Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

RBD fscrypt support #3310

Merged
merged 35 commits into from
Oct 17, 2022
Merged

RBD fscrypt support #3310

merged 35 commits into from
Oct 17, 2022

Commits on Oct 17, 2022

  1. util: Make encryption passphrase size a parameter 

    fscrypt support requires keys longer than 20 bytes. As a preparation,
make the new passphrase length configurable, but default to 20 bytes.

Signed-off-by: Marcel Lauhoff <marcel.lauhoff@suse.com>
    @irq0 @mergify
    irq0 authored and mergify[bot] committed Oct 17, 2022
    Configuration menu
    Copy the full SHA
    33fffa3 View commit details
    Browse the repository at this point in the history

  2. util: Add util to fetch encryption type from vol options 

    Fetch encryption type from vol options. Make fallback type
configurable to support RBD (default block) and Ceph FS (default file)

Signed-off-by: Marcel Lauhoff <marcel.lauhoff@suse.com>
    @mergify
    Marcel Lauhoff authored and mergify[bot] committed Oct 17, 2022
    Configuration menu
    Copy the full SHA
    20081ca View commit details
    Browse the repository at this point in the history

  3. kms: Add GetSecret() to metadata KMS 

    Add GetSecret() to allow direct access to passphrases without KDF and
wrapping by a DEKStore.

This will be used by fscrypt, which has its own KDF and wrapping. It
will allow users to take a k8s secret, for example, and use that
directly as a password in fscrypt.

Signed-off-by: Marcel Lauhoff <marcel.lauhoff@suse.com>
    @mergify
    Marcel Lauhoff authored and mergify[bot] committed Oct 17, 2022
    Configuration menu
    Copy the full SHA
    9b0cdf4 View commit details
    Browse the repository at this point in the history

  4. kms: testing: add KMS test dummy registry 

    Add registry similar to the providers one. This allows testers to
add and use GetKMSTestDummy() to create stripped down provider
instances suitable for use in unit tests.

Signed-off-by: Marcel Lauhoff <marcel.lauhoff@suse.com>
    @mergify
    Marcel Lauhoff authored and mergify[bot] committed Oct 17, 2022
    Configuration menu
    Copy the full SHA
    7f083c2 View commit details
    Browse the repository at this point in the history

  5. kms: Add basic GetSecret() test 

    Add rudimentary test to ensure that we can get a valid passphrase from
the GetSecret() feature

Signed-off-by: Marcel Lauhoff <marcel.lauhoff@suse.com>
    @mergify
    Marcel Lauhoff authored and mergify[bot] committed Oct 17, 2022
    Configuration menu
    Copy the full SHA
    2f57e5e View commit details
    Browse the repository at this point in the history

  6. rbd: Rename encryption to blockEncryption prep for fscrypt 

    In preparation of fscrypt support for RBD filesystems, rename block
encryption related function to include the word 'block'. Add struct
fields and IsFileEncrypted.

Signed-off-by: Marcel Lauhoff <marcel.lauhoff@suse.com>
    @mergify
    Marcel Lauhoff authored and mergify[bot] committed Oct 17, 2022
    Configuration menu
    Copy the full SHA
    0551c0b View commit details
    Browse the repository at this point in the history

  7. journal: Store encryptionType in Config struct 

    Add encryptionType next to kmsID to support both block and file
encryption.

Signed-off-by: Marcel Lauhoff <marcel.lauhoff@suse.com>
    @mergify
    Marcel Lauhoff authored and mergify[bot] committed Oct 17, 2022
    Configuration menu
    Copy the full SHA
    8827105 View commit details
    Browse the repository at this point in the history

  8. fscrypt: fscrypt integration 

    Integrate google/fscrypt into Ceph CSI KMS and encryption setup. Adds
dependencies to google/fscrypt and pkg/xattr. Be as generic as
possible to support integration with both RBD and Ceph FS.

Add the following public functions:

InitializeNode: per-node initialization steps. Must be called
before Unlock at least once.

Unlock: All steps necessary to unlock an encrypted directory including
setting it up initially.

