Support using SSE-S3 encryption with RGW using vault Agent auth.
RGW sends requests to the agent instead of directly to Vault, and the agent transparently injects the authentication token. This eliminates using and managing a static token
Signed-off-by: Santosh <sapillai@redhat.com>
This prevents overwriting the user-specified capabilities
and correctly copies the Capabilities into UserCapabilities
after the AdminOpsClient calls.
Signed-off-by: hjk068 <hello.hyunjin@gmail.com>
initialize both aws sdk v1 and v2 clients in s3agent.
update createbucket to use sdk v2 while keeping all
other methods on sdk v1.
Signed-off-by: Oded Viner <oviner@redhat.com>
Allow users to configure custom labels on CephObjectStore RGW services
by adding a Labels field to the RGWServiceSpec, following the existing
pattern used for Annotations. This enables use cases such as service
mesh integration and monitoring discovery that require specific labels
on Kubernetes services.
Fixes: #17235
Signed-off-by: majiayu000 <1835304752@qq.com>
This PR creates the account root user by default when
CephObjectStoreAccount CR is created and skips it if
`spec.rootuser.skipCreate` is true.
Signed-off-by: Santosh <sapillai@redhat.com>
deleting an erasure coded CephBlockPool left the ec profile
orphaned. recreating with different settings failed because
the old profile could not be overridden.
- delete ec profile during CephBlockPool deletion
- disable --format json on ec profile set command
- fix ec profile name mismatch in CephObjectStore deletion
Signed-off-by: Oded Viner <oviner@redhat.com>
When http is disabled, the spec.status.info.insecure will keep on
showing the insecure endpoint. This PR makes sure that the
spec.status.info.insecure is empty when http is disabled
Signed-off-by: Santosh <sapillai@redhat.com>
with controller runtime latest version vO.23.0, golangci lint
is complaining about deprecated api deprecated.
This commit updates the api and adds the requried rbacs
Signed-off-by: subhamkrai <srai@redhat.com>
Update the CA bundle volume mount permissions to read-all (o444). RGW
runs as 'ceph', but the volume mount defaults to 'root'. o444 ensures
the RGW can read the bundle.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
Add ceph version check to determine CA bundle configuration method.
Ceph Tentacle+ supports CURL_CA_BUNDLE environment variable, while older
versions require system CA trust update via init container.
Signed-off-by: Sunnatillo <sunnat.samadov@est.tech>
This mounts custom CA bundle directly to the RGW container at
/etc/ceph/rgw-ca-bundle/ and CURL_CA_BUNDLE points to the certificate
file. Ceph changes regarding CURL_CA_BUNDLE variable is in this PR:
https://github.com/ceph/ceph/pull/44283
This change simplifies the CA bundle handling by:
- Removing the update-ca-trust init container and related volumes
- Mounting the CA bundle secret directly to the RGW pod
Signed-off-by: Sunnatillo <sunnat.samadov@est.tech>
in endpoint slice for the mgr and rgw service
it was harcoded to use the ipv4,
now dynamically assign the type based on the endpoint
ip adrress type
Signed-off-by: parth-gr <partharora1010@gmail.com>
For all of the controllers besides the cluster controller,
the logging now includes the namespaced name of the resource
that is being reconciled. This will help with log troubleshooting
to help analyze logs consistently for the resource being
reconciled.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
For Rook v1.19,removing support for Ceph Reef. It is at end of life.
Users on Reef can continue to use Rook v1.18.x or older.
The latest two Ceph versions Squid and Tentacle are supported.
Signed-off-by: subhamkrai <srai@redhat.com>
The logger names are seen on each line of logging. As
long as they are unique, they really don't need to be
long and descriptive, so let's make them a bit more
concise, and independent from controller names.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
add defaultRealm field to cephobjectstore to allow rook to mark the
created realm as default. this prevents ceph from auto-creating a
"default" zonegroup and zone when the default is not explicitly set.
affects only non-multisite setups.
Signed-off-by: Oded Viner <oviner@redhat.com>
obc was using an internal exponential backup for the lookup of the sc.
This is somewhat of an anti-pattern when using controller-runtime as it
implements retrying logic. If the sc doesn't exist, the reconcile
attempt should fail immediately and controller-runtime will handle the
back-off policy.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
A typo was causing the operator to attempt to sync bucket policy when
the state was already in sync. This resulted in the operator carrying
out unnecessary work and logging activity with no user visible change
resulting.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
Creating the rgw admin user is taking on the order of two
minutes instead of the expected seconds, thus the command
was timing out and cause the object store user creation
to fail. The increased timeout allows the admin user creation
to complete, and other users to be created as well.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Joshua Hoblitt
Oded Viner
Blaine Gardner
Santosh
Travis Nielsen
Joshua Hoblitt
hjk068
Tarun Gupta Akirala
majiayu000
Artem Torubarov
subhamkrai
Sunnatillo
dependabot[bot]
Parth Arora
SantoshPillai
cuiweixie