kms: added Azure Key Vault as a supported KMS #4455

iPraveenParihar · 2024-02-21T05:45:58Z

Describe what this PR does

This commit adds the support for the Azure key vault KMS service
for Ceph CSI.

Related issues

Fixes: #4421
Depends-on: #4477

Checklist:

Commit Message Formatting: Commit titles and messages follow guidelines in the developer guide.
Reviewed the developer guide on Submitting a Pull Request
Pending release notes updated with breaking and/or notable changes for the next major release.
Documentation has been updated, if necessary.
Unit tests have been added, if necessary.
Integration tests have been added, if necessary.


=== Pod mounting =====

I0221 05:36:19.964922  186528 rbd_util.go:352] ID: 32 Req-ID: 0001-0009-rook-ceph-0000000000000002-274e6365-aa70-4afa-9bd7-9e889a8adc00 checking for ImageFeatures: [layering]
I0221 05:36:20.034605  186528 cephcmds.go:105] ID: 32 Req-ID: 0001-0009-rook-ceph-0000000000000002-274e6365-aa70-4afa-9bd7-9e889a8adc00 command succeeded: rbd [device list --format=json --device-type krbd]
I0221 05:36:20.064959  186528 rbd_attach.go:427] ID: 32 Req-ID: 0001-0009-rook-ceph-0000000000000002-274e6365-aa70-4afa-9bd7-9e889a8adc00 rbd: map mon 10.101.166.81:6789
I0221 05:36:20.212976  186528 cephcmds.go:105] ID: 32 Req-ID: 0001-0009-rook-ceph-0000000000000002-274e6365-aa70-4afa-9bd7-9e889a8adc00 command succeeded: rbd [--id csi-rbd-node -m 10.101.166.81:6789 --keyfile=***stripped*** map replicapool/csi-vol-274e6365-aa70-4afa-9bd7-9e889a8adc00 --device-type krbd --options noudev]
I0221 05:36:20.213114  186528 nodeserver.go:422] ID: 32 Req-ID: 0001-0009-rook-ceph-0000000000000002-274e6365-aa70-4afa-9bd7-9e889a8adc00 rbd image: replicapool/csi-vol-274e6365-aa70-4afa-9bd7-9e889a8adc00 was successfully mapped at /dev/rbd0
I0221 05:36:20.240236  186528 encryption.go:82] ID: 32 Req-ID: 0001-0009-rook-ceph-0000000000000002-274e6365-aa70-4afa-9bd7-9e889a8adc00 image replicapool/csi-vol-274e6365-aa70-4afa-9bd7-9e889a8adc00 encrypted state metadata reports "encryptionPrepared"
I0221 05:36:23.697891  186528 crypto.go:261] ID: 32 Req-ID: 0001-0009-rook-ceph-0000000000000002-274e6365-aa70-4afa-9bd7-9e889a8adc00 Encrypting device "/dev/rbd0"	 with LUKS
I0221 05:36:33.318346  186528 crypto.go:320] ID: 32 Req-ID: 0001-0009-rook-ceph-0000000000000002-274e6365-aa70-4afa-9bd7-9e889a8adc00 "/dev/mapper/luks-rbd-0001-0009-rook-ceph-0000000000000002-274e6365-aa70-4afa-9bd7-9e889a8adc00" is not an active LUKS device (an error (exit status 4) occurred while running cryptsetup args: [status luks-rbd-0001-0009-rook-ceph-0000000000000002-274e6365-aa70-4afa-9bd7-9e889a8adc00]):
I0221 05:36:33.318412  186528 crypto.go:272] ID: 32 Req-ID: 0001-0009-rook-ceph-0000000000000002-274e6365-aa70-4afa-9bd7-9e889a8adc00 Opening device "/dev/rbd0" with LUKS on "luks-rbd-0001-0009-rook-ceph-0000000000000002-274e6365-aa70-4afa-9bd7-9e889a8adc00"
I0221 05:36:35.655134  186528 cephcmds.go:105] ID: 32 Req-ID: 0001-0009-rook-ceph-0000000000000002-274e6365-aa70-4afa-9bd7-9e889a8adc00 command succeeded: blockdev [--getsize64 /dev/rbd0]
I0221 05:36:35.656776  186528 cephcmds.go:105] ID: 32 Req-ID: 0001-0009-rook-ceph-0000000000000002-274e6365-aa70-4afa-9bd7-9e889a8adc00 command succeeded: blockdev [--getsize64 /dev/mapper/luks-rbd-0001-0009-rook-ceph-0000000000000002-274e6365-aa70-4afa-9bd7-9e889a8adc00]
I0221 05:36:35.656809  186528 crypto.go:283] ID: 32 Req-ID: 0001-0009-rook-ceph-0000000000000002-274e6365-aa70-4afa-9bd7-9e889a8adc00 Resizing LUKS device "/dev/mapper/luks-rbd-0001-0009-rook-ceph-0000000000000002-274e6365-aa70-4afa-9bd7-9e889a8adc00"
I0221 05:36:35.710597  186528 nodeserver.go:382] ID: 32 Req-ID: 0001-0009-rook-ceph-0000000000000002-274e6365-aa70-4afa-9bd7-9e889a8adc00 rbd: successfully mounted volume 0001-0009-rook-ceph-0000000000000002-274e6365-aa70-4afa-9bd7-9e889a8adc00 to stagingTargetPath /var/lib/kubelet/plugins/kubernetes.io/csi/rook-ceph.rbd.csi.ceph.com/c7184aef29d006913ec1ffd7db0e8d1d69d1fbccb77c25c4666aad492bb9a9b3/globalmount/0001-0009-rook-ceph-0000000000000002-274e6365-aa70-4afa-9bd7-9e889a8adc00


