Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

issue-176: encryption at rest #2593

Merged
merged 13 commits into from
Dec 9, 2024
Merged

issue-176: encryption at rest #2593

Show file tree
Hide file tree
Changes from 12 commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
f37db1d
restore style
sharpeye Nov 28, 2024
784413f
defer log creation
sharpeye Nov 28, 2024
c5b78fd
setup encryption_at_rest test
sharpeye Nov 28, 2024
d5fd99f
issue-176: encryption at rest for Disk Registry based disks
sharpeye Nov 28, 2024
1e1af26
fix tabs
sharpeye Nov 28, 2024
025602f
tweak
sharpeye Nov 28, 2024
325e8d7
fix tests
sharpeye Nov 29, 2024
d8a52f3
tweak
sharpeye Dec 3, 2024
ea28a3d
local-nonrepl: load-encryption-at-rest
sharpeye Dec 4, 2024
fe7943b
don't create unencrypted disk on failure
sharpeye Dec 4, 2024
f9b68c1
tweak test: check raw data
sharpeye Dec 4, 2024
6d6be47
cleanup
sharpeye Dec 6, 2024
ca8d64b
use IsDiskRegistryLocalMediaKind
sharpeye Dec 6, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions cloud/blockstore/config/storage.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1068,4 +1068,7 @@ message TStorageServiceConfig
// When enabled, the Disk Registry REMOVE_HOST CMS action will "forget"
// agents devices and suspend local devices.
optional bool DiskRegistryCleanupConfigOnRemoveHost = 392;

// Enables the encryption at rest for Disk Registry based disks.
optional bool EncryptionAtRestForDiskRegistryBasedDisksEnabled = 393;
}
1 change: 1 addition & 0 deletions cloud/blockstore/libs/daemon/ydb/bootstrap.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -573,6 +573,7 @@ void TBootstrapYdb::InitKikimrService()
}();
args.VolumeBalancerSwitch = VolumeBalancerSwitch;
args.EndpointEventHandler = EndpointEventHandler;
args.RootKmsKeyProvider = RootKmsKeyProvider;

ActorSystem = NStorage::CreateActorSystem(args);

Expand Down
2 changes: 1 addition & 1 deletion cloud/blockstore/libs/daemon/ydb/config_initializer.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ using namespace NCloud::NBlockStore::NDiscovery;
////////////////////////////////////////////////////////////////////////////////

TConfigInitializerYdb::TConfigInitializerYdb(TOptionsYdbPtr options)
: TConfigInitializerCommon(options)
: TConfigInitializerCommon(options)
, NCloud::NStorage::TConfigInitializerYdbBase(options)
, Options(options)
{}
Expand Down
6 changes: 3 additions & 3 deletions cloud/blockstore/libs/root_kms/impl/client.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -214,9 +214,7 @@ TRootKmsClient::TRootKmsClient(
TCreateRootKmsClientParams params)
: Logging(std::move(logging))
, Params(std::move(params))
, Log(Logging->CreateLog("ROOT_KMS_CLIENT"))
{
}
{}

TRootKmsClient::~TRootKmsClient()
{
Expand All @@ -225,6 +223,8 @@ TRootKmsClient::~TRootKmsClient()

void TRootKmsClient::Start()
{
Log = Logging->CreateLog("ROOT_KMS_CLIENT");

grpc::SslCredentialsOptions sslOpts{
.pem_root_certs = ReadFile(Params.RootCertsFile),
.pem_private_key = ReadFile(Params.PrivateKeyFile),
Expand Down
3 changes: 3 additions & 0 deletions cloud/blockstore/libs/storage/core/config.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -516,6 +516,8 @@ TDuration MSeconds(ui32 value)
xxx(DiskRegistryDisksNotificationTimeout, TDuration, Seconds(5) )\
xxx(BlobStorageAsyncGetTimeoutHDD, TDuration, Seconds(0) )\
xxx(BlobStorageAsyncGetTimeoutSSD, TDuration, Seconds(0) )\
\
xxx(EncryptionAtRestForDiskRegistryBasedDisksEnabled, bool, false ) \

