Red Hat Summit Red Hat SummitApoyoConsolaDesarrolladoresIniciar una pruebaContacto

Este contenido no está disponible en el idioma seleccionado.

Chapter 6. Securing Multicloud Object Gateway

Change and rotate your Multicloud Object Gateway (MCG) account credentials using the command-line interface to prevent issues with applications, and to ensure better account security.

6.1.1. Resetting the noobaa account password
Copiar enlace

Prerequisites

  • A running OpenShift Data Foundation cluster.

  • Download the Multicloud Object Gateway (MCG) command-line interface binary from the customer portal and make it executable.

    Note

    Choose the correct product variant according to your architecture. Available platforms are Linux(x86_64), Windows, and Mac OS.

Procedure

  • To reset the noobaa account password, run the following command: 

    $ odf noobaa account passwd <noobaa_account_name> [options]
     
    $ odf noobaa account passwd
FATA[0000] ❌ Missing expected arguments: <noobaa_account_name>

Options:
    --new-password='': New Password for authentication - the best practice is to omit this flag, in that
    case the CLI will prompt to prompt and read it securely from the terminal to avoid leaking secrets in t
     he shell history
    --old-password='': Old Password for authentication - the best practice is to omit this flag, in that
    case the CLI will prompt to prompt and read it securely from the terminal to avoid leaking secrets in
    the shell history
    --retype-new-password='': Retype new Password for authentication - the best practice is to omit this flag, in that case the CLI will prompt to prompt and read it securely from the terminal to avoid
    leaking secrets in the shell history


Usage:
    odf noobaa account passwd <noobaa-account-name> [flags] [options]

Use "odf noobaa options" for a list of global command-line options (applies to all commands).

    Example: 

    $ odf noobaa account passwd admin@noobaa.io

    Example output: 

    Enter old-password: [got 24 characters]
Enter new-password: [got 7 characters]
Enter retype-new-password: [got 7 characters]
INFO[0017] ✅ Exists: Secret "noobaa-admin"
INFO[0017] ✅ Exists: NooBaa "noobaa"
INFO[0017] ✅ Exists: Service "noobaa-mgmt"
INFO[0017] ✅ Exists: Secret "noobaa-operator"
INFO[0017] ✅ Exists: Secret "noobaa-admin"
INFO[0017] ✈️  RPC: account.reset_password() Request: {Email:admin@noobaa.io VerificationPassword:* Password:*}
WARN[0017] RPC: GetConnection creating connection to wss://localhost:58460/rpc/ 0xc000402ae0
INFO[0017] RPC: Connecting websocket (0xc000402ae0) &{RPC:0xc000501a40 Address:wss://localhost:58460/rpc/ State:init WS:<nil> PendingRequests:map[] NextRequestID:0
Lock:{state:1 sema:0} ReconnectDelay:0s cancelPings:<nil>}
INFO[0017] RPC: Connected websocket (0xc000402ae0) &{RPC:0xc000501a40 Address:wss://localhost:58460/rpc/ State:init WS:<nil> PendingRequests:map[] NextRequestID:0
Lock:{state:1 sema:0} ReconnectDelay:0s cancelPings:<nil>}
INFO[0020] ✅ RPC: account.reset_password() Response OK: took 2907.1ms
INFO[0020] ✅ Updated:  "noobaa-admin"
INFO[0020] ✅ Successfully reset the password for the account "admin@noobaa.io"
    Important

    To access the admin account credentials run the noobaa status command from the terminal: 

    --------------------
- Mgmt Credentials -
--------------------

email    : admin@noobaa.io
password : ***

You can update and verify the Multicloud Object Gateway (MCG) account credentials manually by using the MCG CLI command.

Prerequisites

Ensure that the following prerequisites are met:

  • A running OpenShift Data Foundation cluster.
  • Download the Multicloud Object Gateway (MCG) command-line interface binary from the customer portal and make it executable.
Note

Choose the correct product variant according to your architecture. Available platforms are Linux(x86_64), Windows, and Mac OS.

