Repository: rook/rook
Pull request #10278 (2022-05-18 13:36:55)

csi: make storage class updated with csi-users in external cluster
<!-- Please take a look at our [Contributing](https://rook.io/docs/rook/latest/development-flow.html)
documentation before submitting a Pull Request!
Thank you for contributing to Rook! -->

**Description of your changes:**
For using restricted auth users we need to update the
restricted users in the Storage class, so updating
it is in the JSON output for the external cluster
    

**Which issue is resolved by this Pull Request:**
Resolves #

**Checklist:**

- [ ] **Commit Message Formatting**: Commit titles and messages follow guidelines in the [developer guide](https://rook.io/docs/rook/latest/development-flow.html#commit-structure).
- [ ] **Skip Tests for Docs**: If this is only a documentation change, add the label `skip-ci` on the PR.
- [ ] Reviewed the developer guide on [Submitting a Pull Request](https://rook.io/docs/rook/latest/development-flow.html#submitting-a-pull-request)
- [ ] [Pending release notes](https://github.com/rook/rook/blob/master/PendingReleaseNotes.md) updated with breaking and/or notable changes for the next minor release.
- [ ] Documentation has been updated, if necessary.
- [ ] Unit tests have been added, if necessary.
- [ ] Integration tests have been added, if necessary.


parth-gr: The testing looks good

```
parameters:
  clusterID: openshift-storage
  csi.storage.k8s.io/controller-expand-secret-name: rook-csi-cephfs-provisioner-vavuthurauthperm-cephfs
  csi.storage.k8s.io/controller-expand-secret-namespace: openshift-storage
  csi.storage.k8s.io/node-stage-secret-name: rook-csi-cephfs-node-vavuthurauthperm-cephfs
  csi.storage.k8s.io/node-stage-secret-namespace: openshift-storage
  csi.storage.k8s.io/provisioner-secret-name: rook-csi-cephfs-provisioner-vavuthurauthperm-cephfs
  csi.storage.k8s.io/provisioner-secret-namespace: openshift-storage
  fsName: cephfs
  pool: cephfs_data
```

```
parameters:
  clusterID: openshift-storage
  csi.storage.k8s.io/controller-expand-secret-name: rook-csi-rbd-provisioner-vavuthurauthperm-rbd
  csi.storage.k8s.io/controller-expand-secret-namespace: openshift-storage
  csi.storage.k8s.io/fstype: ext4
  csi.storage.k8s.io/node-stage-secret-name: rook-csi-rbd-node-vavuthurauthperm-rbd
  csi.storage.k8s.io/node-stage-secret-namespace: openshift-storage
  csi.storage.k8s.io/provisioner-secret-name: rook-csi-rbd-provisioner-vavuthurauthperm-rbd
  csi.storage.k8s.io/provisioner-secret-namespace: openshift-storage
  imageFeatures: layering
  imageFormat: "2"
  pool: rbd
provisioner: openshift-storage.rbd.csi.ceph.com
```
Madhu-1: > > @parth-gr I suggest you test deploying operator in one namespace and creating a ceph cluster in another namespace.
> 
> Okay, I have updated the result of downstream testing, upstream still needs to check(need to create a standalone ceph cluster), Downstream doesn't use this import-external script

I would suggest doing this one. For example, create rook in the `rook-ceph` namespace and import the ceph cluster in the `rook-ceph-external` namespace.
parth-gr: > > > @parth-gr I suggest you test deploying operator in one namespace and creating a ceph cluster in another namespace.
> > 
> > 
> > Okay, I have updated the result of downstream testing, upstream still needs to check(need to create a standalone ceph cluster), Downstream doesn't use this import-external script
> 
> I would suggest doing this one. For example, create rook in the `rook-ceph` namespace and import the ceph cluster in the `rook-ceph-external` namespace.

@Madhu-1 @leseb verified this way there were a lot of issues in import script for upstream fixed it,
I would request you to please have a final review,

Testing:
CEPHCLUSTER:
```
 kubectl get cephcluster -nrook-ceph-external
NAME                 DATADIRHOSTPATH   MONCOUNT   AGE   PHASE       MESSAGE                          HEALTH      EXTERNAL
rook-ceph-external                                9h    Connected   Cluster connected successfully   HEALTH_OK   true
```
SC:
```
kubectl get sc -nrook-ceph-external
NAME                 PROVISIONER                              RECLAIMPOLICY   VOLUMEBINDINGMODE   ALLOWVOLUMEEXPANSION   AGE
ceph-rbd             rook-ceph-external.rbd.csi.ceph.com      Delete          Immediate           true                   17m
cephfs               rook-ceph-external.cephfs.csi.ceph.com   Delete          Immediate           true                   17m
standard (default)   k8s.io/minikube-hostpath                 Delete          Immediate           false                  23d
```

OPerator:
```
kubectl get pods -nrook-ceph       
rook-ceph-operator-65ddb87bcb-5qxp9             1/1     Running   0          2m
```
mergify[bot]: This pull request has merge conflicts that must be resolved before it can be merged. @parth-gr please rebase it. https://rook.io/docs/rook/latest/Contributing/development-flow/#updating-your-fork
parth-gr: > > > > @parth-gr I suggest you test deploying operator in one namespace and creating a ceph cluster in another namespace.
> > > 
> > > 
> > > Okay, I have updated the result of downstream testing, upstream still needs to check(need to create a standalone ceph cluster), Downstream doesn't use this import-external script
> > 
> > 
> > I would suggest doing this one. For example, create rook in the `rook-ceph` namespace and import the ceph cluster in the `rook-ceph-external` namespace.
> 
> @Madhu-1 @leseb verified this way there were a lot of issues in import script for upstream fixed it, I would request you to please have a final review,
> 
> Testing: CEPHCLUSTER:
> 
> ```
>  kubectl get cephcluster -nrook-ceph-external
> NAME                 DATADIRHOSTPATH   MONCOUNT   AGE   PHASE       MESSAGE                          HEALTH      EXTERNAL
> rook-ceph-external                                9h    Connected   Cluster connected successfully   HEALTH_OK   true
> ```
> 
> SC:
> 
> ```
> kubectl get sc -nrook-ceph-external
> NAME                 PROVISIONER                              RECLAIMPOLICY   VOLUMEBINDINGMODE   ALLOWVOLUMEEXPANSION   AGE
> ceph-rbd             rook-ceph-external.rbd.csi.ceph.com      Delete          Immediate           true                   17m
> cephfs               rook-ceph-external.cephfs.csi.ceph.com   Delete          Immediate           true                   17m
> standard (default)   k8s.io/minikube-hostpath                 Delete          Immediate           false                  23d
> ```
> 
> OPerator:
> 
> ```
> kubectl get pods -nrook-ceph       
> rook-ceph-operator-65ddb87bcb-5qxp9             1/1     Running   0          2m
> ```

PVC creation and pod mount work fine on upstream too, thanks for reviewing and explaining it:)

```
kubectl get pvc
NAME          STATUS   VOLUME                                     CAPACITY   ACCESS MODES   STORAGECLASS   AGE
cephfs-pvc1   Bound    pvc-72990b7f-25e5-44c3-ac54-ccaf1cffbab1   1Gi        RWO            cephfs         4h25m
rbd-pvc1      Bound    pvc-60b0b8c8-135a-479e-9c21-9961c1b588d9   1Gi        RWO            ceph-rbd       4h25m
```
```
kubectl get pods 
NAME                  READY   STATUS    RESTARTS   AGE
csicephfs-demo-pod1   1/1     Running   0          4h27m
csirbd-demo-pod1      1/1     Running   0          4h26m

```



mergify[bot]: This pull request has merge conflicts that must be resolved before it can be merged. @parth-gr please rebase it. https://rook.io/docs/rook/latest/Contributing/development-flow/#updating-your-fork

Patch:
diff --git a/Documentation/CRDs/ceph-cluster-crd.md b/Documentation/CRDs/ceph-cluster-crd.md
index 25d080218..a31e1c10e 100755
--- a/Documentation/CRDs/ceph-cluster-crd.md
+++ b/Documentation/CRDs/ceph-cluster-crd.md
@@ -1367,16 +1367,16 @@ export RGW_POOL_PREFIX=default
 
 1. Deploy Rook-Ceph, create [common.yaml](/deploy/examples/common.yaml), [crds.yaml](/deploy/examples/crds.yaml) and [operator.yaml](/deploy/examples/operator.yaml) manifests.
 
-2. Paste the above output from `create-external-cluster-resources.py` into your current shell to allow importing the source data.
+2. Create [common-external.yaml](/deploy/examples/common-external.yaml) and [cluster-external.yaml](/deploy/examples/cluster-external.yaml)
 
-3. Run the [import](/deploy/examples/import-external-cluster.sh) script.
+3. Paste the above output from `create-external-cluster-resources.py` into your current shell to allow importing the source data.
+
+4. Run the [import](/deploy/examples/import-external-cluster.sh) script.
 
     ```console
     . import-external-cluster.sh
     ```
 
-4. Create [common-external.yaml](/deploy/examples/common-external.yaml) and [cluster-external.yaml](/deploy/examples/cluster-external.yaml)
-
 5. Verify the consumer cluster is connected to the source ceph cluster:
 
     ```console
@@ -1385,54 +1385,15 @@ export RGW_POOL_PREFIX=default
     rook-ceph-external   /var/lib/rook                162m   Connected   HEALTH_OK
     ```
 
-### Create StorageClass
-
-Create a StorageClass based on the pool that was already created in the source Ceph cluster.
-In this example, the pool `replicated_2g` exists in the source cluster.
-
+6. StorageClass will also be created, verify its creation.
 ```console
-cat << EOF | kubectl apply -f -
+kubectl -n rook-ceph-external get sc
 ```
+`ceph-rbd` and `cephfs` StorageClass would be respective name for RBD and CephFS StorageClass.
 
