Storage encryption proposal

[kasabe28]

Proposed Changes

Storage encryption proposal to enable onmetal volume encryption with user provided encryption key

[lukasfrank]

For me is the overall flow a bit unclear. Can you elaborate the interplay of a VolumePool and a Volume. Do you implicit assume that a VolumePool is encrypted (that assigned volumes) if the secret in spec.encryption is given? What is expected if the Volume encryption flag is set to false and it is assigned to an "encrypted" pool?

[kasabe28]

For me is the overall flow a bit unclear. Can you elaborate the interplay of a VolumePool and a Volume. Do you implicit assume that a VolumePool is encrypted (that assigned volumes) if the secret in spec.encryption is given? What is expected if the Volume encryption flag is set to false and it is assigned to an "encrypted" pool?

As per discussion now encryption key secret reference will be provided in Volume.

• If encryption enabled flag is false, then volume will not be encrypted
• If encryption enabled flag is set to true, then user can provide encryption key via secret reference to encrypt onmetal Volume.
• If encryption enabled flag is set to true and user has not provided encryption key secret reference in Volume, then Volume will be encrypted with shared key of storage provider.

[ManuStoessel]

Up for discussion: behaviour when a user does not set a secret for a encrypted volume explicitely. I would prefer auto-generating an individual secret instead of relying on a shared secret in that case.

Flow adjusted / concerns addressed.