Merge pull request #10035 from leseb/fix-ibm-kms-corner-case

osd: only set kek to env var on encryption scenario

pkg/daemon/ceph/osd/daemon.go

@@ -158,7 +158,8 @@ func configRawDevice(name string, context *clusterd.Context) (*sys.LocalDisk, er
 
 // Provision provisions an OSD
 func Provision(context *clusterd.Context, agent *OsdAgent, crushLocation, topologyAffinity string) error {
-	if agent.pvcBacked {
+	if agent.pvcBacked && os.Getenv(oposd.EncryptedDeviceEnvVarName) == "true" {
+		logger.Debug("encryption configuration detecting, populating kek to an env variable")
 		// Init KMS store, retrieve the KEK and store it as an env var for ceph-volume
 		err := setKEKinEnv(context, agent.clusterInfo)
 		if err != nil {

pkg/daemon/ceph/osd/encryption.go

@@ -103,8 +103,7 @@ func setKEKinEnv(context *clusterd.Context, clusterInfo *cephclient.ClusterInfo)
 		return errors.Wrap(err, "failed to set key encryption key env variable for ceph-volume")
 	}
 
-	logger.Debug("successfully set vault env variables")
-
+	logger.Debug("successfully set kek to env variable")
 	return nil
 }
 

pkg/daemon/ceph/osd/kms/envs.go

@@ -134,6 +134,7 @@ func ConfigEnvsToMapString() map[string]string {
 		pair := strings.SplitN(e, "=", 2)
 		for _, knownKMS := range knownKMSPrefix {
 			if strings.HasPrefix(pair[0], knownKMS) || pair[0] == Provider {
+				logger.Debugf("adding env %q", pair[0])
 				envs[pair[0]] = os.Getenv(pair[0])
 			}
 		}