Add hw_ephemeral_encryption_secret_uuid image property

If an image is encrypted, we will need to retrieve the passphrase from
the key manager service in order to create an instance from it.

This adds an image property to store the secret UUID that belongs to
the image. It will only be used to decrypt the image and will not be
used to encrypt or decrypt any other image. Nova will create a new
secret for each disk image it creates, including snapshots.

Related to blueprint ephemeral-storage-encryption

Change-Id: I01eef6adc2c8feb64e86b33392b8b4b483041e27

nova/notifications/objects/image.py

@@ -133,9 +133,6 @@ class ImageMetaPropsPayload(base.NotificationPayloadBase):
     # Version 1.13: Added 'hw_virtio_packed_ring' field
     VERSION = '1.13'
 
-    SCHEMA = {
-        k: ('image_meta_props', k) for k in image_meta.ImageMetaProps.fields}
-
     # NOTE(efried): This logic currently relies on all of the fields of
     # ImageMetaProps being initialized with no arguments. See the docstring.
     # NOTE(efried): It's possible this could just be:
@@ -143,7 +140,11 @@ class ImageMetaPropsPayload(base.NotificationPayloadBase):
     #  But it is not clear that OVO can tolerate the same *instance* of a type
     #  class being used in more than one place.
     fields = {
-        k: v.__class__() for k, v in image_meta.ImageMetaProps.fields.items()}
+        k: v.__class__() for k, v in image_meta.ImageMetaProps.fields.items()
+            if k not in ('hw_ephemeral_encryption_secret_uuid',)}
+
+    SCHEMA = {
+        k: ('image_meta_props', k) for k in fields}
 
     def __init__(self, image_meta_props):
         super(ImageMetaPropsPayload, self).__init__()

nova/objects/image_meta.py

@@ -195,14 +195,17 @@ class ImageMetaProps(base.NovaObject):
     # Version 1.35: Added 'hw_virtio_packed_ring' field
     # Version 1.36: Added 'hw_maxphysaddr_mode' and
     #                     'hw_maxphysaddr_bits' field
+    # Version 1.37: Added 'hw_ephemeral_encryption_secret_uuid' field
     # NOTE(efried): When bumping this version, the version of
     # ImageMetaPropsPayload must also be bumped. See its docstring for details.
-    VERSION = '1.36'
+    VERSION = '1.37'
 
     def obj_make_compatible(self, primitive, target_version):
         super(ImageMetaProps, self).obj_make_compatible(primitive,
                                                         target_version)
         target_version = versionutils.convert_version_to_tuple(target_version)
+        if target_version < (1, 37):
+            primitive.pop('hw_ephemeral_encryption_secret_uuid', None)
         if target_version < (1, 36):
             primitive.pop('hw_maxphysaddr_mode', None)
             primitive.pop('hw_maxphysaddr_bits', None)
@@ -480,6 +483,8 @@ class ImageMetaProps(base.NovaObject):
         # encryption format to be used when ephemeral encryption is enabled
         'hw_ephemeral_encryption_format':
             fields.BlockDeviceEncryptionFormatTypeField(),
+        # encryption secret uuid string for passphrase in the image
+        'hw_ephemeral_encryption_secret_uuid': fields.UUIDField(),
 
         # boolean - If true, this will enable the virtio packed ring feature
         'hw_virtio_packed_ring': fields.FlexibleBooleanField(),

nova/tests/unit/objects/test_image_meta.py

@@ -14,6 +14,8 @@
 
 import datetime
 
+from oslo_utils.fixture import uuidsentinel as uuids
+
 from nova import exception
 from nova import objects
 from nova.objects import fields
@@ -570,3 +572,22 @@ class TestImageMetaProps(test.NoDBTestCase):
         # and is absent on older versions
         primitive = obj.obj_to_primitive('1.33')
         self.assertNotIn('hw_viommu_model', primitive['nova_object.data'])
+
+    def test_obj_make_compatible_ephemeral_encryption_secret_uuid(self):
+        """Check 'hw_ephemeral_encryption_secret_uuid' compatibility."""
+        obj = objects.ImageMetaProps(
+            hw_ephemeral_encryption_secret_uuid=uuids.secret)
+
+        primitive = obj.obj_to_primitive('1.37')
+        self.assertIn(
+            'hw_ephemeral_encryption_secret_uuid',
+            primitive['nova_object.data'])
+        self.assertEqual(
+            uuids.secret,
+            primitive[
+                'nova_object.data']['hw_ephemeral_encryption_secret_uuid'])
+
+        primitive = obj.obj_to_primitive('1.36')
+        self.assertNotIn(
+            'hw_ephemeral_encryption_secret_uuid',
+            primitive['nova_object.data'])

nova/tests/unit/objects/test_objects.py

@@ -1105,7 +1105,7 @@ object_data = {
     'HyperVLiveMigrateData': '1.4-e265780e6acfa631476c8170e8d6fce0',
     'IDEDeviceBus': '1.0-29d4c9f27ac44197f01b6ac1b7e16502',
     'ImageMeta': '1.8-642d1b2eb3e880a367f37d72dd76162d',
-    'ImageMetaProps': '1.36-5d06cd527d8d32e6e2b457ce3b9369e0',
+    'ImageMetaProps': '1.37-1e0d70fb51041c0446b00695c5ef0e21',
     'Instance': '2.8-2727dba5e4a078e6cc848c1f94f7eb24',
     'InstanceAction': '1.2-9a5abc87fdd3af46f45731960651efb5',
     'InstanceActionEvent': '1.4-5b1f361bd81989f8bb2c20bb7e8a4cb4',