From a41832eb429bdd2a3b84c484be29bd0a33c9a6d4 Mon Sep 17 00:00:00 2001 From: Andrea Baglioni Date: Thu, 24 Oct 2019 10:14:54 +0100 Subject: [PATCH] rgw: Add support to Vault's Transit Secrets Engine in SSE-KMS * refactor rgw_kms.cc to support extension to multiple secret engines. * introduced support to Vault Namesapces * added support for Vault Agent Signed-off-by: Andrea Baglioni Signed-off-by: Sergio de Carvalho --- doc/radosgw/config-ref.rst | 99 ++++---- doc/radosgw/vault.rst | 22 +- src/common/legacy_config_opts.h | 16 +- src/common/options.cc | 26 ++- src/rgw/rgw_kms.cc | 387 ++++++++++++++++++++++---------- src/rgw/rgw_kms.h | 26 +++ src/test/rgw/test_rgw_kms.cc | 153 +++++++++++-- src/vstart.sh | 15 +- 8 files changed, 537 insertions(+), 207 deletions(-) diff --git a/doc/radosgw/config-ref.rst b/doc/radosgw/config-ref.rst index c3f17d62824a9..5849047be633b 100644 --- a/doc/radosgw/config-ref.rst +++ b/doc/radosgw/config-ref.rst @@ -55,14 +55,14 @@ instances or all radosgw-admin commands can be put into the ``[global]`` or the :Description: The number of entries in the Ceph Object Gateway cache. :Type: Integer :Default: ``10000`` - + ``rgw socket path`` -:Description: The socket path for the domain socket. ``FastCgiExternalServer`` - uses this socket. If you do not specify a socket path, Ceph - Object Gateway will not run as an external server. The path you - specify here must be the same as the path specified in the +:Description: The socket path for the domain socket. ``FastCgiExternalServer`` + uses this socket. If you do not specify a socket path, Ceph + Object Gateway will not run as an external server. The path you + specify here must be the same as the path specified in the ``rgw.conf`` file. :Type: String @@ -76,7 +76,7 @@ instances or all radosgw-admin commands can be put into the ``[global]`` or the ``rgw host`` -:Description: The host for the Ceph Object Gateway instance. Can be an IP +:Description: The host for the Ceph Object Gateway instance. Can be an IP address or a hostname. :Type: String @@ -85,9 +85,9 @@ instances or all radosgw-admin commands can be put into the ``[global]`` or the ``rgw port`` -:Description: Port the instance listens for requests. If not specified, +:Description: Port the instance listens for requests. If not specified, Ceph Object Gateway runs external FastCGI. - + :Type: String :Default: None @@ -95,9 +95,9 @@ instances or all radosgw-admin commands can be put into the ``[global]`` or the ``rgw dns name`` :Description: The DNS name of the served domain. See also the ``hostnames`` setting within regions. -:Type: String +:Type: String :Default: None - + ``rgw script uri`` @@ -126,8 +126,8 @@ instances or all radosgw-admin commands can be put into the ``[global]`` or the ``rgw remote addr param`` -:Description: The remote address parameter. For example, the HTTP field - containing the remote address, or the ``X-Forwarded-For`` +:Description: The remote address parameter. For example, the HTTP field + containing the remote address, or the ``X-Forwarded-For`` address if a reverse proxy is operational. :Type: String @@ -135,25 +135,25 @@ instances or all radosgw-admin commands can be put into the ``[global]`` or the ``rgw op thread timeout`` - + :Description: The timeout in seconds for open threads. :Type: Integer :Default: 600 - + ``rgw op thread suicide timeout`` - -:Description: The time ``timeout`` in seconds before a Ceph Object Gateway + +:Description: The time ``timeout`` in seconds before a Ceph Object Gateway process dies. Disabled if set to ``0``. -:Type: Integer +:Type: Integer :Default: ``0`` ``rgw thread pool size`` :Description: The size of the thread pool. -:Type: Integer +:Type: Integer :Default: 100 threads. @@ -168,7 +168,7 @@ instances or all radosgw-admin commands can be put into