Add a design for CephObjectStore to allow users to pass through Ceph
configs (e.g., `rgw_enable_apis`, `debug_rgw`) to the object store. This
design will help users set configs that they want for their environments
that aren't covered under Rook's umbrella of managed configs. This will
benefit users by allowing them to make use of rare RGW features that
Rook devs don't have ability to prioritize, as well as newly-released
RGW features that Rook devs haven't had time to plan API interfaces for.
This frees up Rook developers to focus effort on implementing APIs that
have integration benefits with Kubernetes or other resources and less
effort on simple configs.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
RGW can only serve a single certificate. This limitation means that the
prior behavior of using the default service for admin ops when TLS is
enabled may mean it requires additional complex certificate management
to make sure the object store uses a certificate valid for Rook internal
admin ops and user connections.
This is needlessly complex for users. Instead, change Rook's behavior
and documentation to clarify that it will use the same endpoint intended
for S3 client applications. This means that users have a more
straightforward path to enabling both Rook and consuming applications.
More info: https://github.com/rook/rook/issues/14530
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
Update the vhost-style S3 bucket access design doc to reflect recent
user feedback and configuration issues. The primary goal is to add a
field to disambiguate for users and Rook which endpoint should be used
for CephObjectStoreUsers, OBCs, and COSI buckets.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
Until now, an object store would create all the necessary
metadata pools and the data pool that were exclusively
for its own object store. When isolation between object
stores is necessary, this would cause many pools and
PGs to be created in the cluster, which was not
manageable.
Now one set of pools can be created to be shared
by any number of object stores. The metadata and data
between each object store is isolated by
RADOS namespaces, which by design will keep the
data safe for multi-tenancy.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The PR #11091 add support for LDAP integration with RGW, this contains
breif overview of design specific details.
Signed-off-by: Jiffin Tony Thottan <thottanjiffin@gmail.com>
If the admin wants to use insecure TLS to validate connections to rgw
internally, the TLS secret can have another entry "insecureSkipVerify"
and set it to "true".
Signed-off-by: Sébastien Han <seb@redhat.com>
`CephObjectStore->gateway->type` is not used. Rook has only supported s3-like
interface and hasn't had no code which handles `type` field.
In addition, this field was removed from CRD in the following commit.
ceph: auto-gen crds
31db03fece
Signed-off-by: Satoru Takeuchi <satoru.takeuchi@gmail.com>
This commit adds design revisions, examples, and
documentation for object multisite.
Changes to the CephObjectRealm to pull a realm
from another cluster, and the zone for creating
pools are amongst the larger changes
Signed-off-by: Ali Maredia <amaredia@redhat.com>
When zones are created the ceph RGWs inside the
those zones should be using pools with the zones
name not the object-store's name
Signed-off-by: Ali Maredia <amaredia@redhat.com>
The implementation of this initial design will
allow object-stores to sync data across Rook Ceph
Clusters via a Day 1 setup of Ceph RGW Multisite
This design splits the realm, zonegroup, and zone
objects of Ceph RGW Multisite into seperate
resources.
This commit also moves all ceph object designs
into the design/ceph/object dir.
Signed-off-by: Ali Maredia <amaredia@redhat.com>
Blaine Gardner
Travis Nielsen
Artem Torubarov
Jiffin Tony Thottan
Josh Soref
subhamkrai
Sébastien Han
Denis Egorenko
Satoru Takeuchi
Ali Maredia