Bug 1637529

Summary:	[RFE] Avoid requirement to put Keystone secrets (admin token or admin password) in plain text/unencrypted in Ceph Object Gateway configuration
Product:	[Red Hat Storage] Red Hat Ceph Storage	Reporter:	Karun Josy <kjosy>
Component:	RGW	Assignee:	Matt Benjamin (redhat) <mbenjamin>
Status:	CLOSED ERRATA	QA Contact:	Tejas <tchandra>
Severity:	urgent	Docs Contact:	Bara Ancincova <bancinco>
Priority:	urgent
Version:	3.0	CC:	aguetta, cbodley, ceph-eng-bugs, fsoppels, hnallurv, kbader, kjosy, mbenjamin, pasik, sweil, tchandra, tserlin
Target Milestone:	rc	Keywords:	FutureFeature
Target Release:	3.2
Hardware:	x86_64
OS:	Unspecified
Whiteboard:
Fixed In Version:	RHEL: ceph-12.2.8-32.el7cp Ubuntu: ceph_12.2.8-31redhat1	Doc Type:	Bug Fix
Doc Text:	.The Keystone credentials were moved to an external file When using the Keystone identity service to authenticate a Ceph Object Gateway user, the Keystone credentials were set as plain text in the Ceph configuration file. With this update, the Keystone credentials are configured in an external file that only the Ceph user can read.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-01-03 19:02:01 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1629656

Description Karun Josy 2018-10-09 12:33:15 UTC

Description of problem:

When using Keystone to Authenticate Ceph Object Gateway User,
while configuring civetweb we are giving the rgw_keystone_admin_password as plain text in ceph.conf as mentioned in our doc[1].

The documents says there are  2 ways to  configure civetweb users; as plain text user/password or token based. But Red Hat recommends disabling authentication by admin token in production environments. 
Will it be possible to set up a secure authentication process, avoiding the unencrypted password in the configuration file ceph.conf, like encrypted password? 

[1] https://access.redhat.com/documentation/en-us/red_hat_ceph_storage/2/html-single/using_keystone_to_authenticate_ceph_object_gateway_users/index

Version-Release number of selected component (if applicable):
3.*

How reproducible:
Always

Comment 26 errata-xmlrpc 2019-01-03 19:02:01 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2019:0020