add possibility for nfs tls mounts / xprtsec=mtls

[eingemaischt]

We are using TLS for our nfs mounts - this is relatively easy and enables stream encryption and certificate authentication between nfs client and server.

An example for a configuration for linux clients and server can be find here:
https://forums.gentoo.org/viewtopic-p-8843922.html

Is it possible to make xprtsec usable with csi-driver-nfs for StorageClasses, too?

It would really help a lot and secure our connections (currently we are using a wireguard...)

[andyzhangx]

seems it's related to config on the node? how is this related to csi driver?

[eingemaischt]

For nfs over tls a newer kernel and a daemon for handling tls offload to the kernel is needed ( ktls-utils ). https://wiki.archlinux.org/title/NFS#TLS_encryption

Or can csi driver communicate with the ktls-config on the node? That would be neat because then certificate configuration and CA-checking would be done on the node. Maybe it is only needed to mount a socket to the container?