Add LUKS disk encryption support for Linux OS morphing

coriolis/conductor/rpc/server.py

@@ -1427,7 +1427,7 @@ def _check_transfer_running_executions(self, ctxt, transfer):
     def _check_valid_transfer_tasks_execution(transfer, force=False):
         sorted_executions = sorted(
             transfer.executions, key=lambda e: e.number, reverse=True)
-        if not sorted_executions:
+        if not sorted_executions and not force:
             raise exception.InvalidTransferState(
                 "The Transfer has never been executed.")
 

coriolis/osmorphing/manager.py

@@ -135,7 +135,8 @@ def morph_image(origin_provider, destination_provider, connection_info,
     # instantiate and run OSMount tools:
     os_mount_tools = osmount_factory.get_os_mount_tools(
         os_type, connection_info, event_manager, ignore_devices,
-        CONF.default_osmorphing_operation_timeout)
+        CONF.default_osmorphing_operation_timeout,
+        osmorphing_info=osmorphing_info)
 
     proxy_settings = _get_proxy_settings()
     os_mount_tools.set_proxy(proxy_settings)
@@ -262,6 +263,9 @@ def morph_image(origin_provider, destination_provider, connection_info,
     LOG.info("Post packages install")
     import_os_morphing_tools.post_packages_install(packages_add)
 
+    os_mount_tools.remove_encryption_artifacts(os_root_dir)
+    os_mount_tools.install_encryption_firstboot_setup(os_root_dir)
+
     event_manager.progress_update("Dismounting OS partitions")
     try:
         os_mount_tools.dismount_os(os_root_dir)

coriolis/osmorphing/osmount/base.py

@@ -6,6 +6,7 @@
 import base64
 import collections
 import itertools
+import json
 import os
 import re
 import uuid
@@ -14,6 +15,7 @@
 from six import with_metaclass
 
 from coriolis import exception
+from coriolis.osmorphing.osmount import luks_mixin
 from coriolis import utils
 
 LOG = logging.getLogger(__name__)
@@ -24,12 +26,13 @@
 class BaseOSMountTools(object, with_metaclass(abc.ABCMeta)):
 
     def __init__(self, connection_info, event_manager, ignore_devices,
-                 operation_timeout):
+                 operation_timeout, osmorphing_info=None):
         self._event_manager = event_manager
         self._ignore_devices = ignore_devices
         self._environment = {}
         self._connection_info = connection_info
         self._osmount_operation_timeout = operation_timeout
+        self._osmorphing_info = osmorphing_info or {}
         self._connect()
 
     @abc.abstractmethod
@@ -58,6 +61,12 @@ def dismount_os(self, root_dir):
     def set_proxy(self, proxy_settings):
         pass
 
+    def remove_encryption_artifacts(self, os_root_dir):
+        pass
+
+    def install_encryption_firstboot_setup(self, os_root_dir):
+        pass
+
     def get_environment(self):
         return self._environment
 
@@ -117,7 +126,7 @@ def get_connection(self):
         return self._ssh
 
 
-class BaseLinuxOSMountTools(BaseSSHOSMountTools):
+class BaseLinuxOSMountTools(luks_mixin.LinuxLUKSMixin, BaseSSHOSMountTools):
     def _get_pvs(self):
         out = self._exec_cmd("sudo pvdisplay -c").splitlines()
         LOG.debug("Output of 'pvdisplay -c' command: %s", out)
@@ -417,16 +426,27 @@ def _get_volume_block_devices(self):
         #   where 'ln -s /dev/dm-N /dev/<VG-name>/<LV-name>'
         # Querying for the kernel device name (KNAME) should ensure we get the
         # device names we desire both for physical and logical volumes.
-        volume_devs = self._exec_cmd("lsblk -lnao KNAME").splitlines()
-        LOG.debug("All block devices: %s", str(volume_devs))
+        raw = self._exec_cmd("lsblk -lao KNAME,TYPE --json")
+        LOG.debug("All block devices: %s", raw)
 
-        volume_devs = ["/dev/%s" % d for d in volume_devs if
-                       not re.match(r"^.*\d+$", d)]
+        # Exclude partitions.
+        blockdevices = json.loads(raw).get("blockdevices", [])
+        volume_devs = [
+            "/dev/%s" % dev["kname"]
+            for dev in blockdevices
+            if dev.get("type") != "part"
+        ]
 
         LOG.debug("Ignoring block devices: %s", self._ignore_devices)
         volume_devs = [d for d in volume_devs if d
                        not in self._ignore_devices]
 
+        # lsblk reads sysfs, which is shared with the host inside containers,
+        # so it may list devices that have no /dev node here. Drop any such
+        # phantom entries.
+        volume_devs = [d for d in volume_devs
+                       if utils.test_ssh_path(self._ssh, d)]
+
         LOG.info("Volume block devices: %s", volume_devs)
         return volume_devs
 
@@ -555,6 +575,8 @@ def mount_os(self):
                 "sudo ls -1 %s*" % volume_dev).splitlines()
         LOG.debug("All simple devices to scan: %s", dev_paths)
 
+        self._unlock_luks_devices(dev_paths)
+
         lvm_dev_paths = []
         self._check_vgs()
         vgs = self._get_vgs()
@@ -654,6 +676,8 @@ def dismount_os(self, root_dir):
         self._exec_cmd(
             'mountpoint -q %s && sudo umount %s' % (root_dir, root_dir))
 
+        self._close_luks_devices()
+
     def set_proxy(self, proxy_settings):
         url = proxy_settings.get('url')
         if not url:

coriolis/osmorphing/osmount/factory.py

@@ -16,7 +16,8 @@
 
 
 def get_os_mount_tools(os_type, connection_info, event_manager,
-                       ignore_devices, operation_timeout):
+                       ignore_devices, operation_timeout,
+                       osmorphing_info=None):
     os_mount_tools = {constants.OS_TYPE_LINUX: [ubuntu.UbuntuOSMountTools,
                                                 redhat.RedHatOSMountTools,
                                                 suse.SUSEOSMountTools],
@@ -28,7 +29,7 @@ def get_os_mount_tools(os_type, connection_info, event_manager,
     for cls in os_mount_tools.get(os_type,
                                   itertools.chain(*os_mount_tools.values())):
         tools = cls(connection_info, event_manager, ignore_devices,
-                    operation_timeout)
+                    operation_timeout, osmorphing_info=osmorphing_info)
         LOG.debug("Testing OS mount tools: %s", cls.__name__)
         if tools.check_os():
             return tools