配置glusterdfs的分布式分散卷ssl加密的操作步骤

密钥可以通过openssl来生成也可以通过cfssl，这里可以去别处参考

1、添加SSL（文件名字必须为glusterfs.xxx）

/etc/ssl/glusterfs.pem
/etc/ssl/glusterfs.key
/etc/ssl/glusterfs.ca

2、节点加密设置准备一个空文件

touch /var/lib/glusterd/secure-access

3、启动glusterd服务

systemctl restart glusterd

4、添加信任资源池(域名/IP)

gluster peer probe glusterfs-02        
gluster peer probe glusterfs-03

5、制作分布式存储卷（卷的类性有很多此处分布式分散卷类似raid5和raid6，最多只能使用16个块设备，扩展时比较麻烦必须是成倍扩展）

gluster volume create ceshi disperse-data 8 redundancy 4 \
192.168.1.20:/opt/storage/data1 \
192.168.1.20:/opt/storage/data2 \
192.168.1.20:/opt/storage/data3 \
192.168.1.20:/opt/storage/data4 \
192.168.1.21:/opt/storage/data1 \
192.168.1.21:/opt/storage/data2 \
192.168.1.21:/opt/storage/data3 \
192.168.1.21:/opt/storage/data4 \
192.168.1.22:/opt/storage/data1 \
192.168.1.22:/opt/storage/data2 \
192.168.1.22:/opt/storage/data3 \
192.168.1.22:/opt/storage/data4 force

6、设置vol主机间的加密(这里server代表主机IP/域名)

gluster volume set volume-name auth.ssl-allow 'servera,serverb,serverc'
gluster volume set volume-name auth.ssl-allow '*'

7、开启server和client加密

gluster volume set volume-name server.ssl on
gluster volume set volume-name client.ssl on

8、重新启动vol卷

gluster volume stop volume-name
gluster volume start volume-name

9、客户端挂载

mkdir /var/lib/glusterd
touch /var/lib/glusterd/secure-access
mount -t glusterfs server1 /mnt

10、删除卷操作

gluster vol stop volume-name    #停止卷

gluster vol delete volume-name  #删除卷

gluster peer detach 域名/IP     #删除信任