From: Andrew Bartlett <abartlet@catalyst.net.nz>
To: ceph-devel@vger.kernel.org
Subject: Interested in ceph OSD encryption and key management
Date: Thu, 28 May 2015 16:23:25 +1200 [thread overview]
Message-ID: <1432787005.11787.33.camel@catalyst.net.nz> (raw)
David Disseldorp was good enough to point me at this proposal for ceph
OSD key management:
https://wiki.ceph.com/Planning/Blueprints/Infernalis/osd%3A_simple_ceph-mon_dm-crypt_key_management
I'm really interested in improving ceph on-disk encryption, and am
really glad folks are taking this beyond the local key storage we have
managed so far.
So I can be part of the discussion, how do I get a login to the wiki? I
would like to indicate my interest there.
Regarding the proposal:
In the default mode suggested in the wiki, my primary concern is that
I'm told, in a number of deployments, the monitor node is the same
server that also holds the OSDs, so we don't gain anything for those
cases over the /etc storage.
In those cases, the hooks suggested in the wiki will be key, as will be
having those configurable in ceph.conf, so ceph-deploy can just pass it
down to all the nodes as they are built, just as the other dmcrypt
options are.
I would like to see three things hookable:
- the command to obtain the key (on stdout)
- to encrypt the key (so we can additionally pass it
via gpg, a HSM or remote encrypt/decrypt service)
- to decrypt the key
Thanks,
Andrew Bartlett
--
Andrew Bartlett
http://samba.org/~abartlet/
Authentication Developer, Samba Team http://samba.org
Samba Developer, Catalyst IT http://catalyst.net.nz/services/samba
next reply other threads:[~2015-05-28 4:31 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-05-28 4:23 Andrew Bartlett [this message]
2015-05-28 20:03 ` Interested in ceph OSD encryption and key management Sage Weil
2015-05-31 14:01 ` Wyllys Ingersoll
2015-06-03 0:07 ` Andrew Bartlett
2015-06-03 0:12 ` Andrew Bartlett
2015-06-03 5:39 ` Milan Broz
2015-06-17 2:37 ` Andrew Bartlett
2015-06-17 4:16 ` Sage Weil
2015-06-18 13:34 ` Milan Broz
2015-06-18 14:31 ` Sage Weil
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1432787005.11787.33.camel@catalyst.net.nz \
--to=abartlet@catalyst.net.nz \
--cc=ceph-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.