目標(biāo)：
創(chuàng)建并使用加密的cinder卷
準(zhǔn)備:
-openstack
過程：
修改配置文件：
將fixed_key的值設(shè)置為cinder-volume-key和一組十六位的十六進(jìn)制的密鑰（控制節(jié)點(diǎn)和計算節(jié)點(diǎn)）
[root@compute ~]# ssh controller
root@controller's password:
Last login: Tue May 28 12:10:00 2019 from compute
[root@controller ~]# sed -n 3524,3532p /etc/nova/nova.conf
[keymgr]
#
# From nova
#
# Fixed key returned by key manager, specified in hex (string value)
fixed_key=cinder-volume-key
fixed_key=0000000000000000
[root@controller ~]# sed -n 2794,2811p /etc/cinder/cinder.conf
[KEYMGR]
#
# From cinder
#
# Authentication url for encryption service. (string value)
#encryption_auth_url = http://localhost:5000/v3
# Url for encryption service. (string value)
#encryption_api_url = http://localhost:9311/v1
# The full class name of the key manager API class (string value)
#api_class = cinder.keymgr.conf_key_mgr.ConfKeyManager
# Fixed key returned by key manager, specified in hex (string value)
fixed_key = cinder-volume-key
fixed_key = 0000000000000000
重啟服務(wù)：
[root@controller ~]# systemctl restart openstack-nova-compute
[root@controller ~]# systemctl restart openstack-cinder-volume
[root@compute ~]# systemctl restart openstack-nova-compute
[root@compute ~]# systemctl restart openstack-cinder-volume
創(chuàng)建加密卷類型：
[root@controller ~]# cinder type-create luks
+--------------------------------------+------+-------------+-----------+
| ID | Name | Description | Is_Public |
+--------------------------------------+------+-------------+-----------+
| bd278099-ad80-4f54-b1da-e0734ee33cba | luks | - | True |
+--------------------------------------+------+-------------+-----------+
[root@controller ~]# cinder encryption-type-create --cipher aes-xts-plain64 --key_size 512 --control_location front-end luks nova.volume.encryptors.luks.LuksEncryptor
+--------------------------------------+-------------------------------------------+-----------------+----------+------------------+
| Volume Type ID | Provider | Cipher | Key Size | Control Location |
+--------------------------------------+-------------------------------------------+-----------------+----------+------------------+
| bd278099-ad80-4f54-b1da-e0734ee33cba | nova.volume.encryptors.luks.LuksEncryptor | aes-xts-plain64 | 512 | front-end |
+--------------------------------------+-------------------------------------------+-----------------+----------+------------------+
創(chuàng)建cinder卷：
未加密：[root@controller ~]# cinder create --name unencrypted 1
加密：[root@controller ~]# cinder create --name encrypted --volume-type luks 1
掛載到云主機(jī)進(jìn)行測試：
加密卷：
[root@controller ~]# nova volume-attach iaas 89f2cc72-435e-4136-b32f-44acdd96a8a7
+----------+--------------------------------------+
| Property | Value |
+----------+--------------------------------------+
| device | /dev/vdb |
| id | 89f2cc72-435e-4136-b32f-44acdd96a8a7 |
| serverId | 3089a676-1394-4e0b-bad7-e9ed1f43e676 |
| volumeId | 89f2cc72-435e-4136-b32f-44acdd96a8a7 |
+----------+--------------------------------------+
未加密：
[root@controller ~]# nova volume-attach iaas c4fa8087-e648-4ee4-ba24-be8d56835d98
+----------+--------------------------------------+
| Property | Value |
+----------+--------------------------------------+
| device | /dev/vdc |
| id | c4fa8087-e648-4ee4-ba24-be8d56835d98 |
| serverId | 3089a676-1394-4e0b-bad7-e9ed1f43e676 |
| volumeId | c4fa8087-e648-4ee4-ba24-be8d56835d98 |
+----------+--------------------------------------+
測試：
到云主機(jī)里向卷內(nèi)寫入數(shù)據(jù)
[root@xiandian ~]# echo "encrypted /dev/vdb Hello,world" >> /dev/vdb
[root@xiandian ~]# echo "unencrypted /dev/vdc Hello,world" >> /dev/vdc
到cinder卷所在節(jié)點(diǎn)驗證：
未加密的卷信息就會暴露出來
[root@compute ~]# strings /dev/mapper/cinder--volumes-volume--* | grep "Hello,world"
unencrypted /dev/vdc Hello,world
