Openstack上のcinderボリュームの暗号化

ターゲット:
暗号化されたcinderボリュームの作成と使用
準備:
-openstack
プロセス:
プロファイルの変更:
fixed_keyの値はcinder-volume-keyと16ビットの16進鍵(制御ノードと計算ノード)のセットに設定されます.

[root@compute ~]# ssh controller                                                    
root@controller's password: 
Last login: Tue May 28 12:10:00 2019 from compute
[root@controller ~]# sed -n 3524,3532p /etc/nova/nova.conf     
[keymgr]

#
# From nova
#

# Fixed key returned by key manager, specified in hex (string value)
fixed_key=cinder-volume-key
fixed_key=0000000000000000

[root@controller ~]# sed -n 2794,2811p /etc/cinder/cinder.conf 
[KEYMGR]

#
# From cinder
#

# Authentication url for encryption service. (string value)
#encryption_auth_url = http://localhost:5000/v3

# Url for encryption service. (string value)
#encryption_api_url = http://localhost:9311/v1

# The full class name of the key manager API class (string value)
#api_class = cinder.keymgr.conf_key_mgr.ConfKeyManager

# Fixed key returned by key manager, specified in hex (string value)
fixed_key = cinder-volume-key
fixed_key = 0000000000000000

サービスの再起動:

[root@controller ~]# systemctl restart openstack-nova-compute
[root@controller ~]# systemctl restart openstack-cinder-volume

[root@compute ~]# systemctl restart openstack-nova-compute
[root@compute ~]# systemctl restart openstack-cinder-volume

ボリュームタイプの作成:

[root@controller ~]# cinder type-create luks
+--------------------------------------+------+-------------+-----------+
|                  ID                  | Name | Description | Is_Public |
+--------------------------------------+------+-------------+-----------+
| bd278099-ad80-4f54-b1da-e0734ee33cba | luks |      -      |    True   |
+--------------------------------------+------+-------------+-----------+
[root@controller ~]# cinder encryption-type-create --cipher aes-xts-plain64 --key_size 512 --control_location front-end luks nova.volume.encryptors.luks.LuksEncryptor    
+--------------------------------------+-------------------------------------------+-----------------+----------+------------------+
|            Volume Type ID            |                  Provider                 |      Cipher     | Key Size | Control Location |
+--------------------------------------+-------------------------------------------+-----------------+----------+------------------+
| bd278099-ad80-4f54-b1da-e0734ee33cba | nova.volume.encryptors.luks.LuksEncryptor | aes-xts-plain64 |   512    |    front-end     |
+--------------------------------------+-------------------------------------------+-----------------+----------+------------------+

cinderボリュームの作成:

   ：[root@controller ~]# cinder create --name unencrypted 1 
  ：[root@controller ~]# cinder create --name encrypted --volume-type luks 1 

クラウドホストにマウントしてテストを行います.
ボリュームの暗号化:

[root@controller ~]# nova volume-attach iaas 89f2cc72-435e-4136-b32f-44acdd96a8a7
+----------+--------------------------------------+
| Property | Value                                |
+----------+--------------------------------------+
| device   | /dev/vdb                             |
| id       | 89f2cc72-435e-4136-b32f-44acdd96a8a7 |
| serverId | 3089a676-1394-4e0b-bad7-e9ed1f43e676 |
| volumeId | 89f2cc72-435e-4136-b32f-44acdd96a8a7 |
+----------+--------------------------------------+

暗号化されていません:

[root@controller ~]# nova volume-attach iaas c4fa8087-e648-4ee4-ba24-be8d56835d98
+----------+--------------------------------------+
| Property | Value                                |
+----------+--------------------------------------+
| device   | /dev/vdc                             |
| id       | c4fa8087-e648-4ee4-ba24-be8d56835d98 |
| serverId | 3089a676-1394-4e0b-bad7-e9ed1f43e676 |
| volumeId | c4fa8087-e648-4ee4-ba24-be8d56835d98 |
+----------+--------------------------------------+

テスト:クラウドホストにデータをボリュームに書き込む

[root@xiandian ~]# echo "encrypted /dev/vdb Hello,world" >> /dev/vdb 
[root@xiandian ~]# echo "unencrypted /dev/vdc Hello,world" >> /dev/vdc 

cinderボリュームのあるノードで検証:暗号化されていないボリューム情報が露出します.

[root@compute ~]# strings /dev/mapper/cinder--volumes-volume--* | grep "Hello,world"
unencrypted /dev/vdc Hello,world