diff --git a/doc/source/configuration/cephadm.rst b/doc/source/configuration/cephadm.rst index 09dcd2075b..ed4ba86874 100644 --- a/doc/source/configuration/cephadm.rst +++ b/doc/source/configuration/cephadm.rst @@ -510,6 +510,102 @@ RGWs to use the Kolla-deployed haproxy. Set the following in Kolla enable_ceph_rgw_loadbalancer: false + +SSE KMS +~~~~~~~ + +SSE KMS (Server-Side Encryption with Key Management Service) allows RADOS +Gateway to encrypt object data at rest while keeping encryption keys managed +outside Ceph in a dedicated KMS backend. When enabled, data is encrypted and +decrypted transparently by RGW during write and read operations. + +SSE KMS should be implemented with the use of OpenStack Barbican. Steps for +implementing are as follows; + +Create a dedicated project for RGW and Barbican integration. + +.. code:: bash + + (openstack) $ openstack project create --domain default rgwcrypt + +Create a dedicated user for RGW to use when interacting with Barbican. + +.. code:: bash + + (openstack) $ PASSWORD=$(openssl rand -base64 24); openstack user create --domain default --project rgwcrypt --password "$PASSWORD" rgwcrypt && echo "Password: $PASSWORD" + +Make sure to store the password in `secrets.yml` as `ceph_rgw_rgwcrypt_password` + +Provide rgwcrypt user the appropriate roles within the rgwcrypt project + +.. code:: bash + + (openstack) $ openstack role add --user rgwcrypt --project rgwcrypt member + (openstack) $ openstack role add --user rgwcrypt --project rgwcrypt creator + +As the rgwcrypt user create a secret that will act as the symmetric AES-256 key. Make sure to make note of the UUID contained within the secret href. + +.. code:: bash + + (openstack) $ openstack secret store \ + --name rgw-sse-key \ + --payload-content-type application/octet-stream \ + --payload-content-encoding base64 \ + --algorithm aes \ + --bit-length 256 \ + --mode cbc \ + --secret-type symmetric \ + --payload "$(openssl rand -base64 32)" + +In `cephadm.yml` ensure the following is present; + +.. code:: yaml + + # Append the following to cephadm_commands_post: + - "config set client.rgw rgw_barbican_url {{ 'https' if kolla_enable_tls_internal | bool else 'http' }}://{{ kolla_internal_fqdn }}:9311" + - "config set client.rgw rgw_keystone_barbican_domain Default" + - "config set client.rgw rgw_keystone_barbican_project rgwcrypt" + - "config set client.rgw rgw_keystone_barbican_password {{ (lookup('file', kayobe_env_config_path ~ '/kolla/passwords.yml') | from_yaml).ceph_rgw_rgwcrypt_password }}" + - "config set client.rgw rgw_keystone_barbican_user rgwcrypt" + - "config set client.rgw rgw_crypt_s3_kms_backend barbican" + +Either deploy Ceph with `cephadm.yml` playbook or if Ceph and RGW are already deployed then just run `cephadm-commands-post.yml` + +.. code:: bash + + kayobe playbook run $KAYOBE_CONFIG_PATH/ansible/ceph/cephadm.yml + +or + +.. code:: bash + + kayobe playbook run $KAYOBE_CONFIG_PATH/ansible/ceph/cephadm-commands-post.yml + +Make sure to schedule a restart RGW services using `ceph orch restart RGW_SERVICE_NAME` + +Attempt to upload a file using s3cmd with server side encryption requested. + +.. code:: bash + + s3cmd put foo.txt s3://bar --server-side-encryption --server-side-encryption-kms-id=UUID-FROM-SECRET-HREF + +Use `s3cmd info` to check SSE is present + +.. code:: bash + + s3cmd info s3://bar/foo.txt + s3://bar/foo.txt (object): + File size: 14 + Last mod: Fri, 29 May 2026 17:16:33 GMT + MIME type: text/plain + Storage: STANDARD + MD5 sum: 3223203c6b8bf5e61123044f99eb7a8c + SSE: aws:kms + Policy: none + CORS: none + ACL: admin: FULL_CONTROL + x-amz-meta-s3cmd-attrs: atime:1780071502/ctime:1780071462/gid:1000/gname:cloud-user/md5:3223203c6b8bf5e61123044f99eb7a8c/mode:33188/mtime:1780071462/uid:1000/uname:cloud-user + Deployment ========== diff --git a/etc/kayobe/kolla-image-tags.yml b/etc/kayobe/kolla-image-tags.yml index deb49f9284..5175fdc319 100644 --- a/etc/kayobe/kolla-image-tags.yml +++ b/etc/kayobe/kolla-image-tags.yml @@ -7,6 +7,10 @@ kolla_image_tags: rocky-9: 2025.1-rocky-9-20260205T152450 rocky-10: 2025.1-rocky-10-20260423T154048 ubuntu-noble: 2025.1-ubuntu-noble-20260205T152450 + cinder: + rocky-9: 2025.1-rocky-9-20260512T204620 + rocky-10: 2025.1-rocky-10-20260529T102322 + ubuntu-noble: 2025.1-ubuntu-noble-20260515T083354 etcd: rocky-9: 2025.1-rocky-9-20260303T104901 glance: @@ -31,6 +35,10 @@ kolla_image_tags: magnum: rocky-9: 2025.1-rocky-9-20260413T112937 ubuntu-noble: 2025.1-ubuntu-noble-20260413T112937 + manila: + rocky-9: 2025.1-rocky-9-20260511T100757 + rocky-10: 2025.1-rocky-10-20260529T102322 + ubuntu-noble: 2025.1-ubuntu-noble-20260515T083354 multipathd: rocky-9: 2025.1-rocky-9-20260421T115054 ubuntu-noble: 2025.1-ubuntu-noble-20260421T115054 diff --git a/etc/kayobe/kolla.yml b/etc/kayobe/kolla.yml index fb4b65c427..57a01ca788 100644 --- a/etc/kayobe/kolla.yml +++ b/etc/kayobe/kolla.yml @@ -131,6 +131,10 @@ kolla_sources: type: git location: https://github.com/stackhpc/stackhpc-inspector-plugins.git reference: 1.3.0 + cinder-base: + type: git + location: https://github.com/stackhpc/cinder.git + reference: stackhpc/{{ openstack_release }} horizon-plugin-cloudkitty-dashboard: type: git location: https://github.com/stackhpc/cloudkitty-dashboard.git @@ -145,6 +149,10 @@ kolla_sources: sha256: amd64: 70b2c30a19da4db264dfd68c8a3664e05093a361cefd89572ffb36f8abfa3d09 arm64: 13d03672be289045d2ff00e4e345d61de1c6f21c1257a45955a30e8ae036d8f1 + manila-base: + type: git + location: https://github.com/stackhpc/manila.git + reference: stackhpc/{{ openstack_release }} neutron-base-plugin-networking-generic-switch: type: git location: https://github.com/stackhpc/networking-generic-switch.git diff --git a/releasenotes/notes/add-rgw-sse-kms-docs-7fcccd9dc358a505.yaml b/releasenotes/notes/add-rgw-sse-kms-docs-7fcccd9dc358a505.yaml new file mode 100644 index 0000000000..0ce39645a9 --- /dev/null +++ b/releasenotes/notes/add-rgw-sse-kms-docs-7fcccd9dc358a505.yaml @@ -0,0 +1,4 @@ +--- +features: + - | + Document process for deploying RGW with SSE KMS support diff --git a/releasenotes/notes/vast-images-2025.1-3f81aaf7f5c9188f.yaml b/releasenotes/notes/vast-images-2025.1-3f81aaf7f5c9188f.yaml new file mode 100644 index 0000000000..9e648516cb --- /dev/null +++ b/releasenotes/notes/vast-images-2025.1-3f81aaf7f5c9188f.yaml @@ -0,0 +1,5 @@ +--- +features: + - | + Adds Cinder support for VAST storage backends and Manila support for VAST + multitenancy.