Procedure

  • To update the MCG account credentials, run the following command: 

    $ odf noobaa account credentials <noobaa-account-name> [options]

    Example: 

    $ odf noobaa account credentials admin@noobaa.io

    Example output: 

    $ odf noobaa account credentials admin@noobaa.io
Enter access-key: [got 20 characters]
Enter secret-key: [got 40 characters]
INFO[0026] ❌ Not Found: NooBaaAccount "admin@noobaa.io"
INFO[0026] ✅ Exists: NooBaa "noobaa"
INFO[0026] ✅ Exists: Service "noobaa-mgmt"
INFO[0026] ✅ Exists: Secret "noobaa-operator"
INFO[0026] ✅ Exists: Secret "noobaa-admin"
INFO[0026] ✈️  RPC: account.update_account_keys() Request: {Email:admin@noobaa.io AccessKeys:{AccessKey:* SecretKey:}} WARN[0026] RPC: GetConnection creating connection to wss://localhost:33495/rpc/ 0xc000cd9980 INFO[0026] RPC: Connecting websocket (0xc000cd9980) &{RPC:0xc0001655e0 Address:wss://localhost:33495/rpc/ State:init WS:<nil> PendingRequests:map[] NextRequestID:0 Lock:{state:1 sema:0} ReconnectDelay:0s cancelPings:<nil>} INFO[0026] RPC: Connected websocket (0xc000cd9980) &{RPC:0xc0001655e0 Address:wss://localhost:33495/rpc/ State:init WS:<nil> PendingRequests:map[] NextRequestID:0 Lock:{state:1 sema:0} ReconnectDelay:0s cancelPings:<nil>} INFO[0026] ✅ RPC: account.update_account_keys() Response OK: took 42.7ms INFO[0026] ✈️ RPC: account.read_account() Request: {Email:admin@noobaa.io} INFO[0026] ✅ RPC: account.read_account() Response OK: took 2.0ms INFO[0026] ✅ Updated: "noobaa-admin" INFO[0026] ✅ Successfully updated s3 credentials for the account "admin@noobaa.io" INFO[0026] ✅ Exists: Secret "noobaa-admin" Connection info: AWS_ACCESS_KEY_ID :  AWS_SECRET_ACCESS_KEY : *

    Credential complexity requirements:

    Access key
    The account access key must be 20 characters in length and it must contain only alphanumeric characters.
    Secret key

    The secret key must be 40 characters in length and it must contain alphanumeric characters and "+", "/".

    For example: 

    $ odf noobaa account credentials my-account --access-key=ABCDEF1234567890ABCD --secret-key=ABCDE12345+FGHIJ67890/KLMNOPQRSTUV123456

  • To verify the credentials, run the following command: 

    odf noobaa account status <noobaa-account-name> --show-secrets
Note

You cannot have a duplicate access-key. Each user must have a unique access-key and secret-key.

6.1.3. Regenerating the S3 credentials for the accounts
Copiar enlace

Prerequisites

  • A running OpenShift Data Foundation cluster.

  • Download the Multicloud Object Gateway (MCG) command-line interface binary from the customer portal and make it executable.

    Note

    Choose the correct product variant according to your architecture. Available platforms are Linux(x86_64), Windows, and Mac OS.

Procedure

  1. Get the account name.

    For listing the accounts, run the following command: 

    $ odf noobaa account list

    Example output: 

    NAME           ALLOWED_BUCKETS   DEFAULT_RESOURCE               PHASE   AGE
account-test   [*]               noobaa-default-backing-store   Ready   14m17s
test2          [first.bucket]    noobaa-default-backing-store   Ready   3m12s

    Alternatively, run the oc get noobaaaccount command from the terminal: 

    $ oc get noobaaaccount

    Example output: 

    NAME           PHASE   AGE
account-test   Ready   15m
test2          Ready   3m59s

  2. To regenerate the noobaa account S3 credentials, run the following command: 

    $ odf noobaa account regenerate <noobaa_account_name> [options]
     
    $ odf noobaa account regenerate
FATA[0000] ❌ Missing expected arguments: <noobaa-account-name>

Usage:
    odf noobaa account regenerate <noobaa-account-name> [flags] [options]

Use "odf noobaa options" for a list of global command-line options (applies to all commands).

