Pure Storage FlashBlade: verify SSL certificate by default

The FlashBlade share driver unconditionally called disable_verify_ssl()
during do_setup(), leaving the management connection to the array with no
certificate verification and open to man-in-the-middle attacks, with no
way for an operator to enable verification.

This adds two configuration options:

* flashblade_ssl_cert_verify (boolean, default True) - verify the
  certificate presented by the FlashBlade management interface.
* flashblade_ca_cert_path (string) - optional path to a CA certificate
  bundle used for verification, for self-signed or private CAs.

Certificate verification is now enabled by default. Deployments using a
self-signed or private CA certificate must supply the CA bundle via
flashblade_ca_cert_path, install it in the system trust store, or
explicitly set flashblade_ssl_cert_verify = False to retain the previous
behaviour.

The driver version is also bumped to 11.0.0 for the 2026.2 (Hibiscus)
release.

This addresses the insecure-by-default driver concerns raised in the
openstack-discuss security documentation thread.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Change-Id: I93c5081763af6b1623ac243c25059264a0f185ff
Signed-off-by: Simon Dodsley <simon@purestorage.com>

doc/source/configuration/tables/manila-purestorage-flashblade.inc

@@ -16,3 +16,7 @@
      - (String) API token for an administrative level user account.
    * - ``flashblade_eradicate`` = ``True``
      - (Boolean) Enable or disable filesystem and snapshot eradication on delete.
+   * - ``flashblade_ssl_cert_verify`` = ``True``
+     - (Boolean) Verify the SSL certificate presented by the FlashBlade management interface. Enabled by default. Use ``flashblade_ca_cert_path`` to supply a CA bundle for self-signed or private CA certificates.
+   * - ``flashblade_ca_cert_path`` = ``None``
+     - (String) Path to a CA certificate bundle file (PEM) used to verify the FlashBlade management interface's SSL certificate when ``flashblade_ssl_cert_verify`` is True.

manila/share/drivers/purestorage/flashblade.py

@@ -48,6 +48,23 @@ flashblade_connection_opts = [
         "to be the preferred IP address, although is not "
         "enforced.",
     ),
+    cfg.BoolOpt(
+        "flashblade_ssl_cert_verify",
+        default=True,
+        help="If set to True, the driver verifies the SSL certificate "
+        "presented by the FlashBlade management interface. This is "
+        "enabled by default. If the FlashBlade uses a self-signed or "
+        "private CA certificate, supply the CA certificate bundle via "
+        "flashblade_ca_cert_path. Setting this to False disables "
+        "verification and is not recommended.",
+    ),
+    cfg.StrOpt(
+        "flashblade_ca_cert_path",
+        help="Path to a CA certificate bundle file (PEM format) used to "
+        "verify the FlashBlade management interface's SSL certificate. "
+        "Only used when flashblade_ssl_cert_verify is True. If unset, "
+        "the system default CA certificates are used.",
+    ),
 ]
 
 flashblade_auth_opts = [
@@ -103,10 +120,11 @@ class FlashBladeShareDriver(driver.ShareDriver):
        8.0.0 - 2025.1 (Epoxy) release
        9.0.0 - 2025.2 (Flamingo) release
        10.0.0 - 2026.1 (Gazpacho) release
+       11.0.0 - 2026.2 (Hibiscus) release
 
     """
 
-    VERSION = "10.0"  # driver version
+    VERSION = "11.0"  # driver version
     USER_AGENT_BASE = "OpenStack Manila"
 
     def __init__(self, *args, **kwargs):
@@ -138,7 +156,17 @@ class FlashBladeShareDriver(driver.ShareDriver):
             "flashblade_data_vip"
         )
         self._sys = purity_fb.PurityFb(self.management_address)
-        self._sys.disable_verify_ssl()
+        if self.configuration.flashblade_ssl_cert_verify:
+            self._sys.enable_verify_ssl(
+                self.configuration.flashblade_ca_cert_path
+            )
+        else:
+            LOG.warning(
+                "SSL certificate verification is disabled for the "
+                "FlashBlade management connection. Enable "
+                "flashblade_ssl_cert_verify to secure this connection."
+            )
+            self._sys.disable_verify_ssl()
         try:
             self._sys.login(self.api)
             self._sys._api_client.user_agent = self._user_agent

manila/tests/share/drivers/purestorage/test_flashblade.py

@@ -86,6 +86,8 @@ class FlashBladeDriverTestCaseBase(test.TestCase):
         self.configuration.flashblade_data_vip = ["mockfb2"]
         self.configuration.flashblade_api = "api"
         self.configuration.flashblade_eradicate = True
+        self.configuration.flashblade_ssl_cert_verify = True
+        self.configuration.flashblade_ca_cert_path = None
 
         self.configuration.driver_handles_share_servers = False
         self._mock_filesystem = mock.Mock()
@@ -175,6 +177,32 @@ class FlashBladeDriverTestCase(FlashBladeDriverTestCaseBase):
             exception.BadConfigurationException, self.driver.do_setup, None
         )
 
+    def test_ssl_cert_verify_enabled_by_default(self):
+        self._sys.enable_verify_ssl.reset_mock()
+        self._sys.disable_verify_ssl.reset_mock()
+        self.configuration.flashblade_ssl_cert_verify = True
+        self.configuration.flashblade_ca_cert_path = None
+        self.driver.do_setup(None)
+        self._sys.enable_verify_ssl.assert_called_once_with(None)
+        self._sys.disable_verify_ssl.assert_not_called()
+
+    def test_ssl_cert_verify_with_ca_cert_path(self):
+        self._sys.enable_verify_ssl.reset_mock()
+        self.configuration.flashblade_ssl_cert_verify = True
+        self.configuration.flashblade_ca_cert_path = "/etc/ssl/fb-ca.pem"
+        self.driver.do_setup(None)
+        self._sys.enable_verify_ssl.assert_called_once_with(
+            "/etc/ssl/fb-ca.pem"
+        )
+
+    def test_ssl_cert_verify_disabled(self):
+        self._sys.enable_verify_ssl.reset_mock()
+        self._sys.disable_verify_ssl.reset_mock()
+        self.configuration.flashblade_ssl_cert_verify = False
+        self.driver.do_setup(None)
+        self._sys.disable_verify_ssl.assert_called_once_with()
+        self._sys.enable_verify_ssl.assert_not_called()
+
     def test_create_share_incorrect_protocol(self):
         test_nfs_share.share_proto = "CIFS"
         self.assertRaises(

releasenotes/notes/flashblade-ssl-cert-verify-7c1e2a9b4d6f8a30.yaml

@@ -0,0 +1,20 @@
+---
+security:
+  - |
+    The Pure Storage FlashBlade share driver now verifies the SSL
+    certificate presented by the FlashBlade management interface by
+    default. Previously certificate verification was unconditionally
+    disabled, which left the management connection open to
+    man-in-the-middle attacks. A new ``flashblade_ssl_cert_verify``
+    option (default ``True``) controls this behaviour, and
+    ``flashblade_ca_cert_path`` may be used to supply a CA certificate
+    bundle for self-signed or private CA certificates.
+upgrade:
+  - |
+    Certificate verification is now enabled by default for the Pure
+    Storage FlashBlade share driver. Deployments whose FlashBlade uses a
+    self-signed or private CA certificate must either supply the CA
+    bundle via ``flashblade_ca_cert_path``, install the certificate in
+    the system trust store, or explicitly set
+    ``flashblade_ssl_cert_verify = False`` (not recommended) to retain
+    the previous behaviour.