-
Notifications
You must be signed in to change notification settings - Fork 1.4k
RBD Encryption Support #2039
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
RBD Encryption Support #2039
Conversation
sitsofe
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
- I'm fine with your choice not to auto-format the image (but I'm not benchmarking Ceph so perhaps I'm not the target audience)
- Please squash these commits into one - this can be seen as being atomic and can go in all in one go
- You may want to move some of the PR info into the commit message
ffb7ad2 to
870d6cf
Compare
|
Cool all tests passed. |
|
@Greenpepper15 Just that minor nit, if you fix it up and amend the commit and force push it, I can pick it up. Rest looks fine to me. |
Currently, the rbd engine can only attach to unencrypted images. This prevents users from benchmarking the performance impact of librbd's client-side encryption features. This patch adds two new options, 'rbd_encryption_format' and 'rbd_encryption_passphrase', allowing fio to perform encryption/decryption IO with librbd before starting I/O. Signed-off-by: David Mohren <[email protected]>
870d6cf to
067ffa4
Compare
|
Pulled with a fixup added on top, github doesn't really render things properly and you had various cases of trailing whitespace or incorrect usage of tabs vs spaces. |
|
Thanks for the merge! |
Summary
This PR adds support for testing Ceph
librbdclient-side encryption (AES-XTS) by allowing fio to load LUKS keys for an existing image with librbd. After the loading operation any IO to the rbd image will be encrypted/decrypted.See the Ceph documentation for this feature: https://docs.ceph.com/en/reef/rbd/rbd-encryption/
Motivation
librbdhas supported encryption/decryption since Ceph Pacific (16.2.z). However, the fio rbd engine currently lacks the hooks to load encryption context. This prevents users from benchmarking the crypto overhead of this librbd feature.Implementation Details
configureconfiguration to detect if the linkedlibrbdsupportsrbd_encryption_load.rbd_encryption_format: (luks1, luks2)rbd_encryption_passphrase: The key/passphrase to unlock the image.rbd_encryption_load()during the connection phase to load encryption context.Notes on Design
rbd_encryption_format. It is assumed the user has already provisioned and formatted the image using the Ceph CLI (rbd encryption format ...). This avoids accidental data destruction or re-formatting overhead during benchmark runtime.CONFIG_RBD_ENCRYPTION. If fio is built against an older Ceph version (pre-Pacific), the options are unavailable, and the engine behaves as before.Example Job File
And please review the documentation I wrote. I am unsure if the phrasing and syntax I used is consistent with the rest of the documentation.