Skip to content

<feature>[storage]: support backup key restore inheritance #4257

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
zstack-robot-2 wants to merge 1 commit into
base: dev/encrypted-vm-backup-key-agent-client@@3
Choose a base branch
from
Open

<feature>[storage]: support backup key restore inheritance #4257

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions plugin/ceph/src/main/java/org/zstack/storage/ceph/primary/CephPrimaryStorageBase.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -463,6 +463,19 @@ public static class KVMHostLuksConvertCmd implements Serializable {
public Long virtualSize;
}

public static class KVMHostImageStoreEncryptedDownloadCmd implements Serializable {
public String psUuid;
public String hostname;
public String backupStorageInstallPath;
public String primaryStorageInstallPath;
public int concurrency;
public String keyProviderUuid;
public Integer keyVersion;
public String cipher;
@NoLogging
public String encryptedDek;
}

public static class KVMHostEncryptInPlaceCmd implements Serializable {
public String psUuid;
@NoLogging
Expand Down Expand Up @@ -1420,6 +1433,7 @@ public int compareTo(SnapInfo snapInfo) {
public static final String KVM_HOST_LUKS_ENCRYPT_IN_PLACE_PATH = "/ceph/primarystorage/kvmhost/encryptinplace";
public static final String KVM_HOST_LUKS_RESIZE_PATH = "/ceph/primarystorage/kvmhost/luksresize";
public static final String KVM_HOST_LUKS_CONVERT_PATH = "/ceph/primarystorage/kvmhost/luksconvert";
public static final String KVM_HOST_IMAGESTORE_ENCRYPTED_DOWNLOAD_PATH = "/ceph/primarystorage/kvmhost/imagestore/encrypteddownload";
public static final String FLATTEN_PATH = "/ceph/primarystorage/volume/flatten";
public static final String SFTP_DOWNLOAD_PATH = "/ceph/primarystorage/sftpbackupstorage/download";
public static final String SFTP_UPLOAD_PATH = "/ceph/primarystorage/sftpbackupstorage/upload";
Expand Down
15 changes: 15 additions & 0 deletions storage/src/main/java/org/zstack/storage/encrypt/DummyVolumeEncryptedResourceKeyBackend.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,6 +56,11 @@ public boolean checkTemporarySnapshotImageKeyProviderAttached(String imageUuid)
return false;
}

@Override
public boolean checkBackupKeyProviderAttached(String backupUuid) {
return false;
}

@Override
public void copyVolumeKeyToSnapshot(String volumeUuid, String snapshotUuid) {
logger.debug(String.format("ignore copy volume[uuid:%s] key to snapshot[uuid:%s]", volumeUuid, snapshotUuid));
Expand Down Expand Up @@ -86,6 +91,16 @@ public void copyVolumeKeyToBackup(String volumeUuid, String backupUuid) {
logger.debug(String.format("ignore copy volume[uuid:%s] key to backup[uuid:%s]", volumeUuid, backupUuid));
}

@Override
public void copyBackupKeyToTemporarySnapshotImage(String backupUuid, String imageUuid) {
logger.debug(String.format("ignore copy backup[uuid:%s] key to temporary snapshot image[uuid:%s]", backupUuid, imageUuid));
}

@Override
public void copyBackupKeyToVolume(String backupUuid, String volumeUuid) {
logger.debug(String.format("ignore copy backup[uuid:%s] key to volume[uuid:%s]", backupUuid, volumeUuid));
}

@Override
public String defaultKeyProviderUuid() {
return null;
Expand Down
7 changes: 7 additions & 0 deletions storage/src/main/java/org/zstack/storage/encrypt/VolumeEncryptedInitialExtension.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,6 +80,13 @@ private void inheritTemporaryRootVolumeKeyFromOrigin(InstantiateVolumeMsg msg, V
return;
}

// A backup or snapshot temporary image can already provide the target root
// volume key. Keep that key as the source of truth; falling back to the
// origin root would overwrite it or fail if the origin key binding is gone.
if (volumeEncryptedResourceKeyBackend.checkVolumeKeyProviderAttached(volume.getUuid())) {
return;
}

String originVolumeUuid = ((InstantiateTemporaryRootVolumeMsg) msg).getOriginVolumeUuid();
if (StringUtils.isBlank(originVolumeUuid)) {
return;
Expand Down
6 changes: 6 additions & 0 deletions storage/src/main/java/org/zstack/storage/encrypt/VolumeEncryptedResourceKeyBackend.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,8 @@ public interface VolumeEncryptedResourceKeyBackend {

boolean checkTemporarySnapshotImageKeyProviderAttached(String imageUuid);

boolean checkBackupKeyProviderAttached(String backupUuid);

void copyVolumeKeyToSnapshot(String volumeUuid, String snapshotUuid);

void copySnapshotKeyToVolume(String snapshotUuid, String volumeUuid);
Expand All @@ -52,6 +54,10 @@ public interface VolumeEncryptedResourceKeyBackend {

void copyVolumeKeyToBackup(String volumeUuid, String backupUuid);

void copyBackupKeyToTemporarySnapshotImage(String backupUuid, String imageUuid);

void copyBackupKeyToVolume(String backupUuid, String volumeUuid);

/**
* Global default key provider uuid, or null (e.g. NONE / crypto not installed).
*/
Expand Down