Skip to content

smb: add remote control server#64372

Merged
adk3798 merged 31 commits intoceph:mainfrom
phlogistonjohn:jjm-smb-remotectl
Aug 15, 2025
Merged

smb: add remote control server#64372
adk3798 merged 31 commits intoceph:mainfrom
phlogistonjohn:jjm-smb-remotectl

Conversation

@phlogistonjohn
Copy link
Contributor

@phlogistonjohn phlogistonjohn commented Jul 7, 2025

Depends on #64142

Add support for an optional remote-control sidecar server. This server is provided by the sambacc project and creates a gRPC interface that allows systems outside the ceph cluster to get realtime-ish connection information and make changes like disconnecting a client or share.

This server uses mTLS for simple auth{n,z} if a server cert, server key and ca cert are provided. The server can also be deployed in an insecure mode (no TLS) and or non-authenticating mode (no CA Cert). However, these modes are read-only and are mainly just for testing.

To support TLS credentials, a new top-level resource type ceph.smb.tls.credential is added. This type is somewhat similar to the the ceph.smb.join.auth type in behavior. See the updated doc for more information.

Contribution Guidelines

  • To sign and title your commits, please refer to Submitting Patches to Ceph.

  • If you are submitting a fix for a stable branch (e.g. "quincy"), please refer to Submitting Patches to Ceph - Backports for the proper workflow.

  • When filling out the below checklist, you may click boxes directly in the GitHub web UI. When entering or editing the entire PR message in the GitHub web UI editor, you may also select a checklist item by adding an x between the brackets: [x]. Spaces and capitalization matter when checking off items this way.

Checklist

  • Tracker (select at least one)
    • References tracker ticket
    • Very recent bug; references commit where it was introduced
    • New feature (ticket optional)
    • Doc update (no ticket needed)
    • Code cleanup (no ticket needed)
  • Component impact
    • Affects Dashboard, opened tracker ticket
    • Affects Orchestrator, opened tracker ticket
    • No impact that needs to be tracked
  • Documentation (select at least one)
    • Updates relevant documentation
    • No doc update is appropriate
  • Tests (select at least one)
Show available Jenkins commands

@github-actions
Copy link

github-actions bot commented Jul 9, 2025

This pull request can no longer be automatically merged: a rebase is needed and changes have to be manually resolved

@github-actions
Copy link

This pull request can no longer be automatically merged: a rebase is needed and changes have to be manually resolved

@phlogistonjohn phlogistonjohn force-pushed the jjm-smb-remotectl branch 2 times, most recently from e9d6f50 to 0fed13b Compare July 16, 2025 20:29
@phlogistonjohn phlogistonjohn force-pushed the jjm-smb-remotectl branch 2 times, most recently from 837c856 to b719182 Compare July 28, 2025 15:17
@phlogistonjohn phlogistonjohn changed the title [WIP] smb: add remote control server smb: add remote control server Jul 28, 2025
@phlogistonjohn
Copy link
Contributor Author

jenkins test make check

@phlogistonjohn
Copy link
Contributor Author

jenkins test windows

@github-actions
Copy link

This pull request can no longer be automatically merged: a rebase is needed and changes have to be manually resolved

@phlogistonjohn phlogistonjohn marked this pull request as ready for review July 31, 2025 14:32
@phlogistonjohn phlogistonjohn requested review from a team as code owners July 31, 2025 14:32
@phlogistonjohn
Copy link
Contributor Author

jenkins test make check

Use the new tls credential resource and remote control cluster field
to configure the tls creds for the remote control sidecar in the
service spec.

Signed-off-by: John Mulligan <jmulligan@redhat.com>
Update the handler code needed to make tls credential types work
corrently for `ceph smb show` commands.

Signed-off-by: John Mulligan <jmulligan@redhat.com>
Support populating the cert data sent to the cephadm binary using
special `URI:` prefixed strings instead of putting the cert data itself
in the smb service spec. This avoids having an extra copy of the cert
floating around but still matches the behavior of other services where
cephadm writes the certs into files.

In the future we may be able to avoid even putting the data in here as
sambacc can use rados apis - but for simplicity and matching other
services we will send the data this way for now.

Signed-off-by: John Mulligan <jmulligan@redhat.com>
Signed-off-by: John Mulligan <jmulligan@redhat.com>
Signed-off-by: John Mulligan <jmulligan@redhat.com>
Copy link
Contributor

@anoopcs9 anoopcs9 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks OK at a very high level.

It covers the remote control configuration object and the tls credential
resource and source object created to support it and future tls needs.

Signed-off-by: John Mulligan <jmulligan@redhat.com>
When not referring to a code object or field value or module name, try
to spell ID and SMB in all caps everywhere in the document.

Signed-off-by: John Mulligan <jmulligan@redhat.com>
@adk3798
Copy link
Contributor

adk3798 commented Aug 12, 2025

jenkins test make check

2 similar comments
@adk3798
Copy link
Contributor

adk3798 commented Aug 13, 2025

jenkins test make check

@adk3798
Copy link
Contributor

adk3798 commented Aug 13, 2025

jenkins test make check

@anoopcs9
Copy link
Contributor

jenkins test dashboard cephadm

@anoopcs9
Copy link
Contributor

jenkins test make check

1 similar comment
@phlogistonjohn
Copy link
Contributor Author

jenkins test make check

@phlogistonjohn
Copy link
Contributor Author

jenkins test dashboard cephadm

@adk3798
Copy link
Contributor

adk3798 commented Aug 13, 2025

jenkins test make check

@phlogistonjohn
Copy link
Contributor Author

jenkins test dashboard cephadm

2 similar comments
@anoopcs9
Copy link
Contributor

jenkins test dashboard cephadm

@phlogistonjohn
Copy link
Contributor Author

jenkins test dashboard cephadm

@anoopcs9
Copy link
Contributor

@adk3798 Given that ceph dashboard cephadm e2e tests is not listed as Required in the CI checklist, is this good enough to be merged?

@phlogistonjohn
Copy link
Contributor Author

jenkins test dashboard cephadm

@adk3798 adk3798 merged commit 14f033f into ceph:main Aug 15, 2025
13 of 14 checks passed
@phlogistonjohn phlogistonjohn deleted the jjm-smb-remotectl branch August 15, 2025 16:33
@phlogistonjohn phlogistonjohn added the wip-spuiuk-tracking Sachin Prabhu - tracking label Sep 2, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants