openstack上cinder卷的加密

目标：

创建并使用加密的cinder卷

准备:

-openstack

过程：

修改配置文件：

将fixed_key的值设置为cinder-volume-key和一组十六位的十六进制的密钥（控制节点和计算节点）

[root@compute ~]# ssh controller                                                    
root@controller's password: 
Last login: Tue May 28 12:10:00 2019 from compute
[root@controller ~]# sed -n 3524,3532p /etc/nova/nova.conf     
[keymgr]

#
# From nova
#

# Fixed key returned by key manager, specified in hex (string value)
fixed_key=cinder-volume-key
fixed_key=0000000000000000

[root@controller ~]# sed -n 2794,2811p /etc/cinder/cinder.conf 
[KEYMGR]

#
# From cinder
#

# Authentication url for encryption service. (string value)
#encryption_auth_url = http://localhost:5000/v3

# Url for encryption service. (string value)
#encryption_api_url = http://localhost:9311/v1

# The full class name of the key manager API class (string value)
#api_class = cinder.keymgr.conf_key_mgr.ConfKeyManager

# Fixed key returned by key manager, specified in hex (string value)
fixed_key = cinder-volume-key
fixed_key = 0000000000000000

重启服务：

[root@controller ~]# systemctl restart openstack-nova-compute
[root@controller ~]# systemctl restart openstack-cinder-volume

[root@compute ~]# systemctl restart openstack-nova-compute
[root@compute ~]# systemctl restart openstack-cinder-volume

创建加密卷类型：

[root@controller ~]# cinder type-create luks
+--------------------------------------+------+-------------+-----------+
|                  ID                  | Name | Description | Is_Public |
+--------------------------------------+------+-------------+-----------+
| bd278099-ad80-4f54-b1da-e0734ee33cba | luks |      -      |    True   |
+--------------------------------------+------+-------------+-----------+
[root@controller ~]# cinder encryption-type-create --cipher aes-xts-plain64 --key_size 512 --control_location front-end luks nova.volume.encryptors.luks.LuksEncryptor    
+--------------------------------------+-------------------------------------------+-----------------+----------+------------------+
|            Volume Type ID            |                  Provider                 |      Cipher     | Key Size | Control Location |
+--------------------------------------+-------------------------------------------+-----------------+----------+------------------+
| bd278099-ad80-4f54-b1da-e0734ee33cba | nova.volume.encryptors.luks.LuksEncryptor | aes-xts-plain64 |   512    |    front-end     |
+--------------------------------------+-------------------------------------------+-----------------+----------+------------------+

创建cinder卷：

未加密：[root@controller ~]# cinder create --name unencrypted 1 
加密：[root@controller ~]# cinder create --name encrypted --volume-type luks 1 

挂载到云主机进行测试：

加密卷：

[root@controller ~]# nova volume-attach iaas 89f2cc72-435e-4136-b32f-44acdd96a8a7
+----------+--------------------------------------+
| Property | Value                                |
+----------+--------------------------------------+
| device   | /dev/vdb                             |
| id       | 89f2cc72-435e-4136-b32f-44acdd96a8a7 |
| serverId | 3089a676-1394-4e0b-bad7-e9ed1f43e676 |
| volumeId | 89f2cc72-435e-4136-b32f-44acdd96a8a7 |
+----------+--------------------------------------+

未加密：

[root@controller ~]# nova volume-attach iaas c4fa8087-e648-4ee4-ba24-be8d56835d98
+----------+--------------------------------------+
| Property | Value                                |
+----------+--------------------------------------+
| device   | /dev/vdc                             |
| id       | c4fa8087-e648-4ee4-ba24-be8d56835d98 |
| serverId | 3089a676-1394-4e0b-bad7-e9ed1f43e676 |
| volumeId | c4fa8087-e648-4ee4-ba24-be8d56835d98 |
+----------+--------------------------------------+

测试：
到云主机里向卷内写入数据

[root@xiandian ~]# echo "encrypted /dev/vdb Hello,world" >> /dev/vdb 
[root@xiandian ~]# echo "unencrypted /dev/vdc Hello,world" >> /dev/vdc 

到cinder卷所在节点验证：
未加密的卷信息就会暴露出来

[root@compute ~]# strings /dev/mapper/cinder--volumes-volume--* | grep "Hello,world"
unencrypted /dev/vdc Hello,world