Bug 1464955 - [RFE] Simplified CephFS client key creation
[RFE] Simplified CephFS client key creation
Status: CLOSED ERRATA
Product: Red Hat Ceph Storage
Classification: Red Hat
Component: CephFS (Show other bugs)
3.0
Unspecified Unspecified
urgent Severity urgent
: rc
: 3.0
Assigned To: Patrick Donnelly
Ramakrishnan Periyasamy
Bara Ancincova
: FutureFeature
Depends On:
Blocks: 1494421
  Show dependency treegraph
 
Reported: 2017-06-26 05:50 EDT by John Spray
Modified: 2017-12-05 18:34 EST (History)
9 users (show)

See Also:
Fixed In Version: RHEL: ceph-12.1.4-1.el7cp Ubuntu: ceph_12.1.4-2redhat1xenial
Doc Type: Enhancement
Doc Text:
.Simplified creation of CephFS client keyring A new command, `ceph fs authorize`, is now supported. The command simplifies creation of `cephx` capabilities for a Ceph File System (CephFS) client user. For example, to grant the `client.1` user read and write access to MDS nodes and read access to Monitor and OSD nodes on a Ceph File System named `cephfs`: ---- # ceph fs authorize cephfs client.1 rw r ---- Use this command only when creating new users. It is not possible to modify existing users with `ceph fs authorize`.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2017-12-05 18:34:34 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Ceph Project Bug Tracker 20885 None None None 2017-08-02 15:42 EDT

  None (edit)
Description John Spray 2017-06-26 05:50:49 EDT
Instead of user having to manually write out auth caps syntax, provide a command that allows them to grant access to a client ID by filesystem name.
Comment 5 dfuller 2017-08-02 11:44:31 EDT
Upstream ticket: http://tracker.ceph.com/issues/20885
Comment 6 Ken Dreyer (Red Hat) 2017-08-07 13:31:17 EDT
We need a new upstream point release since this PR landed after v12.1.2 was tagged.
Comment 10 Ramakrishnan Periyasamy 2017-09-20 16:52:43 EDT
Moving this bug to verified state.

Command used for verification

[ubuntu@host028 ~]$ sudo ceph --cluster qetest fs authorize cephfs client.fs rw r
[client.fs]
	key = AQDO1MJZU4JtOBAAvBocj+CzsNDp3Cogk2FsMw==
Comment 11 Ramakrishnan Periyasamy 2017-09-20 16:58:26 EDT
The caps created by the command

[ubuntu@host028 ~]$ sudo ceph --cluster qetest fs authorize cephfs client.fs rw r
[client.fs]
	key = AQDO1MJZU4JtOBAAvBocj+CzsNDp3Cogk2FsMw==

[ubuntu@host028 ~]$ sudo ceph --cluster qetest auth get client.fs
exported keyring for client.fs
[client.fs]
	key = AQDO1MJZU4JtOBAAvBocj+CzsNDp3Cogk2FsMw==
	caps mds = "allow r path=rw"
	caps mon = "allow r"
	caps osd = "allow r pool=cephfs_data"

Command: ceph fs authorize <fs_name> <entity> <caps>
Comment 17 errata-xmlrpc 2017-12-05 18:34:34 EST
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:3387

Note You need to log in before you can comment on or make changes to this bug.