Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add encryption support #514

Closed
wants to merge 5 commits into from
Closed

Add encryption support #514

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
916c067
Add LUKS encryption support.
paravibe Jun 20, 2023
b121391
Revert bump-version
paravibe Jul 13, 2023
7dfa6c6
Remove LUKS storage class.
paravibe Jul 13, 2023
ec5f145
Return formatted error in case LUKS validation is failed.
paravibe Jul 13, 2023
3db00e4
Add e2e test for LUKS volume.
paravibe Aug 4, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
## unreleased

## v4.7.0 - 2023.06.23
* Add LUKS encryption support
[[GH-514]](https://github.com/digitalocean/csi-digitalocean/pull/514)

## v4.6.1 - 2023.05.17
* Update CSI sidecars to latest
[[GH-502]](https://github.com/digitalocean/csi-digitalocean/pull/502)
Expand Down
15 changes: 15 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -277,6 +277,21 @@ $ kubectl exec -ti my-csi-app /bin/sh
hello-world
```

## Volume parameters

This plugin supports the following `StorageClass` parameters:

For LUKS encryption:

* `dobs.csi.digitalocean.com/luks-encrypted`: set to the string `"true"` if the volume should be encrypted
with LUKS
* `dobs.csi.digitalocean.com/luks-cipher`: cipher to use; must be supported by the kernel and luks
* `dobs.csi.digitalocean.com/luks-key-size`: key-size to use

For LUKS encrypted volumes, a secret that contains the LUKS key needs to be referenced through
the `csi.storage.k8s.io/node-stage-secret-name` and `csi.storage.k8s.io/node-stage-secret-namespace`
parameter. See the included `StorageClass` definition.

## Upgrading

When upgrading to a new Kubernetes minor version, you should upgrade the CSI
Expand Down
2 changes: 1 addition & 1 deletion VERSION
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
v4.6.1
v4.7.0
1 change: 1 addition & 0 deletions cmd/do-csi-plugin/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@ FROM amd64/alpine:3.16
# e2fsprogs-extra is required for resize2fs used for the resize operation
# blkid: block device identification tool from util-linux
RUN apk add --no-cache ca-certificates \
cryptsetup \
e2fsprogs \
findmnt \
xfsprogs \
Expand Down
36 changes: 36 additions & 0 deletions deploy/kubernetes/releases/csi-digitalocean-dev/driver.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,36 @@ deletionPolicy: Delete

---

kind: StorageClass
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Given that we're already defining quite a few storageclasses, I think it might be better to instead document this feature, rather than explicitly define it for all future clusters.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok, I've removed those LUKS storage classes and updated README.md a bit.

apiVersion: storage.k8s.io/v1
metadata:
name: do-block-storage-luks-global
provisioner: dobs.csi.digitalocean.com
allowVolumeExpansion: true
parameters:
dobs.csi.digitalocean.com/luks-encrypted: "true"
dobs.csi.digitalocean.com/luks-cipher: "aes-xts-plain64"
dobs.csi.digitalocean.com/luks-key-size: "512"
csi.storage.k8s.io/node-stage-secret-namespace: "kube-system"
csi.storage.k8s.io/node-stage-secret-name: "luks-key"

---

kind: StorageClass
apiVersion: storage.k8s.io/v1
metadata:
name: do-block-storage-luks
provisioner: dobs.csi.digitalocean.com
allowVolumeExpansion: true
parameters:
dobs.csi.digitalocean.com/luks-encrypted: "true"
dobs.csi.digitalocean.com/luks-cipher: "aes-xts-plain64"
dobs.csi.digitalocean.com/luks-key-size: "512"
csi.storage.k8s.io/node-stage-secret-namespace: ${pvc.namespace}
csi.storage.k8s.io/node-stage-secret-name: ${pvc.name}-luks-key

---

kind: StorageClass
apiVersion: storage.k8s.io/v1
metadata:
Expand Down Expand Up @@ -443,6 +473,8 @@ spec:
mountPropagation: "Bidirectional"
- name: device-dir
mountPath: /dev
- name: tmpfs
mountPath: /tmp
volumes:
- name: registration-dir
hostPath:
Expand All @@ -462,6 +494,10 @@ spec:
- name: udev-rules-dir
hostPath:
path: /etc/udev/rules.d/
# to make sure temporary stored luks keys never touch a disk
- name: tmpfs
emptyDir:
medium: Memory
---

apiVersion: v1
Expand Down
Loading