From 6bc7827150da5249a56bf7c10bc32c20ef23ee45 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?S=C3=A9bastien=20Han?= Date: Mon, 11 Apr 2022 16:49:52 +0200 Subject: [PATCH] osd: only set kek to env var on encryption scenario MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit There is a corner case where an env variable populated with the prepare job could influence and trigger some encryption code. We have an env variable to discover whether the prepare job will encrypt a drive or not so let's use that instead of running code as a noop and sometimes trigger a corner case. In this scenario, the prepare job had an "IBM_" env variable present in the OS image (IBM OS) so the setKEKinEnv() function would get called for no reason. Signed-off-by: Sébastien Han --- pkg/daemon/ceph/osd/daemon.go | 3 ++- pkg/daemon/ceph/osd/encryption.go | 3 +-- pkg/daemon/ceph/osd/kms/envs.go | 1 + 3 files changed, 4 insertions(+), 3 deletions(-) diff --git a/pkg/daemon/ceph/osd/daemon.go b/pkg/daemon/ceph/osd/daemon.go index e20a1c372..a5513d00c 100644 --- a/pkg/daemon/ceph/osd/daemon.go +++ b/pkg/daemon/ceph/osd/daemon.go @@ -158,7 +158,8 @@ func configRawDevice(name string, context *clusterd.Context) (*sys.LocalDisk, er // Provision provisions an OSD func Provision(context *clusterd.Context, agent *OsdAgent, crushLocation, topologyAffinity string) error { - if agent.pvcBacked { + if agent.pvcBacked && os.Getenv(oposd.EncryptedDeviceEnvVarName) == "true" { + logger.Debug("encryption configuration detecting, populating kek to an env variable") // Init KMS store, retrieve the KEK and store it as an env var for ceph-volume err := setKEKinEnv(context, agent.clusterInfo) if err != nil { diff --git a/pkg/daemon/ceph/osd/encryption.go b/pkg/daemon/ceph/osd/encryption.go index 9bf2f657a..513ebd1d7 100644 --- a/pkg/daemon/ceph/osd/encryption.go +++ b/pkg/daemon/ceph/osd/encryption.go @@ -103,8 +103,7 @@ func setKEKinEnv(context *clusterd.Context, clusterInfo *cephclient.ClusterInfo) return errors.Wrap(err, "failed to set key encryption key env variable for ceph-volume") } - logger.Debug("successfully set vault env variables") - + logger.Debug("successfully set kek to env variable") return nil } diff --git a/pkg/daemon/ceph/osd/kms/envs.go b/pkg/daemon/ceph/osd/kms/envs.go index 3e7e82996..92c4ded06 100644 --- a/pkg/daemon/ceph/osd/kms/envs.go +++ b/pkg/daemon/ceph/osd/kms/envs.go @@ -134,6 +134,7 @@ func ConfigEnvsToMapString() map[string]string { pair := strings.SplitN(e, "=", 2) for _, knownKMS := range knownKMSPrefix { if strings.HasPrefix(pair[0], knownKMS) || pair[0] == Provider { + logger.Debugf("adding env %q", pair[0]) envs[pair[0]] = os.Getenv(pair[0]) } }