Skip to content

Commit 8841411

Browse files
author
gitlab
committed
Merge branch 'ZSV-11489@@2' into 'feature-zsv-5.0.0-vm-support-vtpm-and-secuceboot'
<feature>[keyprovider]: Add DEK provisioning for TPM See merge request zstackio/zstack!9431
2 parents 4a6318b + 9f41218 commit 8841411

7 files changed

Lines changed: 363 additions & 44 deletions

File tree

‎compute/src/main/java/org/zstack/compute/vm/devices/DummyEncryptedResourceKeyManager.java‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
package org.zstack.compute.vm.devices;
2+
3+
import org.zstack.header.keyprovider.EncryptedResourceKeyManager;
4+
import org.zstack.header.core.Completion;
5+
import org.zstack.header.core.ReturnValueCompletion;
6+
import org.zstack.utils.Utils;
7+
import org.zstack.utils.logging.CLogger;
8+
9+
import static org.zstack.core.Platform.operr;
10+
11+
public class DummyEncryptedResourceKeyManager implements EncryptedResourceKeyManager {
12+
private static final CLogger logger = Utils.getLogger(DummyEncryptedResourceKeyManager.class);
13+
14+
@Override
15+
public void getOrCreateKey(GetOrCreateResourceKeyContext ctx,
16+
ReturnValueCompletion<ResourceKeyResult> completion) {
17+
logger.warn(String.format("crypto module not installed, cannot create resource key for %s[uuid:%s]",
18+
ctx.getResourceType(), ctx.getResourceUuid()));
19+
completion.fail(operr("crypto module is not installed, cannot manage resource encryption keys"));
20+
}
21+
22+
@Override
23+
public void rollbackCreatedKey(ResourceKeyResult result, Completion completion) {
24+
completion.success();
25+
}
26+
}

‎compute/src/main/java/org/zstack/compute/vm/devices/VmTpmExtensions.java‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -114,7 +114,6 @@ public void afterBuildVmSpec(VmInstanceSpec spec) {
114114

115115
tpmSpec.setEnable(true);
116116
tpmSpec.setTpmUuid(tpmUuid);
117-
tpmSpec.setKeyProviderUuid(resourceKeyBackend.findKeyProviderUuidByTpm(tpmUuid));
118117
}
119118
}
120119
}

‎conf/springConfigXml/VmInstanceManager.xml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -297,4 +297,5 @@
297297
</bean>
298298

299299
<bean id="DummyTpmEncryptedResourceKeyBackend" class="org.zstack.compute.vm.devices.DummyTpmEncryptedResourceKeyBackend"/>
300+
<bean id="DummyEncryptedResourceKeyManager" class="org.zstack.compute.vm.devices.DummyEncryptedResourceKeyManager"/>
300301
</beans>

‎header/src/main/java/org/zstack/header/keyprovider/EncryptedResourceKeyManager.java‎

