SES6: Explain how user can verify that OSDs really are encrypted about doc-ses HOT 11 CLOSED

That's a really good writeup @smithfarm

from doc-ses.

@asettle I really don't know what is best. Maybe put it in troubleshooting and link to it from "all of the above" places?

from doc-ses.

And, I might suggest to round out the treatise on OSD encryption with a statement like this:

"Since decrypting the data on an encrypted OSD disk requires knowledge of the corresponding dm-crypt secret key, OSD encryption provides protection for cases when a disk drive that was used as an OSD is decommissioned, lost, or stolen."

from doc-ses.

Potential reviewers:

• @ddiss
• @jan--f
• @tserong

from doc-ses.

@smithfarm is this complete as it is? :) There isn't exactly an obvious location of where to include this straight up, your options are (in order of what I think is best first):

1. https://documentation.suse.com/ses/6/single-html/ses-admin/#part-troubleshooting
2. https://documentation.suse.com/ses/6/single-html/ses-admin/#ceph-monitor
3. https://documentation.suse.com/ses/6/single-html/ses-admin/#storage-salt-cluster

Let me know what you think

from doc-ses.

@asettle It's not clear where to put it, and I see that as part of the problem. A user wanting to deploy encrypted OSDs will probably search the docs for the term "encrypted". I did that, and the only place in the documentation that seems to (kinda sorta) describe how to deploy them is

https://documentation.suse.com/ses/6/single-html/ses-deployment/#ds-drive-groups-specs

Would it make sense to make a dedicated section on deploying encrypted OSDs?

from doc-ses.

@smithfarm 🤔 You're very right, that's exactly what I did too to check we didn't have anything. My thoughts are that the new "Encrypted OSDs" section definitely has its own title, just where in the guides - that's why I provided those 3 options. I actually think the best place is the troubleshooting section, which can then be put into the new troubleshooting guide for SES 7 where we have a whole section for OSDs: https://susedoc.github.io/doc-ses/master/html/ses-tips-troubleshooting/bp-troubleshooting-osds.html

Thoughts?

from doc-ses.

@asettle Granted that folks will be grepping for it, I guess it doesn't matter much, but if you're asking me, "Troubleshooting" is not where I'd put a discussion of how to deploy encrypted OSDs. If there is a section on OSD deployment, that's where it would belong I guess.

How about putting this little ditty in the Troubleshooting chapter and link to it from the OSD deployment section?

from doc-ses.

@smithfarm
As you've pointed out before, this is all we appear to have for deploying OSDs: https://documentation.suse.com/ses/6/single-html/ses-deployment/#ds-drive-groups
Any of our actual add or remove docs is in the admin guide here: https://documentation.suse.com/ses/6/single-html/ses-admin/#storage-salt-cluster

So, I'm happy to put it in either location. Also happy to put it in the troubleshooting section, and link it to that last statement in the ds-drive-groups section

from doc-ses.

Nice write-up @smithfarm! 👍

from doc-ses.

@smithfarm
As you've pointed out before, this is all we appear to have for deploying OSDs: https://documentation.suse.com/ses/6/single-html/ses-deployment/#ds-drive-groups
Any of our actual add or remove docs is in the admin guide here: https://documentation.suse.com/ses/6/single-html/ses-admin/#storage-salt-cluster

So, I'm happy to put it in either location. Also happy to put it in the troubleshooting section, and link it to that last statement in the ds-drive-groups section

@smithfarm ping :) just checking in

from doc-ses.