Skip to content

Commit 871ba97

Browse files
rajan-misrajan-mis
authored
Merge pull request #818 from Anand-Reddy7/anand-4171
Adding IBM Key Protect Support
2 parents 2fb2716 + 9bedcb9 commit 871ba97

22 files changed

+500
-0
lines changed

‎roles/kp_encryption_apply/README.MD

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
# Enabling Encryption with IBM® Key Protect on IBM Storage Scale
2+
3+
IBM® Key Protect is a powerful service on IBM Cloud that simplifies the provisioning and storage of encrypted keys for applications across IBM Cloud services. By using IBM Key Protect, you can centralize the management of data encryption and efficiently oversee the entire key lifecycle, providing a robust foundation for securing your data on an IBM Storage Scale cluster.
4+
5+
## Setting Up IBM Key Protect
6+
7+
The first step in enabling encryption for your Storage Scale cluster file system is to create a Key Protect service. Once the service is set up, you will generate an encryption key and apply an encryption policy to your desired file system within the cluster. For a detailed guide on setting up and managing your Key Protect service, refer to the [IBM Key Protect documentation](https://cloud.ibm.com/docs/key-protect?topic=key-protect-about).
8+
9+
## Configuring Cluster Nodes
10+
11+
To ensure that every node in the cluster can access the encrypted file system, it's essential to have specific configuration files on each node. These include:
12+
13+
- `/var/mmfs/etc/RKM.conf`
14+
- `/var/mmfs/etc/prefix.p12`
15+
16+
These files are critical for enabling secure access to the encrypted file system across the entire cluster. Without them, nodes will not be able to interact with the encrypted data.
17+
18+
## Understanding Secure Storage and Data Protection
19+
20+
Secure storage relies on encryption to render data unreadable to unauthorized users. Data is encrypted while at rest (on disk) and decrypted only when accessed by authorized users. It's important to note that encryption protects only the data itself, not the associated metadata.
21+
22+
IBM GPFS encryption safeguards against various threats, including disk theft or improper disposal, and unprivileged user attacks in a multi-tenant cluster. However, it does not protect against malicious actions by a cluster administrator.
23+
24+
In addition to securing data, GPFS encryption facilitates secure data deletion. By leveraging encryption and key management, it ensures that once the master encryption keys are deleted from the key server, the data becomes irretrievable. For more details, refer to [Encryption keys](https://www.ibm.com/docs/en/STXKQY_5.1.8/com.ibm.spectrum.scale.v5r10.doc/bl1adv_encryptionkeys.html#encryptionkeys).
25+
26+
## Applying Encryption on the IBM Storage Scale
27+
28+
The `kp_encryption_apply` Ansible role simplifies the encryption process by automating the following tasks:
29+
30+
- Applying the encryption policy to the IBM Storage Scale cluster file system.
31+
- Validating the encryption to ensure proper implementation.
32+
33+
## Verifying Encryption on the File System
34+
35+
1. Log in to any of the cluster nodes (storage or compute) using the following SSH command and switch to the `root` user:
36+
37+
```bash
38+
ssh -J root@BASTION_SERVER vpcuser@STORAGE_NODE
39+
sudo -i
40+
```
41+
42+
2. Validate the policy applied to the cluster by running the following command:
43+
44+
```bash
45+
mmlspolicy FILESYSTEM_NAME -L
46+
```
47+
48+
3. Check the encryption status of a specific file by running the following command:
49+
50+
```bash
51+
mmlsattr -n gpfs.Encryption FILE_NAME
52+
```
53+
54+
For more in-depth information about encryption in IBM Spectrum Scale, including various encryption use cases, see the [Encryption documentation](https://www.ibm.com/docs/en/storage-scale/5.1.8?topic=administering-encryption).

