From b4e1c1720dbae6a03b21c0897ea3681a0b796225 Mon Sep 17 00:00:00 2001
From: Santosh Pillai <sapillai@redhat.com>
Date: Fri, 29 Aug 2025 12:00:04 +0530
Subject: [PATCH] osd: rotate lockbox keys for encrypted osd

ceph-volume creates osd-lockbox keys for the encryted osds. This PR
rotates those keys along with the OSD keys.

Signed-off-by: Santosh Pillai <sapillai@redhat.com>
---
 pkg/operator/ceph/cluster/osd/labels.go |  6 ------
 pkg/operator/ceph/cluster/osd/spec.go   | 20 +++++++++++++++++++-
 pkg/operator/ceph/cluster/osd/update.go | 10 ++++++++++
 3 files changed, 29 insertions(+), 7 deletions(-)

diff --git a/pkg/operator/ceph/cluster/osd/labels.go b/pkg/operator/ceph/cluster/osd/labels.go
index f2d652a13..aea609806 100644
--- a/pkg/operator/ceph/cluster/osd/labels.go
+++ b/pkg/operator/ceph/cluster/osd/labels.go
@@ -64,12 +64,6 @@ func (c *Cluster) getOSDLabels(osd OSDInfo, failureDomainValue string, portable
 		labels[deviceType] = osd.DeviceType
 	}
 
-	encryptedOSD := "false"
-	if osd.Encrypted {
-		encryptedOSD = "true"
-	}
-	labels[encrypted] = encryptedOSD
-
 	for k, v := range getOSDTopologyLocationLabels(osd.Location) {
 		labels[k] = v
 	}
diff --git a/pkg/operator/ceph/cluster/osd/spec.go b/pkg/operator/ceph/cluster/osd/spec.go
index 15984bbaf..c30a47614 100644
--- a/pkg/operator/ceph/cluster/osd/spec.go
+++ b/pkg/operator/ceph/cluster/osd/spec.go
@@ -111,6 +111,17 @@ OSD_DATA_DIR=/var/lib/ceph/osd/ceph-"$OSD_ID"
 KEYRING_FILE="$OSD_DATA_DIR"/keyring
 CV_MODE=%s
 DEVICE="$%s"
+ENCRYPTED="%t"
+
+# copy the latest lockbox keys to the keyring file as they might have been rotated
+if [ "$ENCRYPTED" == "true" ] ; then
+	LOCKBOX_KEYRING_FILE="$OSD_DATA_DIR"/lockbox.keyring
+	LOCKBOX_USER=client.osd-lockbox."$OSD_UUID"
+
+	ceph --name client.admin auth get-or-create "$LOCKBOX_USER" \
+	mon 'allow command "config-key get" with key="dm-crypt/osd/'$OSD_UUID'/luks"' \
+	--keyring /etc/ceph/admin-keyring-store/keyring > "$LOCKBOX_KEYRING_FILE"
+fi
 
 # active the osd with ceph-volume
 if [[ "$CV_MODE" == "lvm" ]]; then
@@ -523,6 +534,13 @@ func (c *Cluster) makeDeployment(osdProps osdProperties, osd *OSDInfo, provision
 
 	osdLabels := c.getOSDLabels(*osd, failureDomainValue, osdProps.portable)
 
+	// update encryption label on the OSD deployment
+	if osdProps.storeConfig.EncryptedDevice || osdProps.encrypted {
+		osdLabels[encrypted] = "true"
+	} else {
+		osdLabels[encrypted] = "false"
+	}
+
 	if osd.ExportService {
 		osdService, err := c.createOSDService(*osd, osdLabels)
 		if err != nil {
@@ -938,7 +956,7 @@ func (c *Cluster) getActivateOSDInitContainer(configDir, namespace, osdID string
 		Command: []string{
 			"/bin/bash",
 			"-c",
-			fmt.Sprintf(activateOSDOnNodeCode, osdInfo.UUID, osdStoreFlag, osdInfo.CVMode, blockPathVarName),
+			fmt.Sprintf(activateOSDOnNodeCode, osdInfo.UUID, osdStoreFlag, osdInfo.CVMode, blockPathVarName, osdProps.storeConfig.EncryptedDevice),
 		},
 		Name:            "activate",
 		Image:           c.spec.CephVersion.Image,
diff --git a/pkg/operator/ceph/cluster/osd/update.go b/pkg/operator/ceph/cluster/osd/update.go
index 2cb3a2e50..fba9dbed7 100644
--- a/pkg/operator/ceph/cluster/osd/update.go
+++ b/pkg/operator/ceph/cluster/osd/update.go
@@ -428,5 +428,15 @@ func (c *Cluster) rotateCephxKey(osdInfo OSDInfo) (cephv1.CephxStatus, error) {
 		return didNotRotateCephxStatus, errors.Wrapf(err, "failed to rotate cephx key for OSD %d", osdInfo.ID)
 	}
 
+	// rotating the `client.osd-lockbox.$OSD_UUID` keys created for luks-encrypted OSDs by ceph-volume
+	if osdInfo.Encrypted {
+		osdLockBoxUser := fmt.Sprintf("client.osd-lockbox.%s", osdInfo.UUID)
+		logger.Infof("rotating osd-lockbox cephx key of encrypted OSD %d for CephCluster in namespace %q", osdInfo.ID, c.clusterInfo.Namespace)
+		_, err = cephclient.AuthRotate(c.context, c.clusterInfo, osdLockBoxUser)
+		if err != nil {
+			return didNotRotateCephxStatus, errors.Wrapf(err, "failed to rotate osd-lockbox cephx key for the encrypted OSD %d", osdInfo.ID)
+		}
+	}
+
 	return didRotateCephxStatus, nil
 }