Merge pull request #10278 from parth-gr/external-sc

csi: make storage class updated with csi-users in external cluster
2022-06-08 07:48:08 -06:00
commit e9c8226c6e
@@ -104,26 +104,12 @@ jobs:
    - name: test external script with restricted_auth_permission flag and without having cephfs_filesystem flag
      run: |
        toolbox=$(kubectl get pod -l app=rook-ceph-tools -n rook-ceph -o jsonpath='{.items[*].metadata.name}')
-        # create `radosNamespace1` rados-namespace for `replicapool` rbd data-pool
-        kubectl -n rook-ceph exec $toolbox -- rbd namespace create replicapool/radosNamespace1
-        kubectl -n rook-ceph exec $toolbox -- python3 /etc/ceph/create-external-cluster-resources.py --rbd-data-pool-name replicapool --rados-namespace radosNamespace1 --cluster-name rookStorage --restricted-auth-permission true
-        # test the CRD created rados namespace `namespace-a` using external script
-        kubectl create -f deploy/examples/radosnamespace.yaml
-        timeout 60 sh -c "until kubectl -n rook-ceph exec $toolbox -- rbd namespace ls replicapool --format=json|jq .[0].name|grep -q "namespace-a"; do sleep 1 && echo 'waiting for the rados namespace to be created'; done"
-        kubectl -n rook-ceph exec $toolbox -- python3 /etc/ceph/create-external-cluster-resources.py --rbd-data-pool-name replicapool --rados-namespace namespace-a --cluster-name rookStorage --restricted-auth-permission true
-        # test the rados namespace which not exit for replicapool(false testing)
-        if output=$(kubectl -n rook-ceph exec $toolbox -- python3 /etc/ceph/create-external-cluster-resources.py --rbd-data-pool-name replicapool --rados-namespace false-test-namespace --cluster-name rookStorage --restricted-auth-permission true); then
-          echo $output
-        else
-          echo "script failed because wrong rados namespace was passed"
-        fi
+        kubectl -n rook-ceph exec $toolbox -- python3 /etc/ceph/create-external-cluster-resources.py --rbd-data-pool-name replicapool --cluster-name rookstorage --restricted-auth-permission true

    - name: test external script with restricted_auth_permission flag
      run: |
        toolbox=$(kubectl get pod -l app=rook-ceph-tools -n rook-ceph -o jsonpath='{.items[*].metadata.name}')
-        # create `radosNamespace` rados-namespace for `replicapool` rbd data-pool
-        kubectl -n rook-ceph exec $toolbox -- rbd namespace create replicapool/radosNamespace
-        kubectl -n rook-ceph exec $toolbox -- python3 /etc/ceph/create-external-cluster-resources.py --cephfs-filesystem-name myfs --rbd-data-pool-name replicapool --rados-namespace radosNamespace --cluster-name rookStorage --restricted-auth-permission true
+        kubectl -n rook-ceph exec $toolbox -- python3 /etc/ceph/create-external-cluster-resources.py --cephfs-filesystem-name myfs --rbd-data-pool-name replicapool --cluster-name rookstorage --restricted-auth-permission true

    - name: test the upgrade flag
      run: |
@@ -139,12 +125,12 @@ jobs:
      run: |
        toolbox=$(kubectl get pod -l app=rook-ceph-tools -n rook-ceph -o jsonpath='{.items[*].metadata.name}')
        # print existing client auth
-        kubectl -n rook-ceph exec $toolbox -- ceph auth get client.csi-rbd-node-rookStorage-replicapool-radosNamespace
-        # restricted auth user need to provide --rbd-data-pool-name, --rados-namespace,
+        kubectl -n rook-ceph exec $toolbox -- ceph auth get client.csi-rbd-node-rookstorage-replicapool
+        # restricted auth user need to provide --rbd-data-pool-name,
        #  --cluster-name and --run-as-user flag while upgrading
-        kubectl -n rook-ceph exec $toolbox -- python3 /etc/ceph/create-external-cluster-resources.py --upgrade --rbd-data-pool-name replicapool --rados-namespace radosNamespace --cluster-name rookStorage  --run-as-user client.csi-rbd-node-rookStorage-replicapool-radosNamespace
+        kubectl -n rook-ceph exec $toolbox -- python3 /etc/ceph/create-external-cluster-resources.py --upgrade --rbd-data-pool-name replicapool --cluster-name rookstorage  --run-as-user client.csi-rbd-node-rookstorage-replicapool
        # print ugraded client auth
-        kubectl -n rook-ceph exec $toolbox -- ceph auth get client.csi-rbd-node-rookStorage-replicapool-radosNamespace
+        kubectl -n rook-ceph exec $toolbox -- ceph auth get client.csi-rbd-node-rookstorage-replicapool

    - name: check-ownerreferences
      run: tests/scripts/github-action-helper.sh check_ownerreferences
@@ -1367,16 +1367,16 @@ export RGW_POOL_PREFIX=default

 1. Deploy Rook-Ceph, create [common.yaml](/deploy/examples/common.yaml), [crds.yaml](/deploy/examples/crds.yaml) and [operator.yaml](/deploy/examples/operator.yaml) manifests.