-```yaml
-apiVersion: storage.k8s.io/v1
-kind: StorageClass
-metadata:
-   name: rook-ceph-block-ext
-# Change "rook-ceph" provisioner prefix to match the operator namespace if needed
-provisioner: rook-ceph.rbd.csi.ceph.com
-parameters:
-    # clusterID is the namespace where the rook cluster is running
-    clusterID: rook-ceph-external
-    # Ceph pool into which the RBD image shall be created
-    pool: replicated_2g
-
-    # RBD image format. Defaults to "2".
-    imageFormat: "2"
-
-    # RBD image features. Available for imageFormat: "2". CSI RBD currently supports only `layering` feature.
-    imageFeatures: layering
-
-    # The secrets contain Ceph admin credentials.
-    csi.storage.k8s.io/provisioner-secret-name: rook-csi-rbd-provisioner
-    csi.storage.k8s.io/provisioner-secret-namespace: rook-ceph-external
-    csi.storage.k8s.io/controller-expand-secret-name: rook-csi-rbd-provisioner
-    csi.storage.k8s.io/controller-expand-secret-namespace: rook-ceph-external
-    csi.storage.k8s.io/node-stage-secret-name: rook-csi-rbd-node
-    csi.storage.k8s.io/node-stage-secret-namespace: rook-ceph-external
-
-    # Specify the filesystem type of the volume. If not specified, csi-provisioner
-    # will set default as `ext4`. Note that `xfs` is not recommended due to potential deadlock
-    # in hyperconverged settings where the volume is mounted on the same node as the osds.
-    csi.storage.k8s.io/fstype: ext4
-
-# Delete the rbd volume when a PVC is deleted
-reclaimPolicy: Delete
-allowVolumeExpansion: true
-EOF
-```
+**NOTE:** For CephFS StorageClass you also need to export `CEPHFS_FS_NAME`, `CEPHFS_POOL_NAME` or you can pass these parameters with a CLI flag (--cephfs-data-pool-name,--cephfs-filesystem-name) while running the python script. For creating ECRBDStorageClass you need to pass --rbd-metadata-ec-pool-name CLI flag or export `RBD_METADATA_EC_POOL_NAME`.
 
-You can now create a persistent volume based on this StorageClass.
+7. Then you can now create a [persistent volume](/deploy/examples/csi) based on these StorageClass.
 
 ### CephCluster example (management)
 
diff --git a/deploy/examples/create-external-cluster-resources.py b/deploy/examples/create-external-cluster-resources.py
index cd40b1f0a..4ea0621c2 100644
--- a/deploy/examples/create-external-cluster-resources.py
+++ b/deploy/examples/create-external-cluster-resources.py
@@ -331,11 +331,11 @@ class RadosJSON:
         common_group.add_argument(
             "--restricted-auth-permission",
             default=False,
-            help="Restricted cephCSIKeyrings auth permissions to specific pools, cluster and pool namespaces."
-            + "Mandatory flags that need to be set are --rbd-data-pool-name, --rados-namespace and --cluster-name."
+            help="Restricted cephCSIKeyrings auth permissions to specific pools, cluster."
+            + "Mandatory flags that need to be set are --rbd-data-pool-name, and --cluster-name."
             + "--cephfs-filesystem-name flag can also be passed in case of cephfs user restriction, so it can restrict user to particular cephfs filesystem"
-            + "sample run: `python3 /etc/ceph/create-external-cluster-resources.py --cephfs-filesystem-name myfs --rbd-data-pool-name replicapool --rados-namespace radosNamespace --cluster-name rookStorage --restricted-auth-permission true`"
-            + "Note: Restricting the users per pool, per cluster and per pool namespace will require to create new users and new secrets for that users.",
+            + "sample run: `python3 /etc/ceph/create-external-cluster-resources.py --cephfs-filesystem-name myfs --rbd-data-pool-name replicapool --cluster-name rookStorage --restricted-auth-permission true`"
+            + "Note: Restricting the users per pool, and per cluster will require to create new users and new secrets for that users.",
         )
 
         output_group = argP.add_argument_group("output")
@@ -430,9 +430,9 @@ class RadosJSON:
             help="Upgrades the cephCSIKeyrings(For example: client.csi-cephfs-provisioner) with new permissions needed for the new cluster version and older permission will still be applied."
             + "Sample run: `python3 /etc/ceph/create-external-cluster-resources.py --upgrade`, this will upgrade all the default csi users(non-restricted)"
             + "For restricted users(For example: client.csi-cephfs-provisioner-openshift-storage-myfs), users created using --restricted-auth-permission flag need to pass mandatory flags"
-            + "mandatory flags: '--rbd-data-pool-name, --rados-namespace, --cluster-name and --run-as-user' flags while upgrading"
+            + "mandatory flags: '--rbd-data-pool-name, --cluster-name and --run-as-user' flags while upgrading"
             + "in case of cephfs users if you have passed --cephfs-filesystem-name flag while creating user then while upgrading it will be mandatory too"
-            + "Sample run: `python3 /etc/ceph/create-external-cluster-resources.py --upgrade --rbd-data-pool-name replicapool --rados-namespace radosNamespace --cluster-name rookStorage  --run-as-user client.csi-rbd-node-rookStorage-replicapool-radosNamespace`"
+            + "Sample run: `python3 /etc/ceph/create-external-cluster-resources.py --upgrade --rbd-data-pool-name replicapool --cluster-name rookStorage  --run-as-user client.csi-rbd-node-rookStorage-replicapool`"
             + "PS: An existing non-restricted user cannot be downgraded to a restricted user by upgrading. Admin need to create a new restricted user for this by re-running the script."
             + "Upgrade flag should only be used to append new permissions to users, it shouldn't be used for changing user already applied permission, for example you shouldn't change in which pool user has access",
         )
@@ -826,13 +826,12 @@ class RadosJSON:
         if self._arg_parser.restricted_auth_permission:
             rbd_pool_name = self._arg_parser.rbd_data_pool_name
             cluster_name = self._arg_parser.cluster_name
-            rados_namespace = self._arg_parser.rados_namespace
-            if rbd_pool_name == "" or cluster_name == "" or rados_namespace == "":
+            if rbd_pool_name == "" or cluster_name == "":
                 raise ExecutionFailureException(
-                    "mandatory flags not found, please set the '--rbd-data-pool-name', '--cluster-name' and --rados-namespace flags"
+                    "mandatory flags not found, please set the '--rbd-data-pool-name', '--cluster-name' flags"
                 )
-            entity = "{}-{}-{}-{}".format(
-                entity, cluster_name, rbd_pool_name, rados_namespace
+            entity = "{}-{}-{}".format(
+                entity, cluster_name, rbd_pool_name
             )
             caps["osd"] = "profile rbd pool={}".format(rbd_pool_name)
 
@@ -847,13 +846,12 @@ class RadosJSON:
         if self._arg_parser.restricted_auth_permission:
             rbd_pool_name = self._arg_parser.rbd_data_pool_name
             cluster_name = self._arg_parser.cluster_name
-            rados_namespace = self._arg_parser.rados_namespace
-            if rbd_pool_name == "" or cluster_name == "" or rados_namespace == "":
+            if rbd_pool_name == "" or cluster_name == "":
                 raise ExecutionFailureException(
-                    "mandatory flags not found, please set the '--rbd-data-pool-name', '--cluster-name' and --rados-namespace flags"
+                    "mandatory flags not found, please set the '--rbd-data-pool-name', '--cluster-name' flags"
                 )
-            entity = "{}-{}-{}-{}".format(
-                entity, cluster_name, rbd_pool_name, rados_namespace
+            entity = "{}-{}-{}".format(
+                entity, cluster_name, rbd_pool_name
             )
             caps["osd"] = "profile rbd pool={}".format(rbd_pool_name)
 
@@ -902,11 +900,11 @@ class RadosJSON:
                 + cmd_json["entity"]
                 + " "
                 + " ".join(cmd_json["caps"])
-            )
+            ), ""
         # check if user already exist
         user_key = self.check_user_exist(entity)
         if user_key != "":
-            return user_key
+            return user_key, "{}".format(entity.split('.',1)[1])  # entity.split('.',1)[1] to rename entity(client.csi-rbd-node) as csi-rbd-node
 
         ret_val, json_out, err_msg = self._common_cmd_json_gen(cmd_json)
         # if there is an unsuccessful attempt,
@@ -917,7 +915,7 @@ class RadosJSON:
                     err_msg if ret_val != 0 else self.EMPTY_OUTPUT_LIST
                 )
             )
-        return str(json_out[0]["key"])
+        return str(json_out[0]["key"]), "{}".format(entity.split('.',1)[1])  # entity.split('.',1)[1] to rename entity(client.csi-rbd-node) as csi-rbd-node
 
     def get_cephfs_data_pool_details(self):
         cmd_json = {"prefix": "fs ls", "format": "json"}
@@ -1257,6 +1255,7 @@ class RadosJSON:
     def _gen_output_map(self):
         if self.out_map:
             return
+        self._arg_parser.cluster_name = self._arg_parser.cluster_name.lower() # always convert cluster name to lowercase characters
         if self._arg_parser.rgw_endpoint:
             self._arg_parser.rgw_endpoint = self.convert_fqdn_rgw_endpoint_to_ip(
                 self._arg_parser.rgw_endpoint
@@ -1272,10 +1271,10 @@ class RadosJSON:
         self.out_map["ROOK_EXTERNAL_CEPH_MON_DATA"] = self.get_ceph_external_mon_data()
         self.out_map["ROOK_EXTERNAL_USER_SECRET"] = self.create_checkerKey()
         self.out_map["ROOK_EXTERNAL_DASHBOARD_LINK"] = self.get_ceph_dashboard_link()
-        self.out_map["CSI_RBD_NODE_SECRET"] = self.create_cephCSIKeyring_user(
+        self.out_map["CSI_RBD_NODE_SECRET"], self.out_map['CSI_RBD_NODE_SECRET_NAME'] = self.create_cephCSIKeyring_user(
             "client.csi-rbd-node"
         )
-        self.out_map["CSI_RBD_PROVISIONER_SECRET"] = self.create_cephCSIKeyring_user(
+        self.out_map["CSI_RBD_PROVISIONER_SECRET"], self.out_map['CSI_RBD_PROVISIONER_SECRET_NAME'] = self.create_cephCSIKeyring_user(
             "client.csi-rbd-provisioner"
         )
         self.out_map["CEPHFS_POOL_NAME"] = self._arg_parser.cephfs_data_pool_name
@@ -1291,12 +1290,10 @@ class RadosJSON:
         self.out_map["CSI_CEPHFS_PROVISIONER_SECRET"] = ""
         # create CephFS node and provisioner keyring only when MDS exists
         if self.out_map["CEPHFS_FS_NAME"] and self.out_map["CEPHFS_POOL_NAME"]:
-            self.out_map["CSI_CEPHFS_NODE_SECRET"] = self.create_cephCSIKeyring_user(
+            self.out_map["CSI_CEPHFS_NODE_SECRET"], self.out_map['CSI_CEPHFS_NODE_SECRET_NAME'] = self.create_cephCSIKeyring_user(
                 "client.csi-cephfs-node"
             )
-            self.out_map[
-                "CSI_CEPHFS_PROVISIONER_SECRET"
-            ] = self.create_cephCSIKeyring_user("client.csi-cephfs-provisioner")
+            self.out_map["CSI_CEPHFS_PROVISIONER_SECRET"], self.out_map['CSI_CEPHFS_PROVISIONER_SECRET_NAME'] = self.create_cephCSIKeyring_user("client.csi-cephfs-provisioner")
         self.out_map["RGW_ENDPOINT"] = self._arg_parser.rgw_endpoint
         self.out_map["RGW_TLS_CERT"] = ""
         (
@@ -1373,168 +1370,46 @@ class RadosJSON:
             },
         ]
 
