Volume Encryption not supported by charm

[Drew Freiberger]

I've tried to configure an encrypted volume based on the process outlined here:

https://docs.openstack.org/liberty/config-reference/content/section_create-encrypted-volume-type.html (couldn't find equivalent link for mitaka)

It resulted in creating the volume within cinder (using a charmed ceph backend), however, when attempting to attach to a nova-compute instance, I receive the following traceback, which shows that the keymgr api is not configured by the charm per this reference:

https://docs.openstack.org/mitaka/config-reference/block-storage/volume-encryption.html

nova-compute.log-2017-08-04 23:21:41.229 588061 ERROR nova.virt.libvirt.driver [instance: e74d5610-8521-4d6d-a05d-a68ac3020058] Traceback (most recent call last):
nova-compute.log-2017-08-04 23:21:41.229 588061 ERROR nova.virt.libvirt.driver [instance: e74d5610-8521-4d6d-a05d-a68ac3020058] File "/usr/lib/python2.7/dist-packages/nova/virt/libvirt/driver.py", line 1345, in attach_volume
nova-compute.log-2017-08-04 23:21:41.229 588061 ERROR nova.virt.libvirt.driver [instance: e74d5610-8521-4d6d-a05d-a68ac3020058] encryption)
nova-compute.log-2017-08-04 23:21:41.229 588061 ERROR nova.virt.libvirt.driver [instance: e74d5610-8521-4d6d-a05d-a68ac3020058] File "/usr/lib/python2.7/dist-packages/nova/virt/libvirt/driver.py", line 1286, in _get_volume_encryptor
nova-compute.log-2017-08-04 23:21:41.229 588061 ERROR nova.virt.libvirt.driver [instance: e74d5610-8521-4d6d-a05d-a68ac3020058] **encryption)
nova-compute.log-2017-08-04 23:21:41.229 588061 ERROR nova.virt.libvirt.driver [instance: e74d5610-8521-4d6d-a05d-a68ac3020058] File "/usr/lib/python2.7/dist-packages/nova/volume/encryptors/__init__.py", line 34, in get_volume_encryptor
nova-compute.log-2017-08-04 23:21:41.229 588061 ERROR nova.virt.libvirt.driver [instance: e74d5610-8521-4d6d-a05d-a68ac3020058] encryptor = nop.NoOpEncryptor(connection_info, **kwargs)
nova-compute.log-2017-08-04 23:21:41.229 588061 ERROR nova.virt.libvirt.driver [instance: e74d5610-8521-4d6d-a05d-a68ac3020058] File "/usr/lib/python2.7/dist-packages/nova/volume/encryptors/nop.py", line 28, in __init__
nova-compute.log-2017-08-04 23:21:41.229 588061 ERROR nova.virt.libvirt.driver [instance: e74d5610-8521-4d6d-a05d-a68ac3020058] super(NoOpEncryptor, self).__init__(connection_info, **kwargs)
nova-compute.log-2017-08-04 23:21:41.229 588061 ERROR nova.virt.libvirt.driver [instance: e74d5610-8521-4d6d-a05d-a68ac3020058] File "/usr/lib/python2.7/dist-packages/nova/volume/encryptors/base.py", line 35, in __init__
nova-compute.log-2017-08-04 23:21:41.229 588061 ERROR nova.virt.libvirt.driver [instance: e74d5610-8521-4d6d-a05d-a68ac3020058] self._key_manager = keymgr.API()
nova-compute.log-2017-08-04 23:21:41.229 588061 ERROR nova.virt.libvirt.driver [instance: e74d5610-8521-4d6d-a05d-a68ac3020058] File "/usr/lib/python2.7/dist-packages/nova/keymgr/__init__.py", line 33, in API
nova-compute.log-2017-08-04 23:21:41.229 588061 ERROR nova.virt.libvirt.driver [instance: e74d5610-8521-4d6d-a05d-a68ac3020058] return cls()
nova-compute.log-2017-08-04 23:21:41.229 588061 ERROR nova.virt.libvirt.driver [instance: e74d5610-8521-4d6d-a05d-a68ac3020058] File "/usr/lib/python2.7/dist-packages/nova/keymgr/conf_key_mgr.py", line 58, in __init__
nova-compute.log-2017-08-04 23:21:41.229 588061 ERROR nova.virt.libvirt.driver [instance: e74d5610-8521-4d6d-a05d-a68ac3020058] raise ValueError(_('keymgr.fixed_key not defined'))
nova-compute.log-2017-08-04 23:21:41.229 588061 ERROR nova.virt.libvirt.driver [instance: e74d5610-8521-4d6d-a05d-a68ac3020058] ValueError: keymgr.fixed_key not defined
nova-compute.log-2017-08-04 23:21:41.229 588061 ERROR nova.virt.libvirt.driver [instance: e74d5610-8521-4d6d-a05d-a68ac3020058]
nova-compute.log:2017-08-04 23:21:41.232 588061 ERROR nova.virt.block_device [req-15cb8edd-d101-4099-a776-569db18b3231 1d3dd7410c33419aac94508264038c89 1fa839daef4d4dac9dc0576ae9420453 - - -] [instance: e74d5610-8521-4d6d-a05d-a68ac3020058] Driver failed to attach volume 31b44efe-ec93-43d3-9800-f658ec6dae23 at /dev/vdb

Running trusty/Mitaka bootstack cloud with:
cinder 2:8.1.1-0ubuntu3~cloud0
nova-compute 2:13.1.4-0ubuntu1~cloud0

recently updated to openstack-charms/17.02

[Matt Rae (mattrae)]

Confirming that currently encrypted volumes are not supported by the cinder or barbican charms. Barbican is required but the Barbican charm currently doesn't support integrating with cinder.

[Alex Kavanagh (ajkavanagh)]

(I'm the author of the barbican charms)

It's not so much that the Barbican charm needs to support cinder, as cinder needs to be configurable to use Barbican: Please see here: (mitaka) https://docs.openstack.org/mitaka/config-reference/block-storage/volume-encryption.html and (newton) https://docs.openstack.org/newton/config-reference/block-storage/volume-encryption.html

i.e. cinder would need updating to provide a [key_manager] section.

A bigger issue is that the Barbican charm isn't 'production' yet, as there is no suitable HSM configuration defined for it. The 'out-of-the-box no hsm' configuration might be suitable, soft-hsm doesn't work due to a missing OpenSSL feature on Xenial (#1611393), and no hardware HSM has been identified as a solution to work against. Please see bug: #1615211 for more details.

So, from a Barbican perspective, it can work with just the built in secret system. However, there's no HA (tested) on the Barbican charm and there's probably a little work in getting it fully production level (which we want to do!) with just the built in system.

It boils down to the requirements of the user. i.e. with some work we would be able to support Barbican / internal secret store / encrypted volumes (with a change to the Cinder charm) if it's okay that those volume keys are stored in the database, rather than an HSM. If they have to be stored in an HSM, then the HSM needs selecting, and a configuration charm for it needs to be produced.

Hope that helps with some background.