‎roles/kp_encryption_apply/tasks/apply_encryption.yml

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
# Apply Encryption Policy on IBM Storge Scale Cluster
2+
3+
- name: KeyProtect Encryption | Encryption Apply | Check encryption policy for file system
4+
command: mmlspolicy {{ filesystem_mountpoint }} -L
5+
register: policy_output
6+
ignore_errors: yes
7+
8+
- name: KeyProtect Encryption | Encryption Apply | Check if encryption policy is applied
9+
set_fact:
10+
encryption_applied: "{{ 'KEYS' in policy_output.stdout }}"
11+
12+
- name: KeyProtect Encryption | Encryption Apply | Check if KP.fsenc.pol file exists
13+
stat:
14+
path: /var/mmfs/etc/KP.fsenc.pol
15+
register: fsenc_pol_stat
16+
when: not encryption_applied
17+
18+
- name: KeyProtect Encryption | Encryption Apply | Apply Policy
19+
command: mmchpolicy {{ filesystem_mountpoint }} /var/mmfs/etc/KP.fsenc.pol
20+
when: not encryption_applied
21+
run_once: true
22+
23+
- name: KeyProtect Encryption | Encryption Apply | Show Applied Policy
24+
command: mmlspolicy {{ filesystem_mountpoint }} -L
25+
register: policy_output
26+
run_once: true
27+
28+
- name: KeyProtect Encryption | Encryption Apply | Display Policy Output
29+
debug:
30+
msg: "{{ policy_output.stdout }}"
31+
run_once: true

‎roles/kp_encryption_apply/tasks/main.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
2+
# Import the 'apply_encryption.yml' task to Apply the Encryption on the Scale Cluster.
3+
4+
- import_tasks: apply_encryption.yml

‎roles/kp_encryption_apply/vars/main.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
# Static Variables for Encryption
2+
3+
# Scale File System Mount Point
4+
filesystem_mountpoint: "{{ filesystem_mountpoint }}"

‎roles/kp_encryption_configure/README.MD

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# Enabling Encryption with IBM® Key Protect on IBM Storage Scale
2+
3+
IBM® Key Protect is a powerful service on IBM Cloud that simplifies the provisioning and storage of encrypted keys for applications across IBM Cloud services. By using IBM Key Protect, you can centralize the management of data encryption and efficiently oversee the entire key lifecycle, providing a robust foundation for securing your data on an IBM Storage Scale cluster.
4+
5+
## Setting Up IBM Key Protect
6+
7+
The first step in enabling encryption for your Storage Scale cluster file system is to create a Key Protect service. Once the service is set up, you will generate an encryption key and apply an encryption policy to your desired file system within the cluster. For a detailed guide on setting up and managing your Key Protect service, refer to the [IBM Key Protect documentation](https://cloud.ibm.com/docs/key-protect?topic=key-protect-about).
8+
9+
## Configuring Cluster Nodes
10+
11+
To ensure that every node in the cluster can access the encrypted file system, it's essential to have specific configuration files on each node. These include:
12+
13+
- `/var/mmfs/etc/RKM.conf`
14+
- `/var/mmfs/etc/prefix.p12`
15+
16+
These files are critical for enabling secure access to the encrypted file system across the entire cluster. Without them, nodes will not be able to interact with the encrypted data.
17+
18+
## Understanding Secure Storage and Data Protection
19+
20+
Secure storage relies on encryption to render data unreadable to unauthorized users. Data is encrypted while at rest (on disk) and decrypted only when accessed by authorized users. It's important to note that encryption protects only the data itself, not the associated metadata.
21+
22+
IBM GPFS encryption safeguards against various threats, including disk theft or improper disposal, and unprivileged user attacks in a multi-tenant cluster. However, it does not protect against malicious actions by a cluster administrator.
23+
24+
In addition to securing data, GPFS encryption facilitates secure data deletion. By leveraging encryption and key management, it ensures that once the master encryption keys are deleted from the key server, the data becomes irretrievable. For more details, refer to [Encryption keys](https://www.ibm.com/docs/en/STXKQY_5.1.8/com.ibm.spectrum.scale.v5r10.doc/bl1adv_encryptionkeys.html#encryptionkeys).
25+
26+
## Configuring Key Protect
27+
28+
The `kp_encryption_configure` Ansible role automates the distribution of essential files to streamline the encryption process:
29+
30+
- Distributing the `.p12` and `RKM.conf` files to all servers to enable encryption.
31+
32+
33+
For more in-depth information about encryption in IBM Spectrum Scale, including various encryption use cases, see the [Encryption documentation](https://www.ibm.com/docs/en/storage-scale/5.1.8?topic=administering-encryption).

