Encrypting a Block Storage volume with LUKS

Objective

OVHcloud Block Storage volumes can be encrypted at rest using LUKS. The encryption key — called a Service Key — is generated and stored in OVHcloud Key Management Service (OKMS).

By default, this Service Key is entirely generated and managed by OVHcloud: you simply order an encrypted (-luks) volume type and OVHcloud takes care of the rest. Optionally, you can instead use a customer-managed key (CMK): a Service Key that you create and control yourself in your own OKMS domain, including its suspension and deletion.

This guide first reminds how default (OVHcloud-managed) LUKS encryption works, then explains how to switch to a customer-managed key (CMK).

Default encryption (OVHcloud-managed key)

To encrypt a Block Storage volume with the default, OVHcloud-managed key, order the encrypted variant of any volume type (classic-luks, high-speed-luks, high-speed-gen2-luks) — from the Control Panel or with the tools described in the How to create and configure an additional disk on an instance guide. OVHcloud automatically generates and manages the Service Key in OKMS: there is no OKMS domain to create, no Service Key to manage, and no IAM policy to configure.

The rest of this guide covers the customer-managed key (CMK) alternative.

Using a customer-managed key (CMK)

Most steps below are documented in 2 ways:

• via the OVHcloud Control Panel, available today for the OKMS and IAM operations;
• via the OVHcloud API or the OpenStack CLI, currently the only ways to create the encrypted Block Storage volume itself. Control Panel support for volume creation with a CMK is coming soon.

Requirements

These requirements apply only to the customer-managed key (CMK) workflow below.

• An active OVHcloud account with sufficient rights to manage IAM, OKMS, and Block Storage.
• API access with valid credentials — a Bearer token (OAuth2 via an IAM service account) or the classic application key / signature authentication. See the First Steps with the OVHcloud APIs guide.
• Optionally, the OpenStack CLI installed and configured for the target region, as an alternative to the OVHcloud API for creating the volume. See the Preparing an environment for using the OpenStack API guide.
• Appropriate IAM permissions to create policies and assign them to OVHcloud NICs — specifically the account:apiovh:iam/policy/create action.

OVHcloud Control Panel Access

Policies:

• Direct link: Policies
• Navigation path: Identity, Security & Operations > Policies

Key Management Service:

• Direct link: Key Management Service
• Navigation path: Identity, Security & Operations > Key Management Service > Select your OKMS domain

Instructions

Each step below presents the available interfaces as tabs: OVHcloud Control Panel, OVHcloud API, or OpenStack CLI.

Step 1: Create an OKMS domain

An OKMS domain is a logical namespace inside OKMS that holds your Service Keys. Each domain is tied to a specific region.

An OKMS domain is ordered as a service from the OVHcloud Control Panel; the OVHcloud API is then used to retrieve its ID.

Step 2: Create a Service Key

A Service Key is a cryptographic key stored inside your OKMS domain. The Block Storage service uses it to generate and protect the data encryption keys (DEKs) that encrypt your volumes.

{
  "name": "cmk-luks-volumes",
  "type": "oct",
  "size": 256,
  "operations": ["encrypt", "decrypt", "wrapKey", "unwrapKey"]
}

Step 3: Delegate access via an IAM policy

To allow OVHcloud's OpenStack services to create and use LUKS volumes with your key, you must grant specific IAM permissions to the OVHcloud NIC associated with the Block Storage service in your region.

3.1 Identify the OVHcloud NIC for your region

Each OVHcloud region has a dedicated internal NIC that the Block Storage service uses to interact with OKMS:

3.2 Create the IAM policy

{
  "name": "allow-blockstorage-cmk-luks",
  "description": "Allow the regional Block Storage NIC to use my Service Key for LUKS volumes",
  "identities": [
    "urn:v1:eu:identity:account:{blockStorageNic}"
  ],
  "resources": [
    { "urn": "{serviceKeyIamUrn}" }
  ],
  "permissions": {
    "allow": [
      { "action": "okms:apikms:serviceKey/dataKey/create" },
      { "action": "okms:apikms:serviceKey/dataKey/decrypt" }
    ]
  }
}

3.3 Actions to authorize

Under Key Management Service (OKMS) / Service Keys, in the OPERATE category:

Step 4: Create the LUKS volume

{
  "name": "my-encrypted-volume",
  "description": "CMK LUKS encrypted volume",
  "size": 50,
  "type": "high-speed-gen2-luks",
  "availabilityZone": "eu-west-par-a",
  "encryption": {
    "encrypted": true,
    "kms": {
      "domainId": "{okmsDomainId}",
      "serviceKeyId": "{serviceKeyId}"
    }
  }
}

openstack volume create \
  --size 50 \
  --availability-zone eu-west-par-a \
  --property okms_domain_id={okmsDomainId} \
  --property okms_servicekey_id={serviceKeyId} \
  --type high-speed-gen2-luks \
  my-encrypted-volume

Step 5: Use the volume

Once created, a CMK LUKS encrypted volume behaves like a standard OVHcloud Block Storage volume: you attach and detach it the same way. Deleting the volume does not delete your Service Key.

Limitations

Converting a volume to an image is not supported for LUKS volumes, whether the encrypted version uses a CMK or the default OVHcloud-managed key. This restriction applies regardless of the tool used — Control Panel, OVHcloud API, OpenStack CLI, or Terraform.

Summary

Go further

How to create and configure an additional disk on an instance

Migrating a Block Storage volume to an encrypted LUKS volume

Getting started with OVHcloud Key Management Service (KMS)

How to use IAM policies using the OVHcloud Control Panel

Join our community of users.