Merge pull request #11523 from Madhu-1/fix-11522

ceph: set rbd_default_map_options for encryption

pkg/operator/ceph/cluster/cluster.go

@@ -604,14 +604,18 @@ func (c *cluster) configureMsgr2() error {
 	monStore := config.GetMonStore(c.context, c.ClusterInfo)
 	if c.Spec.Network.Connections.Encryption != nil {
 		encryptionSetting := "crc secure"
+		// crc mode, if denied agree to secure mode
+		defaultRBDMapOptions := "ms_mode=prefer-crc"
 		if c.Spec.Network.Connections.Encryption.Enabled {
 			encryptionSetting = "secure"
+			defaultRBDMapOptions = "ms_mode=secure"
 		}
 
 		globalConfigSettings := map[string]string{
-			"ms_cluster_mode": encryptionSetting,
-			"ms_service_mode": encryptionSetting,
-			"ms_client_mode":  encryptionSetting,
+			"ms_cluster_mode":         encryptionSetting,
+			"ms_service_mode":         encryptionSetting,
+			"ms_client_mode":          encryptionSetting,
+			"rbd_default_map_options": defaultRBDMapOptions,
 		}
 
 		logger.Infof("setting msgr2 encryption mode to %q", encryptionSetting)

tests/framework/installer/ceph_manifests.go

@@ -314,11 +314,6 @@ parameters:
   imageFeatures: layering
   csi.storage.k8s.io/fstype: ext4
 `
-	if m.settings.ConnectionsEncrypted {
-		// encryption requires either the 5.11 kernel or the nbd mounter. Until the newer
-		// kernel is available in minikube, we need to test with nbd.
-		sc += "  mounter: rbd-nbd"
-	}
 	return sc
 }