Bug 1668213

So, we might want some actual commands from step 2 to 7 here. Multiple reasons for that:


1) It helps us understand what you need;
2) It helps QE, since they will be needing specific commands to run tests and verify the feature;
3) Should the whole Glance team get hit by a bus, it will make it easier for our replacements to pick up this bug report.


2) Get key and ID from 1/
So, probably using "openstack secret order list/get", right?

3/ Generate encrypted image with 2/ as LUKS key.
How do you do this?

4) Upload the image into glance
$ openstack image create --disk-format qcow2 --file <encrypted-image> --property cinder_encryption_key_id=$ID_KEY_BARBICAN

5) Create volume from image
$ openstack volume create --image <image-id from step 4>

6) Attach volume to instance
$ nova volume-attach <instance-id> <volume-id> auto

7) VM mount the volume.
$ mount /dev/whatever /media/my-volume  # After SSHing the nova instance

Are the commands above what you had in mind?

I'll talk to upstream Cinder/Glance and see whether this is something we can support in the near future. I think right now, we can only use Barbican to sign images, but we do not support encryption/booting from an encrypted image.

According to our records, this should be resolved by openstack-cinder-15.0.2-0.20200123220928.900f769.el8ost.  This build is available now.

Reopening: there is still work to do to verify this. I'll try to summarize the status.

This feature is about uploading pre-encrypted images intended to be written as volume.

Two possible workflows can be potentially taken into account:

1) have barbican provide the key/secret, encrypt the image offline using that key, upload it to glance and update its metadata to refer to the key.
2) create a key offline, use it to encrypt the image, then upload the key to barbican and the image to glance.

The case 1) should receive more attention. It should be investigated whether and under which conditions case 2) may work.

*** Bug 1644787 has been marked as a duplicate of this bug. ***

Moving to z3 because of https://bugzilla.redhat.com/show_bug.cgi?id=1879190

Latest status:

- Creating a secret in barbican, retrieve the key - WORKS
- Build an encrypted image file with the key retrieve in previous step, upload it to glance - WORKS
- Attaching a volume from an (pre)encrypted image to a running VMs - WORKS
- Booting a VM with a volume from an (pre)encrypted image - FAILS because of BZ#1879190

BZ#1879190 has been accepted as exception for 16.1.2. Reverting RFE TM to 16.1.2.

RFE will move to verified if the bug fix indeed solves the issue and QE is able to verify it in time.

Verified

Thanks, Greg and Brian!