[pve-devel] [PATCH manager] ui: rbd: cephfs: add keyring/secret field for external clusters

[pve-devel] [PATCH manager] ui: rbd: cephfs: add keyring/secret field for external clusters

[Aaron Lauterer]

Manual switching of xtype because binding 'hidden' does not work with
pmxDisplayEditField.

Signed-off-by: Aaron Lauterer <a.lauterer@proxmox.com>
---
 www/manager6/storage/CephFSEdit.js | 39 ++++++++++++++++++++----------
 www/manager6/storage/RBDEdit.js    | 11 +++++++++
 2 files changed, 37 insertions(+), 13 deletions(-)

diff --git a/www/manager6/storage/CephFSEdit.js b/www/manager6/storage/CephFSEdit.js
index 92fdfe63..89459ba8 100644
--- a/www/manager6/storage/CephFSEdit.js
+++ b/www/manager6/storage/CephFSEdit.js
@@ -101,20 +101,33 @@ Ext.define('PVE.storage.CephFSInputPanel', {
 	    },
 	];
 
-	me.columnB = [{
-	    xtype: 'proxmoxcheckbox',
-	    name: 'pveceph',
-	    reference: 'pvecephRef',
-	    bind: {
-		disabled: '{!pvecephPossible}',
-		value: '{pveceph}',
+	me.columnB = [
+	    {
+		xtype: me.isCreate ? 'textfield' : 'displayfield',
+		name: 'keyring',
+		fieldLabel: 'Secret',
+		value: me.isCreate? '' : '***********',
+		allowBlank: false,
+		bind: {
+		    hidden: '{pveceph}',
+		    disabled: '{pveceph}',
+		},
+	    },
+	    {
+		xtype: 'proxmoxcheckbox',
+		name: 'pveceph',
+		reference: 'pvecephRef',
+		bind: {
+		    disabled: '{!pvecephPossible}',
+		    value: '{pveceph}',
+		},
+		checked: true,
+		uncheckedValue: 0,
+		submitValue: false,
+		hidden: !me.isCreate,
+		boxLabel: gettext('Use Proxmox VE managed hyper-converged cephFS'),
 	    },
-	    checked: true,
-	    uncheckedValue: 0,
-	    submitValue: false,
-	    hidden: !me.isCreate,
-	    boxLabel: gettext('Use Proxmox VE managed hyper-converged cephFS'),
-	}];
+	];
 
 	me.callParent();
     },
diff --git a/www/manager6/storage/RBDEdit.js b/www/manager6/storage/RBDEdit.js
index 35568b98..3dcfea20 100644
--- a/www/manager6/storage/RBDEdit.js
+++ b/www/manager6/storage/RBDEdit.js
@@ -201,6 +201,17 @@ Ext.define('PVE.storage.RBDInputPanel', {
 	];
 
 	me.columnB = [
+	    {
+		xtype: me.isCreate ? 'textarea' : 'displayfield',
+		name: 'keyring',
+		fieldLabel: 'Keyring',
+		value: me.isCreate? '' : '***********',
+		allowBlank: false,
+		bind: {
+		    hidden: '{pveceph}',
+		    disabled: '{pveceph}',
+		},
+	    },
 	    {
 		xtype: 'proxmoxcheckbox',
 		name: 'pveceph',
-- 
2.30.2

[pve-devel] [PATCH docs 2/3] storage: rbd: cephs: update authentication section

[Aaron Lauterer]

It is not needed anymore to place the keyring/secret file manually in
the correct location as it can be done with pvesm and the GUI/API now.

Signed-off-by: Aaron Lauterer <a.lauterer@proxmox.com>
---

Since both sectons share the same footnote, I tried to get them to share
the same with footnote:<id>[here some text] and footnote:<id>[] to
reference it as explained in the asciidoc documentation [0].
Unfortunately I did not get it to work, most likely because they are
both in separate files?
I rather err on having the same footnote twice than missing it in one
place.



[0] https://docs.asciidoctor.org/asciidoc/latest/macros/footnote/

 pve-storage-cephfs.adoc | 31 ++++++++++++++++++-------------
 pve-storage-rbd.adoc    | 28 +++++++++++++++++++---------
 2 files changed, 37 insertions(+), 22 deletions(-)

