27 Feb
2024
27 Feb
'24
6:24 a.m.
Is there a how-to document or cheat sheet on how to enable OSD encryption using dm-crypt?
-- Michael
This message and its attachments are from Data Dimensions and are intended only for the
use of the individual or entity to which it is addressed, and may contain information that
is privileged, confidential, and exempt from disclosure under applicable law. If the
reader of this message is not the intended recipient, or the employee or agent responsible
for delivering the message to the intended recipient, you are hereby notified that any
dissemination, distribution, or copying of this communication is strictly prohibited. If
you have received this communication in error, please notify the sender immediately and
permanently delete the original email and destroy any copies or printouts of this email as
well as any attachments.
27 Feb
27 Feb
7:10 a.m.
If you are using a service spec, just set
encrypted: true
If using ceph-volume, pass this flag:
--dmcrypt
You can verify similar to
https://smithfarm-thebrain.blogspot.com/2020/03/how-to-verify-that-encrypte…
--
Alex Gorbachev
ISS/Storcium
On Mon, Feb 26, 2024 at 10:25 PM Michael Worsham <
mworsham(a)datadimensions.com> wrote:
Is there a how-to document or cheat sheet on how to
enable OSD encryption
using dm-crypt?
-- Michael
This message and its attachments are from Data Dimensions and are intended
only for the use of the individual or entity to which it is addressed, and
may contain information that is privileged, confidential, and exempt from
disclosure under applicable law. If the reader of this message is not the
intended recipient, or the employee or agent responsible for delivering the
message to the intended recipient, you are hereby notified that any
dissemination, distribution, or copying of this communication is strictly
prohibited. If you have received this communication in error, please notify
the sender immediately and permanently delete the original email and
destroy any copies or printouts of this email as well as any attachments.
_______________________________________________
ceph-users mailing list -- ceph-users(a)ceph.io
To unsubscribe send an email to ceph-users-leave(a)ceph.io
7:45 a.m.
I was setting up the Ceph cluster via this URL
(https://computingforgeeks.com/install-ceph-storage-cluster-on-ubuntu-linux-…) and
didn't know if there was a way to do it via the "ceph orch daemon add osd
ceph-osd-01:/dev/sdb" command or not?
Is it possible to set the OSD to encryption after the fact or does that involve some other
process?
-- Michael
Get Outlook for Android<https://aka.ms/AAb9ysg>
________________________________
From: Alex Gorbachev <ag(a)iss-integration.com>
Sent: Monday, February 26, 2024 11:10:54 PM
To: Michael Worsham <mworsham(a)datadimensions.com>
Cc: ceph-users(a)ceph.io <ceph-users(a)ceph.io>
Subject: Re: [ceph-users] OSD with dm-crypt?
This is an external email. Please take care when clicking links or opening attachments.
When in doubt, check with the Help Desk or Security.
If you are using a service spec, just set
encrypted: true
If using ceph-volume, pass this flag:
--dmcrypt
You can verify similar to
https://smithfarm-thebrain.blogspot.com/2020/03/how-to-verify-that-encrypte…
--
Alex Gorbachev
ISS/Storcium
On Mon, Feb 26, 2024 at 10:25 PM Michael Worsham
<mworsham@datadimensions.com<mailto:mworsham@datadimensions.com>> wrote:
Is there a how-to document or cheat sheet on how to enable OSD encryption using
dm-crypt?
-- Michael
This message and its attachments are from Data Dimensions and are intended only for the
use of the individual or entity to which it is addressed, and may contain information that
is privileged, confidential, and exempt from disclosure under applicable law. If the
reader of this message is not the intended recipient, or the employee or agent responsible
for delivering the message to the intended recipient, you are hereby notified that any
dissemination, distribution, or copying of this communication is strictly prohibited. If
you have received this communication in error, please notify the sender immediately and
permanently delete the original email and destroy any copies or printouts of this email as
well as any attachments.
_______________________________________________
ceph-users mailing list -- ceph-users@ceph.io<mailto:ceph-users@ceph.io>
To unsubscribe send an email to
ceph-users-leave@ceph.io<mailto:ceph-users-leave@ceph.io>
This message and its attachments are from Data Dimensions and are intended only for the
use of the individual or entity to which it is addressed, and may contain information that
is privileged, confidential, and exempt from disclosure under applicable law. If the
reader of this message is not the intended recipient, or the employee or agent responsible
for delivering the message to the intended recipient, you are hereby notified that any
dissemination, distribution, or copying of this communication is strictly prohibited. If
you have received this communication in error, please notify the sender immediately and
permanently delete the original email and destroy any copies or printouts of this email as
well as any attachments.
