diff --git a/.github/workflows/canary-integration-test.yml b/.github/workflows/canary-integration-test.yml index bf16b17d8..5d2008959 100644 --- a/.github/workflows/canary-integration-test.yml +++ b/.github/workflows/canary-integration-test.yml @@ -104,26 +104,12 @@ jobs: - name: test external script with restricted_auth_permission flag and without having cephfs_filesystem flag run: | toolbox=$(kubectl get pod -l app=rook-ceph-tools -n rook-ceph -o jsonpath='{.items[*].metadata.name}') - # create `radosNamespace1` rados-namespace for `replicapool` rbd data-pool - kubectl -n rook-ceph exec $toolbox -- rbd namespace create replicapool/radosNamespace1 - kubectl -n rook-ceph exec $toolbox -- python3 /etc/ceph/create-external-cluster-resources.py --rbd-data-pool-name replicapool --rados-namespace radosNamespace1 --cluster-name rookStorage --restricted-auth-permission true - # test the CRD created rados namespace `namespace-a` using external script - kubectl create -f deploy/examples/radosnamespace.yaml - timeout 60 sh -c "until kubectl -n rook-ceph exec $toolbox -- rbd namespace ls replicapool --format=json|jq .[0].name|grep -q "namespace-a"; do sleep 1 && echo 'waiting for the rados namespace to be created'; done" - kubectl -n rook-ceph exec $toolbox -- python3 /etc/ceph/create-external-cluster-resources.py --rbd-data-pool-name replicapool --rados-namespace namespace-a --cluster-name rookStorage --restricted-auth-permission true - # test the rados namespace which not exit for replicapool(false testing) - if output=$(kubectl -n rook-ceph exec $toolbox -- python3 /etc/ceph/create-external-cluster-resources.py --rbd-data-pool-name replicapool --rados-namespace false-test-namespace --cluster-name rookStorage --restricted-auth-permission true); then - echo $output - else - echo "script failed because wrong rados namespace was passed" - fi + kubectl -n rook-ceph exec $toolbox -- python3 /etc/ceph/create-external-cluster-resources.py --rbd-data-pool-name replicapool --cluster-name rookstorage --restricted-auth-permission true - name: test external script with restricted_auth_permission flag run: | toolbox=$(kubectl get pod -l app=rook-ceph-tools -n rook-ceph -o jsonpath='{.items[*].metadata.name}') - # create `radosNamespace` rados-namespace for `replicapool` rbd data-pool - kubectl -n rook-ceph exec $toolbox -- rbd namespace create replicapool/radosNamespace - kubectl -n rook-ceph exec $toolbox -- python3 /etc/ceph/create-external-cluster-resources.py --cephfs-filesystem-name myfs --rbd-data-pool-name replicapool --rados-namespace radosNamespace --cluster-name rookStorage --restricted-auth-permission true + kubectl -n rook-ceph exec $toolbox -- python3 /etc/ceph/create-external-cluster-resources.py --cephfs-filesystem-name myfs --rbd-data-pool-name replicapool --cluster-name rookstorage --restricted-auth-permission true - name: test the upgrade flag run: | @@ -139,12 +125,12 @@ jobs: run: | toolbox=$(kubectl get pod -l app=rook-ceph-tools -n rook-ceph -o jsonpath='{.items[*].metadata.name}') # print existing client auth - kubectl -n rook-ceph exec $toolbox -- ceph auth get client.csi-rbd-node-rookStorage-replicapool-radosNamespace - # restricted auth user need to provide --rbd-data-pool-name, --rados-namespace, + kubectl -n rook-ceph exec $toolbox -- ceph auth get client.csi-rbd-node-rookstorage-replicapool + # restricted auth user need to provide --rbd-data-pool-name, # --cluster-name and --run-as-user flag while upgrading - kubectl -n rook-ceph