the ``[global]`` or the ``rgw init timeout`` -:Description: The number of seconds before Ceph Object Gateway gives up on +:Description: The number of seconds before Ceph Object Gateway gives up on initialization. :Type: Integer @@ -177,7 +177,7 @@ instances or all radosgw-admin commands can be put into the ``[global]`` or the ``rgw mime types file`` -:Description: The path and location of the MIME types. Used for Swift +:Description: The path and location of the MIME types. Used for Swift auto-detection of object types. :Type: String @@ -186,7 +186,7 @@ instances or all radosgw-admin commands can be put into the ``[global]`` or the ``rgw gc max objs`` -:Description: The maximum number of objects that may be handled by +:Description: The maximum number of objects that may be handled by garbage collection in one garbage collection processing cycle. :Type: Integer @@ -195,16 +195,16 @@ instances or all radosgw-admin commands can be put into the ``[global]`` or the ``rgw gc obj min wait`` -:Description: The minimum wait time before the object may be removed +:Description: The minimum wait time before the object may be removed and handled by garbage collection processing. - + :Type: Integer :Default: ``2 * 3600`` ``rgw gc processor max time`` -:Description: The maximum time between the beginning of two consecutive garbage +:Description: The maximum time between the beginning of two consecutive garbage collection processing cycles. :Type: Integer @@ -227,7 +227,7 @@ instances or all radosgw-admin commands can be put into the ``[global]`` or the ``rgw resolve cname`` -:Description: Whether ``rgw`` should use DNS CNAME record of the request +:Description: Whether ``rgw`` should use DNS CNAME record of the request hostname field (if hostname is not equal to ``rgw dns name``). :Type: Boolean @@ -258,7 +258,7 @@ instances or all radosgw-admin commands can be put into the ``[global]`` or the ``rgw exit timeout secs`` -:Description: Number of seconds to wait for a process before exiting +:Description: Number of seconds to wait for a process before exiting unconditionally. :Type: Integer @@ -280,7 +280,7 @@ instances or all radosgw-admin commands can be put into the ``[global]`` or the :Type: Integer :Default: ``4 << 20`` - + ``rgw relaxed s3 bucket names`` :Description: Enables relaxed S3 bucket names rules for US region buckets. @@ -312,7 +312,7 @@ instances or all radosgw-admin commands can be put into the ``[global]`` or the ``rgw curl wait timeout ms`` -:Description: The timeout in milliseconds for certain ``curl`` calls. +:Description: The timeout in milliseconds for certain ``curl`` calls. :Type: Integer :Default: ``1000`` @@ -327,7 +327,7 @@ instances or all radosgw-admin commands can be put into the ``[global]`` or the ``rgw copy obj progress every bytes`` :Description: The minimum bytes between copy progress output. -:Type: Integer +:Type: Integer :Default: ``1024 * 1024`` @@ -518,8 +518,8 @@ Swift Settings :Description: Enforces the Swift Access Control List (ACL) settings. :Type: Boolean :Default: ``true`` - - + + ``rgw swift token expiration`` :Description: The time in seconds for expiring a Swift token. @@ -532,7 +532,7 @@ Swift Settings :Description: The URL for the Ceph Object Gateway Swift API. :Type: String :Default: None - + ``rgw swift url prefix`` @@ -565,7 +565,7 @@ Swift Settings ``rgw swift auth url`` -:Description: Default URL for verifying v1 auth tokens (if not using internal +:Description: Default URL for verifying v1 auth tokens (if not using internal Swift auth). :Type: String @@ -619,7 +619,7 @@ Swift Settings Those containers cannot be versioned by the S3 object versioning mechanism. - A slightly different attribute, ``X-History-Location``, which is also understood by + A slightly different attribute, ``X-History-Location``, which