IsDirectoryUnlocked: Test if directory is really encrypted

Signed-off-by: Marcel Lauhoff <marcel.lauhoff@suse.com>
    @mergify
    Marcel Lauhoff authored and mergify[bot] committed Oct 17, 2022
    Configuration menu
    Copy the full SHA
    259b4d0 View commit details
    Browse the repository at this point in the history

  9. vendor: vendor fscrypt integration dependencies 

    Signed-off-by: Marcel Lauhoff <marcel.lauhoff@suse.com>
    @mergify
    Marcel Lauhoff authored and mergify[bot] committed Oct 17, 2022
    Configuration menu
    Copy the full SHA
    ea13d57 View commit details
    Browse the repository at this point in the history

  10. fscrypt: Unlock: Fetch keys early 

    Fetch keys from KMS before doing anything else. This will catch KMS
errors before setting up any fscrypt metadata.

Signed-off-by: Marcel Lauhoff <marcel.lauhoff@suse.com>
    @mergify
    Marcel Lauhoff authored and mergify[bot] committed Oct 17, 2022
    Configuration menu
    Copy the full SHA
    13073f0 View commit details
    Browse the repository at this point in the history

  11. fscrypt: Fetch passphrase when keyFn is invoked not created 

    Fetch password when keyFn is invoked, not when it is created. This
allows creation of the keyFn before actually creating the passphrase.

Signed-off-by: Marcel Lauhoff <marcel.lauhoff@suse.com>
    @mergify
    Marcel Lauhoff authored and mergify[bot] committed Oct 17, 2022
    Configuration menu
    Copy the full SHA
    3d9cd65 View commit details
    Browse the repository at this point in the history

  12. fscrypt: Determine best supported fscrypt policy on node init 

    Currently fscrypt supports policies version 1 and 2. 2 is the best
choice and was the only choice prior to this commit. This adds support
for kernels < 5.4, by selecting policy version 1 there.

Signed-off-by: Marcel Lauhoff <marcel.lauhoff@suse.com>
    @mergify
    Marcel Lauhoff authored and mergify[bot] committed Oct 17, 2022
    Configuration menu
    Copy the full SHA
    e165c9e View commit details
    Browse the repository at this point in the history

  13. fscrypt: Update mount info before create context 

    NewContextFrom{Mountpoint,Path} functions use cached
`/proc/self/mountinfo` to find mounted file systems by device ID.
Since we run fscrypt as a library in a long-lived process the cached
information is likely to be stale. Stale entries may map device IDs to
mount points of already destroyed RBDs and fail context creation.
Updating the cache beforehand prevents this.

Signed-off-by: Marcel Lauhoff <marcel.lauhoff@suse.com>
    @mergify
    Marcel Lauhoff authored and mergify[bot] committed Oct 17, 2022
    Configuration menu
    Copy the full SHA
    1d781fd View commit details
    Browse the repository at this point in the history

  14. fscrypt: Use constant protector name 

    Use constant protector name 'ceph-csi' instead of constant prefix
concatenated with the volume ID. When cloning volumes the ID changes
and fscrypt protected directories become inunlockable due to the
protector name change

Signed-off-by: Marcel Lauhoff <marcel.lauhoff@suse.com>
    @mergify
    Marcel Lauhoff authored and mergify[bot] committed Oct 17, 2022
    Configuration menu
    Copy the full SHA
    bfd397d View commit details
    Browse the repository at this point in the history

  15. fscrypt: fsync encrypted dir after setting policy [workaround] 

    Revert once our google/fscrypt dependency is upgraded to a version
that includes google/fscrypt#359 gets accepted

Signed-off-by: Marcel Lauhoff <marcel.lauhoff@suse.com>
    @mergify
    Marcel Lauhoff authored and mergify[bot] committed Oct 17, 2022
    Configuration menu
    Copy the full SHA
    c63133e View commit details
    Browse the repository at this point in the history

  16. fscrypt: fix metadata directory permissions 

    Call Mount.Setup with SingleUserWritable constant instead of 0o755,
which is silently ignored and causes the /.fscrypt/{policy,protector}/
directories to have mode 000.

