docs: DHCHAP kernel requirement and the enforcement parameter - #211
Open
boddumanohar wants to merge 1 commit into
Open
docs: DHCHAP kernel requirement and the enforcement parameter#211boddumanohar wants to merge 1 commit into
boddumanohar wants to merge 1 commit into
Conversation
…meter DH-HMAC-CHAP needs an initiator kernel built for it, which is a build option and not a kernel version: a RHEL 9.6 kernel (5.14) carries in-band authentication, a Talos 1.12 kernel (6.18) does not. The option is CONFIG_NVME_HOST_AUTH since kernel 6.7 and CONFIG_NVME_AUTH before it, and on a 6.7 or later kernel the older name refers to the shared library that target-side support also selects, so it does not imply initiator support. Documents the /dev/nvme-fabrics probe as the check that avoids the question. dhchap_node_label is what carries the allowed-node restriction onto a volume, so a hand-written StorageClass that omits it provisions volumes with no nodeAffinity while the pool still reports DHCHAP as enabled. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
|
🤖: Deployment available as https://docstest.simplyblock.io/docs-dhchap-kernel-requirements |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two things a customer configuring DHCHAP had no way to find out.
The initiator kernel has to be built for it. Not a kernel version requirement: a RHEL 9.6 kernel (5.14) supports
DH-HMAC-CHAP, a Talos 1.12 kernel (6.18) does not. The option is
CONFIG_NVME_HOST_AUTHsince kernel 6.7 andCONFIG_NVME_AUTHbefore that, and on 6.7+ the older name refers to the shared library that target-side support alsoselects, so finding it set means nothing for an initiator. Documents the
/dev/nvme-fabricsprobe, which answers thequestion without knowing any of that, and the
option "dhchap_secret" ignoredfailure it produces when missing.dhchap_node_labelis what enforces the allowed nodes. A hand-written StorageClass that names a DHCHAP pool butomits the parameter provisions volumes with no
nodeAffinity, so no node restriction applies while the pool stillreports DHCHAP as enabled.
Kernel detail sits once on the NVMe-oF Security concepts page; the two security pages state the requirement and link
to it. Additive only, no existing text rewritten.
🤖 Generated with Claude Code