mirrors/ceph-csi
1
0
Fork 0
mirror of https://github.com/ceph/ceph-csi.git synced 2024-09-19 15:09:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

rbd: implement the DEKStore interface

Browse Source 
To accommodate storing DEKs outside a KMS, the DEK can be stored in the
metadata of the volume.

Signed-off-by: Niels de Vos <ndevos@redhat.com>
This commit is contained in:
Niels de Vos 2021-02-17 16:55:06 +01:00 committed by mergify[bot]
parent 9ac7f56400
commit e4431edaf9
1 changed files with 32 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
internal/rbd/encryption.go
View File

@ -54,6 +54,10 @@ const (
// image metadata key for encryption
encryptionMetaKey = ".rbd.csi.ceph.com/encrypted"
// metadataDEK is the key in the image metadata where the (encrypted)
// DEK is stored.
metadataDEK = ".rbd.csi.ceph.com/dek"
)
// checkRbdImageEncrypted verifies if rbd image was encrypted when created.
@ -206,3 +210,31 @@ func (rv *rbdVolume) setKMS(kmsID string, credentials map[string]string) error {
return nil
}
// StoreDEK saves the DEK in the metadata, overwrites any existing contents.
func (rv *rbdVolume) StoreDEK(volumeID, dek string) error {
if rv.VolID != volumeID {
return fmt.Errorf("volume %q can not store DEK for %q", rv.String(), volumeID)
}
return rv.SetMetadata(metadataDEK, dek)
}
// FetchDEK reads the DEK from the image metadata.
func (rv *rbdVolume) FetchDEK(volumeID string) (string, error) {
if rv.VolID != volumeID {
return "", fmt.Errorf("volume %q can not fetch DEK for %q", rv.String(), volumeID)
}
return rv.GetMetadata(metadataDEK)
}
// RemoveDEK does not need to remove the DEK from the metadata, the image is
// most likely getting removed.
func (rv *rbdVolume) RemoveDEK(volumeID string) error {
if rv.VolID != volumeID {
return fmt.Errorf("volume %q can not remove DEK for %q", rv.String(), volumeID)
}
return nil
}