Bug 2079685

Summary: Storageclass creation page with "Enable encryption" is not displaying saved KMS connection details when vaulttenantsa details are available in csi-kms-details config
Product: OpenShift Container Platform Reporter: Amrita Mahapatra <ammahapa>
Component: Console Storage PluginAssignee: Rishabh Bhandari <rbhandar>
Status: CLOSED ERRATA QA Contact: Amrita Mahapatra <ammahapa>
Severity: high Docs Contact:
Priority: unspecified    
Version: 4.10CC: badhikar, gshanmug, jefbrown, madam, mmuench, muagarwa, nberry, nthomas, ocs-bugs, skatiyar
Target Milestone: ---Keywords: PrioBumpQA, Regression, Reopened
Target Release: 4.11.0   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2022-08-10 11:09:16 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2092496    

Description Amrita Mahapatra 2022-04-28 05:45:38 UTC
Description of problem (please be detailed as possible and provide log
snippests):

For OCP 4.10 and ODF 4.10 if details for "encryptionKMSType": "vaulttenantsa" is available  in the csi-kms-connection-details configmap, for eg:

$ oc get cm csi-kms-connection-details -n openshift-storage -o yaml
apiVersion: v1
data:
  vault-tenant-sa-auth: |-
    {
      "encryptionKMSType": "vaulttenantsa",
      "vaultAddress": https://vault.qe.rh-ocs.com:8200",
      "vaultAuthPath": "/v1/auth/ammahapa-k8/login",
      "vaultBackendPath": "ammahapa_ocs3",
      "vaultCAFromSecret": "ocs-kms-ca-secret-dslpu",
      "vaultClientCertFromSecret": "ocs-kms-client-cert-i4t28j",
      "vaultClientCertKeyFromSecret": "ocs-kms-client-key-or3su",
      "tenantSAName": "ceph-csi-vault-sa"
    }
  vault-test: '{"encryptionKMSType":"vaulttokens","kmsServiceName":"vault-test","vaultAddress":"https://vault.qe.rh-ocs.com:8200","vaultBackendPath":"rook","vaultTLSServerName":"","vaultCAFileName":"","vaultClientCertFileName":"","vaultClientCertKeyFileName":"","vaultAuthMethod":"token","tenantTokenName":"ceph-csi-kms-token","vaultNamespace":""}'
  vault-token: '{"encryptionKMSType":"vaulttokens","kmsServiceName":"vault-token","vaultAddress":"https://vault.qe.rh-ocs.com:8200","vaultBackendPath":"ammahapa_ocs3","vaultCAFromSecret":"ocs-kms-ca-secret-dslpu","vaultTLSServerName":"","vaultClientCertFromSecret":"ocs-kms-client-cert-i4t28j","vaultClientCertKeyFromSecret":"ocs-kms-client-key-or3su","vaultCAFileName":"fullchain.pem","vaultClientCertFileName":"cert.pem","vaultClientCertKeyFileName":"privkey.pem","vaultAuthMethod":"token","tenantTokenName":"ceph-csi-kms-token","vaultNamespace":""}'
kind: ConfigMap
metadata:
  creationTimestamp: "2022-04-27T08:07:24Z"
  name: csi-kms-connection-details
  namespace: openshift-storage
  resourceVersion: "247071"
  uid: a9c64f1d-c291-4896-8b3c-35894d906956

in the storage class creation page, on clicking the "Enable Encryption" checkbox with radio button 'Choose existing KMS connection' selected 'Key service' empty drop down displayed.

For OCP 4.11 and ODF 4.11 for similar scenario, in the storage class creation page, after clicking "Enable Encryption" checkbox with radio button 'Choose existing KMS connection' selected 'Key service' drop down displayed with only added vaulttoken connection option.

Version of all relevant components (if applicable):
===================================================
For issue faced in OCP and ODF 4.10---
OCP: 4.10.0-0.nightly-2022-04-26-204343
ODF full_version: 4.10.1-2

For issue faced in OCP and ODF 4.11---
OCP: 4.11.0-0.nightly-2022-04-26-181148
ODF full_version: 4.11.0-51


Does this issue impact your ability to continue to work with the product
(please explain in detail what is the user impact)? No


Is there any workaround available to the best of your knowledge? No


Rate from 1 - 5 the complexity of the scenario you performed that caused this
bug (1 - very simple, 5 - very complex)? 3


Can this issue reproducible? yes


Can this issue reproduce from the UI? yes


If this is a regression, please provide more details to justify this: yes


Steps to Reproduce:
1. Edit/create the csi-kms-connection-details configmap in the openshift-storage namespace with details for encryptionKMStype: vaulttenantsa and encryptionKMStype: vaulttokens

2. In the UI, navigate to storageclass creation page: Storage -> Storageclasses -> Create newstorageclass

3. Enter the name of the storageclass, select provisioner "openshift-storage.rbd.csi.ceph.com"

4. Click on the "Enable Encryption" checkbox
5. Select radio button 'Choose existing KMS connection'
6. Click on 'Key service' drop down


Actual results:
For OCP and ODF 4.10 no KMS connection details displayed under storageclass creation with encryption page with existing KMS connection when details of encryptionKMStype: vaulttenantsa type is available in csi-kms-details configmap along with encryptionKMStype: vaulttokens.

For OCP and ODF 4.11 only encryptionKMStype: vaulttokens details displayed under storageclass creation with encryption page with existing KMS connection when details of encryptionKMStype: vaulttenantsa type is available in csi-kms-details configmap along with encryptionKMStype: vaulttokens.

Expected results:
All the existing KMS connections of type vaulttenantsa and vaulttokens should be displayed under 'Key service' drop down

Comment 13 errata-xmlrpc 2022-08-10 11:09:16 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Important: OpenShift Container Platform 4.11.0 bug fix and security update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2022:5069