exec $toolbox -- python3 /etc/ceph/create-external-cluster-resources.py --upgrade --rbd-data-pool-name replicapool --rados-namespace radosNamespace --cluster-name rookStorage --run-as-user client.csi-rbd-node-rookStorage-replicapool-radosNamespace + kubectl -n rook-ceph exec $toolbox -- python3 /etc/ceph/create-external-cluster-resources.py --upgrade --rbd-data-pool-name replicapool --cluster-name rookstorage --run-as-user client.csi-rbd-node-rookstorage-replicapool # print ugraded client auth - kubectl -n rook-ceph exec $toolbox -- ceph auth get client.csi-rbd-node-rookStorage-replicapool-radosNamespace + kubectl -n rook-ceph exec $toolbox -- ceph auth get client.csi-rbd-node-rookstorage-replicapool - name: check-ownerreferences run: tests/scripts/github-action-helper.sh check_ownerreferences diff --git a/Documentation/CRDs/ceph-cluster-crd.md b/Documentation/CRDs/ceph-cluster-crd.md index 25d080218..a31e1c10e 100755 --- a/Documentation/CRDs/ceph-cluster-crd.md +++ b/Documentation/CRDs/ceph-cluster-crd.md @@ -1367,16 +1367,16 @@ export RGW_POOL_PREFIX=default 1. Deploy Rook-Ceph, create [common.yaml](/deploy/examples/common.yaml), [crds.yaml](/deploy/examples/crds.yaml) and [operator.yaml](/deploy/examples/operator.yaml) manifests. -2. Paste the above output from `create-external-cluster-resources.py` into your current shell to allow importing the source data. +2. Create [common-external.yaml](/deploy/examples/common-external.yaml) and [cluster-external.yaml](/deploy/examples/cluster-external.yaml) -3. Run the [import](/deploy/examples/import-external-cluster.sh) script. +3. Paste the above output from `create-external-cluster-resources.py` into your current shell to allow importing the source data. + +4. Run the [import](/deploy/examples/import-external-cluster.sh) script. ```console . import-external-cluster.sh ``` -4. Create [common-external.yaml](/deploy/examples/common-external.yaml) and [cluster-external.yaml](/deploy/examples/cluster-external.yaml) - 5. Verify the consumer cluster is connected to the source ceph cluster: ```console @@ -1385,54 +1385,15 @@ export RGW_POOL_PREFIX=default rook-ceph-external /var/lib/rook 162m Connected HEALTH_OK ``` -### Create StorageClass - -Create a StorageClass based on the pool that was already created in the source Ceph cluster. -In this example, the pool `replicated_2g` exists in the source cluster. - +6. StorageClass will also be created, verify its creation. ```console -cat << EOF | kubectl apply -f - +kubectl -n rook-ceph-external get sc ``` +`ceph-rbd` and `cephfs` StorageClass would be respective name for RBD and CephFS StorageClass. -```yaml -apiVersion: storage.k8s.io/v1 -kind: StorageClass -metadata: - name: rook-ceph-block-ext -# Change "rook-ceph" provisioner prefix to match the operator namespace if needed -provisioner: rook-ceph.rbd.csi.ceph.com -parameters: - # clusterID is the namespace where the rook cluster is running - clusterID: rook-ceph-external - # Ceph pool into which the RBD image shall be created - pool: replicated_2g +**NOTE:** For CephFS StorageClass you also need to export `CEPHFS_FS_NAME`, `CEPHFS_POOL_NAME` or you can pass these parameters with a CLI flag (--cephfs-data-pool-name,--cephfs-filesystem-name) while running the python script. For creating ECRBDStorageClass you need to pass --rbd-metadata-ec-pool-name CLI flag or export `RBD_METADATA_EC_POOL_NAME`. - # RBD image format. Defaults to "2". - imageFormat: "2" - - # RBD image features. Available for