13:04:45 #startmeeting image_encryption 13:04:45 Meeting started Mon Apr 15 13:04:45 2024 UTC and is due to finish in 60 minutes. The chair is Luzi. Information about MeetBot at http://wiki.debian.org/MeetBot. 13:04:45 Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. 13:04:45 The meeting name has been set to 'image_encryption' 13:04:53 #topic Roll Call 13:04:54 ahoy! 13:04:58 hi 13:05:11 #topic Image Encryption Spec 13:05:58 So in the PTG the Nova team approached the Cinder and Glance team with new requirements and ideas for the image encryption. 13:07:11 is there a summary of the new requirements? 13:07:35 When we started to evaluate the image encryption a few years ago the tooling to encrypt images with LUKS for endusers were not easy and would have required root privilege and other things 13:08:02 now qemu has tooling which makes it easier, and my colleague already tested it 13:08:25 oh very cool 13:08:34 as Nova and Cinder both use LUKS encryption especially Nonva would like to not have to convert between gpg and LUKS 13:09:37 so with this "new" qemu features and Glance being just a storage for images, we agreed to rework the whole spec to use LUKS instead of GPG 13:10:24 in that way, there are no decrypting mechanisms needed in nova - and cinder will only need to convert from qcow2-LUKS to raw LUKS blocks 13:10:34 (as far as i did understand it) 13:10:47 sounds more efficient too 13:10:51 yeah 13:11:31 but we still need to standardize all possible metadata in glance and look through all possible workflows 13:11:56 so I wrote a new Spec that incorporates this. 13:12:27 #link https://review.opendev.org/c/openstack/glance-specs/+/915726 13:12:50 It is also very fortunate to have the Secret Consumers in Barbican, because we will still need them 13:13:00 they may even get a bigger role 13:13:47 so... that is a big change 13:13:52 indeed 13:13:58 thanks for the update! 13:14:18 but in the end we hope that with the alignment in all services we will have better overall workflows 13:14:28 the end result sounds like it will be easier to maintain long-term at least 13:14:33 yea 13:14:54 although - this could have happened a bit earlier for my taste :D 13:15:11 of course 13:15:36 it's a significant course change which invalidates a lot of earlier work 13:15:54 well - I will focus on getting the patch through and looking into Cinder and what work need to be done there 13:16:24 maybe this will at least help increase the review priority for the new parts 13:16:43 overall the feature will be smaller and more easy to review 13:16:56 which is good i think 13:17:53 yeah 13:18:07 #topic Open Discussion 13:18:19 do you have anything you want to talk about? 13:20:19 i did not, but other than the new nova requirements was there anything else useful to come out of ptg discussions about image encryption? 13:23:51 hm some things in how nova and cinder are handling the passphrase or key to encrypt decrypt their LUKS - but I think that is mainly a part on their sides, we would focus on Glance 13:24:26 #link https://etherpad.opendev.org/p/dalmatian-ptg-cinder#L393 13:25:30 interesting, that's useful to note in the design, i guess 13:25:47 thanks! 13:26:54 okay, anything else? 13:27:09 nothing on my end, nope 13:28:39 okay, thank you for joining this meeting and have a nice week 13:28:46 thanks, you too! 13:28:46 #endmeeting image_encryption