forked from rook/rook
NymanRobin
05315ae64f
Ceph-CSI support for fscrypt encryption of cephfs.
To achieve this commit add capability of mounting the
required `rook-ceph-csi-kms-config` configmap into
csi-cephfsplugin-provisioner and nodeplugin pods.
Further it modifies the ClusterRoles `cephfs-csi-nodeplugin` and
`cephfs-external-provisioner-runner` to grant privileges
required for reading encryption configuration and fetching
encryption secrets from either kubernetes secrets or
from a Key Management System (KMS).
These privileges are essential for the proper functioning of
ceph-csi-cephfs with fscrypt encryption.
The following privileges have been added:
- `secrets/get`: Allows reading of secrets for encryption.
- `configmaps/get`: Grants access to configuration maps,
this is used to read encryption configuration.
- `serviceaccounts/get`: Enables retrieval of service accounts for
authentication to KMS and for retrieving encryption secrets
stored there.
- `serviceaccounts/token/create`: Allows creation of service account tokens,
which are required for authenticating requests to KMS
when retrieving encryption secrets.
The commit also updated the csi documentation to include cephfs
in the encryption section, with examples updated accordingly.
Signed-off-by: NymanRobin <robin.nyman@est.tech>
45 lines
1.9 KiB
YAML
45 lines
1.9 KiB
YAML
apiVersion: storage.k8s.io/v1
|
|
kind: StorageClass
|
|
metadata:
|
|
name: rook-cephfs
|
|
provisioner: rook-ceph.cephfs.csi.ceph.com # csi-provisioner-name
|
|
parameters:
|
|
# clusterID is the namespace where the rook cluster is running
|
|
# If you change this namespace, also change the namespace below where the secret namespaces are defined
|
|
clusterID: rook-ceph # namespace:cluster
|
|
|
|
# CephFS filesystem name into which the volume shall be created
|
|
fsName: myfs
|
|
|
|
# Ceph pool into which the volume shall be created
|
|
# Required for provisionVolume: "true"
|
|
pool: myfs-replicated
|
|
|
|
# The secrets contain Ceph admin credentials. These are generated automatically by the operator
|
|
# in the same namespace as the cluster.
|
|
csi.storage.k8s.io/provisioner-secret-name: rook-csi-cephfs-provisioner
|
|
csi.storage.k8s.io/provisioner-secret-namespace: rook-ceph # namespace:cluster
|
|
csi.storage.k8s.io/controller-expand-secret-name: rook-csi-cephfs-provisioner
|
|
csi.storage.k8s.io/controller-expand-secret-namespace: rook-ceph # namespace:cluster
|
|
csi.storage.k8s.io/node-stage-secret-name: rook-csi-cephfs-node
|
|
csi.storage.k8s.io/node-stage-secret-namespace: rook-ceph # namespace:cluster
|
|
|
|
# (optional) Set it to true to encrypt each volume with encryption keys
|
|
# from a key management system (KMS)
|
|
# encrypted: "true"
|
|
|
|
# (optional) Use external key management system (KMS) for encryption key by
|
|
# specifying a unique ID matching a KMS ConfigMap. The ID is only used for
|
|
# correlation to configmap entry.
|
|
# encryptionKMSID: <kms-config-id>
|
|
|
|
# (optional) The driver can use either ceph-fuse (fuse) or ceph kernel client (kernel)
|
|
# If omitted, default volume mounter will be used - this is determined by probing for ceph-fuse
|
|
# or by setting the default mounter explicitly via --volumemounter command-line argument.
|
|
# mounter: kernel
|
|
reclaimPolicy: Delete
|
|
allowVolumeExpansion: true
|
|
mountOptions:
|
|
# uncomment the following line for debugging
|
|
#- debug
|