// BLOCKSTORE_STORAGE_CONFIG_RW

Expand Down Expand Up @@ -546,6 +548,7 @@ BLOCKSTORE_STORAGE_CONFIG(BLOCKSTORE_STORAGE_DECLARE_CONFIG)
xxx(ReplaceDevice) \
xxx(UseNonReplicatedHDDInsteadOfReplicated) \
xxx(AddingUnconfirmedBlobs) \
xxx(EncryptionAtRestForDiskRegistryBasedDisks) \

// BLOCKSTORE_BINARY_FEATURES

Expand Down
7 changes: 7 additions & 0 deletions cloud/blockstore/libs/storage/core/config.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -361,6 +361,11 @@ class TStorageConfig
const TString& folderId,
const TString& diskId) const;

[[nodiscard]] bool IsEncryptionAtRestForDiskRegistryBasedDisksFeatureEnabled(
const TString& cloudId,
const TString& folderId,
const TString& diskId) const;

TDuration GetMaxTimedOutDeviceStateDurationFeatureValue(
const TString& cloudId,
const TString& folderId,
Expand Down Expand Up @@ -613,6 +618,8 @@ class TStorageConfig

TDuration GetBlobStorageAsyncGetTimeoutHDD() const;
TDuration GetBlobStorageAsyncGetTimeoutSSD() const;

[[nodiscard]] bool GetEncryptionAtRestForDiskRegistryBasedDisksEnabled() const;
};

ui64 GetAllocationUnit(
Expand Down
7 changes: 7 additions & 0 deletions cloud/blockstore/libs/storage/core/proto_helpers.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,6 +100,13 @@ NProto::TEncryptionDesc ConvertToEncryptionDesc(
NProto::TEncryptionDesc resultDesc;
resultDesc.SetMode(mode);
resultDesc.SetKeyHash(desc.GetKeyHash());

if (desc.HasEncryptedDataKey()) {
auto& key = *resultDesc.MutableEncryptionKey();
key.SetKekId(desc.GetEncryptedDataKey().GetKekId());
key.SetEncryptedDEK(desc.GetEncryptedDataKey().GetCiphertext());
}

return resultDesc;
}

Expand Down
3 changes: 2 additions & 1 deletion cloud/blockstore/libs/storage/init/server/actorsystem.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -216,7 +216,8 @@ class TStorageServicesInitializer final
Args.EndpointEventHandler,
Args.RdmaClient,
Args.VolumeStats,
Args.PreemptedVolumes);
Args.PreemptedVolumes,
Args.RootKmsKeyProvider);

setup->LocalServices.emplace_back(
MakeStorageServiceId(),
Expand Down
2 changes: 2 additions & 0 deletions cloud/blockstore/libs/storage/init/server/actorsystem.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@
#include <cloud/blockstore/libs/common/public.h>
#include <cloud/blockstore/libs/diagnostics/public.h>
#include <cloud/blockstore/libs/discovery/public.h>
#include <cloud/blockstore/libs/encryption/public.h>
#include <cloud/blockstore/libs/endpoints/public.h>
#include <cloud/blockstore/libs/kikimr/public.h>
#include <cloud/blockstore/libs/nvme/public.h>
Expand Down Expand Up @@ -65,6 +66,7 @@ struct TServerActorSystemArgs
NNvme::INvmeManagerPtr NvmeManager;
IVolumeBalancerSwitchPtr VolumeBalancerSwitch;
NServer::IEndpointEventHandlerPtr EndpointEventHandler;
IRootKmsKeyProviderPtr RootKmsKeyProvider;

TVector<NCloud::NStorage::IUserMetricsSupplierPtr> UserCounterProviders;

Expand Down
6 changes: 4 additions & 2 deletions cloud/blockstore/libs/storage/service/service.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,8 @@ IActorPtr CreateStorageService(
NServer::IEndpointEventHandlerPtr endpointEventHandler,
NRdma::IClientPtr rdmaClient,
IVolumeStatsPtr volumeStats,
TManuallyPreemptedVolumesPtr preemptedVolumes)
TManuallyPreemptedVolumesPtr preemptedVolumes,
IRootKmsKeyProviderPtr rootKmsKeyProvider)
{
return std::make_unique<TServiceActor>(
std::move(config),
Expand All @@ -30,7 +31,8 @@ IActorPtr CreateStorageService(
std::move(endpointEventHandler),
std::move(rdmaClient),
std::move(volumeStats),
std::move(preemptedVolumes));
std::move(preemptedVolumes),
std::move(rootKmsKeyProvider));
}

