Merge pull request #18093 from jhoblitt/helm-cluster-objectstoreusers

helm: add cephObjectStoreUsers to the cluster chart
2026-08-07 12:07:21 -06:00
commit bcbb6f793b
@@ -142,6 +142,17 @@ commented out by default; uncomment and adjust them to deploy a multisite config
 | `cephObjectZones[].name` | The name of the CephObjectZone | `zone-a` |
 | `cephObjectZones[].spec` | The CephObjectZone spec, see the [CephObjectZone CRD](../CRDs/Object-Storage/ceph-object-zone-crd.md) documentation. | see values.yaml |

+### **Ceph Object Store Users**
+
+The `cephObjectStoreUsers` array in the values file defines a list of S3 users to create in an
+object store. The entries are commented out by default; uncomment and adjust them to create users,
+pointing each at a `cephObjectStores` entry via its `spec.store`.
+
+| Parameter | Description | Default |
+| --------- | ----------- | ------- |
+| `cephObjectStoreUsers[].name` | The name of the CephObjectStoreUser | `my-user` |
+| `cephObjectStoreUsers[].spec` | The CephObjectStoreUser spec, see the [CephObjectStoreUser CRD](../CRDs/Object-Storage/ceph-object-store-user-crd.md) documentation. | see values.yaml |
+
 ### **Existing Clusters**

 If you have an existing CephCluster CR that was created without the helm chart and you want the helm
@@ -181,6 +181,17 @@ commented out by default; uncomment and adjust them to deploy a multisite config
 | `cephObjectZones[].name` | The name of the CephObjectZone | `zone-a` |
 | `cephObjectZones[].spec` | The CephObjectZone spec, see the [CephObjectZone CRD](../CRDs/Object-Storage/ceph-object-zone-crd.md) documentation. | see values.yaml |

+### **Ceph Object Store Users**
+
+The `cephObjectStoreUsers` array in the values file defines a list of S3 users to create in an
+object store. The entries are commented out by default; uncomment and adjust them to create users,
+pointing each at a `cephObjectStores` entry via its `spec.store`.
+
+| Parameter | Description | Default |
+| --------- | ----------- | ------- |
+| `cephObjectStoreUsers[].name` | The name of the CephObjectStoreUser | `my-user` |
+| `cephObjectStoreUsers[].spec` | The CephObjectStoreUser spec, see the [CephObjectStoreUser CRD](../CRDs/Object-Storage/ceph-object-store-user-crd.md) documentation. | see values.yaml |
+
 ### **Existing Clusters**

 If you have an existing CephCluster CR that was created without the helm chart and you want the helm
@@ -11,3 +11,4 @@

 - RBD QoS (Quality of Service) support via `VolumeAttributesClass` using the krbd mounter with cgroup v2 `io.max` enforcement. See the [RBD QoS documentation](Documentation/Storage-Configuration/Block-Storage-RBD/rbd-qos.md) for details.
 - Automated OSD replacement. OSD deployment can be annotated to mark it for replacement. Rook will drain and destroy it with preserving its CRUSH position to later reuse it when new device will be available on the same node. All types of OSDs supported for host-based cluster included OSDs sharing metadata device. PVC-based OSDs are not supported. See [OSD replacement design document](./design/ceph/osd-replacement.md) for details.
+- The rook-ceph-cluster Helm chart can create `CephObjectStoreUser` resources via the new `cephObjectStoreUsers` value.
@@ -0,0 +1,11 @@
+{{- $root := . -}}
+{{- range $user := .Values.cephObjectStoreUsers }}
+---
+kind: CephObjectStoreUser
+apiVersion: ceph.rook.io/v1
+metadata:
+  name: {{ $user.name }}
+  namespace: {{ $root.Release.Namespace }} # namespace:cluster
+spec:
+  {{- $user.spec | toYaml | nindent 2 }}
+{{- end }}
@@ -0,0 +1,81 @@
+suite: cephobjectstoreuser
+templates:
+  - cephobjectstoreuser.yaml
+tests:
+  - it: renders nothing by default
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: renders a CephObjectStoreUser for each configured user
+    set:
+      cephObjectStoreUsers:
+        - name: user-a
+          spec:
+            store: ceph-objectstore
+        - name: user-b
+          spec:
+            store: other-objectstore
+    asserts:
+      - hasDocuments:
+          count: 2
+      - isKind:
+          of: CephObjectStoreUser
+      - isAPIVersion:
+          of: ceph.rook.io/v1
+      - equal:
+          path: metadata.name
+          value: user-a
+        documentIndex: 0
+      - equal:
+          path: metadata.name
+          value: user-b
+        documentIndex: 1
+
+  - it: places users in the release namespace
+    release:
+      namespace: rook-ceph
+    set:
+      cephObjectStoreUsers:
+        - name: user-a
+          spec:
+            store: ceph-objectstore
+    asserts:
+      - equal:
+          path: metadata.namespace
+          value: rook-ceph
+
+  - it: passes the spec through verbatim
+    set:
+      cephObjectStoreUsers:
+        - name: user-a
+          spec:
+            store: ceph-objectstore
+            displayName: A display name
+            clusterNamespace: other-cluster
+            quotas:
+              maxBuckets: 100
+              maxSize: 10G
+              maxObjects: 10000
+            capabilities:
+              user: "*"
+              bucket: "*"
+    asserts:
+      - equal:
+          path: spec.store
+          value: ceph-objectstore
+      - equal:
+          path: spec.displayName
+          value: A display name
+      - equal:
+          path: spec.clusterNamespace
+          value: other-cluster
+      - equal:
+          path: spec.quotas.maxBuckets
+          value: 100
+      - equal:
+          path: spec.quotas.maxSize
+          value: 10G
+      - equal:
+          path: spec.capabilities.user
+          value: "*"
@@ -748,6 +748,14 @@ cephObjectStores:
 #      #   - "http://rgw-a.fqdn"
 #      # if the pools need to be removed from backend enable following setting
 #      # preservePoolsOnDelete: false
+## cephObjectStoreUsers create S3 users in a CephObjectStore. They are disabled by default;
+## remove the comments and set desired values to enable them. See
+## https://rook.io/docs/rook/latest/CRDs/Object-Storage/ceph-object-store-user-crd/
+#cephObjectStoreUsers:
+#  - name: my-user
+#    spec:
+#      store: ceph-objectstore
+#      displayName: my display name
 ## cephECBlockPools are disabled by default, please remove the comments and set desired values to enable it
 ## For erasure coded a replicated metadata pool is required.
 ## https://rook.io/docs/rook/latest/CRDs/Shared-Filesystem/ceph-filesystem-crd/#erasure-coded