From 3a5f899e7a72c46861761062524298923da2a051 Mon Sep 17 00:00:00 2001 From: Adam King Date: Wed, 3 Jul 2024 14:54:47 -0400 Subject: [PATCH] python-common/service_spec: add root_ca_cert to nvmeof spec Also improves the error messaging around when spec/key attributes are missing when enable_auth is set to true Signed-off-by: Adam King (cherry picked from commit 9212914be65fe3adde2108f5a2cfd2587d17c0ff) (cherry picked from commit f7c46fa3adf71631a1cea372841e4d74f09094ed) --- src/cephadm/cephadmlib/daemons/nvmeof.py | 8 +++++++- src/pybind/mgr/cephadm/services/nvmeof.py | 11 ++++++++--- .../templates/services/nvmeof/ceph-nvmeof.conf.j2 | 1 + src/python-common/ceph/deployment/service_spec.py | 13 ++++++++++--- 4 files changed, 26 insertions(+), 7 deletions(-) diff --git a/src/cephadm/cephadmlib/daemons/nvmeof.py b/src/cephadm/cephadmlib/daemons/nvmeof.py index 8c0623448ff03..7e8ab25163628 100644 --- a/src/cephadm/cephadmlib/daemons/nvmeof.py +++ b/src/cephadm/cephadmlib/daemons/nvmeof.py @@ -80,7 +80,13 @@ class CephNvmeof(ContainerDaemonForm): self, data_dir: str, files: Dict[str, str] ) -> Dict[str, str]: mounts = dict() - for fn in ['server_cert', 'server_key', 'client_cert', 'client_key']: + for fn in [ + 'server_cert', + 'server_key', + 'client_cert', + 'client_key', + 'root_ca_cert', + ]: if fn in files: mounts[ os.path.join(data_dir, fn) diff --git a/src/pybind/mgr/cephadm/services/nvmeof.py b/src/pybind/mgr/cephadm/services/nvmeof.py index f6b1c22dba326..1bad7447b0370 100644 --- a/src/pybind/mgr/cephadm/services/nvmeof.py +++ b/src/pybind/mgr/cephadm/services/nvmeof.py @@ -60,15 +60,20 @@ class NvmeofService(CephService): or not spec.client_key or not spec.server_cert or not spec.server_key + or not spec.root_ca_cert ): - self.mgr.log.error(f'enable_auth set for {spec.service_name()} spec, but at ' - 'least one of server/client cert/key fields missing. TLS ' - f'not being set up for {daemon_spec.name()}') + err_msg = 'enable_auth is true but ' + for cert_key_attr in ['server_key', 'server_cert', 'client_key', 'client_cert', 'root_ca_cert']: + if not hasattr(spec, cert_key_attr): + err_msg += f'{cert_key_attr}, ' + err_msg += 'attribute(s) missing from nvmeof spec' + self.mgr.log.error(err_msg) else: daemon_spec.extra_files['server_cert'] = spec.server_cert daemon_spec.extra_files['client_cert'] = spec.client_cert daemon_spec.extra_files['server_key'] = spec.server_key daemon_spec.extra_files['client_key'] = spec.client_key + daemon_spec.extra_files['root_ca_cert'] = spec.root_ca_cert daemon_spec.final_config, daemon_spec.deps = self.generate_config(daemon_spec) daemon_spec.deps = [] diff --git a/src/pybind/mgr/cephadm/templates/services/nvmeof/ceph-nvmeof.conf.j2 b/src/pybind/mgr/cephadm/templates/services/nvmeof/ceph-nvmeof.conf.j2 index 9ef92991affbc..18786f95bbe8d 100644 --- a/src/pybind/mgr/cephadm/templates/services/nvmeof/ceph-nvmeof.conf.j2 +++ b/src/pybind/mgr/cephadm/templates/services/nvmeof/ceph-nvmeof.conf.j2 @@ -45,6 +45,7 @@ server_key = /server.key client_key = /client.key server_cert = /server.cert client_cert = /client.cert +root_ca_cert = /root.ca.cert [spdk] tgt_path = {{ spec.tgt_path }} diff --git a/src/python-common/ceph/deployment/service_spec.py b/src/python-common/ceph/deployment/service_spec.py index b2dd1c79195b2..853a408bbcb50 100644 --- a/src/python-common/ceph/deployment/service_spec.py +++ b/src/python-common/ceph/deployment/service_spec.py @@ -1331,6 +1331,7 @@ class NvmeofServiceSpec(ServiceSpec): server_cert: Optional[str] = None, client_key: Optional[str] = None, client_cert: Optional[str] = None, + root_ca_cert: Optional[str] = None, spdk_path: Optional[str] = None, tgt_path: Optional[str] = None, spdk_timeout: Optional[float] = 60.0, @@ -1415,6 +1416,8 @@ class NvmeofServiceSpec(ServiceSpec): self.client_key = client_key #: ``client_cert`` client certificate self.client_cert = client_cert + #: ``root_ca_cert`` CA cert for server/client certs + self.root_ca_cert = root_ca_cert #: ``spdk_path`` path to SPDK self.spdk_path = spdk_path or '/usr/local/bin/nvmf_tgt' #: ``tgt_path`` nvmeof target path @@ -1469,9 +1472,13 @@ class NvmeofServiceSpec(ServiceSpec): raise SpecValidationError('Cannot add NVMEOF: No Pool specified') if self.enable_auth: - if not all([self.server_key, self.server_cert, self.client_key, self.client_cert]): - raise SpecValidationError( - 'enable_auth is true but client/server certificates are missing') + if not all([self.server_key, self.server_cert, self.client_key, self.client_cert, self.root_ca_cert]): + err_msg = 'enable_auth is true but ' + for cert_key_attr in ['server_key', 'server_cert', 'client_key', 'client_cert', 'root_ca_cert']: + if not hasattr(self, cert_key_attr): + err_msg += f'{cert_key_attr}, ' + err_msg += 'attribute(s) not set in the spec' + raise SpecValidationError(err_msg) if self.transports not in ['tcp']: raise SpecValidationError('Invalid transport. Valid values are tcp') -- 2.39.5