-        if self.out_map["RBD_METADATA_EC_POOL_NAME"]:
-            json_out.append(
-                {
-                    "name": "ceph-rbd",
-                    "kind": "StorageClass",
-                    "data": {
-                        "dataPool": self.out_map["RBD_POOL_NAME"],
-                        "pool": self.out_map["RBD_METADATA_EC_POOL_NAME"],
-                    },
-                }
-            )
-        else:
-            json_out.append(
-                {
-                    "name": "ceph-rbd",
-                    "kind": "StorageClass",
-                    "data": {"pool": self.out_map["RBD_POOL_NAME"]},
-                }
-            )
-
-        if self._arg_parser.restricted_auth_permission:
-            cluster_name = self._arg_parser.cluster_name
-            rbd_pool_name = self._arg_parser.rbd_data_pool_name
-            cephfs_filesystem = self._arg_parser.cephfs_filesystem_name
-            rados_namespace = self._arg_parser.rados_namespace
-            json_out.append(
-                {
-                    "name": "rook-csi-rbd-node-{}-{}-{}".format(
-                        cluster_name, rbd_pool_name, rados_namespace
-                    ),
-                    "kind": "Secret",
-                    "data": {
-                        "userID": "csi-rbd-node-{}-{}-{}".format(
-                            cluster_name, rbd_pool_name, rados_namespace
-                        ),
-                        "userKey": self.out_map["CSI_RBD_NODE_SECRET"],
-                    },
+        # if 'CSI_RBD_NODE_SECRET' exists, then only add 'rook-csi-rbd-provisioner' Secret
+        if self.out_map['CSI_RBD_NODE_SECRET'] and self.out_map["CSI_RBD_NODE_SECRET_NAME"]:
+            json_out.append({
+                "name": "rook-{}".format(self.out_map["CSI_RBD_NODE_SECRET_NAME"]),
+                "kind": "Secret",
+                "data": {
+                    "userID": self.out_map["CSI_RBD_NODE_SECRET_NAME"],
+                    "userKey": self.out_map['CSI_RBD_NODE_SECRET']
                 }
-            )
-            # if 'CSI_RBD_PROVISIONER_SECRET' exists, then only add 'rook-csi-rbd-provisioner' Secret
-            if self.out_map["CSI_RBD_PROVISIONER_SECRET"]:
-                json_out.append(
-                    {
-                        "name": "rook-csi-rbd-provisioner-{}-{}-{}".format(
-                            cluster_name, rbd_pool_name, rados_namespace
-                        ),
-                        "kind": "Secret",
-                        "data": {
-                            "userID": "csi-rbd-provisioner-{}-{}-{}".format(
-                                cluster_name, rbd_pool_name, rados_namespace
-                            ),
-                            "userKey": self.out_map["CSI_RBD_PROVISIONER_SECRET"],
-                        },
-                    }
-                )
-            # if 'CSI_CEPHFS_PROVISIONER_SECRET' exists, then only add 'rook-csi-cephfs-provisioner' Secret
-            if (
-                self.out_map["CSI_CEPHFS_PROVISIONER_SECRET"]
-                and cephfs_filesystem != ""
-            ):
-                json_out.append(
-                    {
-                        "name": "rook-csi-cephfs-provisioner-{}-{}".format(
-                            cluster_name, cephfs_filesystem
-                        ),
-                        "kind": "Secret",
-                        "data": {
-                            "adminID": "csi-cephfs-provisioner-{}-{}".format(
-                                cluster_name, cephfs_filesystem
-                            ),
-                            "adminKey": self.out_map["CSI_CEPHFS_PROVISIONER_SECRET"],
-                        },
-                    }
-                )
-            if (
-                self.out_map["CSI_CEPHFS_PROVISIONER_SECRET"]
-                and cephfs_filesystem == ""
-            ):
-                json_out.append(
-                    {
-                        "name": "rook-csi-cephfs-provisioner-{}".format(cluster_name),
-                        "kind": "Secret",
-                        "data": {
-                            "adminID": "csi-cephfs-provisioner-{}".format(cluster_name),
-                            "adminKey": self.out_map["CSI_CEPHFS_PROVISIONER_SECRET"],
-                        },
-                    }
-                )
-            # if 'CSI_CEPHFS_NODE_SECRET' exists, then only add 'rook-csi-cephfs-node' Secret
-            if self.out_map["CSI_CEPHFS_NODE_SECRET"] and cephfs_filesystem != "":
-                json_out.append(
-                    {
-                        "name": "rook-csi-cephfs-node-{}-{}".format(
-                            cluster_name, cephfs_filesystem
-                        ),
-                        "kind": "Secret",
-                        "data": {
-                            "adminID": "csi-cephfs-node-{}-{}".format(
-                                cluster_name, cephfs_filesystem
-                            ),
-                            "adminKey": self.out_map["CSI_CEPHFS_NODE_SECRET"],
-                        },
-                    }
-                )
-            if self.out_map["CSI_CEPHFS_NODE_SECRET"] and cephfs_filesystem == "":
-                json_out.append(
-                    {
-                        "name": "rook-csi-cephfs-node-{}".format(cluster_name),
-                        "kind": "Secret",
-                        "data": {
-                            "adminID": "csi-cephfs-node-{}".format(cluster_name),
-                            "adminKey": self.out_map["CSI_CEPHFS_NODE_SECRET"],
-                        },
-                    }
-                )
-        else:
-            json_out.append(
-                {
-                    "name": "rook-csi-rbd-node",
-                    "kind": "Secret",
-                    "data": {
-                        "userID": "csi-rbd-node",
-                        "userKey": self.out_map["CSI_RBD_NODE_SECRET"],
-                    },
+            })
+        # if 'CSI_RBD_PROVISIONER_SECRET' exists, then only add 'rook-csi-rbd-provisioner' Secret
+        if self.out_map['CSI_RBD_PROVISIONER_SECRET'] and self.out_map["CSI_RBD_PROVISIONER_SECRET_NAME"]:
+            json_out.append({
+                "name": "rook-{}".format(self.out_map["CSI_RBD_PROVISIONER_SECRET_NAME"]),
+                "kind": "Secret",
+                "data": {
+                    "userID": self.out_map["CSI_RBD_PROVISIONER_SECRET_NAME"],
+                    "userKey": self.out_map['CSI_RBD_PROVISIONER_SECRET']
+                },
+            })
+        # if 'CSI_CEPHFS_PROVISIONER_SECRET' exists, then only add 'rook-csi-cephfs-provisioner' Secret
+        if self.out_map['CSI_CEPHFS_PROVISIONER_SECRET'] and self.out_map['CSI_CEPHFS_PROVISIONER_SECRET_NAME']:
+            json_out.append({
+                "name": "rook-{}".format(self.out_map["CSI_CEPHFS_PROVISIONER_SECRET_NAME"]),
+                "kind": "Secret",
+                "data": {
+                    "adminID": self.out_map["CSI_CEPHFS_PROVISIONER_SECRET_NAME"],
+                    "adminKey": self.out_map['CSI_CEPHFS_PROVISIONER_SECRET']
+                },
+            })
+        # if 'CSI_CEPHFS_NODE_SECRET' exists, then only add 'rook-csi-cephfs-node' Secret
+        if self.out_map['CSI_CEPHFS_NODE_SECRET'] and self.out_map['CSI_CEPHFS_NODE_SECRET_NAME']:
+            json_out.append({
+                "name": "rook-{}".format(self.out_map["CSI_CEPHFS_NODE_SECRET_NAME"]),
+                "kind": "Secret",
+                "data": {
+                    "adminID": self.out_map["CSI_CEPHFS_NODE_SECRET_NAME"],
+                    "adminKey": self.out_map['CSI_CEPHFS_NODE_SECRET']
                 }
-            )
-            # if 'CSI_RBD_PROVISIONER_SECRET' exists, then only add 'rook-csi-rbd-provisioner' Secret
-            if self.out_map["CSI_RBD_PROVISIONER_SECRET"]:
-                json_out.append(
-                    {
-                        "name": "rook-csi-rbd-provisioner",
-                        "kind": "Secret",
-                        "data": {
-                            "userID": "csi-rbd-provisioner",
-                            "userKey": self.out_map["CSI_RBD_PROVISIONER_SECRET"],
-                        },
-                    }
-                )
-            # if 'CSI_CEPHFS_PROVISIONER_SECRET' exists, then only add 'rook-csi-cephfs-provisioner' Secret
-            if self.out_map["CSI_CEPHFS_PROVISIONER_SECRET"]:
-                json_out.append(
-                    {
-                        "name": "rook-csi-cephfs-provisioner",
-                        "kind": "Secret",
-                        "data": {
-                            "adminID": "csi-cephfs-provisioner",
-                            "adminKey": self.out_map["CSI_CEPHFS_PROVISIONER_SECRET"],
-                        },
-                    }
-                )
-            # if 'CSI_CEPHFS_NODE_SECRET' exists, then only add 'rook-csi-cephfs-node' Secret
-            if self.out_map["CSI_CEPHFS_NODE_SECRET"]:
-                json_out.append(
-                    {
-                        "name": "rook-csi-cephfs-node",
-                        "kind": "Secret",
-                        "data": {
-                            "adminID": "csi-cephfs-node",
-                            "adminKey": self.out_map["CSI_CEPHFS_NODE_SECRET"],
-                        },
-                    }
-                )
+            })
         # if 'ROOK_EXTERNAL_DASHBOARD_LINK' exists, then only add 'rook-ceph-dashboard-link' Secret
         if self.out_map["ROOK_EXTERNAL_DASHBOARD_LINK"]:
             json_out.append(
@@ -1547,18 +1422,42 @@ class RadosJSON:
                     },
                 }
             )
+        if self.out_map['RBD_METADATA_EC_POOL_NAME']:
+            json_out.append({
+                "name": "ceph-rbd",
+                "kind": "StorageClass",
+                "data": {
+                    "dataPool": self.out_map['RBD_METADATA_EC_POOL_NAME'],
+                    "pool": self.out_map['RBD_POOL_NAME'],
+                    "csi.storage.k8s.io/provisioner-secret-name": "rook-{}".format(self.out_map["CSI_RBD_PROVISIONER_SECRET_NAME"]),
+                    "csi.storage.k8s.io/controller-expand-secret-name": "rook-{}".format(self.out_map["CSI_RBD_PROVISIONER_SECRET_NAME"]),
+                    "csi.storage.k8s.io/node-stage-secret-name": "rook-{}".format(self.out_map["CSI_RBD_NODE_SECRET_NAME"])
+                },
+            })
+        else:
+            json_out.append({
+                "name": "ceph-rbd",
+                "kind": "StorageClass",
+                "data": {
+                    "pool": self.out_map['RBD_POOL_NAME'],
+                    "csi.storage.k8s.io/provisioner-secret-name": "rook-{}".format(self.out_map["CSI_RBD_PROVISIONER_SECRET_NAME"]),
+                    "csi.storage.k8s.io/controller-expand-secret-name": "rook-{}".format(self.out_map["CSI_RBD_PROVISIONER_SECRET_NAME"]),
+                    "csi.storage.k8s.io/node-stage-secret-name": "rook-{}".format(self.out_map["CSI_RBD_NODE_SECRET_NAME"])
+                },
+            })
         # if 'CEPHFS_FS_NAME' exists, then only add 'cephfs' StorageClass
-        if self.out_map["CEPHFS_FS_NAME"]:
-            json_out.append(
-                {
-                    "name": "cephfs",
-                    "kind": "StorageClass",
-                    "data": {
-                        "fsName": self.out_map["CEPHFS_FS_NAME"],
-                        "pool": self.out_map["CEPHFS_POOL_NAME"],
-                    },
+        if self.out_map['CEPHFS_FS_NAME']:
+            json_out.append({
+                "name": "cephfs",
+                "kind": "StorageClass",
+                "data": {
+                    "fsName": self.out_map['CEPHFS_FS_NAME'],
+                    "pool": self.out_map['CEPHFS_POOL_NAME'],
+                    "csi.storage.k8s.io/provisioner-secret-name": "rook-{}".format(self.out_map["CSI_CEPHFS_PROVISIONER_SECRET_NAME"]),
+                    "csi.storage.k8s.io/controller-expand-secret-name": "rook-{}".format(self.out_map["CSI_CEPHFS_PROVISIONER_SECRET_NAME"]),
+                    "csi.storage.k8s.io/node-stage-secret-name": "rook-{}".format(self.out_map["CSI_CEPHFS_NODE_SECRET_NAME"])
                 }
-            )
+            })
         # if 'RGW_ENDPOINT' exists, then only add 'ceph-rgw' StorageClass
         if self.out_map["RGW_ENDPOINT"]:
             json_out.append(
diff --git a/deploy/examples/import-external-cluster.sh b/deploy/examples/import-external-cluster.sh
index ea0f438be..bccfabc2f 100644
--- a/deploy/examples/import-external-cluster.sh
+++ b/deploy/examples/import-external-cluster.sh
@@ -5,10 +5,6 @@ set -e
 # VARIABLES #
 #############
 MON_SECRET_NAME=rook-ceph-mon
-CSI_RBD_NODE_SECRET_NAME=rook-csi-rbd-node
-CSI_RBD_PROVISIONER_SECRET_NAME=rook-csi-rbd-provisioner
-CSI_CEPHFS_NODE_SECRET_NAME=rook-csi-cephfs-node
-CSI_CEPHFS_PROVISIONER_SECRET_NAME=rook-csi-cephfs-provisioner
 RGW_ADMIN_OPS_USER_SECRET_NAME=rgw-admin-ops-user
 MON_SECRET_CLUSTER_NAME_KEYNAME=cluster-name
 MON_SECRET_FSID_KEYNAME=fsid
@@ -20,7 +16,12 @@ MON_ENDPOINT_CONFIGMAP_NAME=rook-ceph-mon-endpoints
 ROOK_EXTERNAL_CLUSTER_NAME=$NAMESPACE
 ROOK_EXTERNAL_MAX_MON_ID=2
 ROOK_EXTERNAL_MAPPING={}
+RBD_STORAGE_CLASS_NAME=ceph-rbd
+CEPHFS_STORAGE_CLASS_NAME=cephfs
 ROOK_EXTERNAL_MONITOR_SECRET=mon-secret
+OPERATOR_NAMESPACE=rook-ceph # default set to rook-ceph
+RBD_PROVISIONER=$OPERATOR_NAMESPACE".rbd.csi.ceph.com" # driver:namespace:operator
+CEPHFS_PROVISIONER=$OPERATOR_NAMESPACE".cephfs.csi.ceph.com" # driver:namespace:operator
 : "${ROOK_EXTERNAL_ADMIN_SECRET:=admin-secret}"
 
