User can define his desired endpoint list in Zone CR so that it will
overwrite the default service name for rgw.
Resolves#6432
Signed-off-by: Jiffin Tony Thottan <thottanjiffin@gmail.com>
Signed-off-by: Jiffin Tony Thottan <jthottan@redhat.com>
The colon character is not allowed in secret names, therfore the secret
with the subuser credentials must use another character to join the
user and the subuser name.
This in turn makes the mapping non-injective (which has security
implications).
Signed-off-by: Sebastian Riese <sebastian.riese@cloudandheat.com>
Make explicity how the operator acts when the subuser list in the
CephObjectStoreUser CR is changed.
Signed-off-by: Sebastian Riese <sebastian.riese@cloudandheat.com>
Since only OpenStack Identity API version 3 is supported the
API version need not be configurable in the resource.
Signed-off-by: Sebastian Riese <sebastian.riese@cloudandheat.com>
As proposed in the review the natural target version for this feature is
1.9 which is to be released around March 2022.
Signed-off-by: Sebastian Riese <sebastian.riese@cloudandheat.com>
The open questions have been resolved in the discussion and the chosen
solution has been added to the main text. So the Open Questions section
is obsolete now.
Signed-off-by: Sebastian Riese <sebastian.riese@cloudandheat.com>
The goals/non-goals were mixed up to a degree. This
cleanly separates them to their respective sections.
In the course of that the term "Keystone API" was replaced by the more
correct "OpenStack Identity API" and the documentation of the API was
linked.
Signed-off-by: Sebastian Riese <sebastian.riese@cloudandheat.com>
Instead of mixing configuration for different protocols in the gateway
section, depending on the type option, introduce a new section protocols for
API specific configuration.
This allows configuring s3 and swift in one RGW and at the same time
simplifies validation of the CRD and allows for a clean separation of
concerns.
Signed-off-by: Sebastian Riese <sebastian.riese@cloudandheat.com>
* add annotations to the examples of new CR fields
* add links to external documentation
* clarify language issues raised in review
Signed-off-by: Sebastian Riese <sebastian.riese@cloudandheat.com>
The prior formulation which openrc variables take effect was
ambiguous/contradictory.
Signed-off-by: Sebastian Riese <sebastian.riese@cloudandheat.com>
Access to the Swift API is granted via subusers. The configuration
of the subusers is added to the cephobjectstoreuser CR.
Signed-off-by: Sebastian Riese <sebastian.riese@cloudandheat.com>
The integration of Keystone includes HTTPS API calls to Keystone. We
document why the CA bundle used to verify those connections,
can't be explicitly configured and how it can be indirectly configured.
Signed-off-by: Sebastian Riese <sebastian.riese@cloudandheat.com>
It is not clear at this moment whether anyone has a use case for this.
As a workaround you can explicitly generate a user and subuser that
can access the bucket created via OBC.
Signed-off-by: Sebastian Riese <sebastian.riese@cloudandheat.com>
Ceph RGW supports integrating with OpenStack clouds by providing
the Swift object store API and using Keystone for authentication.
The design document describes how the required configuration shall
be mapped to the Object Store CRD.
Signed-off-by: Sebastian Riese <sebastian.riese@cloudandheat.com>
If the admin wants to use insecure TLS to validate connections to rgw
internally, the TLS secret can have another entry "insecureSkipVerify"
and set it to "true".
Signed-off-by: Sébastien Han <seb@redhat.com>
`CephObjectStore->gateway->type` is not used. Rook has only supported s3-like
interface and hasn't had no code which handles `type` field.
In addition, this field was removed from CRD in the following commit.
ceph: auto-gen crds
31db03fece
Signed-off-by: Satoru Takeuchi <satoru.takeuchi@gmail.com>
This documents the Ceph topics and buckets notification management by rook through CRs.
Signed-off-by: Guillaume Moutier <guillaume.moutier@gmail.com>
Signed-off-by: Jiffin Tony Thottan <thottanjiffin@gmail.com>
Found by running the following command:
codespell -S .git,*.png,*.jpg -L \
aks,keyserver,atleast,dne,ser,ist,files\',ba,dum,iam,te -f -H
Signed-off-by: Mateusz Gozdek <mgozdekof@gmail.com>
This commit adds design revisions, examples, and
documentation for object multisite.
Changes to the CephObjectRealm to pull a realm
from another cluster, and the zone for creating
pools are amongst the larger changes
Signed-off-by: Ali Maredia <amaredia@redhat.com>
When zones are created the ceph RGWs inside the
those zones should be using pools with the zones
name not the object-store's name
Signed-off-by: Ali Maredia <amaredia@redhat.com>
The implementation of this initial design will
allow object-stores to sync data across Rook Ceph
Clusters via a Day 1 setup of Ceph RGW Multisite
This design splits the realm, zonegroup, and zone
objects of Ceph RGW Multisite into seperate
resources.
This commit also moves all ceph object designs
into the design/ceph/object dir.
Signed-off-by: Ali Maredia <amaredia@redhat.com>
Jiffin Tony Thottan
Josh Soref
Jiffin Tony Thottan
subhamkrai
Sebastian Riese
Sébastien Han
Yuval Lifshitz
Denis Egorenko
Satoru Takeuchi
Guillaume Moutier
Mateusz Gozdek
Ali Maredia