Merge pull request #7299 from jshen28/remove-generatekeyring-for-osd

ceph: remove unnecessary generate key for osd

pkg/operator/ceph/cluster/osd/config.go

@@ -20,46 +20,18 @@ import (
 	"encoding/base64"
 	"fmt"
 	"path"
-	"strconv"
 
 	"github.com/pkg/errors"
 	cephv1 "github.com/rook/rook/pkg/apis/ceph.rook.io/v1"
 	"github.com/rook/rook/pkg/operator/ceph/cluster/mgr"
 	opconfig "github.com/rook/rook/pkg/operator/ceph/config"
-	"github.com/rook/rook/pkg/operator/ceph/config/keyring"
 	v1 "k8s.io/api/core/v1"
 )
 
 const (
-	// don't list caps in keyring; allow OSD to get those from mons
-	keyringTemplate = `[osd.%s]
-key = %s
-`
-
-	// OsdEncryptionSecretNameKeyName is the key name of the Secret that contains the OSD encryption key
-	// #nosec G101 since this is not leaking any hardcoded credentials, it's just the secret key name
-	OsdEncryptionSecretNameKeyName = "dmcrypt-key"
-	dmCryptKeySize                 = 128
+	dmCryptKeySize = 128
 )
 
-func (c *Cluster) generateKeyring(osdID int) (string, error) {
-	deploymentName := fmt.Sprintf(osdAppNameFmt, osdID)
-	osdIDStr := strconv.Itoa(osdID)
-
-	user := fmt.Sprintf("osd.%s", osdIDStr)
-	access := []string{"osd", "allow *", "mon", "allow profile osd"}
-
-	s := keyring.GetSecretStore(c.context, c.clusterInfo, &c.clusterInfo.OwnerRef)
-
-	key, err := s.GenerateKey(user, access)
-	if err != nil {
-		return "", err
-	}
-
-	keyring := fmt.Sprintf(keyringTemplate, osdIDStr, key)
-	return keyring, s.CreateOrUpdate(deploymentName, keyring)
-}
-
 // PrivilegedContext returns a privileged Pod security context
 func PrivilegedContext() *v1.SecurityContext {
 	privileged := true

pkg/operator/ceph/cluster/osd/osd.go

@@ -590,15 +590,6 @@ func (c *Cluster) startOSDDaemonsOnPVC(pvcName string, config *provisionConfig,
 	for _, osd := range osds {
 		logger.Debugf("start osd %v", osd)
 
-		// keyring must be generated before deployment creation in order to avoid a race condition resulting
-		// in intermittent failure of first-attempt OSD pods.
-		_, err := c.generateKeyring(osd.ID)
-		if err != nil {
-			errMsg := fmt.Sprintf("failed to create keyring for pvc %q, osd %v. %v", osdProps.crushHostname, osd, err)
-			config.addError(errMsg)
-			continue
-		}
-
 		dp, err := c.makeDeployment(osdProps, osd, config)
 		if err != nil {
 			errMsg := fmt.Sprintf("failed to create deployment for pvc %q. %v", osdProps.crushHostname, err)
@@ -660,15 +651,6 @@ func (c *Cluster) startOSDDaemonsOnNode(nodeName string, config *provisionConfig
 		logger.Debugf("start osd %v", osd)
 		opconfig.ConditionExport(c.context, c.clusterInfo.NamespacedName(), cephv1.ConditionProgressing, v1.ConditionTrue, "ClusterProgressing", fmt.Sprintf("Processing node %s osd %d", nodeName, osd.ID))
 
-		// keyring must be generated before deployment creation in order to avoid a race condition resulting
-		// in intermittent failure of first-attempt OSD pods.
-		_, err := c.generateKeyring(osd.ID)
-		if err != nil {
-			errMsg := fmt.Sprintf("failed to create keyring for node %q, osd %v. %v", n.Name, osd, err)
-			config.addError(errMsg)
-			continue
-		}
-
 		dp, err := c.makeDeployment(osdProps, osd, config)
 		if err != nil {
 			errMsg := fmt.Sprintf("failed to create deployment for node %s: %v", n.Name, err)