diff --git a/pve-storage-cephfs.adoc b/pve-storage-cephfs.adoc
index c67f089..2437859 100644
--- a/pve-storage-cephfs.adoc
+++ b/pve-storage-cephfs.adoc
@@ -71,31 +71,36 @@ disabled.
 Authentication
 ~~~~~~~~~~~~~~
 
-If you use `cephx` authentication, which is enabled by default, you need to copy
-the secret from your external Ceph cluster to a Proxmox VE host.
+If you use `cephx` authentication, which is enabled by default, you need to provide
+the secret from the external Ceph cluster.
 
-Create the directory `/etc/pve/priv/ceph` with
+The secret file is expected to be located at
 
- mkdir /etc/pve/priv/ceph
+ /etc/pve/priv/ceph/<STORAGE_ID>.secret
 
-Then copy the secret
+You can copy the secret with
 
- scp cephfs.secret <proxmox>:/etc/pve/priv/ceph/<STORAGE_ID>.secret
+ scp <external cephserver>:/etc/ceph/cephfs.secret /local/path/to/<STORAGE_ID>.secret
 
-The secret must be renamed to match your `<STORAGE_ID>`. Copying the
-secret generally requires root privileges. The file must only contain the
-secret key itself, as opposed to the `rbd` backend which also contains a
-`[client.userid]` section.
+If you use the `pvesm` CLI tool to configure the external RBD storage, use the
+`--keyring` parameter, which needs to be a path to the secret file that you
+copied.
+
+When configuring an external RBD storage via the GUI, you can copy and paste
+the secret into the appropriate field.
+
+The secret is only the key itself, as opposed to the `rbd` backend which also
+contains a `[client.userid]` section.
 
 A secret can be received from the Ceph cluster (as Ceph admin) by issuing the
 command below, where `userid` is the client ID that has been configured to
 access the cluster. For further information on Ceph user management, see the
-Ceph docs footnote:[Ceph user management
-{cephdocs-url}/rados/operations/user-management/].
+Ceph docs.footnote:[Ceph user management
+{cephdocs-url}/rados/operations/user-management/]
 
  ceph auth get-key client.userid > cephfs.secret
 
-If Ceph is installed locally on the PVE cluster, that is, it was set up using
+If Ceph is installed locally on the {pve} cluster, that is, it was set up using
 `pveceph`, this is done automatically.
 
 Storage Features
diff --git a/pve-storage-rbd.adoc b/pve-storage-rbd.adoc
index bbc80e2..1f14b7c 100644
--- a/pve-storage-rbd.adoc
+++ b/pve-storage-rbd.adoc
@@ -69,23 +69,33 @@ TIP: You can use the `rbd` utility to do low-level management tasks.
 Authentication
 ~~~~~~~~~~~~~~
 
-If you use `cephx` authentication, you need to copy the keyfile from your
-external Ceph cluster to a Proxmox VE host.
+If you use `cephx` authentication, which is enabled by default, you need to
+provide the keyring from the external Ceph cluster.
 
-Create the directory `/etc/pve/priv/ceph` with
+The keyring file is expected to be at
 
- mkdir /etc/pve/priv/ceph
+ /etc/pve/priv/ceph/<STORAGE_ID>.keyring
 
-Then copy the keyring
+You can copy the keyring with
 
- scp <cephserver>:/etc/ceph/ceph.client.admin.keyring /etc/pve/priv/ceph/<STORAGE_ID>.keyring
+ scp <external cephserver>:/etc/ceph/ceph.client.admin.keyring /local/path/to/<STORAGE_ID>.keyring
 
-The keyring must be named to match your `<STORAGE_ID>`. Copying the
-keyring generally requires root privileges.
+If you use the `pvesm` CLI tool to configure the external RBD storage, use the
+`--keyring` parameter, which needs to be a path to the keyring file that you
+copied.
 
-If Ceph is installed locally on the PVE cluster, this is done automatically by
+When configuring an external RBD storage via the GUI, you can copy and paste the
+keyring into the appropriate field.
+
+If Ceph is installed locally on the {pve} cluster, this is done automatically by
 'pveceph' or in the GUI.
 
