Bug 1795271

Summary:	[Docs][OSP 16] Deprecate the current LVM based ephemeral disk encryption implementation
Product:	Red Hat OpenStack	Reporter:	Lee Yarwood <lyarwood>
Component:	openstack-nova	Assignee:	Roger Heslop <rheslop>
Status:	CLOSED CURRENTRELEASE	QA Contact:	RHOS Documentation Team <rhos-docs>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	16.0 (Train)	CC:	dasmith, eglynn, igallagh, jhakimra, kchamart, sbauza, sgordon, vromanso
Target Milestone:	---	Keywords:	NoDocsQEReview, Triaged
Target Release:	16.0 (Train on RHEL 8.1)
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Deprecated Functionality
Doc Text:	In Red Hat OpenStack Platform 16.0, ephemeral disk encryption is deprecated. Bug fixes and support will be provided through the end of the 16.0 life cycle but no new feature enhancements will be made.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-08-12 20:34:06 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Lee Yarwood 2020-01-27 15:29:02 UTC

Description of problem:

https://access.redhat.com/documentation/en-us/red_hat_openstack_platform/15/html-single/security_and_hardening_guide/index#ephemeral_disk_encryption

The current ephemeral disk encryption implementation is limited to LVM, using a single encryption key per instance and using the `plain` cryptsetup encryption format. All of these should be highlighted.

The following RFE is looking at address these by expanding support across all ephemeral backends, using a key (passphrase) per disk and using the more flexible LUKS encryption format.


[RFE] LUKS encryption of all Nova ephemeral disk backends (local (RAW), QCOW2, rbd and LVM)
https://bugzilla.redhat.com/show_bug.cgi?id=1301026

Comment 2 Lee Yarwood 2020-01-31 15:34:34 UTC

During triage the compute team agreed that the easier approach here is to simply deprecate the current implementation.

Comment 6 Roger Heslop 2020-08-12 20:34:06 UTC

This feature is added to release notes as deprecated.