-2. Paste the above output from `create-external-cluster-resources.py` into your current shell to allow importing the source data.
+2. Create [common-external.yaml](/deploy/examples/common-external.yaml) and [cluster-external.yaml](/deploy/examples/cluster-external.yaml)

-3. Run the [import](/deploy/examples/import-external-cluster.sh) script.
+3. Paste the above output from `create-external-cluster-resources.py` into your current shell to allow importing the source data.
+
+4. Run the [import](/deploy/examples/import-external-cluster.sh) script.

    ```console
    . import-external-cluster.sh
    ```

-4. Create [common-external.yaml](/deploy/examples/common-external.yaml) and [cluster-external.yaml](/deploy/examples/cluster-external.yaml)
-
 5. Verify the consumer cluster is connected to the source ceph cluster:

    ```console
@@ -1385,54 +1385,15 @@ export RGW_POOL_PREFIX=default
    rook-ceph-external   /var/lib/rook                162m   Connected   HEALTH_OK
    ```

-### Create StorageClass
-
-Create a StorageClass based on the pool that was already created in the source Ceph cluster.
-In this example, the pool `replicated_2g` exists in the source cluster.
-
+6. StorageClass will also be created, verify its creation.
 ```console
-cat << EOF | kubectl apply -f -
+kubectl -n rook-ceph-external get sc
 ```
+`ceph-rbd` and `cephfs` StorageClass would be respective name for RBD and CephFS StorageClass.

-```yaml
-apiVersion: storage.k8s.io/v1
-kind: StorageClass
-metadata:
-   name: rook-ceph-block-ext
-# Change "rook-ceph" provisioner prefix to match the operator namespace if needed
-provisioner: rook-ceph.rbd.csi.ceph.com
-parameters:
-    # clusterID is the namespace where the rook cluster is running
-    clusterID: rook-ceph-external
-    # Ceph pool into which the RBD image shall be created
-    pool: replicated_2g
+**NOTE:** For CephFS StorageClass you also need to export `CEPHFS_FS_NAME`, `CEPHFS_POOL_NAME` or you can pass these parameters with a CLI flag (--cephfs-data-pool-name,--cephfs-filesystem-name) while running the python script. For creating ECRBDStorageClass you need to pass --rbd-metadata-ec-pool-name CLI flag or export `RBD_METADATA_EC_POOL_NAME`.

-    # RBD image format. Defaults to "2".
-    imageFormat: "2"
-
-    # RBD image features. Available for imageFormat: "2". CSI RBD currently supports only `layering` feature.
-    imageFeatures: layering
-
-    # The secrets contain Ceph admin credentials.
-    csi.storage.k8s.io/provisioner-secret-name: rook-csi-rbd-provisioner
-    csi.storage.k8s.io/provisioner-secret-namespace: rook-ceph-external
-    csi.storage.k8s.io/controller-expand-secret-name: rook-csi-rbd-provisioner
-    csi.storage.k8s.io/controller-expand-secret-namespace: rook-ceph-external
-    csi.storage.k8s.io/node-stage-secret-name: rook-csi-rbd-node
-    csi.storage.k8s.io/node-stage-secret-namespace: rook-ceph-external
-
-    # Specify the filesystem type of the volume. If not specified, csi-provisioner
-    # will set default as `ext4`. Note that `xfs` is not recommended due to potential deadlock
-    # in hyperconverged settings where the volume is mounted on the same node as the osds.
-    csi.storage.k8s.io/fstype: ext4
-
-# Delete the rbd volume when a PVC is deleted
-reclaimPolicy: Delete
-allowVolumeExpansion: true
-EOF
-```
-
-You can now create a persistent volume based on this StorageClass.
+7. Then you can now create a [persistent volume](/deploy/examples/csi) based on these StorageClass.

 ### CephCluster example (management)

@@ -331,11 +331,11 @@ class RadosJSON:
        common_group.add_argument(
            "--restricted-auth-permission",
            default=False,
-            help="Restricted cephCSIKeyrings auth permissions to specific pools, cluster and pool namespaces."
-            + "Mandatory flags that need to be set are --rbd-data-pool-name, --rados-namespace and --cluster-name."
+            help="Restricted cephCSIKeyrings auth permissions to specific pools, cluster."
+            + "Mandatory flags that need to be set are --rbd-data-pool-name, and --cluster-name."
            + "--cephfs-filesystem-name flag can also be passed in case of cephfs user restriction, so it can restrict user to particular cephfs filesystem"
-            + "sample run: `python3 /etc/ceph/create-external-cluster-resources.py --cephfs-filesystem-name myfs --rbd-data-pool-name replicapool --rados-namespace radosNamespace --cluster-name rookStorage --restricted-auth-permission true`"
-            + "Note: Restricting the users per pool, per cluster and per pool namespace will require to create new users and new secrets for that users.",
+            + "sample run: `python3 /etc/ceph/create-external-cluster-resources.py --cephfs-filesystem-name myfs --rbd-data-pool-name replicapool --cluster-name rookStorage --restricted-auth-permission true`"
+            + "Note: Restricting the users per pool, and per cluster will require to create new users and new secrets for that users.",
        )

