Add volume and image encryption feature

Signed-off-by: andy.lee <andy.lee@suse.com>

pkg/harvester/config/harvester-map.js

@@ -69,3 +69,12 @@ export const ADD_ONS = {
   RANCHER_MONITORING:               'rancher-monitoring',
   VM_IMPORT_CONTROLLER:             'vm-import-controller',
 };
+
+export const CSI_SECRETS = {
+  CSI_PROVISIONER_SECRET_NAME:       'csi.storage.k8s.io/provisioner-secret-name',
+  CSI_PROVISIONER_SECRET_NAMESPACE:  'csi.storage.k8s.io/provisioner-secret-namespace',
+  CSI_NODE_PUBLISH_SECRET_NAME:      'csi.storage.k8s.io/node-publish-secret-name',
+  CSI_NODE_PUBLISH_SECRET_NAMESPACE: 'csi.storage.k8s.io/node-publish-secret-namespace',
+  CSI_NODE_STAGE_SECRET_NAME:        'csi.storage.k8s.io/node-stage-secret-name',
+  CSI_NODE_STAGE_SECRET_NAMESPACE:   'csi.storage.k8s.io/node-stage-secret-namespace',
+};

pkg/harvester/config/table-headers.js

@@ -8,7 +8,6 @@ export const IMAGE_DOWNLOAD_SIZE = {
   labelKey: 'tableHeaders.size',
   value:    'downSize',
   sort:     'status.size',
-  width:    120
 };
 
 export const IMAGE_VIRTUAL_SIZE = {
@@ -16,7 +15,6 @@ export const IMAGE_VIRTUAL_SIZE = {
   labelKey: 'harvester.tableHeaders.virtualSize',
   value:    'virtualSize',
   sort:     'status.virtualSize',
-  width:    120
 };
 
 export const IMAGE_PROGRESS = {

pkg/harvester/detail/harvesterhci.io.virtualmachineimage/index.vue

@@ -7,8 +7,9 @@ import Tabbed from '@shell/components/Tabbed';
 import Tab from '@shell/components/Tabbed/Tab';
 import { findBy } from '@shell/utils/array';
 import { get } from '@shell/utils/object';
-
+import { ucFirst } from '@shell/utils/string';
 import Storage from './Storage';
+import { SECRET } from '@shell/config/types';
 
 export default {
   components: {
@@ -26,8 +27,14 @@ export default {
     },
   },
 
+  async fetch() {
+    const inStore = this.$store.getters['currentProduct'].inStore;
+
+    this.secrets = await this.$store.dispatch(`${ inStore }/findAll`, { type: SECRET });
+  },
+
   data() {
-    return {};
+    return { secrets: [] };
   },
 
   computed: {
@@ -57,6 +64,21 @@ export default {
       return this.value?.spec?.sourceType === 'upload';
     },
 
+    encryptionSecret() {
+      if (!this.value.isEncrypted) {
+        return '-';
+      }
+
+      return this.value.encryptionSecret;
+    },
+    secretLink() {
+      return this.secrets.find(sc => sc.id === this.value.encryptionSecret)?.detailLocation;
+    },
+
+    isEncryptedString() {
+      return ucFirst(String(this.value.isEncrypted));
+    },
+
     imageName() {
       return this.value?.metadata?.annotations?.[HCI.IMAGE_NAME] || '-';
     },
@@ -116,6 +138,23 @@ export default {
         </div>
       </div>
 
+      <div class="row">
+        <div class="col span-12">
+          <LabelValue :name="t('harvester.image.isEncryption')" :value="isEncryptedString" class="mb-20" />
+        </div>
+      </div>
+
+      <div v-if="value.isEncrypted" class="row">
+        <div class="col span-12">
+          <div class="text-label">
+            {{ t('harvester.image.encryptionSecret') }}
+          </div>
+          <n-link v-if="secretLink" :to="secretLink">
+            {{ encryptionSecret }}
+          </n-link>
+        </div>
+      </div>
+
       <div v-if="errorMessage !== '-'" class="row">
         <div class="col span-12">
           <div>

pkg/harvester/edit/harvesterhci.io.storage/provisioners/driver.longhorn.io.vue

@@ -3,9 +3,9 @@ import KeyValue from '@shell/components/form/KeyValue';
 import LabeledSelect from '@shell/components/form/LabeledSelect';
 import { LabeledInput } from '@components/Form/LabeledInput';
 import RadioGroup from '@components/Form/Radio/RadioGroup';
-
+import { SECRET, NAMESPACE, LONGHORN } from '@shell/config/types';
 import { _CREATE, _VIEW } from '@shell/config/query-params';
-import { LONGHORN } from '@shell/config/types';
+import { CSI_SECRETS } from '@pkg/harvester/config/harvester-map';
 import { clone } from '@shell/utils/object';
 import { uniq } from '@shell/utils/array';
 
