Is there a how-to document or cheat sheet on how to enable OSD encryption using dm-crypt? -- Michael This message and its attachments are from Data Dimensions and are intended only for the use of the individual or entity to which it is addressed, and may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please notify the sender immediately and permanently delete the original email and destroy any copies or printouts of this email as well as any attachments.
If you are using a service spec, just set encrypted: true If using ceph-volume, pass this flag: --dmcrypt You can verify similar to https://smithfarm-thebrain.blogspot.com/2020/03/how-to-verify-that-encrypted... -- Alex Gorbachev ISS/Storcium On Mon, Feb 26, 2024 at 10:25 PM Michael Worsham < mworsham@datadimensions.com> wrote:
Is there a how-to document or cheat sheet on how to enable OSD encryption using dm-crypt?
-- Michael
This message and its attachments are from Data Dimensions and are intended only for the use of the individual or entity to which it is addressed, and may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please notify the sender immediately and permanently delete the original email and destroy any copies or printouts of this email as well as any attachments. _______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io
I was setting up the Ceph cluster via this URL (https://computingforgeeks.com/install-ceph-storage-cluster-on-ubuntu-linux-s...) and didn't know if there was a way to do it via the "ceph orch daemon add osd ceph-osd-01:/dev/sdb" command or not? Is it possible to set the OSD to encryption after the fact or does that involve some other process? -- Michael Get Outlook for Android<https://aka.ms/AAb9ysg> ________________________________ From: Alex Gorbachev <ag@iss-integration.com> Sent: Monday, February 26, 2024 11:10:54 PM To: Michael Worsham <mworsham@datadimensions.com> Cc: ceph-users@ceph.io <ceph-users@ceph.io> Subject: Re: [ceph-users] OSD with dm-crypt? This is an external email. Please take care when clicking links or opening attachments. When in doubt, check with the Help Desk or Security. If you are using a service spec, just set encrypted: true If using ceph-volume, pass this flag: --dmcrypt You can verify similar to https://smithfarm-thebrain.blogspot.com/2020/03/how-to-verify-that-encrypted... -- Alex Gorbachev ISS/Storcium On Mon, Feb 26, 2024 at 10:25 PM Michael Worsham <mworsham@datadimensions.com<mailto:mworsham@datadimensions.com>> wrote: Is there a how-to document or cheat sheet on how to enable OSD encryption using dm-crypt? -- Michael This message and its attachments are from Data Dimensions and are intended only for the use of the individual or entity to which it is addressed, and may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please notify the sender immediately and permanently delete the original email and destroy any copies or printouts of this email as well as any attachments. _______________________________________________ ceph-users mailing list -- ceph-users@ceph.io<mailto:ceph-users@ceph.io> To unsubscribe send an email to ceph-users-leave@ceph.io<mailto:ceph-users-leave@ceph.io> This message and its attachments are from Data Dimensions and are intended only for the use of the individual or entity to which it is addressed, and may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please notify the sender immediately and permanently delete the original email and destroy any copies or printouts of this email as well as any attachments.
On 27-02-2024 05:45, Michael Worsham wrote:
I was setting up the Ceph cluster via this URL (https://computingforgeeks.com/install-ceph-storage-cluster-on-ubuntu-linux-s...) and didn't know if there was a way to do it via the "ceph orch daemon add osd ceph-osd-01:/dev/sdb" command or not?
Is it possible to set the OSD to encryption after the fact or does that involve some other process?
You can't enable encryption after the OSDs have been created. So you would need to reprovision each OSD. I think Using a spec file with the option "encrypted: true" in there is the easiest way of doing this [1]. So the procedure would be: - destroy all of your OSDs if you do not have stored any data in it. Otherwise do this one OSD (or failure domain) at a time. - use ceph-volume zap command to clean the OSDs, i.e.: cephadm shell -- ceph-volume lvm zap /path/to/device --destroy - check with cephadm shell -- ceph orch device ls --wide --refresh if all the drives you want to use are available - Test your spec file in a dry-run to see if cephadm would do what you expect: cephadm shell --mount /path/to/your/specfile/directory -- ceph orch apply osd -i /mnt/specfile-directory/example.spec --dry-run If this gives the outcome you want, you can omit the --dry-run part and let cephadm provision the OSDs for you. Note that to prevent cephadm by redeploying the "newly" discovered available drives you best make sure (and remove) the current OSD specfiles if present. And or pause cephadm. Gr. Stefan [1]: https://docs.ceph.com/en/latest/cephadm/services/osd/#osd-service
Not possible to set after the fact, to my knowledge. The OSD must be set to dm-crypt at the creation stage. -- Alex Gorbachev ISS/Storcium On Mon, Feb 26, 2024 at 11:45 PM Michael Worsham < mworsham@datadimensions.com> wrote:
I was setting up the Ceph cluster via this URL ( https://computingforgeeks.com/install-ceph-storage-cluster-on-ubuntu-linux-s...) and didn't know if there was a way to do it via the "ceph orch daemon add osd ceph-osd-01:/dev/sdb" command or not?
Is it possible to set the OSD to encryption after the fact or does that involve some other process?
-- Michael
Get Outlook for Android <https://aka.ms/AAb9ysg> ------------------------------ *From:* Alex Gorbachev <ag@iss-integration.com> *Sent:* Monday, February 26, 2024 11:10:54 PM *To:* Michael Worsham <mworsham@datadimensions.com> *Cc:* ceph-users@ceph.io <ceph-users@ceph.io> *Subject:* Re: [ceph-users] OSD with dm-crypt?
This is an external email. Please take care when clicking links or opening attachments. When in doubt, check with the Help Desk or Security.
If you are using a service spec, just set
encrypted: true
If using ceph-volume, pass this flag:
--dmcrypt
You can verify similar to https://smithfarm-thebrain.blogspot.com/2020/03/how-to-verify-that-encrypted... -- Alex Gorbachev ISS/Storcium
On Mon, Feb 26, 2024 at 10:25 PM Michael Worsham < mworsham@datadimensions.com> wrote:
Is there a how-to document or cheat sheet on how to enable OSD encryption using dm-crypt?
-- Michael
This message and its attachments are from Data Dimensions and are intended only for the use of the individual or entity to which it is addressed, and may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please notify the sender immediately and permanently delete the original email and destroy any copies or printouts of this email as well as any attachments. _______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io
This message and its attachments are from Data Dimensions and are intended only for the use of the individual or entity to which it is addressed, and may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please notify the sender immediately and permanently delete the original email and destroy any copies or printouts of this email as well as any attachments.
participants (3)
-
Alex Gorbachev
-
Michael Worsham
-
Stefan Kooman