        output_group = argP.add_argument_group("output")
@@ -430,9 +430,9 @@ class RadosJSON:
            help="Upgrades the cephCSIKeyrings(For example: client.csi-cephfs-provisioner) with new permissions needed for the new cluster version and older permission will still be applied."
            + "Sample run: `python3 /etc/ceph/create-external-cluster-resources.py --upgrade`, this will upgrade all the default csi users(non-restricted)"
            + "For restricted users(For example: client.csi-cephfs-provisioner-openshift-storage-myfs), users created using --restricted-auth-permission flag need to pass mandatory flags"
-            + "mandatory flags: '--rbd-data-pool-name, --rados-namespace, --cluster-name and --run-as-user' flags while upgrading"
+            + "mandatory flags: '--rbd-data-pool-name, --cluster-name and --run-as-user' flags while upgrading"
            + "in case of cephfs users if you have passed --cephfs-filesystem-name flag while creating user then while upgrading it will be mandatory too"
-            + "Sample run: `python3 /etc/ceph/create-external-cluster-resources.py --upgrade --rbd-data-pool-name replicapool --rados-namespace radosNamespace --cluster-name rookStorage  --run-as-user client.csi-rbd-node-rookStorage-replicapool-radosNamespace`"
+            + "Sample run: `python3 /etc/ceph/create-external-cluster-resources.py --upgrade --rbd-data-pool-name replicapool --cluster-name rookStorage  --run-as-user client.csi-rbd-node-rookStorage-replicapool`"
            + "PS: An existing non-restricted user cannot be downgraded to a restricted user by upgrading. Admin need to create a new restricted user for this by re-running the script."
            + "Upgrade flag should only be used to append new permissions to users, it shouldn't be used for changing user already applied permission, for example you shouldn't change in which pool user has access",
        )
@@ -826,13 +826,12 @@ class RadosJSON:
        if self._arg_parser.restricted_auth_permission:
            rbd_pool_name = self._arg_parser.rbd_data_pool_name
            cluster_name = self._arg_parser.cluster_name
-            rados_namespace = self._arg_parser.rados_namespace
-            if rbd_pool_name == "" or cluster_name == "" or rados_namespace == "":
+            if rbd_pool_name == "" or cluster_name == "":
                raise ExecutionFailureException(
-                    "mandatory flags not found, please set the '--rbd-data-pool-name', '--cluster-name' and --rados-namespace flags"
+                    "mandatory flags not found, please set the '--rbd-data-pool-name', '--cluster-name' flags"
                )
-            entity = "{}-{}-{}-{}".format(
-                entity, cluster_name, rbd_pool_name, rados_namespace
+            entity = "{}-{}-{}".format(
+                entity, cluster_name, rbd_pool_name
            )
            caps["osd"] = "profile rbd pool={}".format(rbd_pool_name)

@@ -847,13 +846,12 @@ class RadosJSON:
        if self._arg_parser.restricted_auth_permission:
            rbd_pool_name = self._arg_parser.rbd_data_pool_name
            cluster_name = self._arg_parser.cluster_name
-            rados_namespace = self._arg_parser.rados_namespace
-            if rbd_pool_name == "" or cluster_name == "" or rados_namespace == "":
+            if rbd_pool_name == "" or cluster_name == "":
                raise ExecutionFailureException(
-                    "mandatory flags not found, please set the '--rbd-data-pool-name', '--cluster-name' and --rados-namespace flags"
+                    "mandatory flags not found, please set the '--rbd-data-pool-name', '--cluster-name' flags"
                )
-            entity = "{}-{}-{}-{}".format(
-                entity, cluster_name, rbd_pool_name, rados_namespace
+            entity = "{}-{}-{}".format(
+                entity, cluster_name, rbd_pool_name
            )
            caps["osd"] = "profile rbd pool={}".format(rbd_pool_name)

@@ -902,11 +900,11 @@ class RadosJSON:
                + cmd_json["entity"]
                + " "
                + " ".join(cmd_json["caps"])
-            )
+            ), ""
        # check if user already exist
        user_key = self.check_user_exist(entity)
        if user_key != "":
-            return user_key
+            return user_key, "{}".format(entity.split('.',1)[1])  # entity.split('.',1)[1] to rename entity(client.csi-rbd-node) as csi-rbd-node

        ret_val, json_out, err_msg = self._common_cmd_json_gen(cmd_json)
        # if there is an unsuccessful attempt,
@@ -917,7 +915,7 @@ class RadosJSON:
                    err_msg if ret_val != 0 else self.EMPTY_OUTPUT_LIST
                )
            )
-        return str(json_out[0]["key"])
+        return str(json_out[0]["key"]), "{}".format(entity.split('.',1)[1])  # entity.split('.',1)[1] to rename entity(client.csi-rbd-node) as csi-rbd-node

