Storage layout
Provision three independent external buckets:
All three must exist before startup. The runtime adapter never creates a bucket.
The overlay uses HTTPS, path-style S3 addressing, verified private CA trust,
AES-256 server-side encryption requests, and SHA-256 application integrity.
Option A: external managed OBCs
Identify the customer-approved RGW bucket StorageClass:k8s/overlays/openshift-odf-rgw/object-bucket-claims.example.yaml
to the customer environment repository, replace the StorageClass placeholder,
and apply it separately from CaseBender. Bucket lifecycle remains owned by the
storage operator.
BUCKET_HOST, BUCKET_PORT, BUCKET_NAME, and BUCKET_REGION, and each
Secret provides AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. If the OBC
operator uses other keys, patch valueFrom; never copy credentials into a
ConfigMap or Kustomize file.
Option B: standalone external RGW
Usek8s/overlays/openshift-odf-rgw/standalone-rgw-resources.example.yaml
as a mapping example. Replace every .invalid endpoint and bucket placeholder
in the customer overlay. Use the installed external-secret controller or
another approved secret injector. Keep endpoints and bucket names in
ConfigMaps, credentials in Secrets, and all real values outside this repository.
The restricted init container reads these resources and writes a strict
STORAGE_CONFIG_FILE to a memory-backed emptyDir with mode 0400. Web and
worker mount it read-only.
Private CA
Create a CA ConfigMap containing only the issuing chain:--insecure, or a
certificate-bypass option.
Egress
The included policy permits web and worker to reach TCP 443 on pods labelledapp=rook-ceph-rgw in openshift-storage. Verify the actual namespace, labels,
port, and CNI behavior.
For external RGW, copy and adapt
external-rgw-network-policy.example.yaml with stable approved CIDRs, or route
through an operator-controlled egress proxy. Kubernetes NetworkPolicy cannot
select FQDNs. Do not restore wildcard 0.0.0.0/0 or ::/0 egress.
Add separate least-privilege policies for PostgreSQL, Redis, identity, scanner,
and approved integrations.
Scanner prerequisite
Production user uploads require externalclamd. The provided worker patch
expects casebender-malware-scanner (host, port) and
casebender-malware-scanner-ca (ca.crt) and enables TLS. A same-pod scanner
may instead use CLAMD_SOCKET_PATH. If the scanner is unavailable, objects
remain quarantined and retries can eventually dead-letter; downloads do not
fail open.
Render and validate
apps/docs/en/deployment/odf-ceph-rgw-validation-evidence.md. A render,
emulator test, or unsigned transcript is not live certification.
Credential rotation
- Rotate through the supported ODF/Ceph procedure; do not hand-edit an operator-owned OBC Secret.
- Allow a bounded overlap while the generated Secret or ExternalSecret refreshes.
- Restart web and worker so the init container regenerates the mounted file.
- Require
/api/health/readyand live contract validation to pass. - Revoke the old credential and check sanitized authentication metrics/logs.
CA rotation
- Publish a temporary CA bundle containing old and new issuing CAs.
- Restart and validate web and worker.
- Rotate the RGW serving certificate.
- Publish the new-only CA bundle, restart, and validate again.
- Record ConfigMap resource versions, CA SHA-256 hashes, exact ODF/Ceph versions, and evidence—never credential values.
k8s/overlays/openshift-odf-rgw/README.md for overlay details.