cephx_secret': prepare_utils.create_key()} cephx_lockbox_secret = '' encrypted = 1 if args.dmcrypt '] = encryption_utils.create_dmcrypt_key() secrets['cephx_lockbox_secret'] = cephx_lockbox_secret bluestore OSD to activate') is_encrypted = osd_lv.tags.get('ceph.encrypted', '0') == '1' #是否加密 dmcrypt_secret = encryption_utils.get_dmcrypt_key(osd_id, osd_fsid) encryption_utils.luks_open(dmcrypt_secret =dmcrypt_secret) wal_device_path = get_osd_device_path(osd_lv, lvs, 'wal', dmcrypt_secret=dmcrypt_secret
db_device_path = get_osd_device_path(osd_lv, lvs, 'db', dmcrypt_secret=dmcrypt_secret) wal_device_path = get_osd_device_path(osd_lv, lvs, 'wal', dmcrypt_secret=dmcrypt_secret) #获取最终存储设备路径 def get_osd_device_path (osd_lv, lvs, device_type, dmcrypt_secret=None): """ ``device_type`` can be one of ``db``, `` lv_uuid=device_uuid) if device_lv: if is_encrypted: encryption_utils.luks_open(dmcrypt_secret disk.get_device_from_partuuid(device_uuid) if physical_device and is_encrypted: encryption_utils.luks_open(dmcrypt_secret
[--crush-device-class CRUSH_DEVICE_CLASS] [--dmcrypt crush-device-class CRUSH_DEVICE_CLASS Crush device class to assign this OSD to --dmcrypt
procmail /usr/bin/find /usr/sbin/exim4 /usr/lib/pt_chown /usr/lib/openssh/ssh-keysign /usr/lib/eject/dmcrypt-get-device
procmail /usr/bin/find /usr/sbin/exim4 /usr/lib/pt_chown /usr/lib/openssh/ssh-keysign /usr/lib/eject/dmcrypt-get-device
usr/bin/chsh /usr/lib/openssh/ssh-keysign /usr/lib/dbus-1.0/dbus-daemon-launch-helper /usr/lib/eject/dmcrypt-get-device
procmail /usr/bin/find /usr/sbin/exim4 /usr/lib/pt_chown /usr/lib/openssh/ssh-keysign /usr/lib/eject/dmcrypt-get-device
[('node0', '/var/local/osd0', None), ('node1', '/var/local/osd1', None)] [ceph_deploy.cli][INFO ] dmcrypt True [ceph_deploy.cli][INFO ] subcommand : prepare [ceph_deploy.cli][INFO ] dmcrypt_key_dir : /etc/ceph/dmcrypt-keys [ceph_deploy.cli][INFO ] quiet : False
are also encrypted with the same OSD key 通过使用ceph-volume命令,在创建OSD的时候启动磁盘级的加密 ceph-volume lvm create --dmcrypt
bin/gpasswd /usr/bin/chfn /usr/bin/sudo /usr/bin/chsh /usr/bin/newgrp /usr/bin/passwd /usr/lib/eject/dmcrypt-get-device
bin/gpasswd /usr/bin/chfn /usr/bin/sudo /usr/bin/chsh /usr/bin/newgrp /usr/bin/passwd /usr/lib/eject/dmcrypt-get-device
procmail /usr/bin/find /usr/sbin/exim4 /usr/lib/pt_chown /usr/lib/openssh/ssh-keysign /usr/lib/eject/dmcrypt-get-device
/bin/passwd /usr/lib/openssh/ssh-keysign /usr/lib/dbus-1.0/dbus-daemon-launch-helper /usr/lib/eject/dmcrypt-get-device
/ssh-keysign /usr/lib/dbus-1.0/dbus-daemon-launch-helper /usr/lib/snapd/snap-confine /usr/lib/eject/dmcrypt-get-device
/usr/bin/find # /usr/sbin/exim4 # /usr/lib/pt_chown # /usr/lib/openssh/ssh-keysign # /usr/lib/eject/dmcrypt-get-device
bin/passwd /usr/bin/sudo /usr/bin/newgrp /usr/sbin/exim4 /usr/lib/openssh/ssh-keysign /usr/lib/eject/dmcrypt-get-device
dmcrypt.png 具体细节简要分析: 对于文件系统的写请求,dm-crypt并不会立即处理,而是将其转成加密的任务请求放入一个名为kcryptd的内核工作队列中,以便在以后方便的时候进行。
None), ('idcv-ceph2', '/dev/sdb', None), ('idcv-ceph3', '/dev/sdb', None)] [ceph_deploy.cli][INFO ] dmcrypt True [ceph_deploy.cli][INFO ] subcommand : prepare [ceph_deploy.cli][INFO ] dmcrypt_key_dir : /etc/ceph/dmcrypt-keys [ceph_deploy.cli][INFO ] quiet : False
does not support ID_PART_ENTRY_* fields, trying sgdisk; may not correctly identify ceph volumes with dmcrypt
当前Tina dm-crypt 分区的初始化、挂载与卸载借助package/security/dm-crypt/dmcrypt.sh 脚本来实现。该脚本默认将映射后的分区格式化为ext4。