cloudstack kvm host which supports volume encryption

2. Create a compute offering and disk offering which has encryption enabled

3. Launch a vm with encrypted compute offering and data disk offering > vm launched successfullt

4. Take a vm snapshot of the vm

5. Stop the vm

6. Start the vm > Exception

2026-05-19 08:12:53,372 WARN  [resource.wrapper.LibvirtStartCommandWrapper] (AgentRequest-Handler-2:[]) (logid:757a3937) LibvirtException org.libvirt.LibvirtException: internal error: Unexpected enum value 0 for virStorageEncryptionEngine
	at org.libvirt.ErrorHandler.processError(Unknown Source)
	at org.libvirt.ErrorHandler.processError(Unknown Source)
	at org.libvirt.Connect.domainCreateXML(Unknown Source)
	at com.cloud.hypervisor.kvm.resource.LibvirtComputingResource.startVM(LibvirtComputingResource.java:2241)
	at com.cloud.hypervisor.kvm.resource.LibvirtComputingResource.startVM(LibvirtComputingResource.java:2210)
	at com.cloud.hypervisor.kvm.resource.wrapper.LibvirtStartCommandWrapper.execute(LibvirtStartCommandWrapper.java:91)
	at com.cloud.hypervisor.kvm.resource.wrapper.LibvirtStartCommandWrapper.execute(LibvirtStartCommandWrapper.java:52)
	at com.cloud.hypervisor.kvm.resource.wrapper.LibvirtRequestWrapper.execute(LibvirtRequestWrapper.java:78)
	at com.cloud.hypervisor.kvm.resource.LibvirtComputingResource.executeRequest(LibvirtComputingResource.java:2280)
	at com.cloud.agent.Agent.processRequest(Agent.java:813)
	at com.cloud.agent.Agent$AgentRequestHandler.doTask(Agent.java:1295)
	at com.cloud.utils.nio.Task.call(Task.java:83)
	at com.cloud.utils.nio.Task.call(Task.java:29)
	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
	at java.base/java.lang.Thread.run(Thread.java:840)

7. Try to destroy/expunge the vm >> Exception

2026-05-19 08:15:08,143 DEBUG [c.c.a.t.Request] (AgentManager-Handler-8:[]) (logid:) Seq 1-6388356071425053772: Processing:  { Ans: , MgmtId: 32988351955983, via: 1, Ver: v1, Flags: 10, [{"com.cloud.agent.api.Answer":{"result":"false","details":"Exception: org.apache.cloudstack.utils.qemu.QemuImgException
Message: qemu-img: Could not open '/mnt/c2498341-cfff-3eee-86df-fff0fcae419d/7b84527f-6513-4138-a477-6187b880af77': Could not open backing file: Parameter 'encrypt.key-secret' is required for cipher
Stack: org.apache.cloudstack.utils.qemu.QemuImgException: qemu-img: Could not open '/mnt/c2498341-cfff-3eee-86df-fff0fcae419d/7b84527f-6513-4138-a477-6187b880af77': Could not open backing file: Parameter 'encrypt.key-secret' is required for cipher
	at org.apache.cloudstack.utils.qemu.QemuImg.commit(QemuImg.java:871)
	at com.cloud.hypervisor.kvm.resource.wrapper.LibvirtMergeDiskOnlyVMSnapshotCommandWrapper.mergeDiskOnlySnapshotsForStoppedVM(LibvirtMergeDiskOnlyVMSnapshotCommandWrapper.java:86)
	at com.cloud.hypervisor.kvm.resource.wrapper.LibvirtMergeDiskOnlyVMSnapshotCommandWrapper.execute(LibvirtMergeDiskOnlyVMSnapshotCommandWrapper.java:62)
	at com.cloud.hypervisor.kvm.resource.wrapper.LibvirtMergeDiskOnlyVMSnapshotCommandWrapper.execute(LibvirtMergeDiskOnlyVMSnapshotCommandWrapper.java:51)
	at com.cloud.hypervisor.kvm.resource.wrapper.LibvirtRequestWrapper.execute(LibvirtRequestWrapper.java:78)
	at com.cloud.hypervisor.kvm.resource.LibvirtComputingResource.executeRequest(LibvirtComputingResource.java:2280)
	at com.cloud.agent.Agent.processRequest(Agent.java:813)
	at com.cloud.agent.Agent$AgentRequestHandler.doTask(Agent.java:1295)
	at com.cloud.utils.nio.Task.call(Task.java:83)
	at com.cloud.utils.nio.Task.call(Task.java:29)
	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
	at java.base/java.lang.Thread.run(Thread.java:840)

2026-05-19 08:15:08,180 ERROR [c.c.a.ApiAsyncJobDispatcher] (API-Job-Executor-56:[ctx-5f20d751, job-219]) (logid:c1458150) Unexpected exception while executing org.apache.cloudstack.api.command.admin.vm.DestroyVMCmdByAdmin com.cloud.utils.exception.CloudRuntimeException: Failed to destroy vm with specified vmId
	at com.cloud.vm.UserVmManagerImpl.destroyVm(UserVmManagerImpl.java:5999)
	at com.cloud.vm.UserVmManagerImpl.destroyVm(UserVmManagerImpl.java:3545)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:569)
	at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:344)
	at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:198)
	at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java

Currently, we disallow the following operations on encrypted volumes, and provide a exception message when user tries to perform the following operation

