Orchestrate object storage from OpenStack for OpenShift projects

[knikolla]

Related nerc-project/operations#891

For a short-term solution to the above linked issue, we would like to automate the process of giving access to OpenStack's RGW for object storage when an allocation to OpenShift is approved.

• The OpenShift Resource will have a new Resource Attribute Object Storage from OpenStack Resource whose value will match the Resource name of the OpenStack cluster.
• When a resource allocation is approved, if the Resource is an OpenShift resource that contains the above attribute:
  • Create a project in the OpenStack resource referenced above
    • Project name of the OpenStack project is same as openshift namespace.
    • Quotas of the OpenStack project are set to zero values. With the exception of object quota.
    • Already existing quota attribute for Openstack object storage is added to allocation.
    • Create an EC2 access credential for that project to access object storage
  • After creating the OpenShift project
    • insert a secret in the OpenShift namespace with the following values as described below and named nerc-s3-credentials.
• Introduce a new management command line that deals with re-provisioning secrets that have been deleted.

AWS_ENDPOINT_URL=<RGW endpoint>
AWS_ENDPOINT_URL_S3=<RGW endpoint>
AWS_ACCESS_KEY_ID=<Created EC2 ID>
AWS_SECRET_ACCESS_KEY=<Created EC2 Secret>

[knikolla]

More things to think about

• Should we create a corresponding Resource Allocation on the OpenStack resource to be created, or just track this behind the scenes without exposing what is happening?
• Alternatively, should we create a Object Storage Resource, that subclasses from OpenStack that just contains the above ^?

I feel somewhat weirded out about the idea of one resource allocation corresponding to two projects, and creating two Resource Allocations would track this more natively, but then mess up the user permissions.

[joachimweyl]

If/once IBM storage is available, this will not be required. What is the size/estimate of this?

[QuanMPhm]

Since this is a somewhat unfamiliar task, I would estimate it would take around a week of effort before I submit the initial PR

[joachimweyl]

Let's put this on pause until I can find out how soon we think we will be able to use IBM Scale storage for this purpose.