Object WORM Feature in Ceph Rados Gateway
summary
Ceph radosgw gains S3-compatible WORM via an Object Lock implementation that China Mobile contributes: a prototype adds six new APIs to set bucket defaults and per-object retention and legal holds, auto-enables versioning for buckets created with object lock, and stores retention metadata in rgw object attributes (rgw.object_retention). Retention has time-based and legal-hold modes, retention periods can be extended but not shortened, and the feature is implemented and working though test coverage and policy handling still need finishing.
AI-written summary · about
chapters (14)
- 0:00Introduction to speaker
- 0:20What is WORM storage
- 1:50Types of WORM storage
- 2:34Why WORM is needed
- 3:15WORM in S3 Object Lock
- 4:25Configuring bucket Object Lock
- 5:30Retention and legal hold
- 7:20Governance vs compliance mode
- 8:41Legal hold protection
- 10:13S3 API additions for Object Lock
- 11:19Object Lock configurations
- 12:06Enabling Object Lock in RGW
- 13:31Retention expiration tracking
- 13:51Future work and Q&A
related talks
18mData Security and Storage Hardening in Rook and Ceph
27mEncrypting Data in Ceph: An Overview and Opportunities
35mData Security and Storage Hardening in Rook and Ceph
41mLet Your Cloud Native Storage Save You from Ransomware!
36mCeph Security BoF
30mData Security: Theoretical and Real World Approache...
38mProtecting the Data Lake
29mSecuring Data in Motion and at Rest: Quantifying End-to-End Encryption Perfo...