is also understood by `OpenStack Swift `_ for handling ``DELETE`` operations, is currently not supported. :Type: Boolean @@ -644,7 +644,7 @@ Logging Settings ``rgw log nonexistent bucket`` -:Description: Enables Ceph Object Gateway to log a request for a non-existent +:Description: Enables Ceph Object Gateway to log a request for a non-existent bucket. :Type: Boolean @@ -653,7 +653,7 @@ Logging Settings ``rgw log object name`` -:Description: The logging format for an object name. See manpage +:Description: The logging format for an object name. See manpage :manpage:`date` for details about format specifiers. :Type: Date @@ -662,7 +662,7 @@ Logging Settings ``rgw log object name utc`` -:Description: Whether a logged object name includes a UTC time. +:Description: Whether a logged object name includes a UTC time. If ``false``, it uses the local time. :Type: Boolean @@ -678,7 +678,7 @@ Logging Settings ``rgw usage max user shards`` -:Description: The maximum number of shards used for a single user's +:Description: The maximum number of shards used for a single user's usage logging. :Type: Integer @@ -701,7 +701,7 @@ Logging Settings ``rgw ops log rados`` -:Description: Whether the operations log should be written to the +:Description: Whether the operations log should be written to the Ceph Storage Cluster backend. :Type: Boolean @@ -726,7 +726,7 @@ Logging Settings ``rgw usage log flush threshold`` -:Description: The number of dirty merged entries in the usage log before +:Description: The number of dirty merged entries in the usage log before flushing synchronously. :Type: Integer @@ -753,7 +753,7 @@ Logging Settings ``rgw intent log object name`` -:Description: The logging format for the intent log object name. See manpage +:Description: The logging format for the intent log object name. See manpage :manpage:`date` for details about format specifiers. :Type: Date @@ -762,7 +762,7 @@ Logging Settings ``rgw intent log object name utc`` -:Description: Whether the intent log object name includes a UTC time. +:Description: Whether the intent log object name includes a UTC time. If ``false``, it uses the local time. :Type: Boolean @@ -980,6 +980,21 @@ HashiCorp Vault Settings :Type: String :Default: None +``rgw crypt vault secret engine`` + +:Description: Vault Secret Engine to be used to retrieve encryption keys: choose + between kv-v2, transit. +:Type: String +:Default: None + +``rgw crypt vault namespace`` + +:Description: If set, Vault Namespace provides tenant isolation for teams and individuals + on the same Vault Enterprise instance, e.g. ``acme/tenant1`` +:Type: String +:Default: None + + QoS settings ------------ diff --git a/doc/radosgw/vault.rst b/doc/radosgw/vault.rst index 6bd1a9081f764..d61b3d3a129a8 100644 --- a/doc/radosgw/vault.rst +++ b/doc/radosgw/vault.rst @@ -14,16 +14,25 @@ Configure Vault =============== Vault provides several Secret Engines, which can store, generate, and encrypt -data. Currently, the Object Gateway supports the `KV Secrets engine`_ version 2 -only. To enable the KV engine version 2 in Vault, use the Vault command line +data. Currently, the Object Gateway supports `KV Secrets engine`_ version 2 +an `KV Transit engine`_. + +Basic Vault Configuration +------------------------- +To enable the KV engine version 2 in Vault, use the Vault command line tool:: vault secrets enable kv-v2 -Vault also provides several authentication mechanisms. Currently, the Object -Gateway supports the `token authentication method`_ only. When authenticating -using the token method, a token must be obtained for the Gateway and saved in a -file as plain-text. +Analogously for the Transit Engine:: + vault secrets enable transit + +Vault also provides several authentication mechanisms. +To simplify user's interaction with Vault, the