From 54fef6bca2673383ba18cdea8ca2ac8d68138348 Mon Sep 17 00:00:00 2001 From: Prachi Goel Date: Fri, 10 Jan 2025 17:51:07 +0530 Subject: [PATCH] mgr/dashboard: Add GKLM(KMIP) option to SSE-KMS dropdown Menu in the Dashboard UI Fixes: https://tracker.ceph.com/issues/69490 Signed-off-by: Prachi Goel Changes for GKLM dropdown UI: 1.Added option kmip in KMS dropdown in configuration page RGW 2.Made API dynamic for setting form data for Vault, kmip both for (S3 and KMS) 3.Both Getdata and setdata API for RGW config page is modified --- src/pybind/mgr/dashboard/controllers/rgw.py | 42 +-- .../ceph/rgw/models/rgw-bucket-encryption.ts | 24 +- .../rgw-config-modal.component.html | 274 +++++++++++++----- .../rgw-config-modal.component.ts | 188 ++++++++---- .../rgw-configuration-page.component.ts | 51 ++-- .../src/app/shared/api/rgw-bucket.service.ts | 35 +-- .../models/rgw-encryption-config-keys.ts | 43 +++ src/pybind/mgr/dashboard/model/rgw.py | 100 +++++++ src/pybind/mgr/dashboard/openapi.yaml | 22 +- .../mgr/dashboard/services/ceph_service.py | 250 +++++++--------- 10 files changed, 646 insertions(+), 383 deletions(-) create mode 100644 src/pybind/mgr/dashboard/model/rgw.py diff --git a/src/pybind/mgr/dashboard/controllers/rgw.py b/src/pybind/mgr/dashboard/controllers/rgw.py index d48542a759038..23321a94308b0 100755 --- a/src/pybind/mgr/dashboard/controllers/rgw.py +++ b/src/pybind/mgr/dashboard/controllers/rgw.py @@ -10,6 +10,7 @@ import cherrypy from .. import mgr from ..exceptions import DashboardException +from ..model.rgw import KmipConfig, KmsProviders, VaultConfig from ..rest_client import RequestException from ..security import Permission, Scope from ..services.auth import AuthManager, JwtManager @@ -421,19 +422,9 @@ class RgwBucket(RgwRESTController): mfa_token_serial, mfa_token_pin) def _set_encryption(self, bid, encryption_type, key_id, daemon_name, owner): - rgw_client = RgwClient.instance(owner, daemon_name) rgw_client.set_bucket_encryption(bid, key_id, encryption_type) - # pylint: disable=W0613 - def _set_encryption_config(self, encryption_type, kms_provider, auth_method, secret_engine, - secret_path, namespace, address, token, daemon_name, owner, - ssl_cert, client_cert, client_key): - - CephService.set_encryption_config(encryption_type, kms_provider, auth_method, - secret_engine, secret_path, namespace, address, - token, daemon_name, ssl_cert, client_cert, client_key) - def _get_encryption(self, bucket_name, daemon_name, owner): rgw_client = RgwClient.instance(owner, daemon_name) return rgw_client.get_bucket_encryption(bucket_name) @@ -681,15 +672,27 @@ class RgwBucket(RgwRESTController): }, json_response=False) @RESTController.Collection(method='PUT', path='/setEncryptionConfig') - @allow_empty_body - def set_encryption_config(self, encryption_type=None, kms_provider=None, auth_method=None, - secret_engine=None, secret_path='', namespace='', address=None, - token=None, daemon_name=None, owner=None, ssl_cert=None, - client_cert=None, client_key=None): - return self._set_encryption_config(encryption_type, kms_provider, auth_method, - secret_engine, secret_path, namespace, - address, token, daemon_name, owner, ssl_cert, - client_cert, client_key) + def set_encryption_config(self, encryption_type: Optional[str] = None, + kms_provider: Optional[str] = None, + config: Optional[Union[VaultConfig, KmipConfig]] = None, + daemon_name: Optional[str] = None): + if encryption_type is None or daemon_name is None: + raise ValueError("Both 'encryption_type' and 'daemon_name' must