12:29 p.m.
On 27-02-2024 05:45, Michael Worsham wrote:
I was setting up the Ceph cluster via this URL
(https://computingforgeeks.com/install-ceph-storage-cluster-on-ubuntu-linux-…) and
didn't know if there was a way to do it via the "ceph orch daemon add osd
ceph-osd-01:/dev/sdb" command or not?
Is it possible to set the OSD to encryption after the fact or does that involve some
other process?
You can't enable encryption after the OSDs have been created. So you
would need to reprovision each OSD. I think Using a spec file with the
option "encrypted: true" in there is the easiest way of doing this [1].
So the procedure would be:
- destroy all of your OSDs if you do not have stored any data in it.
Otherwise do this one OSD (or failure domain) at a time.
- use ceph-volume zap command to clean the OSDs, i.e.: cephadm shell --
ceph-volume lvm zap /path/to/device --destroy
- check with cephadm shell -- ceph orch device ls --wide --refresh if
all the drives you want to use are available
- Test your spec file in a dry-run to see if cephadm would do what you
expect: cephadm shell --mount /path/to/your/specfile/directory -- ceph
orch apply osd -i /mnt/specfile-directory/example.spec --dry-run
If this gives the outcome you want, you can omit the --dry-run part and
let cephadm provision the OSDs for you.
Note that to prevent cephadm by redeploying the "newly" discovered
available drives you best make sure (and remove) the current OSD
specfiles if present. And or pause cephadm.
Gr. Stefan
[1]: https://docs.ceph.com/en/latest/cephadm/services/osd/#osd-service
7:09 p.m.
Not possible to set after the fact, to my knowledge. The OSD must be set
to dm-crypt at the creation stage.
--
Alex Gorbachev
ISS/Storcium
On Mon, Feb 26, 2024 at 11:45 PM Michael Worsham <
mworsham(a)datadimensions.com> wrote:
I was setting up the Ceph cluster via this URL (
https://computingforgeeks.com/install-ceph-storage-cluster-on-ubuntu-linux-…)
and didn't know if there was a way to do it via the "ceph orch daemon add
osd ceph-osd-01:/dev/sdb" command or not?
Is it possible to set the OSD to encryption after the fact or does that
involve some other process?
-- Michael
Get Outlook for Android <https://aka.ms/AAb9ysg>
------------------------------
*From:* Alex Gorbachev <ag(a)iss-integration.com>
*Sent:* Monday, February 26, 2024 11:10:54 PM
*To:* Michael Worsham <mworsham(a)datadimensions.com>
*Cc:* ceph-users(a)ceph.io <ceph-users(a)ceph.io>
*Subject:* Re: [ceph-users] OSD with dm-crypt?
This is an external email. Please take care when clicking links or opening
attachments. When in doubt, check with the Help Desk or Security.
If you are using a service spec, just set
encrypted: true
If using ceph-volume, pass this flag:
--dmcrypt
You can verify similar to
https://smithfarm-thebrain.blogspot.com/2020/03/how-to-verify-that-encrypte…
--
Alex Gorbachev
ISS/Storcium
On Mon, Feb 26, 2024 at 10:25 PM Michael Worsham <
mworsham(a)datadimensions.com> wrote:
Is there a how-to document or cheat sheet on how to enable OSD encryption
using dm-crypt?
-- Michael
This message and its attachments are from Data Dimensions and are intended
only for the use of the individual or entity to which it is addressed, and
may contain information that is privileged, confidential, and exempt from
disclosure under applicable law. If the reader of this message is not the
intended recipient, or the employee or agent responsible for delivering the
message to the intended recipient, you are hereby notified that any
dissemination, distribution, or copying of this communication is strictly
prohibited. If you have received this communication in error, please notify
the sender immediately and permanently delete the original email and
destroy any copies or printouts of this email as well as any attachments.
_______________________________________________
ceph-users mailing list -- ceph-users(a)ceph.io
To unsubscribe send an email to ceph-users-leave(a)ceph.io
This message and its attachments are from Data Dimensions and are intended
only for the use of the individual or entity to which it is addressed, and
may contain information that is privileged, confidential, and exempt from
disclosure under applicable law. If the reader of this message is not the
intended recipient, or the employee or agent responsible for delivering the
message to the intended recipient, you are hereby notified that any
dissemination, distribution, or copying of this communication is strictly
prohibited. If you have received this communication in error, please notify
the sender immediately and permanently delete the original email and
destroy any copies or printouts of this email as well as any attachments.
83
days inactive
83
days old
4 comments
3 participants
participants (3)
-
Alex Gorbachev -
Michael Worsham -
Stefan Kooman