Adding encryption format to images and clones

Edit online

Add encryption format to images and clones with the rbd encryption format command. Given a LUKS2-formatted image, you can create both a LUKS2-formatted clone and a LUKS1-formatted clone.

Layered-client-side encryption is supported. The cloned images can be encrypted with their own format and passphrase, potentially different from that of the parent image.

Prerequisites

Edit online

  • A running IBM Storage Ceph cluster with RADOS Block Device (RBD) configured.

  • Root-level access to the node.

Procedure

Edit online

  1. Create a LUKS2-formatted image:

    Syntax 

     rbd create --size SIZE POOL_NAME/LUKS_IMAGE
 rbd encryption format POOL_NAME/LUKS_IMAGE luks1|luks2 PASSPHRASE_FILE
 rbd resize --size 50G --encryption-passphrase-file PASSPHRASE_FILE POOL_NAME/LUKS_IMAGE

    Example 

     [ceph: root@host01 /]# rbd create --size 50G mypool/myimage
 [ceph: root@host01 /]# rbd encryption format mypool/myimage luks2 passphrase.txt
 [ceph: root@host01 /]# rbd resize --size 50G --encryption-passphrase-file passphrase.txt mypool/myimage

    The rbd resize command grows the image to compensate for the overhead associated with the LUKS2 header.

  2. With the LUKS2-formatted image, create a LUKS2-formatted clone with the same effective size:

    Syntax 

     rbd snap create POOL_NAME/IMAGE_NAME@SNAP_NAME
 rbd snap protect POOL_NAME/IMAGE_NAME@SNAP_NAME
 rbd clone POOL_NAME/IMAGE_NAME@SNAP_NAME POOL_NAME/CLONE_NAME
 rbd encryption format POOL_NAME/CLONE_NAME luks1 CLONE_PASSPHRASE_FILE

    Example 

     [ceph: root@host01 /]# rbd snap create mypool/myimage@snap
 [ceph: root@host01 /]# rbd snap protect mypool/myimage@snap
 [ceph: root@host01 /]# rbd clone mypool/myimage@snap mypool/myclone
 [ceph: root@host01 /]# rbd encryption format mypool/myclone luks1 clone-passphrase.bin

  3. With the LUKS2-formatted image, create a LUKS1-formatted clone with the same effective size:

    Syntax 

     rbd snap create POOL_NAME/IMAGE_NAME@SNAP_NAME
 rbd snap protect POOL_NAME/IMAGE_NAME@SNAP_NAME
 rbd clone POOL_NAME/IMAGE_NAME@SNAP_NAME POOL_NAME/CLONE_NAME
 rbd encryption format POOL_NAME/CLONE_NAME luks1 CLONE_PASSPHRASE_FILE
 rbd resize --size SIZE --allow-shrink --encryption-passphrase-file CLONE_PASSPHRASE_FILE --encryption-passphrase-file PASSPHRASE_FILE POOL_NAME/CLONE_NAME

    Example 

     [ceph: root@host01 /]# rbd snap create mypool/myimage@snap
 [ceph: root@host01 /]# rbd snap protect mypool/myimage@snap
 [ceph: root@host01 /]# rbd clone mypool/myimage@snap mypool/myclone
 [ceph: root@host01 /]# rbd encryption format mypool/myclone luks1 clone-passphrase.bin
 [ceph: root@host01 /]# rbd resize --size 50G --allow-shrink --encryption-passphrase-file clone-passphrase.bin --encryption-passphrase-file passphrase.bin mypool/myclone

    Since LUKS1 header is usually smaller than LUKS2 header, the rbd resize command at the end shrinks the cloned image to get rid of unwanted space allowance.

  4. With the LUKS-1-formatted image, create a LUKS2-formatted clone with the same effective size:

    Syntax 

     rbd resize --size SIZE POOL_NAME/LUKS_IMAGE
 rbd snap create POOL_NAME/IMAGE_NAME@SNAP_NAME
 rbd snap protect POOL_NAME/IMAGE_NAME@SNAP_NAME
 rbd clone POOL_NAME/IMAGE_NAME@SNAP_NAME POOL_NAME/CLONE_NAME
 rbd encryption format POOL_NAME/CLONE_NAME luks2 CLONE_PASSPHRASE_FILE
 rbd resize --size SIZE --allow-shrink --encryption-passphrase-file PASSPHRASE_FILE POOL_NAME/LUKS_IMAGE
 rbd resize --size SIZE --allow-shrink --encryption-passphrase-file CLONE_PASSPHRASE_FILE --encryption-passphrase-file PASSPHRASE_FILE POOL_NAME/CLONE_NAME

    Example 

     [ceph: root@host01 /]# rbd resize --size 51G mypool/myimage
 [ceph: root@host01 /]# rbd snap create mypool/myimage@snap
 [ceph: root@host01 /]# rbd snap protect mypool/myimage@snap
 [ceph: root@host01 /]# rbd clone mypool/my-image@snap mypool/myclone
 [ceph: root@host01 /]# rbd encryption format mypool/myclone luks2 clone-passphrase.bin
 [ceph: root@host01 /]# rbd resize --size 50G --allow-shrink --encryption-passphrase-file passphrase.bin mypool/myimage
 [ceph: root@host01 /]# rbd resize --size 50G --allow-shrink --encryption-passphrase-file clone-passphrase.bin --encryption-passphrase-file passphrase.bin mypool/myclone

    Since LUKS2 header is usually bigger than LUKS1 header, the rbd resize command at the beginning temporarily grows the parent image to reserve some extra space in the parent snapshot and consequently the cloned image. This is necessary to make all parent data accessible in the cloned image. The rbd resize command at the end shrinks the parent image back to its original size and does not impact the parent snapshot and the cloned image to get rid of the unused reserved space.

    The same applies to creating a formatted clone of an unformatted image, since an unformatted image does not have a header at all.