Skip to content

Commit fa5b5bf

Browse files
openshift-merge-bot[bot]openshift-merge-bot[bot]
authored
Merge pull request #2846 from malayparida2000/encrypted
Add option to enable encryption for particular deviceset & Add KMS details when any of the deviceSet is encrypted.
2 parents 07c57b1 + fbbb241 commit fa5b5bf

File tree

118 files changed

+33039
-13
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

118 files changed

+33039
-13
lines changed

‎api/v1/storagecluster_types.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -402,6 +402,10 @@ type StorageDeviceSet struct {
402402
DataPVCTemplate corev1.PersistentVolumeClaim `json:"dataPVCTemplate"`
403403
MetadataPVCTemplate *corev1.PersistentVolumeClaim `json:"metadataPVCTemplate,omitempty"`
404404
WalPVCTemplate *corev1.PersistentVolumeClaim `json:"walPVCTemplate,omitempty"`
405+
406+
// Whether to encrypt the deviceSet or not
407+
// +optional
408+
Encrypted *bool `json:"encrypted,omitempty"`
405409
}
406410

407411
// TODO: Fill in the members when the actual configurable options are defined in rook-ceph

‎api/v1/zz_generated.deepcopy.go

Lines changed: 5 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/bases/ocs.openshift.io_storageclusters.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4452,6 +4452,9 @@ spec:
44524452
- NVME
44534453
- nvme
44544454
type: string
4455+
encrypted:
4456+
description: Whether to encrypt the deviceSet or not
4457+
type: boolean
44554458
initialWeight:
44564459
description: |-
44574460
InitialWeight is an optional explicit OSD weight value in TiB units.

‎controllers/storagecluster/cephcluster.go

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -167,10 +167,11 @@ func (obj *ocsCephCluster) ensureCreated(r *StorageClusterReconciler, sc *ocsv1.
167167
cephCluster = newExternalCephCluster(sc, monitoringIP, monitoringPort)
168168
} else {
169169
// Add KMS details to CephCluster spec, only if
170-
// cluster-wide encryption is enabled
171-
// ie, sc.Spec.Encryption.ClusterWide/sc.Spec.Encryption.Enable is True
170+
// cluster-wide encryption is enabled or any of the device set is encrypted
171+
// ie, sc.Spec.Encryption.ClusterWide/sc.Spec.Encryption.Enable is True or any device is encrypted
172172
// and KMS ConfigMap is available
173-
if sc.Spec.Encryption.Enable || sc.Spec.Encryption.ClusterWide {
173+
174+
if util.IsClusterOrDeviceSetEncrypted(sc) {
174175
kmsConfigMap, err := getKMSConfigMap(KMSConfigMapName, sc, r.Client)
175176
if err != nil {
176177
r.Log.Error(err, "Failed to procure KMS ConfigMap.", "KMSConfigMap", klog.KRef(sc.Namespace, KMSConfigMapName))
@@ -882,7 +883,7 @@ func newStorageClassDeviceSets(sc *ocsv1.StorageCluster) []rookCephv1.StorageCla
882883
Portable: portable,
883884
TuneSlowDeviceClass: ds.Config.TuneSlowDeviceClass,
884885
TuneFastDeviceClass: ds.Config.TuneFastDeviceClass,
885-
Encrypted: sc.Spec.Encryption.Enable || sc.Spec.Encryption.ClusterWide,
886+
Encrypted: isDeviceSetToBeEncrypted(sc, ds),
886887
}
887888

888889
if ds.MetadataPVCTemplate != nil {
@@ -989,6 +990,13 @@ func countAndReplicaOf(ds *ocsv1.StorageDeviceSet) (int, int) {
989990
return count, replica
990991
}
991992

993+
func isDeviceSetToBeEncrypted(sc *ocsv1.StorageCluster, ds ocsv1.StorageDeviceSet) bool {
994+
if ds.Encrypted != nil {
995+
return *ds.Encrypted
996+
}
997+
return sc.Spec.Encryption.Enable || sc.Spec.Encryption.ClusterWide
998+
}
999+
9921000
func newCephDaemonResources(sc *ocsv1.StorageCluster) map[string]corev1.ResourceRequirements {
9931001
resources := map[string]corev1.ResourceRequirements{
9941002
"mon": defaults.GetProfileDaemonResources("mon", sc),

