From 9a604640ac95e4a08e53682faecdc8b65424fae4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?S=C3=A9bastien=20Han?= Date: Tue, 16 Feb 2021 15:14:08 +0100 Subject: [PATCH] ceph: do not override existing keys MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit If the cluster was expanded we would iterate over the entire list of OSDs again, create a new key and override in Vault... The Secret store is not impacted since we have a handler for "already exist". Signed-off-by: Sébastien Han --- pkg/daemon/ceph/osd/kms/vault.go | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/pkg/daemon/ceph/osd/kms/vault.go b/pkg/daemon/ceph/osd/kms/vault.go index 3e8987e9e..414009453 100644 --- a/pkg/daemon/ceph/osd/kms/vault.go +++ b/pkg/daemon/ceph/osd/kms/vault.go @@ -129,12 +129,22 @@ func configTLS(clusterdContext *clusterd.Context, namespace string, config map[s } func put(v secrets.Secrets, secretName, secretValue string, keyContext map[string]string) error { + // First we must see if the key entry already exists, if it does we do nothing + key, err := get(v, secretName, keyContext) + if err != nil && err != secrets.ErrInvalidSecretId { + return errors.Wrapf(err, "failed to get secret %q in vault", secretName) + } + if key != "" { + logger.Debugf("key %q already exists in vault!", secretName) + return nil + } + // Build Secret data := make(map[string]interface{}) data[secretName] = secretValue // #nosec G104 Write the encryption key in Vault - err := v.PutSecret(secretName, data, keyContext) + err = v.PutSecret(secretName, data, keyContext) if err != nil { return errors.Wrapf(err, "failed to put secret %q in vault", secretName) } @@ -146,7 +156,7 @@ func get(v secrets.Secrets, secretName string, keyContext map[string]string) (st // #nosec G104 Write the encryption key in Vault s, err := v.GetSecret(secretName, keyContext) if err != nil { - return "", errors.Wrapf(err, "failed to get secret %q in vault", secretName) + return "", err } return s[secretName].(string), nil