Vasyl Purchel 419ad0dd8e Adds per volume encryption with Vault integration ...

- adds proposal document for PVC encryption from PR448
- adds per-volume encription by generating encryption passphrase
  for each volume and storing it in a KMS
- adds HashiCorp Vault integration as a KMS for encryption passphrases
- avoids encrypting volume second time if it was already encrypted but
  no file system created
- avoids unnecessary checks if volume is a mapped device when encryption
  was not requested
- prevents resizing encrypted volumes (it is not currently supported)
- prevents creating snapshots from encrypted volumes to prevent attack
  on encryption key (security guard until re-encryption of volumes
  implemented)

Signed-off-by: Vasyl Purchel vasyl.purchel@workday.com
Signed-off-by: Andrea Baglioni andrea.baglioni@workday.com

Fixes #420
Fixes #744

2020-02-05 05:18:56 +00:00

..

cachepersister.go

provide option to set pluginpath for cephfs

2019-07-25 14:47:42 +05:30

cephcmds.go

Adds PVC encryption with LUKS

2019-12-16 08:12:44 +00:00

cephconf.go

Avoid keyring message while logging

2019-07-25 09:48:09 +00:00

credentials.go

Add a check for nil secrets

2019-09-27 05:10:01 +00:00

crypto.go

Adds per volume encryption with Vault integration

2020-02-05 05:18:56 +00:00

cryptsetup.go

Adds PVC encryption with LUKS

2019-12-16 08:12:44 +00:00

csiconfig_test.go

Removed config maps and replaced with rados omaps

2019-05-19 12:29:33 +00:00

csiconfig.go

Removed config maps and replaced with rados omaps

2019-05-19 12:29:33 +00:00

errors.go

Refactor voljournal to aid reuse with CephFS

2019-05-30 09:58:40 +00:00

httpserver.go

implement grpc metrics for ceph-csi

2019-08-30 06:50:32 +00:00

idlocker_test.go

Change the logic of locking

2019-09-20 07:37:17 +00:00

idlocker.go

Change the logic of locking

2019-09-20 07:37:17 +00:00

k8scmcache.go

Enable all static-checks in golangci-lint

2019-06-10 15:56:17 +05:30

log.go

Add req-ID to logging

2019-09-11 13:45:40 +00:00

nodecache.go

discard umount error if directory is not mounted

2019-12-17 13:33:41 +00:00

pidlimit_test.go

provisioners: add reconfiguring of PID limit

2019-08-13 14:43:29 +00:00

pidlimit.go

Address security concerns reported by 'gosec'

2019-09-04 11:48:37 +00:00

stripsecrets.go

Use --keyfile option to pass keys to all Ceph CLIs

2019-07-25 12:46:15 +00:00

util_test.go

Fix volsize for cephfs and rbd

2019-10-11 08:22:27 +00:00

util.go

Update to kube v1.17

2020-01-17 12:06:02 +00:00

validate.go

Move mounting staging instance to a sub-path within staging path

2019-08-13 14:07:52 +00:00

vault.go

Adds per volume encryption with Vault integration

2020-02-05 05:18:56 +00:00

volid_test.go

Make CephFS plugin stateless reusing RADOS based journal scheme

2019-05-30 06:20:35 -04:00

volid.go

Enable all static-checks in golangci-lint

2019-06-10 15:56:17 +05:30

voljournal.go

Adds per volume encryption with Vault integration

2020-02-05 05:18:56 +00:00