HAProxy_Host has possible ergonomic issues (for large clusters) about nfs-ganesha HOT 3 OPEN

I have followed some of the NFS over TLS, but not closely. TLS IS on our radar. but it's a resource issue. As long as the certificates are easy to match with services, yes, we can use that to match instead of an IP address.

from nfs-ganesha.

When we get to TLS, we could consider allowing a bypass for TLS, but note that clients will want to use TLS, so we will need some way to indentify what services each TLS connection is allowed. So we may still end up with the same list :-)

Hmm, could there be some way to use a DNS wildcard instead of an IP address?

from nfs-ganesha.

Sure, I was specifically thinking of the case where we could use mTLS such that the ganshsa server would only trust clients (haproxy) with matching certs (and vice versa for haproxy). Since cephadm would be distributing/managing what certs get assigned to the containers, this fits our use case very well, but I realize there are uses for TLS in general outside of that for Ganesha. :-)

from nfs-ganesha.