 #############
@@ -31,6 +32,26 @@ function checkEnvVars() {
   if [ -z "$NAMESPACE" ]; then
     echo "Please populate the environment variable NAMESPACE"
     exit 1
+  fi
+   if [ -z "$RBD_POOL_NAME" ]; then
+    echo "Please populate the environment variable RBD_POOL_NAME"
+    exit 1
+  fi
+  if [ -z "$CSI_RBD_NODE_SECRET_NAME" ]; then
+    echo "Please populate the environment variable CSI_RBD_NODE_SECRET_NAME"
+    exit 1
+  fi
+  if [ -z "$CSI_RBD_PROVISIONER_SECRET_NAME" ]; then
+    echo "Please populate the environment variable CSI_RBD_PROVISIONER_SECRET_NAME"
+    exit 1
+  fi
+  if [ -z "$CSI_CEPHFS_NODE_SECRET_NAME" ]; then
+    echo "Please populate the environment variable CSI_CEPHFS_NODE_SECRET_NAME"
+    exit 1
+  fi
+  if [ -z "$CSI_CEPHFS_PROVISIONER_SECRET_NAME" ]; then
+    echo "Please populate the environment variable CSI_CEPHFS_PROVISIONER_SECRET_NAME"
+    exit 1
   fi
   if [ -z "$ROOK_EXTERNAL_FSID" ]; then
     echo "Please populate the environment variable ROOK_EXTERNAL_FSID"
@@ -103,8 +124,8 @@ function importCsiRBDNodeSecret() {
   secret \
   generic \
   --type="kubernetes.io/rook" \
-  "$CSI_RBD_NODE_SECRET_NAME" \
-  --from-literal=userID=csi-rbd-node \
+  "rook-""$CSI_RBD_NODE_SECRET_NAME" \
+  --from-literal=userID="$CSI_RBD_NODE_SECRET_NAME" \
   --from-literal=userKey="$CSI_RBD_NODE_SECRET"
 }
 
@@ -114,8 +135,8 @@ function importCsiRBDProvisionerSecret() {
   secret \
   generic \
   --type="kubernetes.io/rook" \
-  "$CSI_RBD_PROVISIONER_SECRET_NAME" \
-  --from-literal=userID=csi-rbd-provisioner \
+  "rook-""$CSI_RBD_PROVISIONER_SECRET_NAME" \
+  --from-literal=userID="$CSI_RBD_PROVISIONER_SECRET_NAME" \
   --from-literal=userKey="$CSI_RBD_PROVISIONER_SECRET"
 }
 
@@ -125,8 +146,8 @@ function importCsiCephFSNodeSecret() {
   secret \
   generic \
   --type="kubernetes.io/rook" \
-  "$CSI_CEPHFS_NODE_SECRET_NAME" \
-  --from-literal=adminID=csi-cephfs-node \
+  "rook-""$CSI_CEPHFS_NODE_SECRET_NAME" \
+  --from-literal=adminID="$CSI_CEPHFS_NODE_SECRET_NAME" \
   --from-literal=adminKey="$CSI_CEPHFS_NODE_SECRET"
 }
 
@@ -136,8 +157,8 @@ function importCsiCephFSProvisionerSecret() {
   secret \
   generic \
   --type="kubernetes.io/rook" \
-  "$CSI_CEPHFS_PROVISIONER_SECRET_NAME" \
-  --from-literal=adminID=csi-cephfs-provisioner \
+  "rook-""$CSI_CEPHFS_PROVISIONER_SECRET_NAME" \
+  --from-literal=adminID="$CSI_CEPHFS_PROVISIONER_SECRET_NAME" \
   --from-literal=adminKey="$CSI_CEPHFS_PROVISIONER_SECRET"
 }
 
@@ -152,6 +173,77 @@ function importRGWAdminOpsUser() {
   --from-literal=secretKey="$RGW_ADMIN_OPS_USER_SECRET_KEY"
 }
 
+function createECRBDStorageClass() {
+cat <<eof | kubectl create -f -
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: $RBD_STORAGE_CLASS_NAME
+provisioner: $RBD_PROVISIONER
+parameters:
+  clusterID: $NAMESPACE
+  pool: $RBD_POOL_NAME
+  dataPool: $RBD_METADATA_EC_POOL_NAME
+  imageFormat: "2"
+  imageFeatures: layering
+  csi.storage.k8s.io/provisioner-secret-name: $CSI_RBD_PROVISIONER_SECRET_NAME
+  csi.storage.k8s.io/provisioner-secret-namespace: $NAMESPACE
+  csi.storage.k8s.io/controller-expand-secret-name:  $CSI_RBD_PROVISIONER_SECRET_NAME
+  csi.storage.k8s.io/controller-expand-secret-namespace: $NAMESPACE
+  csi.storage.k8s.io/node-stage-secret-name: $CSI_RBD_NODE_SECRET_NAME
+  csi.storage.k8s.io/node-stage-secret-namespace: $NAMESPACE
+  csi.storage.k8s.io/fstype: ext4
+allowVolumeExpansion: true
+reclaimPolicy: Delete
+eof
+}
+
+function createRBDStorageClass() {
+cat <<eof | kubectl create -f -
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: $RBD_STORAGE_CLASS_NAME
+provisioner: $RBD_PROVISIONER
+parameters:
+  clusterID: $NAMESPACE
+  pool: $RBD_POOL_NAME
+  imageFormat: "2"
+  imageFeatures: layering
+  csi.storage.k8s.io/provisioner-secret-name: $CSI_RBD_PROVISIONER_SECRET_NAME
+  csi.storage.k8s.io/provisioner-secret-namespace: $NAMESPACE
+  csi.storage.k8s.io/controller-expand-secret-name:  $CSI_RBD_PROVISIONER_SECRET_NAME
+  csi.storage.k8s.io/controller-expand-secret-namespace: $NAMESPACE
+  csi.storage.k8s.io/node-stage-secret-name: $CSI_RBD_NODE_SECRET_NAME
+  csi.storage.k8s.io/node-stage-secret-namespace: $NAMESPACE
+  csi.storage.k8s.io/fstype: ext4
+allowVolumeExpansion: true
+reclaimPolicy: Delete
+eof
+}
+
+function createCephFSStorageClass() {
+cat <<eof | kubectl create -f -
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: $CEPHFS_STORAGE_CLASS_NAME
+provisioner: $CEPHFS_PROVISIONER
+parameters:
+  clusterID: $NAMESPACE
+  fsName: $CEPHFS_FS_NAME
+  pool: $CEPHFS_POOL_NAME
+  csi.storage.k8s.io/provisioner-secret-name: $CSI_CEPHFS_PROVISIONER_SECRET_NAME
+  csi.storage.k8s.io/provisioner-secret-namespace: $NAMESPACE
+  csi.storage.k8s.io/controller-expand-secret-name: $CSI_CEPHFS_PROVISIONER_SECRET_NAME
+  csi.storage.k8s.io/controller-expand-secret-namespace: $NAMESPACE
+  csi.storage.k8s.io/node-stage-secret-name: $CSI_CEPHFS_NODE_SECRET_NAME
+  csi.storage.k8s.io/node-stage-secret-namespace: $NAMESPACE
+allowVolumeExpansion: true
+reclaimPolicy: Delete
+eof
+}
+
 ########
 # MAIN #
 ########
@@ -163,3 +255,11 @@ importCsiRBDProvisionerSecret
 importCsiCephFSNodeSecret
 importCsiCephFSProvisionerSecret
 importRGWAdminOpsUser
+if [ -n "$RBD_METADATA_EC_POOL_NAME" ]; then
+  createECRBDStorageClass
+else
+  createRBDStorageClass
+fi
+if [ -n "$CEPHFS_FS_NAME" ] && [ -n "$CEPHFS_POOL_NAME" ]; then
+  createCephFSStorageClass
+fi
diff --git a/pkg/operator/ceph/csi/controller.go b/pkg/operator/ceph/csi/controller.go
index e7d26aa3a..48eb2ba86 100644
--- a/pkg/operator/ceph/csi/controller.go
+++ b/pkg/operator/ceph/csi/controller.go
@@ -19,7 +19,6 @@ package csi
 import (
 	"context"
 	"os"
-	"strconv"
 
