Re: Improving Data-At-Rest encryption in Ceph

2015-12-14 Thread Martin Millnert
On Mon, 2015-12-14 at 14:17 +0100, Radoslaw Zarzynski wrote: > Hello Folks, > > I would like to publish a proposal regarding improvements to Ceph > data-at-rest encryption mechanism. Adam Kupczyk and I worked > on that in last weeks. > > Initially we considered several architectural approaches

Re: Improving Data-At-Rest encryption in Ceph

2015-12-14 Thread Martin Millnert
On Mon, 2015-12-14 at 12:28 -0800, Gregory Farnum wrote: > On Mon, Dec 14, 2015 at 5:17 AM, Radoslaw Zarzynski > > In typical case ciphertext data transferred from OSD to OSD can be > > used without change. This is when both OSDs have the same crypto key > > version for given placement group. In

Re: OSD public / cluster network isolation using VRF:s

2015-12-07 Thread Martin Millnert
Greg, see below. On Thu, 2015-12-03 at 13:25 -0800, Gregory Farnum wrote: > On Thu, Dec 3, 2015 at 12:13 PM, Martin Millnert <mar...@millnert.se> wrote: > > Hi, > > > > we're deploying Ceph on Linux for multiple purposes. > > We want to build network isolation

Re: OSD public / cluster network isolation using VRF:s

2015-12-07 Thread Martin Millnert
On Mon, 2015-12-07 at 06:10 -0800, Sage Weil wrote: > On Mon, 7 Dec 2015, Martin Millnert wrote: > > > Note that on a largish cluster the public/client traffic is all > > > north-south, while the backend traffic is also mostly north-south to the > > > top-of

Re: OSD public / cluster network isolation using VRF:s

2015-12-07 Thread Martin Millnert
Wido, thanks for your feedback. On Thu, 2015-12-03 at 22:03 +0100, w...@42on.com wrote: > > > Op 3 dec. 2015 om 21:14 heeft Martin Millnert <mar...@millnert.se> het > > volgende geschreven: > > > > Hi, > > > > we're deploying Ceph on Linux for mu

Re: OSD public / cluster network isolation using VRF:s

2015-12-07 Thread Martin Millnert
Sage, thanks for your feedback, please see below: On Thu, 2015-12-03 at 13:30 -0800, Sage Weil wrote: > On Thu, 3 Dec 2015, w...@42on.com wrote: > > Why all the trouble and complexity? I personally always try to avoid the > > two networks and run with one. Also in large L3 envs. > > > > I like

OSD public / cluster network isolation using VRF:s

2015-12-03 Thread Martin Millnert
at, I'm interested in feedback. Would obviously prefer it to be merged. Regards, Martin Millnert [1] https://lwn.net/Articles/632522/ [2] https://www.kernel.org/doc/Documentation/networking/vrf.txt -- To unsubscribe from this list: send the line "unsubscribe ceph-devel" in the body o

Infernalis uninstallable - jenkins virtualenv misconfiguration?

2015-11-06 Thread Martin Millnert
.rpm /bin/bash /bin/sh /bin/sh /bin/sh /bin/sh /bin/sh /usr/bin/env /usr/bin/python [snip] Seems virtualenv on the jenkins build host is affecting some python path/env variable in the spec file somehow. Haven't dug further. Regards, -- Martin Millnert <mar...@millnert.se> -- To unsubscrib

Re: civetweb upstream/downstream divergence

2015-11-04 Thread Martin Millnert
On Wed, 2015-11-04 at 16:43 -0700, Ken Dreyer wrote: > When I was talking about a "parallel effort", what I meant is that > we'd get vanilla civetweb upstream into the distros, and we'd also > continue to bundle civetweb in Ceph, until we can reliably use the > upstream Civetweb package. That's

Re: newstore direction

2015-10-21 Thread Martin Millnert
Adding 2c On Wed, 2015-10-21 at 14:37 -0500, Mark Nelson wrote: > My thought is that there is some inflection point where the userland > kvstore/block approach is going to be less work, for everyone I think, > than trying to quickly discover, understand, fix, and push upstream > patches that

Re: newstore direction

2015-10-20 Thread Martin Millnert
Adding to this, On Tue, 2015-10-20 at 05:34 -0700, Sage Weil wrote: > On Mon, 19 Oct 2015, James (Fei) Liu-SSI wrote: > > Hi Sage and Somnath, > > In my humble opinion, There is another more aggressive solution than > > raw block device base keyvalue store as backend for objectstore. The new