ceph: add vault kms support for osd encryption

When the Ceph cluster runs on PVC and the OSDs are encrypted we can
store LUKS's Key Encryption Key inside a Key Management System. Today,
Rook only supports HashiCorp Vault: https://www.vaultproject.io/

The CephCluster has now a new "security" field which will plug onto the
KMS. Here is an example:

security:
  kms:
    tokenSecretName: <name of the secret containing a Vault token, used
    to authenticate>
    connectionDetails: < a map of strings containing connection
    information>

Refer to the ceph-cluster-crd documentation to lear more.

Closes: https://github.com/rook/rook/issues/6105
Signed-off-by: Sébastien Han <seb@redhat.com>
This commit is contained in:
Sébastien Han committed 2020-10-30 16:16:33 +01:00
1 parent 1c562512e1
commit ea1d71cbfb
51 files changed
+3318 -194

No files matched your search

+1 -1
View File
@@ -16,5 +16,5 @@ jobs:
run: GOPATH=$(go env GOPATH) make codegen
- name: validate codegen
run: hack/validate_modified_files.sh codegen
run: tests/scripts/validate_modified_files.sh codegen