From 29fc3d3a5eb2c2b57cc65d8d48bb067be74e2662 Mon Sep 17 00:00:00 2001
From: raaizik <132667934+raaizik@users.noreply.github.com>
Date: Tue, 1 Jul 2025 18:32:48 +0300
Subject: [PATCH] core: fix CephObjectRealm controller generated generated
 AccessKey invalid chars

Suggested fix for issue https://github.com/rook/rook/issues/16072
Adds key type differentiation to exclude invalid characters from AccessKey

Signed-off-by: raaizik <132667934+raaizik@users.noreply.github.com>
(cherry picked from commit 1b3f36ff5c884284d22b45df9f3e3a1d8ed14d1e)
---
 pkg/operator/ceph/cluster/mgr/dashboard.go    | 19 ++++++++++++++++---
 .../ceph/cluster/mgr/dashboard_test.go        |  6 +++---
 pkg/operator/ceph/object/realm/controller.go  |  4 ++--
 3 files changed, 21 insertions(+), 8 deletions(-)

diff --git a/pkg/operator/ceph/cluster/mgr/dashboard.go b/pkg/operator/ceph/cluster/mgr/dashboard.go
index f87e2da01..dedf20a18 100644
--- a/pkg/operator/ceph/cluster/mgr/dashboard.go
+++ b/pkg/operator/ceph/cluster/mgr/dashboard.go
@@ -55,6 +55,13 @@ var (
 	removeMgrDaemonConfiguration = true
 )
 
+type KeyType int
+
+const (
+	DefaultKey KeyType = iota
+	AccessKey
+)
+
 func (c *Cluster) configureDashboardService() error {
 	dashboardService, err := c.makeDashboardService(AppName)
 	if err != nil {
@@ -325,7 +332,7 @@ func (c *Cluster) getOrGenerateDashboardPassword() (string, error) {
 	}
 
 	// Generate a password
-	password, err := GeneratePassword(passwordLength)
+	password, err := GeneratePassword(passwordLength, DefaultKey)
 	if err != nil {
 		return "", errors.Wrap(err, "failed to generate password")
 	}
@@ -354,9 +361,15 @@ func (c *Cluster) getOrGenerateDashboardPassword() (string, error) {
 	return password, nil
 }
 
-func GeneratePassword(length int) (string, error) {
+func GeneratePassword(length int, keyType KeyType) (string, error) {
 	//nolint:gosec // because of the word password
-	const passwordChars = "!\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~"
+	passwordChars := "!\"#$%&'()*+,-.0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~"
+
+	if keyType == DefaultKey {
+		//nolint:gosec // because of the word password
+		passwordChars += "/"
+	}
+
 	passwd, err := GenerateRandomBytes(length)
 	if err != nil {
 		return "", errors.Wrap(err, "failed to generate password")
diff --git a/pkg/operator/ceph/cluster/mgr/dashboard_test.go b/pkg/operator/ceph/cluster/mgr/dashboard_test.go
index 4fea16c18..7790a7260 100644
--- a/pkg/operator/ceph/cluster/mgr/dashboard_test.go
+++ b/pkg/operator/ceph/cluster/mgr/dashboard_test.go
@@ -35,16 +35,16 @@ import (
 )
 
 func TestGeneratePassword(t *testing.T) {
-	password, err := GeneratePassword(0)
+	password, err := GeneratePassword(0, DefaultKey)
 	require.Nil(t, err)
 	assert.Equal(t, "", password)
 
-	password, err = GeneratePassword(1)
+	password, err = GeneratePassword(1, DefaultKey)
 	require.Nil(t, err)
 	assert.Equal(t, 1, len(password))
 	logger.Infof("password: %s", password)
 
-	password, err = GeneratePassword(10)
+	password, err = GeneratePassword(10, DefaultKey)
 	require.Nil(t, err)
 	assert.Equal(t, 10, len(password))
 	logger.Infof("password: %s", password)
diff --git a/pkg/operator/ceph/object/realm/controller.go b/pkg/operator/ceph/object/realm/controller.go
index a8d24f49b..5f92ad592 100644
--- a/pkg/operator/ceph/object/realm/controller.go
+++ b/pkg/operator/ceph/object/realm/controller.go
@@ -275,13 +275,13 @@ func (r *ReconcileObjectRealm) createRealmKeys(realm *cephv1.CephObjectRealm) (r
 	}
 
 	// the realm's secret key and access key are randomly generated and then encoded to base64
-	accessKey, err := mgr.GeneratePassword(accessKeyLength)
+	accessKey, err := mgr.GeneratePassword(accessKeyLength, mgr.AccessKey)
 	if err != nil {
 		return reconcile.Result{}, errors.Wrapf(err, "access key failed to generate")
 	}
 	accessKey = base64.StdEncoding.EncodeToString([]byte(accessKey))
 
-	secretKey, err := mgr.GeneratePassword(secretKeyLength)
+	secretKey, err := mgr.GeneratePassword(secretKeyLength, mgr.DefaultKey)
 	if err != nil {
 		return reconcile.Result{}, errors.Wrapf(err, "failed to generate secret key")
 	}