‎roles/kp_encryption_configure/tasks/copy_config_files_to_remote.yml

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# Distribute .p12 and RKM.conf files to all servers to apply encryption.
2+
3+
- block:
4+
- name: KeyProtect Encryption | Encryption Configuration | Check .p12
5+
stat:
6+
path: "/var/mmfs/etc/{{ kp_resource_prefix }}.p12"
7+
register: p12_file_stat
8+
9+
- name: KeyProtect Encryption | Encryption Configuration | Copy .p12
10+
copy:
11+
src: "{{ key_protect_cert_files_dir }}/{{ kp_resource_prefix }}.p12"
12+
dest: "/var/mmfs/etc/{{ kp_resource_prefix }}.p12"
13+
owner: root
14+
group: root
15+
mode: '0600'
16+
when: not p12_file_stat.stat.exists
17+
register: p12_copy_result
18+
19+
- name: KeyProtect Encryption | Encryption Configuration | Check RKM.conf
20+
stat:
21+
path: "/var/mmfs/etc/RKM.conf"
22+
register: rkm_conf_stat
23+
24+
- name: KeyProtect Encryption | Encryption Configuration | Copy RKM.conf
25+
copy:
26+
src: "{{ key_protect_cert_files_dir }}/RKM.conf"
27+
dest: "/var/mmfs/etc/RKM.conf"
28+
owner: root
29+
group: root
30+
mode: '0600'
31+
when: not rkm_conf_stat.stat.exists
32+
33+
when: key_protect_cert_files_dir is defined and key_protect_cert_files_dir | length > 0

‎roles/kp_encryption_configure/tasks/main.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
2+
# Import the 'copy_config_files_to_remote.yml' task to obtain the RKM.conf and .p12 certificate files and copy them to Bootstrap node.
3+
4+
- import_tasks: copy_config_files_to_remote.yml

‎roles/kp_encryption_configure/vars/main.yml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# Static Variables for Encryption
2+
3+
# Resource Prefix
4+
kp_resource_prefix: "{{ kp_resource_prefix }}"
5+
6+
# Key Protect files path on Bootstrap node
7+
key_protect_cert_files_dir: "/opt/IBM/ibm-spectrumscale-cloud-deploy/key_protect"

