how to distinguish SED/OPAL and non SED/OPAL disks in orchestrator?
Hi, is it possible to somehow distinguish self encrypting drives from drives that are lacking the support in the orchestrator. So I don't encrypt them twice :) -- Die Selbsthilfegruppe "UTF-8-Probleme" trifft sich diesmal abweichend im groüen Saal.
Hi Boris, Unfortunately, there’s currently nothing in ceph-volume to detect self-encrypted devices. That being said, while I can’t give you a precise timeframe, it is something we are looking into. Regards, -- Guillaume Abrioux Software Engineer From: Boris <bb@kervyn.de> Date: Wednesday, 28 August 2024 at 13:10 To: ceph-users@ceph.io <ceph-users@ceph.io> Subject: [EXTERNAL] [ceph-users] how to distinguish SED/OPAL and non SED/OPAL disks in orchestrator? Hi, is it possible to somehow distinguish self encrypting drives from drives that are lacking the support in the orchestrator. So I don't encrypt them twice :) -- Die Selbsthilfegruppe "UTF-8-Probleme" trifft sich diesmal abweichend im groüen Saal. _______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io Unless otherwise stated above: Compagnie IBM France Siège Social : 17, avenue de l'Europe, 92275 Bois-Colombes Cedex RCS Nanterre 552 118 465 Forme Sociale : S.A.S. Capital Social : 664 614 175,50 € SIRET : 552 118 465 03644 - Code NAF 6203Z
is it possible to somehow distinguish self encrypting drives from drives that are lacking the support in the orchestrator.
So I don't encrypt them twice :)
I believe that an osd_spec can be bound to drive models, so you could differentiate that way. You could also just not use SED/OPAL and rely on dmcrypt across the board, but probably you paid extra for drives for a reason and have a key management scheme.
I just don't want to waste any performance and in my opinion SED can do it transparently, because they already do it all the time, but the encryption key is by default not secured with a password. At least that is how I understood it. Doing dmcrypt still goes through the CPU IIRC. But basically I only want to be able to send disks back to HPE when they shipped a bunch of ... check notes ... top performing and reliable enterprise disks. But I have to say that the idea of handing the SED/OPAL stuff over to dmcrypt is very promising :) Am Mi., 28. Aug. 2024 um 17:02 Uhr schrieb Anthony D'Atri < anthony.datri@gmail.com>:
is it possible to somehow distinguish self encrypting drives from drives that are lacking the support in the orchestrator.
So I don't encrypt them twice :)
I believe that an osd_spec can be bound to drive models, so you could differentiate that way.
You could also just not use SED/OPAL and rely on dmcrypt across the board, but probably you paid extra for drives for a reason and have a key management scheme. _______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io
-- Die Selbsthilfegruppe "UTF-8-Probleme" trifft sich diesmal abweichend im groüen Saal.
participants (3)
-
Anthony D'Atri
-
Boris
-
Guillaume ABRIOUX