Bug 1973355

Summary:	[RFE] Change manila ceph client user capabilities for OSP 17
Product:	Red Hat OpenStack	Reporter:	Goutham Pacha Ravi <gouthamr>
Component:	tripleo-ansible	Assignee:	RHOS Maint <rhos-maint>
Status:	CLOSED DUPLICATE	QA Contact:	Joe H. Rahme <jhakimra>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	17.0 (Wallaby)
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	All
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-06-17 16:57:28 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Goutham Pacha Ravi 2021-06-17 16:45:30 UTC

Description of problem:

The manila CephFS drivers (Native CephFS and CephFS-via-NFS-Ganesha) saw a major revamp in the wallaby release. They now interact with Ceph clusters via the Ceph Manager "Volumes" interface. To do this, the ceph client user configured for manila no longer needs to be as permissive as it was in the past. 


Old Capabilities: https://opendev.org/openstack/tripleo-ansible/src/commit/4ce6fda21b08bfcb8cfa319e7522fb9eb19c0178/tripleo_ansible/roles/tripleo_ceph_work_dir/tasks/build_keys.yml#L39-L45


New Capabilities required are documented here:
https://docs.openstack.org/manila/latest/admin/cephfs_driver.html#authorizing-the-driver-to-communicate-with-ceph


Fixing these capabilities will make our deployments more secure and prevent any abuse via the manila service ceph client user. 


Version-Release number of selected component (if applicable): 17

Comment 1 Goutham Pacha Ravi 2021-06-17 16:57:28 UTC


*** This bug has been marked as a duplicate of bug 1973356 ***