external: add realm support for external cluster

if a cluster won't use the deafult realm and try to
execute the python script it will fail to vaildate rgw
as the rgw-admin-user would be created on default realm
So creating user in specific realm if the realm name is passed

Signed-off-by: parth-gr <paarora@redhat.com>
(cherry picked from commit 96ea7817f8)

.github/workflows/canary-integration-test.yml

@@ -177,6 +177,20 @@ jobs:
           # pass the valid rgw-endpoint of same ceph cluster with --rgw-skip-tls
           timeout 15 sh -c "until kubectl -n rook-ceph exec $toolbox -- python3 /etc/ceph/create-external-cluster-resources.py --rbd-data-pool-name replicapool --rgw-endpoint $rgw_endpoint --rgw-skip-tls true; do sleep 1 && echo 'waiting for the rgw endpoint to be validated'; done"
 
+      - name: validate multisite
+        run: |
+          toolbox=$(kubectl get pod -l app=rook-ceph-tools -n rook-ceph -o jsonpath='{.items[*].metadata.name}')
+          # create realm
+          kubectl -n rook-ceph exec $toolbox -- radosgw-admin realm create --rgw-realm=realm1
+          # pass correct realm
+          kubectl -n rook-ceph exec $toolbox -- python3 /etc/ceph/create-external-cluster-resources.py --rbd-data-pool-name replicapool --rgw-realm-name realm1
+          # pass wrong realm
+          if output=$(kubectl -n rook-ceph exec $toolbox -- python3 /etc/ceph/create-external-cluster-resources.py --rbd-data-pool-name replicapool --rgw-realm-name realm3); then
+            exit 1
+          else
+            echo "script failed because wrong realm was passed"
+          fi
+
       - name: check-ownerreferences
         run: tests/scripts/github-action-helper.sh check_ownerreferences
 

Documentation/CRDs/Cluster/external-cluster.md

@@ -56,6 +56,7 @@ python3 create-external-cluster-resources.py --rbd-data-pool-name <pool_name> --
 - `--cephfs-data-pool-name`: (optional) Provides the name of the CephFS data pool, used for creating CephFS StorageClass
 - `--rados-namespace`: (optional) Divides a pool into separate logical namespaces, used for creating RBD PVC in a RadosNamespaces
 - `--subvolume-group`: (optional) Provides the name of the subvolume group, used for creating CephFS PVC in a subvolumeGroup
+- `--rgw-realm-name`: (optional) Provides the name of the rgw-realm
 - `--upgrade`: (optional) Upgrades the 'Ceph CSI keyrings (For example: client.csi-cephfs-provisioner) with new permissions needed for the new cluster version and older permission will still be applied.
 - `--restricted-auth-permission`: (optional) Restrict cephCSIKeyrings auth permissions to specific pools, and cluster. Mandatory flags that need to be set are `--rbd-data-pool-name`, and `--cluster-name`. `--cephfs-filesystem-name` flag can also be passed in case of CephFS user restriction, so it can restrict users to particular CephFS filesystem.
 

deploy/examples/create-external-cluster-resources.py

@@ -429,6 +429,12 @@ class RadosJSON:
             required=False,
             help="provides the name of the subvolume group",
         )
+        output_group.add_argument(
+            "--rgw-realm-name",
+            default="",
+            required=False,
+            help="provides the name of the rgw-realm",
+        )
 
         upgrade_group = argP.add_argument_group("upgrade")
         upgrade_group.add_argument(
@@ -1105,6 +1111,8 @@ class RadosJSON:
             "Rook RGW Admin Ops user",
             "--caps",
             "buckets=*;users=*;usage=read;metadata=read;zone=read",
+            "--rgw-realm",
+            self._arg_parser.rgw_realm_name,
         ]
         if self._arg_parser.dry_run:
             return self.dry_run("ceph " + " ".join(cmd))
@@ -1305,6 +1313,24 @@ class RadosJSON:
                 ).format(self._arg_parser.rgw_endpoint, rgw_fsid, fsid)
             )
 
+    def validate_rgw_realm_name(self):
+        if self._arg_parser.rgw_realm_name != "":
+            cmd = [
+                "radosgw-admin",
+                "realm",
+                "get",
+                "--rgw-realm",
+                self._arg_parser.rgw_realm_name,
+            ]
+            try:
+                output = subprocess.check_output(cmd, stderr=subprocess.PIPE)
+            except subprocess.CalledProcessError as execErr:
+                err_msg = (
+                    "failed to execute command %s. Output: %s. Code: %s. Error: %s"
+                    % (cmd, execErr.output, execErr.returncode, execErr.stderr)
+                )
+                raise Exception(err_msg)
+
     def _gen_output_map(self):
         if self.out_map:
             return
@@ -1318,6 +1344,7 @@ class RadosJSON:
         self.validate_pool()
         self.validate_rados_namespace()
         self.validate_subvolume_group()
+        self.validate_rgw_realm_name()
         self._excluded_keys.add("CLUSTER_NAME")
         self.get_cephfs_data_pool_details()
         self.out_map["NAMESPACE"] = self._arg_parser.namespace
@@ -1367,6 +1394,7 @@ class RadosJSON:
         self.out_map[
             "RBD_METADATA_EC_POOL_NAME"
         ] = self.validate_rgw_metadata_ec_pool_name()
+        self.out_map["RGW_REALM_NAME"] = self._arg_parser.rgw_realm_name
         self.out_map["RGW_POOL_PREFIX"] = self._arg_parser.rgw_pool_prefix
         if self._arg_parser.rgw_endpoint:
             if self._arg_parser.dry_run:

pkg/operator/ceph/object/objectstore.go

@@ -207,13 +207,12 @@ func deleteSingleSiteRealmAndPools(objContext *Context, spec cephv1.ObjectStoreS
 func getMultisiteForObjectStore(ctx context.Context, clusterdContext *clusterd.Context, spec *cephv1.ObjectStoreSpec, namespace, name string) (string, string, string, error) {
 
 	if spec.IsExternal() {
-		// Currently external cluster with zones/zonegroup/realm are not supported, will be
-		// fixed by https://github.com/rook/rook/issues/6342. So if user does not create
-		// zone/zonegroup, RGW internally creates zone/zonegroup named as `default`, hence
-		// Rook can set this value in the object context fields.
+		// In https://github.com/rook/rook/issues/6342, it was determined that
+		// a multisite context isn't needed for external mode CephObjectStores.
+		// The context is only needed for managing an object store, which isn't
+		// happening in external mode.
 		return "", "default", "default", nil
 	}
-
 	if spec.IsMultisite() {
 		zone, err := clusterdContext.RookClientset.CephV1().CephObjectZones(namespace).Get(ctx, spec.Zone.Name, metav1.GetOptions{})
 		if err != nil {