    def get_cephfs_data_pool_details(self):
        cmd_json = {"prefix": "fs ls", "format": "json"}
@@ -1257,6 +1255,7 @@ class RadosJSON:
    def _gen_output_map(self):
        if self.out_map:
            return
+        self._arg_parser.cluster_name = self._arg_parser.cluster_name.lower() # always convert cluster name to lowercase characters
        if self._arg_parser.rgw_endpoint:
            self._arg_parser.rgw_endpoint = self.convert_fqdn_rgw_endpoint_to_ip(
                self._arg_parser.rgw_endpoint
@@ -1272,10 +1271,10 @@ class RadosJSON:
        self.out_map["ROOK_EXTERNAL_CEPH_MON_DATA"] = self.get_ceph_external_mon_data()
        self.out_map["ROOK_EXTERNAL_USER_SECRET"] = self.create_checkerKey()
        self.out_map["ROOK_EXTERNAL_DASHBOARD_LINK"] = self.get_ceph_dashboard_link()
-        self.out_map["CSI_RBD_NODE_SECRET"] = self.create_cephCSIKeyring_user(
+        self.out_map["CSI_RBD_NODE_SECRET"], self.out_map['CSI_RBD_NODE_SECRET_NAME'] = self.create_cephCSIKeyring_user(
            "client.csi-rbd-node"
        )
-        self.out_map["CSI_RBD_PROVISIONER_SECRET"] = self.create_cephCSIKeyring_user(
+        self.out_map["CSI_RBD_PROVISIONER_SECRET"], self.out_map['CSI_RBD_PROVISIONER_SECRET_NAME'] = self.create_cephCSIKeyring_user(
            "client.csi-rbd-provisioner"
        )
        self.out_map["CEPHFS_POOL_NAME"] = self._arg_parser.cephfs_data_pool_name
@@ -1291,12 +1290,10 @@ class RadosJSON:
        self.out_map["CSI_CEPHFS_PROVISIONER_SECRET"] = ""
        # create CephFS node and provisioner keyring only when MDS exists
        if self.out_map["CEPHFS_FS_NAME"] and self.out_map["CEPHFS_POOL_NAME"]:
-            self.out_map["CSI_CEPHFS_NODE_SECRET"] = self.create_cephCSIKeyring_user(
+            self.out_map["CSI_CEPHFS_NODE_SECRET"], self.out_map['CSI_CEPHFS_NODE_SECRET_NAME'] = self.create_cephCSIKeyring_user(
                "client.csi-cephfs-node"
            )
-            self.out_map[
-                "CSI_CEPHFS_PROVISIONER_SECRET"
-            ] = self.create_cephCSIKeyring_user("client.csi-cephfs-provisioner")
+            self.out_map["CSI_CEPHFS_PROVISIONER_SECRET"], self.out_map['CSI_CEPHFS_PROVISIONER_SECRET_NAME'] = self.create_cephCSIKeyring_user("client.csi-cephfs-provisioner")
        self.out_map["RGW_ENDPOINT"] = self._arg_parser.rgw_endpoint
        self.out_map["RGW_TLS_CERT"] = ""
        (
@@ -1373,168 +1370,46 @@ class RadosJSON:
            },
        ]

