Libvirt: Native LUKS file and host device decryption by QEMU

Registered by Lee Yarwood on 2017-04-04

QEMU 2.6 and Libvirt 2.2.0 allow LUKS files and host block devices to be
decrypted natively by QEMU. This spec outlines the required changes to utilise
this new functionality within the Libvirt Nova virt driver and the possible
benefits associated with doing so.

Blueprint information

Status:
Complete
Approver:
Matt Riedemann
Priority:
Low
Drafter:
Lee Yarwood
Direction:
Approved
Assignee:
Lee Yarwood
Definition:
Approved
Series goal:
Accepted for queens
Implementation:
Implemented
Milestone target:
milestone icon queens-rc1
Started by
Matt Riedemann on 2017-12-01
Completed by
Matt Riedemann on 2018-01-31

Related branches

Sprints

Whiteboard

Gerrit topic: https://review.openstack.org/#q,topic:bp/libvirt-qemu-native-luks,n,z

Addressed by: https://review.openstack.org/437070
    Libvirt: Native LUKS file and host device decryption by QEMU

Addressed by: https://review.openstack.org/464008
    libvirt: Introduce disk encryption config classes

Where are we at with this series? I know Lee was re-assigned for some other things for awhile, so is anyone else going to pick this up because it's getting late for Pike (we're 3 weeks from feature freeze). -- mriedem 20170707

Work on this has stalled for Pike so I'm deferring it to Queens when maybe Lee will have more time to come back to it. -- mriedem 20170725

Addressed by: https://review.openstack.org/490824
    Libvirt: Native LUKS file and host device decryption by QEMU

Re-approved for Queens. -- mriedem 20171003

Gerrit topic: https://review.openstack.org/#q,topic:bp/libvirt-qemu-luks-support,n,z

Addressed by: https://review.openstack.org/523958
    WIP libvirt: Use QEMU's native LUKS support

Addressed by: https://review.openstack.org/460243
    libvirt: Refactor encryptor attach and detach calls

Addressed by: https://review.openstack.org/536350
    DNM: Test LM with encrypted volumes

Addressed by: https://review.openstack.org/537642
    Add release note for QEMU native LUKS decryption

Addressed by: https://review.openstack.org/540679
    libvirt: Add missing encryption_secret_uuid tests

Addressed by: https://review.openstack.org/540861
    libvirt: Collocate encryptor and volume driver calls

Addressed by: https://review.openstack.org/545074
    DNM: Test LM with encrypted volumes

Addressed by: https://review.openstack.org/545093
    DNM: Test LM with encrypted volumes

(?)

Work Items

This blueprint contains Public information 
Everyone can see this information.