Describe the feature you'd like to have

Add DH-CHAP authentication to the NVMe-oF CSI driver for secure storage connections.

What is DH-CHAP?

DH-CHAP is NVMe's authentication protocol - like requiring a password before accessing storage, but cryptographically secure. It prevents unauthorized nodes from accessing volumes.

Modes

• Bidirectional: Host and storage both authenticate (recommended for production)
• Unidirectional: Only host authenticates to storage
• None: No authentication (default, backward compatible)

Required by PM.

Acceptance Criteria

Configuration

• Add dhchapMode parameter: none/unidirectional/bidirectional
• Backward compatible (existing env work without changes)

Key Management

• Auto-generate secure DH-CHAP keys per node-subsystem connection
• Store encrypted keys in Kubernetes Secrets (or Vault for production)
• Auto-cleanup when volumes/hosts removed

Volume Operations

• ControllerPublishVolume: Generate host key, pass to gateway AddHost
• NodeStageVolume: Retrieve key, connect with nvme connect --dhchap-secret
• ControllerUnpublishVolume: Cleanup keys when last volume detached
• Clear error messages on authentication failures

Security

• Keys never logged or exposed
• Unique keys per connection (no reuse)

Example Configuration

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: ceph-nvmeof-secure
provisioner: nvmeof.csi.ceph.com
parameters:
  subsystemNQN: "nqn.2024-01.io.ceph:csi"
  dhchapMode: "unidirectional"  # <-- NEW
  # ... other params

Future Work

• Key rotation support
• External KMS integration (Vault)