unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 4 Actions Packages Projects Releases Wiki Activity

Roll cephrgw-operator to v0.2.0 (radosgw-native)
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details

Browse Source 
cephrgw-operator v0.2.0 rebuilds the Ceph integration to talk directly to
radosgw via go-ceph (Admin Ops API) and aws-sdk-go-v2 (S3), replacing the
manager dashboard client, and adds fine-grained bucket-access policies. The
operator now authenticates with an RGW admin user's access/secret key instead
of a dashboard login.

- bump the operator image to v0.2.0
- update the envFrom / VaultStaticSecret comments to the CEPH_RGW_* credential
  keys the new image consumes (the KV seed must be re-put with these keys)

Claude-Session: https://claude.ai/code/session_016CEncETbf8cvy1PhsHfFHM
This commit is contained in:
Ben Vincent
2026-07-24 23:06:44 +10:00
parent 982bf1c837
commit 1e01cd670d
2 changed files with 12 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/base/cephrgw-system/deployment.yaml
+5 -4
View File
@@ -24,15 +24,16 @@ spec:
runAsNonRoot: true runAsNonRoot: true
containers: containers:
- name: operator - name: operator
image: git.unkin.net/unkin/cephrgw-operator:v0.1.0 image: git.unkin.net/unkin/cephrgw-operator:v0.2.0
args: args:
- --metrics-bind-address=:8080 - --metrics-bind-address=:8080
- --health-probe-bind-address=:8081 - --health-probe-bind-address=:8081
- --leader-elect - --leader-elect
envFrom: envFrom:
# Provides CEPH_DASHBOARD_URL/USERNAME/PASSWORD and, optionally, # Provides CEPH_RGW_ACCESS_KEY/SECRET_KEY and the endpoints
# CEPH_RGW_ENDPOINT / CEPH_DASHBOARD_CA. Create this Secret per # (CEPH_RGW_ENDPOINT / CEPH_RGW_ADMIN_ENDPOINT), plus optional
# docs/ceph-setup.md; it is intentionally not managed in GitOps. # CEPH_RGW_REGION / CEPH_RGW_CA / CEPH_RGW_INSECURE. Rendered from
# Vault per docs/ceph-setup.md; not managed in GitOps.
- secretRef: - secretRef:
name: cephrgw-credentials name: cephrgw-credentials
ports: ports:
apps/base/cephrgw-system/vaultstaticsecret.yaml
+7 -4
View File
@@ -1,14 +1,17 @@
--- ---
# Renders the Ceph dashboard credentials from Vault into the cephrgw-credentials # Renders the radosgw credentials from Vault into the cephrgw-credentials
# Secret the operator Deployment consumes via envFrom. The KV secret's keys # Secret the operator Deployment consumes via envFrom. The KV secret's keys
# (CEPH_DASHBOARD_URL/USERNAME/PASSWORD, optional CEPH_RGW_ENDPOINT/CA) are # (CEPH_RGW_ACCESS_KEY/SECRET_KEY, CEPH_RGW_ENDPOINT, optional
# copied verbatim, so they land as the matching env vars. # CEPH_RGW_ADMIN_ENDPOINT/REGION/CA) are copied verbatim, so they land as the
# matching env vars.
# #
# The path sits under the templated default policy # The path sits under the templated default policy
# (kv/data/kubernetes/namespace/<ns>/<sa>/*), so it needs no dedicated Vault # (kv/data/kubernetes/namespace/<ns>/<sa>/*), so it needs no dedicated Vault
# role or policy. Seed the values with: # role or policy. Seed the values with:
# vault kv put kv/kubernetes/namespace/cephrgw-system/default/cephrgw-credentials \ # vault kv put kv/kubernetes/namespace/cephrgw-system/default/cephrgw-credentials \
# CEPH_DASHBOARD_URL=... CEPH_DASHBOARD_USERNAME=... CEPH_DASHBOARD_PASSWORD=... # CEPH_RGW_ENDPOINT=https://s3.ceph.unkin.net \
# CEPH_RGW_ADMIN_ENDPOINT=https://radosgw.service.consul:443 \
# CEPH_RGW_ACCESS_KEY=... CEPH_RGW_SECRET_KEY=...
apiVersion: secrets.hashicorp.com/v1beta1 apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret kind: VaultStaticSecret
metadata: metadata: