Ceph

This bug has been discussed on the ceph-devel mailing list in thread:

"Understanding encrypted OSD's and cephx"

The summary of this is (as presented by Sage):

and instead define a new monitor command to do all of this in one go.
For example, 'osd bootstrap' could take the necessary arguments (e.g., the
uuid and local key) and in one step set up the various keys for you. I
think that's going to be the most maintainable and sane solution going
forward.

I (Owen Synge) would like to add that I feel a need to prevent replay attacks and propose:

Using the trigger of OSD registering to prevent replay attacks, seems
like a better compromise than making each command only work once, so
setup can be repeated until success, and then since replay is prevented
other keys cannot be exposed.

Am currently testing a work around for the test suite:

https://github.com/SUSE/ceph-qa-suite/tree/wip_dmcrypt_admin_workaround

The bootstrap-osd could have permissions to ceph config-key put/get ( https://github.com/ceph/ceph/blob/master/src/ceph-disk/ceph_disk/main.py#L3691 ) and the OSD could have permission to only ceph config-key get its own uuid.

I noticed a somewhat-related ticket today: #16755