=== Inside POD ===

/dev/mapper/luks-rbd-0001-0009-rook-ceph-0000000000000002-274e6365-aa70-4afa-9bd7-9e889a8adc00  977M  2.5M  958M   1% /var/lib/www/html
tmpfs                                                                                            12G   12K   12G   1% /run/secrets/kubernetes.io/serviceaccount


=== Image metadata ===

[pm@dhcp53-242 examples]$ kubectl exec -it rook-ceph-tools-66b77b8df5-xkhvv -- rbd image-meta ls replicapool/csi-vol-274e6365-aa70-4afa-9bd7-9e889a8adc00
There is 1 metadatum on this image:

Key                         Value
rbd.csi.ceph.com/encrypted  encrypted

=== Pod unmounting ===

I0221 05:41:45.794205  186528 nodeserver.go:1001] ID: 47 Req-ID: 0001-0009-rook-ceph-0000000000000002-274e6365-aa70-4afa-9bd7-9e889a8adc00 successfully unmounted volume (0001-0009-rook-ceph-0000000000000002-274e6365-aa70-4afa-9bd7-9e889a8adc00) from staging path (/var/lib/kubelet/plugins/kubernetes.io/csi/rook-ceph.rbd.csi.ceph.com/c7184aef29d006913ec1ffd7db0e8d1d69d1fbccb77c25c4666aad492bb9a9b3/globalmount/0001-0009-rook-ceph-0000000000000002-274e6365-aa70-4afa-9bd7-9e889a8adc00)
I0221 05:41:45.812138  186528 crypto.go:294] ID: 47 Req-ID: 0001-0009-rook-ceph-0000000000000002-274e6365-aa70-4afa-9bd7-9e889a8adc00 Closing LUKS device "luks-rbd-0001-0009-rook-ceph-0000000000000002-274e6365-aa70-4afa-9bd7-9e889a8adc00"
I0221 05:41:45.924626  186528 cephcmds.go:105] ID: 47 Req-ID: 0001-0009-rook-ceph-0000000000000002-274e6365-aa70-4afa-9bd7-9e889a8adc00 command succeeded: rbd [unmap /dev/rbd0 --device-type krbd --options noudev]
I0221 05:41:45.924710  186528 nodeserver.go:1059] ID: 47 Req-ID: 0001-0009-rook-ceph-0000000000000002-274e6365-aa70-4afa-9bd7-9e889a8adc00 successfully unmapped volume (0001-0009-rook-ceph-0000000000000002-274e6365-aa70-4afa-9bd7-9e889a8adc00)

mergify · 2024-02-21T05:46:34Z

This pull request now has conflicts with the target branch. Could you please resolve conflicts and force push the corrected changes? 🙏

nixpanic

consider adding more details in a document under https://github.com/ceph/ceph-csi/tree/devel/docs/design/proposals

internal/kms/azure_vault.go

docs/deploy-rbd.md

examples/kms/vault/azure-credentials.yaml

internal/kms/azure_vault._test.go

internal/kms/azure_vault.go

internal/kms/kms.go

iPraveenParihar · 2024-03-06T09:30:39Z

/test ci/centos/k8s-e2e-external-storage/1.27

iPraveenParihar · 2024-03-06T11:44:25Z

/test ci/centos/k8s-e2e-external-storage/1.27

iPraveenParihar · 2024-03-07T03:33:34Z

@nixpanic @Rakshith-R PTAL

Rakshith-R

Thanks

Madhu-1

LGTM, @nixpanic please feel free to approve it as you have suggested changes

nixpanic · 2024-03-13T12:44:14Z

@Mergifyio rebase

This commit adds the Azure Key Vault as a supported KMS provider. Signed-off-by: Praveen M <m.praveen@ibm.com>