‎controllers/storagecluster/cephobjectstores.go

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ import (
77
ocsv1 "github.com/red-hat-storage/ocs-operator/api/v4/v1"
88
"github.com/red-hat-storage/ocs-operator/v4/controllers/defaults"
99
"github.com/red-hat-storage/ocs-operator/v4/controllers/platform"
10+
"github.com/red-hat-storage/ocs-operator/v4/controllers/util"
1011
cephv1 "github.com/rook/rook/pkg/apis/ceph.rook.io/v1"
1112
corev1 "k8s.io/api/core/v1"
1213
"k8s.io/apimachinery/pkg/api/errors"
@@ -42,10 +43,10 @@ func (obj *ocsCephObjectStores) ensureCreated(r *StorageClusterReconciler, insta
4243
}
4344
var cephObjectStores []*cephv1.CephObjectStore
4445
// Add KMS details to cephObjectStores spec, only if
45-
// cluster-wide encryption is enabled
46-
// ie, sc.Spec.Encryption.ClusterWide/sc.Spec.Encryption.Enable is True
46+
// cluster-wide encryption is enabled or any of the device set is encrypted
47+
// ie, sc.Spec.Encryption.ClusterWide/sc.Spec.Encryption.Enable is True or any of the deviceSet is encrypted
4748
// and KMS ConfigMap is available
48-
if instance.Spec.Encryption.Enable || instance.Spec.Encryption.ClusterWide {
49+
if util.IsClusterOrDeviceSetEncrypted(instance) {
4950
kmsConfigMap, err := getKMSConfigMap(KMSConfigMapName, instance, r.Client)
5051
if err != nil {
5152
r.Log.Error(err, "Failed to procure KMS ConfigMap.", "KMSConfigMap", klog.KRef(instance.Namespace, KMSConfigMapName))

‎controllers/storagecluster/noobaa_system_reconciler.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -230,10 +230,10 @@ func (r *StorageClusterReconciler) setNooBaaDesiredState(nb *nbv1.NooBaa, sc *oc
230230

231231
// Add KMS details to Noobaa spec, only if
232232
// KMS is enabled, along with
233-
// ClusterWide encryption OR in a StandAlone Noobaa cluster mode
233+
// ClusterWide encryption/any deviceSet Encryption OR in a StandAlone Noobaa cluster mode
234234
// PS: sc.Spec.Encryption.Enable field is deprecated and added for backward compatibility
235235
if sc.Spec.Encryption.KeyManagementService.Enable &&
236-
(sc.Spec.Encryption.Enable || sc.Spec.Encryption.ClusterWide || r.IsNoobaaStandalone) {
236+
(util.IsClusterOrDeviceSetEncrypted(sc) || r.IsNoobaaStandalone) {
237237
if kmsConfig, err := getKMSConfigMap(KMSConfigMapName, sc, r.Client); err != nil {
238238
return err
239239
} else if kmsConfig != nil {

‎controllers/util/util.go

Lines changed: 20 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,10 @@ import (
55
"encoding/hex"
66
"encoding/json"
77
"fmt"
8-
ocsv1 "github.com/red-hat-storage/ocs-operator/api/v4/v1"
98
"os"
109

10+
ocsv1 "github.com/red-hat-storage/ocs-operator/api/v4/v1"
11+
1112
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
1213
)
1314

@@ -42,8 +43,8 @@ func GetKeyRotationSpec(sc *ocsv1.StorageCluster) (bool, string) {
4243
}
4344

4445
if sc.Spec.Encryption.KeyRotation.Enable == nil {
45-
if (sc.Spec.Encryption.Enable || sc.Spec.Encryption.ClusterWide) && !sc.Spec.Encryption.KeyManagementService.Enable {
46-
// use key-rotation by default if cluster-wide encryption is opted without KMS & "enable" spec is missing
46+
if IsClusterOrDeviceSetEncrypted(sc) && !sc.Spec.Encryption.KeyManagementService.Enable {
47+
// use key-rotation by default if cluster-wide encryption/any deviceSet encryption is opted without KMS & "enable" spec is missing
4748
return true, schedule
4849
}
4950
return false, schedule
@@ -103,3 +104,19 @@ func AssertEqual[T comparable](actual T, expected T, exitCode int) {
103104
os.Exit(exitCode)
104105
}
105106
}
107+
108+
func IsClusterOrDeviceSetEncrypted(sc *ocsv1.StorageCluster) bool {
109+
// If cluster-wide encryption is enabled
110+
if sc.Spec.Encryption.Enable || sc.Spec.Encryption.ClusterWide {
111+
return true
112+
}
113+
114+
// If any device set is encrypted
115+
for _, deviceSet := range sc.Spec.StorageDeviceSets {
116+
if deviceSet.Encrypted != nil && *deviceSet.Encrypted {
117+
return true
118+
}
119+
}
120+
121+
return false
122+
}

‎deploy/csv-templates/crds/ocs/ocs.openshift.io_storageclusters.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4452,6 +4452,9 @@ spec:
44524452
- NVME
44534453
- nvme
44544454
type: string
4455+
encrypted:
4456+
description: Whether to encrypt the deviceSet or not
4457+
type: boolean
44554458
initialWeight:
44564459
description: |-
44574460
InitialWeight is an optional explicit OSD weight value in TiB units.

‎deploy/ocs-operator/manifests/storagecluster.crd.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4452,6 +4452,9 @@ spec:
44524452
- NVME
44534453
- nvme
44544454
type: string
4455+
encrypted:
4456+
description: Whether to encrypt the deviceSet or not
4457+
type: boolean
44554458
initialWeight:
44564459
description: |-
44574460
InitialWeight is an optional explicit OSD weight value in TiB units.

