Add "encryption-*" options in volume type commands

Add "--encryption-provider", "--encryption-cipher",
"--encryption-key-size" and "--encryption-control-location"
options to "volume type set" and "volume type create" commands.
Add "--encryption-type" option to "volume type unset",
"volume type list" and "volume type show" commands.

Change-Id: I3572635d5913d971a723a62d7790ffe0f20ec39a
Implements: bp cinder-command-support
Closes-Bug: #1651117

Author: Huanxuan Ao

doc/source/command-objects/volume-type.rst

@@ -18,6 +18,10 @@ Create new volume type
         [--property <key=value> [...] ]
         [--project <project>]
         [--project-domain <project-domain>]
+        [--encryption-provider <provider>]
+        [--encryption-cipher <cipher>]
+        [--encryption-key-size <key-size>]
+        [--encryption-control-location <control-location>]
         <name>
 
 .. option:: --description <description>
@@ -56,6 +60,34 @@ Create new volume type
 
     *Volume version 2 only*
 
+.. option:: --encryption-provider <provider>
+
+    Set the class that provides encryption support for this volume type
+    (e.g "LuksEncryptor") (admin only)
+
+    This option is required when setting encryption type of a volume.
+    Consider using other encryption options such as: :option:`--encryption-cipher`,
+    :option:`--encryption-key-size` and :option:`--encryption-control-location`
+
+.. option:: --encryption-cipher <cipher>
+
+    Set the encryption algorithm or mode for this volume type
+    (e.g "aes-xts-plain64") (admin only)
+
+.. option:: --encryption-key-size <key-size>
+
+    Set the size of the encryption key of this volume type
+    (e.g "128" or "256") (admin only)
+
+.. option:: --encryption-control-location <control-location>
+
+    Set the notional service where the encryption is performed
+    ("front-end" or "back-end") (admin only)
+
+    The default value for this option is "front-end" when setting encryption type of
+    a volume. Consider using other encryption options such as: :option:`--encryption-cipher`,
+    :option:`--encryption-key-size` and :option:`--encryption-provider`
+
 .. _volume_type_create-name:
 .. describe:: <name>
 
@@ -88,6 +120,7 @@ List volume types
     openstack volume type list
         [--long]
         [--default | --public | --private]
+        [--encryption-type]
 
 .. option:: --long
 
@@ -111,6 +144,10 @@ List volume types
 
     *Volume version 2 only*
 
+.. option:: --encryption-type
+
+    Display encryption information for each volume type (admin only)
+
 volume type set
 ---------------
 
@@ -125,6 +162,10 @@ Set volume type properties
         [--property <key=value> [...] ]
         [--project <project>]
         [--project-domain <project-domain>]
+        [--encryption-provider <provider>]
+        [--encryption-cipher <cipher>]
+        [--encryption-key-size <key-size>]
+        [--encryption-control-location <control-location>]
         <volume-type>
 
 .. option:: --name <name>
@@ -154,6 +195,34 @@ Set volume type properties
 
     Set a property on this volume type (repeat option to set multiple properties)
 
+.. option:: --encryption-provider <provider>
+
+    Set the class that provides encryption support for this volume type
+    (e.g "LuksEncryptor") (admin only)
+
+    This option is required when setting encryption type of a volume for the first time.
+    Consider using other encryption options such as: :option:`--encryption-cipher`,
+    :option:`--encryption-key-size` and :option:`--encryption-control-location`
+
+.. option:: --encryption-cipher <cipher>
+
+    Set the encryption algorithm or mode for this volume type
+    (e.g "aes-xts-plain64") (admin only)
+
+.. option:: --encryption-key-size <key-size>
+
+    Set the size of the encryption key of this volume type
+    (e.g "128" or "256") (admin only)
+
+.. option:: --encryption-control-location <control-location>
+
+    Set the notional service where the encryption is performed
+    ("front-end" or "back-end") (admin only)
+
+    The default value for this option is "front-end" when setting encryption type of
+    a volume for the first time. Consider using other encryption options such as:
+    :option:`--encryption-cipher`, :option:`--encryption-key-size` and :option:`--encryption-provider`
+
 .. _volume_type_set-volume-type:
 .. describe:: <volume-type>
 
@@ -168,8 +237,13 @@ Display volume type details
 .. code:: bash
 
     openstack volume type show
+        [--encryption-type]
         <volume-type>
 
+.. option:: --encryption-type
+
+    Display encryption information of this volume type (admin only)
+
 .. _volume_type_show-volume-type:
 .. describe:: <volume-type>
 
@@ -187,6 +261,7 @@ Unset volume type properties
         [--property <key> [...] ]
         [--project <project>]
         [--project-domain <project-domain>]
+        [--encryption-type]
         <volume-type>
 
 .. option:: --property <key>
@@ -204,6 +279,12 @@ Unset volume type properties
     Domain the project belongs to (name or ID).
     This can be used in case collisions between project names exist.
 
