Encrypt OSDs on running System. A good Idea?
Hello all :-), We use Ceph both as storage in Proxmox and as storage in K8S. I would like to encrypt the OSDs. I have backups of the Proxmox machines, but honestly, I would prefer not to have to use them, as it would take two days to rebuild everything from scratch. I ran some tests on a small Proxmox machine, and telling the OSDs to encrypt themselves doesn’t seem too difficult. However, nothing is running on that storage. What issues should I expect if I take an OSD (15TB) out one at a time, encrypt it, and put it back into the cluster? I would have a long period where some OSDs are encrypted and others are not. How dangerous is this? Has anyone done it before ? Best wishes, Gio
What issues should I expect if I take an OSD (15TB) out one at a time, encrypt it, and put it back into the cluster? I would have a long period where some OSDs are encrypted and others are not. How dangerous is this?
I don't think it would be more dangerous than if you were redoing OSDs for any other reasons, so if you empty the OSD, rebuild it with --dmcrypt and refill again, you would always have the correct number of copies. It would not be an issue that some OSDs are encrypted and others are not, this is only an aspect of how data is stored on disk, when the OSD is up and running it will serve the same data regardless of the encryption status. Encryption for OSDs is more related to what is stored on the drive when you remove it from the server and if that is readable or not in that state. -- May the most significant bit of your life be positive.
Hello Janne, thank you for your answer. I will do. Best Gio Am 20.11.2024 um 11:24 schrieb Janne Johansson:
What issues should I expect if I take an OSD (15TB) out one at a time, encrypt it, and put it back into the cluster? I would have a long period where some OSDs are encrypted and others are not. How dangerous is this? I don't think it would be more dangerous than if you were redoing OSDs for any other reasons, so if you empty the OSD, rebuild it with --dmcrypt and refill again, you would always have the correct number of copies. It would not be an issue that some OSDs are encrypted and others are not, this is only an aspect of how data is stored on disk, when the OSD is up and running it will serve the same data regardless of the encryption status. Encryption for OSDs is more related to what is stored on the drive when you remove it from the server and if that is readable or not in that state.
participants (2)
-
Giovanna Ratini
-
Janne Johansson