-        if self.out_map["RBD_METADATA_EC_POOL_NAME"]:
-            json_out.append(
-                {
-                    "name": "ceph-rbd",
-                    "kind": "StorageClass",
-                    "data": {
-                        "dataPool": self.out_map["RBD_POOL_NAME"],
-                        "pool": self.out_map["RBD_METADATA_EC_POOL_NAME"],
-                    },
+        # if 'CSI_RBD_NODE_SECRET' exists, then only add 'rook-csi-rbd-provisioner' Secret
+        if self.out_map['CSI_RBD_NODE_SECRET'] and self.out_map["CSI_RBD_NODE_SECRET_NAME"]:
+            json_out.append({
+                "name": "rook-{}".format(self.out_map["CSI_RBD_NODE_SECRET_NAME"]),
+                "kind": "Secret",
+                "data": {
+                    "userID": self.out_map["CSI_RBD_NODE_SECRET_NAME"],
+                    "userKey": self.out_map['CSI_RBD_NODE_SECRET']
                }
-            )
-        else:
-            json_out.append(
-                {
-                    "name": "ceph-rbd",
-                    "kind": "StorageClass",
-                    "data": {"pool": self.out_map["RBD_POOL_NAME"]},
+            })
+        # if 'CSI_RBD_PROVISIONER_SECRET' exists, then only add 'rook-csi-rbd-provisioner' Secret
+        if self.out_map['CSI_RBD_PROVISIONER_SECRET'] and self.out_map["CSI_RBD_PROVISIONER_SECRET_NAME"]:
+            json_out.append({
+                "name": "rook-{}".format(self.out_map["CSI_RBD_PROVISIONER_SECRET_NAME"]),
+                "kind": "Secret",
+                "data": {
+                    "userID": self.out_map["CSI_RBD_PROVISIONER_SECRET_NAME"],
+                    "userKey": self.out_map['CSI_RBD_PROVISIONER_SECRET']
+                },
+            })
+        # if 'CSI_CEPHFS_PROVISIONER_SECRET' exists, then only add 'rook-csi-cephfs-provisioner' Secret
+        if self.out_map['CSI_CEPHFS_PROVISIONER_SECRET'] and self.out_map['CSI_CEPHFS_PROVISIONER_SECRET_NAME']:
+            json_out.append({
+                "name": "rook-{}".format(self.out_map["CSI_CEPHFS_PROVISIONER_SECRET_NAME"]),
+                "kind": "Secret",
+                "data": {
+                    "adminID": self.out_map["CSI_CEPHFS_PROVISIONER_SECRET_NAME"],
+                    "adminKey": self.out_map['CSI_CEPHFS_PROVISIONER_SECRET']
+                },
+            })
+        # if 'CSI_CEPHFS_NODE_SECRET' exists, then only add 'rook-csi-cephfs-node' Secret
+        if self.out_map['CSI_CEPHFS_NODE_SECRET'] and self.out_map['CSI_CEPHFS_NODE_SECRET_NAME']:
+            json_out.append({
+                "name": "rook-{}".format(self.out_map["CSI_CEPHFS_NODE_SECRET_NAME"]),
+                "kind": "Secret",
+                "data": {
+                    "adminID": self.out_map["CSI_CEPHFS_NODE_SECRET_NAME"],
+                    "adminKey": self.out_map['CSI_CEPHFS_NODE_SECRET']
                }
-            )
-
-        if self._arg_parser.restricted_auth_permission:
-            cluster_name = self._arg_parser.cluster_name
-            rbd_pool_name = self._arg_parser.rbd_data_pool_name
-            cephfs_filesystem = self._arg_parser.cephfs_filesystem_name
-            rados_namespace = self._arg_parser.rados_namespace
-            json_out.append(
-                {
-                    "name": "rook-csi-rbd-node-{}-{}-{}".format(
-                        cluster_name, rbd_pool_name, rados_namespace
-                    ),
-                    "kind": "Secret",
-                    "data": {
-                        "userID": "csi-rbd-node-{}-{}-{}".format(
-                            cluster_name, rbd_pool_name, rados_namespace
-                        ),
-                        "userKey": self.out_map["CSI_RBD_NODE_SECRET"],
-                    },
-                }
-            )
-            # if 'CSI_RBD_PROVISIONER_SECRET' exists, then only add 'rook-csi-rbd-provisioner' Secret
-            if self.out_map["CSI_RBD_PROVISIONER_SECRET"]:
-                json_out.append(
-                    {
-                        "name": "rook-csi-rbd-provisioner-{}-{}-{}".format(
-                            cluster_name, rbd_pool_name, rados_namespace
-                        ),
-                        "kind": "Secret",
-                        "data": {
-                            "userID": "csi-rbd-provisioner-{}-{}-{}".format(
-                                cluster_name, rbd_pool_name, rados_namespace
-                            ),
-                            "userKey": self.out_map["CSI_RBD_PROVISIONER_SECRET"],
-                        },
-                    }
-                )
-            # if 'CSI_CEPHFS_PROVISIONER_SECRET' exists, then only add 'rook-csi-cephfs-provisioner' Secret
-            if (
-                self.out_map["CSI_CEPHFS_PROVISIONER_SECRET"]
-                and cephfs_filesystem != ""
-            ):
-                json_out.append(
-                    {
-                        "name": "rook-csi-cephfs-provisioner-{}-{}".format(
-                            cluster_name, cephfs_filesystem
-                        ),
-                        "kind": "Secret",
-                        "data": {
-                            "adminID": "csi-cephfs-provisioner-{}-{}".format(
-                                cluster_name, cephfs_filesystem
-                            ),
-                            "adminKey": self.out_map["CSI_CEPHFS_PROVISIONER_SECRET"],
-                        },
-                    }
-                )
-            if (
-                self.out_map["CSI_CEPHFS_PROVISIONER_SECRET"]
-                and cephfs_filesystem == ""
-            ):
-                json_out.append(
-                    {
-                        "name": "rook-csi-cephfs-provisioner-{}".format(cluster_name),
-                        "kind": "Secret",
-                        "data": {
-                            "adminID": "csi-cephfs-provisioner-{}".format(cluster_name),
-                            "adminKey": self.out_map["CSI_CEPHFS_PROVISIONER_SECRET"],
-                        },
-                    }
-                )
-            # if 'CSI_CEPHFS_NODE_SECRET' exists, then only add 'rook-csi-cephfs-node' Secret
-            if self.out_map["CSI_CEPHFS_NODE_SECRET"] and cephfs_filesystem != "":
-                json_out.append(
-                    {
-                        "name": "rook-csi-cephfs-node-{}-{}".format(
-                            cluster_name, cephfs_filesystem
-                        ),
-                        "kind": "Secret",
-                        "data": {
-                            "adminID": "csi-cephfs-node-{}-{}".format(
-                                cluster_name, cephfs_filesystem
-                            ),
