Data Security and Storage Hardening in Rook and Ceph
summary
Rook deploys Ceph on Kubernetes and claims hardening becomes a YAML switch; the talk shows concrete options: 6.5 exabytes of deployed Ceph, FIPS 140-2 cipher support, Messenger 2.1 for in‑flight Ceph protocol encryption, and CSI + Vault/AWS KMS integration for per-volume keys and key rotation. It demonstrates encrypt‑at‑rest with dm‑crypt, placing monitors separate from OSDs, RGW versioning and the thres_bin for deleted RBDs, and secure sanitization by forget the key rather than overwriting media.
AI-written summary · about
chapters (14)
- 0:00Data security in Rook and Ceph
- 3:56Ceph scale and architecture
- 6:03Threat models for storage security
- 8:32Security zones in Ceph
- 10:41Ceph product security at IBM and Red Hat
- 14:35IBM’s Ceph secure development lifecycle
- 17:01Encryption and key management in Ceph
- 19:09Rook security features
- 20:52Identity and access management in Ceph
- 22:15Auditing and retention in Ceph
- 24:07Secure deletion and sanitization
- 25:59OS hardening for Ceph
- 27:30Kubernetes and Ceph security resources
- 29:01Q&A on vulnerability management
related talks
18mData Security and Storage Hardening in Rook and Ceph
36mCeph Security BoF
30mData Security: Theoretical and Real World Approache...
27mEncrypting Data in Ceph: An Overview and Opportunities
24mSecurity Process Improvements in Ceph and Rook
39mCeph in Scientific Computing and Large Clusters BoF
33mBringing fscrypt Encryption to CephFS Userspace
29mRotating Heads and CephX Keys