‎metrics/go.mod

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,7 @@ require (
5050
github.com/containernetworking/cni v1.2.3 // indirect
5151
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
5252
github.com/emicklei/go-restful/v3 v3.12.1 // indirect
53+
github.com/evanphx/json-patch/v5 v5.9.0 // indirect
5354
github.com/fxamacker/cbor/v2 v2.7.0 // indirect
5455
github.com/go-jose/go-jose/v4 v4.0.4 // indirect
5556
github.com/go-logr/logr v1.4.2 // indirect
@@ -58,6 +59,7 @@ require (
5859
github.com/go-openapi/swag v0.23.0 // indirect
5960
github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
6061
github.com/gogo/protobuf v1.3.2 // indirect
62+
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
6163
github.com/golang/protobuf v1.5.4 // indirect
6264
github.com/google/gnostic-models v0.6.8 // indirect
6365
github.com/google/go-cmp v0.6.0 // indirect

‎metrics/go.sum

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -201,6 +201,8 @@ github.com/evanphx/json-patch v4.2.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLi
201201
github.com/evanphx/json-patch v4.5.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
202202
github.com/evanphx/json-patch v4.9.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
203203
github.com/evanphx/json-patch v4.12.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
204+
github.com/evanphx/json-patch/v5 v5.9.0 h1:kcBlZQbplgElYIlo/n1hJbls2z/1awpXxpRi0/FOJfg=
205+
github.com/evanphx/json-patch/v5 v5.9.0/go.mod h1:VNkHZ/282BpEyt/tObQO8s5CMPmYYq14uClGH4abBuQ=
204206
github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
205207
github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM=
206208
github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE=
@@ -315,6 +317,7 @@ github.com/golang/groupcache v0.0.0-20190129154638-5b532d6fd5ef/go.mod h1:cIg4er
315317
github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
316318
github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
317319
github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
320+
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
318321
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
319322
github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
320323
github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
@@ -1433,6 +1436,8 @@ k8s.io/api v0.31.0/go.mod h1:0YiFF+JfFxMM6+1hQei8FY8M7s1Mth+z/q7eF1aJkTE=
14331436
k8s.io/apiextensions-apiserver v0.0.0-20190409022649-727a075fdec8/go.mod h1:IxkesAMoaCRoLrPJdZNZUQp9NfZnzqaVzLhb2VEQzXE=
14341437
k8s.io/apiextensions-apiserver v0.18.3/go.mod h1:TMsNGs7DYpMXd+8MOCX8KzPOCx8fnZMoIGB24m03+JE=
14351438
k8s.io/apiextensions-apiserver v0.20.1/go.mod h1:ntnrZV+6a3dB504qwC5PN/Yg9PBiDNt1EVqbW2kORVk=
1439+
k8s.io/apiextensions-apiserver v0.31.0 h1:fZgCVhGwsclj3qCw1buVXCV6khjRzKC5eCFt24kyLSk=
1440+
k8s.io/apiextensions-apiserver v0.31.0/go.mod h1:b9aMDEYaEe5sdK+1T0KU78ApR/5ZVp4i56VacZYEHxk=
14361441
k8s.io/apimachinery v0.0.0-20190404173353-6a84e37a896d/go.mod h1:ccL7Eh7zubPUSh9A3USN90/OzHNSVN6zxzde07TDCL0=
14371442
k8s.io/apimachinery v0.18.3/go.mod h1:OaXp26zu/5J7p0f92ASynJa1pZo06YlV9fG7BoWbCko=
14381443
k8s.io/apimachinery v0.19.0/go.mod h1:DnPGDnARWFvYa3pMHgSxtbZb7gpzzAZ1pTfaUNDVlmA=

‎metrics/internal/collectors/storage-cluster.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ import (
99

1010
v1 "github.com/red-hat-storage/ocs-operator/api/v4/v1"
1111
"github.com/red-hat-storage/ocs-operator/metrics/v4/internal/options"
12+
"github.com/red-hat-storage/ocs-operator/v4/controllers/util"
1213
)
1314

1415
type StorageClusterCollector struct {
@@ -79,7 +80,7 @@ func getAllStorageClusters(lister StorageClusterLister) []*v1.StorageCluster {
7980
func (c *StorageClusterCollector) collectKMSConnectionStatuses(ch chan<- prometheus.Metric, storageClusters []*v1.StorageCluster) {
8081
for _, storageCluster := range storageClusters {
8182
v := 2
82-
if storageCluster.Spec.Encryption.Enable || storageCluster.Spec.Encryption.ClusterWide {
83+
if util.IsClusterOrDeviceSetEncrypted(storageCluster) {
8384
v = 0
8485
if storageCluster.Status.KMSServerConnection.KMSServerConnectionError != "" {
8586
v = 1

‎metrics/vendor/github.com/evanphx/json-patch/v5/LICENSE

Lines changed: 25 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎metrics/vendor/github.com/evanphx/json-patch/v5/errors.go

Lines changed: 38 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)