mirrors/ceph-csi
1
0
Fork 0
mirror of https://github.com/ceph/ceph-csi.git synced 2025-06-14 02:43:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

rbd: add backwards compatible encryption in NodeStageVolume

Browse Source 
When a volume was provisioned by an old Ceph-CSI provisioner, the
metadata of the RBD image will contain `requiresEncryption` to indicate
a passphrase needs to be created. New Ceph-CSI provisioners create the
passphrase in the CreateVolume request, and set `encryptionPrepared`
instead.

When a new node-plugin detects that `requiresEncryption` is set in the
RBD image metadata, it will fallback to the old behaviour.

In case `encryptionPrepared` is read from the RBD image metadata, the
passphrase is used to cryptsetup/format the image.

Signed-off-by: Niels de Vos <ndevos@redhat.com>
This commit is contained in:
Niels de Vos
2021-02-16 16:56:42 +01:00
committed by mergify[bot]
parent ee79b22c97
commit 4937e59c4d
3 changed files with 52 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
internal/rbd/encryption.go
View File

@ -18,18 +18,37 @@ package rbd
import (
"context"
"errors"
"fmt"
"strings"
"github.com/ceph/ceph-csi/internal/util"
librbd "github.com/ceph/go-ceph/rbd"
)
// rbdEncryptionState describes the status of the process where the image is
// with respect to being encrypted.
type rbdEncryptionState string
const (
// Encryption statuses for RbdImage
rbdImageEncryptionUnknown = rbdEncryptionState("")
rbdImageEncrypted = rbdEncryptionState("encrypted")
// rbdImageEncryptionUnknown means the image is not encrypted, or the
// metadata of the image can not be fetched.
rbdImageEncryptionUnknown = rbdEncryptionState("")
// rbdImageEncrypted is set in the image metadata after the image has
// been formatted with cryptsetup. Future usage of the image should
// unlock the image before mounting.
rbdImageEncrypted = rbdEncryptionState("encrypted")
// rbdImageEncryptionPrepared gets set in the image metadata once the
// passphrase for the image has been generated and stored in the KMS.
// When using the image for the first time, it needs to be encrypted
// with cryptsetup before updating the state to `rbdImageEncrypted`.
rbdImageEncryptionPrepared = rbdEncryptionState("encryptionPrepared")
// rbdImageRequiresEncryption has been deprecated, it is used only for
// volumes that have been created with an old provisioner, were never
// attached/mounted and now get staged by a new node-plugin
// TODO: remove this backwards compatibility support
rbdImageRequiresEncryption = rbdEncryptionState("requiresEncryption")
// image metadata key for encryption
@ -39,13 +58,16 @@ const (
// checkRbdImageEncrypted verifies if rbd image was encrypted when created.
func (rv *rbdVolume) checkRbdImageEncrypted(ctx context.Context) (rbdEncryptionState, error) {
value, err := rv.GetMetadata(encryptionMetaKey)
if err != nil {
util.ErrorLog(ctx, "checking image %s encrypted state metadata failed: %s", rv, err)
if errors.Is(err, librbd.ErrNotFound) {
util.DebugLog(ctx, "image %s encrypted state not set", rv.String())
return rbdImageEncryptionUnknown, nil
} else if err != nil {
util.ErrorLog(ctx, "checking image %s encrypted state metadata failed: %s", rv.String(), err)
return rbdImageEncryptionUnknown, err
}
encrypted := rbdEncryptionState(strings.TrimSpace(value))
util.DebugLog(ctx, "image %s encrypted state metadata reports %q", rv, encrypted)
util.DebugLog(ctx, "image %s encrypted state metadata reports %q", rv.String(), encrypted)
return encrypted, nil
}
@ -69,7 +91,7 @@ func (rv *rbdVolume) setupEncryption(ctx context.Context) error {
return err
}
err = rv.ensureEncryptionMetadataSet(rbdImageRequiresEncryption)
err = rv.ensureEncryptionMetadataSet(rbdImageEncryptionPrepared)
if err != nil {
util.ErrorLog(ctx, "failed to save encryption status, deleting "+
"image %s: %s", rv.String(), err)