Use force=True for os-brick disconnect during delete

The 'force' parameter of os-brick's disconnect_volume() method allows
callers to ignore flushing errors and ensure that devices are being
removed from the host.

We should use force=True when we are going to delete an instance to
avoid leaving leftover devices connected to the compute host which
could then potentially be reused to map to volumes to an instance that
should not have access to those volumes.

We can use force=True even when disconnecting a volume that will not be
deleted on termination because os-brick will always attempt to flush
and disconnect gracefully before forcefully removing devices.

Closes-Bug: #2004555

Change-Id: I3629b84d3255a8fe9d8a7cea8c6131d7c40899e8

1 files changed, 11 insertions, 0 deletions

diff --git a/releasenotes/notes/service-user-token-421d067c16257782.yaml b/releasenotes/notes/service-user-token-421d067c16257782.yaml
new file mode 100644
index 0000000000..d3af14fbb8
--- /dev/null
+++ b/releasenotes/notes/service-user-token-421d067c16257782.yaml
@@ -0,0 +1,11 @@
+upgrade:
+  - |
+    Configuration of service user tokens is now **required** for all Nova services
+    to ensure security of block-storage volume data.
+
+    All Nova configuration files must configure the ``[service_user]`` section as
+    described in the `documentation`__.
+
+    See https://bugs.launchpad.net/nova/+bug/2004555 for more details.
+
+    __ https://docs.openstack.org/nova/latest/admin/configuration/service-user-token.html