libcephfs_proxy: implement support for fscrypt by xhernandez · Pull Request #64743 · ceph/ceph

xhernandez · 2025-07-29T15:31:49Z

Depends on #61137

Contribution Guidelines

To sign and title your commits, please refer to Submitting Patches to Ceph.
If you are submitting a fix for a stable branch (e.g. "quincy"), please refer to Submitting Patches to Ceph - Backports for the proper workflow.
When filling out the below checklist, you may click boxes directly in the GitHub web UI. When entering or editing the entire PR message in the GitHub web UI editor, you may also select a checklist item by adding an x between the brackets: [x]. Spaces and capitalization matter when checking off items this way.

Checklist

Tracker (select at least one)
- References tracker ticket
- Very recent bug; references commit where it was introduced
- New feature (ticket optional)
- Doc update (no ticket needed)
- Code cleanup (no ticket needed)
Component impact
- Affects Dashboard, opened tracker ticket
- Affects Orchestrator, opened tracker ticket
- No impact that needs to be tracked
Documentation (select at least one)
- Updates relevant documentation
- No doc update is appropriate
Tests (select at least one)
- Includes unit test(s)
- Includes integration test(s)
- Includes bug reproducer
- No tests

Show available Jenkins commands

jenkins test classic perf Jenkins Job | Jenkins Job Definition
jenkins test crimson perf Jenkins Job | Jenkins Job Definition
jenkins test signed Jenkins Job | Jenkins Job Definition
jenkins test make check Jenkins Job | Jenkins Job Definition
jenkins test make check arm64 Jenkins Job | Jenkins Job Definition
jenkins test submodules Jenkins Job | Jenkins Job Definition
jenkins test dashboard Jenkins Job | Jenkins Job Definition
jenkins test dashboard cephadm Jenkins Job | Jenkins Job Definition
jenkins test api Jenkins Job | Jenkins Job Definition
jenkins test docs ReadTheDocs | Github Workflow Definition
jenkins test ceph-volume all Jenkins Jobs | Jenkins Jobs Definition
jenkins test windows Jenkins Job | Jenkins Job Definition
jenkins test rook e2e Jenkins Job | Jenkins Job Definition

github-actions · 2025-07-29T16:01:42Z

This pull request can no longer be automatically merged: a rebase is needed and changes have to be manually resolved

bluikko · 2025-08-01T06:22:26Z

doc/cephfs/fs-volumes.rst


   ceph fs subvolume earmark rm <vol_name> <subvol_name> [--group_name <subvol_group_name>]

+Getting enctag of a subvolume


Should there be some article here?

Suggested change

Getting enctag of a subvolume

Getting the enctag of a subvolume

bluikko · 2025-08-01T06:23:15Z

doc/cephfs/fs-volumes.rst

+
+   ceph fs subvolume enctag get <vol_name> <subvol_name> [--group_name <subvol_group_name>]
+
+Setting enctag of a subvolume


ditto

Suggested change

Setting enctag of a subvolume

Setting the enctag of a subvolume

bluikko · 2025-08-01T06:23:28Z

doc/cephfs/fs-volumes.rst

+
+   ceph fs subvolume enctag set <vol_name> <subvol_name> [--group_name <subvol_group_name>] <enctag>
+
+Removing enctag of a subvolume


ditto

Suggested change

Removing enctag of a subvolume

Removing the enctag of a subvolume

bluikko · 2025-08-01T06:26:01Z

doc/cephfs/fs-volumes.rst

 .. note:: Setting ``--casesensitive=0`` option implicitly enables
   unicode normalization on the subvolume.

+A separate encryption tag is available for use with encryption. This is to be used tagging the subvolume, with


I'm not sure but I feel like this could use a "for" or something else and skip the comma, like:

Suggested change

A separate encryption tag is available for use with encryption. This is to be used tagging the subvolume, with

A separate encryption tag is available for use with encryption. This is to be used for tagging the subvolume with

github-actions · 2025-09-09T10:50:04Z

This pull request can no longer be automatically merged: a rebase is needed and changes have to be manually resolved

phlogistonjohn · 2025-09-11T16:05:36Z

jenkins test make check

github-actions · 2026-01-05T16:02:57Z

This pull request has been automatically marked as stale because it has not had any activity for 60 days. It will be closed if no further activity occurs for another 30 days.
If you are a maintainer or core committer, please follow-up on this pull request to identify what steps should be taken by the author to move this proposed change forward.
If you are the author of this pull request, thank you for your proposed contribution. If you believe this change is still appropriate, please ensure that any feedback has been addressed and ask for a code review.

ceph-jenkins · 2026-01-05T16:03:00Z

Can one of the admins verify this patch?

vshankar · 2026-01-05T16:10:43Z

@xhernandez - any reason this is still a draft version?

xhernandez · 2026-01-07T12:15:59Z

@xhernandez - any reason this is still a draft version?

Probably not, but I need to double check it. I'm on sick leave now. I expect to be back next week and I'll update this PR.

