3 ms·

I heard a rumor that ZFS native encryption is somewhat abandoned by its maintainer following it having landed in the release, that it was one person and they mo

by sneak 3y ago

I heard a rumor that ZFS native encryption is somewhat abandoned by its maintainer following it having landed in the release, that it was one person and they moved on/lost interest. I don’t know if this is true or not. I’m still using ZFS on LUKS2 for now, given the issues like this. (You also can’t specify multiple keys in ZFS native encryption.)

xoa 3y ago
Sadly there have seemed to be a number of rough edges that have stuck around with ZFS native encryption, which is unfortunate given that the cross platform and remote replication advantages are fundamentally very compelling. Honestly it's kind of curious that polishing that experience hasn't been more of a priority, for commercial interests like iXsystems if no one else. Speaking of which, for people running their ZFS off a NAS the idea of just being able to offload all the encryption and FS computation to that is a compelling part of the value equation beyond sheer storage in principle too. Though that in turn (if one does it with iSCSI) runs into another seemingly neglected area of ZFS (zvols). Nothing is perfect.
- zrav 3y ago
  What makes you say zvols are neglected? In fact the people that did most of the work porting ZFS to Linux, i.e. LLNL, use zvols for their HPC cluster and they still employ a number developers and the primary maintainer of ZoL. I also remember a quote from them stating that zvols were in fact more mature than vfs.
  - Xorlev 3y ago
    https://github.com/openzfs/zfs/issues/7631 https://github.com/openzfs/zfs/issues/7631 This is a long-standing issue with zvols which affects overall system stability, and has no real solution as of yet.
justinclift 3y ago
ZFS on top of LUKS seems to have it's own issues though. :( https://github.com/openzfs/zfs/issues/15533 https://github.com/openzfs/zfs/issues/15533
- PaulCarrack 3y ago
  Since LUKS is exposed as block device like a hard drive, it's really no different than saying that they are just having issues with certain kind of hard drives. There is a PR out for this: https://github.com/openzfs/zfs/pull/15588 https://github.com/openzfs/zfs/pull/15588
zrav 3y ago
See this discussion about the state of native encryption and the linked list of open bugs: https://discourse.practicalzfs.com/t/is-native-encryption-ready-for-production-use/532 https://discourse.practicalzfs.com/t/is-native-encryption-re...
wb14123 3y ago
More details on this discussion: https://github.com/openzfs/zfs/issues/6824#issuecomment-1817372085 https://github.com/openzfs/zfs/issues/6824#issuecomment-1817... . Basically he is too busy to continue developing the encryption features but is able to review the related works. There is also discussion about using ZFS on LUKS in the same thread: https://github.com/openzfs/zfs/issues/6824#issuecomment-1819474767 https://github.com/openzfs/zfs/issues/6824#issuecomment-1819...

by sneak 3y ago

xoa 3y ago

Sadly there have seemed to be a number of rough edges that have stuck around with ZFS native encryption, which is unfortunate given that the cross platform and remote replication advantages are fundamentally very compelling. Honestly it's kind of curious that polishing that experience hasn't been more of a priority, for commercial interests like iXsystems if no one else. Speaking of which, for people running their ZFS off a NAS the idea of just being able to offload all the encryption and FS computation to that is a compelling part of the value equation beyond sheer storage in principle too. Though that in turn (if one does it with iSCSI) runs into another seemingly neglected area of ZFS (zvols). Nothing is perfect.

zrav 3y ago
What makes you say zvols are neglected? In fact the people that did most of the work porting ZFS to Linux, i.e. LLNL, use zvols for their HPC cluster and they still employ a number developers and the primary maintainer of ZoL. I also remember a quote from them stating that zvols were in fact more mature than vfs.
- Xorlev 3y ago
  https://github.com/openzfs/zfs/issues/7631 https://github.com/openzfs/zfs/issues/7631 This is a long-standing issue with zvols which affects overall system stability, and has no real solution as of yet.

justinclift 3y ago

ZFS on top of LUKS seems to have it's own issues though. :( https://github.com/openzfs/zfs/issues/15533 https://github.com/openzfs/zfs/issues/15533

PaulCarrack 3y ago
Since LUKS is exposed as block device like a hard drive, it's really no different than saying that they are just having issues with certain kind of hard drives. There is a PR out for this: https://github.com/openzfs/zfs/pull/15588 https://github.com/openzfs/zfs/pull/15588

zrav 3y ago

See this discussion about the state of native encryption and the linked list of open bugs: https://discourse.practicalzfs.com/t/is-native-encryption-ready-for-production-use/532 https://discourse.practicalzfs.com/t/is-native-encryption-re...

wb14123 3y ago

More details on this discussion: https://github.com/openzfs/zfs/issues/6824#issuecomment-1817372085 https://github.com/openzfs/zfs/issues/6824#issuecomment-1817... . Basically he is too busy to continue developing the encryption features but is able to review the related works. There is also discussion about using ZFS on LUKS in the same thread: https://github.com/openzfs/zfs/issues/6824#issuecomment-1819474767 https://github.com/openzfs/zfs/issues/6824#issuecomment-1819...