fix(rook-ceph-cluster/biohazard): 1.14-1.16 upgrade prep

kube/deploy/core/storage/rook-ceph/cluster/biohazard/hr.yaml

@@ -36,6 +36,9 @@ spec:
         name: rook-ceph
         kind: HelmRepository
         namespace: flux-system
+  dependsOn:
+    - name: rook-ceph
+      namespace: rook-ceph
   values:
     clusterName: "${CLUSTER_NAME:=biohazard}"
     operatorNamespace: "rook-ceph"
@@ -49,7 +52,7 @@ spec:
       mon_data_avail_warn = 10
     cephClusterSpec:
       cephVersion:
-        image: "quay.io/ceph/ceph:v18.2.0" # TODO: temp rolled back to 18.2.0 for Prom metrics, 18.2.1 breaks some metrics
+        image: "quay.io/ceph/ceph:v18.2.4@sha256:6ac7f923aa1d23b43248ce0ddec7e1388855ee3d00813b52c3172b0b23b37906" # 2025-01-14: not v19 Squid yet due to CephFS MDS trim issue
       network:
         provider: host
         addressRanges:
@@ -418,3 +421,8 @@ spec:
           - hosts:
               - *dashboard-host
     pspEnable: false
+    csi:
+      readAffinity:
+        enabled: true
+      cephfs:
+        kernelMountOptions: "ms_mode=prefer-secure,recover_session=clean" # needed for mounting CephFS on a cluster with network encryption enabled, and recover_session allows CephFS to gracefully recover from network failure causing MDS to blocklist