Creating LUKS Encrypted Volumes

OpenStack allows you to encrypt volumes at rest using LUKS. On NWS OpenStack, the volume type that provides encryption-at-rest is conveniently called LUKS. See below for further information and how to setup encrypted volumes.

How Does OpenStack Encrypt Volumes?

When you create an encrypted volume from the Horizon UI or the OpenStack CLI, OpenStack will generate the necessary encryption key for you and store it in Barbican, OpenStack's key manager. Alll LUKS encrytion keys on NWS OpenStack use 256bit aes-xts-plain64 encryption.

As Secrets are billed on a per-secret basis in NWS OpenStack, each encrypted volume will incur minimal additional cost (0.40€ p. Secret p. Month, 03/2024)

When attaching an encrypted volume to a server, OpenStack will decrypt it in the background using the encryption key stored in Barbican. The attached volume can be handled and consumed on the server like any other (unencrypted) volume.

Creating Encrypted Volumes in OpenStack

Encrypted volumes can be created either from the Horizon UI or from the terminal using the OpenStack CLI.

Using Horizon UI

In your OpenStack Horizon UI (at https://cloud.netways.de) make sure to pick the correct project, then follow the steps below:

1. Navigate to Volumes > Volumes
2. Click on Create Volume
3. Configure the volume
   
   1. [Required] Set a name
   2. [Optional] Set a description
   3. [Required] Pick a volume source
   4. [Required] Set LUKS as Volume Type
   5. [Optional] Adjust volume size
      
   6. [Optional] Pick a volume group
4. Confirm settings and create volume by clicking Create Volume

OpenStack will start creating the volume, which will appear listed under Volumes > Volumes upon reload.

Using OpenStack CLI

Source your OpenStackRC.sh file and pick the correct project:

source nws-id-openstack-rc.sh

Testing authentication and fetching project list ...

Please select one of your OpenStack projects.

1) 20631-openstack-04223  3) 5475-openstack-41b6b   5) 5475-openstack-8bdaf   7) 5475-openstack-a169e
2) 5475-openstack-1ccca	  4) 5475-openstack-4745f   6) 5475-openstack-9d52e   8) 5475-openstack-c716d
Enter a number: 1
Selected project: 20631-openstack-04223

Then, create a new, encrypted volume like this:

openstack volume create \
  --type LUKS \
  --size <size> \
  --description <description> \
  --image <image> \
  <name>

The following options can be passed as parameters:

• <size>: size of the volume in GB, required if <image> is not passed
• <description>: description of the volume, optional
• <image>: image reference if the volume should be based on an image, optional
• <name>: name of the volume, required

Attaching Encrypted Volumes to Servers

Encrypted volumes can be attached to servers either from the Horizon UI or from the terminal using the OpenStack CLI, just like any other volume.

Using Horizon UI

In your OpenStack Horizon UI (at https://cloud.netways.de) make sure to pick the correct project, then follow the steps below:

1. Navigate to Compute > Instances
2. Identify the server you want to attach the volume to in the list
3. Expand the dropdown menu in the server's Action column
4. Click Attach Volume and select the desired volume
5. Confirm by clicking Attach Volume.

After a few seconds, the volume should be visible on the server at /dev/sdX

Using OpenStack CLI

Source your OpenStackRC.sh file and pick the correct project:

source nws-id-openstack-rc.sh

Testing authentication and fetching project list ...

Please select one of your OpenStack projects.

1) 20631-openstack-04223  3) 5475-openstack-41b6b   5) 5475-openstack-8bdaf   7) 5475-openstack-a169e
2) 5475-openstack-1ccca	  4) 5475-openstack-4745f   6) 5475-openstack-9d52e   8) 5475-openstack-c716d
Enter a number: 1
Selected project: 20631-openstack-04223

Then, attach the volume to a server like this:

openstack server add volume --device <device> <server> <volume>

The following options need to be passed as parameters:

• <device>: server internal device name, e.g. /dev/sdb, required
• <server>: name or UUID of the server to attach the volume to, required
• <volume>: name or UUID of the volume to attach to the server, required

After a few seconds, the volume should be visible on the server at /dev/sdX

Further Information

If you are looking for more detailed instructions on creating and mounting encrypted volumes or want to learn more about encrypted volumes on OpenStack in general, see the links below:

• NWS-Blogpost: LUKS Encrypted Storage on OpenStack
• OpenStack Documentation: Volume encryption supported by the key manager