# ceph.conf 认证配置
[global]
auth_cluster_required = cephx     # 集群内部认证（MON/OSD/MGR 间）
auth_service_required = cephx     # 服务端认证（OSD 间通信）
auth_client_required = cephx      # 客户端认证

# 列出所有用户
ceph auth ls

# 查看用户详情
ceph auth get client.admin

# 创建新用户（最小权限原则）
ceph auth get-or-create client.monitor-user \
    mon 'allow r' \
    osd 'allow r' \
    mgr 'allow r'

# 创建 RBD 专用用户
ceph auth get-or-create client.rbd-user \
    mon 'profile rbd' \
    osd 'profile rbd pool=mypool' \
    mgr 'profile rbd pool=mypool'

# 创建 CephFS 专用用户
ceph auth get-or-create client.cephfs-user \
    mon 'allow r' \
    mds 'allow rw path=/myfs/data' \
    osd 'allow rw pool=cephfs-data' \
    mgr 'allow r'

# 导出密钥文件
ceph auth get-or-create client.myuser > /etc/ceph/ceph.client.myuser.keyring

# 修改用户权限
ceph auth caps client.myuser \
    mon 'allow r' \
    osd 'allow rw pool=mypool'

# 删除用户
ceph auth del client.myuser

# 为不同租户创建隔离的用户和池
# 租户 A
ceph osd pool create tenant-a-pool 128 128 replicated
ceph auth get-or-create client.tenant-a \
    mon 'allow r' \
    osd 'allow rw pool=tenant-a-pool'

# 租户 B
ceph osd pool create tenant-b-pool 128 128 replicated
ceph auth get-or-create client.tenant-b \
    mon 'allow r' \
    osd 'allow rw pool=tenant-b-pool'

# 测试隔离性
# tenant-a 用户无法访问 tenant-b-pool
ceph --id tenant-a -p tenant-b-pool ls  # 应该失败

# ceph.conf 配置
[global]
ms_cluster_mode = secure          # 集群内部通信加密
ms_service_mode = secure          # OSD 间通信加密
ms_client_mode = secure           # 客户端通信加密

# 或只加密客户端通信
ms_client_mode = secure
ms_cluster_mode = crc             # 集群内部用 CRC（性能更好）
ms_service_mode = crc

# 使用 Ceph 内置的 TLS
ceph config set global ms_cluster_mode secure
ceph config set global ms_service_mode secure
ceph config set global ms_client_mode secure

# 查看 Messenger 版本
ceph daemon mon.node1 config show | grep ms_type
# 输出: "ms_type": "async+posix"

# 重启所有服务使配置生效
ceph orch restart mon
ceph orch restart osd

# 在创建 OSD 时启用加密
# cephadm 方式
ceph orch daemon add osd node1:/dev/sdb --dmcrypt

# ceph-volume 方式
ceph-volume lvm create --data /dev/sdb --dmcrypt

# 批量部署加密 OSD
ceph orch apply osd --all-available-devices --dmcrypt

# 验证加密状态
ceph-volume lvm list
# 输出中应显示 encrypted=true

# dm-crypt 密钥存储在 Monitor 中
# 查看加密密钥
ceph config-key list | grep dm-crypt

# 导出密钥（用于灾难恢复）
ceph config-key get dm-crypt/osd/osd.5/luks | base64 -d > /backup/osd5-luks-key.bin

# 备份所有加密密钥
for osd_id in $(ceph osd ls); do
    ceph config-key get dm-crypt/osd/osd.${osd_id}/luks | base64 -d > /backup/osd${osd_id}-luks-key.bin
done

# 生成 SSL 证书
openssl req -new -x509 -nodes -days 3650 \
    -keyout /etc/ceph/rgw.key \
    -out /etc/ceph/rgw.crt \
    -subj "/CN=rgw.example.com"

# 配置 RGW 使用 HTTPS
ceph config set client.rgw rgw_frontends "beast ssl_port=443 ssl_certificate=/etc/ceph/rgw.crt ssl_private_key=/etc/ceph/rgw.key"

# 重启 RGW
ceph orch restart rgw

# 启用 RGW 服务端加密
ceph config set client.rgw rgw_crypt_default_encryption_key <base64-key>

# 使用 KMS 加密（如 Vault）
ceph config set client.rgw rgw_crypt_vault_auth token
ceph config set client.rgw rgw_crypt_vault_addr https://vault.example.com:8200
ceph config set client.rgw rgw_crypt_vault_secret_engine transit
ceph config set client.rgw rgw_crypt_vault_prefix /v1/transit

# 设置用户存储配额
radosgw-admin quota set --quota-scope=user --uid=myuser --max-size=100G
radosgw-admin quota set --quota-scope=user --uid=myuser --max-objects=100000
radosgw-admin quota enable --quota-scope=user --uid=myuser

# 设置桶配额
radosgw-admin quota set --quota-scope=bucket --uid=myuser --max-size=10G
radosgw-admin quota set --quota-scope=bucket --uid=myuser --max-objects=10000
radosgw-admin quota enable --quota-scope=bucket --uid=myuser

# 设置强密码
ceph dashboard set-login-credentials admin 'MyStr0ng!P@ssw0rd'

# 启用 SSL
ceph dashboard create-self-signed-cert

# 配置 RBAC 角色
ceph dashboard ac-role-create readonly
ceph dashboard ac-role-add-scope-perms readonly cephfs read
ceph dashboard ac-role-add-scope-perms readonly pool read
ceph dashboard ac-role-add-scope-perms readonly osd read
ceph dashboard ac-role-add-scope-perms readonly rgw read

# 创建只读用户
ceph dashboard ac-user-create viewer 'Read0nly!' readonly

# 查看所有用户
ceph dashboard ac-user-show

# Ceph 需要开放的端口
# Monitor: 3300 (v2), 6789 (v1)
# OSD: 6800-7300
# MGR: 9283 (prometheus), 8443 (dashboard), 9287 (prometheus metrics)
# RGW: 80/443
# MDS: 6800+

# iptables 规则示例
# 允许集群网络
iptables -A INPUT -s 10.10.10.0/24 -j ACCEPT

# 允许公共网络访问
iptables -A INPUT -s 192.168.1.0/24 -p tcp --dport 6789 -j ACCEPT  # MON
iptables -A INPUT -s 192.168.1.0/24 -p tcp --dport 6800:7300 -j ACCEPT  # OSD
iptables -A INPUT -s 192.168.1.0/24 -p tcp --dport 80 -j ACCEPT  # RGW
iptables -A INPUT -s 192.168.1.0/24 -p tcp --dport 8443 -j ACCEPT  # Dashboard

# firewalld (RHEL/CentOS)
firewall-cmd --permanent --zone=trusted --add-source=10.10.10.0/24
firewall-cmd --permanent --add-port=6789/tcp
firewall-cmd --permanent --add-port=6800-7300/tcp
firewall-cmd --permanent --add-port=80/tcp
firewall-cmd --permanent --add-port=8443/tcp
firewall-cmd --reload

# 启用 Ceph 审计日志
ceph config set global log_to_stderr true
ceph config set mon audit_log_to_stderr true

# 查看审计日志
tail -f /var/log/ceph/ceph.audit.log

# Dashboard 操作审计
ceph dashboard audit-log-get