From 648cfd9236dce301e5a694a3c02b41f3bc1ec608 Mon Sep 17 00:00:00 2001 From: Gil Bregman Date: Thu, 17 Jul 2025 14:29:34 +0300 Subject: [PATCH] imgr/cephadm/nvmeof: Add "force TLS" flag to NVMeOF spec file. Fixes: https://tracker.ceph.com/issues/72172 Signed-off-by: Gil Bregman --- .../mgr/cephadm/templates/services/nvmeof/ceph-nvmeof.conf.j2 | 1 + src/pybind/mgr/cephadm/tests/test_services.py | 1 + src/python-common/ceph/deployment/service_spec.py | 4 ++++ 3 files changed, 6 insertions(+) diff --git a/src/pybind/mgr/cephadm/templates/services/nvmeof/ceph-nvmeof.conf.j2 b/src/pybind/mgr/cephadm/templates/services/nvmeof/ceph-nvmeof.conf.j2 index f28b6205a04c4..d16a06adb2c6f 100644 --- a/src/pybind/mgr/cephadm/templates/services/nvmeof/ceph-nvmeof.conf.j2 +++ b/src/pybind/mgr/cephadm/templates/services/nvmeof/ceph-nvmeof.conf.j2 @@ -44,6 +44,7 @@ max_namespaces = {{ spec.max_namespaces }} max_namespaces_per_subsystem = {{ spec.max_namespaces_per_subsystem }} max_hosts_per_subsystem = {{ spec.max_hosts_per_subsystem }} subsystem_cache_expiration = {{ spec.subsystem_cache_expiration }} +force_tls = {{ spec.force_tls }} [gateway-logs] log_level = {{ spec.log_level }} diff --git a/src/pybind/mgr/cephadm/tests/test_services.py b/src/pybind/mgr/cephadm/tests/test_services.py index 13cc9d1d950ef..e82224157c3fd 100644 --- a/src/pybind/mgr/cephadm/tests/test_services.py +++ b/src/pybind/mgr/cephadm/tests/test_services.py @@ -393,6 +393,7 @@ max_namespaces = 4096 max_namespaces_per_subsystem = 512 max_hosts_per_subsystem = 128 subsystem_cache_expiration = 5 +force_tls = False [gateway-logs] log_level = INFO diff --git a/src/python-common/ceph/deployment/service_spec.py b/src/python-common/ceph/deployment/service_spec.py index d743b757e3b6d..45507ef391351 100644 --- a/src/python-common/ceph/deployment/service_spec.py +++ b/src/python-common/ceph/deployment/service_spec.py @@ -1437,6 +1437,7 @@ class NvmeofServiceSpec(ServiceSpec): max_namespaces_per_subsystem: Optional[int] = 512, max_hosts_per_subsystem: Optional[int] = 128, subsystem_cache_expiration: Optional[int] = 5, + force_tls: Optional[bool] = False, server_key: Optional[str] = None, server_cert: Optional[str] = None, client_key: Optional[str] = None, @@ -1571,6 +1572,8 @@ class NvmeofServiceSpec(ServiceSpec): self.max_hosts_per_subsystem = max_hosts_per_subsystem #: ``subsystem_cache_expiration`` number of seconds before subsystems cache expires self.subsystem_cache_expiration = subsystem_cache_expiration + #: ``force_tls`` force using TLS when adding hosts and listeners + self.force_tls = force_tls #: ``allowed_consecutive_spdk_ping_failures`` # of ping failures before aborting gateway self.allowed_consecutive_spdk_ping_failures = allowed_consecutive_spdk_ping_failures #: ``spdk_ping_interval_in_seconds`` sleep interval in seconds between SPDK pings @@ -1775,6 +1778,7 @@ class NvmeofServiceSpec(ServiceSpec): verify_positive_int(self.max_hosts_per_subsystem, "Max hosts per subsystem") verify_non_negative_number(self.subsystem_cache_expiration, "Subsystem cache expiration period") + verify_boolean(self.force_tls, "Force TLS") verify_non_negative_number(self.monitor_timeout, "Monitor timeout") verify_non_negative_int(self.port, "Port") verify_non_negative_int(self.discovery_port, "Discovery port") -- 2.39.5