+    *Volume version 2 only*
+
+.. option:: --encryption-type
+
+    Remove the encryption type for this volume type (admin only)
+
 .. _volume_type_unset-volume-type:
 .. describe:: <volume-type>
 

openstackclient/tests/functional/volume/v1/test_volume_type.py

@@ -87,3 +87,74 @@ def test_multi_delete(self):
         time.sleep(5)
         raw_output = self.openstack(cmd)
         self.assertOutput('', raw_output)
+
+    # NOTE: Add some basic funtional tests with the old format to
+    #       make sure the command works properly, need to change
+    #       these to new test format when beef up all tests for
+    #       volume tye commands.
+    def test_encryption_type(self):
+        encryption_type = uuid.uuid4().hex
+        # test create new encryption type
+        opts = self.get_opts(['encryption'])
+        raw_output = self.openstack(
+            'volume type create '
+            '--encryption-provider LuksEncryptor '
+            '--encryption-cipher aes-xts-plain64 '
+            '--encryption-key-size 128 '
+            '--encryption-control-location front-end ' +
+            encryption_type + opts)
+        expected = ["provider='LuksEncryptor'",
+                    "cipher='aes-xts-plain64'",
+                    "key_size='128'",
+                    "control_location='front-end'"]
+        for attr in expected:
+            self.assertIn(attr, raw_output)
+        # test show encryption type
+        opts = self.get_opts(['encryption'])
+        raw_output = self.openstack(
+            'volume type show --encryption-type ' + encryption_type + opts)
+        expected = ["provider='LuksEncryptor'",
+                    "cipher='aes-xts-plain64'",
+                    "key_size='128'",
+                    "control_location='front-end'"]
+        for attr in expected:
+            self.assertIn(attr, raw_output)
+        # test list encryption type
+        opts = self.get_opts(['Encryption'])
+        raw_output = self.openstack(
+            'volume type list --encryption-type ' + opts)
+        expected = ["provider='LuksEncryptor'",
+                    "cipher='aes-xts-plain64'",
+                    "key_size='128'",
+                    "control_location='front-end'"]
+        for attr in expected:
+            self.assertIn(attr, raw_output)
+        # test set new encryption type
+        raw_output = self.openstack(
+            'volume type set '
+            '--encryption-provider LuksEncryptor '
+            '--encryption-cipher aes-xts-plain64 '
+            '--encryption-key-size 128 '
+            '--encryption-control-location front-end ' +
+            self.NAME)
+        self.assertEqual('', raw_output)
+        opts = self.get_opts(['encryption'])
+        raw_output = self.openstack(
+            'volume type show --encryption-type ' + self.NAME + opts)
+        expected = ["provider='LuksEncryptor'",
+                    "cipher='aes-xts-plain64'",
+                    "key_size='128'",
+                    "control_location='front-end'"]
+        for attr in expected:
+            self.assertIn(attr, raw_output)
+        # test unset encryption type
+        raw_output = self.openstack(
+            'volume type unset --encryption-type ' + self.NAME)
+        self.assertEqual('', raw_output)
+        opts = self.get_opts(['encryption'])
+        raw_output = self.openstack(
+            'volume type show --encryption-type ' + self.NAME + opts)
+        self.assertEqual('\n', raw_output)
+        # test delete encryption type
+        raw_output = self.openstack('volume type delete ' + encryption_type)
+        self.assertEqual('', raw_output)

