Uploaded image for project: 'OpenShift Storage'
  1. OpenShift Storage
  2. STOR-874

Implement custom keys in GCP PD CSI driver operator

    XMLWordPrintable

Details

    • Story
    • Resolution: Done
    • Undefined
    • None
    • None
    • None
    • Storage Sprint 232

    Description

      User Story:

      As a cluster admin, I want OCP to provision new volumes with my custom encryption key that I specified during cluster installation in install-config.yaml so all OCP assets (PVs, VMs & their root disks) use the same encryption key.

      Acceptance Criteria:

      Description of criteria:

      • Check that dynamically provisioned PVs use the key specified in install-config.yaml
      • Check that the key can be changed in TBD API and all volumes newly provisioned after the key change use the new key. (Exact API is not defined yet, probably a new field in `Infrastructure`, calling it TBD API now).

      (optional) Out of Scope:

      Re-encryption of existing PVs with a new key. Only newly provisioned PVs will use the new key.

      Engineering Details:

      Enhancement (incl. TBD API with encryption key reference) will be provided as part of https://issues.redhat.com/browse/CORS-2080.

      "Raw meat" of this story is translation of the key reference in TBD API to StorageClass.Parameters. GCP PD CSi driver operator should update both StorageClasses that it manages (standard-csi, standard-ssd) with:

      Parameters:
          disk-encryption-kms-key: projects/<KEY_PROJECT_ID>/locations/<LOCATION>/keyRings/<RING_NAME>/cryptoKeys/<KEY_NAME>

      Upstream docs: https://github.com/kubernetes-sigs/gcp-compute-persistent-disk-csi-driver#createvolume-parameters (CreateVolume parameters == StorageClass.Parameters)

      Attachments

        Issue Links

          Activity

            People

              jdobson@redhat.com Jonathan Dobson
              rhn-engineering-jsafrane Jan Safranek
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: