Create an encrypted share

You create a share with tenant-supplied encryption keys stored in the Key Manager service (barbican). You upload a symmetric encryption key and reference it when creating the share for encryption at rest.

Before you begin

  • You have credentials for an OpenStack project where the Shared File Systems service (manila) and Key Manager service (barbican) are available.
  • Your cloud administrator has configured a share type that supports encryption with encryption_support=share_server.
  • You have a share network configured for use with encrypted shares.
  • You have the python-openstackclient and python-manilaclient CLI tools installed.

About this task

Considerations
  • You can mount and use encrypted shares the same as any non-encrypted share. The storage back end handles encryption and decryption transparently.
  • Do not delete the Key Manager service secret while the share is in use. The storage back end retrieves the key when bringing volumes online. Deleting the secret makes the share data inaccessible.
  • To rotate encryption keys, create a new share with a new Key Manager service secret and migrate the data manually. The Shared File Systems service does not perform automatic key rotation.
  • Snapshots and replicas of an encrypted share inherit the same encryption key.

Procedure

  1. Generate a 256-bit AES encryption key and upload it to the Key Manager service: 
    $ KEY_BASE64=$(openssl rand -base64 32)
$ openstack secret store \
    --name my-encryption-key \
    --payload "$KEY_BASE64" \
    --payload-content-type "application/octet-stream" \
    --payload-content-encoding base64 \
    --secret-type symmetric \
    --algorithm AES \
    --bit-length 256 \
    --mode CBC

    In the output, record the UUID portion of the Secret href field for use in the next step:

    +---------------+-------------------------------------------------------+
| Field         | Value                                                 |
+---------------+-------------------------------------------------------+
| Secret href   | https://<barbican_host>/v1/secrets/<secret_uuid>      |
| Name          | my-encryption-key                                     |
| Algorithm     | AES                                                   |
| Bit length    | 256                                                   |
| Secret type   | symmetric                                             |
| Mode          | CBC                                                   |
+---------------+-------------------------------------------------------+
  2. Optional: List the secrets in your project to verify the upload: 
    $ openstack secret list
  3. Create the encrypted share by passing the Key Manager service secret reference: 
    $ openstack share create NFS 1 \
    --name <share_name> \
    --share-type <share_type> \
    --share-network <share_network> \
    --encryption-key-ref <secret_uuid>
    • Replace <share_name> with a name for your encrypted share.
    • Replace <share_type> with the name of the share type configured for encryption.
    • Replace <share_network> with the name or ID of your share network.
    • Replace <secret_uuid> with the UUID from the Key Manager service secret reference. You can use either the bare UUID or the full secret href URL.

      If the share type does not support encryption_support=share_server, the API rejects the request with an error message.

  4. Verify that the share was created successfully: 
    $ openstack share show <share_name>

    Replace <share_name> with the name of your encrypted share.

    In the output, confirm that the encryption_key_ref field displays the Key Manager service secret UUID and that the share status is available:

    +---------------------------+--------------------------------------------+
| Field                     | Value                                      |
+---------------------------+--------------------------------------------+
| id                        | <share_id>                                 |
| name                      | <share_name>                               |
| status                    | available                                  |
| share_type_name           | <share_type>                               |
| share_network_id          | <share_network>                            |
| encryption_key_ref        | <secret_uuid>                              |
+---------------------------+--------------------------------------------+

Results

  • Grant access to the encrypted share and mount it on a client instance to verify that encryption and decryption are transparent: 
    $ openstack share access create <share_name> ip <client_ip> --access-level rw
$ openstack share access list <share_name>

    Replace <share_name> with the name of your encrypted share and <client_ip> with the IP address of the client instance.