mirror of
https://github.com/ceph/ceph-csi.git
synced 2024-09-20 07:29:50 +00:00
9ac7f56400
Use DEKStore API for Fetching and Storing passphrases. Drop the fallback for the old KMS interface that is now provided as DEKStore. The original implementation has been re-used for the DEKStore interface. This also moves GetCryptoPassphrase/StoreNewCryptoPassphrase functions to methods of VolumeEncryption. Signed-off-by: Niels de Vos <ndevos@redhat.com>
75 lines
2.0 KiB
Go
75 lines
2.0 KiB
Go
/*
|
|
Copyright 2019 The Ceph-CSI Authors.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package util
|
|
|
|
import (
|
|
"errors"
|
|
)
|
|
|
|
const (
|
|
// Encryption passphrase location in K8s secrets
|
|
encryptionPassphraseKey = "encryptionPassphrase"
|
|
|
|
// Default KMS type
|
|
defaultKMSType = "default"
|
|
)
|
|
|
|
// SecretsKMS is default KMS implementation that means no KMS is in use.
|
|
type SecretsKMS struct {
|
|
integratedDEK
|
|
|
|
passphrase string
|
|
}
|
|
|
|
// initSecretsKMS initializes a SecretsKMS that uses the passphrase from the
|
|
// secret that is configured for the StorageClass. This KMS provider uses a
|
|
// single (LUKS) passhprase for all volumes.
|
|
func initSecretsKMS(secrets map[string]string) (EncryptionKMS, error) {
|
|
passphraseValue, ok := secrets[encryptionPassphraseKey]
|
|
if !ok {
|
|
return nil, errors.New("missing encryption passphrase in secrets")
|
|
}
|
|
return SecretsKMS{passphrase: passphraseValue}, nil
|
|
}
|
|
|
|
// GetID is returning ID representing default KMS `default`.
|
|
func (kms SecretsKMS) GetID() string {
|
|
return defaultKMSType
|
|
}
|
|
|
|
// Destroy frees all used resources.
|
|
func (kms SecretsKMS) Destroy() {
|
|
// nothing to do
|
|
}
|
|
|
|
// FetchDEK returns passphrase from Kubernetes secrets.
|
|
func (kms SecretsKMS) FetchDEK(key string) (string, error) {
|
|
return kms.passphrase, nil
|
|
}
|
|
|
|
// StoreDEK does nothing, as there is no passphrase per key (volume), so
|
|
// no need to store is anywhere.
|
|
func (kms SecretsKMS) StoreDEK(key, value string) error {
|
|
return nil
|
|
}
|
|
|
|
// RemoveDEK is doing nothing as no new passphrases are saved with
|
|
// SecretsKMS.
|
|
func (kms SecretsKMS) RemoveDEK(key string) error {
|
|
return nil
|
|
}
|