add support for enabling clusterwide encryption as day-2 operation

Signed-off-by: Santosh Pillai <[email protected]>

controllers/storagecluster/cephcluster.go

@@ -271,6 +271,14 @@ func (obj *ocsCephCluster) ensureCreated(r *StorageClusterReconciler, sc *ocsv1.
 	// Update OSD store to `bluestore`
 	cephCluster.Spec.Storage.Store = updateOSDStore(found.Spec.Storage.Store)
 
+	// confirm OSD migration if encryption is enabled as day-2 operation
+	if isEncrptionSettingUpdated(sc.Spec.Encryption.ClusterWide, found.Spec.Storage.StorageClassDeviceSets) {
+		cephCluster.Spec.Storage.Migration.Confirmation = "yes-really-migrate-osds"
+	} else {
+		// keeping the same expected state in the corresponding reconcile once encryption is enabled
+		cephCluster.Spec.Storage.Migration.Confirmation = found.Spec.Storage.Migration.Confirmation
+	}
+
 	// Add it to the list of RelatedObjects if found
 	objectRef, err := reference.GetReference(r.Scheme, found)
 	if err != nil {
@@ -1399,3 +1407,14 @@ func determineDefaultCephDeviceClass(foundDeviceClasses []rookCephv1.DeviceClass
 	// if no device classes are found in status return empty string
 	return ""
 }
+
+// isEncrptionSettingUpdated checks whether ecryption was enabled or disabled by comparing the new clusterWide encryption setting
+// with the encryption setting on existing StorageClassDeviceSets.
+func isEncrptionSettingUpdated(clusterWideEncrytion bool, existingDeviceSet []rookCephv1.StorageClassDeviceSet) bool {
+	for i := range existingDeviceSet {
+		if existingDeviceSet[i].Encrypted != clusterWideEncrytion {
+			return true
+		}
+	}
+	return false
+}

controllers/storagecluster/cephcluster_test.go

@@ -1675,3 +1675,24 @@ func TestDetermineDefaultCephDeviceClass(t *testing.T) {
 		assert.Equal(t, c.expectedDeviceClass, actual)
 	}
 }
+
+func TestIsEncrptionSettingUpdated(t *testing.T) {
+	newStorageClassDeviceSet := []rookCephv1.StorageClassDeviceSet{
+		{
+			Name:      "set1",
+			Encrypted: false,
+		},
+		{
+			Name:      "set2",
+			Encrypted: false,
+		},
+	}
+
+	// encryption setting has changed
+	actualResult := isEncrptionSettingUpdated(true, newStorageClassDeviceSet)
+	assert.Equal(t, true, actualResult)
+
+	// encryption setting has not changed
+	actualResult = isEncrptionSettingUpdated(false, newStorageClassDeviceSet)
+	assert.Equal(t, false, actualResult)
+}