Add helpers for vaultlocker #159
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add a new context and utility function to help charms make use of vault and vaultlocker for storage and retrieval of dmcrypt keys in Hashicorp Vault.
javacruft
force-pushed
the
vaultlocker-helpers
branch
from
9b1649a
to
450ab9b
Compare
openstack-gerrit
pushed a commit
to openstack/charm-ceph-osd
that referenced
this pull request
May 15, 2018
vaultlocker provides support for storage of encryption keys for LUKS based dm-crypt device in Hashicorp Vault. Add support for this key management approach for Ceph Luminous or later. Applications will block until vault has been initialized and unsealed at which point OSD devices will be prepared and booted into the Ceph cluster. The dm-crypt layer is placed between the block device parition and the top level LVM PV used to create VG's and LV's to support OSD operation. Vaultlocker enables a systemd unit for each encrypted block device to perform unlocking during reboots of the unit; ceph-volume will then detect the new VG/LV's and boot the ceph-osd processes as required. Note that vault/vaultlocker usage is only supported with ceph-volume, which was introduced into the Ubuntu packages as of the 12.2.4 point release for Luminous. If vault is configured as the key manager in deployments using older versions, a hook error will be thrown with a blocked status message to this effect. Change-Id: I713492d1fd8d371439e96f9eae824b4fe7260e47 Depends-On: If73e7bd518a7bc60c2db08e2aa3a93dcfe79c0dd Depends-On: juju/charm-helpers#159
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add a new context and utility function to help charms make use of
vault and vaultlocker for storage and retrieval of dmcrypt keys
in Hashicorp Vault.