[cephx_key] Add aes256k cipher support#3910
Conversation
|
Build failed (check pipeline). Post ✔️ openstack-k8s-operators-content-provider SUCCESS in 2h 18m 57s |
|
the task works in the basic scenario [1] and doesn't introduce any regression. |
|
recheck |
Add an optional `cipher` parameter (choices: aes, aes256k; default: aes)
to the `cephx_key` Ansible module so CI jobs can generate AES-256k
(32-byte, type=2) CephX keys.
- Refactor __create_cephx_key() to accept cipher argument; use
key_type=2 and os.urandom(32) for aes256k, key_type=1 and
os.urandom(16) for aes (default, backward compatible).
- Update DOCUMENTATION, EXAMPLES and RETURN docstrings.
- Update the "Generate a cephx key" task in hooks/playbooks/ceph.yml
to pass `cipher: "{{ cifmw_ceph_key_cipher | default('aes') }}"`,
allowing scenarios to opt in via a single variable.
- Add tests/unit/modules/test_cephx_key.py with 8 tests covering both
cipher modes, invalid input, base64 validity, and key randomness.
Jira: OSPRH-29667
Signed-off-by: John Fulton <fulton@redhat.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
/approve |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: michburk The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-merge-bot
Bot
merged commit 03fdc8f
into
openstack-k8s-operators:main
3 participants
Add an optional
cipherparameter (choices: aes, aes256k; default: aes) to thecephx_keyAnsible module so CI jobs can generate AES-256k (32-byte, type=2) CephX keys.cipher: "{{ cifmw_ceph_key_cipher | default('aes') }}", allowing scenarios to opt in via a single variable.Jira: OSPRH-29667