How to build a virtual machine in an encrypted container with virsh

Question

I would like to use the volume encryption mechanism of libvirt. However, I was unable to find information about how to use this feature when running virt-install.

How do I pass the related options?

Edit 1

Based on the answer by Cole Robinson, I tried the following:

virsh --connect qemu:///system secret-define /tmp/testSecret.xml

MYSECRET=`printf %s "blablablaOpen" | base64`

virsh --connect qemu:///system secret-set-value f52a81b2-424e-490c-823d-6bd4235bc572 $MYSECRET

virsh --connect qemu:///system vol-create vm_images /tmp/testLuks.xml

virt-install --disk source_pool=vm_images,source_volume=MyLuks.img --connect qemu:///system -n luksTest -r 2048 --os-type=linux --os-variant debian10 --vnc --location ftp://ftp2.de.debian.org/debian/dists/buster/main/installer-amd64

with testSecret.xml:

<secret ephemeral='no' private='yes'>
   <description>Secret to protect File System</description>
   <uuid>f52a81b2-424e-490c-823d-6bd4235bc572</uuid>
   <usage type='volume'>
      <volume>/opt/vm_images/MyLuks.img</volume>
   </usage>
</secret>

and testLuks.xml:

<volume>
  <name>MyLuks.img</name>
  <capacity unit="G">5</capacity>
  <target>
    <path>/opt/vm_images/MyLuks.img</path>
    <format type='raw'/>
    <encryption format='luks'>
      <secret type='passphrase' uuid='f52a81b2-424e-490c-823d-6bd4235bc572'/>
    </encryption>
  </target>
</volume>

However, I get an error:

ERROR    internal error: process exited while connecting to monitor: 2019-10-15T05:29:57.582967Z qemu-system-x86_64: -drive file=/opt/vm_images/MyLuks.img,format=raw,if=none,id=drive-virtio-disk0: Could not open '/opt/vm_images/MyLuks.img': Permission denied

I assume that this is caused because virt-install does not support encrypted file systems.

Thus I restate my question:

How do I arrive at a bootable virtual machine (e.g. Debian) inside an encrypted container?

One idea might be to clone a system into an encrypted container.

Answer 1

virt-install doesn't support creating it natively. you will need to create the volume using libvirt directly (virsh vol-create or similar). Also virt-install doesn't yet support the <disk><encryption> XML either. You might be able to get libvirt to do the right thing with:

virt-install --disk source.pool=POOLNAME,source.volume=VOLNAME

But I haven't tried it myself.