Hi guys,
Can HekaFS be configured for Infiniband use, without the need to use IP (ie IP-over-Infiniband) which has less performance?
Just asking because Gluster can use Infiniband natively (last I checked anyway), and we have Infiniband test gear in the lab that can be used. :)
Regards and best wishes,
Justin Clift
-- Aeolus Community Manager http://www.aeolusproject.org
On 10/20/2011 08:04 AM, Justin Clift wrote:
Can HekaFS be configured for Infiniband use, without the need to use IP (ie IP-over-Infiniband) which has less performance?
Mostly the answer is yes, but there are two caveats.
(1) The SSL feature is implemented as part of the socket transport, so is not applicable to RDMA. This also precludes using both transports at once, because it would be bad to have asymmetric authentication.
(2) RDMA is not always the earliest or most thoroughly tested part of GlusterFS, and has been a bit prone to breakage with each major release. Maybe this will change now that more testing resources are available.
On 20/10/2011, at 11:50 PM, Jeff Darcy wrote:
On 10/20/2011 08:04 AM, Justin Clift wrote:
Can HekaFS be configured for Infiniband use, without the need to use IP (ie IP-over-Infiniband) which has less performance?
Mostly the answer is yes, but there are two caveats.
(1) The SSL feature is implemented as part of the socket transport, so is not applicable to RDMA. This also precludes using both transports at once, because it would be bad to have asymmetric authentication.
Thanks Jeff. Kund of thinking this SSL-not-available-for-that is probably a non issue. Haven't ever heard of people sniffing Infiniband RDMA before, though it's probably possible with some even more exotic gear. (switch level port mirroring maybe?)
(2) RDMA is not always the earliest or most thoroughly tested part of GlusterFS, and has been a bit prone to breakage with each major release. Maybe this will change now that more testing resources are available.
Interesting. Might not bother setting up the Infiniband stuff just yet then.
Will see how we go. :)
Regards and best wishes,
Justin Clift
-- Aeolus Community Manager http://www.aeolusproject.org
On 10/20/2011 08:56 AM, Justin Clift wrote:
(1) The SSL feature is implemented as part of the socket transport, so is not applicable to RDMA. This also precludes using both transports at once, because it would be bad to have asymmetric authentication.
Thanks Jeff. Kund of thinking this SSL-not-available-for-that is probably a non issue. Haven't ever heard of people sniffing Infiniband RDMA before, though it's probably possible with some even more exotic gear. (switch level port mirroring maybe?)
As you point out, being able to see the traffic might not be a problem. The bigger problem is at the endpoints, because we rely on SSL for authentication as well as encryption. As a result, there would be little point to using SSL on the socket transport if an attacker could trivially spoof an identity by using RDMA (including RoCE) instead.
cloudfs-devel@lists.fedorahosted.org