-                            "adminKey": self.out_map["CSI_CEPHFS_NODE_SECRET"],
-                        },
-                    }
-                )
-            if self.out_map["CSI_CEPHFS_NODE_SECRET"] and cephfs_filesystem == "":
-                json_out.append(
-                    {
-                        "name": "rook-csi-cephfs-node-{}".format(cluster_name),
-                        "kind": "Secret",
-                        "data": {
-                            "adminID": "csi-cephfs-node-{}".format(cluster_name),
-                            "adminKey": self.out_map["CSI_CEPHFS_NODE_SECRET"],
-                        },
-                    }
-                )
-        else:
-            json_out.append(
-                {
-                    "name": "rook-csi-rbd-node",
-                    "kind": "Secret",
-                    "data": {
-                        "userID": "csi-rbd-node",
-                        "userKey": self.out_map["CSI_RBD_NODE_SECRET"],
-                    },
-                }
-            )
-            # if 'CSI_RBD_PROVISIONER_SECRET' exists, then only add 'rook-csi-rbd-provisioner' Secret
-            if self.out_map["CSI_RBD_PROVISIONER_SECRET"]:
-                json_out.append(
-                    {
-                        "name": "rook-csi-rbd-provisioner",
-                        "kind": "Secret",
-                        "data": {
-                            "userID": "csi-rbd-provisioner",
-                            "userKey": self.out_map["CSI_RBD_PROVISIONER_SECRET"],
-                        },
-                    }
-                )
-            # if 'CSI_CEPHFS_PROVISIONER_SECRET' exists, then only add 'rook-csi-cephfs-provisioner' Secret
-            if self.out_map["CSI_CEPHFS_PROVISIONER_SECRET"]:
-                json_out.append(
-                    {
-                        "name": "rook-csi-cephfs-provisioner",
-                        "kind": "Secret",
-                        "data": {
-                            "adminID": "csi-cephfs-provisioner",
-                            "adminKey": self.out_map["CSI_CEPHFS_PROVISIONER_SECRET"],
-                        },
-                    }
-                )
-            # if 'CSI_CEPHFS_NODE_SECRET' exists, then only add 'rook-csi-cephfs-node' Secret
-            if self.out_map["CSI_CEPHFS_NODE_SECRET"]:
-                json_out.append(
-                    {
-                        "name": "rook-csi-cephfs-node",
-                        "kind": "Secret",
-                        "data": {
-                            "adminID": "csi-cephfs-node",
-                            "adminKey": self.out_map["CSI_CEPHFS_NODE_SECRET"],
-                        },
-                    }
-                )
+            })
        # if 'ROOK_EXTERNAL_DASHBOARD_LINK' exists, then only add 'rook-ceph-dashboard-link' Secret
        if self.out_map["ROOK_EXTERNAL_DASHBOARD_LINK"]:
            json_out.append(
@@ -1547,18 +1422,42 @@ class RadosJSON:
                    },
                }
            )
+        if self.out_map['RBD_METADATA_EC_POOL_NAME']:
+            json_out.append({
+                "name": "ceph-rbd",
+                "kind": "StorageClass",
+                "data": {
+                    "dataPool": self.out_map['RBD_METADATA_EC_POOL_NAME'],
+                    "pool": self.out_map['RBD_POOL_NAME'],
+                    "csi.storage.k8s.io/provisioner-secret-name": "rook-{}".format(self.out_map["CSI_RBD_PROVISIONER_SECRET_NAME"]),
+                    "csi.storage.k8s.io/controller-expand-secret-name": "rook-{}".format(self.out_map["CSI_RBD_PROVISIONER_SECRET_NAME"]),
+                    "csi.storage.k8s.io/node-stage-secret-name": "rook-{}".format(self.out_map["CSI_RBD_NODE_SECRET_NAME"])
+                },
+            })
+        else:
+            json_out.append({
+                "name": "ceph-rbd",
+                "kind": "StorageClass",
+                "data": {
+                    "pool": self.out_map['RBD_POOL_NAME'],
+                    "csi.storage.k8s.io/provisioner-secret-name": "rook-{}".format(self.out_map["CSI_RBD_PROVISIONER_SECRET_NAME"]),
+                    "csi.storage.k8s.io/controller-expand-secret-name": "rook-{}".format(self.out_map["CSI_RBD_PROVISIONER_SECRET_NAME"]),
+                    "csi.storage.k8s.io/node-stage-secret-name": "rook-{}".format(self.out_map["CSI_RBD_NODE_SECRET_NAME"])
+                },
+            })
        # if 'CEPHFS_FS_NAME' exists, then only add 'cephfs' StorageClass
-        if self.out_map["CEPHFS_FS_NAME"]:
-            json_out.append(
-                {
-                    "name": "cephfs",
-                    "kind": "StorageClass",
-                    "data": {
-                        "fsName": self.out_map["CEPHFS_FS_NAME"],
-                        "pool": self.out_map["CEPHFS_POOL_NAME"],
-                    },
+        if self.out_map['CEPHFS_FS_NAME']:
+            json_out.append({
+                "name": "cephfs",
+                "kind": "StorageClass",
+                "data": {
+                    "fsName": self.out_map['CEPHFS_FS_NAME'],
+                    "pool": self.out_map['CEPHFS_POOL_NAME'],
+                    "csi.storage.k8s.io/provisioner-secret-name": "rook-{}".format(self.out_map["CSI_CEPHFS_PROVISIONER_SECRET_NAME"]),
+                    "csi.storage.k8s.io/controller-expand-secret-name": "rook-{}".format(self.out_map["CSI_CEPHFS_PROVISIONER_SECRET_NAME"]),
+                    "csi.storage.k8s.io/node-stage-secret-name": "rook-{}".format(self.out_map["CSI_CEPHFS_NODE_SECRET_NAME"])
                }
-            )
+            })
        # if 'RGW_ENDPOINT' exists, then only add 'ceph-rgw' StorageClass
        if self.out_map["RGW_ENDPOINT"]:
            json_out.append(
@@ -5,10 +5,6 @@ set -e
 # VARIABLES #
 #############
 MON_SECRET_NAME=rook-ceph-mon
-CSI_RBD_NODE_SECRET_NAME=rook-csi-rbd-node
-CSI_RBD_PROVISIONER_SECRET_NAME=rook-csi-rbd-provisioner
-CSI_CEPHFS_NODE_SECRET_NAME=rook-csi-cephfs-node
-CSI_CEPHFS_PROVISIONER_SECRET_NAME=rook-csi-cephfs-provisioner
 RGW_ADMIN_OPS_USER_SECRET_NAME=rgw-admin-ops-user
 MON_SECRET_CLUSTER_NAME_KEYNAME=cluster-name
 MON_SECRET_FSID_KEYNAME=fsid
@@ -20,7 +16,12 @@ MON_ENDPOINT_CONFIGMAP_NAME=rook-ceph-mon-endpoints
 ROOK_EXTERNAL_CLUSTER_NAME=$NAMESPACE
 ROOK_EXTERNAL_MAX_MON_ID=2
 ROOK_EXTERNAL_MAPPING={}
+RBD_STORAGE_CLASS_NAME=ceph-rbd
+CEPHFS_STORAGE_CLASS_NAME=cephfs
 ROOK_EXTERNAL_MONITOR_SECRET=mon-secret
+OPERATOR_NAMESPACE=rook-ceph # default set to rook-ceph
+RBD_PROVISIONER=$OPERATOR_NAMESPACE".rbd.csi.ceph.com" # driver:namespace:operator
+CEPHFS_PROVISIONER=$OPERATOR_NAMESPACE".cephfs.csi.ceph.com" # driver:namespace:operator
 : "${ROOK_EXTERNAL_ADMIN_SECRET:=admin-secret}"