Object Gateway supports +two modes: `token authentication method`_ and `agent authentication method`_. + +When authenticating using the token method, a token must be obtained +for the Gateway and saved in a file as plain-text. For security reasons, the Object Gateway should be given a Vault token with a restricted policy that allows it to fetch secrets only. Such a policy can be @@ -57,6 +66,7 @@ in a file as plain-text. The path to this file must then be provided in the Gateway configuration file (see section below). For security reasons, ensure the file is readable by the Object Gateway only. + Configure the Ceph Object Gateway ================================= diff --git a/src/common/legacy_config_opts.h b/src/common/legacy_config_opts.h index 6dfeddc8f527d..041cd576656d5 100644 --- a/src/common/legacy_config_opts.h +++ b/src/common/legacy_config_opts.h @@ -168,7 +168,7 @@ OPTION(ms_async_rdma_type, OPT_STR) OPTION(ms_max_accept_failures, OPT_INT) OPTION(ms_dpdk_port_id, OPT_INT) -SAFE_OPTION(ms_dpdk_coremask, OPT_STR) // it is modified in unittest so that use SAFE_OPTION to declare +SAFE_OPTION(ms_dpdk_coremask, OPT_STR) // it is modified in unittest so that use SAFE_OPTION to declare OPTION(ms_dpdk_memory_channel, OPT_STR) OPTION(ms_dpdk_hugepages, OPT_STR) OPTION(ms_dpdk_pmd, OPT_STR) @@ -545,7 +545,7 @@ OPTION(osd_data, OPT_STR) OPTION(osd_journal, OPT_STR) OPTION(osd_journal_size, OPT_INT) // in mb OPTION(osd_journal_flush_on_shutdown, OPT_BOOL) // Flush journal to data store on shutdown -// flags for specific control purpose during osd mount() process. +// flags for specific control purpose during osd mount() process. // e.g., can be 1 to skip over replaying journal // or 2 to skip over mounting omap or 3 to skip over both. // This might be helpful in case the journal is totally corrupted @@ -827,7 +827,7 @@ OPTION(osd_snap_trim_cost, OPT_U32) // set default cost equal to 1MB io OPTION(osd_scrub_priority, OPT_U32) // set default cost equal to 50MB io -OPTION(osd_scrub_cost, OPT_U32) +OPTION(osd_scrub_cost, OPT_U32) // set requested scrub priority higher than scrub priority to make the // requested scrubs jump the queue of scheduled scrubs OPTION(osd_requested_scrub_priority, OPT_U32) @@ -967,15 +967,15 @@ OPTION(bluestore_compression_max_blob_size_ssd, OPT_U32) /* * Specifies minimum expected amount of saved allocation units * per single blob to enable compressed blobs garbage collection - * + * */ -OPTION(bluestore_gc_enable_blob_threshold, OPT_INT) +OPTION(bluestore_gc_enable_blob_threshold, OPT_INT) /* * Specifies minimum expected amount of saved allocation units * per all blobsb to enable compressed blobs garbage collection - * + * */ -OPTION(bluestore_gc_enable_total_threshold, OPT_INT) +OPTION(bluestore_gc_enable_total_threshold, OPT_INT) OPTION(bluestore_max_blob_size, OPT_U32) OPTION(bluestore_max_blob_size_hdd, OPT_U32) @@ -1503,6 +1503,8 @@ OPTION(rgw_crypt_vault_auth, OPT_STR) // Type of authentication method to be use OPTION(rgw_crypt_vault_token_file, OPT_STR) // Path to the token file for Vault authentication OPTION(rgw_crypt_vault_addr, OPT_STR) // Vault server base address OPTION(rgw_crypt_vault_prefix, OPT_STR) // Optional URL prefix to Vault secret path +OPTION(rgw_crypt_vault_secret_engine, OPT_STR) // kv, transit or other supported secret engines +OPTION(rgw_crypt_vault_namespace, OPT_STR) // Vault Namespace (only availabe in Vault Enterprise Version) OPTION(rgw_crypt_s3_kms_encryption_keys, OPT_STR) // extra keys that may be used for aws:kms // defined as map "key1=YmluCmJvb3N0CmJvb3N0LQ== key2=b3V0CnNyYwpUZXN0aW5nCg==" diff --git a/src/common/options.cc b/src/common/options.cc index 67bea89ef3e36..7ac9ad708dd8a 100644 --- a/src/common/options.cc +++ b/src/common/options.cc @@ -6549,7 +6549,7 @@ std::vector