cinder/bp-nfs-volume-encryption-3d8362843caeb39c.yaml at 5402ac8e2d30872b526c3ac7d9f10645452fbf66 - cinder - OpenDev: Free Software Needs Free Tools

openstack/cinder

Eric Harney 44c7da9a44 NFS encrypted volume support

Volume encryption helps provide basic data protection in
case the volume back-end is either compromised or outright
stolen. The contents of an encrypted volume can only be
read with the use of a specific key;

Volume encryption: Check volume encryption key in
'_do_create_volume' method (remotefs) and use
'_create_encrypted_volume_file' when encryption is
required.

Snapshot encryption: To create an encrypted volume from a
snapshot, we need to pass the Barbican key of the
snapshot.volume to 'convert_image' method. Because of this
I've added 'src_passphrase_file' parameter.

This patch doesn't handle encrypted volume -> unencrypted
Current error prompted: 'Invalid input received: Invalid
volume_type provided: aeac5517-6bc8-4b59-9eb2-76e84369bd0
(requested type is not compatible; recommend omitting the
type argument). (HTTP 400)'

Implements: blueprint nfs-volume-encryption
Co-Authored-By: Sofia Enriquez <lsofia.enriquez@gmail.com>

Change-Id: I896f70d204ad103e968ab242ba9045ca984827c4

2020-06-23 22:00:05 +00:00

5 lines

87 B

YAML

Raw Blame History

 ---
 features:
   - |
     The NFS driver now supports the creation of encrypted volumes.