Support for LUKS disk encryption for local-storage

[wokalski]

Support for LUKS encryption for local-storage can make hwameistor an even more complete solution. I'd like to be able to say; here's a PVC, encrypt it with LUKS with the key from this secret. And it'd create a logical volume encrypted with the given secret.

I think it might be a bit more challenging for local-disk stuff so I'd like to separate those two out into separate feature requests.

[SSmallMonster]

@wokalski Thanks for your feedback, data volume encryption is really important, especially inside scenarios with high data security requirements.

This feature is currently in our planning, it would be great if you could contribute to this feature, and if you have any questions during this process, please feel free to contact us, we will provide as much help as possible!

[wokalski]

I think i might be able to contribute it but I'd need some information how you'd like it implemented:

1. Example how it would be configured
2. The encryption method on the lvm level - which commands etc would be used to perform encryption and decryption
3. Any "tricky situations" that come to your mind.

Thank you!

[SSmallMonster]

1. Example how it would be configured

I think this has to do with how users use it. Perhaps both StorageClass and LocalVolume should reflect whether encryption is applied and how it is done.

LocalVolume is our custom resource, which corresponds one-to-one to PV. Generally speaking, the information of the data volume will be included in this resource.
See https://github.com/hwameistor/hwameistor/blob/main/pkg/apis/hwameistor/v1alpha1/localvolume_types.go for more details.

As for the encryption key information, it might be associated through secrets. This relationship can be maintained in the StorageClass.

These are some of my current ideas about this. If there is a better way, please feel free to communicate~

[SSmallMonster]

3. Any "tricky situations" that come to your mind.

Actually, I'm not sure whether all the physical volumes (PVs) in a volume group (VG) should have the same encryption policy. If a data volume spans across multiple PVs with different encryption policies, is there any security risk?

[SSmallMonster]

2. The encryption method on the lvm level - which commands etc would be used to perform encryption and decryption

cryptsetup can achieve LVM encryption, but I am thinking that having an LV level encryption method may be more flexible.I'm not sure if there is such a tool.

Ref: https://linuxhint.com/encrypt-lvm-volumes-luks/

[wokalski]

cryptsetup can achieve LVM encryption, but I am thinking that having an LV level encryption method may be more flexible.I'm not sure if there is such a tool.

cryptsetup can be used for LV level encryption as well so it's the right tool for the job 👍.

---

I will think about the rest and get back to you soon.

[AmazingPangWei]

Same requirement.

[AmazingPangWei]

@wokalski Hi, are you still working on this issue?

[wokalski]

Unfortunately I'm not working on it actively. It is in my backlog but untouched.