  3. Once you run the odf noobaa account regenerate command it will prompt a warning that says "This will invalidate all connections between S3 clients and NooBaa which are connected using the current credentials.", and ask for confirmation:

    Example: 

    $ odf noobaa account regenerate account-test

    Example output: 

    INFO[0000] You are about to regenerate an account's security credentials.
INFO[0000] This will invalidate all connections between S3 clients and NooBaa which are connected using the current credentials.
INFO[0000] are you sure? y/n

  4. On approving, it will regenerate the credentials and eventually print them: 

    INFO[0015] ✅ Exists: Secret "noobaa-account-account-test"
Connection info:
AWS_ACCESS_KEY_ID      : ***
AWS_SECRET_ACCESS_KEY  : ***

6.1.4. Regenerating the S3 credentials for the OBC
Copiar enlace

Prerequisites

  • A running OpenShift Data Foundation cluster.

  • Download the Multicloud Object Gateway (MCG) command-line interface binary from the customer portal and make it executable.

    Note

    Choose the correct product variant according to your architecture. Available platforms are Linux(x86_64), Windows, and Mac OS.

Procedure

  1. To get the OBC name, run the following command: 

    $ odf noobaa obc list

    Example output: 

    NAMESPACE   NAME       BUCKET-NAME                                     STORAGE-CLASS       BUCKET-CLASS                  PHASE
default     obc-test   obc-test-35800e50-8978-461f-b7e0-7793080e26ba   default.noobaa.io   noobaa-default-bucket-class   Bound

    Alternatively, run the oc get obc command from the terminal: 

    $ oc get obc

    Example output: 

    NAME       STORAGE-CLASS       PHASE   AGE
obc-test   default.noobaa.io   Bound   38s

  2. To regenerate the noobaa OBC S3 credentials, run the following command: 

    $ odf noobaa obc regenerate <bucket_claim_name> [options]
     
    $ odf noobaa obc regenerate
FATA[0000] ❌ Missing expected arguments: <bucket-claim-name>

Usage:
   odf noobaa obc regenerate <bucket-claim-name> [flags] [options]

Use "odf noobaa options" for a list of global command-line options (applies to all commands).

  3. Once you run the odf noobaa obc regenerate command it will prompt a warning that says "This will invalidate all connections between the S3 clients and noobaa which are connected using the current credentials.", and ask for confirmation:

    Example: 

    $ odf noobaa obc regenerate obc-test

    Example output: 

    INFO[0000] You are about to regenerate an OBC's security credentials.
INFO[0000] This will invalidate all connections between S3 clients and NooBaa which are connected using the current credentials.
INFO[0000] are you sure? y/n

  4. On approving, it will regenerate the credentials and eventually print them: 

    INFO[0022] ✅ RPC: bucket.read_bucket() Response OK: took 95.4ms

ObjectBucketClaim info:
  Phase                  : Bound
  ObjectBucketClaim      : kubectl get -n default objectbucketclaim obc-test
  ConfigMap              : kubectl get -n default configmap obc-test
  Secret                 : kubectl get -n default secret obc-test
  ObjectBucket           : kubectl get objectbucket obc-default-obc-test
  StorageClass           : kubectl get storageclass default.noobaa.io
  BucketClass            : kubectl get -n default bucketclass noobaa-default-bucket-class

Connection info:
 BUCKET_HOST            : s3.default.svc
 BUCKET_NAME            : obc-test-35800e50-8978-461f-b7e0-7793080e26ba
    BUCKET_PORT            : 443
    AWS_ACCESS_KEY_ID      : ***
    AWS_SECRET_ACCESS_KEY  : ***

Shell commands:
  AWS S3 Alias           : alias s3='AWS_ACCESS_KEY_ID=***
AWS_SECRET_ACCESS_KEY=*** aws s3 --no-verify-ssl --endpoint-url ***'

Bucket status:
  Name                   : obc-test-35800e50-8978-461f-b7e0-7793080e26ba
  Type                   : REGULAR
  Mode                   : OPTIMAL
  ResiliencyStatus       : OPTIMAL
  QuotaStatus            : QUOTA_NOT_SET
  Num Objects            : 0
  Data Size              : 0.000 B
  Data Size Reduced      : 0.000 B
  Data Space Avail       : 13.261 GB
  Num Objects Avail      : 9007199254740991

6.2. Enabling secured mode deployment for Multicloud Object Gateway
Copiar enlace

You can specify a range of IP addresses that should be allowed to reach the Multicloud Object Gateway (MCG) load balancer services to enable secure mode deployment. This helps to control the IP addresses that can access the MCG services.