 	cephv1 "github.com/rook/rook/pkg/apis/ceph.rook.io/v1"
 	cephclient "github.com/rook/rook/pkg/daemon/ceph/client"
@@ -47,11 +46,11 @@ const (
 
 // ReconcileCSI reconciles a ceph-csi driver
 type ReconcileCSI struct {
-	client             client.Client
-	context            *clusterd.Context
-	opManagerContext   context.Context
-	opConfig           opcontroller.OperatorConfig
-	clustersWithHolder []ClusterDetail
+	client           client.Client
+	context          *clusterd.Context
+	opManagerContext context.Context
+	opConfig         opcontroller.OperatorConfig
+	multusClusters   []ClusterDetail
 }
 
 // ClusterDetail is a struct that holds the information of a cluster, it knows its internals (like
@@ -70,11 +69,11 @@ func Add(mgr manager.Manager, context *clusterd.Context, opManagerContext contex
 // newReconciler returns a new reconcile.Reconciler
 func newReconciler(mgr manager.Manager, context *clusterd.Context, opManagerContext context.Context, opConfig opcontroller.OperatorConfig) reconcile.Reconciler {
 	return &ReconcileCSI{
-		client:             mgr.GetClient(),
-		context:            context,
-		opConfig:           opConfig,
-		opManagerContext:   opManagerContext,
-		clustersWithHolder: []ClusterDetail{},
+		client:           mgr.GetClient(),
+		context:          context,
+		opConfig:         opConfig,
+		opManagerContext: opManagerContext,
+		multusClusters:   []ClusterDetail{},
 	}
 }
 
@@ -154,29 +153,6 @@ func (r *ReconcileCSI) reconcile(request reconcile.Request) (reconcile.Result, e
 
 		return reconcile.Result{}, nil
 	}
-	// Fetch the operator's configmap. We force the NamespaceName to the operator since the request
-	// could be a CephCluster. If so the NamespaceName will be the one from the cluster and thus the
-	// CM won't be found
-	opNamespaceName := types.NamespacedName{Name: opcontroller.OperatorSettingConfigMapName, Namespace: r.opConfig.OperatorNamespace}
-	opConfig := &v1.ConfigMap{}
-	err = r.client.Get(r.opManagerContext, opNamespaceName, opConfig)
-	if err != nil {
-		if kerrors.IsNotFound(err) {
-			logger.Debug("operator's configmap resource not found. will use default value or env var.")
-			r.opConfig.Parameters = make(map[string]string)
-		} else {
-			// Error reading the object - requeue the request.
-			return opcontroller.ImmediateRetryResult, errors.Wrap(err, "failed to get operator's configmap")
-		}
-	} else {
-		// Populate the operator's config
-		r.opConfig.Parameters = opConfig.Data
-	}
-
-	csiHostNetworkEnabled, err := strconv.ParseBool(k8sutil.GetValue(r.opConfig.Parameters, "CSI_ENABLE_HOST_NETWORK", "true"))
-	if err != nil {
-		return reconcile.Result{}, errors.Wrap(err, "failed to parse value for 'CSI_ENABLE_HOST_NETWORK'")
-	}
 
 	for i, cluster := range cephClusters.Items {
 		if !cluster.DeletionTimestamp.IsZero() {
@@ -188,10 +164,10 @@ func (r *ReconcileCSI) reconcile(request reconcile.Request) (reconcile.Result, e
 			logger.Debugf("ceph cluster %q has cleanup policy, the cluster will soon go away, no need to reconcile the csi driver", cluster.Name)
 			return reconcile.Result{}, nil
 		}
-		holderEnabled := !csiHostNetworkEnabled || cluster.Spec.Network.IsMultus()
-		// Do we have a multus cluster or csi host network disabled?
+
+		// Do we have a multus cluster?
 		// If so deploy the plugin holder with the fsid attached
-		if holderEnabled {
+		if cluster.Spec.Network.IsMultus() {
 			// Load cluster info for later use in updating the ceph-csi configmap
 			clusterInfo, _, _, err := opcontroller.LoadClusterInfo(r.context, r.opManagerContext, cluster.Namespace)
 			if err != nil {
@@ -205,13 +181,30 @@ func (r *ReconcileCSI) reconcile(request reconcile.Request) (reconcile.Result, e
 				return opcontroller.ImmediateRetryResult, errors.Wrapf(err, "failed to load cluster info for cluster %q", cluster.Name)
 			}
 
-			logger.Debugf("cluster %q is running on multus or CSI_ENABLE_HOST_NETWORK is false, deploying the ceph-csi plugin holder", cluster.Name)
-
-			r.clustersWithHolder = append(r.clustersWithHolder, ClusterDetail{cluster: &cephClusters.Items[i], clusterInfo: clusterInfo})
+			logger.Debugf("cluster %q is running on multus, deploying the ceph-csi plugin holder", cluster.Name)
+			r.multusClusters = append(r.multusClusters, ClusterDetail{cluster: &cephClusters.Items[i], clusterInfo: clusterInfo})
+		} else {
+			logger.Debugf("not a multus cluster %q, not deploying the ceph-csi plugin holder", request.NamespacedName)
+		}
+	}
 
+	// Fetch the operator's configmap. We force the NamespaceName to the operator since the request
+	// could be a CephCluster. If so the NamespaceName will be the one from the cluster and thus the
+	// CM won't be found
+	opNamespaceName := types.NamespacedName{Name: opcontroller.OperatorSettingConfigMapName, Namespace: r.opConfig.OperatorNamespace}
+	opConfig := &v1.ConfigMap{}
+	err = r.client.Get(r.opManagerContext, opNamespaceName, opConfig)
+	if err != nil {
+		if kerrors.IsNotFound(err) {
+			logger.Debug("operator's configmap resource not found. will use default value or env var.")
+			r.opConfig.Parameters = make(map[string]string)
 		} else {
-			logger.Debugf("not a multus cluster %q or CSI_ENABLE_HOST_NETWORK is true, not deploying the ceph-csi plugin holder", request.NamespacedName)
+			// Error reading the object - requeue the request.
+			return opcontroller.ImmediateRetryResult, errors.Wrap(err, "failed to get operator's configmap")
 		}
+	} else {
+		// Populate the operator's config
+		r.opConfig.Parameters = opConfig.Data
 	}
 
 	ownerRef, err := k8sutil.GetDeploymentOwnerReference(r.opManagerContext, r.context.Clientset, os.Getenv(k8sutil.PodNameEnvVar), r.opConfig.OperatorNamespace)
diff --git a/pkg/operator/ceph/csi/spec.go b/pkg/operator/ceph/csi/spec.go
index 5d99a65ae..3464e2521 100644
--- a/pkg/operator/ceph/csi/spec.go
+++ b/pkg/operator/ceph/csi/spec.go
@@ -370,15 +370,8 @@ func (r *ReconcileCSI) startDrivers(ver *version.Info, ownerInfo *k8sutil.OwnerI
 			return errors.Wrap(err, "failed to load nfs provisioner deployment template")
 		}
 	}
+	multusApplied := len(r.multusClusters) > 0
 
-	holderEnabled := !CSIParam.EnableCSIHostNetwork
-
-	for i := range r.clustersWithHolder {
-		if r.clustersWithHolder[i].cluster.Spec.Network.IsMultus() {
-			holderEnabled = true
-			break
-		}
-	}
 	// get common provisioner tolerations and node affinity
 	provisionerTolerations := getToleration(r.opConfig.Parameters, provisionerTolerationsEnv, []corev1.Toleration{})
 	provisionerNodeAffinity := getNodeAffinity(r.opConfig.Parameters, provisionerNodeAffinityEnv, &corev1.NodeAffinity{})
@@ -387,12 +380,11 @@ func (r *ReconcileCSI) startDrivers(ver *version.Info, ownerInfo *k8sutil.OwnerI
 	pluginTolerations := getToleration(r.opConfig.Parameters, pluginTolerationsEnv, []corev1.Toleration{})
 	pluginNodeAffinity := getNodeAffinity(r.opConfig.Parameters, pluginNodeAffinityEnv, &corev1.NodeAffinity{})
 
-	if holderEnabled && !v.SupportsNsenter() {
-		return errors.Errorf("multus/csi pod networking is applied but the csi version %q does not support it, need at least %q", v.String(), nsenterSupportedVersion.String())
+	if multusApplied && !v.SupportsMultus() {
+		return errors.Errorf("multus is applied but the csi version %q does not support it, need at least %q", v.String(), multusSupportedVersion.String())
 	}
 