+TIP: Creating a keyring with only the needed capabilities is recommend when
+connecting to an external cluster. For further information on Ceph user
+management, see the Ceph docs.footnote:[Ceph user management
+{cephdocs-url}/rados/operations/user-management/]
+
+
 Storage Features
 ~~~~~~~~~~~~~~~~
 
-- 
2.30.2

[pve-devel] [PATCH docs 3/3] storage: rbd: cephs: replace PVE with {pve}

[Aaron Lauterer]

Signed-off-by: Aaron Lauterer <a.lauterer@proxmox.com>
---
 pve-storage-cephfs.adoc | 4 ++--
 pve-storage-rbd.adoc    | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pve-storage-cephfs.adoc b/pve-storage-cephfs.adoc
index 2437859..f211aa5 100644
--- a/pve-storage-cephfs.adoc
+++ b/pve-storage-cephfs.adoc
@@ -37,7 +37,7 @@ This backend supports the common storage properties `nodes`,
 monhost::
 
 List of monitor daemon addresses. Optional, only needed if Ceph is not running
-on the PVE cluster.
+on the {pve} cluster.
 
 path::
 
@@ -45,7 +45,7 @@ The local mount point. Optional, defaults to `/mnt/pve/<STORAGE_ID>/`.
 
 username::
 
-Ceph user id. Optional, only needed if Ceph is not running on the PVE cluster,
+Ceph user id. Optional, only needed if Ceph is not running on the {pve} cluster,
 where it defaults to `admin`.
 
 subdir::
diff --git a/pve-storage-rbd.adoc b/pve-storage-rbd.adoc
index 1f14b7c..e9c5c40 100644
--- a/pve-storage-rbd.adoc
+++ b/pve-storage-rbd.adoc
@@ -37,7 +37,7 @@ This backend supports the common storage properties `nodes`,
 monhost::
 
 List of monitor daemon IPs. Optional, only needed if Ceph is not running on the
-PVE cluster.
+{pve} cluster.
 
 pool::
 
@@ -45,7 +45,7 @@ Ceph pool name.
 
 username::
 
-RBD user ID. Optional, only needed if Ceph is not running on the PVE cluster.
+RBD user ID. Optional, only needed if Ceph is not running on the {pve} cluster.
 Note that only the user ID should be used. The "client." type prefix must be
 left out.
 
-- 
2.30.2

Re: [pve-devel] [PATCH manager] ui: rbd: cephfs: add keyring/secret field for external clusters

[Aaron Lauterer]

If this gets applied, please fix the commit title by adding the missing f in cehpFs in the last two commits... :)

On 11/26/21 17:44, Aaron Lauterer wrote:
> Manual switching of xtype because binding 'hidden' does not work with
> pmxDisplayEditField.
> 
> Signed-off-by: Aaron Lauterer <a.lauterer@proxmox.com>
> ---
>   www/manager6/storage/CephFSEdit.js | 39 ++++++++++++++++++++----------
>   www/manager6/storage/RBDEdit.js    | 11 +++++++++
>   2 files changed, 37 insertions(+), 13 deletions(-)
> 
> diff --git a/www/manager6/storage/CephFSEdit.js b/www/manager6/storage/CephFSEdit.js
> index 92fdfe63..89459ba8 100644
> --- a/www/manager6/storage/CephFSEdit.js
> +++ b/www/manager6/storage/CephFSEdit.js
> @@ -101,20 +101,33 @@ Ext.define('PVE.storage.CephFSInputPanel', {
>   	    },
>   	];
>   
> -	me.columnB = [{
> -	    xtype: 'proxmoxcheckbox',
> -	    name: 'pveceph',
> -	    reference: 'pvecephRef',
> -	    bind: {
> -		disabled: '{!pvecephPossible}',
> -		value: '{pveceph}',
> +	me.columnB = [
> +	    {
> +		xtype: me.isCreate ? 'textfield' : 'displayfield',
> +		name: 'keyring',
> +		fieldLabel: 'Secret',
> +		value: me.isCreate? '' : '***********',
> +		allowBlank: false,
> +		bind: {
> +		    hidden: '{pveceph}',
> +		    disabled: '{pveceph}',
> +		},
> +	    },
> +	    {
> +		xtype: 'proxmoxcheckbox',
> +		name: 'pveceph',
> +		reference: 'pvecephRef',
> +		bind: {
> +		    disabled: '{!pvecephPossible}',
> +		    value: '{pveceph}',
> +		},
> +		checked: true,
> +		uncheckedValue: 0,
> +		submitValue: false,
> +		hidden: !me.isCreate,
> +		boxLabel: gettext('Use Proxmox VE managed hyper-converged cephFS'),
>   	    },
> -	    checked: true,
> -	    uncheckedValue: 0,
> -	    submitValue: false,
> -	    hidden: !me.isCreate,
> -	    boxLabel: gettext('Use Proxmox VE managed hyper-converged cephFS'),
> -	}];
> +	];
>   
>   	me.callParent();
>       },
> diff --git a/www/manager6/storage/RBDEdit.js b/www/manager6/storage/RBDEdit.js
> index 35568b98..3dcfea20 100644
> --- a/www/manager6/storage/RBDEdit.js
> +++ b/www/manager6/storage/RBDEdit.js
> @@ -201,6 +201,17 @@ Ext.define('PVE.storage.RBDInputPanel', {
>   	];
>   
>   	me.columnB = [
> +	    {
> +		xtype: me.isCreate ? 'textarea' : 'displayfield',
> +		name: 'keyring',
> +		fieldLabel: 'Keyring',
> +		value: me.isCreate? '' : '***********',
> +		allowBlank: false,
> +		bind: {
> +		    hidden: '{pveceph}',
> +		    disabled: '{pveceph}',
> +		},
> +	    },
>   	    {
>   		xtype: 'proxmoxcheckbox',
>   		name: 'pveceph',
> 

Re: [pve-devel] [PATCH manager] ui: rbd: cephfs: add keyring/secret field for external clusters

[Aaron Lauterer]

ping?

Patches should still apply.

If you apply them, please fix the commit title, as I missed the F in cephfs.

On 11/26/21 17:44, Aaron Lauterer wrote:
> Manual switching of xtype because binding 'hidden' does not work with
> pmxDisplayEditField.
> 
> Signed-off-by: Aaron Lauterer <a.lauterer@proxmox.com>
> ---
