Enabling volume encryption
Cinder can manage the encryption of volumes, and it happens transparent to the guest. Encryption is enabled on a volume type level.
Getting ready
Encryption can be enabled either when creating a new volume type or added to an existing volume type that has no volumes in use. To enable volume encryption, you will need the following:
An
openrcfile with appropriate credentials for the environmentThe
openstackcommand-line clientThe name of the volume type
Name of the encryption provider
Encryption control location
Encryption key size
Encryption cipher
For our example, these will be as follows:
Name:
Cookbook Encrypted VolumesEncryption provider:
nova.volume.encryptors.luks.LuksEncryptorEncryption control location:
front-endEncryption key size:
256Encryption cipher:
aes-xts-plain64
Note
The encryption-specific values you choose will be based on what is available in your particular environment. A detailed discussion of these values is beyond the scope of this book.
