Cephalocon 2020

Over the last few years, Workday has invested in a number of virtualization technologies such as VMware, OpenStack and Kubernetes. On OpenStack alone, we currently have over 7,000 hypervisors across five data centres. More recently, we started to focus on Ceph as our main storage platform.

As a leading financial and human capital management cloud software provider, Workday takes security very seriously. In our data centres, all data and all communications must be encrypted at all times. This has presented a number of challenges to use Ceph in Workday.

In this talk we will describe the main security challenges we are facing and how we are working to address them. We will discuss the need for encryption in transit with Ceph’s new communication protocol (MSGR2), and present two efforts developed in Workday to strengthen Ceph’s encryption capabilities using HashiCorp Vault: extending server-side encryption support in Rados Gateway’s S3 API (SSE-KMS), and introducing RBD volume encryption support for Kubernetes with the Ceph-CSI driver.