-	// Deploy the CSI Holder DaemonSet if Multus is enabled or
-	// EnableCSIHostNetwork is disabled.
+	// Deploy the CSI Holder DaemonSet if Multus is enabled
 	err = r.configureHolders(enabledDrivers, tp, pluginTolerations, pluginNodeAffinity)
 	if err != nil {
 		return errors.Wrap(err, "failed to configure holder")
@@ -410,11 +402,11 @@ func (r *ReconcileCSI) startDrivers(ver *version.Info, ownerInfo *k8sutil.OwnerI
 		if err != nil {
 			return errors.Wrapf(err, "failed to set owner reference to rbd plugin daemonset %q", rbdPlugin.Name)
 		}
-		err = r.applyCephClusterNetworkConfig(r.opManagerContext, &rbdPlugin.Spec.Template.ObjectMeta)
+		_, err := r.applyCephClusterNetworkConfig(r.opManagerContext, &rbdPlugin.Spec.Template.ObjectMeta)
 		if err != nil {
 			return errors.Wrapf(err, "failed to apply network config to rbd plugin daemonset %q", rbdPlugin.Name)
 		}
-		if holderEnabled {
+		if multusApplied {
 			rbdPlugin.Spec.Template.Spec.HostNetwork = false
 		}
 		err = k8sutil.CreateDaemonSet(r.opManagerContext, r.opConfig.OperatorNamespace, r.context.Clientset, rbdPlugin)
@@ -442,7 +434,7 @@ func (r *ReconcileCSI) startDrivers(ver *version.Info, ownerInfo *k8sutil.OwnerI
 			Type: apps.RecreateDeploymentStrategyType,
 		}
 
-		err = r.applyCephClusterNetworkConfig(r.opManagerContext, &rbdProvisionerDeployment.Spec.Template.ObjectMeta)
+		_, err = r.applyCephClusterNetworkConfig(r.opManagerContext, &rbdProvisionerDeployment.Spec.Template.ObjectMeta)
 		if err != nil {
 			return errors.Wrapf(err, "failed to apply network config to rbd plugin provisioner deployment %q", rbdProvisionerDeployment.Name)
 		}
@@ -478,11 +470,11 @@ func (r *ReconcileCSI) startDrivers(ver *version.Info, ownerInfo *k8sutil.OwnerI
 		if err != nil {
 			return errors.Wrapf(err, "failed to set owner reference to cephfs plugin daemonset %q", cephfsPlugin.Name)
 		}
-		err = r.applyCephClusterNetworkConfig(r.opManagerContext, &cephfsPlugin.Spec.Template.ObjectMeta)
+		multusApplied, err := r.applyCephClusterNetworkConfig(r.opManagerContext, &cephfsPlugin.Spec.Template.ObjectMeta)
 		if err != nil {
 			return errors.Wrapf(err, "failed to apply network config to cephfs plugin daemonset %q", cephfsPlugin.Name)
 		}
-		if holderEnabled {
+		if multusApplied {
 			cephfsPlugin.Spec.Template.Spec.HostNetwork = false
 			// HostPID is used to communicate with the network namespace
 			cephfsPlugin.Spec.Template.Spec.HostPID = true
@@ -514,7 +506,7 @@ func (r *ReconcileCSI) startDrivers(ver *version.Info, ownerInfo *k8sutil.OwnerI
 			Type: apps.RecreateDeploymentStrategyType,
 		}
 
-		err = r.applyCephClusterNetworkConfig(r.opManagerContext, &cephfsProvisionerDeployment.Spec.Template.ObjectMeta)
+		_, err = r.applyCephClusterNetworkConfig(r.opManagerContext, &cephfsProvisionerDeployment.Spec.Template.ObjectMeta)
 		if err != nil {
 			return errors.Wrapf(err, "failed to apply network config to cephfs plugin provisioner deployment %q", cephfsProvisionerDeployment.Name)
 		}
@@ -549,11 +541,11 @@ func (r *ReconcileCSI) startDrivers(ver *version.Info, ownerInfo *k8sutil.OwnerI
 		if err != nil {
 			return errors.Wrapf(err, "failed to set owner reference to nfs plugin daemonset %q", nfsPlugin.Name)
 		}
-		err = r.applyCephClusterNetworkConfig(r.opManagerContext, &nfsPlugin.Spec.Template.ObjectMeta)
+		multusApplied, err := r.applyCephClusterNetworkConfig(r.opManagerContext, &nfsPlugin.Spec.Template.ObjectMeta)
 		if err != nil {
 			return errors.Wrapf(err, "failed to apply network config to nfs plugin daemonset %q", nfsPlugin.Name)
 		}
-		if holderEnabled {
+		if multusApplied {
 			nfsPlugin.Spec.Template.Spec.HostNetwork = false
 		}
 		err = k8sutil.CreateDaemonSet(r.opManagerContext, r.opConfig.OperatorNamespace, r.context.Clientset, nfsPlugin)
@@ -582,7 +574,7 @@ func (r *ReconcileCSI) startDrivers(ver *version.Info, ownerInfo *k8sutil.OwnerI
 			Type: apps.RecreateDeploymentStrategyType,
 		}
 
-		err = r.applyCephClusterNetworkConfig(r.opManagerContext, &nfsProvisionerDeployment.Spec.Template.ObjectMeta)
+		_, err = r.applyCephClusterNetworkConfig(r.opManagerContext, &nfsProvisionerDeployment.Spec.Template.ObjectMeta)
 		if err != nil {
 			return errors.Wrapf(err, "failed to apply network config to nfs provisioner deployment %q", nfsProvisionerDeployment.Name)
 		}
@@ -678,21 +670,23 @@ func (r *ReconcileCSI) deleteCSIDriverResources(ver *version.Info, daemonset, de
 	return nil
 }
 
-func (r *ReconcileCSI) applyCephClusterNetworkConfig(ctx context.Context, objectMeta *metav1.ObjectMeta) error {
+func (r *ReconcileCSI) applyCephClusterNetworkConfig(ctx context.Context, objectMeta *metav1.ObjectMeta) (bool, error) {
+	var isMultusApplied bool
 	cephClusters, err := r.context.RookClientset.CephV1().CephClusters(objectMeta.Namespace).List(ctx, metav1.ListOptions{})
 	if err != nil {
-		return errors.Wrap(err, "failed to find CephClusters")
+		return false, errors.Wrap(err, "failed to find CephClusters")
 	}
 	for _, cephCluster := range cephClusters.Items {
 		if cephCluster.Spec.Network.IsMultus() {
 			err = k8sutil.ApplyMultus(cephCluster.Spec.Network, objectMeta)
 			if err != nil {
-				return errors.Wrapf(err, "failed to apply multus configuration to CephCluster %q", cephCluster.Name)
+				return false, errors.Wrapf(err, "failed to apply multus configuration to CephCluster %q", cephCluster.Name)
 			}
+			isMultusApplied = true
 		}
 	}
 
-	return nil
+	return isMultusApplied, nil
 }
 
 // ValidateCSIVersion checks if the configured ceph-csi image is supported
@@ -747,11 +741,11 @@ func (r *ReconcileCSI) validateCSIVersion(ownerInfo *k8sutil.OwnerInfo) (*CephCS
 }
 
 func (r *ReconcileCSI) configureHolders(enabledDrivers []driverDetails, tp templateParam, pluginTolerations []corev1.Toleration, pluginNodeAffinity *corev1.NodeAffinity) error {
-	for _, cluster := range r.clustersWithHolder {
+	for _, multusCluster := range r.multusClusters {
 		for _, driver := range enabledDrivers {
-			err := r.configureHolder(driver, cluster, tp, pluginTolerations, pluginNodeAffinity)
+			err := r.configureHolder(driver, multusCluster, tp, pluginTolerations, pluginNodeAffinity)
 			if err != nil {
-				return errors.Wrapf(err, "failed to configure holder %q for %q/%q", driver.name, cluster.cluster.Name, cluster.cluster.Namespace)
+				return errors.Wrapf(err, "failed to configure holder %q for %q/%q", driver.name, multusCluster.cluster.Name, multusCluster.cluster.Namespace)
 			}
 		}
 	}
@@ -759,7 +753,7 @@ func (r *ReconcileCSI) configureHolders(enabledDrivers []driverDetails, tp templ
 	return nil
 }
 
-func (r *ReconcileCSI) configureHolder(driver driverDetails, c ClusterDetail, tp templateParam, pluginTolerations []corev1.Toleration, pluginNodeAffinity *corev1.NodeAffinity) error {
+func (r *ReconcileCSI) configureHolder(driver driverDetails, multusCluster ClusterDetail, tp templateParam, pluginTolerations []corev1.Toleration, pluginNodeAffinity *corev1.NodeAffinity) error {
 	cephPluginHolder, err := templateToDaemonSet("cephpluginholder", driver.holderTemplate, tp)
 	if err != nil {
 		return errors.Wrapf(err, "failed to load ceph %q plugin holder template", driver.fullName)
@@ -781,7 +775,7 @@ func (r *ReconcileCSI) configureHolder(driver driverDetails, c ClusterDetail, tp
 		cephPluginHolder.Spec.Template.Spec.Containers[0].Env,
 		corev1.EnvVar{
 			Name:  "CEPH_CLUSTER_NAMESPACE",
-			Value: c.cluster.Namespace,
+			Value: multusCluster.cluster.Namespace,
 		},
 	)
 
@@ -796,37 +790,35 @@ func (r *ReconcileCSI) configureHolder(driver driverDetails, c ClusterDetail, tp
 	)
 
 	// Make the DS name unique per Ceph cluster
-	cephPluginHolder.Name = fmt.Sprintf("%s-%s", cephPluginHolder.Name, c.cluster.Name)
-	cephPluginHolder.Spec.Template.Name = fmt.Sprintf("%s-%s", cephPluginHolder.Spec.Template.Name, c.cluster.Name)
-	cephPluginHolder.Spec.Template.Spec.Containers[0].Name = fmt.Sprintf("%s-%s", cephPluginHolder.Spec.Template.Spec.Containers[0].Name, c.cluster.Name)
+	cephPluginHolder.Name = fmt.Sprintf("%s-%s", cephPluginHolder.Name, multusCluster.cluster.Name)
+	cephPluginHolder.Spec.Template.Name = fmt.Sprintf("%s-%s", cephPluginHolder.Spec.Template.Name, multusCluster.cluster.Name)
+	cephPluginHolder.Spec.Template.Spec.Containers[0].Name = fmt.Sprintf("%s-%s", cephPluginHolder.Spec.Template.Spec.Containers[0].Name, multusCluster.cluster.Name)
 
 	// Add default labels
 	k8sutil.AddRookVersionLabelToDaemonSet(cephPluginHolder)
 
