Create Ceph Object Storage users¶

Warning

This procedure is valid for MOSK clusters that use the MiraCeph custom resource (CR), which is available since MOSK 25.2 to replace the unsupported KaaSCephCluster resource. And MiraCeph will be automatically migrated to CephDeployment in MOSK 26.1. For details, see Deprecation Notes: KaaSCephCluster API on management clusters.

For the equivalent procedure with the unsupported KaaSCephCluster CR, refer to the following section:

Create Ceph Object Storage users

Ceph Object Storage users can create Amazon S3 buckets and bucket policies that grant access to other users.

This section describes how to create two Ceph Object Storage users and configure their S3 credentials.

To create and configure Ceph Object Storage users:

Open the MiraCeph CR:

kubectl -n ceph-lcm-mirantis edit miraceph

In the objectStorage.rgw section, add new Ceph Object Storage users.

Caution

For user name, apply the UUID format with no capital letters.

For example:

spec:
  objectStorage:
    rgw:
      objectUsers:
      - name: user-b
        displayName: user-a
        capabilities:
          bucket: "*"
          user: read
      - name: user-t
        displayName: user-t
        capabilities:
          bucket: "*"
          user: read

Verify that rgwUserSecrets are created for both users:

kubectl -n ceph-lcm-mirantis get mcsecret -o yaml

Example of a positive system response:

status:
  secretInfo:
    rgwUserSecrets:
    - name: user-a
      secretName: <user-aCredSecretName>
      secretNamespace: <user-aCredSecretNamespace>
    - name: user-t
      secretName: <user-tCredSecretName>
      secretNamespace: <user-tCredSecretNamespace>

Obtain S3 user credentials from the cluster secrets. Specify an access key and a secret key for both users:

kubectl -n <user-aCredSecretNamespace> get secret <user-aCredSecretName> -o jsonpath='{.data.AccessKey}' | base64 -d
kubectl -n <user-aCredSecretNamespace> get secret <user-aCredSecretName> -o jsonpath='{.data.SecretKey}' | base64 -d
kubectl -n <user-tCredSecretNamespace> get secret <user-tCredSecretName> -o jsonpath='{.data.AccessKey}' | base64 -d
kubectl -n <user-tCredSecretNamespace> get secret <user-tCredSecretName> -o jsonpath='{.data.SecretKey}' | base64 -d

Substitute the corresponding secretNamespace and secretName for both users.

Obtain Ceph Object Storage public endpoint from the MiraCephHealth status:

kubectl -n ceph-lcm-mirantis get mchealth -o yaml | grep PublicEndpoint

Example of a positive system response:

objectStorePublicEndpoint: https://object-storage.mirantis.example.com

Obtain the CA certificate to use an HTTPS endpoint:

kubectl -n rook-ceph get secret $(kubectl -n rook-ceph get ingress -o jsonpath='{.items[0].spec.tls[0].secretName}{"\n"}') -o jsonpath='{.data.ca\.crt}' | base64 -d; echo

Save the output to ca.crt.

No results

An error occurred

Create Ceph Object Storage users¶