@@ -15,8 +15,18 @@ const DEFAULT_PARAMETERS = [
   'diskSelector',
   'nodeSelector',
   'migratable',
+  'encrypted',
 ];
 
+const {
+  CSI_PROVISIONER_SECRET_NAME,
+  CSI_PROVISIONER_SECRET_NAMESPACE,
+  CSI_NODE_PUBLISH_SECRET_NAME,
+  CSI_NODE_PUBLISH_SECRET_NAMESPACE,
+  CSI_NODE_STAGE_SECRET_NAME,
+  CSI_NODE_STAGE_SECRET_NAMESPACE
+} = CSI_SECRETS;
+
 export default {
   components: {
     KeyValue,
@@ -40,6 +50,14 @@ export default {
     },
   },
 
+  async fetch() {
+    const inStore = this.$store.getters['currentProduct'].inStore;
+    const allNamespaces = await this.$store.dispatch(`${ inStore }/findAll`, { type: NAMESPACE });
+
+    this.secrets = await this.$store.dispatch(`${ inStore }/findAll`, { type: SECRET });
+    this.namespaces = allNamespaces.filter(ns => ns.isSystem === false).map(ns => ns.id); // only show non-system namespaces to user to select
+  },
+
   data() {
     if (this.realMode === _CREATE) {
       this.value['parameters'] = {
@@ -47,11 +65,15 @@ export default {
         staleReplicaTimeout: '30',
         diskSelector:        null,
         nodeSelector:        null,
-        migratable:          'true'
+        encrypted:           'false',
+        migratable:          'true',
       };
     }
 
-    return {};
+    return {
+      secrets:    [],
+      namespaces: [],
+    };
   },
 
   computed: {
@@ -97,6 +119,26 @@ export default {
       }];
     },
 
+    secretOptions() {
+      const selectedNS = this.secretNamespace;
+
+      return this.secrets.filter(secret => secret.namespace === selectedNS).map(secret => secret.name);
+    },
+
+    secretNameOptions() {
+      return this.namespaces;
+    },
+
+    volumeEncryptionOptions() {
+      return [{
+        label: this.t('generic.yes'),
+        value: 'true'
+      }, {
+        label: this.t('generic.no'),
+        value: 'false'
+      }];
+    },
+
     parameters: {
       get() {
         const parameters = clone(this.value?.parameters) || {};
@@ -113,6 +155,49 @@ export default {
       }
     },
 
+    volumeEncryption: {
+      set(neu) {
+        this.$set(this.value, 'parameters', {
+          ...this.value.parameters,
+          encrypted: neu
+        });
+      },
+
+      get() {
+        return this.value?.parameters?.encrypted || 'false';
+      }
+    },
+
+    secretName: {
+      get() {
+        return this.value.parameters[CSI_PROVISIONER_SECRET_NAME];
+      },
+
+      set(neu) {
+        this.$set(this.value, 'parameters', {
+          ...this.value.parameters,
+          [CSI_PROVISIONER_SECRET_NAME]:  neu,
+          [CSI_NODE_PUBLISH_SECRET_NAME]: neu,
+          [CSI_NODE_STAGE_SECRET_NAME]:   neu
+        });
+      }
+    },
+
+    secretNamespace: {
+      get() {
+        return this.value.parameters[CSI_PROVISIONER_SECRET_NAMESPACE];
+      },
+
+      set(neu) {
+        this.$set(this.value, 'parameters', {
+          ...this.value.parameters,
+          [CSI_PROVISIONER_SECRET_NAMESPACE]:  neu,
+          [CSI_NODE_PUBLISH_SECRET_NAMESPACE]: neu,
+          [CSI_NODE_STAGE_SECRET_NAMESPACE]:   neu
+        });
+      }
+    },
+
     nodeSelector: {
       get() {
         const nodeSelector = this.value?.parameters?.nodeSelector;
@@ -221,14 +306,39 @@ export default {
         </LabeledSelect>
       </div>
     </div>
-    <div class="row mt-10">
+    <div class="row mt-20">
+      <RadioGroup
+        v-model:value="value.parameters.migratable"
+        name="layer3NetworkMode"
+        :label="t('harvester.storage.parameters.migratable.label')"
+        :mode="mode"
+        :options="migratableOptions"
+      />
+    </div>
+    <div class="row mt-20">
+      <RadioGroup
+        v-model:value="volumeEncryption"
+        name="volumeEncryption"
+        :label="t('harvester.storage.volumeEncryption')"
+        :mode="mode"
+        :options="volumeEncryptionOptions"
+      />
+    </div>
+    <div v-if="value.parameters.encrypted === 'true'" class="row mt-20">
       <div class="col span-6">
-        <RadioGroup
+        <LabeledSelect
-          v-model:value="value.parameters.migratable"
+          v-model:value="secretNamespace"
-          name="layer3NetworkMode"
+          :label="t('harvester.storage.secretNamespace')"
-          :label="t('harvester.storage.parameters.migratable.label')"
+          :options="secretNameOptions"
+          :mode="mode"
+        />
+      </div>
+      <div class="col span-6">
+        <LabeledSelect
+          v-model:value="secretName"
+          :label="t('harvester.storage.secretName')"
+          :options="secretOptions"
           :mode="mode"
-          :options="migratableOptions"
         />
       </div>
     </div>