Note

You can disable the MCG load balancer usage by setting the disableLoadBalancerService variable in the storagecluster custom resource definition (CRD) while deploying OpenShift Data Foundation using the command line interface. This helps to restrict MCG from creating any public resources for private clusters and to disable the MCG service EXTERNAL-IP. For more information, see the Red Hat Knowledgebase article Install Red Hat OpenShift Data Foundation 4.X in internal mode using command line interface. For information about disabling MCG load balancer service after deploying OpenShift Data Foundation, see Disabling Multicloud Object Gateway external service after deploying OpenShift Data Foundation.

Prerequisites

  • A running OpenShift Data Foundation cluster.
  • In case of a bare metal deployment, ensure that the load balancer controller supports setting the loadBalancerSourceRanges attribute in the Kubernetes services.

Procedure

  • Edit the NooBaa custom resource (CR) to specify the range of IP addresses that can access the MCG services after deploying OpenShift Data Foundation. 

    $ oc edit noobaa -n openshift-storage noobaa
    noobaa
    The NooBaa CR type that controls the NooBaa system deployment.
    noobaa

    The name of the NooBaa CR.

    For example: 

    ...
spec:
  ...
  loadBalancerSourceSubnets:
    s3: ["10.0.0.0/16", "192.168.10.0/32"]
    sts:
      - "10.0.0.0/16"
      - "192.168.10.0/32"
...
    loadBalancerSourceSubnets

    A new field that can be added under spec in the NooBaa CR to specify the IP addresses that should have access to the NooBaa services.

    In this example, all the IP addresses that are in the subnet 10.0.0.0/16 or 192.168.10.0/32 will be able to access MCG S3 and security token service (STS) while the other IP addresses are not allowed to access.

Verification steps

  • To verify if the specified IP addresses are set, in the OpenShift Web Console, run the following command and check if the output matches with the IP addresses provided to MCG: 

    $ oc get svc -n openshift-storage <s3 | sts> -o=go-template='{{ .spec.loadBalancerSourceRanges }}'

You can disable S3, STS, and noobaa-mgmt routes by setting the following option in the storagecluster CR: 

spec:
  multiCloudGateway:
    disableRoutes: true

This stops reconciling of all the three routes so that the routes are not recreated when they are deleted.

Procedure

Edit the storagecluster CR in one of the following ways:

  • Using the oc patch command: 

    oc patch storagecluster ocs-storage -n openshift-storage --type=merge -p '{"spec":{"multiCloudGateway":{"disableRoutes":true}}}'

  • Using the interactive method: 

    oc edit storagecluster ocs-storage -n openshift-storage

    • Add the following under .spec: 

      multiCloudGateway:
  disableRoutes: true

Verification steps

To verify, delete the existing routes and check if they are listed: 

oc delete routes --all -n openshift-storage
oc get routes -n openshift-storage

The S3, STS, and noobaa-mgmt routes are no longer reconciled by the operator.

Red Hat logoGithubredditYoutubeTwitter

Aprender

Pruebe, compre y venda

Comunidades

Acerca de Red Hat

Ofrecemos soluciones reforzadas que facilitan a las empresas trabajar en plataformas y entornos, desde el centro de datos central hasta el perímetro de la red.

Hacer que el código abierto sea más inclusivo

Red Hat se compromete a reemplazar el lenguaje problemático en nuestro código, documentación y propiedades web. Para más detalles, consulte el Blog de Red Hat.

Acerca de la documentación de Red Hat

Ayudamos a los usuarios de Red Hat a innovar y alcanzar sus objetivos con nuestros productos y servicios con contenido en el que pueden confiar. Explore nuestras recientes actualizaciones.

Legal Notice

Theme

© 2026 Red HatVolver arriba