From 3e49c9f4cf475f66fd5540bb1c7548e2eb3d90ff Mon Sep 17 00:00:00 2001 From: Santosh Date: Mon, 25 May 2026 18:45:37 +0530 Subject: [PATCH] osd: add cryptsetup resize for encrypted host based osds MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit when using encryptedDevice:true with host based (non pvc) osds, resizing the underlying disk and restarting the OSD didn't expand the OSD because the LUKS encryption layer was not resized. This PR adds resize capabilities inside the activate container. Full device stack must be resized: PV → LV → LUKS Steps: 1. Run pvresize and lvextend to grow the LVM layers. 2. Retrieve the LUKS key from the Ceph config-key store using the lockbox crednetials already available in the activate container 3. Pass the key explicitly to cryptsetup resize via --key-file. Signed-off-by: Santosh --- PendingReleaseNotes.md | 1 + pkg/operator/ceph/cluster/osd/spec.go | 20 ++++++++++++++++++++ 2 files changed, 21 insertions(+) diff --git a/PendingReleaseNotes.md b/PendingReleaseNotes.md index 6d195410b..9e3472efb 100644 --- a/PendingReleaseNotes.md +++ b/PendingReleaseNotes.md @@ -16,3 +16,4 @@ - Unused CRUSH rule cleanup: Rook now deletes unused CRUSH rules by default after the Ceph mgr starts. Set `ROOK_DELETE_UNUSED_CRUSH_RULES` to `false` in the operator config to disable this cleanup. - Declare stable the feature to concurrently reconcile multiple Ceph Clusters with the setting `ROOK_RECONCILE_CONCURRENT_CLUSTERS`. - Containers within a pod are now consistently reconciled by name instead of relying on the order in which they are declared. This is a defensive measure against the declaration order changing due to manipulation by a mutating webhook. +- OSD resize with encrypted host-based OSDs: When using `encryptedDevice: true` with host-based (non-PVC) OSDs, resizing the underlying disk now automatically expands encrypted OSDs. diff --git a/pkg/operator/ceph/cluster/osd/spec.go b/pkg/operator/ceph/cluster/osd/spec.go index 63d3ded91..f0cf86739 100644 --- a/pkg/operator/ceph/cluster/osd/spec.go +++ b/pkg/operator/ceph/cluster/osd/spec.go @@ -140,6 +140,26 @@ if [[ "$CV_MODE" == "lvm" ]]; then # activate osd ceph-volume lvm activate --no-systemd "$OSD_STORE_FLAG" "$OSD_ID" "$OSD_UUID" + # For encrypted LVM OSDs, resize the full stack: PV → LV → LUKS. + # All operations are no-ops if the underlying device hasn't grown. + if [ "$ENCRYPTED" == "true" ]; then + VG_NAME=$(dirname "$DEVICE" | xargs basename) + pvresize "$(pvs --noheadings -o pv_name -S vg_name="$VG_NAME" 2>/dev/null | tr -d ' ')" + # With osd_per_device > 1, multiple LVs share the same VG. Absolute target + # (total/count) divides space equally and is a no-op on restarts. + OSD_COUNT=$(vgs --noheadings --nosuffix -o lv_count "$VG_NAME" 2>/dev/null | tr -d ' ') + TOTAL_EXTENTS=$(vgs --noheadings --nosuffix -o vg_extent_count "$VG_NAME" 2>/dev/null | tr -d ' ') + lvextend -l "$((TOTAL_EXTENTS / OSD_COUNT))" "$DEVICE" || true + + DM_NAME=$(basename "$(readlink "$OSD_DATA_DIR/block")") + KEY_FILE=$(mktemp /tmp/.luks_key.XXXXXX) + trap "rm -f '$KEY_FILE'" EXIT + ceph --cluster ceph --name "$LOCKBOX_USER" \ + --keyring "$LOCKBOX_KEYRING_FILE" \ + config-key get "dm-crypt/osd/$OSD_UUID/luks" > "$KEY_FILE" + cryptsetup --verbose resize "$DM_NAME" --key-file "$KEY_FILE" + fi + # copy the tmpfs directory to a temporary directory # this is needed because when the init container exits, the tmpfs goes away and its content with it # this will result in the emptydir to be empty when accessed by the main osd container