pkg/harvester/edit/harvesterhci.io.virtualmachineimage.vue

@@ -8,7 +8,6 @@ import NameNsDescription from '@shell/components/form/NameNsDescription';
 import { RadioGroup } from '@components/Form/Radio';
 import Select from '@shell/components/form/Select';
 import LabeledSelect from '@shell/components/form/LabeledSelect';
-
 import CreateEditView from '@shell/mixins/create-edit-view';
 import { HCI as HCI_ANNOTATIONS } from '@pkg/harvester/config/labels-annotations';
 import { exceptionToErrorsArray } from '@shell/utils/error';
@@ -18,6 +17,9 @@ import { VM_IMAGE_FILE_FORMAT } from '../validators/vm-image';
 import { OS } from '../mixins/harvester-vm';
 import { HCI } from '../types';
 
+const ENCRYPT = 'encrypt';
+const DECRYPT = 'decrypt';
+const CLONE = 'clone';
 const DOWNLOAD = 'download';
 const UPLOAD = 'upload';
 const rawORqcow2 = 'raw_qcow2';
@@ -59,6 +61,8 @@ export default {
     const defaultStorage = this.$store.getters[`${ inStore }/all`](STORAGE_CLASS).find(s => s.isDefault);
 
     this['storageClassName'] = this.storageClassName || defaultStorage?.metadata?.name || 'longhorn';
+    this.images = this.$store.getters[`${ inStore }/all`](HCI.IMAGE);
+    this.selectedImage = this.images.find(i => i.name === this.value.name) || null;
   },
 
   data() {
@@ -71,12 +75,14 @@ export default {
     }
 
     return {
-      url:      this.value.spec.url,
+      selectedImage: null,
-      files:    [],
+      images:        [],
-      resource: '',
+      url:           this.value.spec.url,
-      headers:  {},
+      files:         [],
-      fileUrl:  '',
+      resource:      '',
-      file:     '',
+      headers:       {},
+      fileUrl:       '',
+      file:          '',
     };
   },
 
