osd: don't set dmcrypt env in prepare pod job spec

this commit remove the code which sets the dmcrypt encryption
key from secret as environment variable in the prepare pod job
spec. Now, the env will be set under function `setKEKinEnv`, which
tries to reads secret from k8s first method `c.IsK8s()`under
`GetSecret` and then check for KMS to ready and apply env directly.

Signed-off-by: subhamkrai <srai@redhat.com>
(cherry picked from commit d86aa28f30)

pkg/daemon/ceph/osd/encryption.go

@@ -70,13 +70,6 @@ func setKEKinEnv(context *clusterd.Context, clusterInfo *cephclient.ClusterInfo)
 	// pick it up
 	clusterSpec := &v1.ClusterSpec{Security: v1.SecuritySpec{KeyManagementService: v1.KeyManagementServiceSpec{ConnectionDetails: kms.ConfigEnvsToMapString()}}}
 
-	// If KMS is not enabled this code does not need to run since we attach the KEK value from the
-	// Kubernetes Secret in the provision pod spec (mounted as an environment variable)
-	if !clusterSpec.Security.KeyManagementService.IsEnabled() {
-		logger.Debug("cluster-wide encryption is enabled with kubernetes secrets and the kek is attached to the provision env spec")
-		return nil
-	}
-
 	// The ibm key protect library does not read any environment variables, so we must set the
 	// service api key (coming from the secret mounted as environment variable) in the KMS
 	// connection details. These details are used to build the client connection

pkg/operator/ceph/cluster/osd/envs.go

@@ -20,7 +20,6 @@ import (
 	"strconv"
 
 	"github.com/rook/rook/pkg/daemon/ceph/client"
-	kms "github.com/rook/rook/pkg/daemon/ceph/osd/kms"
 	opmon "github.com/rook/rook/pkg/operator/ceph/cluster/mon"
 	"github.com/rook/rook/pkg/operator/k8sutil"
 	"gopkg.in/ini.v1"
@@ -190,20 +189,6 @@ func pvcNameEnvVar(pvcName string) v1.EnvVar {
 	return v1.EnvVar{Name: PVCNameEnvVarName, Value: pvcName}
 }
 
-func cephVolumeRawEncryptedEnvVarFromSecret(osdProps osdProperties) v1.EnvVar {
-	return v1.EnvVar{
-		Name: CephVolumeEncryptedKeyEnvVarName,
-		ValueFrom: &v1.EnvVarSource{
-			SecretKeyRef: &v1.SecretKeySelector{
-				LocalObjectReference: v1.LocalObjectReference{
-					Name: kms.GenerateOSDEncryptionSecretName(osdProps.pvc.ClaimName),
-				},
-				Key: kms.OsdEncryptionSecretNameKeyName,
-			},
-		},
-	}
-}
-
 func cephVolumeEnvVar() []v1.EnvVar {
 	return []v1.EnvVar{
 		{Name: "CEPH_VOLUME_DEBUG", Value: "1"},

pkg/operator/ceph/cluster/osd/provision_spec.go

@@ -294,12 +294,9 @@ func (c *Cluster) provisionOSDContainer(osdProps osdProperties, copyBinariesMoun
 				}
 				envVars = append(envVars, kms.ConfigToEnvVar(c.spec)...)
 				if c.spec.Security.KeyManagementService.IsKMIPKMS() {
-					envVars = append(envVars, cephVolumeRawEncryptedEnvVarFromSecret(osdProps))
 					_, volmeMountsKMIP := kms.KMIPVolumeAndMount(c.spec.Security.KeyManagementService.TokenSecretName)
 					volumeMounts = append(volumeMounts, volmeMountsKMIP)
 				}
-			} else {
-				envVars = append(envVars, cephVolumeRawEncryptedEnvVarFromSecret(osdProps))
 			}
 		}
 	} else {