openstackclient/tests/functional/volume/v2/test_volume_type.py

@@ -102,3 +102,90 @@ def test_multi_delete(self):
         time.sleep(5)
         raw_output = self.openstack(cmd)
         self.assertOutput('', raw_output)
+
+    # NOTE: Add some basic funtional tests with the old format to
+    #       make sure the command works properly, need to change
+    #       these to new test format when beef up all tests for
+    #       volume tye commands.
+    def test_encryption_type(self):
+        encryption_type = uuid.uuid4().hex
+        # test create new encryption type
+        opts = self.get_opts(['encryption'])
+        raw_output = self.openstack(
+            'volume type create '
+            '--encryption-provider LuksEncryptor '
+            '--encryption-cipher aes-xts-plain64 '
+            '--encryption-key-size 128 '
+            '--encryption-control-location front-end ' +
+            encryption_type + opts)
+        expected = ["provider='LuksEncryptor'",
+                    "cipher='aes-xts-plain64'",
+                    "key_size='128'",
+                    "control_location='front-end'"]
+        for attr in expected:
+            self.assertIn(attr, raw_output)
+        # test show encryption type
+        opts = self.get_opts(['encryption'])
+        raw_output = self.openstack(
+            'volume type show --encryption-type ' + encryption_type + opts)
+        expected = ["provider='LuksEncryptor'",
+                    "cipher='aes-xts-plain64'",
+                    "key_size='128'",
+                    "control_location='front-end'"]
+        for attr in expected:
+            self.assertIn(attr, raw_output)
+        # test list encryption type
+        opts = self.get_opts(['Encryption'])
+        raw_output = self.openstack(
+            'volume type list --encryption-type ' + opts)
+        expected = ["provider='LuksEncryptor'",
+                    "cipher='aes-xts-plain64'",
+                    "key_size='128'",
+                    "control_location='front-end'"]
+        for attr in expected:
+            self.assertIn(attr, raw_output)
+        # test set existing encryption type
+        raw_output = self.openstack(
+            'volume type set '
+            '--encryption-key-size 256 '
+            '--encryption-control-location back-end ' +
+            encryption_type)
+        self.assertEqual('', raw_output)
+        opts = self.get_opts(['encryption'])
+        raw_output = self.openstack(
+            'volume type show --encryption-type ' + encryption_type + opts)
+        expected = ["provider='LuksEncryptor'",
+                    "cipher='aes-xts-plain64'",
+                    "key_size='256'",
+                    "control_location='back-end'"]
+        for attr in expected:
+            self.assertIn(attr, raw_output)
+        # test set new encryption type
+        raw_output = self.openstack(
+            'volume type set '
+            '--encryption-provider LuksEncryptor '
+            '--encryption-cipher aes-xts-plain64 '
+            '--encryption-key-size 128 '
+            '--encryption-control-location front-end ' +
+            self.NAME)
+        self.assertEqual('', raw_output)
+        opts = self.get_opts(['encryption'])
+        raw_output = self.openstack(
+            'volume type show --encryption-type ' + self.NAME + opts)
+        expected = ["provider='LuksEncryptor'",
+                    "cipher='aes-xts-plain64'",
+                    "key_size='128'",
+                    "control_location='front-end'"]
+        for attr in expected:
+            self.assertIn(attr, raw_output)
+        # test unset encryption type
+        raw_output = self.openstack(
+            'volume type unset --encryption-type ' + self.NAME)
+        self.assertEqual('', raw_output)
+        opts = self.get_opts(['encryption'])
+        raw_output = self.openstack(
+            'volume type show --encryption-type ' + self.NAME + opts)
+        self.assertEqual('\n', raw_output)
+        # test delete encryption type
+        raw_output = self.openstack('volume type delete ' + encryption_type)
+        self.assertEqual('', raw_output)

openstackclient/tests/unit/volume/v1/fakes.py

@@ -364,6 +364,9 @@ def __init__(self, **kwargs):
         self.qos_specs.resource_class = fakes.FakeResource(None, {})
         self.volume_types = mock.Mock()
         self.volume_types.resource_class = fakes.FakeResource(None, {})
+        self.volume_encryption_types = mock.Mock()
+        self.volume_encryption_types.resource_class = (
+            fakes.FakeResource(None, {}))
         self.transfers = mock.Mock()
         self.transfers.resource_class = fakes.FakeResource(None, {})
         self.volume_snapshots = mock.Mock()
@@ -470,6 +473,34 @@ def get_types(types=None, count=2):
 
         return mock.Mock(side_effect=types)
 
+    @staticmethod
+    def create_one_encryption_type(attrs=None):
+        """Create a fake encryption type.
+
+        :param Dictionary attrs:
+            A dictionary with all attributes
+        :return:
+            A FakeResource object with volume_type_id etc.
+        """
+        attrs = attrs or {}
+
+        # Set default attributes.
+        encryption_info = {
+            "volume_type_id": 'type-id-' + uuid.uuid4().hex,
+            'provider': 'LuksEncryptor',
+            'cipher': None,
+            'key_size': None,
+            'control_location': 'front-end',
+        }
+
+        # Overwrite default attributes.
+        encryption_info.update(attrs)
+
+        encryption_type = fakes.FakeResource(
+            info=copy.deepcopy(encryption_info),
+            loaded=True)
+        return encryption_type
+
 
 class FakeSnapshot(object):
     """Fake one or more snapshot."""