7:04 a.m.
Hi guys,
Can HekaFS be configured for Infiniband use, without the need to use IP (ie
IP-over-Infiniband) which has less performance?
Just asking because Gluster can use Infiniband natively (last I checked anyway), and we
have Infiniband test gear in the lab that can be used. :)
Regards and best wishes,
Justin Clift
--
Aeolus Community Manager
http://www.aeolusproject.org
7:50 a.m.
On 10/20/2011 08:04 AM, Justin Clift wrote:
Can HekaFS be configured for Infiniband use, without the need to use
IP (ie
IP-over-Infiniband) which has less performance?
Mostly the answer is yes, but there are two caveats.
(1) The SSL feature is implemented as part of the socket transport, so is not
applicable to RDMA. This also precludes using both transports at once, because
it would be bad to have asymmetric authentication.
(2) RDMA is not always the earliest or most thoroughly tested part of
GlusterFS, and has been a bit prone to breakage with each major release. Maybe
this will change now that more testing resources are available.
7:56 a.m.
On 20/10/2011, at 11:50 PM, Jeff Darcy wrote:
On 10/20/2011 08:04 AM, Justin Clift wrote:
> Can HekaFS be configured for Infiniband use, without the need to use IP (ie
> IP-over-Infiniband) which has less performance?
Mostly the answer is yes, but there are two caveats.
(1) The SSL feature is implemented as part of the socket transport, so is not
applicable to RDMA. This also precludes using both transports at once, because
it would be bad to have asymmetric authentication.
Thanks Jeff. Kund of thinking this SSL-not-available-for-that is probably a
non issue. Haven't ever heard of people sniffing Infiniband RDMA before, though
it's probably possible with some even more exotic gear. (switch level port
mirroring maybe?)
(2) RDMA is not always the earliest or most thoroughly tested part
of
GlusterFS, and has been a bit prone to breakage with each major release. Maybe
this will change now that more testing resources are available.
Interesting. Might not bother setting up the Infiniband stuff just yet then.
Will see how we go. :)
Regards and best wishes,
Justin Clift
--
Aeolus Community Manager
http://www.aeolusproject.org
8:08 a.m.
On 10/20/2011 08:56 AM, Justin Clift wrote:
> (1) The SSL feature is implemented as part of the socket
transport, so is not
> applicable to RDMA. This also precludes using both transports at once, because
> it would be bad to have asymmetric authentication.
Thanks Jeff. Kund of thinking this SSL-not-available-for-that is probably a
non issue. Haven't ever heard of people sniffing Infiniband RDMA before, though
it's probably possible with some even more exotic gear. (switch level port
mirroring maybe?)
As you point out, being able to see the traffic might not be a problem. The
bigger problem is at the endpoints, because we rely on SSL for authentication
as well as encryption. As a result, there would be little point to using SSL
on the socket transport if an attacker could trivially spoof an identity by
using RDMA (including RoCE) instead.
4599
days inactive
4599
days old
cloudfs-devel@lists.fedorahosted.org
3 comments
2 participants
participants (2)
-
Jeff Darcy -
Justin Clift