From fb33d87d335cdf5a7639ab9b2861e59360cd600a Mon Sep 17 00:00:00 2001 From: shenjiatong Date: Wed, 24 Feb 2021 14:11:17 +0800 Subject: [PATCH] ceph: remove `generateKeyring` for osd After adopting `ceph-volume`, secret key for user osd.x will be generated by `ceph-volume` and thus method `generateKeyring` is not necessary anymore. Executing ceph command takes extra half of second to complete, executing it in serial is rather expensive, remove it for better performance. Signed-off-by: shenjiatong --- pkg/operator/ceph/cluster/osd/config.go | 30 +------------------------ pkg/operator/ceph/cluster/osd/osd.go | 18 --------------- 2 files changed, 1 insertion(+), 47 deletions(-) diff --git a/pkg/operator/ceph/cluster/osd/config.go b/pkg/operator/ceph/cluster/osd/config.go index 66e52e828..4ebf86d8a 100644 --- a/pkg/operator/ceph/cluster/osd/config.go +++ b/pkg/operator/ceph/cluster/osd/config.go @@ -20,46 +20,18 @@ import ( "encoding/base64" "fmt" "path" - "strconv" "github.com/pkg/errors" cephv1 "github.com/rook/rook/pkg/apis/ceph.rook.io/v1" "github.com/rook/rook/pkg/operator/ceph/cluster/mgr" opconfig "github.com/rook/rook/pkg/operator/ceph/config" - "github.com/rook/rook/pkg/operator/ceph/config/keyring" v1 "k8s.io/api/core/v1" ) const ( - // don't list caps in keyring; allow OSD to get those from mons - keyringTemplate = `[osd.%s] -key = %s -` - - // OsdEncryptionSecretNameKeyName is the key name of the Secret that contains the OSD encryption key - // #nosec G101 since this is not leaking any hardcoded credentials, it's just the secret key name - OsdEncryptionSecretNameKeyName = "dmcrypt-key" - dmCryptKeySize = 128 + dmCryptKeySize = 128 ) -func (c *Cluster) generateKeyring(osdID int) (string, error) { - deploymentName := fmt.Sprintf(osdAppNameFmt, osdID) - osdIDStr := strconv.Itoa(osdID) - - user := fmt.Sprintf("osd.%s", osdIDStr) - access := []string{"osd", "allow *", "mon", "allow profile osd"} - - s := keyring.GetSecretStore(c.context, c.clusterInfo, &c.clusterInfo.OwnerRef) - - key, err := s.GenerateKey(user, access) - if err != nil { - return "", err - } - - keyring := fmt.Sprintf(keyringTemplate, osdIDStr, key) - return keyring, s.CreateOrUpdate(deploymentName, keyring) -} - // PrivilegedContext returns a privileged Pod security context func PrivilegedContext() *v1.SecurityContext { privileged := true diff --git a/pkg/operator/ceph/cluster/osd/osd.go b/pkg/operator/ceph/cluster/osd/osd.go index d11587b0a..de2b04663 100644 --- a/pkg/operator/ceph/cluster/osd/osd.go +++ b/pkg/operator/ceph/cluster/osd/osd.go @@ -590,15 +590,6 @@ func (c *Cluster) startOSDDaemonsOnPVC(pvcName string, config *provisionConfig, for _, osd := range osds { logger.Debugf("start osd %v", osd) - // keyring must be generated before deployment creation in order to avoid a race condition resulting - // in intermittent failure of first-attempt OSD pods. - _, err := c.generateKeyring(osd.ID) - if err != nil { - errMsg := fmt.Sprintf("failed to create keyring for pvc %q, osd %v. %v", osdProps.crushHostname, osd, err) - config.addError(errMsg) - continue - } - dp, err := c.makeDeployment(osdProps, osd, config) if err != nil { errMsg := fmt.Sprintf("failed to create deployment for pvc %q. %v", osdProps.crushHostname, err) @@ -660,15 +651,6 @@ func (c *Cluster) startOSDDaemonsOnNode(nodeName string, config *provisionConfig logger.Debugf("start osd %v", osd) opconfig.ConditionExport(c.context, c.clusterInfo.NamespacedName(), cephv1.ConditionProgressing, v1.ConditionTrue, "ClusterProgressing", fmt.Sprintf("Processing node %s osd %d", nodeName, osd.ID)) - // keyring must be generated before deployment creation in order to avoid a race condition resulting - // in intermittent failure of first-attempt OSD pods. - _, err := c.generateKeyring(osd.ID) - if err != nil { - errMsg := fmt.Sprintf("failed to create keyring for node %q, osd %v. %v", n.Name, osd, err) - config.addError(errMsg) - continue - } - dp, err := c.makeDeployment(osdProps, osd, config) if err != nil { errMsg := fmt.Sprintf("failed to create deployment for node %s: %v", n.Name, err)