Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Adds option for volume encryption and setup for volume encryption #178

Closed
wants to merge 1 commit into from
Closed

Adds option for volume encryption and setup for volume encryption #178

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions charts/longhorn/templates/NOTES.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,18 @@
{{- if .Values.persistence.encryption.enabled }}
###############################################################################
IMPORTANT: Backup the Encryption Secret
###############################################################################
Encryption has been enabled for your Longhorn volumes. To avoid losing access to your encrypted volumes, it’s crucial to back up the encryption secret.

To backup the encryption secret, use the following command:

kubectl get secret {{ .Values.persistence.encryption.secretName | default "longhorn-crypto" }} -n {{ include "release_namespace" . }} -o yaml > encryption-secret-backup.yaml

Store this file securely, as losing this secret will result in permanent data loss for encrypted volumes.

###############################################################################
{{- end }}

Longhorn is now installed on the cluster!

Please wait a few minutes for other Longhorn components such as CSI deployments, Engine Images, and Instance Managers to be initialized.
Expand Down
9 changes: 9 additions & 0 deletions charts/longhorn/templates/storageclass.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,3 +54,12 @@ data:
{{- if .Values.persistence.disableRevisionCounter }}
disableRevisionCounter: "{{ .Values.persistence.disableRevisionCounter }}"
{{- end }}
{{- if .Values.persistence.encryption.enabled }}
encrypted: "true"
csi.storage.k8s.io/provisioner-secret-name: {{ .Values.persistence.encryption.secretName | default "longhorn-crypto" | quote }}
csi.storage.k8s.io/provisioner-secret-namespace: {{ .Values.persistence.encryption.secretNamespace | default (include "release_namespace" .) | quote }}
csi.storage.k8s.io/node-publish-secret-name: {{ .Values.persistence.encryption.secretName | default "longhorn-crypto" | quote }}
csi.storage.k8s.io/node-publish-secret-namespace: {{ .Values.persistence.encryption.secretNamespace | default (include "release_namespace" .) | quote }}
csi.storage.k8s.io/node-stage-secret-name: {{ .Values.persistence.encryption.secretName | default "longhorn-crypto" | quote }}
csi.storage.k8s.io/node-stage-secret-namespace: {{ .Values.persistence.encryption.secretNamespace | default (include "release_namespace" .) | quote }}
{{- end }}
17 changes: 17 additions & 0 deletions charts/longhorn/templates/volume-encryption-secret.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
{{- if and .Values.persistence.encryption.enabled (not .Values.persistence.encryption.secretName) -}}
apiVersion: v1
kind: Secret
metadata:
name: longhorn-crypto
namespace: {{ include "release_namespace" . }}
data:
{{- $secretObj := (lookup "v1" "Secret" .Release.Namespace "longhorn-crypto") | default dict }}
{{- $secretData := (get $secretObj "data") | default dict }}
{{- $passphrase := (get $secretData "CRYPTO_KEY_VALUE") | default (randAlphaNum 32 | b64enc) }}
CRYPTO_KEY_VALUE: {{ $passphrase | quote }}
CRYPTO_KEY_PROVIDER: {{ ( "secret" | b64enc ) }}
CRYPTO_KEY_CIPHER: {{ ( "aes-xts-plain64" | b64enc ) }}
CRYPTO_KEY_HASH: {{ ( "sha256" | b64enc ) }}
CRYPTO_KEY_SIZE: {{ ( "256" | b64enc ) }}
CRYPTO_PBKDF: {{ ( "argon2i" | b64enc ) }}
{{- end }}
9 changes: 9 additions & 0 deletions charts/longhorn/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -172,6 +172,15 @@ persistence:
selector: ""
# -- Setting that allows you to enable automatic snapshot removal during filesystem trim for a Longhorn StorageClass. (Options: "ignored", "enabled", "disabled")
removeSnapshotsDuringFilesystemTrim: ignored
encryption:
# -- Setting that allows you to enable volume encryption with a global secret (Details: https://longhorn.io/docs/1.7.1/advanced-resources/security/volume-encryption/).
# -- Requirements: To use encrypted volumes, ensure that the dm_crypt kernel module is loaded and that cryptsetup is installed on your worker nodes.
enabled: false
# -- Name of the encryption secret. When not provided, a secret is generated automatically.
# -- Note: As the secret generation uses helms lookup functions to check for existing secrets, there maybe some issues when using CD Tools like ArgoCD, relying on the templating engine and not supporting the lookup functions.
# secretName: ""
# -- Namespace of the encryption secret. Defaults to the release namespace.
# secretNamespace: ""

preUpgradeChecker:
# -- Setting that allows Longhorn to perform pre-upgrade checks. Disable this setting when installing Longhorn using Argo CD or other GitOps solutions.
Expand Down