第 12 章 加密和验证 OpenStack 存储服务

流程

1. 创建使用加密的卷类型：

   openstack volume type create \
   --encryption-provider  nova.volume.encryptors.luks.LuksEncryptor \
   --encryption-cipher aes-xts-plain64 \
   --encryption-key-size 256 \
   --encryption-control-location front-end LuksEncryptor-256

   输出示例

   +-------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
   | Field       | Value                                                                                                                                                                              |
   +-------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
   | description | None                                                                                                                                                                               |
   | encryption  | cipher='aes-xts-plain64', control_location='front-end', encryption_id='9df604d0-8584-4ce8-b450-e13e6316c4d3', key_size='256', provider='nova.volume.encryptors.luks.LuksEncryptor' |
   | id          | 78898a82-8f4c-44b2-a460-40a5da9e4d59                                                                                                                                               |
   | is_public   | True                                                                                                                                                                               |
   | name        | LuksEncryptor-256                                                                                                                                                                  |
   +-------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+

2. 创建一个新卷，并指定它使用 LuksEncryptor-256 设置：

   openstack volume create --size 1 --type LuksEncryptor-256 'Encrypted-Test-Volume'

   输出示例

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | attachments         | []                                   |
   | availability_zone   | nova                                 |
   | bootable            | false                                |
   | consistencygroup_id | None                                 |
   | created_at          | 2018-01-22T00:19:06.000000           |
   | description         | None                                 |
   | encrypted           | True                                 |
   | id                  | a361fd0b-882a-46cc-a669-c633630b5c93 |
   | migration_status    | None                                 |
   | multiattach         | False                                |
   | name                | Encrypted-Test-Volume                |
   | properties          |                                      |
   | replication_status  | None                                 |
   | size                | 1                                    |
   | snapshot_id         | None                                 |
   | source_volid        | None                                 |
   | status              | creating                             |
   | type                | LuksEncryptor-256                    |
   | updated_at          | None                                 |
   | user_id             | 0e73cb3111614365a144e7f8f1a972af     |
   +---------------------+--------------------------------------+

   生成的 secret 会自动上传到 Key Manager 后端。

3. 获取 Key Manager secret UUID。这个值显示在 encryption_key_id 字段中：

   openstack --os-volume-api-version 3.64 volume show Encrypted-Test-Volume

   输出示例

   +------------------------------+-------------------------------------+
   |Property                      |Value                                |
   +------------------------------+-------------------------------------+
   |attached_servers              |[]                                   |
   |attachment_ids                |[]                                   |
   |availability_zone             |nova                                 |
   |bootable                      |false                                |
   |cluster_name                  |None                                 |
   |consistencygroup_id           |None                                 |
   |created_at                    |2022-07-28T17:35:26.000000           |
   |description                   |None                                 |
   |encrypted                     |True                                 |
   |encryption_key_id             |0944b8a8-de09-4413-b2ed-38f6c4591dd4 |
   |group_id                      |None                                 |
   |id                            |a0b51b97-0392-460a-abfa-093022a120f3 |
   |metadata                      |                                     |
   |migration_status              |None                                 |
   |multiattach                   |False                                |
   |name                          |vol                                  |
   |os-vol-host-attr:host         |hostgroup@tripleo_iscsi#tripleo_iscsi|
   |os-vol-mig-status-attr:migstat|None                                 |
   |os-vol-mig-status-attr:name_id|None                                 |
   |os-vol-tenant-attr:tenant_id  |a2071ece39b3440aa82395ff7707996f     |
   |provider_id                   |None                                 |
   |replication_status            |None                                 |
   |service_uuid                  |471f0805-072e-4256-b447-c7dd10ceb807 |
   |shared_targets                |False                                |
   |size                          |1                                    |
   |snapshot_id                   |None                                 |
   |source_volid                  |None                                 |
   |status                        |available                            |
   |updated_at                    |2022-07-28T17:35:26.000000           |
   |user_id                       |ba311b5c2b8e438c951d1137333669d4     |
   |volume_type                   |LUKS                                 |
   |volume_type_id                |cc188ace-f73d-4af5-bf5a-d70ccc5a401c |
   +------------------------------+-------------------------------------+

4. 使用 Key Manager 服务确认存在磁盘加密。在以下示例中，Key Manager secret UUID 与上例输出中的 encryption_key_id 匹配，时间戳与 LUKS 卷创建时间匹配：

   openstack secret list

   输出示例

   +------------------------------------------------------------------------------------+------+---------------------------+--------+-------------------------------------------+-----------+------------+-------------+------+------------+
   | Secret href                                                                        | Name | Created                   | Status | Content types                             | Algorithm | Bit length | Secret type | Mode | Expiration |
   +------------------------------------------------------------------------------------+------+---------------------------+--------+-------------------------------------------+-----------+------------+-------------+------+------------+
   | https://192.168.123.169:9311/v1/secrets/0944b8a8-de09-4413-b2ed-38f6c4591dd4 | None | 2018-01-22T02:23:15+00:00 | ACTIVE | {u'default': u'application/octet-stream'} | aes       |        256 | symmetric   | None | None       |
   +------------------------------------------------------------------------------------+------+---------------------------+--------+-------------------------------------------+-----------+------------+-------------+------+------------+

5. 将新卷附加到现有实例：

   $ openstack server add volume testInstance Encrypted-Test-Volume