} // namespace NCloud::NBlockStore::NStorage
4 changes: 3 additions & 1 deletion cloud/blockstore/libs/storage/service/service.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@

#include <cloud/blockstore/libs/diagnostics/public.h>
#include <cloud/blockstore/libs/discovery/public.h>
#include <cloud/blockstore/libs/encryption/public.h>
#include <cloud/blockstore/libs/endpoints/public.h>
#include <cloud/blockstore/libs/kikimr/public.h>
#include <cloud/blockstore/libs/rdma/iface/public.h>
Expand All @@ -23,6 +24,7 @@ NActors::IActorPtr CreateStorageService(
NServer::IEndpointEventHandlerPtr endpointEventHandler,
NRdma::IClientPtr rdmaClient,
IVolumeStatsPtr volumeStats,
TManuallyPreemptedVolumesPtr preemptedVolumes);
TManuallyPreemptedVolumesPtr preemptedVolumes,
IRootKmsKeyProviderPtr rootKmsKeyProvider);

} // namespace NCloud::NBlockStore::NStorage
7 changes: 4 additions & 3 deletions cloud/blockstore/libs/storage/service/service_actor.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,8 @@ TServiceActor::TServiceActor(
NServer::IEndpointEventHandlerPtr endpointEventHandler,
NRdma::IClientPtr rdmaClient,
IVolumeStatsPtr volumeStats,
TManuallyPreemptedVolumesPtr preemptedVolumes)
TManuallyPreemptedVolumesPtr preemptedVolumes,
IRootKmsKeyProviderPtr rootKmsKeyProvider)
: Config(std::move(config))
, DiagnosticsConfig(std::move(diagnosticsConfig))
, ProfileLog(std::move(profileLog))
Expand All @@ -37,12 +38,12 @@ TServiceActor::TServiceActor(
, EndpointEventHandler(std::move(endpointEventHandler))
, RdmaClient(std::move(rdmaClient))
, VolumeStats(std::move(volumeStats))
, RootKmsKeyProvider(std::move(rootKmsKeyProvider))
, SharedCounters(MakeIntrusive<TSharedServiceCounters>(Config))
, State(std::move(preemptedVolumes))
{}

TServiceActor::~TServiceActor()
{}
TServiceActor::~TServiceActor() = default;

void TServiceActor::Bootstrap(const TActorContext& ctx)
{
Expand Down
7 changes: 5 additions & 2 deletions cloud/blockstore/libs/storage/service/service_actor.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@
#include <cloud/blockstore/libs/diagnostics/public.h>
#include <cloud/blockstore/libs/diagnostics/stats_aggregator.h>
#include <cloud/blockstore/libs/discovery/discovery.h>
#include <cloud/blockstore/libs/encryption/public.h>
#include <cloud/blockstore/libs/endpoints/public.h>
#include <cloud/blockstore/libs/kikimr/helpers.h>
#include <cloud/blockstore/libs/rdma/iface/public.h>
Expand Down Expand Up @@ -47,6 +48,7 @@ class TServiceActor final
const NServer::IEndpointEventHandlerPtr EndpointEventHandler;
const NRdma::IClientPtr RdmaClient;
const IVolumeStatsPtr VolumeStats;
const IRootKmsKeyProviderPtr RootKmsKeyProvider;

TSharedServiceCountersPtr SharedCounters;

Expand All @@ -73,8 +75,9 @@ class TServiceActor final
NServer::IEndpointEventHandlerPtr endpointEventHandler,
NRdma::IClientPtr rdmaClient,
IVolumeStatsPtr volumeStats,
TManuallyPreemptedVolumesPtr preemptedVolumes);
~TServiceActor();
TManuallyPreemptedVolumesPtr preemptedVolumes,
IRootKmsKeyProviderPtr rootKmsKeyProvider);
~TServiceActor() override;

void Bootstrap(const NActors::TActorContext& ctx);

Expand Down
Loading
Loading