-	// If multus is enabled, add the multus plugin label
-	if c.cluster.Spec.Network.IsMultus() {
-		// Apply Multus annotations to daemonset spec
-		err = k8sutil.ApplyMultus(c.cluster.Spec.Network, &cephPluginHolder.Spec.Template.ObjectMeta)
-		if err != nil {
-			return errors.Wrapf(err, "failed to apply multus configuration for holder %q in cluster %q", cephPluginHolder.Name, c.cluster.Namespace)
-		}
+	// Apply Multus annotations to daemonset spec
+	err = k8sutil.ApplyMultus(multusCluster.cluster.Spec.Network, &cephPluginHolder.Spec.Template.ObjectMeta)
+	if err != nil {
+		return errors.Wrapf(err, "failed to apply multus configuration for holder %q in cluster %q", cephPluginHolder.Name, multusCluster.cluster.Namespace)
 	}
+
 	// Finally create the DaemonSet
 	_, err = r.context.Clientset.AppsV1().DaemonSets(r.opConfig.OperatorNamespace).Create(r.opManagerContext, cephPluginHolder, metav1.CreateOptions{})
 	if err != nil {
 		if kerrors.IsAlreadyExists(err) {
-			logger.Debugf("holder %q already exists for cluster %q, it should never be updated", cephPluginHolder.Name, c.cluster.Namespace)
+			logger.Debugf("holder %q already exists for cluster %q, it should never be updated", cephPluginHolder.Name, multusCluster.cluster.Namespace)
 		} else {
 			return errors.Wrapf(err, "failed to start ceph plugin holder daemonset %q", cephPluginHolder.Name)
 		}
 	}
 
 	clusterConfigEntry := &CsiClusterConfigEntry{
-		Monitors: MonEndpoints(c.clusterInfo.Monitors),
+		Monitors: MonEndpoints(multusCluster.clusterInfo.Monitors),
 		RBD:      &CsiRBDSpec{},
 		CephFS:   &CsiCephFSSpec{},
 	}
-	netNamespaceFilePath := generateNetNamespaceFilePath(CSIParam.KubeletDirPath, driver.fullName, c.cluster.Namespace)
+	netNamespaceFilePath := generateNetNamespaceFilePath(CSIParam.KubeletDirPath, driver.fullName, multusCluster.cluster.Namespace)
 	if driver.name == RBDDriverShortName {
 		clusterConfigEntry.RBD.NetNamespaceFilePath = netNamespaceFilePath
 	}
@@ -834,7 +826,7 @@ func (r *ReconcileCSI) configureHolder(driver driverDetails, c ClusterDetail, tp
 		clusterConfigEntry.CephFS.NetNamespaceFilePath = netNamespaceFilePath
 	}
 	// Save the path of the network namespace file for ceph-csi to use
-	err = SaveClusterConfig(r.context.Clientset, c.cluster.Namespace, c.clusterInfo, clusterConfigEntry)
+	err = SaveClusterConfig(r.context.Clientset, multusCluster.cluster.Namespace, multusCluster.clusterInfo, clusterConfigEntry)
 	if err != nil {
 		return errors.Wrapf(err, "failed to save cluster config for csi holder %q", driver.fullName)
 	}
diff --git a/pkg/operator/ceph/csi/template/cephfs/csi-cephfsplugin-holder.yaml b/pkg/operator/ceph/csi/template/cephfs/csi-cephfsplugin-holder.yaml
index e7d447ee9..686f6d1e5 100644
--- a/pkg/operator/ceph/csi/template/cephfs/csi-cephfsplugin-holder.yaml
+++ b/pkg/operator/ceph/csi/template/cephfs/csi-cephfsplugin-holder.yaml
@@ -1,9 +1,9 @@
-# This DaemonSet is only active when the cluster is deployed with Multus enabled or EnableCSIHostNetwork
-# is set to false. Hopefully in the future it will be part of every Ceph-CSI deployment. Its role is to
-# "hold" the Ceph Filesystem mounts that are created by the CSI driver. Essentially, it exposes its
-# network namespace into the Kubelet plugin directly and Ceph-CSI picks it up. When mounting, the Ceph-CSI
-# driver will use the network namespace of the DaemonSet instead of its own (the plugin pod). This pod
-# is not expected to be updated nor restarted unless the node reboots.
+# This DaemonSet is only active when the cluster is deployed with Multus enabled. Hopefully in the
+# future it will be part of every Ceph-CSI deployment. Its role is to "hold" the Ceph Filesystem
+# mounts that are created by the CSI driver. Essentially, it exposes its network namespace into the
+# Kubelet plugin directly and Ceph-CSI picks it up. When mounting, the Ceph-CSI driver will use the
+# network namespace of the DaemonSet instead of its own (the plugin pod). This pod is not expected
+# to be updated nor restarted unless the node reboots.
 kind: DaemonSet
 apiVersion: apps/v1
 metadata:
diff --git a/pkg/operator/ceph/csi/template/rbd/csi-rbdplugin-holder.yaml b/pkg/operator/ceph/csi/template/rbd/csi-rbdplugin-holder.yaml
index c64250673..6bf9b080f 100644
--- a/pkg/operator/ceph/csi/template/rbd/csi-rbdplugin-holder.yaml
+++ b/pkg/operator/ceph/csi/template/rbd/csi-rbdplugin-holder.yaml
@@ -1,9 +1,9 @@
-# This DaemonSet is only active when the cluster is deployed with Multus enabled or EnableCSIHostNetwork
-# is set to false. Hopefully in the future it will be part of every Ceph-CSI deployment. Its role is
-# to "hold" the network RBD block mapping that are created by the CSI driver. Essentially, it exposes
-# its network namespace into the Kubelet plugin directly and Ceph-CSI picks it up. When mapping an RBD
-# image, the Ceph-CSI driver will use the network namespace of the DaemonSet instead of its own (the plugin pod).
-# This pod is not expected to be updated nor restarted unless the node reboots.
+# This DaemonSet is only active when the cluster is deployed with Multus enabled. Hopefully in the
+# future it will be part of every Ceph-CSI deployment. Its role is to "hold" the network RBD block
+# mapping that are created by the CSI driver. Essentially, it exposes its network namespace into the
+# Kubelet plugin directly and Ceph-CSI picks it up. When mapping an RBD image, the Ceph-CSI driver
+# will use the network namespace of the DaemonSet instead of its own (the plugin pod). This pod is
+# not expected to be updated nor restarted unless the node reboots.
 kind: DaemonSet
 apiVersion: apps/v1
 metadata:
diff --git a/pkg/operator/ceph/csi/version.go b/pkg/operator/ceph/csi/version.go
index 5c27fbf5f..1a7f21b9e 100644
--- a/pkg/operator/ceph/csi/version.go
+++ b/pkg/operator/ceph/csi/version.go
@@ -40,8 +40,8 @@ var (
 	// custom ceph.conf is supported in v3.5.0+
 	cephConfSupportedVersion = CephCSIVersion{3, 5, 0}
 
-	// pod networking fix with the extra holder pod is supported with at least v3.6.1
-	nsenterSupportedVersion = CephCSIVersion{3, 6, 1}
+	// multus fix with the extra holder pod is supported with at least v3.6.1
+	multusSupportedVersion = CephCSIVersion{3, 6, 1}
 
 	// for parsing the output of `cephcsi`
 	versionCSIPattern = regexp.MustCompile(`v(\d+)\.(\d+)\.(\d+)`)
@@ -131,13 +131,13 @@ func (v *CephCSIVersion) SupportsCustomCephConf() bool {
 	return v.isAtLeast(&cephConfSupportedVersion)
 }
 
-// SupportsNsenter checks if the csi image has support for calling "nsenter" while executing
+// SupportsMultus checks if the csi image has support for calling "nsenter" while executing
 // mount/map commands. This is needed for Multus scenarios.
-func (v *CephCSIVersion) SupportsNsenter() bool {
+func (v *CephCSIVersion) SupportsMultus() bool {
 	// if AllowUnsupported is set also a csi-image greater than the supported ones are allowed
 	if AllowUnsupported {
 		return true
 	}
 
-	return v.isAtLeast(&nsenterSupportedVersion)
+	return v.isAtLeast(&multusSupportedVersion)
 }


Test patch:
diff --git a/.github/workflows/canary-integration-test.yml b/.github/workflows/canary-integration-test.yml
index bf16b17d8..5abfdaaae 100644
--- a/.github/workflows/canary-integration-test.yml
+++ b/.github/workflows/canary-integration-test.yml
@@ -104,26 +104,12 @@ jobs:
     - name: test external script with restricted_auth_permission flag and without having cephfs_filesystem flag
       run: |
         toolbox=$(kubectl get pod -l app=rook-ceph-tools -n rook-ceph -o jsonpath='{.items[*].metadata.name}')
-        # create `radosNamespace1` rados-namespace for `replicapool` rbd data-pool
-        kubectl -n rook-ceph exec $toolbox -- rbd namespace create replicapool/radosNamespace1
-        kubectl -n rook-ceph exec $toolbox -- python3 /etc/ceph/create-external-cluster-resources.py --rbd-data-pool-name replicapool --rados-namespace radosNamespace1 --cluster-name rookStorage --restricted-auth-permission true
-        # test the CRD created rados namespace `namespace-a` using external script
-        kubectl create -f deploy/examples/radosnamespace.yaml
-        timeout 60 sh -c "until kubectl -n rook-ceph exec $toolbox -- rbd namespace ls replicapool --format=json|jq .[0].name|grep -q "namespace-a"; do sleep 1 && echo 'waiting for the rados namespace to be created'; done"
-        kubectl -n rook-ceph exec $toolbox -- python3 /etc/ceph/create-external-cluster-resources.py --rbd-data-pool-name replicapool --rados-namespace namespace-a --cluster-name rookStorage --restricted-auth-permission true
-        # test the rados namespace which not exit for replicapool(false testing)
-        if output=$(kubectl -n rook-ceph exec $toolbox -- python3 /etc/ceph/create-external-cluster-resources.py --rbd-data-pool-name replicapool --rados-namespace false-test-namespace --cluster-name rookStorage --restricted-auth-permission true); then
-          echo $output
-        else
-          echo "script failed because wrong rados namespace was passed"
-        fi
+        kubectl -n rook-ceph exec $toolbox -- python3 /etc/ceph/create-external-cluster-resources.py --rbd-data-pool-name replicapool --cluster-name rookstorage --restricted-auth-permission true
 
     - name: test external script with restricted_auth_permission flag
       run: |
         toolbox=$(kubectl get pod -l app=rook-ceph-tools -n rook-ceph -o jsonpath='{.items[*].metadata.name}')
-        # create `radosNamespace` rados-namespace for `replicapool` rbd data-pool
-        kubectl -n rook-ceph exec $toolbox -- rbd namespace create replicapool/radosNamespace
-        kubectl -n rook-ceph exec $toolbox -- python3 /etc/ceph/create-external-cluster-resources.py --cephfs-filesystem-name myfs --rbd-data-pool-name replicapool --rados-namespace radosNamespace --cluster-name rookStorage --restricted-auth-permission true
+        kubectl -n rook-ceph exec $toolbox -- python3 /etc/ceph/create-external-cluster-resources.py --cephfs-filesystem-name myfs --rbd-data-pool-name replicapool --cluster-name rookstorage --restricted-auth-permission true
 
