Restore from backup to ZFS over iSCSI fail

[starnetwork]

Hello,
I have 2 zfs over iSCSI storages set on my clusters
both configured on all nodes and working for create new VMs and migrate from other storages to this zfs storages

but, this storage not working for restore from backup, so if I want to restore from backup I have to restore to local / other storage and than do move disk to the iSCSI storage
(one of this 2)

the error I got on restore:
Virtual Environment 6.2-4
Virtual Machine 28 (VM 28) on node 'server20'
Logs
()
restore vma archive: zstd -q -d -c /mnt/pve/Backups/dump/vzdump-qemu-10000-2020_09_25-22_15_02.vma.zst | vma extract -v -r /var/tmp/vzdumptmp19102.fifo - /var/tmp/vzdumptmp19102
CFG: size: 976 name: qemu-server.conf
DEV: dev_id=1 size: 10737418240 devname: drive-scsi0
CTIME: Fri Sep 25 22:15:05 2020
new volume ID is 'zfspool2iscsi:vm-28-cloudinit'
new volume ID is 'zfspool2iscsi:vm-28-disk-1'
map 'drive-scsi0' to 'iscsi://iqn.2003-01.org.linux-iscsi.zfsstorage1/iqn.2003-01.org.linux-iscsi.zfsstorage1.x8664:sn.abcdef1233456/12' (write zeros = 1)
vma: can't open file iscsi://iqn.2003-01.org.linux-iscsi.zfsstorage1/iqn.2003-01.org.linux-iscsi.zfsstorage1.x8664:sn.abcdef1233456/12 - iSCSI: Failed to connect to LUN : Failed to log in to target. Status: Authorization failure(514)
/bin/bash: line 1: 19104 Broken pipe zstd -q -d -c /mnt/pve/Backups/dump/vzdump-qemu-10000-2020_09_25-22_15_02.vma.zst
19105 Trace/breakpoint trap | vma extract -v -r /var/tmp/vzdumptmp19102.fifo - /var/tmp/vzdumptmp19102
temporary volume 'zfspool2iscsi:vm-28-disk-1' sucessfuly removed
no lock found trying to remove 'create' lock
TASK ERROR: command 'set -o pipefail && zstd -q -d -c /mnt/pve/Backups/dump/vzdump-qemu-10000-2020_09_25-22_15_02.vma.zst | vma extract -v -r /var/tmp/vzdumptmp19102.fifo - /var/tmp/vzdumptmp19102' failed: exit code 133

any suggestions?

Regards,

 

[fiona]

Hi,
thanks for reporting the issue! I can reproduce it and created a bug report for it. You can CC yourself there, to receive updates when the bug changes.

 

[Stoiko Ivanov]

connect to LUN : Failed to log in to target. Status: Authorization failure(514)

is 'iqn.2008-11.org.linux-kvm' also allowed to access the luns?

 

[fiona]

is 'iqn.2008-11.org.linux-kvm' also allowed to access the luns?

No, it wasn't. Thanks, allowing this initiator fixes the problem makes restoring work and shows what the problem is. When booting VMs, we use the initiator name in /etc/iscsi/initiatorname.iscsi. Maybe we should use that one for vma as well?

Please be aware of the security implications if you consider adding this initiator as a workaround!

 

[Stoiko Ivanov]

Maybe we should use that one for vma as well?

Would be a good idea - we have still an open issue w.r.t. efidisk on ZFS over iSCSI:

https://bugzilla.proxmox.com/show_bug.cgi?id=2395

here's the issue, with a similar problem when calling qemu-img, which got fixed (92bdc3f0e364704202a3981c5d967eb9504628b1 in qemu-server):
https://bugzilla.proxmox.com/show_bug.cgi?id=2120

 

[starnetwork]

Hi,
adding iqn.2008-11.org.linux-kvm access will not case security issue?
mean, access from other Unauthorized node or vm from same network using this "general" initiator?

Regards

 

[fiona]

Hi,
adding iqn.2008-11.org.linux-kvm access will not case security issue?
mean, access from other Unauthorized node or vm from same network using this "general" initiator?

Regards

Yes, it can. If you cannot make sure the access is restricted in some other way, please don't use it!
I'll also edit my original post and mention that it's not a general fix. (I was just happy that it shows us what the exact problem is.)

 

[starnetwork]

Thanks!
waiting for fix

Regards