Chapter 13. Creating a Ceph key for external access Warning The content for this feature is available in this release as a Documentation Preview , and therefore is not fully verified by Red Hat. Use it only for testing, and do not use in a production environment. External access to Ceph storage is access to Ceph from any site that is not local. Ceph storage at the cental location is external for edge (DCN) sites, just as Ceph storage at the edge is external for the central location. When you deploy the central or DCN sites with Ceph storage, you have the option of using the default openstack keyring for both local and external access. Altenatively, you can create a separate key for access by non-local sites. If you decide to use additional Ceph keys for access to your external sites, each key must have the same name. The key name is external in the examples that follow. If you use a separate key for access by non-local sites, you have the additional security benefit of being able to revoke and re-issue the external key in response to a security event without interrupting local access. However, using a separate key for external access will result in the loss of access to some features, such as cross availability zone backups and offline volume migration. You must balance the needs of your security posture against the desired feature set. By default, the keys for the central and all DCN sites will be shared. 13.1. Creating a Ceph key for external access Complete the following steps to create an external key for non-local access. Process Create a Ceph key for external access. This key is sensitive. You can generate the key using the following: In the directory of the stack you are deploying, create a ceph_keys.yaml environment file with contents like the following, using the output from the command for the key: Include the ceph_keys.yaml environment file in the deployment of the site. For example, to deploy the central site with with the ceph_keys.yaml environment file, run a command like the following: 13.2. Using external Ceph keys You can only use keys that have already been deployed. For information on deploying a site with an external key, see Section 13.1, "Creating a Ceph key for external access" . This should be done for both central and edge sites. When you deploy an edge site that will use an external key provided by central, complete the following: Create dcn_ceph_external.yaml environment file for the edge site. You must include the cephx-key-client-name option to specify the deployed key to include. Include the dcn_ceph_external.yaml file so that the edge site can access the Ceph cluster at the central site. Include the ceph_keys.yaml file to deploy an external key for the Ceph cluster at the edge site. When you update the central location after deploying your edge sites, ensure the central location to use the dcn external keys: Ensure that the CephClientUserName parameter matches the key being exported. If you are using the name external as shown in these examples, create glance_update.yaml to be similar to the following: Use the openstack overcloud export ceph command to include the external keys for DCN edge access from the central location. To do this you must provide a a comma-delimited list of stacks for the --stack argument, and include the cephx-key-client-name option: Redeploy the central site using the original templates and include the newly created dcn_ceph_external.yaml and glance_update.yaml files.

Commands:
python3 -c 'import os,struct,time,base64; key = os.urandom(16) ; header = struct.pack("<hiih", 1, int(time.time()), 0, len(key)) ; print(base64.b64encode(header + key).decode())'
parameter_defaults: CephExtraKeys: - name: "client.external" caps: mgr: "allow *" mon: "profile rbd" osd: "profile rbd pool=vms, profile rbd pool=volumes, profile rbd pool=images" key: "AQD29WteAAAAABAAphgOjFD7nyjdYe8Lz0mQ5Q==" mode: "0600"
overcloud deploy --stack central --templates /usr/share/openstack-tripleo-heat-templates/ .... -e ~/central/ceph_keys.yaml
sudo -E openstack overcloud export ceph --stack central --cephx-key-client-name external --output-file ~/dcn-common/dcn_ceph_external.yaml
parameter_defaults: GlanceEnabledImportMethods: web-download,copy-image GlanceBackend: rbd GlanceStoreDescription: 'central rbd glance store' CephClusterName: central GlanceBackendID: central GlanceMultistoreConfig: dcn0: GlanceBackend: rbd GlanceStoreDescription: 'dcn0 rbd glance store' CephClientUserName: 'external' CephClusterName: dcn0 GlanceBackendID: dcn0 dcn1: GlanceBackend: rbd GlanceStoreDescription: 'dcn1 rbd glance store' CephClientUserName: 'external' CephClusterName: dcn1 GlanceBackendID: dcn1
sudo -E openstack overcloud export ceph --stack dcn0,dcn1,dcn2 --cephx-key-client-name external --output-file ~/central/dcn_ceph_external.yaml
openstack overcloud deploy --stack central --templates /usr/share/openstack-tripleo-heat-templates/ -r ~/central/central_roles.yaml -e /usr/share/openstack-tripleo-heat-templates/environments/cephadm/cephadm.yaml -e /usr/share/openstack-tripleo-heat-templates/environments/nova-az-config.yaml -e ~/central/central-images-env.yaml -e ~/central/role-counts.yaml -e ~/central/site-name.yaml -e ~/central/ceph.yaml -e ~/central/ceph_keys.yaml -e ~/central/glance.yaml -e ~/central/dcn_ceph_external.yaml