Bug 1974802 - Error for PV encryption using encryptionKMSType "vault"
Summary: Error for PV encryption using encryptionKMSType "vault"
Keywords:
Status: CLOSED DUPLICATE of bug 1974800
Alias: None
Product: Red Hat OpenShift Container Storage
Classification: Red Hat Storage
Component: csi-driver
Version: 4.7
Hardware: All
OS: All
unspecified
urgent
Target Milestone: ---
: ---
Assignee: Humble Chirammal
QA Contact: Elad
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2021-06-22 15:09 UTC by mdipalma
Modified: 2021-06-22 15:32 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-06-22 15:31:59 UTC
Embargoed:


Attachments (Terms of Use)

Description mdipalma 2021-06-22 15:09:08 UTC
Description of problem (please be detailed as possible and provide log
snippests):
When configuring PV encryption with an external kms, 2 types (encryptionKMSType) are available - vaulttokens and vault. When using the "vault" encryption KMS type the follow error is returned:

invalid encryption kms configuration: unknown encryption KMS type

The "vault" encryption KMS type should be available. https://github.com/openshift/ceph-csi/blob/release-4.7/internal/util/crypto.go#L166


Version of all relevant components (if applicable):
ODF 4.7.x

Does this issue impact your ability to continue to work with the product
(please explain in detail what is the user impact)?
Yes, serviceaccount authentication to an external Vault kms is broken.

Is there any workaround available to the best of your knowledge?
No

Rate from 1 - 5 the complexity of the scenario you performed that caused this
bug (1 - very simple, 5 - very complex)?
5 

Can this issue reproducible?
Yes

Can this issue reproduce from the UI?
Yes

If this is a regression, please provide more details to justify this:


Steps to Reproduce:
1. https://github.com/ceph/ceph-csi/blob/devel/docs/design/proposals/encrypted-pvc.md
2. https://github.com/ceph/ceph-csi/blob/devel/examples/kms/vault/csi-kms-connection-details.yaml
3. Create a storageclass with encryption enabled 
4. Create PVC using the encrypted storage class
5. Watch for errors

Actual results:
PVC is pending with error: invalid encryption kms configuration: unknown encryption KMS type

Expected results:
Bound PVC

Additional info:

Comment 1 Eran Tamir 2021-06-22 15:31:59 UTC

*** This bug has been marked as a duplicate of bug 1974800 ***


Note You need to log in before you can comment on or make changes to this bug.