<div dir="ltr">Hi Kris,<div><br></div><div>I came across that as well and I believe it has been fixed and ensures existing volumes are accessible:</div><div><br></div><div><a href="https://github.com/openstack/nova/blob/8c3f775743914fe083371a31433ef5563015b029/releasenotes/notes/bug-1633518-0646722faac1a4b9.yaml">https://github.com/openstack/nova/blob/8c3f775743914fe083371a31433ef5563015b029/releasenotes/notes/bug-1633518-0646722faac1a4b9.yaml</a></div><div><br></div><div>Definitely worthwhile to bring up :)</div><div><br></div><div>Joe</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Jan 23, 2017 at 12:53 PM, Kris G. Lindgren <span dir="ltr"><<a href="mailto:klindgren@godaddy.com" target="_blank">klindgren@godaddy.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="white" lang="EN-US" link="blue" vlink="purple">
<div class="m_3021516775107460681WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">Slightly off topic,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">But I remember a discussion involving encrypted volumes and nova(?) and there was an issue where an issue/bug where nova was using the wrong key – like it got hashed wrong and was using
the badly hashed key/password vs’s what was configured.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"><u></u> <u></u></span></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:Calibri;color:black"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:Calibri;color:black">______________________________<wbr>______________________________<wbr>_______<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:Calibri;color:black">Kris Lindgren<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:Calibri;color:black">Senior Linux Systems Engineer<u></u><u></u></span></p>
</div>
</div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:Calibri;color:black">GoDaddy</span><span style="font-size:11.0pt;font-family:Calibri"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"><u></u> <u></u></span></p>
<div style="border:none;border-top:solid #b5c4df 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-family:Calibri;color:black">From: </span>
</b><span style="font-family:Calibri;color:black">Joe Topjian <<a href="mailto:joe@topjian.net" target="_blank">joe@topjian.net</a>><br>
<b>Date: </b>Monday, January 23, 2017 at 12:41 PM<br>
<b>To: </b>"<a href="mailto:openstack-operators@lists.openstack.org" target="_blank">openstack-operators@lists.<wbr>openstack.org</a>" <<a href="mailto:openstack-operators@lists.openstack.org" target="_blank">openstack-operators@lists.<wbr>openstack.org</a>><br>
<b>Subject: </b>[Openstack-operators] Encrypted Cinder Volume Deployment<u></u><u></u></span></p>
</div><div><div class="h5">
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Hi all, <u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">I'm investigating the options for configuring Cinder with encrypted volumes and have a few questions.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">The Cinder environment is currently running Kilo which will be upgraded to something between M-O later this year. The Kilo release supports the fixed_key setting. I see fixed_key is still supported, but has been abstracted into Castellan.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Question: If I configure Kilo with a fixed key, will existing volumes still be able to work with that same fixed key in an M, N, O release?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Next, fixed_key is discouraged because of it being a single key for all tenants. My understanding is that Barbican provides a way for each tenant to generate their own key.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Question: If I deploy with fixed_key (either now or in a later release), can I move from a master key to Barbican without bricking all existing volumes?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Are there any other issues to be aware of? I've done a bunch of Googling and searching on
<a href="http://bugs.launchpad.net" target="_blank">bugs.launchpad.net</a> and am pretty satisfied with the current state of support. My intention is to provide users with simple native encrypted volume support - not so much supporting uploaded volumes, bootable volumes, etc.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">But what I want to make sure of is that I'm not in a position where in order to upgrade, a bunch of volumes become irrecoverable.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Thanks,<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Joe<u></u><u></u></p>
</div>
</div>
</div></div></div>
</div>
</blockquote></div><br></div>