>   www/manager6/storage/CephFSEdit.js | 39 ++++++++++++++++++++----------
>   www/manager6/storage/RBDEdit.js    | 11 +++++++++
>   2 files changed, 37 insertions(+), 13 deletions(-)
> 
> diff --git a/www/manager6/storage/CephFSEdit.js b/www/manager6/storage/CephFSEdit.js
> index 92fdfe63..89459ba8 100644
> --- a/www/manager6/storage/CephFSEdit.js
> +++ b/www/manager6/storage/CephFSEdit.js
> @@ -101,20 +101,33 @@ Ext.define('PVE.storage.CephFSInputPanel', {
>   	    },
>   	];
>   
> -	me.columnB = [{
> -	    xtype: 'proxmoxcheckbox',
> -	    name: 'pveceph',
> -	    reference: 'pvecephRef',
> -	    bind: {
> -		disabled: '{!pvecephPossible}',
> -		value: '{pveceph}',
> +	me.columnB = [
> +	    {
> +		xtype: me.isCreate ? 'textfield' : 'displayfield',
> +		name: 'keyring',
> +		fieldLabel: 'Secret',
> +		value: me.isCreate? '' : '***********',
> +		allowBlank: false,
> +		bind: {
> +		    hidden: '{pveceph}',
> +		    disabled: '{pveceph}',
> +		},
> +	    },
> +	    {
> +		xtype: 'proxmoxcheckbox',
> +		name: 'pveceph',
> +		reference: 'pvecephRef',
> +		bind: {
> +		    disabled: '{!pvecephPossible}',
> +		    value: '{pveceph}',
> +		},
> +		checked: true,
> +		uncheckedValue: 0,
> +		submitValue: false,
> +		hidden: !me.isCreate,
> +		boxLabel: gettext('Use Proxmox VE managed hyper-converged cephFS'),
>   	    },
> -	    checked: true,
> -	    uncheckedValue: 0,
> -	    submitValue: false,
> -	    hidden: !me.isCreate,
> -	    boxLabel: gettext('Use Proxmox VE managed hyper-converged cephFS'),
> -	}];
> +	];
>   
>   	me.callParent();
>       },
> diff --git a/www/manager6/storage/RBDEdit.js b/www/manager6/storage/RBDEdit.js
> index 35568b98..3dcfea20 100644
> --- a/www/manager6/storage/RBDEdit.js
> +++ b/www/manager6/storage/RBDEdit.js
> @@ -201,6 +201,17 @@ Ext.define('PVE.storage.RBDInputPanel', {
>   	];
>   
>   	me.columnB = [
> +	    {
> +		xtype: me.isCreate ? 'textarea' : 'displayfield',
> +		name: 'keyring',
> +		fieldLabel: 'Keyring',
> +		value: me.isCreate? '' : '***********',
> +		allowBlank: false,
> +		bind: {
> +		    hidden: '{pveceph}',
> +		    disabled: '{pveceph}',
> +		},
> +	    },
>   	    {
>   		xtype: 'proxmoxcheckbox',
>   		name: 'pveceph',

Re: [pve-devel] [PATCH manager] ui: rbd: cephfs: add keyring/secret field for external clusters

[Fabian Ebner]

Am 26.11.21 um 17:44 schrieb Aaron Lauterer:
> Manual switching of xtype because binding 'hidden' does not work with
> pmxDisplayEditField.
> 

Except for two style nits:

Reviewed-by: Fabian Ebner <f.ebner@proxmox.com>
Tested-by: Fabian Ebner <f.ebner@proxmox.com>

> Signed-off-by: Aaron Lauterer <a.lauterer@proxmox.com>
> ---
>   www/manager6/storage/CephFSEdit.js | 39 ++++++++++++++++++++----------
>   www/manager6/storage/RBDEdit.js    | 11 +++++++++
>   2 files changed, 37 insertions(+), 13 deletions(-)
> 
> diff --git a/www/manager6/storage/CephFSEdit.js b/www/manager6/storage/CephFSEdit.js
> index 92fdfe63..89459ba8 100644
> --- a/www/manager6/storage/CephFSEdit.js
> +++ b/www/manager6/storage/CephFSEdit.js
> @@ -101,20 +101,33 @@ Ext.define('PVE.storage.CephFSInputPanel', {
>   	    },
>   	];
>   
> -	me.columnB = [{
> -	    xtype: 'proxmoxcheckbox',
> -	    name: 'pveceph',
> -	    reference: 'pvecephRef',
> -	    bind: {
> -		disabled: '{!pvecephPossible}',
> -		value: '{pveceph}',
> +	me.columnB = [
> +	    {
> +		xtype: me.isCreate ? 'textfield' : 'displayfield',
> +		name: 'keyring',
> +		fieldLabel: 'Secret',

Should there be a gettext or is this enough of a technical term in this 
context?

> +		value: me.isCreate? '' : '***********',

Style nit: no space before '?' and eslint doesn't seem to catch it ;)

> +		allowBlank: false,
> +		bind: {
> +		    hidden: '{pveceph}',
> +		    disabled: '{pveceph}',
> +		},
> +	    },
> +	    {
> +		xtype: 'proxmoxcheckbox',
> +		name: 'pveceph',
> +		reference: 'pvecephRef',
> +		bind: {
> +		    disabled: '{!pvecephPossible}',
> +		    value: '{pveceph}',
> +		},
> +		checked: true,
> +		uncheckedValue: 0,
> +		submitValue: false,
> +		hidden: !me.isCreate,
> +		boxLabel: gettext('Use Proxmox VE managed hyper-converged cephFS'),
>   	    },
> -	    checked: true,
> -	    uncheckedValue: 0,
> -	    submitValue: false,
> -	    hidden: !me.isCreate,
> -	    boxLabel: gettext('Use Proxmox VE managed hyper-converged cephFS'),
> -	}];
> +	];
>   
>   	me.callParent();
>       },
> diff --git a/www/manager6/storage/RBDEdit.js b/www/manager6/storage/RBDEdit.js
> index 35568b98..3dcfea20 100644
> --- a/www/manager6/storage/RBDEdit.js
> +++ b/www/manager6/storage/RBDEdit.js
> @@ -201,6 +201,17 @@ Ext.define('PVE.storage.RBDInputPanel', {
>   	];
>   
>   	me.columnB = [
> +	    {
> +		xtype: me.isCreate ? 'textarea' : 'displayfield',
> +		name: 'keyring',
> +		fieldLabel: 'Keyring',

Same question here

> +		value: me.isCreate? '' : '***********',

and style nit here.

> +		allowBlank: false,
> +		bind: {
> +		    hidden: '{pveceph}',
> +		    disabled: '{pveceph}',
> +		},
> +	    },
>   	    {
>   		xtype: 'proxmoxcheckbox',
>   		name: 'pveceph',