 #############
@@ -31,6 +32,26 @@ function checkEnvVars() {
  if [ -z "$NAMESPACE" ]; then
    echo "Please populate the environment variable NAMESPACE"
    exit 1
+  fi
+   if [ -z "$RBD_POOL_NAME" ]; then
+    echo "Please populate the environment variable RBD_POOL_NAME"
+    exit 1
+  fi
+  if [ -z "$CSI_RBD_NODE_SECRET_NAME" ]; then
+    echo "Please populate the environment variable CSI_RBD_NODE_SECRET_NAME"
+    exit 1
+  fi
+  if [ -z "$CSI_RBD_PROVISIONER_SECRET_NAME" ]; then
+    echo "Please populate the environment variable CSI_RBD_PROVISIONER_SECRET_NAME"
+    exit 1
+  fi
+  if [ -z "$CSI_CEPHFS_NODE_SECRET_NAME" ]; then
+    echo "Please populate the environment variable CSI_CEPHFS_NODE_SECRET_NAME"
+    exit 1
+  fi
+  if [ -z "$CSI_CEPHFS_PROVISIONER_SECRET_NAME" ]; then
+    echo "Please populate the environment variable CSI_CEPHFS_PROVISIONER_SECRET_NAME"
+    exit 1
  fi
  if [ -z "$ROOK_EXTERNAL_FSID" ]; then
    echo "Please populate the environment variable ROOK_EXTERNAL_FSID"
@@ -103,8 +124,8 @@ function importCsiRBDNodeSecret() {
  secret \
  generic \
  --type="kubernetes.io/rook" \
-  "$CSI_RBD_NODE_SECRET_NAME" \
-  --from-literal=userID=csi-rbd-node \
+  "rook-""$CSI_RBD_NODE_SECRET_NAME" \
+  --from-literal=userID="$CSI_RBD_NODE_SECRET_NAME" \
  --from-literal=userKey="$CSI_RBD_NODE_SECRET"
 }

