Bug 2222831

Summary: GKLM Integration with Ceph Ceph 6.0
Product: [Red Hat Storage] Red Hat Ceph Storage Reporter: Alexander <allee>
Component: RGWAssignee: Marcus Watts <mwatts>
Status: CLOSED ERRATA QA Contact: Hemanth Sai <hmaheswa>
Severity: low Docs Contact:
Priority: low    
Version: 6.0CC: akraj, allee, bhubbard, ceph-eng-bugs, cephqe-warriors, ckulal, dparkes, kdreyer, mbenjamin, mkasturi, mwatts, nojha, tserlin, vumrao
Target Milestone: ---   
Target Release: 8.0   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: ceph-19.1.0-64.el9cp Doc Type: No Doc Update
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2024-11-25 08:59:18 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2317218    

Description Alexander 2023-07-14 00:55:32 UTC 
Description of problem: 
Cu is testing on a test environment for test purposes only

GKLM does not work on Ceph
Cu trying to follow upstream documentation
https://docs.ceph.com/en/quincy/radosgw/kmip/


Cu was advised that it is not officially supported. and to use Hashicorp Vault.

https://access.redhat.com/documentation/en-us/red_hat_ceph_storage/6/html/object_gateway_guide/security#the_hashicorp_vault

Spoke with lead architect G.G and confirmed that only Hashicorp is supported

Version-Release number of selected component (if applicable): na


How reproducible: 
not reproducible

Steps to Reproduce:
Cu has done the following:

1. Set up GKLM server
2. Followed steps in https://docs.ceph.com/en/quincy/radosgw/kmip/ 
  2a. adjust the ceph.conf
  2b. create a bucket
  2c. cannot set any encryption as there is no Token available from GKLM or certificate directory on GKLM.
3. Then test the following upload: aws --endpoint-url http://xyz s3 cp /plaintext.txt s3://xyzdirectory/xyzencrypted.txt --sse aws:kms --sse-kms-key-id Kxyz



Actual results:

upload failed: when calling the PutObject operation: Failed to retrieve the actual key, kms-keyid: 

Expected results:
File uploaded

Additional info:
Cu wants to know if there are any plans to support GKLM

Let me know if there is any information that I can add here
Comment 12 errata-xmlrpc 2024-11-25 08:59:18 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Red Hat Ceph Storage 8.0 security, bug fix, and enhancement updates), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2024:10216
Comment 13 Red Hat Bugzilla 2025-03-26 04:25:12 UTC 
The needinfo request[s] on this closed bug have been removed as they have been unresolved for 120 days