Support encrypted EBS volumes for bootstrapping controllers on AWS

[Syed Mohammad Adnan Karim]

juju bootstrap aws \
  --storage-pool name=ebs-encrypted \
  --storage-pool type=ebs \
  --storage-pool encrypted=true \
  --bootstrap-constraints="root-disk-source=ebs-encrypted"

I just tried running the above to bootstrap a juju controller with and encrypted EBS volume and I checked on my AWS console and it looks like the controler machine still uses a non-encrypted EBS volume.

It looks like the bootstrap-constraint of root-disk-source is only supported on vSphere and OpenStack providers according to https://discourse.charmhub.io/t/juju-constraints/1160

This feature is important because make the adoption of Juju easier and smoother since organizations wont have to justify the existence of non encrypted EBS volumes to their security teams every review period.

[Ian Booth (wallyworld)]

The doc is not quite correct.

If root disk source refers to a storage pool, then it is supposed to be supported on any provider that can provision block device storage which can be mounted as the root disk of an instance.

The doc is referring to the case where root disk source is not a storage pool name but rather a provider specific datastore or such.

[Ian Booth (wallyworld)]

Looking closer, it turns out that only the azure provider seems to use the bootstrap root disk constraint as a storage pool option. It is not currently used by the aws provider so that will need to be enabled.

[Ian Booth (wallyworld)]

This would be a fairly simple change, except for the fact that juju currently uses a 10 year old AWS api library to manage instances, and this library does not support specifying ebs root disk config. We will have to migrate to a new official AWS library to do what's needed.

[Harry Pidcock (hpidcock)]

https://github.com/juju/juju/pull/13101

[Syed Mohammad Adnan Karim (karimsye)]

Thanks, I am now able to bootstrap juju controllers on AWS with encrypted EBS volumes.
However I found that I was unable to create other machines with encrypted EBS volumes.
I attempted the following:

# Successfully create a controller with encrypted EBS volumes
juju bootstrap aws \
  --storage-pool name=ebs-encrypted \
  --storage-pool type=ebs \
  --storage-pool encrypted=true \
  --bootstrap-constraints="root-disk-source=ebs-encrypted"

# Create an ecrypted EBS storage pool
juju create-storage-pool encrypted-ebs ebs encrypted=true

# Set the storage-default-block-source to encrypted-ebs
juju model-config storage-default-block-source="encrypted-ebs"

# Deploy a bundle
juju deploy cs:bundle/landscape-scalable-8

I checked my EC2 instances in the dashboard and found that the non-controller machines did not have encryption. The juju version is 2.9.7-ubuntu-amd64 from latest/candidate channel.

[Harry Pidcock (hpidcock)]

I think storage-default-block-source is for attached storage. Root disks should be done via constraints like in bootstrap.

[Harry Pidcock (hpidcock)]

The following should work:

juju set-model-constraints root-disk-source="encrypted-ebs"

For all other storage you want to probably set this as well:

juju model-config storage-default-block-source="encrypted-ebs"

[Syed Mohammad Adnan Karim (karimsye)]

Thanks, it works!