@@ -114,8 +135,8 @@ function importCsiRBDProvisionerSecret() {
  secret \
  generic \
  --type="kubernetes.io/rook" \
-  "$CSI_RBD_PROVISIONER_SECRET_NAME" \
-  --from-literal=userID=csi-rbd-provisioner \
+  "rook-""$CSI_RBD_PROVISIONER_SECRET_NAME" \
+  --from-literal=userID="$CSI_RBD_PROVISIONER_SECRET_NAME" \
  --from-literal=userKey="$CSI_RBD_PROVISIONER_SECRET"
 }

@@ -125,8 +146,8 @@ function importCsiCephFSNodeSecret() {
  secret \
  generic \
  --type="kubernetes.io/rook" \
-  "$CSI_CEPHFS_NODE_SECRET_NAME" \
-  --from-literal=adminID=csi-cephfs-node \
+  "rook-""$CSI_CEPHFS_NODE_SECRET_NAME" \
+  --from-literal=adminID="$CSI_CEPHFS_NODE_SECRET_NAME" \
  --from-literal=adminKey="$CSI_CEPHFS_NODE_SECRET"
 }

@@ -136,8 +157,8 @@ function importCsiCephFSProvisionerSecret() {
  secret \
  generic \
  --type="kubernetes.io/rook" \
-  "$CSI_CEPHFS_PROVISIONER_SECRET_NAME" \
-  --from-literal=adminID=csi-cephfs-provisioner \
+  "rook-""$CSI_CEPHFS_PROVISIONER_SECRET_NAME" \
+  --from-literal=adminID="$CSI_CEPHFS_PROVISIONER_SECRET_NAME" \
  --from-literal=adminKey="$CSI_CEPHFS_PROVISIONER_SECRET"
 }

@@ -152,6 +173,77 @@ function importRGWAdminOpsUser() {
  --from-literal=secretKey="$RGW_ADMIN_OPS_USER_SECRET_KEY"
 }

+function createECRBDStorageClass() {
+cat <<eof | kubectl create -f -
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: $RBD_STORAGE_CLASS_NAME
+provisioner: $RBD_PROVISIONER
+parameters:
+  clusterID: $NAMESPACE
+  pool: $RBD_POOL_NAME
+  dataPool: $RBD_METADATA_EC_POOL_NAME
+  imageFormat: "2"
+  imageFeatures: layering
+  csi.storage.k8s.io/provisioner-secret-name: $CSI_RBD_PROVISIONER_SECRET_NAME
+  csi.storage.k8s.io/provisioner-secret-namespace: $NAMESPACE
+  csi.storage.k8s.io/controller-expand-secret-name:  $CSI_RBD_PROVISIONER_SECRET_NAME
+  csi.storage.k8s.io/controller-expand-secret-namespace: $NAMESPACE
+  csi.storage.k8s.io/node-stage-secret-name: $CSI_RBD_NODE_SECRET_NAME
+  csi.storage.k8s.io/node-stage-secret-namespace: $NAMESPACE
+  csi.storage.k8s.io/fstype: ext4
+allowVolumeExpansion: true
+reclaimPolicy: Delete
+eof
+}
+
+function createRBDStorageClass() {
+cat <<eof | kubectl create -f -
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: $RBD_STORAGE_CLASS_NAME
+provisioner: $RBD_PROVISIONER
+parameters:
+  clusterID: $NAMESPACE
+  pool: $RBD_POOL_NAME
+  imageFormat: "2"
+  imageFeatures: layering
+  csi.storage.k8s.io/provisioner-secret-name: $CSI_RBD_PROVISIONER_SECRET_NAME
+  csi.storage.k8s.io/provisioner-secret-namespace: $NAMESPACE
+  csi.storage.k8s.io/controller-expand-secret-name:  $CSI_RBD_PROVISIONER_SECRET_NAME
+  csi.storage.k8s.io/controller-expand-secret-namespace: $NAMESPACE
+  csi.storage.k8s.io/node-stage-secret-name: $CSI_RBD_NODE_SECRET_NAME
+  csi.storage.k8s.io/node-stage-secret-namespace: $NAMESPACE
+  csi.storage.k8s.io/fstype: ext4
+allowVolumeExpansion: true
+reclaimPolicy: Delete
+eof
+}
+
+function createCephFSStorageClass() {
+cat <<eof | kubectl create -f -
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: $CEPHFS_STORAGE_CLASS_NAME
+provisioner: $CEPHFS_PROVISIONER
+parameters:
+  clusterID: $NAMESPACE
+  fsName: $CEPHFS_FS_NAME
+  pool: $CEPHFS_POOL_NAME
+  csi.storage.k8s.io/provisioner-secret-name: $CSI_CEPHFS_PROVISIONER_SECRET_NAME
+  csi.storage.k8s.io/provisioner-secret-namespace: $NAMESPACE
+  csi.storage.k8s.io/controller-expand-secret-name: $CSI_CEPHFS_PROVISIONER_SECRET_NAME
+  csi.storage.k8s.io/controller-expand-secret-namespace: $NAMESPACE
+  csi.storage.k8s.io/node-stage-secret-name: $CSI_CEPHFS_NODE_SECRET_NAME
+  csi.storage.k8s.io/node-stage-secret-namespace: $NAMESPACE
+allowVolumeExpansion: true
+reclaimPolicy: Delete
+eof
+}
+
 ########
 # MAIN #
 ########
@@ -163,3 +255,11 @@ importCsiRBDProvisionerSecret
 importCsiCephFSNodeSecret
 importCsiCephFSProvisionerSecret
 importRGWAdminOpsUser
+if [ -n "$RBD_METADATA_EC_POOL_NAME" ]; then
+  createECRBDStorageClass
+else
+  createRBDStorageClass
+fi
+if [ -n "$CEPHFS_FS_NAME" ] && [ -n "$CEPHFS_POOL_NAME" ]; then
+  createCephFSStorageClass
+fi