[OpenAFS] Red Hat EL Support Customers - Please open a support case for kafs in RHEL8

[Jeffrey Altman]

This is a cryptographically signed message in MIME format.

--------------ms090100070102090407020704
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: quoted-printable

To all AuriStorFS licensees and OpenAFS users,

After more than seventeen years of development led by David Howells, the
Linux kernel now includes a production ready AFS/AuriStorFS client
(kafs) and RX RPC protocol implementation (AF_RXRPC)[1].  These are not
add-ons.  kafs and af_rxrpc are baked into the mainline kernel.

Jonathan Billings has been building kafs enabled Fedora Core kernels via
COPR[1] since July[3].  Beginning with the 4.19 kernel, Fedora Core
kernels now ship with kafs and af_rxrpc enabled.

It was my hope that Red Hat would include kafs and af_rxrpc in RHEL8
Beta as an experimental technology.  Unfortunately, the RHEL8 Beta
announced on Nov 15th did not include either.

Thankfully it is not too late to for kafs and af_rxrpc to be added
before a final release of RHEL8 but RHEL support customers must make the
case by registering for the RHEL8 Beta[4] and opening a Support Case[5].

When opening a support case please specify:

 Product:      Red Hat Enterprise Linux
 Version:      8.0 Beta
 Case Type:    Feature / Enhancement Request
 Hostname:     hostname of the system on which RHEL8 beta was installed
 Problem
 Statement:    Request inclusion of kafs
 Case
 Description;  Explain why your organization uses AFS/AuriStorFS in
               addition to RHEL support storage systems and how the
               inclusion of kafs and af_rxrpc in RHEL8 will benefit
               your organization.

It is very important that the Case Description be specific to your
organization.  Each organization's reasons for using AFS/AuriStorFS are
different just as each organization's use cases are different.

If you are eligible, please attempt to open a support request by
December 11th.  Although this is not a hard deadline, many individuals
will begin taking end of year vacation time the middle of next week.

Frequently Asked Questions:

1. Is the kafs kernel module a replacement for the OpenAFS and
AuriStorFS kernel modules?

The best way to think of kafs is that it is an alternative to the
AFS/AuriStorFS and OpenAFS clients.  When kafs is provided as part of a
Linux distribution and it is enabled, it is not necessary to install any
of the OpenAFS or AuriStorFS client packages.

2. Is kafs compatible with IBM AFS, OpenAFS and AuriStorFS servers?

Yes.  kafs is compatible with IBM AFS 3.6 and all versions of OpenAFS
and AuriStorFS servers.

3. Does enabling kafs and af_rxrpc in RHEL8 prevent installation of
AuriStorFS or OpenAFS clients?

No.  Not only can the AuriStorFS kernel module be installed on Linux
kernels built with kafs and af_rxrpc but both AuriStorFS and kafs can be
enabled at the same time.  Runtime choices have to be made to decide
which will service the /afs mount point, which will use port 7001/udp
for the callback service, etc.  However, there is nothing that prevents
co-existence.

OpenAFS developers will need to ensure compatibility with the latest
RHEL kernels and build configurations.  It is likely that minor coding
adjustments will need to be implemented.

4. How does kafs/af_rxrpc performance compare to OpenAFS and AuriStorFS
clients?

In many workflows the kafs/af_rxrpc client is faster and more efficient
than either OpenAFS or AuriStorFS clients.  kafs/af_rxrpc are tightly
integrated into the Linux network stack and virtual file system layer.
There is significantly less overhead in the network stack (no double
buffering) and no global locks.  Building the Linux kernel from source
in /afs with kafs is at least 30% faster than the AuriStorFS cache
manager without encryption.

5. Are there features that OpenAFS has that kafs does not?

Yes.  kafs does not split horizon caching, it does not have an
equivalent of cache bypass, it does not implement any of the rxdebug or
xstat_cm statistics collection. Nor does it provide pioctls and there is
no fs, vos, pts, bos command suite.  kafs does not export afs2nfs.

