History

Alan Bishop 189a1096da Migrate fixed_key encryption keys to Barbican

Assist users who are switching from the legacy ConfKeyManager to
Barbican by automatically migrating any existing keys. Key migration
is executed in its own thread spawned on cinder-volume startup. Two
factors are used to determine whether existing keys need to be
migrated.

1) The ConfKeyManager's fixed_key config value is set (not None).
   This indicates volumes may exist that were encrypted using the
   ConfKeyManager.
2) Barbican is the current key manager.

When the both conditions are met, each instance of the cinder-volume
service scans its volumes in the database, looking for volumes using
the ConfKeyManager's all-zeros encryption key ID. If a volume has an
all-zeros key ID, the same secret (derived from the fixed_key) is stored
in Barbican, and all database references to that volume's key ID are
replaced with the new Barbican key ID.

Implements: blueprint migrate-fixed-key-to-barbican
Change-Id: Ic70f45762cf4e426c222415e49b947a328282ca0

2017-12-01 15:30:32 -05:00

notes

Migrate fixed_key encryption keys to Barbican

2017-12-01 15:30:32 -05:00

source

Remove setting of version/release from releasenotes

2017-11-16 22:34:49 +00:00

README.rst

Fix release notes link

2017-07-25 14:24:18 -07:00

README.rst

Release notes

The release notes for a patch should be included in the patch. The intended audience for release notes include deployers, administrators and end-users.

A release note is required if the patch has upgrade or API impact. It is also required if the patch adds a feature or fixes a long-standing or security bug.

Please see https://docs.openstack.org/cinder/latest/contributor/releasenotes.html for more details.