Configuring TLS settings for NFS

Enable and customize TLS settings in NFS to secure NFS traffic with encryption and optional mutual authentication.

About this task

TLS settings in NFS control how encrypted communication is established between clients and the server. When you deploy the NFS service using this specification, certificates are generated and configured automatically based on the selected certificate source. The TLS settings also define the cipher suites, minimum protocol version, and optional features such as Kernel TLS (KTLS) and debugging.

Procedure

Deploy or update the NFS service specification file with TLS and SSL configuration.
The following example shows an NFS service specification with TLS and SSL configuration by using inline certificates. 

.. code-block:: yaml

    service_type: nfs
    service_id: mynfs
    placement:
      hosts:
      - ceph-node-0
    spec:
      port: 12345
      ssl: true
      certificate_source: inline|reference|cephadm-signed
      ssl_cert: |
        -----BEGIN CERTIFICATE-----
        (PEM cert contents here)
        -----END CERTIFICATE-----
      ssl_key: |
        -----BEGIN PRIVATE KEY-----
        (PEM key contents here)
        -----END PRIVATE KEY-----
      ssl_ca_cert:
        -----BEGIN PRIVATE KEY-----
        (PEM key contents here)
        -----END PRIVATE KEY-----
      tls_ktls: true
      tls_debug: true
      tls_min_version: TLSv1.3
      tls_ciphers: AES-256

TLS configuration parameters and their default values are listed in Table 1.

Table 1. NFS TLS parameters (inline certificate example)
Parameter Default Description
service_type nfs Defines the service type to deploy.
service_id mynfs Identifier for the NFS service instance.
placement "" Defines where the NFS service is deployed, including host selection and scheduling constraints.
hosts ceph-node-0 Host (or hosts) where the NFS service runs.
port 12345 TCP port that the NFS service listens on.
ssl true Enable or disable TLS for the NFS service.
certificate_source inline | reference | cephadm-signed Location of certificate material: inline content, external reference, or cephadm-signed.
ssl_cert (PEM certificate) Server certificate in PEM format (used when certificate_source is inline).
ssl_key (PEM private key) Server private key in PEM format matching ssl_cert.
ssl_ca_cert (PEM CA certificate) CA certificate (or chain) in PEM format used to validate the server certificate.
tls_ktls true Enable Kernel TLS acceleration if supported by the platform.
tls_debug true Enable detailed TLS debugging logs (use only for troubleshooting).
tls_min_version TLSv1.3 Minimum supported TLS protocol version.
tls_ciphers AES-256 Cipher suite policy for TLS connections.

Results

In case of configuration failure, you can configure TLS settings for NFS manually. For more information, see Manually configuring TLS settings for NFS.