Re: Improving Data-At-Rest encryption in Ceph

2015-12-14 Thread Martin Millnert
On Mon, 2015-12-14 at 12:28 -0800, Gregory Farnum wrote: > On Mon, Dec 14, 2015 at 5:17 AM, Radoslaw Zarzynski > > In typical case ciphertext data transferred from OSD to OSD can be > > used without change. This is when both OSDs have the same crypto key > > version for given placement group. In r

Re: Improving Data-At-Rest encryption in Ceph

2015-12-14 Thread Martin Millnert
On Mon, 2015-12-14 at 14:17 +0100, Radoslaw Zarzynski wrote: > Hello Folks, > > I would like to publish a proposal regarding improvements to Ceph > data-at-rest encryption mechanism. Adam Kupczyk and I worked > on that in last weeks. > > Initially we considered several architectural approaches an

Re: OSD public / cluster network isolation using VRF:s

2015-12-07 Thread Martin Millnert
On Mon, 2015-12-07 at 06:10 -0800, Sage Weil wrote: > On Mon, 7 Dec 2015, Martin Millnert wrote: > > > Note that on a largish cluster the public/client traffic is all > > > north-south, while the backend traffic is also mostly north-south to the > > > top-of

Re: OSD public / cluster network isolation using VRF:s

2015-12-07 Thread Martin Millnert
On Mon, 2015-12-07 at 06:48 -0800, Gregory Farnum wrote: > >> I'm probably just being dense here, but I don't quite understand what > >> all this is trying to accomplish. It looks like it's essentially > >> trying to set up VLANs (with different rules) over a single physical > >> network interface

Re: OSD public / cluster network isolation using VRF:s

2015-12-07 Thread Martin Millnert
Sage, thanks for your feedback, please see below: On Thu, 2015-12-03 at 13:30 -0800, Sage Weil wrote: > On Thu, 3 Dec 2015, w...@42on.com wrote: > > Why all the trouble and complexity? I personally always try to avoid the > > two networks and run with one. Also in large L3 envs. > > > > I like

Re: OSD public / cluster network isolation using VRF:s

2015-12-07 Thread Martin Millnert
Greg, see below. On Thu, 2015-12-03 at 13:25 -0800, Gregory Farnum wrote: > On Thu, Dec 3, 2015 at 12:13 PM, Martin Millnert wrote: > > Hi, > > > > we're deploying Ceph on Linux for multiple purposes. > > We want to build network isolation in our L3 DC network

Re: OSD public / cluster network isolation using VRF:s

2015-12-07 Thread Martin Millnert
Wido, thanks for your feedback. On Thu, 2015-12-03 at 22:03 +0100, w...@42on.com wrote: > > > Op 3 dec. 2015 om 21:14 heeft Martin Millnert het > > volgende geschreven: > > > > Hi, > > > > we're deploying Ceph on Linux for multiple purposes. >

OSD public / cluster network isolation using VRF:s

2015-12-03 Thread Martin Millnert
nd test it too. But before doing that, I'm interested in feedback. Would obviously prefer it to be merged. Regards, Martin Millnert [1] https://lwn.net/Articles/632522/ [2] https://www.kernel.org/doc/Documentation/networking/vrf.txt -- To unsubscribe from this list: send the line "un

Infernalis uninstallable - jenkins virtualenv misconfiguration?

2015-11-06 Thread Martin Millnert
86_64.rpm /bin/bash /bin/sh /bin/sh /bin/sh /bin/sh /bin/sh /usr/bin/env /usr/bin/python [snip] Seems virtualenv on the jenkins build host is affecting some python path/env variable in the spec file somehow. Haven't dug further. Regards, -- Martin Millnert -- To unsubscribe from this

Re: civetweb upstream/downstream divergence

2015-11-04 Thread Martin Millnert
On Wed, 2015-11-04 at 16:43 -0700, Ken Dreyer wrote: > When I was talking about a "parallel effort", what I meant is that > we'd get vanilla civetweb upstream into the distros, and we'd also > continue to bundle civetweb in Ceph, until we can reliably use the > upstream Civetweb package. That's wh

Re: civetweb upstream/downstream divergence

2015-11-02 Thread Martin Millnert
On Fri, 2015-10-30 at 15:38 -0600, Ken Dreyer wrote: > On Thu, Oct 29, 2015 at 10:57 PM, Pete Zaitcev wrote: > > Dunno about SuSE, but as a Fedora packager I would prefer if we (Ceph) > > talked upstream into making regular releases and then for us to stop > > carrying it entirely. One less git su

Re: [ceph-users] who is using radosgw with civetweb?

2015-11-02 Thread Martin Millnert
Hi devs, it seems the below fell between chairs or similar: On Thu, 2015-02-26 at 19:43 +0100, Wido den Hollander wrote: > >> It seems like Civetweb listens on 0.0.0.0 by default and that doesn't seem > >> safe to me. > I'd just suggest to bind on localhost by default and let the user choose > o

Re: newstore direction

2015-10-21 Thread Martin Millnert
Adding 2c On Wed, 2015-10-21 at 14:37 -0500, Mark Nelson wrote: > My thought is that there is some inflection point where the userland > kvstore/block approach is going to be less work, for everyone I think, > than trying to quickly discover, understand, fix, and push upstream > patches that so

Re: newstore direction

2015-10-20 Thread Martin Millnert
Adding to this, On Tue, 2015-10-20 at 05:34 -0700, Sage Weil wrote: > On Mon, 19 Oct 2015, James (Fei) Liu-SSI wrote: > > Hi Sage and Somnath, > > In my humble opinion, There is another more aggressive solution than > > raw block device base keyvalue store as backend for objectstore. The new >