feedc0de/my-rook-config
1
0
Fork 0
forked from rook/rook
Code Pull Requests Activity

osd: in cephx key init, don't overwrite key on failure

Browse Source 
Previously, if the OSD cephx-keyring-update init container couldn't
contact the mons, the output redirect would overwrite the on-disk
keyring file with no text, removing the on-disk keyring.

Modify the init container to only overwrite the keyring file when the
ceph command to get the latest key suceeds, to avoid removing the
on-disk key.

Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
This commit is contained in:
Blaine Gardner
2026-02-09 10:06:27 -07:00
parent 654e57371a
commit d69ffdfd2c
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/operator/ceph/cluster/osd/spec.go
+6 -1
View File
@@ -1480,11 +1480,16 @@ set -o xtrace
OSD_ID="` + osdID + `"
KEYRING_FILE=/var/lib/ceph/osd/ceph-"${OSD_ID}"/keyring
# If this fails, it still writes to redirected file, so use temp file
if ! ceph --name client.admin auth get-or-create osd."${OSD_ID}" \
mon 'allow profile osd' mgr 'allow profile osd' osd 'allow *' \
--keyring /etc/ceph/admin-keyring-store/keyring > "$KEYRING_FILE"; then
--keyring /etc/ceph/admin-keyring-store/keyring > /tmp/keyring; then
echo "failed to get latest cephx key for OSD. continuing OSD startup using on-disk key" >/dev/stderr
exit 0
fi
echo "got latest cephx key for OSD successfully. updating on-disk key" >/dev/stderr
mv /tmp/keyring "$KEYRING_FILE"
`
// ^ (above) Continue on failure here. Getting latest key can fail due to system issues that
// blocking here could make worse. Key rotation is rare, so on-disk key is likely good. If not,