imageFormat: "2". CSI RBD currently supports only `layering` feature. - imageFeatures: layering - - # The secrets contain Ceph admin credentials. - csi.storage.k8s.io/provisioner-secret-name: rook-csi-rbd-provisioner - csi.storage.k8s.io/provisioner-secret-namespace: rook-ceph-external - csi.storage.k8s.io/controller-expand-secret-name: rook-csi-rbd-provisioner - csi.storage.k8s.io/controller-expand-secret-namespace: rook-ceph-external - csi.storage.k8s.io/node-stage-secret-name: rook-csi-rbd-node - csi.storage.k8s.io/node-stage-secret-namespace: rook-ceph-external - - # Specify the filesystem type of the volume. If not specified, csi-provisioner - # will set default as `ext4`. Note that `xfs` is not recommended due to potential deadlock - # in hyperconverged settings where the volume is mounted on the same node as the osds. - csi.storage.k8s.io/fstype: ext4 - -# Delete the rbd volume when a PVC is deleted -reclaimPolicy: Delete -allowVolumeExpansion: true -EOF -``` - -You can now create a persistent volume based on this StorageClass. +7. Then you can now create a [persistent volume](/deploy/examples/csi) based on these StorageClass. ### CephCluster example (management) diff --git a/deploy/examples/create-external-cluster-resources.py b/deploy/examples/create-external-cluster-resources.py index cd40b1f0a..4ea0621c2 100644 --- a/deploy/examples/create-external-cluster-resources.py +++ b/deploy/examples/create-external-cluster-resources.py @@ -331,11 +331,11 @@ class RadosJSON: common_group.add_argument( "--restricted-auth-permission", default=False, - help="Restricted cephCSIKeyrings auth permissions to specific pools, cluster and pool namespaces." - + "Mandatory flags that need to be set are --rbd-data-pool-name, --rados-namespace and --cluster-name." + help="Restricted cephCSIKeyrings auth permissions to specific pools, cluster." + + "Mandatory flags that need to be set are --rbd-data-pool-name, and --cluster-name." + "--cephfs-filesystem-name flag can also be passed in case of cephfs user restriction, so it can restrict user to particular cephfs filesystem" - + "sample run: `python3 /etc/ceph/create-external-cluster-resources.py --cephfs-filesystem-name myfs --rbd-data-pool-name replicapool --rados-namespace radosNamespace --cluster-name rookStorage --restricted-auth-permission true`" - + "Note: Restricting the users per pool, per cluster and per pool namespace will require to create new users and new secrets for that users.", + + "sample run: `python3 /etc/ceph/create-external-cluster-resources.py --cephfs-filesystem-name myfs --rbd-data-pool-name replicapool --cluster-name rookStorage --restricted-auth-permission true`" + + "Note: Restricting the users per pool, and per cluster will require to create new users and new secrets for that users.", ) output_group = argP.add_argument_group("output") @@ -430,9 +430,9 @@ class RadosJSON: help="Upgrades the cephCSIKeyrings(For example: client.csi-cephfs-provisioner) with new permissions needed for the new cluster version and older permission will still be applied." + "Sample run: `python3 /etc/ceph/create-external-cluster-resources.py --upgrade`, this will upgrade all the default csi users(non-restricted)" + "For restricted users(For example: client.csi-cephfs-provisioner-openshift-storage-myfs), users created using --restricted-auth-permission flag need to pass mandatory flags" - + "mandatory flags: '--rbd-data-pool-name, --rados-namespace, --cluster-name and --run-as-user' flags while