Signed-off-by: Praveen M <m.praveen@ibm.com>

This commit adds the Azure SDK for Azure key vault KMS integration to the Ceph CSI driver. Signed-off-by: Praveen M <m.praveen@ibm.com>

mergify · 2024-03-13T12:44:52Z

rebase

✅ Branch has been successfully rebased

nixpanic · 2024-03-13T12:44:59Z

@Mergifyio queue

sp98

LGTM

mergify · 2024-03-13T12:45:34Z

queue

✅ The pull request has been merged automatically

The pull request has been merged automatically at 47b2025

ceph-csi-bot · 2024-03-13T12:45:49Z

/test ci/centos/k8s-e2e-external-storage/1.29

ceph-csi-bot · 2024-03-13T12:45:50Z

/test ci/centos/mini-e2e-helm/k8s-1.29

ceph-csi-bot · 2024-03-13T12:45:50Z

/test ci/centos/mini-e2e/k8s-1.29

ceph-csi-bot · 2024-03-13T12:45:51Z

/test ci/centos/k8s-e2e-external-storage/1.28

ceph-csi-bot · 2024-03-13T12:45:51Z

/test ci/centos/k8s-e2e-external-storage/1.27

ceph-csi-bot · 2024-03-13T12:45:51Z

/test ci/centos/mini-e2e-helm/k8s-1.28

ceph-csi-bot · 2024-03-13T12:45:51Z

/test ci/centos/mini-e2e-helm/k8s-1.27

ceph-csi-bot · 2024-03-13T12:45:52Z

/test ci/centos/mini-e2e/k8s-1.28

ceph-csi-bot · 2024-03-13T12:45:52Z

/test ci/centos/mini-e2e/k8s-1.27

ceph-csi-bot · 2024-03-13T12:45:56Z

/test ci/centos/upgrade-tests-cephfs

ceph-csi-bot · 2024-03-13T12:45:56Z

/test ci/centos/upgrade-tests-rbd

iPraveenParihar added the enhancement New feature or request label Feb 21, 2024

iPraveenParihar self-assigned this Feb 21, 2024

iPraveenParihar force-pushed the kms/azure-key-vault branch 2 times, most recently from 6d103a6 to 369d075 Compare February 21, 2024 06:06

iPraveenParihar changed the title ~~[WIP] kms: added Azure Key Vault as a supported KaMS~~ [WIP] kms: added Azure Key Vault as a supported KMS Feb 21, 2024

iPraveenParihar force-pushed the kms/azure-key-vault branch from 369d075 to 1fe9987 Compare February 21, 2024 06:15

nixpanic reviewed Feb 21, 2024

View reviewed changes

internal/kms/azure_vault.go Outdated Show resolved Hide resolved

internal/kms/azure_vault.go Outdated Show resolved Hide resolved

Madhu-1 reviewed Feb 29, 2024

View reviewed changes

iPraveenParihar force-pushed the kms/azure-key-vault branch from 1fe9987 to f98a26c Compare February 29, 2024 10:49

nixpanic reviewed Feb 29, 2024

View reviewed changes

internal/kms/azure_vault.go Outdated Show resolved Hide resolved

nixpanic reviewed Feb 29, 2024

View reviewed changes

internal/kms/azure_vault.go Outdated Show resolved Hide resolved

iPraveenParihar force-pushed the kms/azure-key-vault branch 3 times, most recently from 14a185a to cdcc829 Compare February 29, 2024 16:44

iPraveenParihar marked this pull request as ready for review March 1, 2024 04:26

iPraveenParihar changed the title ~~[WIP] kms: added Azure Key Vault as a supported KMS~~ kms: added Azure Key Vault as a supported KMS Mar 1, 2024

iPraveenParihar force-pushed the kms/azure-key-vault branch 2 times, most recently from f46e967 to 02d2fbb Compare March 4, 2024 07:56

sp98 suggested changes Mar 4, 2024

View reviewed changes

internal/kms/azure_vault.go Outdated Show resolved Hide resolved

internal/kms/azure_vault.go Outdated Show resolved Hide resolved

iPraveenParihar force-pushed the kms/azure-key-vault branch from 02d2fbb to 4305ca1 Compare March 4, 2024 15:15

nixpanic reviewed Mar 5, 2024

View reviewed changes

internal/kms/kms.go Outdated Show resolved Hide resolved

iPraveenParihar mentioned this pull request Mar 6, 2024

please add the context for the other DEKStore functions too. #4476

Closed

iPraveenParihar force-pushed the kms/azure-key-vault branch 2 times, most recently from 7649c8c to 3cbf7c3 Compare March 6, 2024 08:47

iPraveenParihar force-pushed the kms/azure-key-vault branch 2 times, most recently from 1b0ca36 to ae13d82 Compare March 6, 2024 10:54

iPraveenParihar force-pushed the kms/azure-key-vault branch 2 times, most recently from e68cdb2 to cdd1f41 Compare March 13, 2024 10:01

iPraveenParihar requested review from Rakshith-R and Madhu-1 March 13, 2024 10:59