Re: [pve-devel] [PATCH docs 2/3] storage: rbd: cephs: update authentication section

[Fabian Ebner]

Am 26.11.21 um 17:44 schrieb Aaron Lauterer:
> It is not needed anymore to place the keyring/secret file manually in
> the correct location as it can be done with pvesm and the GUI/API now.
> 
> Signed-off-by: Aaron Lauterer <a.lauterer@proxmox.com>
> ---
> 
> Since both sectons share the same footnote, I tried to get them to share
> the same with footnote:<id>[here some text] and footnote:<id>[] to
> reference it as explained in the asciidoc documentation [0].
> Unfortunately I did not get it to work, most likely because they are
> both in separate files?
> I rather err on having the same footnote twice than missing it in one
> place.
> 
> 
> 
> [0] https://docs.asciidoctor.org/asciidoc/latest/macros/footnote/
> 

Maybe the idea from the "Externalizing a footnote" section with using 
document attributes works?

>   pve-storage-cephfs.adoc | 31 ++++++++++++++++++-------------
>   pve-storage-rbd.adoc    | 28 +++++++++++++++++++---------
>   2 files changed, 37 insertions(+), 22 deletions(-)
> 
> diff --git a/pve-storage-cephfs.adoc b/pve-storage-cephfs.adoc
> index c67f089..2437859 100644
> --- a/pve-storage-cephfs.adoc
> +++ b/pve-storage-cephfs.adoc
> @@ -71,31 +71,36 @@ disabled.
>   Authentication
>   ~~~~~~~~~~~~~~
>   
> -If you use `cephx` authentication, which is enabled by default, you need to copy
> -the secret from your external Ceph cluster to a Proxmox VE host.
> +If you use `cephx` authentication, which is enabled by default, you need to provide
> +the secret from the external Ceph cluster.
>   
> -Create the directory `/etc/pve/priv/ceph` with
> +The secret file is expected to be located at
>   
> - mkdir /etc/pve/priv/ceph
> + /etc/pve/priv/ceph/<STORAGE_ID>.secret
>   
> -Then copy the secret
> +You can copy the secret with
>   
> - scp cephfs.secret <proxmox>:/etc/pve/priv/ceph/<STORAGE_ID>.secret
> + scp <external cephserver>:/etc/ceph/cephfs.secret /local/path/to/<STORAGE_ID>.secret

IMHO this is a bit confusing. We tell the user an explicit path where 
the key should be, and then suggest copying it to some location which 
might or might not be the same as already mentioned. After reading the 
next paragraph it might be clearer, but IMHO the structure should be "To 
add via CLI, do scp + pvesm. To add via GUI, do ...". And/or maybe make 
it clear that pvesm will put the keyring there?

>   
> -The secret must be renamed to match your `<STORAGE_ID>`. Copying the
> -secret generally requires root privileges. The file must only contain the
> -secret key itself, as opposed to the `rbd` backend which also contains a
> -`[client.userid]` section.
> +If you use the `pvesm` CLI tool to configure the external RBD storage, use the
> +`--keyring` parameter, which needs to be a path to the secret file that you
> +copied.
> +
> +When configuring an external RBD storage via the GUI, you can copy and paste
> +the secret into the appropriate field.
> +
> +The secret is only the key itself, as opposed to the `rbd` backend which also
> +contains a `[client.userid]` section.
>   
>   A secret can be received from the Ceph cluster (as Ceph admin) by issuing the
>   command below, where `userid` is the client ID that has been configured to
>   access the cluster. For further information on Ceph user management, see the
> -Ceph docs footnote:[Ceph user management
> -{cephdocs-url}/rados/operations/user-management/].
> +Ceph docs.footnote:[Ceph user management
> +{cephdocs-url}/rados/operations/user-management/]
>   
>    ceph auth get-key client.userid > cephfs.secret
>   
> -If Ceph is installed locally on the PVE cluster, that is, it was set up using
> +If Ceph is installed locally on the {pve} cluster, that is, it was set up using
>   `pveceph`, this is done automatically.
>   
>   Storage Features
> diff --git a/pve-storage-rbd.adoc b/pve-storage-rbd.adoc
> index bbc80e2..1f14b7c 100644
> --- a/pve-storage-rbd.adoc
> +++ b/pve-storage-rbd.adoc
> @@ -69,23 +69,33 @@ TIP: You can use the `rbd` utility to do low-level management tasks.
>   Authentication
>   ~~~~~~~~~~~~~~
>   
> -If you use `cephx` authentication, you need to copy the keyfile from your
> -external Ceph cluster to a Proxmox VE host.
> +If you use `cephx` authentication, which is enabled by default, you need to
> +provide the keyring from the external Ceph cluster.
>   
> -Create the directory `/etc/pve/priv/ceph` with
> +The keyring file is expected to be at

Nit: "to be located at" like above sounds better

>   
> - mkdir /etc/pve/priv/ceph
> + /etc/pve/priv/ceph/<STORAGE_ID>.keyring
>   
> -Then copy the keyring
> +You can copy the keyring with
>   
> - scp <cephserver>:/etc/ceph/ceph.client.admin.keyring /etc/pve/priv/ceph/<STORAGE_ID>.keyring
> + scp <external cephserver>:/etc/ceph/ceph.client.admin.keyring /local/path/to/<STORAGE_ID>.keyring

Same as above.

>   
> -The keyring must be named to match your `<STORAGE_ID>`. Copying the
> -keyring generally requires root privileges.
