ZFS+Solaris+Encryption = no L2ARC

[Firebug24k]

Just discovered this the hard way... If you have a ZFS pool that is encrypted using native Solaris encryption, no data on the encrypted datasets is stored in the L2ARC. So if you're planning on adding SSDs to supplement your ram on an encrypted pool, it doesn't do a bit of good. This sort of makes sense if you think about it, you don't want your encrypted data sitting there in unencrypted form on your L2ARC.

This isn't readily apparent reading the ZFS docs, so I just thought I'd put this out there to save someone else the trouble of buying a brand new SSD only to return it (like me).

 

[olavgg]

I wonder how this is with GELI + ZFS. I belive data will be stored unencrypted on the L2ARC.

 

[_Gea]

Just discovered this the hard way... If you have a ZFS pool that is encrypted using native Solaris encryption, no data on the encrypted datasets is stored in the L2ARC. So if you're planning on adding SSDs to supplement your ram on an encrypted pool, it doesn't do a bit of good. This sort of makes sense if you think about it, you don't want your encrypted data sitting there in unencrypted form on your L2ARC.

This isn't readily apparent reading the ZFS docs, so I just thought I'd put this out there to save someone else the trouble of buying a brand new SSD only to return it (like me).

some more good infos about
see http://blogs.sun.com/darren/entry/zfs_encryption_what_is_on

..
The L2ARC is not currently available for use by encrypted datasets (note this is not a commitment from Oracle to provide this support in any future release of ZFS or Solaris) it is equivalent to having done 'zfs set secondarycache=none <dataset>'. The DDT for deduplication is not encrypted data and is pool wide metadata (stored in the MOS) so it is still able to be stored in the L2ARC.
..

Gea
..

 

[sub.mesa]

On FreeBSD you can encrypt the SSDs too and still use them as L2ARC, or only encrypt the base pool and not encrypt the L2ARC, assuming you only need simple protection; recovering stuff from L2ARC means a determined person trying to decrypt your stuff. ZFS is not a piece of software that has external recover programs that can read ZFS metadata; so recovery might be quite complicated and not encrypting the L2ARC may be sufficient and make sense depending on the situation.

Encryption does add latency to L2ARC but it would still be alot faster, especially if your CPU has acceleration for AES encryption.