Added os-brick adjustments in the Image Encryption spec
A description for the changes in os-brick is added to this spec. Change-Id: Icc5a393b6ed5ab162d2456531500de0508949251 Co-Authored-By: Markus Hentsch <markus.hentsch@secustack.com>
This commit is contained in:
parent
256a502613
commit
89379fcecf
@ -140,6 +140,15 @@ used to encrypt an image, we will let Glance register as a consumer of that
|
|||||||
key (secret in Barbican [1]) when the corresponding encrypted image is
|
key (secret in Barbican [1]) when the corresponding encrypted image is
|
||||||
uploaded and unregister as a consumer when the image is deleted in Glance.
|
uploaded and unregister as a consumer when the image is deleted in Glance.
|
||||||
|
|
||||||
|
The methods for encryption and decryption of files - in this case images -
|
||||||
|
will be written in a driver like manner in os-brick so the image encryption
|
||||||
|
can be extended with another encryption format easily. The encryption driver
|
||||||
|
should focus a specific encryption format and implement exactly one encrypt
|
||||||
|
and one decrypt method, both based on a cipher implementation of GPG aes.
|
||||||
|
This driver may be simple wrappers around an existing implementation. An
|
||||||
|
abstract base class should be defined and be used for the implementation of
|
||||||
|
GPG encryption (and might be used for other implementations in the future).
|
||||||
|
|
||||||
|
|
||||||
Alternatives
|
Alternatives
|
||||||
------------
|
------------
|
||||||
@ -240,7 +249,7 @@ Other deployer impact
|
|||||||
Developer impact
|
Developer impact
|
||||||
----------------
|
----------------
|
||||||
|
|
||||||
* To use the encoding and decoding of images in the library, we need to
|
* To use the encoding and decoding of images in os-brick, we need to
|
||||||
execute priviledged functions. We decided to use privsep for this as in
|
execute priviledged functions. We decided to use privsep for this as in
|
||||||
nova.
|
nova.
|
||||||
|
|
||||||
@ -274,6 +283,8 @@ Work Items
|
|||||||
creating encrypted images from volumes using the proposed image encryption
|
creating encrypted images from volumes using the proposed image encryption
|
||||||
format (GPG)
|
format (GPG)
|
||||||
|
|
||||||
|
* Add encryption and decryption methods for the GPG format in os-brick
|
||||||
|
|
||||||
|
|
||||||
Dependencies
|
Dependencies
|
||||||
============
|
============
|
||||||
@ -328,5 +339,5 @@ History
|
|||||||
|
|
||||||
* - Release Name
|
* - Release Name
|
||||||
- Description
|
- Description
|
||||||
* - Stein
|
* - Train
|
||||||
- Introduced
|
- Introduced
|
||||||
|
Loading…
x
Reference in New Issue
Block a user