unkinben
2c6f63a86f
The operator previously drove the Ceph manager dashboard REST API to manage RGW users, buckets and policies. That coupled it to a dashboard login, the dashboard's RGW wiring, and the dashboard's bucket API surface. Rebuild the Ceph integration to talk directly to radosgw the way the CLI does, using native Go libraries, while keeping every operator capability identical. The exported surface of internal/ceph is unchanged, so the three controllers and cmd/operator are untouched (bar the env-var/config plumbing already in flight for the radosgw move). - replace the internal/ceph client internals with github.com/ceph/go-ceph rgw/admin (Admin Ops API) for users, keys, quotas and bucket info/removal - add github.com/aws/aws-sdk-go-v2 S3 client for bucket create, versioning, policy, tagging and object lock, signed as the bucket owner - map go-ceph admin.ErrNoSuch*/ErrUserExists and smithy APIError codes into IsNotFound/IsConflict so controller create-vs-update branching is preserved - set S3 path-style addressing and WhenRequired checksum modes for RGW - delete the hand-rolled SigV4 signer, canonical-query and XML marshaling - keep policy.go/BuildBucketPolicy/BuildTagJSON as pure builders - replace the SigV4 signer tests with NewClient validation and error-classifier tests - keep CGO_ENABLED=0 distroless: only go-ceph's pure-Go rgw/admin is imported - rewrite README and docs/ceph-setup.md for the single RGW admin user (caps users=*;buckets=*) and CEPH_RGW_* credential Secret Claude-Session: https://claude.ai/code/session_016CEncETbf8cvy1PhsHfFHM
81 lines
2.4 KiB
YAML
81 lines
2.4 KiB
YAML
---
|
|
# radosgw admin credentials for local testing. Replace the values, or create the
|
|
# Secret out-of-band, before applying. Keys map 1:1 to the operator env vars.
|
|
# The access/secret key belong to an RGW user with admin caps
|
|
# (users=*, buckets=*, metadata=read).
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: cephrgw-credentials
|
|
namespace: cephrgw-system
|
|
type: Opaque
|
|
stringData:
|
|
# radosgw endpoint the operator talks to (Admin Ops + S3 APIs).
|
|
CEPH_RGW_ADMIN_ENDPOINT: "https://radosgw.service.consul:443"
|
|
CEPH_RGW_ACCESS_KEY: "change-me"
|
|
CEPH_RGW_SECRET_KEY: "change-me"
|
|
# The S3 endpoint written into credential Secrets for consumers (may be a
|
|
# public name that differs from the API endpoint above).
|
|
CEPH_RGW_ENDPOINT: "https://s3.ceph.unkin.net"
|
|
# Optional: SigV4 credential-scope region (defaults to "default").
|
|
# CEPH_RGW_REGION: "default"
|
|
# Optional: set to "true" to skip TLS verification (dev only).
|
|
# CEPH_RGW_INSECURE: "true"
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: cephrgw-operator
|
|
namespace: cephrgw-system
|
|
labels:
|
|
app.kubernetes.io/name: cephrgw-operator
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: cephrgw-operator
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: cephrgw-operator
|
|
spec:
|
|
serviceAccountName: cephrgw-operator
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
containers:
|
|
- name: operator
|
|
image: cephrgw-operator:dev
|
|
imagePullPolicy: IfNotPresent
|
|
args:
|
|
- --metrics-bind-address=:8080
|
|
- --health-probe-bind-address=:8081
|
|
- --leader-elect
|
|
envFrom:
|
|
- secretRef:
|
|
name: cephrgw-credentials
|
|
ports:
|
|
- containerPort: 8080
|
|
name: metrics
|
|
- containerPort: 8081
|
|
name: health
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /readyz
|
|
port: 8081
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /healthz
|
|
port: 8081
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities:
|
|
drop: ["ALL"]
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 64Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 256Mi
|