OpenStack S3 Swift Backup bucket

Заметка про создание зашифрованного bucket

Зашифрованный это не значит что нужен ключ локально, шифрование идет на стороне сервера, прозрачно. Но добраться до данных имея доступ только к ceph но не к Barbican не выйдет

Endpoints

openstack endpoint list
+----------------------------------+-----------+----------------+----------------+---------+-----------+---------------------------------------------------------------------------------------+
| ID                               | Region    | Service Name   | Service Type   | Enabled | Interface | URL                                                                                   |
+----------------------------------+-----------+----------------+----------------+---------+-----------+---------------------------------------------------------------------------------------+
| 0592463cc2234adfb59b55aa9f1461f8 | RegionOne | tungstenfabric | sdn            | True    | public    | https://tf-config-api.os.home                                                         |
| 5c60fbe89a7f47a59b00ed6d99a04b00 | RegionOne | barbican       | key-manager    | True    | public    | https://barbican.os.home/                                                             |
...

export TARGET_BARBICAN_ENDPOINT="https://barbican.<REGION>.prod.com"
export TARGET_RGW_ENDPOINT="https://rgw-store.<REGION>.prod.com"
export KUBECONFIG=<MOSK kubeconfig>

Log into Keystone client pod

kubectl exec -it -n openstack deploy/keystone-client -c keystone-client -it -- bash

Create KMS secret in Barbican and record the UUID:

openstack secret order create --name ceph_rgw_lon_stg_ostack_backup_key --algorithm aes --mode ctr --bit-length 256 --payload-content-type=application/octet-stream key

Verify the command

openstack secret order get https://${TARGET_BARBICAN_ENDPOINT}/v1/orders/<UUID>

Record the ID of ceph-rgw service user

openstack user list --domain service  | grep ceph-rgw

Pick user which is added to ceph.conf on rgw pod

kubectl -n rook-ceph exec -ti rook-ceph-rgw-rgw-store-a-66b9d96b4f-2mn7l -- grep rgw_keystone_admin_user /etc/ceph/ceph.conf

Assign created secret on RGW service user:

openstack acl user add --user <ID> https://${TARGET_BARBICAN_ENDPOINT}/v1/secrets/<UUID>

Verify project of <ceph_user_id> openstack user show <ceph_user_id> -c default_project_id

Create EC2 credentials openstack ec2 credentials create --user <ceph_user_id> --project <project_id_from_above> Obtain EC2 credentials for the required user and record the IDs/UUIDs:

openstack ec2 credentials list --user <ceph_user_id> --user-domain service

MOSK Source cloud configuration

export KUBECONFIG=<MOSK kubeconfig> export OSDPL_NAME=<CLOUD>-openstack

Edit OSDPL

spec:
  features:
    database:                                           
      backup:                                           
        enabled: true                                   
        schedule_time: "0 0 * * *"                      
        sync_remote:                                    
          enabled: true                                 
          remotes:                                      
            ceph_mariadb:                               
              path: "custom-openstack-db-encrypted-remote-backups/lon-dev1"                
              conf:                                     
                type: s3                                
                provider: Ceph
                acl: private                          
                endpoint: https://rgw-store.eu-ams-pc2.ams30.prod.booking.com      
                access_key_id: "<access_key_id>"           
                secret_access_key: "secret_access_key"
                server_side_encryption: aws:kms
                sse_kms_key_id: <barbican_secret_id>

kubectl -n openstack create job --from cronjob/mariadb-phy-backup mariadb-backup-manual01