From 944b7fc06420a4bd693841c1c5d4593ae89b9416 Mon Sep 17 00:00:00 2001 From: Sebastian Hasler Date: Mon, 11 Sep 2023 21:32:08 +0200 Subject: [PATCH] object: unique username for OBC even when preceding OBC was retained For an OBC's name we cannot simply use the OBC's namespace and name, because they can be reused, while the preceding bucket might be retained by reclaimPolicy. (Commit 2733375ca4ef also didn't solve this issue, as it is an intra-cluster issue.) Therefore we instead use the OBC's UID which should be unique within the cluster and across clusters. Signed-off-by: Sebastian Hasler (cherry picked from commit 041fc1a71ce5fc6c6f7be323fb855642a7c86452) --- pkg/operator/ceph/object/bucket/provisioner.go | 5 +---- .../ceph/object/bucket/rgw-handlers.go | 18 +++++++++--------- 2 files changed, 10 insertions(+), 13 deletions(-) diff --git a/pkg/operator/ceph/object/bucket/provisioner.go b/pkg/operator/ceph/object/bucket/provisioner.go index 53ff585c3..d37d8e2d0 100644 --- a/pkg/operator/ceph/object/bucket/provisioner.go +++ b/pkg/operator/ceph/object/bucket/provisioner.go @@ -68,10 +68,7 @@ func (p Provisioner) GenerateUserID(obc *v1alpha1.ObjectBucketClaim, ob *v1alpha return getCephUser(ob), nil } - username, err := p.genUserName(obc.Name, obc.Namespace) - if err != nil { - return "", errors.Wrap(err, "failed to generate user id for OBC") - } + username := p.genUserName(obc) return username, nil } diff --git a/pkg/operator/ceph/object/bucket/rgw-handlers.go b/pkg/operator/ceph/object/bucket/rgw-handlers.go index 435e1b9ae..193f24e48 100644 --- a/pkg/operator/ceph/object/bucket/rgw-handlers.go +++ b/pkg/operator/ceph/object/bucket/rgw-handlers.go @@ -2,6 +2,7 @@ package bucket import ( "github.com/ceph/go-ceph/rgw/admin" + "github.com/kube-object-storage/lib-bucket-provisioner/pkg/apis/objectbucket.io/v1alpha1" "github.com/pkg/errors" ) @@ -47,15 +48,14 @@ func (p *Provisioner) createCephUser(username string) (accKey string, secKey str return u.Keys[0].AccessKey, u.Keys[0].SecretKey, nil } -func (p *Provisioner) genUserName(obcName, obcNamespace string) (string, error) { - // user name can be deterministically generated by obc name and namespace. since there can't be - // 2 obcs in the same namespace w/ the same name, this won't collide w/in the same k8s cluster. - // However, it can collide in multisite setups, so use the Ceph cluster FSID - fsid := p.clusterInfo.FSID - if p.clusterInfo.FSID == "" { - return "", errors.Errorf("failed to find ceph cluster FSID") - } - return "obc-" + obcNamespace + "-" + obcName + "-" + fsid, nil +func (p *Provisioner) genUserName(obc *v1alpha1.ObjectBucketClaim) string { + // A deterministic user name can be generated from the OBC's UID. We + // cannot simply use the OBC's namespace and name, because they can be + // reused, while the preceding bucket might be retained by reclaimPolicy. + // But we still include namespace and name for usability. RadosGW user + // names have a high enough length limit, so we don't need to crop the + // "obc-namespace-name-" part. + return "obc-" + obc.Namespace + "-" + obc.Name + "-" + string(obc.UID) } // Delete the user and bucket created by OBC with help of radosgw-admin commands