Ceph » Orchestrator

The rook team is working on adding LDAP and Kerberos support to the pods running nfs-ganesha. In order to enable "kerberized" connections the nfs protocol supports options like kerberos encryption or kerberos message integrity. Ganesha has a "SecType" option in the export configuration that can be used to select between the kerberos levels in the nfs protocol. So, for example, one export might require "krb5p" (encryption only) while another may supply "krb5p", "krb5i", "sys" (meaning prefer encryption, but fall back to message integrity or no kerberos as needed).

Note that this change will only add the option to the Ganesha config. It will have no impact on NFS servers deployed by cephadm today because those containers do not support integration with ldap/krb5 stack at this time.