From bc41df4dd8f3cd49f924b95d2615e80387477e3c Mon Sep 17 00:00:00 2001 From: Madhu Rajanna Date: Tue, 10 Jan 2023 12:21:23 +0100 Subject: [PATCH 1/2] core: set rbd_default_map_options for encryption Set rbd_default_map_options to secure when encryption is enabled or else set it to prefer-crc. Signed-off-by: Madhu Rajanna --- pkg/operator/ceph/cluster/cluster.go | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/pkg/operator/ceph/cluster/cluster.go b/pkg/operator/ceph/cluster/cluster.go index 5b9fb08d5..3545eb501 100755 --- a/pkg/operator/ceph/cluster/cluster.go +++ b/pkg/operator/ceph/cluster/cluster.go @@ -604,14 +604,18 @@ func (c *cluster) configureMsgr2() error { monStore := config.GetMonStore(c.context, c.ClusterInfo) if c.Spec.Network.Connections.Encryption != nil { encryptionSetting := "crc secure" + // crc mode, if denied agree to secure mode + defaultRBDMapOptions := "ms_mode=prefer-crc" if c.Spec.Network.Connections.Encryption.Enabled { encryptionSetting = "secure" + defaultRBDMapOptions = "ms_mode=secure" } globalConfigSettings := map[string]string{ - "ms_cluster_mode": encryptionSetting, - "ms_service_mode": encryptionSetting, - "ms_client_mode": encryptionSetting, + "ms_cluster_mode": encryptionSetting, + "ms_service_mode": encryptionSetting, + "ms_client_mode": encryptionSetting, + "rbd_default_map_options": defaultRBDMapOptions, } logger.Infof("setting msgr2 encryption mode to %q", encryptionSetting) From 41e40827308041d9f8ef462287a1b6544501f2b2 Mon Sep 17 00:00:00 2001 From: Madhu Rajanna Date: Wed, 11 Jan 2023 17:31:31 +0100 Subject: [PATCH 2/2] csi: use krbd for encryption use krbd for mapping the rbd image when ceph cluster encryption is enabled. Signed-off-by: Madhu Rajanna --- tests/framework/installer/ceph_manifests.go | 5 ----- 1 file changed, 5 deletions(-) diff --git a/tests/framework/installer/ceph_manifests.go b/tests/framework/installer/ceph_manifests.go index 0b5bcb3af..0b8ec0965 100644 --- a/tests/framework/installer/ceph_manifests.go +++ b/tests/framework/installer/ceph_manifests.go @@ -314,11 +314,6 @@ parameters: imageFeatures: layering csi.storage.k8s.io/fstype: ext4 ` - if m.settings.ConnectionsEncrypted { - // encryption requires either the 5.11 kernel or the nbd mounter. Until the newer - // kernel is available in minikube, we need to test with nbd. - sc += " mounter: rbd-nbd" - } return sc }