I'm trying to reconcile Ceph OSD encryption workflow
- OSD is created, both lockbox and dmcrypt keys are created, and sent along with JSON to the monitors, indicating an encrypted OSD.
- All complementary devices (like journal, db, or wal) get created and encrypted with the same OSD key. Key is stored in the LVM metadata of the OSD
- Activation continues by ensuring devices are mounted, retrieving the dmcrypt secret key from the monitors and decrypting before the OSD gets started.
The (2) step is confusing as it talks about the "OSD key", which is stored in LVM metadata. If the dmcrypt key is stored in the monitor, what is the OSD key? "The same OSD key" means the same as dmcrypt key?