Bug 2144067: core: Read mon secret from file instead of env var

[travisn]

Description of your changes:
Environment variables are not recommended for secrets in pods since they can be easily leaked if the environemnt variables are logged. By mounting the mon secret as a file, the mgr and osd prepare pods can read the mon secret from a file for better security.

This in addition to rook#11331 should mean rook is compliant with not using the secrets.

The one exception to this is that the CSI driver and many of the Ceph pods mount the rook-ceph-config secret, but it does not contain confidential information. The secret only contains the mon endpoints, which is necessary to save as a secret for the csi driver.

Which issue is resolved by this Pull Request:
Resolves #https://bugzilla.redhat.com/show_bug.cgi?id=2144067

Checklist:

• Commit Message Formatting: Commit titles and messages follow guidelines in the developer guide).
• Skip Tests for Docs: If this is only a documentation change, add the label skip-ci on the PR.
• Reviewed the developer guide on Submitting a Pull Request
• Pending release notes updated with breaking and/or notable changes for the next minor release.
• Documentation has been updated, if necessary.
• Unit tests have been added, if necessary.
• Integration tests have been added, if necessary.

[openshift-ci]

@travisn: An error was encountered searching for bug 2144067 on the Bugzilla server at https://bugzilla.redhat.com. No known errors were detected, please see the full error message for details.

Full error message.

response code 401 not 200

Please contact an administrator to resolve this issue, then request a bug refresh with /bugzilla refresh.

In response to this:

Bug 2144067: core: Read mon secret from file instead of env var

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: travisn

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [travisn]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@travisn: An error was encountered searching for bug 2144067 on the Bugzilla server at https://bugzilla.redhat.com. No known errors were detected, please see the full error message for details.

Full error message.

response code 401 not 200

Please contact an administrator to resolve this issue, then request a bug refresh with /bugzilla refresh.

In response to this:

Bug 2144067: core: Read mon secret from file instead of env var

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[travisn]

/cherry-pick release-4.11

[travisn]

/cherry-pick release-4.10

[openshift-cherrypick-robot]

@travisn: #441 failed to apply on top of branch "release-4.11":

Applying: core: read mon secret from file instead of env var
Using index info to reconstruct a base tree...
M	cmd/rook/ceph/osd.go
M	pkg/operator/ceph/cluster/mgr/spec.go
M	pkg/operator/ceph/cluster/mon/env.go
M	pkg/operator/ceph/cluster/osd/envs.go
M	pkg/operator/ceph/cluster/osd/provision_spec.go
Falling back to patching base and 3-way merge...
Auto-merging pkg/operator/ceph/cluster/osd/provision_spec.go
Auto-merging pkg/operator/ceph/cluster/osd/envs.go
CONFLICT (content): Merge conflict in pkg/operator/ceph/cluster/osd/envs.go
Auto-merging pkg/operator/ceph/cluster/mon/env.go
Auto-merging pkg/operator/ceph/cluster/mgr/spec.go
Auto-merging cmd/rook/ceph/osd.go
CONFLICT (content): Merge conflict in cmd/rook/ceph/osd.go
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
Patch failed at 0001 core: read mon secret from file instead of env var
When you have resolved this problem, run "git am --continue".
If you prefer to skip this patch, run "git am --skip" instead.
To restore the original branch and stop patching, run "git am --abort".

In response to this:

/cherry-pick release-4.11

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[openshift-cherrypick-robot]

@travisn: #441 failed to apply on top of branch "release-4.10":

Applying: core: read mon secret from file instead of env var
Using index info to reconstruct a base tree...
M	cmd/rook/ceph/osd.go
M	pkg/operator/ceph/cluster/mgr/spec.go
M	pkg/operator/ceph/cluster/mon/config.go
M	pkg/operator/ceph/cluster/mon/env.go
M	pkg/operator/ceph/cluster/osd/envs.go
M	pkg/operator/ceph/cluster/osd/provision_spec.go
Falling back to patching base and 3-way merge...
Auto-merging pkg/operator/ceph/cluster/osd/provision_spec.go
Auto-merging pkg/operator/ceph/cluster/osd/envs.go
CONFLICT (content): Merge conflict in pkg/operator/ceph/cluster/osd/envs.go
Auto-merging pkg/operator/ceph/cluster/mon/env.go
CONFLICT (content): Merge conflict in pkg/operator/ceph/cluster/mon/env.go
Auto-merging pkg/operator/ceph/cluster/mon/config.go
CONFLICT (content): Merge conflict in pkg/operator/ceph/cluster/mon/config.go
Auto-merging pkg/operator/ceph/cluster/mgr/spec.go
Auto-merging cmd/rook/ceph/osd.go
CONFLICT (content): Merge conflict in cmd/rook/ceph/osd.go
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
Patch failed at 0001 core: read mon secret from file instead of env var
When you have resolved this problem, run "git am --continue".
If you prefer to skip this patch, run "git am --skip" instead.
To restore the original branch and stop patching, run "git am --abort".

In response to this:

/cherry-pick release-4.10

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.