Comment 1 for bug 1696073

For me caps: [osd] allow class-read object_prefix rbd_children, allow rwx pool=glance
was needed. This is the ceph suggested way os using cephx authentication.
http://docs.ceph.com/docs/master/rbd/rbd-openstack/#setup-ceph-client-authentication