Dashboard 强制使用 prometheusEndpointSSLVerify: false — 没有办法为 mgr 提供自定义 CA

**Is this a bug report or feature request?** * Feature Request **What should the feature do:** Honor a custom CA bundle for the ceph-mgr pod, in the same way that `CephObjectStore.spec.gateway.caBundleRef` already does for the RGW — e.g. `CephCluster.spec.mgr.caBundleRef`, or a cluster-wide `CephCluster.spec.caBundleRef` that applies to all daemon pods. **What is the use case behind this feature:** The Ceph dashboard runs inside ceph-mgr and makes outbound HTTPS calls — most importantly to the Prometheus API configured through `CephCluster.spec.dashboard.prometheusEndpoint`. When that endpoint serves a certificate from an internal PKI, there is currently no way to make the mgr trust it, so `spec.dashboard.prometheusEndpointSSLVerify` has to be set to `false`. That is the only unverified TLS hop left in our cluster, and it is not a configuration choice — there is no alternative. Why the obvious alternatives do not work (all measured on a running cluster, Rook v1.20.3 / Ceph v20.2.2): 1. Ceph's own custom-CA path is gated behind cephadm. `src/pybind/mgr/dashboard/controllers/prometheus.py`: verify = ca_cert_file.name if ca_cert_file else Settings.PROMETHEUS_API_SSL_VERIFY … is_cephadm = mgr.get_module_option_ex('orchestrator', 'orchestrator') == 'cephadm' if not is_cephadm: return Credentials(user, password, ca_cert_file, cert_file, pkey_file) # all None 2. The setting cannot carry a path instead of a bool: `PROMETHEUS_API_SSL_VERIFY = Setting(True, [bool]).` 3. The CephCluster CRD offers no way to mount a file or set an env var on the mgr. In the installed CRD: 0 occurrences of `volumeMounts`, 0 of `"env"`, `spec.mgr` only has `allowMultiplePerNode`, `count`, `hostNetwork`, `modules`, placement and resources. 4. `verify=True` therefore falls back to the container's system trust store: `requests.certs.where()` -> `/etc/pki/tls/certs/ca-bundle.crt` (146 public roots), and `/etc/pki/ca-trust/source/anchors/` is empty. **Why this should be a small change:** the dashboard uses Python-requests, which honors `CURL_CA_BUNDLE` exactly when `verify` is `True`. Measured inside the mgr container (requests 2.25.1, `requests/sessions.py`): if verify is True or verify is None: verify = …