mirrors/ceph-csi
1
0
Fork 0
mirror of https://github.com/ceph/ceph-csi.git synced 2025-06-13 02:33:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

Reduce encryption KMS configuration SC parameters

Browse Source 
* moves KMS type from StorageClass into KMS configuration itself
 * updates omapval used to identify KMS to only it's ID without the type

why?

1. when using multiple KMS configurations (not currently supported)
automated parsing of kms configuration will be failing because some
entries in configs won't comply with the requested type
2. less options are needed in the StorageClass and less data used to
identify the KMS

Signed-off-by: Vasyl Purchel vasyl.purchel@workday.com
Signed-off-by: Andrea Baglioni andrea.baglioni@workday.com
This commit is contained in:
Vasyl Purchel
2020-02-06 16:23:14 +00:00
committed by mergify[bot]
parent 1695c6965d
commit 669dc4536f
11 changed files with 175 additions and 153 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
docs/design/proposals/encrypted-pvc.md
View File

@ -63,10 +63,9 @@ requirement by using dm-crypt module through cryptsetup cli interface.
* StorageClass extended with following parameters:
1. `encrypted` ("true" or "false")
1. `encryptionKMS` (string representing kms of choice)
1. `encryptionKMSID` (string representing kms configuration of choice)
ceph-csi plugin may support different kms vendors with different type of
authentication
1. `encryptionKMSID` (string representing kms configuration)
* New KMS Configuration created.
@ -103,10 +102,9 @@ parameters:
# Encrypt volumes
encrypted: "true"
# The type of kms we want to connect to: Barbican, aws kms or others can be
# supported
encryptionKMS: vault
# String representing a KMS configuration
# Use external key management system for encryption passphrases by specifying
# a unique ID matching KMS ConfigMap. The ID is only used for correlation to
# config map entry.
encryptionKMSID: <kms-id>
reclaimPolicy: Delete
@ -120,12 +118,12 @@ apiVersion: v1
kind: ConfigMap
data:
config.json: |-
[
{
"kmsID": "<kms-id>",
{
"<kms-id>": {
"encryptionKMSType": "kmsType",
kms specific config...
}
]
}
metadata:
name: ceph-csi-encryption-kms-config
```