mirrors/ceph-csi
1
0
Fork 0
mirror of https://github.com/ceph/ceph-csi.git synced 2024-09-19 15:09:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

rbd: modify copyEncryptionConfig to accept copyOnlyPassphrase arg

Browse Source 
During PVC snapshot/clone both kms config and passphrase needs to copied,
while for PVC restore only passphrase needs to be copied to dest rbdvol
since destination storageclass may have another kms config.

Signed-off-by: Rakshith R <rar@redhat.com>
This commit is contained in:
Rakshith R 2021-09-28 10:36:20 +05:30 committed by mergify[bot]
parent 3c9d7e3cd5
commit 59b7a26175
5 changed files with 16 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
internal/rbd/clone.go
View File

@ -161,7 +161,7 @@ func (rv *rbdVolume) createCloneFromImage(ctx context.Context, parentVol *rbdVol
}
if parentVol.isEncrypted() {
err = parentVol.copyEncryptionConfig(&rv.rbdImage)
err = parentVol.copyEncryptionConfig(&rv.rbdImage, false)
if err != nil {
return fmt.Errorf("failed to copy encryption config for %q: %w", rv, err)
}

4
internal/rbd/controllerserver.go
View File

@ -1105,7 +1105,7 @@ func cloneFromSnapshot(
defer vol.Destroy()
if rbdVol.isEncrypted() {
err = rbdVol.copyEncryptionConfig(&vol.rbdImage)
err = rbdVol.copyEncryptionConfig(&vol.rbdImage, false)
if err != nil {
return nil, status.Error(codes.Internal, err.Error())
}
@ -1224,7 +1224,7 @@ func (cs *ControllerServer) doSnapshotClone(
}()
if parentVol.isEncrypted() {
cryptErr := parentVol.copyEncryptionConfig(&cloneRbd.rbdImage)
cryptErr := parentVol.copyEncryptionConfig(&cloneRbd.rbdImage, false)
if cryptErr != nil {
log.WarningLog(ctx, "failed copy encryption "+
"config for %q: %v", cloneRbd, cryptErr)

16
internal/rbd/encryption.go
View File

@ -123,7 +123,11 @@ func (ri *rbdImage) setupEncryption(ctx context.Context) error {
// rbdImage to the passed argument. This function re-encrypts the passphrase
// from the original, so that both encrypted passphrases (potentially, depends
// on the DEKStore) have different contents.
func (ri *rbdImage) copyEncryptionConfig(cp *rbdImage) error {
// When copyOnlyPassphrase is set to true, only the passphrase is copied to the
// destination rbdImage's VolumeEncryption object which needs to be initialized
// beforehand and is possibly different from the source VolumeEncryption
// (Usecase: Restoring snapshot into a storageclass with different encryption config).
func (ri *rbdImage) copyEncryptionConfig(cp *rbdImage, copyOnlyPassphrase bool) error {
if ri.VolID == cp.VolID {
return fmt.Errorf("BUG: %q and %q have the same VolID (%s) "+
"set!? Call stack: %s", ri, cp, ri.VolID, util.CallStack())
@ -136,9 +140,11 @@ func (ri *rbdImage) copyEncryptionConfig(cp *rbdImage) error {
ri, err)
}
cp.encryption, err = util.NewVolumeEncryption(ri.encryption.GetID(), ri.encryption.KMS)
if errors.Is(err, util.ErrDEKStoreNeeded) {
cp.encryption.SetDEKStore(cp)
if !copyOnlyPassphrase {
cp.encryption, err = util.NewVolumeEncryption(ri.encryption.GetID(), ri.encryption.KMS)
if errors.Is(err, util.ErrDEKStoreNeeded) {
cp.encryption.SetDEKStore(cp)
}
}
// re-encrypt the plain passphrase for the cloned volume
@ -178,7 +184,7 @@ func (ri *rbdImage) repairEncryptionConfig(dest *rbdImage) error {
dest.conn = ri.conn.Copy()
}
return ri.copyEncryptionConfig(dest)
return ri.copyEncryptionConfig(dest, false)
}
return nil

2
internal/rbd/rbd_journal.go
View File

@ -334,7 +334,7 @@ func (rv *rbdVolume) Exists(ctx context.Context, parentVol *rbdVolume) (bool, er
}
if parentVol != nil && parentVol.isEncrypted() {
err = parentVol.copyEncryptionConfig(&rv.rbdImage)
err = parentVol.copyEncryptionConfig(&rv.rbdImage, false)
if err != nil {
log.ErrorLog(ctx, err.Error())

2
internal/rbd/rbd_util.go
View File

@ -1400,7 +1400,7 @@ func (rv *rbdVolume) cloneRbdImageFromSnapshot(
if pSnapOpts.isEncrypted() {
pSnapOpts.conn = rv.conn.Copy()
err = pSnapOpts.copyEncryptionConfig(&rv.rbdImage)
err = pSnapOpts.copyEncryptionConfig(&rv.rbdImage, true)
if err != nil {
return fmt.Errorf("failed to clone encryption config: %w", err)
}