     - name: test the upgrade flag
       run: |
@@ -139,12 +125,12 @@ jobs:
       run: |
         toolbox=$(kubectl get pod -l app=rook-ceph-tools -n rook-ceph -o jsonpath='{.items[*].metadata.name}')
         # print existing client auth
-        kubectl -n rook-ceph exec $toolbox -- ceph auth get client.csi-rbd-node-rookStorage-replicapool-radosNamespace
-        # restricted auth user need to provide --rbd-data-pool-name, --rados-namespace,
+        kubectl -n rook-ceph exec $toolbox -- ceph auth get client.csi-rbd-node-rookstorage-replicapool
+        # restricted auth user need to provide --rbd-data-pool-name,
         #  --cluster-name and --run-as-user flag while upgrading
-        kubectl -n rook-ceph exec $toolbox -- python3 /etc/ceph/create-external-cluster-resources.py --upgrade --rbd-data-pool-name replicapool --rados-namespace radosNamespace --cluster-name rookStorage  --run-as-user client.csi-rbd-node-rookStorage-replicapool-radosNamespace
+        kubectl -n rook-ceph exec $toolbox -- python3 /etc/ceph/create-external-cluster-resources.py --upgrade --rbd-data-pool-name replicapool --cluster-name rookstorage  --run-as-user client.csi-rbd-node-rookstorage-replicapool
         # print ugraded client auth
-        kubectl -n rook-ceph exec $toolbox -- ceph auth get client.csi-rbd-node-rookStorage-replicapool-radosNamespace
+        kubectl -n rook-ceph exec $toolbox -- ceph auth get client.csi-rbd-node-rookstorage-replicapool
 
     - name: check-ownerreferences
       run: tests/scripts/github-action-helper.sh check_ownerreferences
@@ -1191,7 +1177,7 @@ jobs:
       run: tests/scripts/github-action-helper.sh wait_for_prepare_pod
 
     - name: wait for ceph to be ready
-      run: IS_POD_NETWORK=true IS_MULTUS=true tests/scripts/github-action-helper.sh wait_for_ceph_to_be_ready osd_multus 2
+      run: IS_MULTUS=true tests/scripts/github-action-helper.sh wait_for_ceph_to_be_ready osd_multus 2
 
     - name: wait for ceph-csi configmap to be updated with network namespace
       run: tests/scripts/github-action-helper.sh wait_for_ceph_csi_configmap_to_be_updated
@@ -1212,52 +1198,3 @@ jobs:
       if: failure() && github.event_name == 'pull_request'
       uses: mxschmitt/action-tmate@v3
       timeout-minutes: 60
-
-  csi-hostnetwork-disabled:
-    runs-on: ubuntu-18.04
-    if: "!contains(github.event.pull_request.labels.*.name, 'skip-ci')"
-    steps:
-    - name: checkout
-      uses: actions/checkout@v2
-      with:
-        fetch-depth: 0
-
-    - name: setup cluster resources
-      uses: ./.github/workflows/canary-test-config
-      with:
-        github-token: ${{ secrets.GITHUB_TOKEN }}
-
-
-    - name: use local disk and create partitions for osds
-      run: |
-        tests/scripts/github-action-helper.sh use_local_disk
-        tests/scripts/github-action-helper.sh create_partitions_for_osds
-
-    - name: deploy CSI hostNetworking disabled cluster
-      run: tests/scripts/github-action-helper.sh deploy_csi_hostnetwork_disabled_cluster
-
-    - name: wait for prepare pod
-      run: tests/scripts/github-action-helper.sh wait_for_prepare_pod
-
-    - name: wait for ceph to be ready
-      run: IS_POD_NETWORK=true tests/scripts/github-action-helper.sh wait_for_ceph_to_be_ready osd 2
-
-    - name: wait for ceph-csi configmap to be updated with network namespace
-      run: tests/scripts/github-action-helper.sh wait_for_ceph_csi_configmap_to_be_updated
-
-    - name: test ceph-csi-rbd plugin restart
-      run: tests/scripts/github-action-helper.sh test_csi_rbd_workload
-
-    - name: test ceph-csi-cephfs plugin restart
-      run: tests/scripts/github-action-helper.sh test_csi_cephfs_workload
-
-    - name: collect common logs
-      if: always()
-      uses: ./.github/workflows/collect-logs
-      with:
-        name: csi-hostnetwork-disabled
-
-    - name: setup tmate session for debugging when event is PR
-      if: failure() && github.event_name == 'pull_request'
-      uses: mxschmitt/action-tmate@v3
-      timeout-minutes: 60
diff --git a/pkg/operator/ceph/csi/spec_test.go b/pkg/operator/ceph/csi/spec_test.go
index bc8c74534..d530e25e1 100644
--- a/pkg/operator/ceph/csi/spec_test.go
+++ b/pkg/operator/ceph/csi/spec_test.go
@@ -42,9 +42,9 @@ func TestReconcileCSI_configureHolders(t *testing.T) {
 			Clientset:     testop.New(t, 1),
 			RookClientset: rookclient.NewSimpleClientset(),
 		},
-		opManagerContext:   context.TODO(),
-		opConfig:           opcontroller.OperatorConfig{},
-		clustersWithHolder: []ClusterDetail{},
+		opManagerContext: context.TODO(),
+		opConfig:         opcontroller.OperatorConfig{},
+		multusClusters:   []ClusterDetail{},
 	}
 
 	t.Run("no clusters, noop", func(t *testing.T) {
@@ -68,7 +68,7 @@ func TestReconcileCSI_configureHolders(t *testing.T) {
 			Namespace: r.opConfig.OperatorNamespace,
 		}
 
-		r.clustersWithHolder = []ClusterDetail{
+		r.multusClusters = []ClusterDetail{
 			{
 				cluster: &cephv1.CephCluster{
 					ObjectMeta: metav1.ObjectMeta{Namespace: "rook-ceph", Name: "my-cluster"},
diff --git a/pkg/operator/ceph/csi/version_test.go b/pkg/operator/ceph/csi/version_test.go
index 6ee5b8455..c1ef2bbcd 100644
--- a/pkg/operator/ceph/csi/version_test.go
+++ b/pkg/operator/ceph/csi/version_test.go
@@ -114,22 +114,22 @@ func TestSupportsCustomCephConf(t *testing.T) {
 	assert.True(t, ret)
 }
 
-func TestSupportsNsenter(t *testing.T) {
+func TestSupportsMultus(t *testing.T) {
 	t.Run("AllowUnsupported=true regardless of the version", func(t *testing.T) {
 		AllowUnsupported = true
-		ret := testMinVersion.SupportsNsenter()
+		ret := testMinVersion.SupportsMultus()
 		assert.True(t, ret)
 	})
 
 	t.Run("AllowUnsupported=false and version 3.5 is too old", func(t *testing.T) {
 		AllowUnsupported = false
-		ret := testMinVersion.SupportsNsenter()
+		ret := testMinVersion.SupportsMultus()
 		assert.False(t, ret)
 	})
 
 	t.Run("AllowUnsupported=false and version 3.6.1 is fine", func(t *testing.T) {
 		AllowUnsupported = false
-		ret := testReleaseV361.SupportsNsenter()
+		ret := testReleaseV361.SupportsMultus()
 		assert.True(t, ret)
 	})
 }
diff --git a/tests/scripts/github-action-helper.sh b/tests/scripts/github-action-helper.sh
index 7800de032..8962e2409 100755
--- a/tests/scripts/github-action-helper.sh
+++ b/tests/scripts/github-action-helper.sh
@@ -228,23 +228,6 @@ function deploy_cluster() {
   deploy_manifest_with_local_build toolbox.yaml
 }
 
-function deploy_csi_hostnetwork_disabled_cluster() {
-  create_cluster_prerequisites
-  cd deploy/examples
-  sed -i 's/.*CSI_ENABLE_HOST_NETWORK:.*/  CSI_ENABLE_HOST_NETWORK: \"false\"/g' operator.yaml
-  deploy_manifest_with_local_build operator.yaml
-  if [ $# == 0 ]; then
-    sed -i "s|#deviceFilter:|deviceFilter: ${BLOCK/\/dev\/}|g" cluster-test.yaml
-  elif [ "$1" = "two_osds_in_device" ] ; then
-    sed -i "s|#deviceFilter:|deviceFilter: ${BLOCK/\/dev\/}\n    config:\n      osdsPerDevice: \"2\"|g" cluster-test.yaml
-  elif [ "$1" = "osd_with_metadata_device" ] ; then
-    sed -i "s|#deviceFilter:|deviceFilter: ${BLOCK/\/dev\/}\n    config:\n      metadataDevice: /dev/test-rook-vg/test-rook-lv|g" cluster-test.yaml
-  fi
-  kubectl create -f cluster-test.yaml
-  kubectl create -f filesystem-test.yaml
-  deploy_manifest_with_local_build toolbox.yaml
-}
-
 function wait_for_prepare_pod() {
   get_pod_cmd=(kubectl --namespace rook-ceph get pod --no-headers)
   timeout=450
diff --git a/tests/scripts/validate_cluster.sh b/tests/scripts/validate_cluster.sh
index 6ff47c635..ac170130d 100755
--- a/tests/scripts/validate_cluster.sh
+++ b/tests/scripts/validate_cluster.sh
@@ -89,20 +89,17 @@ function test_demo_pool {
 
 function test_csi {
   timeout 360 bash -x <<-'EOF'
-    echo $IS_POD_NETWORK
     echo $IS_MULTUS
-    if [ -z "$IS_POD_NETWORK" ]; then
+    if [ -z $IS_MULTUS ]; then
       until [[ "$(kubectl -n rook-ceph get pods --field-selector=status.phase=Running|grep -c ^csi-)" -eq 4 ]]; do
         echo "waiting for csi pods to be ready"
         sleep 5
       done
     else
       until [[ "$(kubectl -n rook-ceph get pods --field-selector=status.phase=Running|grep -c ^csi-)" -eq 6 ]]; do
-        echo "waiting for csi pods to be ready with multus or pod networking"
+        echo "waiting for csi pods to be ready with multus"
         sleep 5
       done
-    fi
-    if [ -n "$IS_MULTUS" ]; then
       echo "verifying csi holder interfaces (multus ones must be present)"
       kubectl -n rook-ceph exec -t ds/csi-rbdplugin-holder-my-cluster -- grep net /proc/net/dev
       kubectl -n rook-ceph exec -t ds/csi-cephfsplugin-holder-my-cluster -- grep net /proc/net/dev