‎roles/kp_encryption_prepare/README.MD

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# Enabling Encryption with IBM® Key Protect on IBM Storage Scale
2+
3+
IBM® Key Protect is a powerful service on IBM Cloud that simplifies the provisioning and storage of encrypted keys for applications across IBM Cloud services. By using IBM Key Protect, you can centralize the management of data encryption and efficiently oversee the entire key lifecycle, providing a robust foundation for securing your data on an IBM Storage Scale cluster.
4+
5+
## Setting Up IBM Key Protect
6+
7+
The first step in enabling encryption for your Storage Scale cluster file system is to create a Key Protect service. Once the service is set up, you will generate an encryption key and apply an encryption policy to your desired file system within the cluster. For a detailed guide on setting up and managing your Key Protect service, refer to the [IBM Key Protect documentation](https://cloud.ibm.com/docs/key-protect?topic=key-protect-about).
8+
9+
## Configuring Cluster Nodes
10+
11+
To ensure that every node in the cluster can access the encrypted file system, it's essential to have specific configuration files on each node. These include:
12+
13+
- `/var/mmfs/etc/RKM.conf`
14+
- `/var/mmfs/etc/prefix.p12`
15+
16+
These files are critical for enabling secure access to the encrypted file system across the entire cluster. Without them, nodes will not be able to interact with the encrypted data.
17+
18+
## Understanding Secure Storage and Data Protection
19+
20+
Secure storage relies on encryption to render data unreadable to unauthorized users. Data is encrypted while at rest (on disk) and decrypted only when accessed by authorized users. It's important to note that encryption protects only the data itself, not the associated metadata.
21+
22+
IBM GPFS encryption safeguards against various threats, including disk theft or improper disposal, and unprivileged user attacks in a multi-tenant cluster. However, it does not protect against malicious actions by a cluster administrator.
23+
24+
In addition to securing data, GPFS encryption facilitates secure data deletion. By leveraging encryption and key management, it ensures that once the master encryption keys are deleted from the key server, the data becomes irretrievable. For more details, refer to [Encryption keys](https://www.ibm.com/docs/en/STXKQY_5.1.8/com.ibm.spectrum.scale.v5r10.doc/bl1adv_encryptionkeys.html#encryptionkeys).
25+
26+
## Preparation of the Key Protect service:
27+
28+
To streamline the encryption setup process, the `kp_encryption_prepare` Ansible role automates the following tasks:
29+
30+
- Creating a directory and password file for non-interactive deployment of Key Protect.
31+
- Copying SSL certificates from the bootstrap node to the management node.
32+
- Creating a `.p12` certificate store.
33+
- Generating the encryption key.
34+
- Creating a policy file.
35+
- Updating the `RKM.conf` file.
36+
37+
For more in-depth information about encryption in IBM Spectrum Scale, including various encryption use cases, see the [Encryption documentation](https://www.ibm.com/docs/en/storage-scale/5.1.8?topic=administering-encryption).

‎roles/kp_encryption_prepare/tasks/copy_encryption_files_to_ansible_master.yml

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
# Get RKM.conf and .p12 cert
2+
3+
- block:
4+
- name: KeyProtect Encryption | Encryption Prepare | Check .p12 exists
5+
stat:
6+
path: "{{ key_protect_dir }}/{{ resource_prefix }}.p12"
7+
register: p12_file_stat
8+
9+
- name: KeyProtect Encryption | Encryption Prepare | Update permissions
10+
file:
11+
path: "{{ key_protect_dir }}/{{ resource_prefix }}.p12"
12+
mode: '0644'
13+
when: p12_file_stat.stat.exists
14+
run_once: true
15+
16+
- name: KeyProtect Encryption | Encryption Prepare | Check RKM.conf
17+
stat:
18+
path: "{{ key_protect_dir }}/RKM.conf"
19+
register: rkm_conf_stat
20+
21+
- name: KeyProtect Encryption | Encryption Prepare | Copy RKM.comf
22+
template:
23+
src: "templates/RKM.conf.j2"
24+
dest: "{{ key_protect_dir }}/RKM.conf"
25+
owner: root
26+
group: root
27+
mode: '0600'
28+
when: not rkm_conf_stat.stat.exists
29+
run_once: true
30+
31+
- name: KeyProtect Encryption | Encryption Prepare | Fetch .p12
32+
fetch:
33+
src: "{{ key_protect_dir }}/{{ resource_prefix }}.p12"
34+
dest: "{{ key_protect_cert_files_dir }}/"
35+
flat: yes
36+
when: p12_file_stat.stat.exists
37+
run_once: true
38+
39+
- name: KeyProtect Encryption | Encryption Prepare | Fetch RKM.conf
40+
fetch:
41+
src: "{{ key_protect_dir }}/RKM.conf"
42+
dest: "{{ key_protect_cert_files_dir }}/"
43+
flat: yes
44+
run_once: true
45+
46+
when: key_protect_dir is defined and key_protect_dir | length > 0