Signed-off-by: Xavi Hernandez <xhernandez@gmail.com>

xhernandez · 2026-01-14T10:26:43Z

jenkins test api

xhernandez · 2026-01-14T10:27:29Z

jenkins test dashboard cephadm

anoopcs9

lgtm.

anoopcs9 · 2026-01-21T04:24:43Z

jenkins test api

phlogistonjohn · 2026-01-22T15:57:14Z

I built a ceph image with this patch and the smb mgr module patches layered on that and deployed it on a test cluster.
I verified that I was able to access an encrypted subvolume with both the proxy disabled as well as enabled.

vshankar · 2026-02-09T12:45:36Z

jenkins test api

vshankar · 2026-02-09T12:46:00Z

jenkins test dashboard

github-actions bot added build/ops cephadm cephfs Ceph File System common config-change documentation mgr pybind tests needs-rebase labels Jul 29, 2025

bluikko reviewed Aug 1, 2025

View reviewed changes

xhernandez force-pushed the ll-fscrypt branch from 7604a60 to c93207a Compare August 29, 2025 06:31

github-actions bot removed the needs-rebase label Aug 29, 2025

github-actions bot added the needs-rebase label Sep 9, 2025

xhernandez force-pushed the ll-fscrypt branch 2 times, most recently from ad4d0f3 to 24b410a Compare September 18, 2025 10:40

rzarzynski requested review from gregsfortytwo and vshankar September 19, 2025 09:12

xhernandez force-pushed the ll-fscrypt branch from 24b410a to f8de627 Compare November 6, 2025 14:31

github-actions bot removed the needs-rebase label Nov 6, 2025

xhernandez force-pushed the ll-fscrypt branch from f8de627 to 51f5117 Compare November 6, 2025 14:45

github-actions bot added the stale label Jan 5, 2026

github-actions bot removed the stale label Jan 5, 2026

libcephfs_proxy: implement support for fscrypt

3fb179e

Signed-off-by: Xavi Hernandez <xhernandez@gmail.com>

xhernandez force-pushed the ll-fscrypt branch from 51f5117 to 3fb179e Compare January 13, 2026 17:33

xhernandez marked this pull request as ready for review January 13, 2026 17:34

xhernandez mentioned this pull request Jan 20, 2026

libcephfs_proxy: add support for nonblocking fsync request #65538

Merged

14 tasks

phlogistonjohn mentioned this pull request Jan 20, 2026

smb: add keybridge support and fscrypt configuration #64641

Open

14 tasks

anoopcs9 approved these changes Jan 21, 2026

View reviewed changes

phlogistonjohn added the wip-phlogistonjohn-testing-1 label Jan 21, 2026

phlogistonjohn approved these changes Jan 22, 2026

View reviewed changes

vshankar merged commit 6393ffa into ceph:main Feb 10, 2026
13 of 14 checks passed

xhernandez deleted the ll-fscrypt branch February 10, 2026 07:19


		ceph fs subvolume earmark rm <vol_name> <subvol_name> [--group_name <subvol_group_name>]

		Getting enctag of a subvolume

	Getting enctag of a subvolume
	Getting the enctag of a subvolume


		ceph fs subvolume enctag get <vol_name> <subvol_name> [--group_name <subvol_group_name>]

		Setting enctag of a subvolume

	Setting enctag of a subvolume
	Setting the enctag of a subvolume


		ceph fs subvolume enctag set <vol_name> <subvol_name> [--group_name <subvol_group_name>] <enctag>

		Removing enctag of a subvolume

	Removing enctag of a subvolume
	Removing the enctag of a subvolume

	A separate encryption tag is available for use with encryption. This is to be used tagging the subvolume, with
	A separate encryption tag is available for use with encryption. This is to be used for tagging the subvolume with

Conversation

xhernandez commented Jul 29, 2025

Contribution Guidelines

Checklist

Uh oh!

github-actions bot commented Jul 29, 2025

Uh oh!

bluikko Aug 1, 2025

Choose a reason for hiding this comment

Uh oh!

bluikko Aug 1, 2025

Choose a reason for hiding this comment

Uh oh!

bluikko Aug 1, 2025

Choose a reason for hiding this comment

Uh oh!

bluikko Aug 1, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Sep 9, 2025

Uh oh!

phlogistonjohn commented Sep 11, 2025

Uh oh!

github-actions bot commented Jan 5, 2026

Uh oh!

ceph-jenkins commented Jan 5, 2026

Uh oh!

vshankar commented Jan 5, 2026

Uh oh!

xhernandez commented Jan 7, 2026

Uh oh!

xhernandez commented Jan 14, 2026

Uh oh!

xhernandez commented Jan 14, 2026

Uh oh!

anoopcs9 left a comment

Choose a reason for hiding this comment

Uh oh!

anoopcs9 commented Jan 21, 2026

Uh oh!

phlogistonjohn commented Jan 22, 2026

Uh oh!

vshankar commented Feb 9, 2026

Uh oh!

vshankar commented Feb 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants