[Gluster-users] Fwd: Very slow writes through Samba mount to Gluster with crypt on

Jeff Byers jbyers.sfly at gmail.com
Sat Jan 7 02:54:33 UTC 2017

Jeff Darcy,

So the GlusterFS "encryption-at-rest" feature is unsupported,
"use at your own risk", "deprecated", how would we know?

I'm not sure about the GlusterFS 'encryption-at-rest' feature
being only in the source tree, as it is compiled in GlusterFS
3.7.18 with the crypt volume options being documented in
"gluster volume help set".

There is no indication of "use at your own risk" or
"unsupported", or "deprecated" status anywhere that I could
find. There is no mention of this feature status in the on-
line help, nor any mention in the feature doc at:

    glusterfs-specs/Disk Encryption.md at master · GitHub

which anyone wanting to use the feature would need to read.

There are a number of relatively recent bug reports, so people
do seem to be using the feature:

    Bug 1368455 – memory-leak in crypt xlator glusterfs 3.7.14

    Bug 1376858 – crypt xlator should use linker and compile options
from pkg-config instaed of "-lssl -lcrypo"

    Bug 1301804 – Failure to read files from NAS volume snapshots if
volume is encrypted.

    Bug 1065639 – Crash in nfs with encryption enabled

    Bug 1298520 – tests : Modifying tests for crypt xlator

    Bug 1065634 – Enabling compression and encryption translators on
the same volume causes data corruption

However, it does seem that these are not really being
worked on, bug 1368455 being a serious problem, and is
confirmed to still exist in 3.7.18.

Should we assume that nobody should be creating any new
GlusterFS volumes using the encryption-at-rest feature?

There is no easy migration from GlusterFS volume encryption to
non- encryption. It would basically need to be: block volume
users access, backup volume, verify backup, delete volume, re-
create volume, restore volume, and allow users access. :-(

What is the recommended alternative to GlusterFS "encryption-
at-rest"? This is an important capability for some

Jeff, Whit, thanks for bringing this up, and mentioning the
more or less "abandoned" status of the GlusterFS "encryption-
at-rest" feature; otherwise even more people would be using it
than already are.

~ Jeff Byers ~

More information about the Gluster-users mailing list