Signed-off-by: Marcel Lauhoff <marcel.lauhoff@suse.com>
    @mergify
    Marcel Lauhoff authored and mergify[bot] committed Oct 17, 2022
    Configuration menu
    Copy the full SHA
    802d766 View commit details
    Browse the repository at this point in the history

  17. rbd: fscrypt file encryption support 

    Integrate basic fscrypt functionality into RBD initialization. To
activate file encryption instead of block introduce the new
'encryptionType' storage class key.

Signed-off-by: Marcel Lauhoff <marcel.lauhoff@suse.com>
    @mergify
    Marcel Lauhoff authored and mergify[bot] committed Oct 17, 2022
    Configuration menu
    Copy the full SHA
    65c8787 View commit details
    Browse the repository at this point in the history

  18. rbd: Handle encryption type default at a more meaningful place 

    Different places have different meaningful fallback. When parsing
from user we should default to block, when parsing stored config we
should default to invalid and handle that as an error.

Signed-off-by: Marcel Lauhoff <marcel.lauhoff@suse.com>
    @mergify
    Marcel Lauhoff authored and mergify[bot] committed Oct 17, 2022
    Configuration menu
    Copy the full SHA
    d8e94c3 View commit details
    Browse the repository at this point in the history

  19. rbd: Document new encryptionType storage class example 

    Signed-off-by: Marcel Lauhoff <marcel.lauhoff@suse.com>
    @mergify
    Marcel Lauhoff authored and mergify[bot] committed Oct 17, 2022
    Configuration menu
    Copy the full SHA
    8e49c77 View commit details
    Browse the repository at this point in the history

  20. rbd: Add volume journal encryption support 

    Add fscrypt support to the journal to support operations like
snapshotting.

Signed-off-by: Marcel Lauhoff <marcel.lauhoff@suse.com>
    @mergify
    Marcel Lauhoff authored and mergify[bot] committed Oct 17, 2022
    Configuration menu
    Copy the full SHA
    ca3fabe View commit details
    Browse the repository at this point in the history

  21. rbd: support file encrypted snapshots 

    Support fscrypt on RBD snapshots

Signed-off-by: Marcel Lauhoff <marcel.lauhoff@suse.com>
    @mergify
    Marcel Lauhoff authored and mergify[bot] committed Oct 17, 2022
    Configuration menu
    Copy the full SHA
    2bb1f66 View commit details
    Browse the repository at this point in the history

  22. rbd: Add context to fscrypt errors 

    Signed-off-by: Marcel Lauhoff <marcel.lauhoff@suse.com>
    @mergify
    Marcel Lauhoff authored and mergify[bot] committed Oct 17, 2022
    Configuration menu
    Copy the full SHA
    a6c459d View commit details
    Browse the repository at this point in the history

  23. e2e: Add fscrypt on rbd helper 

    Add validation functions for fscrypt on RBD volumes

Signed-off-by: Marcel Lauhoff <marcel.lauhoff@suse.com>
    @mergify
    Marcel Lauhoff authored and mergify[bot] committed Oct 17, 2022
    Configuration menu
    Copy the full SHA
    92ba6c2 View commit details
    Browse the repository at this point in the history

  24. e2e: Add helper to run encryption tests on block and file 

    Add a `By` wrapper to parameterize encryption related test functions
and run them on both block and file encryption

Signed-off-by: Marcel Lauhoff <marcel.lauhoff@suse.com>
    @mergify
    Marcel Lauhoff authored and mergify[bot] committed Oct 17, 2022
    Configuration menu
    Copy the full SHA
    a5a17fd View commit details
    Browse the repository at this point in the history

  25. e2e: Add PVC validator to ByFileAndBlockEncryption 

    Signed-off-by: Marcel Lauhoff <marcel.lauhoff@suse.com>
    @mergify
    Marcel Lauhoff authored and mergify[bot] committed Oct 17, 2022
    Configuration menu
    Copy the full SHA
    d27f137 View commit details
    Browse the repository at this point in the history

  26. e2e: Run encryption related tests on file and block type 

    Replace `By` with `ByFileAndBlockEncryption` in all encryption related
tests to parameterize them to file and block encryption.

