Bug 2196858 - [RFE] Add role capability in rados user in ODF via rook
Summary: [RFE] Add role capability in rados user in ODF via rook
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat OpenShift Data Foundation
Classification: Red Hat Storage
Component: rook
Version: 4.12
Hardware: x86_64
OS: Linux
unspecified
medium
Target Milestone: ---
: ODF 4.15.0
Assignee: Jiffin
QA Contact: Uday kurundwade
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2023-05-10 14:41 UTC by Sonal
Modified: 2024-03-19 15:21 UTC (History)
7 users (show)

Fixed In Version: 4.15.0-103
Doc Type: Enhancement
Doc Text:
.Role capability for CephObjectStoreUser The CephOjbectStoreUser can create roles by assigning role capability.
Clone Of:
Environment:
Last Closed: 2024-03-19 15:21:05 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2024:1383 0 None None None 2024-03-19 15:21:09 UTC

Description Sonal 2023-05-10 14:41:00 UTC
Description of problem (please be detailed as possible and provide log
snippests):

Currently  CephObjectStoreUser CRD  does not support adding role capability to a rados user. It only supports below caps:

users, buckets, usage, metadata and zone.

Doc : https://rook.io/docs/rook/v1.11/CRDs/Object-Storage/ceph-object-store-user-crd/#spec

Hence, on creating a user with role caps, got below error:

cat test-user-role-caps.yaml
~~~ 
apiVersion: ceph.rook.io/v1
kind: CephObjectStoreUser
metadata:
  name: test-3
  namespace: openshift-storage
spec:
  store: ocs-storagecluster-cephobjectstore
  displayName: test user
  capabilities:
    user: "*"
    bucket: "*"
    roles: "*"
~~~

~~~
oc create -f test-user-role-caps.yaml
W0509 21:01:22.957291  264117 warnings.go:70] unknown field "spec.capabilities.roles"
cephobjectstoreuser.ceph.rook.io/test-3 created
~~~

This RFE is to implement role caps feature in rook.


Version of all relevant components (if applicable):
ODF 4.12

Does this issue impact your ability to continue to work with the product
(please explain in detail what is the user impact)?
No, since there is a workaround.

Is there any workaround available to the best of your knowledge?
Add role caps using radosgw-admin command:
radosgw-admin caps add --uid=<username> --caps="roles=*"

Rate from 1 - 5 the complexity of the scenario you performed that caused this
bug (1 - very simple, 5 - very complex)?
1

Can this issue reproducible?
Yes

Can this issue reproduce from the UI?
Yes

If this is a regression, please provide more details to justify this:
No

Steps to Reproduce:
1. Use above shared yaml to create user with role caps using CephObjectStoreUser CRD
2. The user got created successfully, however without caps.


Actual results:
Got error `unknown field "spec.capabilities.roles"` on adding role caps to user

Expected results:
CephObjectStoreUser CRD  should support adding role capability to a rados user.

Additional info:
-

Comment 19 errata-xmlrpc 2024-03-19 15:21:05 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Important: Red Hat OpenShift Data Foundation 4.15.0 security, enhancement, & bug fix update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2024:1383


Note You need to log in before you can comment on or make changes to this bug.