benvin
1ea1713d6e
Adds a Kubernetes operator that provisions Ceph RGW (S3) buckets and access keys declaratively through the Ceph manager dashboard REST API. Three CRDs in group ceph.unkin.net/v1alpha1: - ObjectStoreUser: creates an RGW user, delivers its key pair to a Secret - Bucket: creates an S3 bucket owned by an ObjectStoreUser; owns the bucket's aggregate S3 policy (union of all BucketAccess grants) - BucketAccess: grants read-only/read-write/full access, provisioning a dedicated user (or reusing a referenced one) and delivering RW/RO keys The internal/ceph client wraps the dashboard /api/auth, /api/rgw/user and /api/rgw/bucket endpoints with lazy token auth and re-auth on 401. Bucket policies are rendered deterministically and applied via the bucket policy API (Reef 18.2+). Credentials come from the cephrgw-credentials Secret via env. Includes generated CRDs/RBAC, samples, kind manifests, Woodpecker CI, and docs/ceph-setup.md covering the required Ceph dashboard account, RGW wiring and permissions.
102 lines
2.7 KiB
Go
102 lines
2.7 KiB
Go
package controller
|
|
|
|
import (
|
|
"context"
|
|
"net/url"
|
|
"time"
|
|
|
|
corev1 "k8s.io/api/core/v1"
|
|
"k8s.io/apimachinery/pkg/api/meta"
|
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
|
"k8s.io/apimachinery/pkg/runtime"
|
|
"sigs.k8s.io/controller-runtime/pkg/client"
|
|
"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
|
|
|
|
"git.unkin.net/unkin/cephrgw-operator/internal/ceph"
|
|
)
|
|
|
|
// finalizer guards external RGW state (users, buckets, policy statements) so it
|
|
// is cleaned up before the Kubernetes object disappears.
|
|
const finalizer = "ceph.unkin.net/finalizer"
|
|
|
|
// requeueSteady is the resync interval for healthy objects; it lets the
|
|
// operator heal drift made directly against RGW.
|
|
const requeueSteady = 10 * time.Minute
|
|
|
|
// requeueShort backs off on transient "waiting for a dependency" states.
|
|
const requeueShort = 30 * time.Second
|
|
|
|
// setReady sets the standard Ready condition on a status conditions slice.
|
|
func setReady(conds *[]metav1.Condition, gen int64, ok bool, reason, msg string) {
|
|
status := metav1.ConditionFalse
|
|
if ok {
|
|
status = metav1.ConditionTrue
|
|
}
|
|
meta.SetStatusCondition(conds, metav1.Condition{
|
|
Type: "Ready",
|
|
Status: status,
|
|
ObservedGeneration: gen,
|
|
Reason: reason,
|
|
Message: truncate(msg, 32000),
|
|
})
|
|
}
|
|
|
|
func truncate(s string, n int) string {
|
|
if len(s) <= n {
|
|
return s
|
|
}
|
|
return s[:n]
|
|
}
|
|
|
|
func orDefault(v, def string) string {
|
|
if v != "" {
|
|
return v
|
|
}
|
|
return def
|
|
}
|
|
|
|
// upsertSecret creates or updates an owner-referenced Opaque Secret with data.
|
|
func upsertSecret(ctx context.Context, c client.Client, scheme *runtime.Scheme, owner client.Object, name, namespace string, data map[string][]byte) error {
|
|
sec := &corev1.Secret{}
|
|
sec.Name = name
|
|
sec.Namespace = namespace
|
|
_, err := controllerutil.CreateOrUpdate(ctx, c, sec, func() error {
|
|
sec.Type = corev1.SecretTypeOpaque
|
|
if sec.Data == nil {
|
|
sec.Data = map[string][]byte{}
|
|
}
|
|
for k, v := range data {
|
|
sec.Data[k] = v
|
|
}
|
|
return controllerutil.SetControllerReference(owner, sec, scheme)
|
|
})
|
|
return err
|
|
}
|
|
|
|
// credentialSecretData assembles the conventional S3/AWS credential keys.
|
|
func credentialSecretData(key ceph.UserKey, uid, endpoint, bucket string) map[string][]byte {
|
|
data := map[string][]byte{
|
|
"AWS_ACCESS_KEY_ID": []byte(key.AccessKey),
|
|
"AWS_SECRET_ACCESS_KEY": []byte(key.SecretKey),
|
|
"RGW_UID": []byte(uid),
|
|
}
|
|
if endpoint != "" {
|
|
data["S3_ENDPOINT"] = []byte(endpoint)
|
|
if host := hostOf(endpoint); host != "" {
|
|
data["BUCKET_HOST"] = []byte(host)
|
|
}
|
|
}
|
|
if bucket != "" {
|
|
data["BUCKET_NAME"] = []byte(bucket)
|
|
}
|
|
return data
|
|
}
|
|
|
|
func hostOf(endpoint string) string {
|
|
u, err := url.Parse(endpoint)
|
|
if err != nil || u.Host == "" {
|
|
return endpoint
|
|
}
|
|
return u.Host
|
|
}
|