docs: DHCHAP kernel requirement and the enforcement parameter - #211
Open
boddumanohar wants to merge 4 commits into
Open
docs: DHCHAP kernel requirement and the enforcement parameter#211boddumanohar wants to merge 4 commits into
boddumanohar wants to merge 4 commits into
Conversation
…meter DH-HMAC-CHAP needs an initiator kernel built for it, which is a build option and not a kernel version: a RHEL 9.6 kernel (5.14) carries in-band authentication, a Talos 1.12 kernel (6.18) does not. The option is CONFIG_NVME_HOST_AUTH since kernel 6.7 and CONFIG_NVME_AUTH before it, and on a 6.7 or later kernel the older name refers to the shared library that target-side support also selects, so it does not imply initiator support. Documents the /dev/nvme-fabrics probe as the check that avoids the question. dhchap_node_label is what carries the allowed-node restriction onto a volume, so a hand-written StorageClass that omits it provisions volumes with no nodeAffinity while the pool still reports DHCHAP as enabled. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
|
🤖: Deployment available as https://docstest.simplyblock.io/docs-dhchap-kernel-requirements |
The parameter was documented as mandatory for a hand-written class, but never with the value to put in it, which is not guessable: it is a label key derived from the pool as simplyblock.io/pool.<namespace>.<storageCluster CR name>.<pool name>, and neither segment is the UUID a user would reach for first. Add the format, a segment-by-segment breakdown, a worked StorageClass, and the two commands that read the key off a node or off the generated class instead of deriving it. Note that a wrong key is not rejected and only surfaces as Pods stuck Pending. Also correct the enforcement description to match the operator: the allowed-node restriction rides on the PV's nodeAffinity alone, not on the StorageClass's allowedTopologies. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
|
🤖: Deployment available as https://docstest.simplyblock.io/docs-dhchap-kernel-requirements |
The operator now writes dhchap_node_selector and CreateVolume prefers it. dhchap_node_label stays readable as a deprecated alias, so document the new name throughout and note that the old one still gates an existing StorageClass, which cannot be renamed in place because StorageClass parameters are immutable. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
|
🤖: Deployment available as https://docstest.simplyblock.io/docs-dhchap-kernel-requirements |
The alias was removed from the driver, so dhchap_node_selector is the only name the parameter has ever had in a release. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
|
🤖: Deployment available as https://docstest.simplyblock.io/docs-dhchap-kernel-requirements |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two things a customer configuring DHCHAP had no way to find out.
The initiator kernel has to be built for it. Not a kernel version requirement: a RHEL 9.6 kernel (5.14) supports
DH-HMAC-CHAP, a Talos 1.12 kernel (6.18) does not. The option is
CONFIG_NVME_HOST_AUTHsince kernel 6.7 andCONFIG_NVME_AUTHbefore that, and on 6.7+ the older name refers to the shared library that target-side support alsoselects, so finding it set means nothing for an initiator. Documents the
/dev/nvme-fabricsprobe, which answers thequestion without knowing any of that, and the
option "dhchap_secret" ignoredfailure it produces when missing.dhchap_node_labelis what enforces the allowed nodes. A hand-written StorageClass that names a DHCHAP pool butomits the parameter provisions volumes with no
nodeAffinity, so no node restriction applies while the pool stillreports DHCHAP as enabled.
Kernel detail sits once on the NVMe-oF Security concepts page; the two security pages state the requirement and link
to it. Additive only, no existing text rewritten.
🤖 Generated with Claude Code