Rakshith-R approved these changes Mar 13, 2024

View reviewed changes

Madhu-1 reviewed Mar 13, 2024

View reviewed changes

nixpanic approved these changes Mar 13, 2024

View reviewed changes

iPraveenParihar added 3 commits March 13, 2024 12:44

kms: Implement Azure key vault as KMS provider

349f7d6

This commit adds the Azure Key Vault as a supported KMS provider. Signed-off-by: Praveen M <m.praveen@ibm.com>

doc: added docs for Azure KMS

9f891d3

Signed-off-by: Praveen M <m.praveen@ibm.com>

rebase: Azure key vault module dependency update

a95efee

This commit adds the Azure SDK for Azure key vault KMS integration to the Ceph CSI driver. Signed-off-by: Praveen M <m.praveen@ibm.com>

nixpanic force-pushed the kms/azure-key-vault branch from cdd1f41 to a95efee Compare March 13, 2024 12:44

sp98 suggested changes Mar 13, 2024

View reviewed changes

mergify bot added the ok-to-test Label to trigger E2E tests label Mar 13, 2024

ceph-csi-bot removed the ok-to-test Label to trigger E2E tests label Mar 13, 2024

mergify bot merged commit 47b2025 into ceph:devel Mar 13, 2024
34 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

kms: added Azure Key Vault as a supported KMS #4455

kms: added Azure Key Vault as a supported KMS #4455

iPraveenParihar commented Feb 21, 2024 •

edited by nixpanic

Loading

mergify bot commented Feb 21, 2024

nixpanic left a comment

iPraveenParihar commented Mar 6, 2024

iPraveenParihar commented Mar 6, 2024

iPraveenParihar commented Mar 7, 2024

Rakshith-R left a comment

Madhu-1 left a comment

nixpanic commented Mar 13, 2024

mergify bot commented Mar 13, 2024

nixpanic commented Mar 13, 2024

sp98 left a comment •

edited

Loading

mergify bot commented Mar 13, 2024 •

edited

Loading

ceph-csi-bot commented Mar 13, 2024

ceph-csi-bot commented Mar 13, 2024

ceph-csi-bot commented Mar 13, 2024

ceph-csi-bot commented Mar 13, 2024

ceph-csi-bot commented Mar 13, 2024

ceph-csi-bot commented Mar 13, 2024

ceph-csi-bot commented Mar 13, 2024

ceph-csi-bot commented Mar 13, 2024

ceph-csi-bot commented Mar 13, 2024

ceph-csi-bot commented Mar 13, 2024

ceph-csi-bot commented Mar 13, 2024

kms: added Azure Key Vault as a supported KMS #4455

kms: added Azure Key Vault as a supported KMS #4455

Conversation

iPraveenParihar commented Feb 21, 2024 • edited by nixpanic Loading

Describe what this PR does

Related issues

mergify bot commented Feb 21, 2024

nixpanic left a comment

Choose a reason for hiding this comment

iPraveenParihar commented Mar 6, 2024

iPraveenParihar commented Mar 6, 2024

iPraveenParihar commented Mar 7, 2024

Rakshith-R left a comment

Choose a reason for hiding this comment

Madhu-1 left a comment

Choose a reason for hiding this comment

nixpanic commented Mar 13, 2024

mergify bot commented Mar 13, 2024

✅ Branch has been successfully rebased

nixpanic commented Mar 13, 2024

sp98 left a comment • edited Loading

Choose a reason for hiding this comment

mergify bot commented Mar 13, 2024 • edited Loading

✅ The pull request has been merged automatically

ceph-csi-bot commented Mar 13, 2024

ceph-csi-bot commented Mar 13, 2024

ceph-csi-bot commented Mar 13, 2024

ceph-csi-bot commented Mar 13, 2024

ceph-csi-bot commented Mar 13, 2024

ceph-csi-bot commented Mar 13, 2024

ceph-csi-bot commented Mar 13, 2024

ceph-csi-bot commented Mar 13, 2024

ceph-csi-bot commented Mar 13, 2024

ceph-csi-bot commented Mar 13, 2024

ceph-csi-bot commented Mar 13, 2024

iPraveenParihar commented Feb 21, 2024 •

edited by nixpanic

Loading

sp98 left a comment •

edited

Loading

mergify bot commented Mar 13, 2024 •

edited

Loading