Where is the default encryption key

[ygao-armada]

Recently I turn on OSD volume encryption with uncommenting following line in file deploy/examples/cluster.yaml:
# encryptedDevice: "true" # the default value for this option is "false"

Which dmcrypt key is used for the encryption?

I see following secrets:

$ kubectl get secret -n rook-ceph
NAME                                TYPE                 DATA   AGE
cluster-peer-token-rook-ceph        kubernetes.io/rook   2      2d17h
rook-ceph-admin-keyring             kubernetes.io/rook   1      2d17h
rook-ceph-config                    kubernetes.io/rook   2      2d17h
rook-ceph-crash-collector-keyring   kubernetes.io/rook   1      2d17h
rook-ceph-dashboard-password        kubernetes.io/rook   1      2d17h
rook-ceph-exporter-keyring          kubernetes.io/rook   1      2d17h
rook-ceph-mgr-a-keyring             kubernetes.io/rook   1      2d17h
rook-ceph-mgr-b-keyring             kubernetes.io/rook   1      2d17h
rook-ceph-mon                       kubernetes.io/rook   4      2d17h
rook-ceph-mons-keyring              kubernetes.io/rook   1      2d17h
rook-csi-cephfs-node                kubernetes.io/rook   2      2d17h
rook-csi-cephfs-provisioner         kubernetes.io/rook   2      2d17h
rook-csi-rbd-node                   kubernetes.io/rook   2      2d17h
rook-csi-rbd-provisioner            kubernetes.io/rook   2      2d17h

[travisn]

The encryption key is not stored in a K8s secret, but is stored in the Ceph mon store. Are you trying to retrieve the encryption key, or you only want to understand where it is stored?

[guits]

I suppose the question is: has rook-ceph-tools enough privileges to export that keyring ?
@travisn ^

[parth-gr]

I think we should provide the privileges in the toolbox

[travisn]

The toolbox mounts the admin keyring, so I the toolbox should already have full privs.

[ygao-armada]

@travisn how can I leverage the full privs in toolbox to get the encryption key?

[travisn]

Does it also fail if you run without the -n arg? This will default to the admin keyring.

ceph config-key get dm-crypt/osd/2b552910-c2fd-45ae-8d38-b8d41986bbf8/luks

It was probably failing because -n was specifying a different user that didn't match the keyring.