ceph-csi icon indicating copy to clipboard operation
ceph-csi copied to clipboard

rbd: add kmip encryption type

Open Rakshith-R opened this issue 3 years ago • 4 comments

The Key Management Interoperability Protocol (KMIP) is an extensible communication protocol that defines message formats for the manipulation of cryptographic keys on a key management server. Ceph-CSI can now be configured to connect to various KMS using KMIP for encrypting RBD volumes.

https://en.wikipedia.org/wiki/Key_Management_Interoperability_Protocol

Resolves: https://github.com/ceph/ceph-csi/issues/3282

Signed-off-by: Rakshith R [email protected]

Heavily inspired from https://github.com/noobaa/noobaa-operator/pull/964#issue-1311434745

Rakshith-R avatar Aug 16 '22 05:08 Rakshith-R

@Rakshith-R looks like ans field has to be renamed for the codespell to be happy :)

./internal/kms/kms_util.go:49: ans ==> and
./internal/kms/kms_util.go:61: ans ==> and
./internal/kms/kms_util.go:71: ans ==> and
./internal/kms/kms_util.go:81: ans ==> and

humblec avatar Aug 16 '22 06:08 humblec

Please split the vendor part from the actual feature, that makes it much easier to review.

nixpanic avatar Aug 16 '22 07:08 nixpanic

This pull request now has conflicts with the target branch. Could you please resolve conflicts and force push the corrected changes? 🙏

mergify[bot] avatar Aug 16 '22 09:08 mergify[bot]

@Rakshith-R can you please address the comments.. I am planning to start the Release work of 3.7, thats why :)

humblec avatar Aug 17 '22 10:08 humblec

mostly nits

Add a note somewhere about how it was tested?

This was tested with pykimp server instance deployed in kubernetes cluster, I'll open an issue to track this, so we can add e2e for kmip encryption in a follow-up pr.

Rakshith-R avatar Aug 18 '22 04:08 Rakshith-R

addressed the comments PTAL @nixpanic @humblec

Rakshith-R avatar Aug 18 '22 05:08 Rakshith-R