upgrading" + + "mandatory flags: '--rbd-data-pool-name, --cluster-name and --run-as-user' flags while upgrading" + "in case of cephfs users if you have passed --cephfs-filesystem-name flag while creating user then while upgrading it will be mandatory too" - + "Sample run: `python3 /etc/ceph/create-external-cluster-resources.py --upgrade --rbd-data-pool-name replicapool --rados-namespace radosNamespace --cluster-name rookStorage --run-as-user client.csi-rbd-node-rookStorage-replicapool-radosNamespace`" + + "Sample run: `python3 /etc/ceph/create-external-cluster-resources.py --upgrade --rbd-data-pool-name replicapool --cluster-name rookStorage --run-as-user client.csi-rbd-node-rookStorage-replicapool`" + "PS: An existing non-restricted user cannot be downgraded to a restricted user by upgrading. Admin need to create a new restricted user for this by re-running the script." + "Upgrade flag should only be used to append new permissions to users, it shouldn't be used for changing user already applied permission, for example you shouldn't change in which pool user has access", ) @@ -826,13 +826,12 @@ class RadosJSON: if self._arg_parser.restricted_auth_permission: rbd_pool_name = self._arg_parser.rbd_data_pool_name cluster_name = self._arg_parser.cluster_name - rados_namespace = self._arg_parser.rados_namespace - if rbd_pool_name == "" or cluster_name == "" or rados_namespace == "": + if rbd_pool_name == "" or cluster_name == "": raise ExecutionFailureException( - "mandatory flags not found, please set the '--rbd-data-pool-name', '--cluster-name' and --rados-namespace flags" + "mandatory flags not found, please set the '--rbd-data-pool-name', '--cluster-name' flags" ) - entity = "{}-{}-{}-{}".format( - entity, cluster_name, rbd_pool_name, rados_namespace + entity = "{}-{}-{}".format( + entity, cluster_name, rbd_pool_name ) caps["osd"] = "profile rbd pool={}".format(rbd_pool_name) @@ -847,13 +846,12 @@ class RadosJSON: if self._arg_parser.restricted_auth_permission: rbd_pool_name = self._arg_parser.rbd_data_pool_name cluster_name = self._arg_parser.cluster_name - rados_namespace = self._arg_parser.rados_namespace - if rbd_pool_name == "" or cluster_name == "" or rados_namespace == "": + if rbd_pool_name == "" or cluster_name == "": raise ExecutionFailureException( - "mandatory flags not found, please set the '--rbd-data-pool-name', '--cluster-name' and --rados-namespace flags" + "mandatory flags not found, please set the '--rbd-data-pool-name', '--cluster-name' flags" ) - entity = "{}-{}-{}-{}".format( - entity, cluster_name, rbd_pool_name, rados_namespace + entity = "{}-{}-{}".format( + entity, cluster_name, rbd_pool_name ) caps["osd"] = "profile rbd pool={}".format(rbd_pool_name) @@ -902,11 +900,11 @@ class RadosJSON: + cmd_json["entity"] + " " + " ".join(cmd_json["caps"]) - ) + ), "" # check if user already exist user_key = self.check_user_exist(entity) if user_key != "": - return user_key + return user_key, "{}".format(entity.split('.',1)[1]) # entity.split('.',1)[1] to rename entity(client.csi-rbd-node) as csi-rbd-node ret_val, json_out, err_msg = self._common_cmd_json_gen(cmd_json) # if there is an unsuccessful attempt, @@ -917,7 +915,7 @@ class RadosJSON: err_msg if ret_val != 0 else self.EMPTY_OUTPUT_LIST ) ) - return str(json_out[0]["key"]) + return str(json_out[0]["key"]), "{}".format(entity.split('.',1)[1]) # entity.split('.',1)[1] to rename entity(client.csi-rbd-node) as csi-rbd-node def get_cephfs_data_pool_details(self): cmd_json = {"prefix": "fs ls", "format": "json"} @@ -1257,6 +1255,7 @@ class RadosJSON: def _gen_output_map(self): if self.out_map: return + self._arg_parser.cluster_name = self._arg_parser.cluster_name.lower() # always convert cluster name to lowercase characters if self._arg_parser.rgw_endpoint: self._arg_parser.rgw_endpoint = self.convert_fqdn_rgw_endpoint_to_ip( self._arg_parser.rgw_endpoint @@ -1272,10 +1271,10 @@ class RadosJSON: self.out_map["ROOK_EXTERNAL_CEPH_MON_DATA"] = self.get_ceph_external_mon_data() self.out_map["ROOK_EXTERNAL_USER_SECRET"] = self.create_checkerKey() self.out_map["ROOK_EXTERNAL_DASHBOARD_LINK"] = self.get_ceph_dashboard_link() - self.out_map["CSI_RBD_NODE_SECRET"] = self.create_cephCSIKeyring_user( + self.out_map["CSI_RBD_NODE_SECRET"], self.out_map['CSI_RBD_NODE_SECRET_NAME'] = self.create_cephCSIKeyring_user( "client.csi-rbd-node" ) - self.out_map["CSI_RBD_PROVISIONER_SECRET"] = self.create_cephCSIKeyring_user( + self.out_map["CSI_RBD_PROVISIONER_SECRET"], self.out_map['CSI_RBD_PROVISIONER_SECRET_NAME'] = self.create_cephCSIKeyring_user( "client.csi-rbd-provisioner" ) self.out_map["CEPHFS_POOL_NAME"] = self._arg_parser.cephfs_data_pool_name @@ -1291,12 +1290,10 @@ class RadosJSON: self.out_map["CSI_CEPHFS_PROVISIONER_SECRET"] = "" # create CephFS node and provisioner keyring only when MDS exists if self.out_map["CEPHFS_FS_NAME"] and self.out_map["CEPHFS_POOL_NAME"]: - self.out_map["CSI_CEPHFS_NODE_SECRET"] = self.create_cephCSIKeyring_user( + self.out_map["CSI_CEPHFS_NODE_SECRET"], self.out_map['CSI_CEPHFS_NODE_SECRET_NAME'] = self.create_cephCSIKeyring_user( "client.csi-cephfs-node" ) - self.out_map[ - "CSI_CEPHFS_PROVISIONER_SECRET" - ] = self.create_cephCSIKeyring_user("client.csi-cephfs-provisioner") + self.out_map["CSI_CEPHFS_PROVISIONER_SECRET"], self.out_map['CSI_CEPHFS_PROVISIONER_SECRET_NAME'] = self.create_cephCSIKeyring_user("client.csi-cephfs-provisioner") self.out_map["RGW_ENDPOINT"] = self._arg_parser.rgw_endpoint self.out_map["RGW_TLS_CERT"] = "" ( @@ -1373,168 +1370,46 @@ class RadosJSON: }, ] - if self.out_map["RBD_METADATA_EC_POOL_NAME"]: - json_out.append( - { - "name": "ceph-rbd", - "kind": "StorageClass", - "data": { - "dataPool": self.out_map["RBD_POOL_NAME"], - "pool": self.out_map["RBD_METADATA_EC_POOL_NAME"], - }, + # if 'CSI_RBD_NODE_SECRET' exists, then only add 'rook-csi-rbd-provisioner' Secret + if self.out_map['CSI_RBD_NODE_SECRET'] and self.out_map["CSI_RBD_NODE_SECRET_NAME"]: + json_out.append({ + "name": "rook-{}".format(self.out_map["CSI_RBD_NODE_SECRET_NAME"]), + "kind": "Secret", + "data": { + "userID": self.out_map["CSI_RBD_NODE_SECRET_NAME"], + "userKey": self.out_map['CSI_RBD_NODE_SECRET'] } - ) - else: - json_out.append( - { - "name": "ceph-rbd", - "kind": "StorageClass", - "data": {"pool": self.out_map["RBD_POOL_NAME"]}, + }) + # if 'CSI_RBD_PROVISIONER_SECRET' exists, then only add 'rook-csi-rbd-provisioner' Secret + if self.out_map['CSI_RBD_PROVISIONER_SECRET'] and self.out_map["CSI_RBD_PROVISIONER_SECRET_NAME"]: + json_out.append({ + "name": "rook-{}".format(self.out_map["CSI_RBD_PROVISIONER_SECRET_NAME"]), + "kind": "Secret", + "data": { + "userID": self.out_map["CSI_RBD_PROVISIONER_SECRET_NAME"], + "userKey": self.out_map['CSI_RBD_PROVISIONER_SECRET'] + }, + }) + # if 'CSI_CEPHFS_PROVISIONER_SECRET' exists, then only add 'rook-csi-cephfs-provisioner' Secret + if self.out_map['CSI_CEPHFS_PROVISIONER_SECRET'] and self.out_map['CSI_CEPHFS_PROVISIONER_SECRET_NAME']: + json_out.append({ + "name": "rook-{}".format(self.out_map["CSI_CEPHFS_PROVISIONER_SECRET_NAME"]), + "kind": "Secret", + "data": { + "adminID": self.out_map["CSI_CEPHFS_PROVISIONER_SECRET_NAME"], + "adminKey": self.out_map['CSI_CEPHFS_PROVISIONER_SECRET'] + }, + }) + # if 'CSI_CEPHFS_NODE_SECRET' exists, then only add 'rook-csi-cephfs-node' Secret + if self.out_map['CSI_CEPHFS_NODE_SECRET'] and self.out_map['CSI_CEPHFS_NODE_SECRET_NAME']: + json_out.append({ + "name": "rook-{}".format(self.out_map["CSI_CEPHFS_NODE_SECRET_NAME"]), + "kind": "Secret", + "data": { + "adminID": self.out_map["CSI_CEPHFS_NODE_SECRET_NAME"], + "adminKey": self.out_map['CSI_CEPHFS_NODE_SECRET'] } - ) - - if self._arg_parser.restricted_auth_permission: - cluster_name = self._arg_parser.cluster_name - rbd_pool_name = self._arg_parser.rbd_data_pool_name - cephfs_filesystem = self._arg_parser.cephfs_filesystem_name - rados_namespace = self._arg_parser.rados_namespace - json_out.append( - { - "name": "rook-csi-rbd-node-{}-{}-{}".format( - cluster_name, rbd_pool_name, rados_namespace - ), - "kind": "Secret", - "data": { - "userID": "csi-rbd-node-{}-{}-{}".format( - cluster_name, rbd_pool_name, rados_namespace - ), - "userKey": self.out_map["CSI_RBD_NODE_SECRET"], - }, - } - ) - # if 'CSI_RBD_PROVISIONER_SECRET' exists, then only add 'rook-csi-rbd-provisioner' Secret - if self.out_map["CSI_RBD_PROVISIONER_SECRET"]: - json_out.append( - { - "name": "rook-csi-rbd-provisioner-{}-{}-{}".format( - cluster_name, rbd_pool_name, rados_namespace - ), - "kind": "Secret", - "data": { - "userID": "csi-rbd-provisioner-{}-{}-{}".format( - cluster_name, rbd_pool_name, rados_namespace - ), - "userKey": self.out_map["CSI_RBD_PROVISIONER_SECRET"], - }, - } - ) - # if 'CSI_CEPHFS_PROVISIONER_SECRET' exists, then only add 'rook-csi-cephfs-provisioner' Secret - if ( - self.out_map["CSI_CEPHFS_PROVISIONER_SECRET"] - and cephfs_filesystem != "" - ): - json_out.append( - { - "name": "rook-csi-cephfs-provisioner-{}-{}".format( - cluster_name, cephfs_filesystem - ), - "kind": "Secret", - "data": { - "adminID": "csi-cephfs-provisioner-{}-{}".format( - cluster_name, cephfs_filesystem - ), - "adminKey": self.out_map["CSI_CEPHFS_PROVISIONER_SECRET"], - }, - } - ) - if ( - self.out_map["CSI_CEPHFS_PROVISIONER_SECRET"] - and cephfs_filesystem == "" - ): - json_out.append( - { - "name": "rook-csi-cephfs-provisioner-{}".format(cluster_name), - "kind": "Secret", - "data": { - "adminID": "csi-cephfs-provisioner-{}".format(cluster_name), - "adminKey": self.out_map["CSI_CEPHFS_PROVISIONER_SECRET"], - }, - } - ) - # if 'CSI_CEPHFS_NODE_SECRET' exists, then only add 'rook-csi-cephfs-node' Secret - if self.out_map["CSI_CEPHFS_NODE_SECRET"] and cephfs_filesystem != "": - json_out.append( - { - "name": "rook-csi-cephfs-node-{}-{}".format( - cluster_name, cephfs_filesystem - ), - "kind": "Secret", - "data": { - "adminID": "csi-cephfs-node-{}-{}".format( - cluster_name, cephfs_filesystem - ), - "adminKey": self.out_map["CSI_CEPHFS_NODE_SECRET"], - }, - } - ) - if self.out_map["CSI_CEPHFS_NODE_SECRET"] and cephfs_filesystem == "": - json_out.append( - { - "name": "rook-csi-cephfs-node-{}".format(cluster_name), - "kind": "Secret", - "data": { - "adminID": "csi-cephfs-node-{}".format(cluster_name), - "adminKey": self.out_map["CSI_CEPHFS_NODE_SECRET"], - }, - } - ) - else: - json_out.append( - { - "name": "rook-csi-rbd-node", - "kind": "Secret", - "data": { - "userID": "csi-rbd-node", - "userKey": self.out_map["CSI_RBD_NODE_SECRET"], - }, - } - ) - # if 