2.6. Object Storage

The following section briefly describes the new features included in the Object Storage service for Red Hat OpenStack Platform 8.

Encryption At Rest

To protect the data in the clusters, Object Storage operators need to have objects stored in an encrypted form. This release adds an operator-managed encryption capability to Object Storage service while remaining completely transparent to clients.

There are two steps to at-rest encryption. The first part is the crypto engine which performs the actual encryption and decryption of the data and metadata.

The second part is key management. This is the process by which the key material is stored, retrieved and supplied to the crypto engine. The process is split with an agent responsible for storing key material safely and an agent responsible for retrieving key material for the crypto engine. Object Storage supports a variety of key-material retrievers, called “keymasters”, via Python’s entry-points mechanism. Typically, an Object Storage cluster will use only one keymaster.

New Ring tools: ring-builder-analyzer and swift-ring-tool

The rings determine where data should reside in the cluster. There is a separate ring for account databases, container databases, and individual objects but each ring works in the same way. These rings are externally managed, in that the server processes themselves do not modify the rings, they are instead given new rings modified by other tools.

Ring Builder Analyzer is a tool for analyzing how well the ring builder performs its job in a particular scenario.

The ring builder analyzer takes a scenario file containing some initial parameters for a ring builder plus a certain number of rounds. In each round, some modifications are made to the builder, e.g. add a device, remove a device, change a device’s weight. Then, the builder is repeatedly rebalanced until it settles down. Data about that round is printed, and the next round begins.

swift-ring-tool is a tool to increase or decrease the partition power of an Object Storage ring without the need to copy all data to a new cluster. Migrating data from a cluster requires a second cluster with at least the size of the origin, which might not be applicable.

The partition power for a Object Storage cluster has to be chosen carefully. Choosing a high value for a small cluster increases replication time significantly; however a low number limits the maximum size of a cluster. This tool makes it possible to increase or decrease the partition power; however a short downtime is required because files need to be renamed on the storage nodes.