-</code></pre></div></td></tr></table></div> </li> <li> <p>After enabling <code>CSI_ENABLE_CSIADDONS</code> in the configmap, a new sidecar container named <code>csi-addons</code> will start automatically in the RBD CSI provisioner and nodeplugin pods.</p> </li> </ul> <h3 id=csi-addons-operations>CSI-Addons Operations<a class=headerlink href=#csi-addons-operations title="Permanent link">¶</a></h3> <p>CSI-Addons supports the following operations:</p> <ul> <li>Reclaim Space<ul> <li><a href=https://github.com/csi-addons/kubernetes-csi-addons/blob/v0.12.0/docs/reclaimspace.md#reclaimspacejob>Creating a ReclaimSpaceJob</a></li> <li><a href=https://github.com/csi-addons/kubernetes-csi-addons/blob/v0.12.0/docs/reclaimspace.md#reclaimspacecronjob>Creating a ReclaimSpaceCronJob</a></li> <li><a href=https://github.com/csi-addons/kubernetes-csi-addons/blob/v0.12.0/docs/reclaimspace.md#annotating-perstentvolumeclaims>Annotating PersistentVolumeClaims</a></li> <li><a href=https://github.com/csi-addons/kubernetes-csi-addons/blob/v0.12.0/docs/reclaimspace.md#annotating-namespace>Annotating Namespace</a></li> <li><a href=https://github.com/csi-addons/kubernetes-csi-addons/blob/v0.12.0/docs/reclaimspace.md#annotating-storageclass>Annotating StorageClass</a></li> </ul> </li> <li>Network Fencing<ul> <li><a href=https://github.com/csi-addons/kubernetes-csi-addons/blob/v0.12.0/docs/networkfence.md>Creating a NetworkFence</a></li> </ul> </li> <li>Volume Replication<ul> <li><a href=https://github.com/csi-addons/kubernetes-csi-addons/blob/v0.12.0/docs/volumereplicationclass.md>Creating VolumeReplicationClass</a></li> <li><a href=https://github.com/csi-addons/kubernetes-csi-addons/blob/v0.12.0/docs/volumereplication.md>Creating VolumeReplication CR</a></li> </ul> </li> <li>Key Rotation Job for PV encryption<ul> <li><a href=https://github.com/csi-addons/kubernetes-csi-addons/blob/v0.12.0/docs/encryptionkeyrotation.md#encryptionkeyrotationjob>Creating EncryptionKeyRotationJob</a></li> <li><a href=https://github.com/csi-addons/kubernetes-csi-addons/blob/v0.12.0/docs/encryptionkeyrotation.md#encryptionkeyrotationcronjob>Creating EncryptionKeyRotationCronJob</a></li> <li><a href=https://github.com/csi-addons/kubernetes-csi-addons/blob/v0.12.0/docs/encryptionkeyrotation.md#annotating-persistentvolumeclaims>Annotating PersistentVolumeClaims</a></li> <li><a href=https://github.com/csi-addons/kubernetes-csi-addons/blob/v0.12.0/docs/encryptionkeyrotation.md#annotating-namespace>Annotating Namespace</a></li> <li><a href=https://github.com/csi-addons/kubernetes-csi-addons/blob/v0.12.0/docs/encryptionkeyrotation.md#annotating-storageclass>Annotating StorageClass</a></li> </ul> </li> </ul> <h2 id=enable-rbd-and-cephfs-encryption-support>Enable RBD and CephFS Encryption Support<a class=headerlink href=#enable-rbd-and-cephfs-encryption-support title="Permanent link">¶</a></h2> <p>Ceph-CSI supports encrypting PersistentVolumeClaims (PVCs) for both RBD and CephFS. This can be achieved using LUKS for RBD and fscrypt for CephFS. More details on encrypting RBD PVCs can be found <a href=https://github.com/ceph/ceph-csi/blob/v3.13.1/docs/deploy-rbd.md#encryption-for-rbd-volumes>here</a>, which includes a full list of supported encryption configurations. More details on encrypting CephFS PVCs can be found <a href=https://github.com/ceph/ceph-csi/blob/v3.13.1/docs/deploy-cephfs.md#cephfs-volume-encryption>here</a>. A sample KMS configmap can be found <a href=https://github.com/ceph/ceph-csi/blob/v3.13.1/examples/kms/vault/kms-config.yaml>here</a>.</p> <div class="admonition note"> <p class=admonition-title>Note</p> <p>Not all KMS are compatible with fscrypt. Generally, KMS that either store secrets to use directly (like Vault) or allow access to the plain password (like Kubernetes Secrets) are compatible.</p> </div> <div class="admonition note"> <p class=admonition-title>Note</p> <p>Rook also supports OSD-level encryption (see <code>encryptedDevice</code> option <a href=../../../CRDs/Cluster/ceph-cluster-crd/#osd-configuration-settings>here</a>).</p> </div> <p>Using both RBD PVC encryption and OSD encryption at the same time will lead to double encryption and may reduce read/write performance.</p> <p>Existing Ceph clusters can also enable Ceph-CSI PVC encryption support and multiple kinds of encryption KMS can be used on the same Ceph cluster using different storageclasses.</p> <p>The following steps demonstrate the common process for enabling encryption support for both RBD and CephFS:</p> <ul> <li>Create the <code>rook-ceph-csi-kms-config</code> configmap with required encryption configuration in the same namespace where the Rook operator is deployed. An example is shown below:</li> </ul> <div class=highlight><table class=highlighttable><tr><td class=linenos><div class=linenodiv><pre><span></span><span class=normal><a href=#__codelineno-6-1> 1</a></span>
0 commit comments