Ceph Security BoF
summary
Ceph and Rook now integrate IBM’s PSIRT and toolchain and claim stricter release security while preserving upstream compatibility; deployable encryption options include cluster-level OSD at-rest encryption with external KMS (Vault, Barbican, KMIP) or self‑managed keys (avoid storing keys on the same three-node setup), messenger‑level TLS for in‑flight encryption (with measurable performance cost), RGW HTTPS or HAProxy termination, FIPS-capable builds, firewall service files for ports 6800–7300, and Rook/CSI support for PV-level KMS encryption.
AI-written summary · about
chapters (13)
- 0:00Introduction and background
- 4:15Threat models in storage
- 7:51IBM security lifecycle for Ceph
- 13:34Encryption and key management
- 18:13In-transit encryption options
- 22:54Network hygiene and firewalls
- 24:18Deployment tools and SSH security
- 26:26Management dashboard security
- 28:55Rook-specific security features
- 31:05Persistent volume encryption
- 32:07Performance vs security trade-offs
- 33:10Client authentication and admin keys
- 34:13Audit mechanisms and best practices
related talks
35mData Security and Storage Hardening in Rook and Ceph
18mData Security and Storage Hardening in Rook and Ceph
30mData Security: Theoretical and Real World Approache...
24mSecurity Process Improvements in Ceph and Rook
27mEncrypting Data in Ceph: An Overview and Opportunities
29mRotating Heads and CephX Keys
33mBringing fscrypt Encryption to CephFS Userspace
29mSecuring Data in Motion and at Rest: Quantifying End-to-End Encryption Perfo...