> +If you use the `pvesm` CLI tool to configure the external RBD storage, use the
> +`--keyring` parameter, which needs to be a path to the keyring file that you
> +copied.
>   
> -If Ceph is installed locally on the PVE cluster, this is done automatically by
> +When configuring an external RBD storage via the GUI, you can copy and paste the
> +keyring into the appropriate field.
> +
> +If Ceph is installed locally on the {pve} cluster, this is done automatically by
>   'pveceph' or in the GUI.
>   
> +TIP: Creating a keyring with only the needed capabilities is recommend when
> +connecting to an external cluster. For further information on Ceph user
> +management, see the Ceph docs.footnote:[Ceph user management
> +{cephdocs-url}/rados/operations/user-management/]
> +
> +
>   Storage Features
>   ~~~~~~~~~~~~~~~~
>   

[pve-devel] applied: [PATCH docs 3/3] storage: rbd: cephs: replace PVE with {pve}

[Fabian Ebner]

Am 26.11.21 um 17:44 schrieb Aaron Lauterer:
> Signed-off-by: Aaron Lauterer <a.lauterer@proxmox.com>
> ---
>   pve-storage-cephfs.adoc | 4 ++--
>   pve-storage-rbd.adoc    | 4 ++--
>   2 files changed, 4 insertions(+), 4 deletions(-)
>

applied this one, adding the missing f in the commit title, thanks!

Re: [pve-devel] [PATCH manager] ui: rbd: cephfs: add keyring/secret field for external clusters

[Aaron Lauterer]

On 1/24/22 13:54, Fabian Ebner wrote:
> Am 26.11.21 um 17:44 schrieb Aaron Lauterer:
>> Manual switching of xtype because binding 'hidden' does not work with
>> pmxDisplayEditField.
>>
> 
> Except for two style nits:
> 
> Reviewed-by: Fabian Ebner <f.ebner@proxmox.com>
> Tested-by: Fabian Ebner <f.ebner@proxmox.com>
> 
>> Signed-off-by: Aaron Lauterer <a.lauterer@proxmox.com>
>> ---
>>   www/manager6/storage/CephFSEdit.js | 39 ++++++++++++++++++++----------
>>   www/manager6/storage/RBDEdit.js    | 11 +++++++++
>>   2 files changed, 37 insertions(+), 13 deletions(-)
>>
>> diff --git a/www/manager6/storage/CephFSEdit.js b/www/manager6/storage/CephFSEdit.js
>> index 92fdfe63..89459ba8 100644
>> --- a/www/manager6/storage/CephFSEdit.js
>> +++ b/www/manager6/storage/CephFSEdit.js
>> @@ -101,20 +101,33 @@ Ext.define('PVE.storage.CephFSInputPanel', {
>>           },
>>       ];
>> -    me.columnB = [{
>> -        xtype: 'proxmoxcheckbox',
>> -        name: 'pveceph',
>> -        reference: 'pvecephRef',
>> -        bind: {
>> -        disabled: '{!pvecephPossible}',
>> -        value: '{pveceph}',
>> +    me.columnB = [
>> +        {
>> +        xtype: me.isCreate ? 'textfield' : 'displayfield',
>> +        name: 'keyring',
>> +        fieldLabel: 'Secret',
> 
> Should there be a gettext or is this enough of a technical term in this context?

That was what I thought. But some time has passed since, and I am not sure anymore if we should not place it in a gettext.

> 
>> +        value: me.isCreate? '' : '***********',
> 
> Style nit: no space before '?' and eslint doesn't seem to catch it ;)

Thanks for catching that :)

> 
>> +        allowBlank: false,
>> +        bind: {
>> +            hidden: '{pveceph}',
>> +            disabled: '{pveceph}',
>> +        },
>> +        },
>> +        {
>> +        xtype: 'proxmoxcheckbox',
>> +        name: 'pveceph',
>> +        reference: 'pvecephRef',
>> +        bind: {
>> +            disabled: '{!pvecephPossible}',
>> +            value: '{pveceph}',
>> +        },
>> +        checked: true,
>> +        uncheckedValue: 0,
>> +        submitValue: false,
>> +        hidden: !me.isCreate,
>> +        boxLabel: gettext('Use Proxmox VE managed hyper-converged cephFS'),
>>           },
>> -        checked: true,
>> -        uncheckedValue: 0,
>> -        submitValue: false,
>> -        hidden: !me.isCreate,
>> -        boxLabel: gettext('Use Proxmox VE managed hyper-converged cephFS'),
>> -    }];
>> +    ];
>>       me.callParent();
>>       },
>> diff --git a/www/manager6/storage/RBDEdit.js b/www/manager6/storage/RBDEdit.js
>> index 35568b98..3dcfea20 100644
>> --- a/www/manager6/storage/RBDEdit.js
>> +++ b/www/manager6/storage/RBDEdit.js
>> @@ -201,6 +201,17 @@ Ext.define('PVE.storage.RBDInputPanel', {
>>       ];
>>       me.columnB = [
>> +        {
>> +        xtype: me.isCreate ? 'textarea' : 'displayfield',
>> +        name: 'keyring',
>> +        fieldLabel: 'Keyring',
> 
> Same question here

Here I rather stick with the keyring as a technical term that is used for Ceph throughout. But then again, there might be a case I did not think of and putting it in a gettext is the sensible thing to do.

> 
>> +        value: me.isCreate? '' : '***********',
> 
> and style nit here.
> 
>> +        allowBlank: false,
>> +        bind: {
>> +            hidden: '{pveceph}',
>> +            disabled: '{pveceph}',
>> +        },
>> +        },
>>           {
>>           xtype: 'proxmoxcheckbox',
>>           name: 'pveceph',

Re: [pve-devel] [PATCH manager] ui: rbd: cephfs: add keyring/secret field for external clusters

[Fabian Ebner]

Am 24.01.22 um 16:26 schrieb Aaron Lauterer:
> 
> 
> On 1/24/22 13:54, Fabian Ebner wrote:
