mirror of
https://github.com/ceph/ceph-csi.git
synced 2024-11-10 00:10:20 +00:00
419ad0dd8e
- adds proposal document for PVC encryption from PR448 - adds per-volume encription by generating encryption passphrase for each volume and storing it in a KMS - adds HashiCorp Vault integration as a KMS for encryption passphrases - avoids encrypting volume second time if it was already encrypted but no file system created - avoids unnecessary checks if volume is a mapped device when encryption was not requested - prevents resizing encrypted volumes (it is not currently supported) - prevents creating snapshots from encrypted volumes to prevent attack on encryption key (security guard until re-encryption of volumes implemented) Signed-off-by: Vasyl Purchel vasyl.purchel@workday.com Signed-off-by: Andrea Baglioni andrea.baglioni@workday.com Fixes #420 Fixes #744
15 lines
421 B
YAML
15 lines
421 B
YAML
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: {{ .Values.kmsConfigMapName | quote }}
|
|
namespace: {{ .Release.Namespace }}
|
|
labels:
|
|
app: {{ include "ceph-csi-rbd.name" . }}
|
|
chart: {{ include "ceph-csi-rbd.chart" . }}
|
|
component: {{ .Values.nodeplugin.name }}
|
|
release: {{ .Release.Name }}
|
|
heritage: {{ .Release.Service }}
|
|
data:
|
|
config.json: |-
|
|
{{ toJson .Values.encryptionKMSConfig | indent 4 -}}
|