[lustre-discuss] kerberised lustre performance

[Sebastien Buisson]

> Le 1 mai 2017 à 14:16, E.S. Rosenberg <esr+lustre at mail.hebrew.edu> a écrit :
> On Fri, Apr 28, 2017 at 11:19 AM, Sebastien Buisson <sbuisson at ddn.com> wrote:
> Hi,
> I have not specifically measured the performance impact of getting the Kerberos ticket before any Lustre request can be sent by the client. It happens at the first connection (so when mounting) and then when the ticket expires. Otherwise the ticket is cached.
> So unless the ticket has a very short lifetime of a few seconds, contacting the Kerberos server to renew the ticket should have very little impact on a standard production workflow.
> Ah, so it is only to authenticate/authorize the client system and not the user that is trying to access files?

Yes, Kerberized Lustre also requires that users have their own credentials. Similarly, user’s Kerberos ticket is cached, and only renewed by contacting the Kerberos server once it has expired.

Cheers,
Sebastien.