From e5c1475a0280771d5278cef7aecca6af23a086b4 Mon Sep 17 00:00:00 2001 From: Sebastian Kawelke Date: Sun, 13 Oct 2024 12:30:56 +0200 Subject: [PATCH] Adds option for volume encryption and setup for volume encryption Signed-off-by: Sebastian Kawelke --- charts/longhorn/templates/NOTES.txt | 15 +++++++++++++++ charts/longhorn/templates/storageclass.yaml | 9 +++++++++ .../templates/volume-encryption-secret.yaml | 17 +++++++++++++++++ charts/longhorn/values.yaml | 9 +++++++++ 4 files changed, 50 insertions(+) create mode 100644 charts/longhorn/templates/volume-encryption-secret.yaml diff --git a/charts/longhorn/templates/NOTES.txt b/charts/longhorn/templates/NOTES.txt index cca7cd77..a43a7c05 100644 --- a/charts/longhorn/templates/NOTES.txt +++ b/charts/longhorn/templates/NOTES.txt @@ -1,3 +1,18 @@ +{{- if .Values.persistence.encryption.enabled }} +############################################################################### +IMPORTANT: Backup the Encryption Secret +############################################################################### +Encryption has been enabled for your Longhorn volumes. To avoid losing access to your encrypted volumes, it’s crucial to back up the encryption secret. + +To backup the encryption secret, use the following command: + +kubectl get secret {{ .Values.persistence.encryption.secretName | default "longhorn-crypto" }} -n {{ include "release_namespace" . }} -o yaml > encryption-secret-backup.yaml + +Store this file securely, as losing this secret will result in permanent data loss for encrypted volumes. + +############################################################################### +{{- end }} + Longhorn is now installed on the cluster! Please wait a few minutes for other Longhorn components such as CSI deployments, Engine Images, and Instance Managers to be initialized. diff --git a/charts/longhorn/templates/storageclass.yaml b/charts/longhorn/templates/storageclass.yaml index 64be249f..c589675b 100644 --- a/charts/longhorn/templates/storageclass.yaml +++ b/charts/longhorn/templates/storageclass.yaml @@ -54,3 +54,12 @@ data: {{- if .Values.persistence.disableRevisionCounter }} disableRevisionCounter: "{{ .Values.persistence.disableRevisionCounter }}" {{- end }} + {{- if .Values.persistence.encryption.enabled }} + encrypted: "true" + csi.storage.k8s.io/provisioner-secret-name: {{ .Values.persistence.encryption.secretName | default "longhorn-crypto" | quote }} + csi.storage.k8s.io/provisioner-secret-namespace: {{ .Values.persistence.encryption.secretNamespace | default (include "release_namespace" .) | quote }} + csi.storage.k8s.io/node-publish-secret-name: {{ .Values.persistence.encryption.secretName | default "longhorn-crypto" | quote }} + csi.storage.k8s.io/node-publish-secret-namespace: {{ .Values.persistence.encryption.secretNamespace | default (include "release_namespace" .) | quote }} + csi.storage.k8s.io/node-stage-secret-name: {{ .Values.persistence.encryption.secretName | default "longhorn-crypto" | quote }} + csi.storage.k8s.io/node-stage-secret-namespace: {{ .Values.persistence.encryption.secretNamespace | default (include "release_namespace" .) | quote }} + {{- end }} \ No newline at end of file diff --git a/charts/longhorn/templates/volume-encryption-secret.yaml b/charts/longhorn/templates/volume-encryption-secret.yaml new file mode 100644 index 00000000..ccf51568 --- /dev/null +++ b/charts/longhorn/templates/volume-encryption-secret.yaml @@ -0,0 +1,17 @@ +{{- if and .Values.persistence.encryption.enabled (not .Values.persistence.encryption.secretName) -}} +apiVersion: v1 +kind: Secret +metadata: + name: longhorn-crypto + namespace: {{ include "release_namespace" . }} +data: + {{- $secretObj := (lookup "v1" "Secret" .Release.Namespace "longhorn-crypto") | default dict }} + {{- $secretData := (get $secretObj "data") | default dict }} + {{- $passphrase := (get $secretData "CRYPTO_KEY_VALUE") | default (randAlphaNum 32 | b64enc) }} + CRYPTO_KEY_VALUE: {{ $passphrase | quote }} + CRYPTO_KEY_PROVIDER: {{ ( "secret" | b64enc ) }} + CRYPTO_KEY_CIPHER: {{ ( "aes-xts-plain64" | b64enc ) }} + CRYPTO_KEY_HASH: {{ ( "sha256" | b64enc ) }} + CRYPTO_KEY_SIZE: {{ ( "256" | b64enc ) }} + CRYPTO_PBKDF: {{ ( "argon2i" | b64enc ) }} +{{- end }} \ No newline at end of file diff --git a/charts/longhorn/values.yaml b/charts/longhorn/values.yaml index 5212816d..dccedfc6 100644 --- a/charts/longhorn/values.yaml +++ b/charts/longhorn/values.yaml @@ -172,6 +172,15 @@ persistence: selector: "" # -- Setting that allows you to enable automatic snapshot removal during filesystem trim for a Longhorn StorageClass. (Options: "ignored", "enabled", "disabled") removeSnapshotsDuringFilesystemTrim: ignored + encryption: + # -- Setting that allows you to enable volume encryption with a global secret (Details: https://longhorn.io/docs/1.7.1/advanced-resources/security/volume-encryption/). + # -- Requirements: To use encrypted volumes, ensure that the dm_crypt kernel module is loaded and that cryptsetup is installed on your worker nodes. + enabled: false + # -- Name of the encryption secret. When not provided, a secret is generated automatically. + # -- Note: As the secret generation uses helms lookup functions to check for existing secrets, there maybe some issues when using CD Tools like ArgoCD, relying on the templating engine and not supporting the lookup functions. + # secretName: "" + # -- Namespace of the encryption secret. Defaults to the release namespace. + # secretNamespace: "" preUpgradeChecker: # -- Setting that allows Longhorn to perform pre-upgrade checks. Disable this setting when installing Longhorn using Argo CD or other GitOps solutions.