How to create initial set of S3 credentials?

[JanJaguschQC]

I'm following the quick start guide and have already spun up an Ozone container. However, when trying to execute aws s3api --endpoint http://localhost:9878/ create-bucket --bucket=wordcount I'm asked to provide credentials:

Unable to locate credentials. You can configure credentials by running "aws configure".

It's not clear to me how I can generate these credentials. I can't find any information about this topic in the documentation.

So my question is: What's the easiest way to generate a pair of admin credentials that let me create a bucket in Ozone?

Any help is appreciated. 🙏

[swagle]

Hi @JanJaguschQC, take a look at the security section in the Ozone website here:
https://ozone.apache.org/docs/edge/interface/s3.html

[swagle]

If security is not enabled you can set it as anything.
export AWS_ACCESS_KEY_ID=testuser/scm@EXAMPLE.COM
export AWS_SECRET_ACCESS_KEY=xyz

[JanJaguschQC]

Thank you!

[pjotrek-b]

Thank you very much! 🍰
Is this mentioned somewhere in the documentation? I must have overlooked it.

[vishrantgupta]

If ozone.security is enabled how to set s3 credentials? AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY, after enabling ozone.security I am getting the following error:

SIMPLE authentication method not supported. S3G user login failed.

[errose28]

Check out the "Security" section on the S3 page. Once you've authenticated with Kerberos you can use ozone s3 getsecret to get the information and then assign it to the environment variables so the aws CLI can read it.

[vishrantgupta]

I am deploying Apache Ozone in k8s and I was expecting there would be a way to preconfigure the Apache Ozone cluster with the credentials specified in the helm chart. @errose28

[errose28]

I'm not very familiar with Kubernetes, but perhaps some of the contributors to the new Ozone Helm Charts repo like @dnskr or @pyttel could help here.

[pyttel]

Hi :)

In my opinion, this process can be automated using a Helm chart. The idea would be to have a configuration in the values.yaml to enable S3G security. If this is set, a new init container should be started, which should check for an already known password in the secrets. If not, the container should initialize the authentication and generate the final Kubernetes secret. There are some tricky parts to this, but it should work. All values for the initial authentication can be shared by another secret configured in the Helm values.yaml.

I suggest opening a ticket in Jira. There we can discuss the details, and I can provide a patch when I have time. I enjoy improving things that I use for our company's solutions. However, we should discuss the specifics with the Ozone people :)

[dnskr]

We also can implement it with periodically executing jobs to keep Ozone in-sync with manually managed secrets. Let's create a ticket as @pyttel suggests and discuss the implementation options.