feat(storage): expose volume encryption for the LVM CSI StorageClass

[abonillabeeche]

Draft — I mirrored the proven driver.longhorn.io_v1.vue encryption block and
ran a JS-parse sanity check, but I could not run the extension's full yarn lint /
build locally. Please let CI (or a maintainer) verify lint/build before merge.

Problem

The StorageClass creation form renders the encryption toggle + secret picker only
for the Longhorn provisioner components (provisioners/driver.longhorn.io_v1.vue /
_v2.vue). The LVM provisioner form (provisioners/lvm.driver.harvesterhci.io.vue) has
no way to enable encryption, so users cannot create an encrypted
lvm.driver.harvesterhci.io StorageClass from the dashboard — they'd have to hand-edit
YAML.

Change

Add the same encryption UI to the LVM provisioner component:

• Volume Encryption RadioGroup bound to parameters.encrypted.
• Secret LabeledSelect that populates the csi.storage.k8s.io/* provisioner /
  node-publish / node-stage (and node-expand, when the online-expansion feature is on)
  secret parameters from the shared CSI_SECRETS map — identical to Longhorn.
• Gated on the existing volumeEncryption feature flag
  (value.volumeEncryptionFeatureEnabled); reuses the SECRET prefetch already done in
  index.vue.
• Encryption-managed params are stripped from the raw KeyValue editor to avoid
  double entry.

Nothing else needs to change: images, volumes, VMs and snapshot/backup restore already
detect encryption generically via StorageClass.isEncrypted
(parameters.encrypted === 'true'), which is provisioner-agnostic. The CDI Settings
tab already lets users set cloneStrategy: copy, which encrypted LVM SCs need so CDI
image clones write through the dm-crypt mapper.

Why the same secret schema works

The LVM CSI driver uses the same encrypted: "true" + CRYPTO_KEY_* secret convention
as Longhorn (validated end-to-end: LUKS2/aes-xts-plain64 on disk, Linux + Windows VMs,
snapshots, Kasten backup/restore all confirmed encrypted). Driver-side support:
harvester/csi-driver-lvm#67.

Test plan

• JS block parses (sanity-checked).
• Needs: yarn lint + build in CI.
• Manual: with the volumeEncryption feature enabled, create a StorageClass, select the
  LVM provisioner, toggle Volume Encryption on, pick a CRYPTO_KEY_* secret, save, and
  confirm the resulting SC has encrypted: "true" + the CSI secret params.

Related

• Tracking issue: [FEATURE] Encryption at rest for LVM local volumes (LUKS2/dm-crypt) harvester#11442
• Driver support: feat: encryption at rest for dm-thin volumes (LUKS2/dm-crypt) csi-driver-lvm#67
• Docs: docs(lvm): document encryption at rest for LVM volumes docs#1107