> For the complete documentation index, see [llms.txt](https://platform9.com/kb/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://platform9.com/kb/pcd/storage/cinder-driver-fails-to-decrypt-storage-passwords-set-via-blueprint.md).

# Cinder Driver Fails to Decrypt Storage Passwords set via Blueprint

## Problem

Following the PCD v2025.4 release, storage passwords within the `cinder.conf` file, specifically in the `secret_mapping.conf` section, are encrypted. However, the Cinder service fails to decrypt these passwords before passing them to the storage driver. This results in authentication failures, manifesting as 401 errors on the storage array.

{% code title="Cinder Logs" %}

```ruby
REQ: curl -i https://<Cinder-IP>:8080/api/v1/credentials -X POST -H "User-Agent: python-3parclient" -H "Accept: application/json" -H "Content-Type: application/json"
 from (pid=3173923) _http_log_req /opt/pf9/pf9-cindervolume-base/lib/python3.9/site-packages/hpe3parclient/http.py:170
REQ BODY: {"user": "3paruser", "password": "xxxxxx"}

DEBUG hpe3parclient.http [[req-ID] None None] RESP BODY:{"code":5,"desc":"invalid username or password"}

ERROR cinder.volume.manager [[req-ID] None None] Failed to initialize driver.: hpe3parclient.exceptions.HTTPForbidden: Forbidden (HTTP 403) 6 - invalid session key
```

{% endcode %}

## Environment

* Private Cloud Director Virtualization - till v2025.4-497
* Self-Hosted Private Cloud Director Virtualisation – till v2025.4-497.
* Component - Storage

## Cause

* The v2025.4 release introduces encryption for storage passwords in Cinder's configuration. A defect exists where the Cinder service does not decrypt these passwords when providing them to the storage driver.
* This is a known issue that was reported as PCD-2162 and a fix is available from **v2025.6-151 and above versions.**

## Resolution

* The fix for this issue is now available in the v2025.6 Release.
* After the Management Plane and the hosts are fully upgraded to v2025.6 Release, remove the file `secret_mapping_override.conf` and provide the password in the Blueprint Volume Config.

## Workaround

To mitigate this issue, do not set storage passwords in the blueprint. Instead, set password-related options directly on the Cinder host as part of an override configuration file.

1. Navigate to the Cinder configuration directory on the Cinder host:

```bash
$ cd /opt/pf9/etc/pf9-cindervolume-base/conf.d/
```

2. Comment the below mentioned lines in cinder.conf as it forces to use the *"config\_source = secrets" section*

<pre class="language-dart"><code class="lang-dart">[DEFAULT]
...
<strong># config_source = secrets
</strong>...
# [secrets]
# driver = castellan
# config_file = /opt/pf9/etc/pf9-cindervolume-base/conf.d/castellan.conf
# mapping_file = /opt/pf9/etc/pf9-cindervolume-base/conf.d/secret_mapping.conf
</code></pre>

3. Edit the `cinder.conf` file. Add the necessary password configurations for your storage backend. For example, for an HPE 3PAR backend named `storage-3par-fc`, the content might look like this:

> *Replace* *`your_actual_password`* *with the correct password for your environment.*

```ruby
[storage-3par-fc]
hpe3par_debug = True
san_password = your_actual_password
hpe3par_password = your_actual_password
```

4. Restart the cinder service on the host:

```bash
systemctl restart pf9-cindervolume-base.service
```

## Additional Information

For further questions/concerns regarding the bug, reach out to the [Platform9 Support Team](https://support.platform9.com/hc/en-us)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://platform9.com/kb/pcd/storage/cinder-driver-fails-to-decrypt-storage-passwords-set-via-blueprint.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.