6. Are there features that AuriStorFS has that kafs does not?

In addition to the items mentioned in the prior answer, kafs does not
yet support the yfs-rxgk security class and aes256-cts-hmac-sha1-96 or
aes256-cts-hmac-sha512-384 encryption.  O_DIRECT support is not yet
complete.  kafs is a fairly complete AuriStorFS client including support
for IPv6 and AuriStorFS RPC suites.

7. Does kafs have capabilities that are implemented in neither OpenAFS
nor AuriStorS?

kafs auto-mounts each afs volume as a separate device instead of
treating the entire /afs file namespace as a single device.  kafs
implements speculative file status fetching from directory lookups.

Perhaps more important is what kafs will be able to implement that
OpenAFS and AuriStorFS cannot due to GPL vs IPL10 license conflicts:

 * inotify notification event generation
 * SELinux/Smack label storage
 * better container namespacing

8. If my organization is happy with OpenAFS and/or AuriStorFS clients,
why should my organization care?

Out-of-the-box Linux distribution support for accessing the /afs file
namespace will significantly simplify the lives of end users not to
mention system administrators and help desk support staff.  When kafs is
distributed as part of the Linux kernel, there can never be a conflict
between the kernel version and the AFS kernel module since they are one
and the same.  There can never be a delay between the availability of a
new kernel version and the matching OpenAFS or AuriStorFS kernel module.
 AuriStor promises a new kernel module release within 48 hours of the
release of a kernel for a supported Linux distribution.  With OpenAFS
there have been many circumstances when the delay has been measured in
weeks or months.

Organizations that have support contracts with Linux vendors are often
told that support does not apply when the Linux kernel has been tainted
by a third-party kernel module.  When using kafs, the Linux kernel is
never tainted.

As part of the Linux kernel source tree, kafs is indirectly supported by
the entire Linux kernel development community.  All of the automated
testing performed against the mainline kernel is also performed against
kafs.  All kernel interface changes impacting kafs or af_rxrpc must be
implemented in kafs and af_rxrpc by the developer(s) promoting the
change.  All-in-all kafs and af_rxrpc will receive reviews by a much
larger community of developers.

Finally, as an out-of-the-box solution, /afs becomes a first class file
system namespace.  As a result, AFS adoption will increase and /afs will
become accessible on systems that are managed by third-party such as
those in the cloud.

9. Is there anything I shouldn't say to Red Hat?

Red Hat is going to make a business decision based upon its evaluation
of customer needs and their impact on growth of RHEL licensing.  If I
were in their shoes I would not find a request to add support for kafs
compelling if it were combined with a statement that the requesting
organization intends to discontinue use of /afs within the next three to
five years.  RHEL8 will have a support lifetime of at least a decade and
there is little justification to commit new engineering resources to a
technology that customers believe has no future.

10. Will AuriStor stop developing its own Linux client?

No.  AuriStor will always be able to ship new functionality in its own
clients first.  AuriStor believes that kafs will be the AFS client for
99.9% of end users with Linux desktops and servers.   The AuriStorFS
client for Linux will be used by organizations that have special needs
and highly managed environments.


Thanks for your assistance on behalf of the entire AFS/AuriStorFS communi=
ty.

Jeffrey Altman


[1] https://www.infradead.org/~dhowells/kafs/
[2] https://copr.fedorainfracloud.org/coprs/jsbillings/kafs/
[3] https://lists.openafs.org/pipermail/openafs-info/2018-July/042481.htm=
l
[4] https://developers.redhat.com/rhel8/getrhel8/
[5]
https://access.redhat.com/support/cases/#/case/new?intcmp=3Dhp%7Ca%7Ca3%7=
Ccase



--------------ms090100070102090407020704
Content-Type: application/pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature

MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC
DGswggXSMIIEuqADAgECAhBAAWbTGehnfUuu91hYwM5DMA0GCSqGSIb3DQEBCwUAMDoxCzAJ
BgNVBAYTAlVTMRIwEAYDVQQKEwlJZGVuVHJ1c3QxFzAVBgNVBAMTDlRydXN0SUQgQ0EgQTEy
MB4XDTE4MTEwMjA2MjYyMloXDTE5MTEwMjA2MjYyMlowcDEvMC0GCgmSJomT8ixkAQETH0Ew
MTQyN0UwMDAwMDE2NkQzMTlFODFBMDAwMDdBN0IxGTAXBgNVBAMTEEplZmZyZXkgRSBBbHRt
YW4xFTATBgNVBAoTDEF1cmlTdG9yIEluYzELMAkGA1UEBhMCVVMwggEiMA0GCSqGSIb3DQEB
AQUAA4IBDwAwggEKAoIBAQDqEYwjLORE23Gc8m7YgKqbGzWn/fmVGtoZkBNwOEYlrFOu84Pb
EhV4sxQrChhPyXVW2jquV2rg2/5dsVC8RO+RwlXuAkUvR9KhWJLu6GJXwUnZr83wtEzJ8nqp
THj6W+3velLwWx7qhADyrMnKN0bTYh+5M9HWt2We4qYi6i1/ejgKtM0arWYxVx6Iwb4xZpil
MDNqV15Dwuunnkq4vNEByIT81zDoClqylMxxKJpvc3tqC66+BHHM5RxF+z36Pt8fb3Q54Vry
txXFm+kVSclKGaWgjq5SqV4tR0FWv6OnMY8tAx1YrljfvgxW5npZgBbo+YVoYEfUrz77WIYQ
yzn7AgMBAAGjggKcMIICmDAOBgNVHQ8BAf8EBAMCBPAwgYQGCCsGAQUFBwEBBHgwdjAwBggr
BgEFBQcwAYYkaHR0cDovL2NvbW1lcmNpYWwub2NzcC5pZGVudHJ1c3QuY29tMEIGCCsGAQUF
BzAChjZodHRwOi8vdmFsaWRhdGlvbi5pZGVudHJ1c3QuY29tL2NlcnRzL3RydXN0aWRjYWEx
Mi5wN2MwHwYDVR0jBBgwFoAUpHPa72k1inXMoBl7CDL4a4nkQuwwCQYDVR0TBAIwADCCASsG
A1UdIASCASIwggEeMIIBGgYLYIZIAYb5LwAGAgEwggEJMEoGCCsGAQUFBwIBFj5odHRwczov
L3NlY3VyZS5pZGVudHJ1c3QuY29tL2NlcnRpZmljYXRlcy9wb2xpY3kvdHMvaW5kZXguaHRt
bDCBugYIKwYBBQUHAgIwga0agapUaGlzIFRydXN0SUQgQ2VydGlmaWNhdGUgaGFzIGJlZW4g
aXNzdWVkIGluIGFjY29yZGFuY2Ugd2l0aCBJZGVuVHJ1c3QncyBUcnVzdElEIENlcnRpZmlj
YXRlIFBvbGljeSBmb3VuZCBhdCBodHRwczovL3NlY3VyZS5pZGVudHJ1c3QuY29tL2NlcnRp
ZmljYXRlcy9wb2xpY3kvdHMvaW5kZXguaHRtbDBFBgNVHR8EPjA8MDqgOKA2hjRodHRwOi8v
dmFsaWRhdGlvbi5pZGVudHJ1c3QuY29tL2NybC90cnVzdGlkY2FhMTIuY3JsMB8GA1UdEQQY
MBaBFGphbHRtYW5AYXVyaXN0b3IuY29tMB0GA1UdDgQWBBQevV8IqWfIUNkQqAugGhxR938z
+jAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwDQYJKoZIhvcNAQELBQADggEBAKsU
kshF6tfL43itTIVy9vjYqqPErG9n8kX5FlRYbtIVlWIYTxQpeqtDpUPur1jfBiNY+xT+9Pay