'CSI_RBD_PROVISIONER_SECRET' exists, then only add 'rook-csi-rbd-provisioner' Secret - if self.out_map["CSI_RBD_PROVISIONER_SECRET"]: - json_out.append( - { - "name": "rook-csi-rbd-provisioner", - "kind": "Secret", - "data": { - "userID": "csi-rbd-provisioner", - "userKey": self.out_map["CSI_RBD_PROVISIONER_SECRET"], - }, - } - ) - # if 'CSI_CEPHFS_PROVISIONER_SECRET' exists, then only add 'rook-csi-cephfs-provisioner' Secret - if self.out_map["CSI_CEPHFS_PROVISIONER_SECRET"]: - json_out.append( - { - "name": "rook-csi-cephfs-provisioner", - "kind": "Secret", - "data": { - "adminID": "csi-cephfs-provisioner", - "adminKey": self.out_map["CSI_CEPHFS_PROVISIONER_SECRET"], - }, - } - ) - # if 'CSI_CEPHFS_NODE_SECRET' exists, then only add 'rook-csi-cephfs-node' Secret - if self.out_map["CSI_CEPHFS_NODE_SECRET"]: - json_out.append( - { - "name": "rook-csi-cephfs-node", - "kind": "Secret", - "data": { - "adminID": "csi-cephfs-node", - "adminKey": self.out_map["CSI_CEPHFS_NODE_SECRET"], - }, - } - ) + }) # if 'ROOK_EXTERNAL_DASHBOARD_LINK' exists, then only add 'rook-ceph-dashboard-link' Secret if self.out_map["ROOK_EXTERNAL_DASHBOARD_LINK"]: json_out.append( @@ -1547,18 +1422,42 @@ class RadosJSON: }, } ) + if self.out_map['RBD_METADATA_EC_POOL_NAME']: + json_out.append({ + "name": "ceph-rbd", + "kind": "StorageClass", + "data": { + "dataPool": self.out_map['RBD_METADATA_EC_POOL_NAME'], + "pool": self.out_map['RBD_POOL_NAME'], + "csi.storage.k8s.io/provisioner-secret-name": "rook-{}".format(self.out_map["CSI_RBD_PROVISIONER_SECRET_NAME"]), + "csi.storage.k8s.io/controller-expand-secret-name": "rook-{}".format(self.out_map["CSI_RBD_PROVISIONER_SECRET_NAME"]), + "csi.storage.k8s.io/node-stage-secret-name": "rook-{}".format(self.out_map["CSI_RBD_NODE_SECRET_NAME"]) + }, + }) + else: + json_out.append({ + "name": "ceph-rbd", + "kind": "StorageClass", + "data": { + "pool": self.out_map['RBD_POOL_NAME'], + "csi.storage.k8s.io/provisioner-secret-name": "rook-{}".format(self.out_map["CSI_RBD_PROVISIONER_SECRET_NAME"]), + "csi.storage.k8s.io/controller-expand-secret-name": "rook-{}".format(self.out_map["CSI_RBD_PROVISIONER_SECRET_NAME"]), + "csi.storage.k8s.io/node-stage-secret-name": "rook-{}".format(self.out_map["CSI_RBD_NODE_SECRET_NAME"]) + }, + }) # if 'CEPHFS_FS_NAME' exists, then only add 'cephfs' StorageClass - if self.out_map["CEPHFS_FS_NAME"]: - json_out.append( - { - "name": "cephfs", - "kind": "StorageClass", - "data": { - "fsName": self.out_map["CEPHFS_FS_NAME"], - "pool": self.out_map["CEPHFS_POOL_NAME"], - }, + if self.out_map['CEPHFS_FS_NAME']: + json_out.append({ + "name": "cephfs", + "kind": "StorageClass", + "data": { + "fsName": self.out_map['CEPHFS_FS_NAME'], + "pool": self.out_map['CEPHFS_POOL_NAME'], + "csi.storage.k8s.io/provisioner-secret-name": "rook-{}".format(self.out_map["CSI_CEPHFS_PROVISIONER_SECRET_NAME"]), + "csi.storage.k8s.io/controller-expand-secret-name": "rook-{}".format(self.out_map["CSI_CEPHFS_PROVISIONER_SECRET_NAME"]), + "csi.storage.k8s.io/node-stage-secret-name": "rook-{}".format(self.out_map["CSI_CEPHFS_NODE_SECRET_NAME"]) } - ) + }) # if 'RGW_ENDPOINT' exists, then only add 'ceph-rgw' StorageClass if self.out_map["RGW_ENDPOINT"]: json_out.append( diff --git a/deploy/examples/import-external-cluster.sh b/deploy/examples/import-external-cluster.sh index ea0f438be..bccfabc2f 100644 --- a/deploy/examples/import-external-cluster.sh +++ b/deploy/examples/import-external-cluster.sh @@ -5,10 +5,6 @@ set -e # VARIABLES # ############# MON_SECRET_NAME=rook-ceph-mon -CSI_RBD_NODE_SECRET_NAME=rook-csi-rbd-node -CSI_RBD_PROVISIONER_SECRET_NAME=rook-csi-rbd-provisioner -CSI_CEPHFS_NODE_SECRET_NAME=rook-csi-cephfs-node -CSI_CEPHFS_PROVISIONER_SECRET_NAME=rook-csi-cephfs-provisioner RGW_ADMIN_OPS_USER_SECRET_NAME=rgw-admin-ops-user MON_SECRET_CLUSTER_NAME_KEYNAME=cluster-name MON_SECRET_FSID_KEYNAME=fsid @@ -20,7 +16,12 @@ MON_ENDPOINT_CONFIGMAP_NAME=rook-ceph-mon-endpoints ROOK_EXTERNAL_CLUSTER_NAME=$NAMESPACE ROOK_EXTERNAL_MAX_MON_ID=2 ROOK_EXTERNAL_MAPPING={} +RBD_STORAGE_CLASS_NAME=ceph-rbd +CEPHFS_STORAGE_CLASS_NAME=cephfs ROOK_EXTERNAL_MONITOR_SECRET=mon-secret +OPERATOR_NAMESPACE=rook-ceph # default set to rook-ceph +RBD_PROVISIONER=$OPERATOR_NAMESPACE".rbd.csi.ceph.com" # driver:namespace:operator +CEPHFS_PROVISIONER=$OPERATOR_NAMESPACE".cephfs.csi.ceph.com" # driver:namespace:operator : "${ROOK_EXTERNAL_ADMIN_SECRET:=admin-secret}" ############# @@ -31,6 +32,26 @@ function checkEnvVars() { if [ -z "$NAMESPACE" ]; then echo "Please populate the environment variable NAMESPACE" exit 1 + fi + if [ -z "$RBD_POOL_NAME" ]; then + echo "Please populate the environment variable RBD_POOL_NAME" + exit 1 + fi + if [ -z "$CSI_RBD_NODE_SECRET_NAME" ]; then + echo "Please populate the environment variable CSI_RBD_NODE_SECRET_NAME" + exit 1 + fi + if [ -z "$CSI_RBD_PROVISIONER_SECRET_NAME" ]; then + echo "Please populate the environment variable CSI_RBD_PROVISIONER_SECRET_NAME" + exit 1 + fi + if [ -z "$CSI_CEPHFS_NODE_SECRET_NAME" ]; then + echo "Please populate the environment variable CSI_CEPHFS_NODE_SECRET_NAME" + exit 1 + fi + if [ -z "$CSI_CEPHFS_PROVISIONER_SECRET_NAME" ]; then + echo "Please populate the environment variable CSI_CEPHFS_PROVISIONER_SECRET_NAME" + exit 1 fi if [ -z "$ROOK_EXTERNAL_FSID" ]; then echo "Please populate the environment variable ROOK_EXTERNAL_FSID" @@ -103,8 +124,8 @@ function importCsiRBDNodeSecret() { secret \ generic \ --type="kubernetes.io/rook" \ - "$CSI_RBD_NODE_SECRET_NAME" \ - --from-literal=userID=csi-rbd-node \ + "rook-""$CSI_RBD_NODE_SECRET_NAME" \ + --from-literal=userID="$CSI_RBD_NODE_SECRET_NAME" \ --from-literal=userKey="$CSI_RBD_NODE_SECRET" } @@ -114,8 +135,8 @@ function importCsiRBDProvisionerSecret() { secret \ generic \ --type="kubernetes.io/rook" \ - "$CSI_RBD_PROVISIONER_SECRET_NAME" \ - --from-literal=userID=csi-rbd-provisioner \ + "rook-""$CSI_RBD_PROVISIONER_SECRET_NAME" \ + --from-literal=userID="$CSI_RBD_PROVISIONER_SECRET_NAME" \ --from-literal=userKey="$CSI_RBD_PROVISIONER_SECRET" } @@ -125,8 +146,8 @@ function importCsiCephFSNodeSecret() { secret \ generic \ --type="kubernetes.io/rook" \ - "$CSI_CEPHFS_NODE_SECRET_NAME" \ - --from-literal=adminID=csi-cephfs-node \ + "rook-""$CSI_CEPHFS_NODE_SECRET_NAME" \ + --from-literal=adminID="$CSI_CEPHFS_NODE_SECRET_NAME" \ --from-literal=adminKey="$CSI_CEPHFS_NODE_SECRET" } @@ -136,8 +157,8 @@ function importCsiCephFSProvisionerSecret() { secret \ generic \ --type="kubernetes.io/rook" \ - "$CSI_CEPHFS_PROVISIONER_SECRET_NAME" \ - --from-literal=adminID=csi-cephfs-provisioner \ + "rook-""$CSI_CEPHFS_PROVISIONER_SECRET_NAME" \ + --from-literal=adminID="$CSI_CEPHFS_PROVISIONER_SECRET_NAME" \ --from-literal=adminKey="$CSI_CEPHFS_PROVISIONER_SECRET" } @@ -152,6 +173,77 @@ function importRGWAdminOpsUser() { --from-literal=secretKey="$RGW_ADMIN_OPS_USER_SECRET_KEY" } +function createECRBDStorageClass() { +cat <