@@ -94,9 +100,16 @@ export default {
     },
 
     showEditAsYaml() {
-      return this.value.spec.sourceType === DOWNLOAD;
+      return this.value.spec.sourceType === DOWNLOAD || this.value.spec.sourceType === CLONE;
+    },
+    radioGroupOptions() {
+      return [
+        DOWNLOAD,
+        UPLOAD,
+        ENCRYPT,
+        DECRYPT
+      ];
     },
-
     storageClassOptions() {
       const inStore = this.$store.getters['currentProduct'].inStore;
       const storages = this.$store.getters[`${ inStore }/all`](STORAGE_CLASS);
@@ -122,9 +135,66 @@ export default {
         this.value.metadata.annotations[HCI_ANNOTATIONS.STORAGE_CLASS] = nue;
       }
     },
+    sourceImageOptions() {
+      let options = [];
+
+      if (this.value.spec.sourceType !== CLONE) {
+        return options;
+      }
+      if (this.value.spec.securityParameters.cryptoOperation === ENCRYPT) {
+        options = this.images.filter(image => !image.isEncrypted);
+      } else {
+        options = this.images.filter(image => image.isEncrypted);
+      }
+
+      return options.map(image => image.spec.displayName);
+    },
+    sourceImageName: {
+      get() {
+        return this.selectedImage?.spec.displayName;
+      },
+      set(imageDisplayName) {
+        this.selectedImage = this.images.find(i => i.spec.displayName === imageDisplayName);
+        // sourceImageName should bring the name of the image
+        this.value.spec.securityParameters.sourceImageName = this.selectedImage?.metadata.name || '';
+      }
+    },
+    sourceType: {
+      get() {
+        if (this.value.spec.sourceType === CLONE) {
+          return this.value.spec.securityParameters.cryptoOperation;
+        } else {
+          return this.value.spec.sourceType;
+        }
+      },
+
+      set(neu) {
+        if (neu === DECRYPT || neu === ENCRYPT) {
+          this.value.spec.sourceType = CLONE;
+          this.$set(this.value.spec, 'securityParameters', {
+            cryptoOperation:      neu,
+            sourceImageName:      '',
+            sourceImageNamespace: this.value.metadata.namespace
+          });
+          this.selectedImage = null;
+        } else {
+          this.$delete(this.value.spec, 'securityParameters');
+          this.value.spec.sourceType = neu;
+        }
+      }
+    }
   },
 
   watch: {
+    'value.metadata.namespace'(neu) {
+      if (this.value.spec.sourceType === CLONE) {
+        this.$set(this.value.spec, 'securityParameters', {
+          cryptoOperation:      this.value.spec.securityParameters.cryptoOperation,
+          sourceImageName:      '',
+          sourceImageNamespace: neu
+        });
+      }
+    },
     'value.spec.url'(neu) {
       const url = neu.trim();
 
@@ -300,15 +370,14 @@ export default {
       >
         <RadioGroup
           v-if="isCreate"
-          v-model:value="value.spec.sourceType"
+          v-model:value="sourceType"
           name="model"
-          :options="[
+          :options="radioGroupOptions"
-            'download',
-            'upload',
-          ]"
           :labels="[
             t('harvester.image.sourceType.download'),
             t('harvester.image.sourceType.upload'),
+            t('harvester.image.sourceType.encrypt'),
+            t('harvester.image.sourceType.decrypt'),
           ]"
           :mode="mode"
         />
@@ -334,7 +403,7 @@ export default {
               :tooltip="t('harvester.image.urlTip', {}, true)"
             />
 
-            <div v-else>
+            <div v-else-if="value.spec.sourceType === 'upload'">
               <LabeledInput
                 v-if="isView"
                 v-model:value="imageName"
@@ -379,6 +448,16 @@ export default {
               label-key="harvester.image.checksum"
               :tooltip="t('harvester.image.checksumTip')"
             />
+
+            <LabeledSelect
+              v-if="value.spec.sourceType === 'clone'"
+              v-model="sourceImageName"
+              :options="sourceImageOptions"
+              :label="t('harvester.image.sourceImage')"
+              :mode="mode"
+              :disabled="isEdit"
+              class="mb-20"
+            />
           </div>
         </div>
       </Tab>

pkg/harvester/l10n/en-us.yaml

@@ -207,6 +207,7 @@ harvester:
           =1 {core}
           other {cores}}
   tableHeaders:
+    imageEncryption: Encryption
     size: Size
     virtualSize: Virtual Size
     progress: Progress
@@ -767,6 +768,8 @@ harvester:
       basics: Basics
     url: URL
     size: Size
+    isEncryption: Encryption
+    encryptionSecret: Encryption Secret
     virtualSize: Virtual Size
     urlTip: 'Supports the <code>raw</code> and <code>qcow2</code> image formats which are supported by <a href="https://www.qemu.org/docs/master/system/images.html#disk-image-file-formats" target="_blank">qemu</a>. Bootable ISO images can also be used and are treated like <code>raw</code> images.'
     fileName: File Name
@@ -775,6 +778,11 @@ harvester:
     sourceType:
       download: URL
       upload: File
+      clone: Clone
+      encrypt: Encrypt
+      decrypt: Decrypt
+    sourceImage: Source Image
+    cryptoOperation: Crypto Operation
     warning:
       uploading: |-
         {count, plural,
@@ -1100,6 +1108,9 @@ harvester:
   storage:
     label: Storage
     useDefault: Use the default storage
+    volumeEncryption: Volume Encryption
+    secretName: Secret Name
+    secretNamespace: Secret Namespace
     migratable:
       label: Migratable
     numberOfReplicas:

