Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support custom image encryption #2

Open
vishwabmc opened this issue Aug 23, 2022 · 0 comments
Open

Support custom image encryption #2

vishwabmc opened this issue Aug 23, 2022 · 0 comments

Comments

@vishwabmc
Copy link
Contributor

vishwabmc commented Aug 23, 2022

data_mover.py uses qemu to create custom image. At the moment, it is not using the LUKS encryption. Hence, when we import the image, it won't be encrypted. opening this issue so that we add that capability into the data mover.

What does it mean :

  • Create a LUKS passphrase and use it to encrypt the image
    - Gotcha !: This has to be used in clear-text. So, we may need to come up with some mechanism where in it can accept wrapped passphrase ( hereinafter called as : WDEK ) and the code contacts HPCS to get it un-wrapped. This way, we don't have to ask for the clear-text passphrase

  • Pass that WDEK to terraform

    • data_mover.py will unwrap and do the operations.
  • Use the customer_root_key_crn and WDEK in the image.tf

@mjamasri @gaganhegde @anunezde

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant