Merge pull request #16399 from travisn/update-client-profile

csi: Set the cephfs kernel mount options when network encryption is enabled

pkg/operator/ceph/controller/cluster_info.go

@@ -163,11 +163,8 @@ func CreateOrLoadClusterInfo(clusterdContext *clusterd.Context, context context.
 	// can run on remote executor
 	clusterInfo.NetworkSpec = cephClusterSpec.Network
 
-	// update clusterInfo with cephClusterSpec.CSI.
-	clusterInfo.CSIDriverSpec = cephClusterSpec.CSI
-	if len(clusterInfo.CSIDriverSpec.ReadAffinity.CrushLocationLabels) == 0 {
-		clusterInfo.CSIDriverSpec.ReadAffinity.CrushLocationLabels = strings.Split(topology.GetDefaultTopologyLabels(), ",")
-	}
+	// update clusterInfo with cephClusterSpec.CSI settings
+	clusterInfo.CSIDriverSpec = loadCsiSettings(cephClusterSpec)
 
 	// If an admin key was provided we don't need to load the other resources
 	// Some people might want to give the admin key
@@ -191,6 +188,25 @@ func CreateOrLoadClusterInfo(clusterdContext *clusterd.Context, context context.
 	return clusterInfo, maxMonID, monMapping, nil
 }
 
+func loadCsiSettings(cephClusterSpec *cephv1.ClusterSpec) cephv1.CSIDriverSpec {
+	settings := cephClusterSpec.CSI
+	if len(settings.ReadAffinity.CrushLocationLabels) == 0 {
+		settings.ReadAffinity.CrushLocationLabels = strings.Split(topology.GetDefaultTopologyLabels(), ",")
+	}
+	// if the csi spec does not specify mount options, apply them from the operator env vars
+	if cephClusterSpec.CSI.CephFS.KernelMountOptions == "" {
+		settings.CephFS.KernelMountOptions = k8sutil.GetOperatorSetting("CSI_CEPHFS_KERNEL_MOUNT_OPTIONS", "")
+		// if the kernel mount options are not set and encryption is enabled, set the default to secure
+		if settings.CephFS.KernelMountOptions == "" {
+			if cephClusterSpec.NetworkEncryptionEnabled() {
+				logger.Info("setting default cephfs kernel mount options to 'ms_mode=secure' since encryption is enabled")
+				settings.CephFS.KernelMountOptions = "ms_mode=secure"
+			}
+		}
+	}
+	return settings
+}
+
 // create new cluster info (FSID, shared keys)
 func createNamedClusterInfo(context *clusterd.Context, namespace string) (*cephclient.ClusterInfo, error) {
 	fsid, err := uuid.NewRandom()

pkg/operator/ceph/controller/cluster_info_test.go

@@ -139,4 +139,38 @@ func TestCreateClusterSecrets(t *testing.T) {
 	assert.NoError(t, err)
 	assert.Equal(t, "testid", info.CephCred.Username)
 	assert.Equal(t, "testkey", info.CephCred.Secret)
+	assert.Equal(t, "", info.CSIDriverSpec.CephFS.KernelMountOptions)
+
+	// Verify the csi settings default to secure if the network is encrypted
+	cephClusterSpec.Network = cephv1.NetworkSpec{
+		Connections: &cephv1.ConnectionsSpec{
+			Encryption: &cephv1.EncryptionSpec{
+				Enabled: true,
+			},
+		},
+	}
+	info, _, _, err = CreateOrLoadClusterInfo(context, ctx, namespace, ownerInfo, cephClusterSpec)
+	assert.NoError(t, err)
+	assert.Equal(t, "ms_mode=secure", info.CSIDriverSpec.CephFS.KernelMountOptions)
+
+	// Verify the csi settings are loaded from an env var
+	cephClusterSpec.Network = cephv1.NetworkSpec{}
+	t.Setenv("CSI_CEPHFS_KERNEL_MOUNT_OPTIONS", "ms_mode=crc")
+	info, _, _, err = CreateOrLoadClusterInfo(context, ctx, namespace, ownerInfo, cephClusterSpec)
+	assert.NoError(t, err)
+	assert.Equal(t, "ms_mode=crc", info.CSIDriverSpec.CephFS.KernelMountOptions)
+
+	// Verify the csi settings are loaded from the cephClusterSpec if specified and override the env var
+	cephClusterSpec.CSI = cephv1.CSIDriverSpec{
+		ReadAffinity: cephv1.ReadAffinitySpec{
+			Enabled:             true,
+			CrushLocationLabels: []string{"kubernetes.io/hostname"},
+		},
+		CephFS: cephv1.CSICephFSSpec{
+			KernelMountOptions: "ms_mode=secure",
+		},
+	}
+	info, _, _, err = CreateOrLoadClusterInfo(context, ctx, namespace, ownerInfo, cephClusterSpec)
+	assert.NoError(t, err)
+	assert.Equal(t, "ms_mode=secure", info.CSIDriverSpec.CephFS.KernelMountOptions)
 }