pkg/harvester/list/harvesterhci.io.virtualmachineimage.vue

@@ -75,6 +75,22 @@ export default {
       <template #more-header-middle>
         <FilterLabel ref="filterLabel" :rows="rows" @changeRows="changeRows" />
       </template>
+      <template #col:name="{row}">
+        <td>
+          <span>
+            <n-link
+              v-if="row?.detailLocation"
+              :to="row.detailLocation"
+            >
+              {{ row.nameDisplay }}
+              <i v-if="row.isEncrypted" class="icon icon-lock" />
+            </n-link>
+            <span v-else>
+              {{ row.nameDisplay }}
+            </span>
+          </span>
+        </td>
+      </template>
     </ResourceTable>
   </div>
 </template>

pkg/harvester/list/harvesterhci.io.volume.vue

@@ -170,6 +170,22 @@ v-if="getVMName(scope.row)"
         </router-link>
       </div>
     </template>
+    <template #col:name="{row}">
+      <td>
+        <span>
+          <n-link
+            v-if="row?.detailLocation"
+            :to="row.detailLocation"
+          >
+            {{ row.nameDisplay }}
+            <i v-if="row.isEncrypted" class="icon icon-lock" />
+          </n-link>
+          <span v-else>
+            {{ row.nameDisplay }}
+          </span>
+        </span>
+      </td>
+    </template>
   </ResourceTable>
 </template>
 

pkg/harvester/models/harvester/persistentvolumeclaim.js

@@ -37,7 +37,7 @@ export default class HciPv extends HarvesterResource {
     return [
       {
         action:  'exportImage',
-        enabled: this.hasAction('export'),
+        enabled: this.hasAction('export') && !this.isEncrypted,
         icon:    'icon icon-copy',
         label:   this.t('harvester.action.exportImage')
       },
@@ -213,6 +213,14 @@ export default class HciPv extends HarvesterResource {
     return false;
   }
 
+  get isEncrypted() {
+    const inStore = this.$rootGetters['currentProduct'].inStore;
+
+    const longhornVolume = this.$rootGetters[`${ inStore }/all`](LONGHORN.VOLUMES).find(v => v.metadata?.name === this.spec?.volumeName);
+
+    return longhornVolume?.spec.encrypted || false;
+  }
+
   get longhornVolume() {
     const inStore = this.$rootGetters['currentProduct'].inStore;
 

pkg/harvester/models/harvesterhci.io.virtualmachineimage.js

@@ -11,6 +11,12 @@ import { _CLONE } from '@shell/config/query-params';
 import { HCI } from '../types';
 import { PRODUCT_NAME as HARVESTER_PRODUCT } from '../config/harvester';
 import HarvesterResource from './harvester';
+import { CSI_SECRETS } from '@pkg/harvester/config/harvester-map';
+
+const {
+  CSI_PROVISIONER_SECRET_NAME,
+  CSI_PROVISIONER_SECRET_NAMESPACE,
+} = CSI_SECRETS;
 
 function isReady() {
   function getStatusConditionOfType(type, defaultValue = []) {
@@ -127,6 +133,24 @@ export default class HciVmImage extends HarvesterResource {
     return stateDisplay(this.metadata.state.name);
   }
 
+  get encryptionSecret() {
+    const secretNS = this.spec.storageClassParameters[CSI_PROVISIONER_SECRET_NAMESPACE];
+    const secretName = this.spec.storageClassParameters[CSI_PROVISIONER_SECRET_NAME];
+
+    if (secretNS && secretName) {
+      return `${ secretNS }/${ secretName }`;
+    }
+
+    return '';
+  }
+
+  get isEncrypted() {
+    return this.spec.sourceType === 'clone' &&
+    this.spec.securityParameters?.cryptoOperation === 'encrypt' &&
+    !!this.spec.securityParameters?.sourceImageName &&
+    !!this.spec.securityParameters?.sourceImageNamespace;
+  }
+
   get imageMessage() {
     if (this.uploadError) {
       return ucFirst(this.uploadError);