be provided.") + + if kms_provider == KmsProviders.VAULT.value: + config = config if config else VaultConfig( + addr="", auth="", prefix="", secret_engine="" + ) + elif kms_provider == KmsProviders.KMIP.value: + config = config if config else KmipConfig( + addr="" + ) + else: + raise ValueError("Invalid KMS provider specified.") + + return CephService.set_encryption_config( + encryption_type, kms_provider, config, daemon_name + ) @RESTController.Collection(method='GET', path='/getEncryption') @allow_empty_body @@ -703,6 +706,7 @@ class RgwBucket(RgwRESTController): @RESTController.Collection(method='GET', path='/getEncryptionConfig') @allow_empty_body + # pylint: disable=W0613 def get_encryption_config(self, daemon_name=None, owner=None): return CephService.get_encryption_config(daemon_name) diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/models/rgw-bucket-encryption.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/models/rgw-bucket-encryption.ts index 5dd7c51de6b46..af773c1464f1d 100644 --- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/models/rgw-bucket-encryption.ts +++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/models/rgw-bucket-encryption.ts @@ -1,5 +1,6 @@ -enum KmsProviders { - Vault = 'vault' +export enum KMS_PROVIDER { + VAULT = 'vault', + KMIP = 'kmip' } enum AuthMethods { @@ -12,26 +13,19 @@ enum SecretEngines { Transit = 'transit' } -enum sseS3 { - SSE_S3 = 'AES256' -} - -enum sseKms { - SSE_KMS = 'aws:kms' +export enum ENCRYPTION_TYPE { + SSE_S3 = 's3', + SSE_KMS = 'kms' } interface RgwBucketEncryptionModel { - kmsProviders: KmsProviders[]; + kmsProviders: KMS_PROVIDER[]; authMethods: AuthMethods[]; secretEngines: SecretEngines[]; - SSE_S3: sseS3; - SSE_KMS: sseKms; } export const rgwBucketEncryptionModel: RgwBucketEncryptionModel = { - kmsProviders: [KmsProviders.Vault], + kmsProviders: [KMS_PROVIDER.VAULT, KMS_PROVIDER.KMIP], authMethods: [AuthMethods.Token, AuthMethods.Agent], - secretEngines: [SecretEngines.KV, SecretEngines.Transit], - SSE_S3: sseS3.SSE_S3, - SSE_KMS: sseKms.SSE_KMS + secretEngines: [SecretEngines.KV, SecretEngines.Transit] }; diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-config-modal/rgw-config-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-config-modal/rgw-config-modal.component.html index 7205665a7a72e..a88e35b6814ba 100644 --- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-config-modal/rgw-config-modal.component.html +++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-config-modal/rgw-config-modal.component.html @@ -16,12 +16,11 @@ formControlName="encryptionType" id="s3Enabled" type="radio" - name="encryptionType" (change)="checkKmsProviders()" - [attr.disabled]="editing && configForm.getValue('encryptionType') !== 'AES256' ? true : null" - value="AES256"> + [attr.disabled]="editing && configForm.getValue('encryptionType') !== ENCRYPTION_TYPE.SSE_S3 ? true : null" + [value]="ENCRYPTION_TYPE.SSE_S3"> @@ -30,27 +29,26 @@ -
+
+ + Where the encryption keys are stored. + + This field is required. @@ -69,39 +71,45 @@
-
+
- + + + Type of authentication method to be used with Vault + + This field is required.
-
+
- + + Vault Secret Engine to be used to retrieve encryption keys. + + This field is required. @@ -109,18 +117,22 @@
-
+
- + + + Vault secret URL prefix, which can be used to restrict access to a particular subset of the Vault secret space. + + This field is required. @@ -128,109 +140,215 @@
-
+
- + + + Vault Namespace to be used to select your tenant. + +
-
+
-
-
-