O2+XxXu9ZEykCz5T4+3q7s5t5RLsHu1dxYcMnAgfUqb13mhZxY8PVPE4PTHSvZLjPZ6Nt7j0
tXjddZJqjDhr7neNpmYgQWSe+oaIxbUqQ34rVW/hDimv9Y2DnCXL0LopCfABQDK9HDzmsuXd
bVH6LUpS6ncge9kQEh1QIGuwqEv2tHCWeauWM6h3BOXj3dlfbJEawUYz2hvc3nSXpscFlCN5
tGAyUAE8QbKnH1ha/zZVrJY1EglFhnDho34lWl35t7pE5NP4kscwggaRMIIEeaADAgECAhEA
+d5Wf8lNDHdw+WAbUtoVOzANBgkqhkiG9w0BAQsFADBKMQswCQYDVQQGEwJVUzESMBAGA1UE
ChMJSWRlblRydXN0MScwJQYDVQQDEx5JZGVuVHJ1c3QgQ29tbWVyY2lhbCBSb290IENBIDEw
HhcNMTUwMjE4MjIyNTE5WhcNMjMwMjE4MjIyNTE5WjA6MQswCQYDVQQGEwJVUzESMBAGA1UE
ChMJSWRlblRydXN0MRcwFQYDVQQDEw5UcnVzdElEIENBIEExMjCCASIwDQYJKoZIhvcNAQEB
BQADggEPADCCAQoCggEBANGRTTzPCic0kq5L6ZrUJWt5LE/n6tbPXPhGt2Egv7plJMoEpvVJ
JDqGqDYymaAsd8Hn9ZMAuKUEFdlx5PgCkfu7jL5zgiMNnAFVD9PyrsuF+poqmlxhlQ06sFY2
hbhQkVVQ00KCNgUzKcBUIvjv04w+fhNPkwGW5M7Ae5K5OGFGwOoRck9GG6MUVKvTNkBw2/vN
MOd29VGVTtR0tjH5PS5yDXss48Yl1P4hDStO2L4wTsW2P37QGD27//XGN8K6amWB6F2XOgff
/PmlQjQOORT95PmLkwwvma5nj0AS0CVp8kv0K2RHV7GonllKpFDMT0CkxMQKwoj+tWEWJTiD
KSsCAwEAAaOCAoAwggJ8MIGJBggrBgEFBQcBAQR9MHswMAYIKwYBBQUHMAGGJGh0dHA6Ly9j
b21tZXJjaWFsLm9jc3AuaWRlbnRydXN0LmNvbTBHBggrBgEFBQcwAoY7aHR0cDovL3ZhbGlk
YXRpb24uaWRlbnRydXN0LmNvbS9yb290cy9jb21tZXJjaWFscm9vdGNhMS5wN2MwHwYDVR0j
BBgwFoAU7UQZwNPwBovupHu+QucmVMiONnYwDwYDVR0TAQH/BAUwAwEB/zCCASAGA1UdIASC
ARcwggETMIIBDwYEVR0gADCCAQUwggEBBggrBgEFBQcCAjCB9DBFFj5odHRwczovL3NlY3Vy
ZS5pZGVudHJ1c3QuY29tL2NlcnRpZmljYXRlcy9wb2xpY3kvdHMvaW5kZXguaHRtbDADAgEB
GoGqVGhpcyBUcnVzdElEIENlcnRpZmljYXRlIGhhcyBiZWVuIGlzc3VlZCBpbiBhY2NvcmRh
bmNlIHdpdGggSWRlblRydXN0J3MgVHJ1c3RJRCBDZXJ0aWZpY2F0ZSBQb2xpY3kgZm91bmQg
YXQgaHR0cHM6Ly9zZWN1cmUuaWRlbnRydXN0LmNvbS9jZXJ0aWZpY2F0ZXMvcG9saWN5L3Rz
L2luZGV4Lmh0bWwwSgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3ZhbGlkYXRpb24uaWRlbnRy
dXN0LmNvbS9jcmwvY29tbWVyY2lhbHJvb3RjYTEuY3JsMB0GA1UdJQQWMBQGCCsGAQUFBwMC
BggrBgEFBQcDBDAOBgNVHQ8BAf8EBAMCAYYwHQYDVR0OBBYEFKRz2u9pNYp1zKAZewgy+GuJ
