RBD Volume Encryption¶
This feature adds support to the Cinder RBD volume driver to support Cinder’s volume encryption.
This requires a few changes in Cinder and Nova due to the fact that RBD volumes are attached by qemu directly and not as block devices on the host.
This fills a feature gap for the RBD driver in Cinder.
The RBD driver does not support volume encryption.
Volume encryption is a common requirement for deployments, particularly where a deployer needs to meet particular security standards.
Enable volume encryption for RBD via qemu’s LUKS block layer.
This means that Nova has to support libvirt operations to manage this qemu feature. This is done here:
We also need Cinder to format volumes upon creation with a LUKS header. This is currently done by os-brick for iSCSI drivers, but can’t be done in the same way for RBD since there is no block device on the compute host, and dm-crypt is not used.
(Note: this will also be true when using qemu’s iSCSI initiator with Nova)
Data model impact¶
REST API impact¶
This is a security-focused feature, but it uses the already existing infrastructure of Cinder volume encryption.
The way encryption works when using RBD is slightly different from other Cinder drivers. Decryption/encryption is handled inside of qemu rather than at the device-mapper layer on the host via dm-crypt.
This means fewer operations having to be run as root, and less exposure of decrypted data to the rest of the system via block devices.
But, the feature in general has the same security implications as cinder volume encryption does for other drivers.
Other end user impact¶
Using encryption could result in slightly higher CPU usage on compute nodes. Should be comparable to using encryption with any other Cinder driver.
Other deployer impact¶
- Primary assignee:
- Other contributors:
Nova changes here: - https://blueprints.launchpad.net/nova/+spec/libvirt-qemu-native-luks
This feature will be covered by the standard tempest tests used for all volume drivers.
- Gate configuration issues are being sorted out here:
Document that volume encryption now works for the RBD volume driver
Current limitation: attached volume migration is not supported