On 06/17/2015 06:16 AM, Sage Weil wrote: >>> The wiki logins are broken, but ignore that.. we're moving to >>> tracker.ceph.com's wiki shortly anyway. Email is best in the meantime! >> >> This proposal seems not have to have it to the new wiki. Is it still >> alive? What do we need to do to keep this moving? I am not able to even login to wiki, seems logins are still completely broken. Probably nobody can edit it now? > I can create a placeholder session. Can you two hash out a proposal over > the next week or so to discuss? I think there are some tricky questions > if petera is used if we want it to integrate with the monitors as well > (e.g., leverage the monitors for updating/distributing the petera > certs/keys). Yes, but later please. We have a lot of fun with selinux and other things, this feature could follow later. BTW Petera is now renamed to Deo (and should be in Fedora packaged already). The idea was: - use LUKS as the encryption format - use Deo to map OSD, for more info see https://github.com/npmccallum/deo In short, Deo will connect to MON node and negotiate key and directly unlock LUKS device. (New version now uses libcryptsetup direcly, so it is really one client binary.) There must be a service listening on MONs nodes (Deo server). I have no idea yet how problematic will be handling certificates here, but because it ensures authentication and encrypts communication, it seems like a nice design. Anyway, delegating this task to one simple tool (maintained independently of Ceph) is IMHO a good idea and the whole integration should not be complicated. (Moreover it will allow easy integration with FreeIPA and similar tools later.) Milan -- To unsubscribe from this list: send the line "unsubscribe ceph-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