>> Am 26.11.21 um 17:44 schrieb Aaron Lauterer:
>>> Manual switching of xtype because binding 'hidden' does not work with
>>> pmxDisplayEditField.
>>>
>>
>> Except for two style nits:
>>
>> Reviewed-by: Fabian Ebner <f.ebner@proxmox.com>
>> Tested-by: Fabian Ebner <f.ebner@proxmox.com>
>>
>>> Signed-off-by: Aaron Lauterer <a.lauterer@proxmox.com>
>>> ---
>>>   www/manager6/storage/CephFSEdit.js | 39 ++++++++++++++++++++----------
>>>   www/manager6/storage/RBDEdit.js    | 11 +++++++++
>>>   2 files changed, 37 insertions(+), 13 deletions(-)
>>>
>>> diff --git a/www/manager6/storage/CephFSEdit.js 
>>> b/www/manager6/storage/CephFSEdit.js
>>> index 92fdfe63..89459ba8 100644
>>> --- a/www/manager6/storage/CephFSEdit.js
>>> +++ b/www/manager6/storage/CephFSEdit.js
>>> @@ -101,20 +101,33 @@ Ext.define('PVE.storage.CephFSInputPanel', {
>>>           },
>>>       ];
>>> -    me.columnB = [{
>>> -        xtype: 'proxmoxcheckbox',
>>> -        name: 'pveceph',
>>> -        reference: 'pvecephRef',
>>> -        bind: {
>>> -        disabled: '{!pvecephPossible}',
>>> -        value: '{pveceph}',
>>> +    me.columnB = [
>>> +        {
>>> +        xtype: me.isCreate ? 'textfield' : 'displayfield',
>>> +        name: 'keyring',
>>> +        fieldLabel: 'Secret',
>>
>> Should there be a gettext or is this enough of a technical term in 
>> this context?
> 
> That was what I thought. But some time has passed since, and I am not 
> sure anymore if we should not place it in a gettext.
> 

Ok, so since .keyring and .secret are also the file extensions, it's 
likely better to not use gettext. But if we were to put "Secret" in 
gettext, I'd rather use "Secret Key".

>>
>>> +        value: me.isCreate? '' : '***********',
>>
>> Style nit: no space before '?' and eslint doesn't seem to catch it ;)
> 
> Thanks for catching that :)
> 
>>
>>> +        allowBlank: false,
>>> +        bind: {
>>> +            hidden: '{pveceph}',
>>> +            disabled: '{pveceph}',
>>> +        },
>>> +        },
>>> +        {
>>> +        xtype: 'proxmoxcheckbox',
>>> +        name: 'pveceph',
>>> +        reference: 'pvecephRef',
>>> +        bind: {
>>> +            disabled: '{!pvecephPossible}',
>>> +            value: '{pveceph}',
>>> +        },
>>> +        checked: true,
>>> +        uncheckedValue: 0,
>>> +        submitValue: false,
>>> +        hidden: !me.isCreate,
>>> +        boxLabel: gettext('Use Proxmox VE managed hyper-converged 
>>> cephFS'),
>>>           },
>>> -        checked: true,
>>> -        uncheckedValue: 0,
>>> -        submitValue: false,
>>> -        hidden: !me.isCreate,
>>> -        boxLabel: gettext('Use Proxmox VE managed hyper-converged 
>>> cephFS'),
>>> -    }];
>>> +    ];
>>>       me.callParent();
>>>       },
>>> diff --git a/www/manager6/storage/RBDEdit.js 
>>> b/www/manager6/storage/RBDEdit.js
>>> index 35568b98..3dcfea20 100644
>>> --- a/www/manager6/storage/RBDEdit.js
>>> +++ b/www/manager6/storage/RBDEdit.js
>>> @@ -201,6 +201,17 @@ Ext.define('PVE.storage.RBDInputPanel', {
>>>       ];
>>>       me.columnB = [
>>> +        {
>>> +        xtype: me.isCreate ? 'textarea' : 'displayfield',
>>> +        name: 'keyring',
>>> +        fieldLabel: 'Keyring',
>>
>> Same question here
> 
> Here I rather stick with the keyring as a technical term that is used 
> for Ceph throughout. But then again, there might be a case I did not 
> think of and putting it in a gettext is the sensible thing to do.
> 
>>
>>> +        value: me.isCreate? '' : '***********',
>>
>> and style nit here.
>>
>>> +        allowBlank: false,
>>> +        bind: {
>>> +            hidden: '{pveceph}',
>>> +            disabled: '{pveceph}',
>>> +        },
>>> +        },
>>>           {
>>>           xtype: 'proxmoxcheckbox',
>>>           name: 'pveceph',

Re: [pve-devel] [PATCH docs 2/3] storage: rbd: cephs: update authentication section

[Aaron Lauterer]

On 1/24/22 14:48, Fabian Ebner wrote:
> Am 26.11.21 um 17:44 schrieb Aaron Lauterer:
>> It is not needed anymore to place the keyring/secret file manually in
>> the correct location as it can be done with pvesm and the GUI/API now.
>>
>> Signed-off-by: Aaron Lauterer <a.lauterer@proxmox.com>
>> ---
>>
>> Since both sectons share the same footnote, I tried to get them to share
>> the same with footnote:<id>[here some text] and footnote:<id>[] to
>> reference it as explained in the asciidoc documentation [0].
>> Unfortunately I did not get it to work, most likely because they are
>> both in separate files?
>> I rather err on having the same footnote twice than missing it in one
>> place.
>>
>>
>>
>> [0] https://docs.asciidoctor.org/asciidoc/latest/macros/footnote/
>>
> 
> Maybe the idea from the "Externalizing a footnote" section with using document attributes works?

Turns out that there is asciidoc and asciidoctor. We use the former, but searching the internet will result in more prominent results for the latter in my experience. They do have slightly different syntax.
