红帽全球峰会4.3. 在外部模式部署后启用加密
先决条件
- OpenShift Data Foundation 被部署并创建一个存储集群。
流程
对 storagecluster 进行补丁，以添加
启用的加密为 true 存储集群 spec：oc patch storagecluster ocs-external-storagecluster -n openshift-storage --type json --patch '[{ "op": "replace", "path": "/spec/network", "value": {"connections": {"encryption": {"enabled": true}}} }]'$ oc patch storagecluster ocs-external-storagecluster -n openshift-storage --type json --patch '[{ "op": "replace", "path": "/spec/network", "value": {"connections": {"encryption": {"enabled": true}}} }]' storagecluster.ocs.openshift.io/ocs-external-storagecluster patchedCopy to Clipboard Copied! Toggle word wrap Toggle overflow 检查 CR 中的连接设置。
oc get storagecluster NAME AGE PHASE EXTERNAL CREATED AT VERSION ocs-external-storagecluster 9h Ready true 2024-11-06T20:48:03Z 4.18.0
oc get storagecluster NAME AGE PHASE EXTERNAL CREATED AT VERSION ocs-external-storagecluster 9h Ready true 2024-11-06T20:48:03Z 4.18.0Copy to Clipboard Copied! Toggle word wrap Toggle overflow oc get storagecluster ocs-external-storagecluster -o yaml | yq '.spec.network.connections'
$ oc get storagecluster ocs-external-storagecluster -o yaml | yq '.spec.network.connections' encryption: enabled: trueCopy to Clipboard Copied! Toggle word wrap Toggle overflow
4.3.1. 在 Red Hat Ceph Storage 集群中应用加密功能
复制链接链接已复制到粘贴板!
流程
应用加密 in-transit 设置。
root@ceph-client ~]# ceph config set global ms_client_mode secure [root@ceph-client ~]# ceph config set global ms_cluster_mode secure [root@ceph-client ~]# ceph config set global ms_service_mode secure [root@ceph-client ~]# ceph config set global rbd_default_map_options ms_mode=secure
root@ceph-client ~]# ceph config set global ms_client_mode secure [root@ceph-client ~]# ceph config set global ms_cluster_mode secure [root@ceph-client ~]# ceph config set global ms_service_mode secure [root@ceph-client ~]# ceph config set global rbd_default_map_options ms_mode=secureCopy to Clipboard Copied! Toggle word wrap Toggle overflow 检查设置。
Copy to Clipboard Copied! Toggle word wrap Toggle overflow 重新启动所有 Ceph 守护进程。
Copy to Clipboard Copied! Toggle word wrap Toggle overflow 等待所有守护进程重启。
4.3.2. 重新挂载现有卷。
复制链接链接已复制到粘贴板!
根据应用程序维护的最佳实践，您可以选择环境的最佳实践来重新挂载或重新映射卷。重新重新挂载的一种方法是删除现有应用程序 pod 并启动另一个应用程序 pod 来使用该卷。另一个选择是排空运行应用程序的节点。这样可保证卷已从当前 pod 卸载，然后挂载到新 pod，从而允许重新映射或重新挂载卷。
'%20d='M201.5%20305.5c-13.8%200-24.9-11.1-24.9-24.6%200-13.8%2011.1-24.9%2024.9-24.9%2013.6%200%2024.6%2011.1%2024.6%2024.9%200%2013.6-11.1%2024.6-24.6%2024.6zM504%20256c0%20137-111%20248-248%20248S8%20393%208%20256%20119%208%20256%208s248%20111%20248%20248zm-132.3-41.2c-9.4%200-17.7%203.9-23.8%2010-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3%2055.4%2012.5c0%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.3%2024.9-24.9s-11.1-24.9-24.9-24.9c-9.7%200-18%205.8-22.1%2013.8l-61.2-13.6c-3-.8-6.1%201.4-6.9%204.4l-19.1%2086.4c-33.2%201.4-63.1%2011.3-85.5%2026.8-6.1-6.4-14.7-10.2-24.1-10.2-34.9%200-46.3%2046.9-14.4%2062.8-1.1%205-1.7%2010.2-1.7%2015.5%200%2052.6%2059.2%2095.2%20132%2095.2%2073.1%200%20132.3-42.6%20132.3-95.2%200-5.3-.6-10.8-1.9-15.8%2031.3-16%2019.8-62.5-14.9-62.5zM302.8%20331c-18.2%2018.2-76.1%2017.9-93.6%200-2.2-2.2-6.1-2.2-8.3%200-2.5%202.5-2.5%206.4%200%208.6%2022.8%2022.8%2087.3%2022.8%20110.2%200%202.5-2.2%202.5-6.1%200-8.6-2.2-2.2-6.1-2.2-8.3%200zm7.7-75c-13.6%200-24.6%2011.1-24.6%2024.9%200%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.1%2024.9-24.6%200-13.8-11-24.9-24.9-24.9z'/%3e%3c/svg%3e){kind=small}