Data Security and Storage Hardening in Rook and Ceph
summary
Explains concrete hardening steps for Rook + Ceph: map four network zones (cluster, storage access, public, client), enable Ceph protocol encryption (messenger v2.1) and TLS for RGW, and encrypt at rest with LUKS/dm-crypt plus per-volume KMS support via the CSI driver (work in progress). Calls out Vault, FIPS 140-2 ciphers, SELinux + seccomp/ASLR builds, warns that Kubernetes secrets are just base64, and recommends secure deletion by forget the key for encrypted OSDs.
AI-written summary · about
chapters (13)
- 0:00Intro
- 1:37Rook in brief
- 2:45Threat Model
- 3:37Network Security zones
- 5:57Connecting Security zones
- 7:12Encryption and Key Management
- 8:45Encryption in transit
- 10:42Rook specific
- 12:26Control Plane
- 13:05Identity and access
- 14:01Auditing
- 14:16Data retention
- 16:09Infrastructure hardening
related talks
35mData Security and Storage Hardening in Rook and Ceph
36mCeph Security BoF
30mRook: Intro and Ceph Deep Dive
26mRook: Intro And Deep Dive With Ceph Storage
30mRook: Intro and Ceph Deep Dive
31mRook: Intro and Deep Dive With Ceph
26mRook: Intro and Deep Dive with Ce...
07mRook: Enterprise Storage for Kubernetes