Skip to content

Add setter/getter for encryption key name in cta-admin tapepool

Problem

At the moment there is an ENCRYPTION_KEY_NAME field in the TAPE_POOL table of the CTA Catalogue, but we do not have the logic to set, get or use this value inside the CTA code:

Instead, we rely on the cta-get-encryption-key-puppet.py script to return the encryption key name based on the tape pool name:

Expected solution

  • Add the option to get/set the ENCRYPTION_KEY_NAME value on the tape pool with the cta-admin tp command. Modify CTA to use this value when archiving files to new tapes.
  • Deprecate the usage of the option --pool-name test_encryption from the cta-get-encryption-key-puppet.py script.
  • Allow CTA to directly key the encryption key from the .json file.

References

CTA Ops docs on encryption:

Edited by Joao Afonso