With that realization and using the correct documentation ( https://asciidoc-py.github.io/userguide.html#X92 ) it is working now.

> 
>>   pve-storage-cephfs.adoc | 31 ++++++++++++++++++-------------
>>   pve-storage-rbd.adoc    | 28 +++++++++++++++++++---------
>>   2 files changed, 37 insertions(+), 22 deletions(-)
>>
>> diff --git a/pve-storage-cephfs.adoc b/pve-storage-cephfs.adoc
>> index c67f089..2437859 100644
>> --- a/pve-storage-cephfs.adoc
>> +++ b/pve-storage-cephfs.adoc
>> @@ -71,31 +71,36 @@ disabled.
>>   Authentication
>>   ~~~~~~~~~~~~~~
>> -If you use `cephx` authentication, which is enabled by default, you need to copy
>> -the secret from your external Ceph cluster to a Proxmox VE host.
>> +If you use `cephx` authentication, which is enabled by default, you need to provide
>> +the secret from the external Ceph cluster.
>> -Create the directory `/etc/pve/priv/ceph` with
>> +The secret file is expected to be located at
>> - mkdir /etc/pve/priv/ceph
>> + /etc/pve/priv/ceph/<STORAGE_ID>.secret
>> -Then copy the secret
>> +You can copy the secret with
>> - scp cephfs.secret <proxmox>:/etc/pve/priv/ceph/<STORAGE_ID>.secret
>> + scp <external cephserver>:/etc/ceph/cephfs.secret /local/path/to/<STORAGE_ID>.secret
> 
> IMHO this is a bit confusing. We tell the user an explicit path where the key should be, and then suggest copying it to some location which might or might not be the same as already mentioned. After reading the next paragraph it might be clearer, but IMHO the structure should be "To add via CLI, do scp + pvesm. To add via GUI, do ...". And/or maybe make it clear that pvesm will put the keyring there?
> 
>> -The secret must be renamed to match your `<STORAGE_ID>`. Copying the
>> -secret generally requires root privileges. The file must only contain the
>> -secret key itself, as opposed to the `rbd` backend which also contains a
>> -`[client.userid]` section.
>> +If you use the `pvesm` CLI tool to configure the external RBD storage, use the
>> +`--keyring` parameter, which needs to be a path to the secret file that you
>> +copied.
>> +
>> +When configuring an external RBD storage via the GUI, you can copy and paste
>> +the secret into the appropriate field.
>> +
>> +The secret is only the key itself, as opposed to the `rbd` backend which also
>> +contains a `[client.userid]` section.
>>   A secret can be received from the Ceph cluster (as Ceph admin) by issuing the
>>   command below, where `userid` is the client ID that has been configured to
>>   access the cluster. For further information on Ceph user management, see the
>> -Ceph docs footnote:[Ceph user management
>> -{cephdocs-url}/rados/operations/user-management/].
>> +Ceph docs.footnote:[Ceph user management
>> +{cephdocs-url}/rados/operations/user-management/]
>>    ceph auth get-key client.userid > cephfs.secret
>> -If Ceph is installed locally on the PVE cluster, that is, it was set up using
>> +If Ceph is installed locally on the {pve} cluster, that is, it was set up using
>>   `pveceph`, this is done automatically.
>>   Storage Features
>> diff --git a/pve-storage-rbd.adoc b/pve-storage-rbd.adoc
>> index bbc80e2..1f14b7c 100644
>> --- a/pve-storage-rbd.adoc
>> +++ b/pve-storage-rbd.adoc
>> @@ -69,23 +69,33 @@ TIP: You can use the `rbd` utility to do low-level management tasks.
>>   Authentication
>>   ~~~~~~~~~~~~~~
>> -If you use `cephx` authentication, you need to copy the keyfile from your
>> -external Ceph cluster to a Proxmox VE host.
>> +If you use `cephx` authentication, which is enabled by default, you need to
>> +provide the keyring from the external Ceph cluster.
>> -Create the directory `/etc/pve/priv/ceph` with
>> +The keyring file is expected to be at
> 
> Nit: "to be located at" like above sounds better
> 
>> - mkdir /etc/pve/priv/ceph
>> + /etc/pve/priv/ceph/<STORAGE_ID>.keyring
>> -Then copy the keyring
>> +You can copy the keyring with
>> - scp <cephserver>:/etc/ceph/ceph.client.admin.keyring /etc/pve/priv/ceph/<STORAGE_ID>.keyring
>> + scp <external cephserver>:/etc/ceph/ceph.client.admin.keyring /local/path/to/<STORAGE_ID>.keyring
> 
> Same as above.
> 
>> -The keyring must be named to match your `<STORAGE_ID>`. Copying the
>> -keyring generally requires root privileges.
>> +If you use the `pvesm` CLI tool to configure the external RBD storage, use the
>> +`--keyring` parameter, which needs to be a path to the keyring file that you
>> +copied.
>> -If Ceph is installed locally on the PVE cluster, this is done automatically by
>> +When configuring an external RBD storage via the GUI, you can copy and paste the
>> +keyring into the appropriate field.
>> +
>> +If Ceph is installed locally on the {pve} cluster, this is done automatically by
>>   'pveceph' or in the GUI.
>> +TIP: Creating a keyring with only the needed capabilities is recommend when
>> +connecting to an external cluster. For further information on Ceph user
>> +management, see the Ceph docs.footnote:[Ceph user management
>> +{cephdocs-url}/rados/operations/user-management/]
>> +
>> +
>>   Storage Features
>>   ~~~~~~~~~~~~~~~~