The Helm chart and the encr-keys volume

[dhess]

Thanks for this project! It appears to be quite comprehensive and well thought-out.

It's possible I'm missing something, but as far as I can tell, this project's Helm chart creates a node DaemonSet that always mounts an encr-keys volume, always uses a hostPath with path /home/keys to back this volume, and provides no way to override this aspect of the configuration.

On Talos systems, at least, /home is read-only, and even if /home/keys were bind-mounted to a writable hostPath, it would likely be ephemeral, as by default, Talos doesn't preserve the contents of the OS volume on upgrades. But even on Kubernetes nodes with writable, persistent hostPaths, personally, I would never store encryption keys this way on a Kubernetes node for any number of reasons.

The Helm chart should make it possible to do any of the following:

• change the encr-keys volume hostPath from the default /home/keys;
• back the encr-keys volume with a Kubernetes secret, rather than a hostPath; or
• elide the encr-keys volume altogether, if the admin has no plans to use encryption

[hrudaya21]

@dhess You can try changing the path in the HelmChart to your custom directory as below.
https://github.com/openebs/zfs-localpv/blob/develop/deploy/helm/charts/templates/zfs-node.yaml#L120

[dhess]

@hrudaya21 Sorry, I'm not sure I follow. You've pointed to the chart's template, but the template provides no way to override or otherwise change the default /home/keys path, nor the DirectoryOrCreate type. If I try to override it by re-specifying the encr-keys volume in zfsNode.additionalVolumes, then Helm errors out, presumably because it can't be given twice in the volumes list.

Are you suggesting that I edit the template and then apply my own version of the chart?

[hrudaya21]

@dhess Yes, that is one the option to do if you are doing the local installation. But I will recommend to have the dynamic value in value.yaml which will be read in the template. If possible please contribute to the repo to do this changes.

[trunet]

I just submitted #487 PR. The default behavior is still hostPath /home/keys, but this adds the possibility to change it.

Should be low risk to merge and release to make possible to use this CSI in talos.