1.
Apache CloudStack
Volume encryption
Vladimir Petrov

2.
About me
l Living in Sofia, father of two boys
l Software engineer in test @ShapeBlue
l 20+ years professional experience in the IT field
l Almost 3 years working with CloudStack on a daily basis

3.
Agenda
l Introduction
l Requirements
l Details
l Supported and unsupported operations
l Hosts preparation
l Service and disk offerings
l Q&A

4.
Introduction
l Coming in the next ACS LTS release 4.18
l Created by Marcus Sorensen from Apple and Suresh Anaparti
l Transparent to the guest OS
l Both root and data volumes can be encrypted
l Two parts implementation:
- API/UI changes
- Storage driver
l First implementation phase

5.
Requirements
l Currently only KVM hypervisor is supported
l QEMU-EV v2.6+ is required
l Supported storage types:
- Local storage
- NFS
- PowerFlex/ScaleIO
- Shared mountpoint

6.
Details
l Simplifies the process of keys management
l The passphrase is stored in the database, encrypted with the
CloudStack’s standard configured DB encryption.
l qcow2 based storage – qemu-img is used to setup the file with
LUKS encryption
l Block based storages (currently just ScaleIO) – cryptsetup utility
is used to format the block device as LUKS for data disks but
qemu-img is used for template copy
l The used cipher is XTS-AES 256 which is a leading industry
standard

7.
VM operations
l Supported VM operations:
- Start/Stop
- Reboot
- Reinstall
- Expunge/recover
- Scale up
- Migrate running instance to another host

8.
VM operations
l Unsupported VM operations:
- VM Snapshot
- Volume snapshot
- Recurring snapshot

9.
Volume operations
l Supported volume operations:
- Attach/detach encrypted volume
- Volume snapshot (stopped VM)
- Revert to snapshot
- Resize
- Delete

10.
Volume operations
l Unsupported volume operations:
- Download volume
- Migrate volume
- Recurring snapshots
- Create template from encrypted volume snapshot
- Create volume from encrypted volume snapshot

11.
Hosts preparation
l Install qemu-ev:
#yum install -y qemu-kvm-common-ev-2.10.0 qemu-kvm-
ev-2.10.0 qemu-img-ev-2.10.0 qemu-kvm-tools-ev-2.10.0
l Install cryptsetup:
#yum install cryptsetup
l Optional:
rngd (EL) or rng-tools (Ubuntu)
package for better entropy
l Restart the agent

12.
Host encryption support
l Verify the host is properly configured

13.
Service offerings
l Adding encryption to service offerings

14.
Disk offerings
l Adding encryption to disk offerings

15.
Future?
l Add support for other hypervisors
l Support more VM/volume operations
l More storage types support – CEPH, Linbit, StorPool?
l Show volume encryption status
l Support LUKS2 encryption

16.
Q&A
Questions?

17.
Thank you!
l Email: vladimir.petrov@shapeblue.com
l LinkedIn: https://www.linkedin.com/in/vladimir/