mirrors/ceph-csi
1
0
Fork 0
mirror of https://github.com/ceph/ceph-csi.git synced 2024-12-25 06:20:24 +00:00
Code Issues Packages Projects Releases Wiki Activity
cb09617437
ceph-csi/internal/kms
History
Niels de Vos a05f63d842 util: use vaultNamespace if vaultAuthNamespace is not set 
When a tenant configures `vaultNamespace` in their own ConfigMap, it is
not applied to the Vault configuration, unless `vaultAuthNamespace` is
set as well. This is unexpected, as the `vaultAuthNamespace` usually is
something configured globally, and not per tenant.

The `vaultAuthNamespace` is an advanced option, that is often not needed
to be configured. Only when tenants have to configure their own
`vaultNamespace`, it is possible that they need to use a different
`vaultAuthNamespace`. The default for the `vaultAuthNamespace` is now
the `vaultNamespace` value from the global configuration. Tenants can
still set it to something else in their own ConfigMap if needed.

Note that Hashicorp Vault Namespaces are only functional in the
Enterprise version of the product. Therefor this can not be tested in
the Ceph-CSI e2e with the Open Source version of Vault.

Fixes: https://bugzilla.redhat.com/2050056
Reported-by: Rachael George <rgeorge@redhat.com>
Signed-off-by: Niels de Vos <ndevos@redhat.com>
(cherry picked from commit f6894909d7)
2022-02-08 10:19:57 +00:00
..
aws_metadata_test.go cleanup: move KMS functionality into its own package 2021-08-30 16:31:40 +00:00
aws_metadata.go util: NewK8sClient() should not panic on non-Kubernetes clusters 2021-09-02 11:22:14 +00:00
keyprotect_test.go rbd: add kms unit test for key protect server 2021-12-21 17:09:50 +00:00
keyprotect.go rbd: add AAD(additionalAuthData) while unwrapping the DEK 2022-02-08 07:41:55 +00:00
kms_test.go cleanup: move KMS functionality into its own package 2021-08-30 16:31:40 +00:00
kms.go util: NewK8sClient() should not panic on non-Kubernetes clusters 2021-09-02 11:22:14 +00:00
secretskms_test.go cleanup: move KMS functionality into its own package 2021-08-30 16:31:40 +00:00
secretskms.go util: NewK8sClient() should not panic on non-Kubernetes clusters 2021-09-02 11:22:14 +00:00
vault_sa_test.go cleanup: move KMS functionality into its own package 2021-08-30 16:31:40 +00:00
vault_sa.go util: NewK8sClient() should not panic on non-Kubernetes clusters 2021-09-02 11:22:14 +00:00
vault_test.go cleanup: move KMS functionality into its own package 2021-08-30 16:31:40 +00:00
vault_tokens_test.go util: use vaultNamespace if vaultAuthNamespace is not set 2022-02-08 10:19:57 +00:00
vault_tokens.go util: set defaults for Vault config before converting 2021-10-28 14:41:53 +00:00
vault.go util: use vaultNamespace if vaultAuthNamespace is not set 2022-02-08 10:19:57 +00:00