Signed-off-by: Marcel Lauhoff <marcel.lauhoff@suse.com>
    @mergify
    Marcel Lauhoff authored and mergify[bot] committed Oct 17, 2022
    Configuration menu
    Copy the full SHA
    656af96 View commit details
    Browse the repository at this point in the history

  27. e2e: Add encrypted PVC with default settings test 

    Add test that enables encryption with default type. Check that we set
up block encryption.

Signed-off-by: Marcel Lauhoff <marcel.lauhoff@suse.com>
    @mergify
    Marcel Lauhoff authored and mergify[bot] committed Oct 17, 2022
    Configuration menu
    Copy the full SHA
    d94e75e View commit details
    Browse the repository at this point in the history

  28. e2e: Apply formatting to rbd suite and helper 

    Apply formatting for previous changes separately to make the commit
diffs easier to read.

Signed-off-by: Marcel Lauhoff <marcel.lauhoff@suse.com>
    @mergify
    Marcel Lauhoff authored and mergify[bot] committed Oct 17, 2022
    Configuration menu
    Copy the full SHA
    b179a13 View commit details
    Browse the repository at this point in the history

  29. e2e: Use utilEncryptionType instead of string in rbd suite 

    Signed-off-by: Marcel Lauhoff <marcel.lauhoff@suse.com>
    @mergify
    Marcel Lauhoff authored and mergify[bot] committed Oct 17, 2022
    Configuration menu
    Copy the full SHA
    e4c561b View commit details
    Browse the repository at this point in the history

  30. kms: Add GetSecret() to KMIP KMS 

    Signed-off-by: Marcel Lauhoff <marcel.lauhoff@suse.com>
    @mergify
    Marcel Lauhoff authored and mergify[bot] committed Oct 17, 2022
    Configuration menu
    Copy the full SHA
    7fa6046 View commit details
    Browse the repository at this point in the history

  31. scripts: Add env to set minikube iso url 

    Make iso url configurable to use pre-release minikube images or
local-built (file://)

Signed-off-by: Marcel Lauhoff <marcel.lauhoff@suse.com>
    @mergify
    Marcel Lauhoff authored and mergify[bot] committed Oct 17, 2022
    Configuration menu
    Copy the full SHA
    829414c View commit details
    Browse the repository at this point in the history

  32. util: Add EncryptionTypeNone and unit tests 

    Add type none to distinguish disabled encryption (positive result)
from invalid configuration (negative result).

Signed-off-by: Marcel Lauhoff <marcel.lauhoff@suse.com>
    @mergify
    Marcel Lauhoff authored and mergify[bot] committed Oct 17, 2022
    Configuration menu
    Copy the full SHA
    12bd495 View commit details
    Browse the repository at this point in the history

  33. rbd: Use EncryptionTypeNone 

    Signed-off-by: Marcel Lauhoff <marcel.lauhoff@suse.com>
    @mergify
    Marcel Lauhoff authored and mergify[bot] committed Oct 17, 2022
    Configuration menu
    Copy the full SHA
    8a23075 View commit details
    Browse the repository at this point in the history

  34. cephfs: Add placeholder journal fscrypt support 

    Signed-off-by: Marcel Lauhoff <marcel.lauhoff@suse.com>
    @mergify
    Marcel Lauhoff authored and mergify[bot] committed Oct 17, 2022
    Configuration menu
    Copy the full SHA
    1dff9a6 View commit details
    Browse the repository at this point in the history

  35. e2e: Feature flag RBD fscrypt tests (default disabled) 

    Add test-rbd-fscrypt feature flag to e2e suite. Default disabled as
the current CI system's kernel doesn't have the required features
enabled.

Signed-off-by: Marcel Lauhoff <marcel.lauhoff@suse.com>
    @mergify
    Marcel Lauhoff authored and mergify[bot] committed Oct 17, 2022
    Configuration menu
    Copy the full SHA
    eccb1a7 View commit details
    Browse the repository at this point in the history