feat(installer): derive a data center's vault from the primary's - #624
Open
NJona wants to merge 2 commits into
Open
feat(installer): derive a data center's vault from the primary's#624NJona wants to merge 2 commits into
NJona wants to merge 2 commits into
Conversation
A multi-data-center installation shares one PostgreSQL server, so the postgres roles, the token signing keys and everything else that encrypts rows in the shared database has to be identical in every data center's vault. Everything tied to a single cluster — the ingress CA, the cephadm SSH key, the kubeconfig, the Ceph credentials the installer writes back — must not be. DeriveDataCenterVault copies the primary data center's vault and drops exactly the second group, so running EnsureSecrets over the result regenerates those and leaves the shared ones untouched. The Ceph cluster credentials are matched by prefix, because the closed-source installer owns those names. ClearDataCenterScopedConfig resets the config fields that are written alongside a dropped secret, since the Ensure* functions are gated on the vault entry and would otherwise leave a stale value paired with a freshly generated key. No caller yet; this is the pure, GCP-independent part of multi-DC support. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Jona Neef <Jona.Neef.97@gmail.com>
Signed-off-by: NJona <25478046+NJona@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A multi-data-center installation shares one PostgreSQL server, so the postgres roles, the token signing keys and everything that encrypts rows in the shared database have to be identical in every data center's vault. Everything tied to a single cluster — the ingress CA, the cephadm SSH key, the kubeconfig, the Ceph credentials the installer writes back — must not be.
DeriveDataCenterVaultcopies the primary data center's vault and drops exactly the second group, so runningEnsureSecretsover the result regenerates those and leaves the shared ones untouched.ClearDataCenterScopedConfigresets the config fields written alongside a dropped secret, since theEnsure*functions are gated on the vault entry and would otherwise leave a stale value paired with a freshly generated key.Review notes
ceph,csi,rgw), because the closed-source installer owns those names and adds to them.postgresPrimaryServerKeyPem/postgresReplicaServerKeyPemare deliberately kept: dropping them would pushregeneratePostgresCertsinto its regeneration branch and mint a server key the running postgres has never seen.Part of the
oms beta bootstrap-gcp --multi-dcstack (10 PRs). Merge in order; each PR is based on its predecessor.