Initial cephrgw-operator implementation #1

2026-07-18T08:29:49+10:00

unkinben commented

2026-07-18 08:29:49 +10:00

Why

Bootstrap the cephrgw-operator: a Kubernetes operator that provisions Ceph RGW (S3) buckets and access keys (RW/RO) from CRDs via the Ceph manager dashboard API.

Changes

Add three CRDs in ceph.unkin.net/v1alpha1: ObjectStoreUser (RGW user + key Secret), Bucket (S3 bucket owned by a user; owns the aggregate bucket policy), and BucketAccess (grants read-only/read-write/full, delivering RW/RO keys).
Add internal/ceph dashboard API client (lazy token auth + re-auth on 401) and a deterministic S3 bucket-policy builder.
Add the three controllers, cmd/operator entrypoint, generated CRDs/RBAC, samples, kind manifests, Woodpecker CI, Dockerfile, and docs/ceph-setup.md covering the required Ceph dashboard account, RGW wiring and permissions.

Verified locally: go vet, gofmt, go build, and go test -race all pass.

## Why Bootstrap the cephrgw-operator: a Kubernetes operator that provisions Ceph RGW (S3) buckets and access keys (RW/RO) from CRDs via the Ceph manager dashboard API. ## Changes - Add three CRDs in `ceph.unkin.net/v1alpha1`: `ObjectStoreUser` (RGW user + key Secret), `Bucket` (S3 bucket owned by a user; owns the aggregate bucket policy), and `BucketAccess` (grants read-only/read-write/full, delivering RW/RO keys). - Add `internal/ceph` dashboard API client (lazy token auth + re-auth on 401) and a deterministic S3 bucket-policy builder. - Add the three controllers, `cmd/operator` entrypoint, generated CRDs/RBAC, samples, kind manifests, Woodpecker CI, Dockerfile, and `docs/ceph-setup.md` covering the required Ceph dashboard account, RGW wiring and permissions. Verified locally: `go vet`, `gofmt`, `go build`, and `go test -race` all pass.

unkinben added 1 commit 2026-07-18 08:29:49 +10:00

Initial cephrgw-operator: Ceph RGW buckets & keys via dashboard API 1ea1713d6e

Adds a Kubernetes operator that provisions Ceph RGW (S3) buckets and
access keys declaratively through the Ceph manager dashboard REST API.

Three CRDs in group ceph.unkin.net/v1alpha1:
- ObjectStoreUser: creates an RGW user, delivers its key pair to a Secret
- Bucket: creates an S3 bucket owned by an ObjectStoreUser; owns the
  bucket's aggregate S3 policy (union of all BucketAccess grants)
- BucketAccess: grants read-only/read-write/full access, provisioning a
  dedicated user (or reusing a referenced one) and delivering RW/RO keys

The internal/ceph client wraps the dashboard /api/auth, /api/rgw/user and
/api/rgw/bucket endpoints with lazy token auth and re-auth on 401. Bucket
policies are rendered deterministically and applied via the bucket
policy API (Reef 18.2+). Credentials come from the cephrgw-credentials
Secret via env. Includes generated CRDs/RBAC, samples, kind manifests,
Woodpecker CI, and docs/ceph-setup.md covering the required Ceph
dashboard account, RGW wiring and permissions.

unkinben added 1 commit 2026-07-18 08:31:38 +10:00

Merge auto-initialized repo

ci/woodpecker/pr/build Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/test Pipeline was successful

Details

41449d41c9

unkinben force-pushed benvin/initial-operator from e3d13996f6 to 41449d41c9

2026-07-18 08:31:38 +10:00

Compare

benvin merged commit c7dcf29858 into main

2026-07-18 11:26:35 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/cephrgw-operator#1