5ELsMA0GCSqGSIb3DQEBCwUAA4ICAQAN4YKu0vv062MZfg+xMSNUXYKvHwvZIk+6H1pUmivy
DI4I6A3wWzxlr83ZJm0oGIF6PBsbgKJ/fhyyIzb+vAYFJmyI8I/0mGlc+nIQNuV2XY8cypPo
VJKgpnzp/7cECXkX8R4NyPtEn8KecbNdGBdEaG4a7AkZ3ujlJofZqYdHxN29tZPdDlZ8fR36
/mAFeCEq0wOtOOc0Eyhs29+9MIZYjyxaPoTS+l8xLcuYX3RWlirRyH6RPfeAi5kySOEhG1qu
NHe06QIwpigjyFT6v/vRqoIBr7WpDOSt1VzXPVbSj1PcWBgkwyGKHlQUOuSbHbHcjOD8w8wH
SDbL+L2he8hNN54doy1e1wJHKmnfb0uBAeISoxRbJnMMWvgAlH5FVrQWlgajeH/6NbYbBSRx
ALuEOqEQepmJM6qz4oD2sxdq4GMN5adAdYEswkY/o0bRKyFXTD3mdqeRXce0jYQbWm7oapqS
ZBccFvUgYOrB78tB6c1bxIgaQKRShtWR1zMM0JfqUfD9u8Fg7G5SVO0IG/GcxkSvZeRjhYcb
TfqF2eAgprpyzLWmdr0mou3bv1Sq4OuBhmTQCnqxAXr4yVTRYHkp5lCvRgeJAme1OTVpVPth
/O7HJ7VuEP9GOr6kCXCXmjB4P3UJ2oU0NqfoQdcSSSt9hliALnExTEjii20B2nSDojGCAxQw
ggMQAgEBME4wOjELMAkGA1UEBhMCVVMxEjAQBgNVBAoTCUlkZW5UcnVzdDEXMBUGA1UEAxMO
VHJ1c3RJRCBDQSBBMTICEEABZtMZ6Gd9S673WFjAzkMwDQYJYIZIAWUDBAIBBQCgggGXMBgG
CSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTE4MTIwNjIzMzMxMFow
LwYJKoZIhvcNAQkEMSIEIJ1XC2cmcGMF8Zuhg+aSkRLZrLvVQVWDnlIt8T1q9urIMF0GCSsG
AQQBgjcQBDFQME4wOjELMAkGA1UEBhMCVVMxEjAQBgNVBAoTCUlkZW5UcnVzdDEXMBUGA1UE
AxMOVHJ1c3RJRCBDQSBBMTICEEABZtMZ6Gd9S673WFjAzkMwXwYLKoZIhvcNAQkQAgsxUKBO
MDoxCzAJBgNVBAYTAlVTMRIwEAYDVQQKEwlJZGVuVHJ1c3QxFzAVBgNVBAMTDlRydXN0SUQg
Q0EgQTEyAhBAAWbTGehnfUuu91hYwM5DMGwGCSqGSIb3DQEJDzFfMF0wCwYJYIZIAWUDBAEq
MAsGCWCGSAFlAwQBAjAKBggqhkiG9w0DBzAOBggqhkiG9w0DAgICAIAwDQYIKoZIhvcNAwIC
AUAwBwYFKw4DAgcwDQYIKoZIhvcNAwICASgwDQYJKoZIhvcNAQEBBQAEggEAI3ZuRSNH2Djs
6+enwv1u1haNXWwD+ez5yn/I5wtTozZiO+qD0S14YhrLE//IQ3dW8KvPO33wDkMluLyb/Uk/
XCj6IF6TCTqVg1GM2MGeks1+APNh3DtrgJXpPTHakoAzMZpE6CDezdZjlPmWA/GTXhT3EoB5
jEm7fAgtVKSg+zRyVG/81qhrr9r/sRLg1IvB3q77UZQcH+QInWvCJOrcgVTHM3mBUkDp7SgV
fwgNtaaPg4jVhAiTctknvjRH71lU5W6BYF9P/3R6wJfepMLE824S/BkgQld9hVpSrUh19QC+
I3SLM7fsGMW3RXkESMBoanh3671B1si3v2cD79q2mAAAAAAAAA==
--------------ms090100070102090407020704--