2026-05-19 08:23:10,479 ERROR [c.c.a.ApiServer] (qtp253011924-26:[ctx-fda2c601, ctx-8fb1e3bd]) (logid:5c23248f) unhandled exception executing api command: [Ljava.lang.String;@5a733241 java.lang.UnsupportedOperationException: Cannot create new volumes from encrypted volume snapshots

Try to revert volume snapshot which was created from an encrypted volume when the vm is in stopped state

Exception

logs

2026-05-19 08:35:01,120 DEBUG [o.a.c.s.s.SnapshotServiceImpl] (API-Job-Executor-69:[ctx-f8fad827, job-251, ctx-c5c1b411]) (logid:d410fd2d) revert snapshot failedcom.cloud.utils.exception.CloudRuntimeException: Unable to revert volume [volumeTO {"dataStore":"PrimaryDataStoreTO {\"id\":2,\"name\":\"ref-trl-11676-k-Mol8-kiran-chavala-kvm-pri2\",\"poolType\":\"NetworkFilesystem\",\"uuid\":\"100681f3-60a3-33de-a7d7-2f203d2e299e\"}","id":28,"name":"ROOT-20","path":"a7b4cdfc-a3a4-406a-8853-fa63f73992cf","uuid":"a7b4cdfc-a3a4-406a-8853-fa63f73992cf"}] to snapshot [SnapshotTO[datastore=NfsTO {"_role":"Image","_url":"NFS:\/\/10.0.32.4\/acs\/secondary\/ref-trl-11676-k-Mol8-kiran-chavala\/ref-trl-11676-k-Mol8-kiran-chavala-sec1","nfsVersion":null,"uuid":null}|volume=volumeTO {"dataStore":"PrimaryDataStoreTO {\"id\":2,\"name\":\"ref-trl-11676-k-Mol8-kiran-chavala-kvm-pri2\",\"poolType\":\"NetworkFilesystem\",\"uuid\":\"100681f3-60a3-33de-a7d7-2f203d2e299e\"}","id":28,"name":"ROOT-20","path":"a7b4cdfc-a3a4-406a-8853-fa63f73992cf","uuid":"a7b4cdfc-a3a4-406a-8853-fa63f73992cf"}|pathsnapshots/2/28/0c96fbe0-0149-4eef-b8c3-a34b8e99028d]] due to [qemu-img: Could not open 'driver=qcow2,file.filename=/mnt/f179ad17-99de-3f02-81ae-88f4dd0c11d7/snapshots/2/28/0c96fbe0-0149-4eef-b8c3-a34b8e99028d': Parameter 'encrypt.key-secret' is required for cipher].
2026-05-19 08:35:01,130 ERROR [c.c.a.ApiAsyncJobDispatcher] (API-Job-Executor-69:[ctx-f8fad827, job-251]) (logid:d410fd2d) Unexpected exception while executing org.apache.cloudstack.api.command.user.snapshot.RevertSnapshotCmd com.cloud.utils.exception.CloudRuntimeException: com.cloud.utils.exception.CloudRuntimeException: Unable to revert volume [volumeTO {"dataStore":"PrimaryDataStoreTO {\"id\":2,\"name\":\"ref-trl-11676-k-Mol8-kiran-chavala-kvm-pri2\",\"poolType\":\"NetworkFilesystem\",\"uuid\":\"100681f3-60a3-33de-a7d7-2f203d2e299e\"}","id":28,"name":"ROOT-20","path":"a7b4cdfc-a3a4-406a-8853-fa63f73992cf","uuid":"a7b4cdfc-a3a4-406a-8853-fa63f73992cf"}] to snapshot [SnapshotTO[datastore=NfsTO {"_role":"Image","_url":"NFS:\/\/10.0.32.4\/acs\/secondary\/ref-trl-11676-k-Mol8-kiran-chavala\/ref-trl-11676-k-Mol8-kiran-chavala-sec1","nfsVersion":null,"uuid":null}|volume=volumeTO {"dataStore":"PrimaryDataStoreTO {\"id\":2,\"name\":\"ref-trl-11676-k-Mol8-kiran-chavala-kvm-pri2\",\"poolType\":\"NetworkFilesystem\",\"uuid\":\"100681f3-60a3-33de-a7d7-2f203d2e299e\"}","id":28,"name":"ROOT-20","path":"a7b4cdfc-a3a4-406a-8853-fa63f73992cf","uuid":"a7b4cdfc-a3a4-406a-8853-fa63f73992cf"}|pathsnapshots/2/28/0c96fbe0-0149-4eef-b8c3-a34b8e99028d]] due to [qemu-img: Could not open 'driver=qcow2,file.filename=/mnt/f179ad17-99de-3f02-81ae-88f4dd0c11d7/snapshots/2/28/0c96fbe0-0149-4eef-b8c3-a34b8e99028d': Parameter 'encrypt.key-secret' is required for cipher].
	at org.apache.cloudstack.storage.snapshot.SnapshotServiceImpl.revertSnapshot(SnapshotServiceImpl.java:699)
	at org.apache.cloudstack.storage.snapshot.DefaultSnapshotStrategy.revertSnapshot(DefaultSnapshotStrategy.java:519)
	at com.cloud.storage.snapshot.SnapshotManagerImpl.revertSnapshot(SnapshotManagerImpl.java:405)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)

Try to revert volume snapshot which was created from an encrypted volume when the vm is in stopped state

Exception

What to do about it?

Don't allow volume and vm snapshot operation on encrypted volumes

[vishesh92]

I tested with @sureshanaparti . This wasn't present in 4.20 and seems to have been introduced as part of #10632