Bug 1625007

Name of function:
Enhanced Storage Security (via Barbican)

User story:
Cinder Volume Encryption:  As an administrator, I’d like to be able to encrypt my Cinder Volume when it’s implemented with Ceph.  I can use Barbican to enable this, or I can use other security features instead.  I would like to use the more secure Barbican key manager to secure my Cinder volumes including storage of the encryption keys in Barbican, and have Nova boot the encrypted volumes seamlessly, and have my volume snapshots be encrypted.

Glance Image Signing.  As an administrator, I want to be able to validate a signature or checksum of an image and use Barbican to store the keys that are used to create the image.  This will help me ensure secure operations because I can trust that the image has not been changed between the time I uploaded it and it has been downloaded.

Purpose of function:
Barbican is a REST API designed for the secure storage, provisioning and management of secrets such as passwords, encryption keys and X.509 Certificates. It is aimed at being useful for all environments, including large ephemeral Clouds.

Work required (from items marked as new in detail plan):
Procedural 
------
How to enable OSD encryption
Glance - How to  create signature
How to turn IPSec off (in the case of degradation of performance)
Ceph IP sec - process to convert from old system to IP Sec process)
------

Conceptual 
------
IPSec - what is it and when/why is it used
What is OSD encryption and when/why would it be used
Cinder verifying signature
How it works out of the box: when you create a volume from a glance image, cinder fetches signature info along with image; verifies they haven’t been corrupted or manipulated.
------

Reference
------
N/A
------