0ff2c0086c
Initially Ic155bd29d46059832cce970bf60375e7e472eca6 had aimed to remove these legacy provider names during the Pike cycle. While removing references to these names in Tempest via Id221414d74af8413084c7935b762f93b7ce43c42 it was highlighted that this wouldn't be possible until Queens and the eventual EOL of Newton. This change simply updates the logged deprecation warnings and adds a new releasenote highlighting that these legancy provider names will remain until Queens. Change-Id: Ib8ca7ecb5494cd4fcae0657525d4c17bfc4ae37e
128 lines
5.0 KiB
Python
128 lines
5.0 KiB
Python
# Copyright (c) 2013 The Johns Hopkins University/Applied Physics Laboratory
|
|
# All Rights Reserved.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
# not use this file except in compliance with the License. You may obtain
|
|
# a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
# License for the specific language governing permissions and limitations
|
|
# under the License.
|
|
|
|
from os_brick.encryptors import nop
|
|
|
|
from oslo_log import log as logging
|
|
from oslo_utils import importutils
|
|
from oslo_utils import strutils
|
|
|
|
LOG = logging.getLogger(__name__)
|
|
|
|
LUKS = "luks"
|
|
PLAIN = "plain"
|
|
|
|
FORMAT_TO_FRONTEND_ENCRYPTOR_MAP = {
|
|
LUKS: 'os_brick.encryptors.luks.LuksEncryptor',
|
|
PLAIN: 'os_brick.encryptors.cryptsetup.CryptsetupEncryptor'
|
|
}
|
|
|
|
LEGACY_PROVIDER_CLASS_TO_FORMAT_MAP = {
|
|
"nova.volume.encryptors.luks.LuksEncryptor": LUKS,
|
|
"nova.volume.encryptors.cryptsetup.CryptsetupEncryptor": PLAIN,
|
|
"nova.volume.encryptors.nop.NoopEncryptor": None,
|
|
"os_brick.encryptors.luks.LuksEncryptor": LUKS,
|
|
"os_brick.encryptors.cryptsetup.CryptsetupEncryptor": PLAIN,
|
|
"os_brick.encryptors.nop.NoopEncryptor": None,
|
|
"LuksEncryptor": LUKS,
|
|
"CryptsetupEncryptor": PLAIN,
|
|
"NoOpEncryptor": None,
|
|
}
|
|
|
|
|
|
def get_volume_encryptor(root_helper,
|
|
connection_info,
|
|
keymgr,
|
|
execute=None,
|
|
*args, **kwargs):
|
|
"""Creates a VolumeEncryptor used to encrypt the specified volume.
|
|
|
|
:param: the connection information used to attach the volume
|
|
:returns VolumeEncryptor: the VolumeEncryptor for the volume
|
|
"""
|
|
encryptor = nop.NoOpEncryptor(root_helper=root_helper,
|
|
connection_info=connection_info,
|
|
keymgr=keymgr,
|
|
execute=execute,
|
|
*args, **kwargs)
|
|
|
|
location = kwargs.get('control_location', None)
|
|
if location and location.lower() == 'front-end': # case insensitive
|
|
provider = kwargs.get('provider')
|
|
|
|
# TODO(lyarwood): Remove the following in Queens and raise an
|
|
# ERROR if provider is not a key in SUPPORTED_ENCRYPTION_PROVIDERS.
|
|
# Until then continue to allow both the class name and path to be used.
|
|
if provider in LEGACY_PROVIDER_CLASS_TO_FORMAT_MAP:
|
|
LOG.warning("Use of the in tree encryptor class %(provider)s"
|
|
" by directly referencing the implementation class"
|
|
" will be blocked in the Queens release of"
|
|
" os-brick.", {'provider': provider})
|
|
provider = LEGACY_PROVIDER_CLASS_TO_FORMAT_MAP[provider]
|
|
|
|
if provider in FORMAT_TO_FRONTEND_ENCRYPTOR_MAP:
|
|
provider = FORMAT_TO_FRONTEND_ENCRYPTOR_MAP[provider]
|
|
elif provider is None:
|
|
provider = "os_brick.encryptors.nop.NoOpEncryptor"
|
|
else:
|
|
LOG.warning("Use of the out of tree encryptor class "
|
|
"%(provider)s will be blocked with the Queens "
|
|
"release of os-brick.", {'provider': provider})
|
|
|
|
try:
|
|
encryptor = importutils.import_object(
|
|
provider,
|
|
root_helper,
|
|
connection_info,
|
|
keymgr,
|
|
execute,
|
|
**kwargs)
|
|
except Exception as e:
|
|
LOG.error("Error instantiating %(provider)s: %(exception)s",
|
|
{'provider': provider, 'exception': e})
|
|
raise
|
|
|
|
msg = ("Using volume encryptor '%(encryptor)s' for connection: "
|
|
"%(connection_info)s" %
|
|
{'encryptor': encryptor, 'connection_info': connection_info})
|
|
LOG.debug(strutils.mask_password(msg))
|
|
|
|
return encryptor
|
|
|
|
|
|
def get_encryption_metadata(context, volume_api, volume_id, connection_info):
|
|
metadata = {}
|
|
if ('data' in connection_info and
|
|
connection_info['data'].get('encrypted', False)):
|
|
try:
|
|
metadata = volume_api.get_volume_encryption_metadata(context,
|
|
volume_id)
|
|
if not metadata:
|
|
LOG.warning('Volume %s should be encrypted but there is no '
|
|
'encryption metadata.', volume_id)
|
|
except Exception as e:
|
|
LOG.error("Failed to retrieve encryption metadata for "
|
|
"volume %(volume_id)s: %(exception)s",
|
|
{'volume_id': volume_id, 'exception': e})
|
|
raise
|
|
|
|
if metadata:
|
|
msg = ("Using volume encryption metadata '%(metadata)s' for "
|
|
"connection: %(connection_info)s" %
|
|
{'metadata': metadata, 'connection_info': connection_info})
|
|
LOG.debug(strutils.mask_password(msg))
|
|
|
|
return metadata
|