wrong ceph capabailities for manila user

Bug #1713928 reported by Jan Provaznik
10
This bug affects 1 person
Affects Status Importance Assigned to Milestone
tripleo
Fix Released
High
Jan Provaznik

Bug Description

After deploying overcloud with ceph-ansible with manila, manila ceph driver can not connect to the ceph cluster (access denied), the reason is that capabilities for manila user are misconfigured:

# ceph auth list
client.manila
 key: AQCgNZ1ZAAAAABAAvOESAeVm1nnEV2QERRX47Q==
 caps: [mds] allow *
 caps: [mon] allow r, allow command auth del, allow command auth caps, allow command auth get, allow command auth get-or-create
 caps: [osd] allow rw

but should be:
client.manila
 key: AQCgNZ1ZAAAAABAAvOESAeVm1nnEV2QERRX47Q==
 caps: [mds] allow *
 caps: [mon] allow r, allow command="auth del", allow command="auth caps", allow command="auth get", allow command="auth get-or-create"
 caps: [osd] allow class-read object_prefix rbd_children, allow rwx pool=cephfs_data, allow rwx pool=cephfs_metadata

The problem will be in unescaped caps in THT:
https://github.com/openstack/tripleo-heat-templates/blob/master/docker/services/ceph-ansible/ceph-base.yaml#L243

should be same as here:
https://github.com/openstack/tripleo-heat-templates/blob/master/puppet/services/ceph-base.yaml#L147

Changed in tripleo:
importance: Undecided → Medium
importance: Medium → High
assignee: nobody → Jan Provaznik (jan-provaznik)
Changed in tripleo:
status: New → Confirmed
Changed in tripleo:
milestone: none → queens-1
status: Confirmed → Triaged
tags: added: pike-backport-potential
Changed in tripleo:
milestone: queens-1 → queens-2
Changed in tripleo:
milestone: queens-2 → queens-3
Revision history for this message
Tom Barron (tpb) wrote :
Changed in tripleo:
status: Triaged → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.