From 13440364198c56181d026bbc61ba0954017c7201 Mon Sep 17 00:00:00 2001 From: parth-gr Date: Tue, 28 Feb 2023 19:29:39 +0530 Subject: [PATCH] external: add realm support for external cluster if a cluster won't use the deafult realm and try to execute the python script it will fail to vaildate rgw as the rgw-admin-user would be created on default realm So creating user in specific realm if the realm name is passed Signed-off-by: parth-gr (cherry picked from commit 96ea7817f8160067788bf71c844da378c9775d11) --- .github/workflows/canary-integration-test.yml | 14 ++++++++++ .../CRDs/Cluster/external-cluster.md | 1 + .../create-external-cluster-resources.py | 28 +++++++++++++++++++ pkg/operator/ceph/object/objectstore.go | 9 +++--- 4 files changed, 47 insertions(+), 5 deletions(-) diff --git a/.github/workflows/canary-integration-test.yml b/.github/workflows/canary-integration-test.yml index ddf107cca..adf0cde9c 100644 --- a/.github/workflows/canary-integration-test.yml +++ b/.github/workflows/canary-integration-test.yml @@ -177,6 +177,20 @@ jobs: # pass the valid rgw-endpoint of same ceph cluster with --rgw-skip-tls timeout 15 sh -c "until kubectl -n rook-ceph exec $toolbox -- python3 /etc/ceph/create-external-cluster-resources.py --rbd-data-pool-name replicapool --rgw-endpoint $rgw_endpoint --rgw-skip-tls true; do sleep 1 && echo 'waiting for the rgw endpoint to be validated'; done" + - name: validate multisite + run: | + toolbox=$(kubectl get pod -l app=rook-ceph-tools -n rook-ceph -o jsonpath='{.items[*].metadata.name}') + # create realm + kubectl -n rook-ceph exec $toolbox -- radosgw-admin realm create --rgw-realm=realm1 + # pass correct realm + kubectl -n rook-ceph exec $toolbox -- python3 /etc/ceph/create-external-cluster-resources.py --rbd-data-pool-name replicapool --rgw-realm-name realm1 + # pass wrong realm + if output=$(kubectl -n rook-ceph exec $toolbox -- python3 /etc/ceph/create-external-cluster-resources.py --rbd-data-pool-name replicapool --rgw-realm-name realm3); then + exit 1 + else + echo "script failed because wrong realm was passed" + fi + - name: check-ownerreferences run: tests/scripts/github-action-helper.sh check_ownerreferences diff --git a/Documentation/CRDs/Cluster/external-cluster.md b/Documentation/CRDs/Cluster/external-cluster.md index 1ff9f013c..ef7f77711 100644 --- a/Documentation/CRDs/Cluster/external-cluster.md +++ b/Documentation/CRDs/Cluster/external-cluster.md @@ -56,6 +56,7 @@ python3 create-external-cluster-resources.py --rbd-data-pool-name -- - `--cephfs-data-pool-name`: (optional) Provides the name of the CephFS data pool, used for creating CephFS StorageClass - `--rados-namespace`: (optional) Divides a pool into separate logical namespaces, used for creating RBD PVC in a RadosNamespaces - `--subvolume-group`: (optional) Provides the name of the subvolume group, used for creating CephFS PVC in a subvolumeGroup +- `--rgw-realm-name`: (optional) Provides the name of the rgw-realm - `--upgrade`: (optional) Upgrades the 'Ceph CSI keyrings (For example: client.csi-cephfs-provisioner) with new permissions needed for the new cluster version and older permission will still be applied. - `--restricted-auth-permission`: (optional) Restrict cephCSIKeyrings auth permissions to specific pools, and cluster. Mandatory flags that need to be set are `--rbd-data-pool-name`, and `--cluster-name`. `--cephfs-filesystem-name` flag can also be passed in case of CephFS user