Bug 1301026 - RFE: LUKS encryption of all disk backends
RFE: LUKS encryption of all disk backends
Status: ASSIGNED
Product: Red Hat OpenStack
Classification: Red Hat
Component: openstack-nova (Show other bugs)
7.0 (Kilo)
Unspecified Unspecified
urgent Severity urgent
: Upstream M2
: ---
Assigned To: nova-maint
Joe H. Rahme
: FutureFeature, Tracking
Depends On: 1305024 1301021
Blocks: 1230405 1476900
  Show dependency treegraph
 
Reported: 2016-01-22 06:15 EST by Daniel Berrange
Modified: 2018-05-11 22:09 EDT (History)
13 users (show)

See Also:
Fixed In Version:
Doc Type: Enhancement
Doc Text:
Story Points: ---
Clone Of:
: 1353247 (view as bug list)
Environment:
Last Closed:
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Daniel Berrange 2016-01-22 06:15:15 EST
Description of problem:
Nova currently has some limited encryption support which works with LVM volumes. This is not a particularly common deployment choice. The encryption support needs to be extended to cover qcow2 files, RBD and iSCSI volumes at the very minimum. This will require QEMU to have native support for the LUKS encryption format.
Comment 3 Stephen Gordon 2017-03-14 15:47:42 EDT
Kashyap are there other dependencies for this work? The linked dependency is (theoretically) resolved?
Comment 4 Daniel Berrange 2017-03-14 15:55:30 EDT
Unfortunately the infrastructure isn't fully completed. QEMU has support for LUKS over plain files, block devices and network volumes, but doesn't have LUKS integration into qcow2 yet. Libvirt supports LUKS over plain files and block devices, but not yet for network volumes.

It is enough to start working on the nova piece, but not complete it yet
Comment 5 Kashyap Chamarthy 2017-03-15 07:09:11 EDT
(In reply to Daniel Berrange from comment #4)
> Unfortunately the infrastructure isn't fully completed. QEMU has support for
> LUKS over plain files, block devices and network volumes, but doesn't have
> LUKS integration into qcow2 yet.

Dan, I presume this in-progress upstream QEMU patch series (that adds LUKS support to QCOW2) from you, is what you're referring to (which I've been following from a distance)

https://lists.nongnu.org/archive/html/qemu-devel/2017-02/msg04653.html --
[PATCH v5 00/18] Convert QCow[2] to QCryptoBlock & add LUKS support

> Libvirt supports LUKS over plain files and
> block devices, but not yet for network volumes.
> 
> It is enough to start working on the nova piece, but not complete it yet
Comment 6 Kashyap Chamarthy 2017-08-31 07:17:03 EDT
So, the v10 of the relevant QEMU patch series from DanPB:

    "[PATCH v10 00/20] Convert QCow[2] to QCryptoBlock & add LUKS support"
    -- https://lists.nongnu.org/archive/html/qemu-block/2017-06/msg00755.html) 

is merged in QEMU 2.10 (released on 30-Aug-2017).
Comment 8 Lee Yarwood 2018-02-20 10:33:04 EST
Moving to rhos-15.0? given RHEL dependencies will not be available during Rocky development.

Note You need to log in before you can comment on or make changes to this bug.