Description of problem: While testing user rate limits and quotas we found that things are enforced properly when using a user's access key + secret directly, but when they assume a role they are no longer limited. In both cases the user statistics are updated correctly, so all actions are being credited back to the original user as expected and only the rate limit/quota enforcement is being bypassed. Version-Release number of selected component (if applicable): ceph 18.2.0-192 / 7.0z2 How reproducible: Always Steps to Reproduce (see detailed steps in 1st comment): -- Create LimitTest user, max ten objects -- Set quota to 10 objects -- Set limit to 10 operations / minute -- Create LimitRole role (Assume policy:) -- Create role policy that allows all actions Actual results: The quota/rate limit is not enforced when role is changed. Expected results: The quota/rate limits enforcement should persist when role is changed. Additional info:
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Red Hat Ceph Storage 7.1 security and bug fix update.), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2024:5080
The needinfo request[s] on this closed bug have been removed as they have been unresolved for 120 days