‎roles/kp_encryption_prepare/tasks/create_encryption_key.yml

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
# Create .p12 certificate and Create Encryption Key
2+
# Create a Policy file
3+
4+
- block:
5+
- name: KeyProtect Encryption | Encryption Prepare | Check if .p12 cert exists
6+
stat:
7+
path: "{{ key_protect_dir }}/{{ resource_prefix }}.p12"
8+
register: cert_file_stat
9+
10+
- name: Run mmgskkm store command | Encryption Prepare | Create a .p12 Store Cert
11+
command: mmgskkm store --pwd "{{ scale_encryption_admin_password }}" --label "{{ resource_prefix }}" --cert "{{ key_protect_dir }}/{{ resource_prefix }}.cert" --priv "{{ key_protect_dir }}/{{ resource_prefix }}.key" --out "{{ key_protect_dir }}/{{ resource_prefix }}.p12"
12+
args:
13+
chdir: "{{ key_protect_dir }}"
14+
when: not cert_file_stat.stat.exists
15+
run_once: true
16+
17+
- name: Run mmgskkm trust command | Encryption Prepare | Apply Trust on .p12 Cert
18+
command: mmgskkm trust --prefix "{{ key_protect_dir }}/Key_Protect_Server.chain" --pwd "{{ scale_encryption_admin_password }}" --label "{{ resource_prefix }}" --out "{{ key_protect_dir }}/{{ resource_prefix }}.p12"
19+
args:
20+
chdir: "{{ key_protect_dir }}"
21+
register: p12cert
22+
when: not cert_file_stat.stat.exists
23+
run_once: true
24+
25+
- name: Sleep for 5 seconds
26+
ansible.builtin.pause:
27+
seconds: 5
28+
29+
- name: KeyProtect Encryption | Encryption Prepare | Check if key creation has already performed
30+
stat:
31+
path: "{{ key_protect_dir }}/key_creation_done.flag"
32+
register: flag_file_stat
33+
34+
- name: KeyProtect Encryption | Encryption Prepare | Create Encryption Key
35+
command: >
36+
mmkmipkm createkey
37+
--host "{{ vpc_region }}.kms.cloud.ibm.com"
38+
--kmipport "{{ resource_prefix }}.port"
39+
--keystore "{{ key_protect_dir }}/{{ resource_prefix }}.p12"
40+
--keypass "{{ key_protect_dir }}/{{ resource_prefix }}.pwd"
41+
--label "{{ resource_prefix }}"
42+
args:
43+
chdir: "{{ key_protect_dir }}"
44+
register: createkey_output
45+
when: p12cert is defined and not flag_file_stat.stat.exists
46+
run_once: true
47+
48+
- name: KeyProtect Encryption | Encryption Prepare | Debug createkey_output
49+
debug:
50+
var: createkey_output
51+
when: createkey_output is defined
52+
53+
- name: KeyProtect Encryption | Encryption Prepare | Create flag to indicate key creation has been performed
54+
file:
55+
path: "{{ key_protect_dir }}/key_creation_done.flag"
56+
state: touch
57+
when: not flag_file_stat.stat.exists
58+
run_once: true
59+
60+
- name: KeyProtect Encryption | Encryption Prepare | Set Encryption key fact
61+
set_fact:
62+
encryption_key: "{{ createkey_output.stdout if createkey_output is defined and 'stdout' in createkey_output and createkey_output.stdout != '' }}"
63+
when: not flag_file_stat.stat.exists
64+
run_once: true
65+
66+
- name: KeyProtect Encryption | Encryption Prepare | Copy Policy file
67+
template:
68+
src: "templates/KP.fsenc.pol.j2"
69+
dest: "/var/mmfs/etc/KP.fsenc.pol"
70+
owner: root
71+
group: root
72+
mode: '0600'
73+
when: encryption_key is defined and encryption_key != ''
74+
run_once: true
75+
76+
when: key_protect_dir is defined and key_protect_dir | length > 0

0 commit comments

Comments
 (0)