By default, all RBD APIs treat encrypted Ceph Block Device images the same way as
unencrypted Ceph Block Device images. You can read or write raw data anywhere in the
image.
Writing raw data into the image might risk the integrity of the encryption format. For example,
the raw data could override the encryption metadata located at the beginning of the image. To safely
perform encrypted Input/Output( I/O) or maintenance operations on the encrypted RBD image, an
additional encryption load operation must be applied immediately after opening the image.
The encryption load operation requires you to specify the encryption format and a passphrase. All
I/Os for the opened RBD image are encrypted or decrypted, for a cloned RBD image, this includes I/Os
for the parent images. The encryption key is stored in memory by the RBD client until the image is
closed.
Note: Once the encryption is loaded on the RBD image, no other encryption load or format
operation can be applied. Additionally, API calls for retrieving the RBD image size using the opened
image context return the effective image size. The encryption is loaded automatically when mapping
the Ceph Block Device images as block devices through rbd-nbd.
Note: API calls for retrieving the image size and the parent overlap using the opened
image context returns the effective image size and the effective parent overlap.
Note: If a clone of an encrypted image is explicitly formatted, flattening or shrinking
of the cloned image ceases to be transparent since the parent data must be re-encrypted according to
the cloned image format as it is copied from the parent snapshot. If encryption is not loaded before
the flatten operation is issued, any parent data that was previously accessible in the cloned image
might become unreadable.
Note: If a clone of an encrypted image is explicitly formatted, the operation of
shrinking the cloned image ceases to be transparent. This is because, in scenarios such as the
cloned image containing snapshots or the cloned image being shrunk to a size that is not aligned
with the object size, the action of copying some data from the parent snapshot, similar to
flattening is involved. If encryption is not loaded before the shrink operation is issued, any
parent data that was previously accessible in the cloned image might become unreadable.