Lines changed: 150 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,150 @@
1+
package org.zstack.header.keyprovider;
2+
3+
import org.zstack.header.core.ReturnValueCompletion;
4+
import org.zstack.header.core.Completion;
5+
6+
/**
7+
* Unified resource key management service.
8+
* Business layers (TPM, volume encryption, etc.) call this to create/retrieve DEKs
9+
* without knowing gRPC/key-tools protocol details.
10+
*/
11+
public interface EncryptedResourceKeyManager {
12+
13+
/**
14+
* Get or create a resource encryption key.
15+
* <p>
16+
* Semantically reuses the existing key record for the same {@code (resourceType, resourceUuid)}
17+
* when one is already available; otherwise creates a new one and returns the plaintext DEK.
18+
* <p>
19+
* This contract does not guarantee concurrent linearizability by itself. Callers must not assume
20+
* the interface alone provides serialization, uniqueness enforcement, or transaction-level protection
21+
* across concurrent create requests.
22+
*
23+
* @param ctx context describing the resource and key provider
24+
* @param completion returns {@link ResourceKeyResult} containing the plaintext DEK (base64)
25+
*/
26+
void getOrCreateKey(GetOrCreateResourceKeyContext ctx,
27+
ReturnValueCompletion<ResourceKeyResult> completion);
28+
29+
/**
30+
* Roll back a newly created resource key during upper-layer workflow rollback.
31+
* <p>
32+
* If the key record already existed before creation, implementation should restore it
33+
* to its previous empty-placeholder state instead of deleting the relationship.
34+
*/
35+
void rollbackCreatedKey(ResourceKeyResult result, Completion completion);
36+
37+
class GetOrCreateResourceKeyContext {
38+
private String resourceUuid;
39+
private String resourceType;
40+
private String keyProviderUuid;
41+
private String purpose;
42+
43+
public String getResourceUuid() {
44+
return resourceUuid;
45+
}
46+
47+
public void setResourceUuid(String resourceUuid) {
48+
this.resourceUuid = resourceUuid;
49+
}
50+
51+
public String getResourceType() {
52+
return resourceType;
53+
}
54+
55+
public void setResourceType(String resourceType) {
56+
this.resourceType = resourceType;
57+
}
58+
59+
public String getKeyProviderUuid() {
60+
return keyProviderUuid;
61+
}
62+
63+
public void setKeyProviderUuid(String keyProviderUuid) {
64+
this.keyProviderUuid = keyProviderUuid;
65+
}
66+
67+
public String getPurpose() {
68+
return purpose;
69+
}
70+
71+
public void setPurpose(String purpose) {
72+
this.purpose = purpose;
73+
}
74+
}
75+
76+
class ResourceKeyResult {
77+
private String resourceUuid;
78+
private String resourceType;
79+
private String keyProviderUuid;
80+
private String keyProviderName;
81+
private String dekBase64;
82+
private String secretRef;
83+
private boolean createdNewKey;
84+
private boolean refExistedBeforeCreate;
85+
86+
public String getResourceUuid() {
87+
return resourceUuid;
88+
}
89+
90+
public void setResourceUuid(String resourceUuid) {
91+
this.resourceUuid = resourceUuid;
92+
}
93+
94+
public String getResourceType() {
95+
return resourceType;
96+
}
97+
98+
public void setResourceType(String resourceType) {
99+
this.resourceType = resourceType;
100+
}
101+
102+
public String getKeyProviderUuid() {
103+
return keyProviderUuid;
104+
}
105+
106+
public void setKeyProviderUuid(String keyProviderUuid) {
107+
this.keyProviderUuid = keyProviderUuid;
108+
}
109+
110+
public String getKeyProviderName() {
111+
return keyProviderName;
112+
}
113+
114+
public void setKeyProviderName(String keyProviderName) {
115+
this.keyProviderName = keyProviderName;
116+
}
117+
118+
public String getDekBase64() {
119+
return dekBase64;
120+
}
121+
122+
public void setDekBase64(String dekBase64) {
123+
this.dekBase64 = dekBase64;
124+
}
125+
126+
public String getSecretRef() {
127+
return secretRef;
128+
}
129+
130+
public void setSecretRef(String secretRef) {
131+
this.secretRef = secretRef;
132+
}
133+
134+
public boolean isCreatedNewKey() {
135+
return createdNewKey;
136+
}
137+
138+
public void setCreatedNewKey(boolean createdNewKey) {
139+
this.createdNewKey = createdNewKey;
140+
}
141+
142+
public boolean isRefExistedBeforeCreate() {
143+
return refExistedBeforeCreate;
144+
}
145+
146+
public void setRefExistedBeforeCreate(boolean refExistedBeforeCreate) {
147+
this.refExistedBeforeCreate = refExistedBeforeCreate;
148+
}
149+
}
150+
}

‎header/src/main/java/org/zstack/header/tpm/entity/TpmSpec.java‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,10 @@ public class TpmSpec {
99
private String keyProviderUuid;
1010
@APINoSee
1111
private String secretUuid;
12+
@APINoSee
13+
private boolean resourceKeyCreatedNew;
14+
@APINoSee
15+
private String resourceKeyProviderUuid;
1216

1317
public boolean isEnable() {
1418
return enable;
@@ -42,6 +46,22 @@ public void setSecretUuid(String secretUuid) {
4246
this.secretUuid = secretUuid;
4347
}
4448

49+
public boolean isResourceKeyCreatedNew() {
50+
return resourceKeyCreatedNew;
51+
}
52+
53+
public void setResourceKeyCreatedNew(boolean resourceKeyCreatedNew) {
54+
this.resourceKeyCreatedNew = resourceKeyCreatedNew;
55+
}
56+
57+
public String getResourceKeyProviderUuid() {
58+
return resourceKeyProviderUuid;
59+
}
60+
61+
public void setResourceKeyProviderUuid(String resourceKeyProviderUuid) {
62+
this.resourceKeyProviderUuid = resourceKeyProviderUuid;
63+
}
64+
4565
public static TpmSpec __example__() {
4666
TpmSpec tpm = new TpmSpec();
4767
tpm.setKeyProviderUuid(StringDSL.createFixedUuid("keyProviderUuid"));

0 commit comments

Comments
 (0)