restriction, so it can restrict users to particular CephFS filesystem. diff --git a/deploy/examples/create-external-cluster-resources.py b/deploy/examples/create-external-cluster-resources.py index 3285d0ae2..51d53e6fa 100644 --- a/deploy/examples/create-external-cluster-resources.py +++ b/deploy/examples/create-external-cluster-resources.py @@ -429,6 +429,12 @@ class RadosJSON: required=False, help="provides the name of the subvolume group", ) + output_group.add_argument( + "--rgw-realm-name", + default="", + required=False, + help="provides the name of the rgw-realm", + ) upgrade_group = argP.add_argument_group("upgrade") upgrade_group.add_argument( @@ -1105,6 +1111,8 @@ class RadosJSON: "Rook RGW Admin Ops user", "--caps", "buckets=*;users=*;usage=read;metadata=read;zone=read", + "--rgw-realm", + self._arg_parser.rgw_realm_name, ] if self._arg_parser.dry_run: return self.dry_run("ceph " + " ".join(cmd)) @@ -1305,6 +1313,24 @@ class RadosJSON: ).format(self._arg_parser.rgw_endpoint, rgw_fsid, fsid) ) + def validate_rgw_realm_name(self): + if self._arg_parser.rgw_realm_name != "": + cmd = [ + "radosgw-admin", + "realm", + "get", + "--rgw-realm", + self._arg_parser.rgw_realm_name, + ] + try: + output = subprocess.check_output(cmd, stderr=subprocess.PIPE) + except subprocess.CalledProcessError as execErr: + err_msg = ( + "failed to execute command %s. Output: %s. Code: %s. Error: %s" + % (cmd, execErr.output, execErr.returncode, execErr.stderr) + ) + raise Exception(err_msg) + def _gen_output_map(self): if self.out_map: return @@ -1318,6 +1344,7 @@ class RadosJSON: self.validate_pool() self.validate_rados_namespace() self.validate_subvolume_group() + self.validate_rgw_realm_name() self._excluded_keys.add("CLUSTER_NAME") self.get_cephfs_data_pool_details() self.out_map["NAMESPACE"] = self._arg_parser.namespace @@ -1367,6 +1394,7 @@ class RadosJSON: self.out_map[ "RBD_METADATA_EC_POOL_NAME" ] = self.validate_rgw_metadata_ec_pool_name() + self.out_map["RGW_REALM_NAME"] = self._arg_parser.rgw_realm_name self.out_map["RGW_POOL_PREFIX"] = self._arg_parser.rgw_pool_prefix if self._arg_parser.rgw_endpoint: if self._arg_parser.dry_run: diff --git a/pkg/operator/ceph/object/objectstore.go b/pkg/operator/ceph/object/objectstore.go index 38b54fea8..57ac0a34c 100644 --- a/pkg/operator/ceph/object/objectstore.go +++ b/pkg/operator/ceph/object/objectstore.go @@ -207,13 +207,12 @@ func deleteSingleSiteRealmAndPools(objContext *Context, spec cephv1.ObjectStoreS func getMultisiteForObjectStore(ctx context.Context, clusterdContext *clusterd.Context, spec *cephv1.ObjectStoreSpec, namespace, name string) (string, string, string, error) { if spec.IsExternal() { - // Currently external cluster with zones/zonegroup/realm are not supported, will be - // fixed by https://github.com/rook/rook/issues/6342. So if user does not create - // zone/zonegroup, RGW internally creates zone/zonegroup named as `default`, hence - // Rook can set this value in the object context fields. + // In https://github.com/rook/rook/issues/6342, it was determined that + // a multisite context isn't needed for external mode CephObjectStores. + // The context is only needed for managing an object store, which isn't + // happening in external mode. return "", "default", "default", nil } - if spec.IsMultisite() { zone, err := clusterdContext.RookClientset.CephV1().CephObjectZones(namespace).Get(ctx, spec.Zone.Name, metav1.GetOptions{}) if err != nil {