[SRU] manilaclient.common.apiclient.exceptions.Forbidden: Access was denied to this resource. (HTTP 403)

[Corey Bryant]

[Description]

2021-11-29 19:26:53.581540 | focal-medium | File "/home/ubuntu/src/review.opendev.org/openstack/charm-manila-ganesha/build/builds/manila-ganesha/.tox/func-target/lib/python3.8/site-packages/zaza/openstack/charm_tests/manila_ganesha/setup.py", line 40, in setup_ganesha_share_type
2021-11-29 19:26:53.581579 | focal-medium | manila_client.share_types.create

results in:
manilaclient.common.apiclient.exceptions.Forbidden: Access was denied to this resource. (HTTP 403)

This occurs on wallaby and above as seen here:
https://review.opendev.org/c/openstack/charm-manila-ganesha/+/816032

2021-11-29 19:26:53.195961 | focal-medium | 2021-11-29 19:26:53 [ERROR] {'default_alias': 'zaza-6aadc5ce9f9b'}
2021-11-29 19:26:53.196094 | focal-medium | 2021-11-29 19:26:53 [ERROR] Model default_alias (zaza-6aadc5ce9f9b)
2021-11-29 19:26:53.581038 | focal-medium | Traceback (most recent call last):
2021-11-29 19:26:53.581121 | focal-medium | File "/home/ubuntu/src/review.opendev.org/openstack/charm-manila-ganesha/build/builds/manila-ganesha/.tox/func-target/bin/functest-run-suite", line 8, in <module>
2021-11-29 19:26:53.581157 | focal-medium | sys.exit(main())
2021-11-29 19:26:53.581206 | focal-medium | File "/home/ubuntu/src/review.opendev.org/openstack/charm-manila-ganesha/build/builds/manila-ganesha/.tox/func-target/lib/python3.8/site-packages/zaza/charm_lifecycle/func_test_runner.py", line 374, in main
2021-11-29 19:26:53.581248 | focal-medium | func_test_runner(
2021-11-29 19:26:53.581276 | focal-medium | File "/home/ubuntu/src/review.opendev.org/openstack/charm-manila-ganesha/build/builds/manila-ganesha/.tox/func-target/lib/python3.8/site-packages/zaza/charm_lifecycle/func_test_runner.py", line 287, in func_test_runner
2021-11-29 19:26:53.581312 | focal-medium | run_env_deployment(env_deployment, keep_model=preserve_model,
2021-11-29 19:26:53.581332 | focal-medium | File "/home/ubuntu/src/review.opendev.org/openstack/charm-manila-ganesha/build/builds/manila-ganesha/.tox/func-target/lib/python3.8/site-packages/zaza/charm_lifecycle/func_test_runner.py", line 155, in run_env_deployment
2021-11-29 19:26:53.581347 | focal-medium | configure.configure(
2021-11-29 19:26:53.581385 | focal-medium | File "/home/ubuntu/src/review.opendev.org/openstack/charm-manila-ganesha/build/builds/manila-ganesha/.tox/func-target/lib/python3.8/site-packages/zaza/charm_lifecycle/configure.py", line 58, in configure
2021-11-29 19:26:53.581426 | focal-medium | run_configure_list(functions)
2021-11-29 19:26:53.581446 | focal-medium | File "/usr/lib/python3.8/contextlib.py", line 75, in inner
2021-11-29 19:26:53.581460 | focal-medium | return func(*args, **kwds)
2021-11-29 19:26:53.581486 | focal-medium | File "/home/ubuntu/src/review.opendev.org/openstack/charm-manila-ganesha/build/builds/manila-ganesha/.tox/func-target/lib/python3.8/site-packages/zaza/charm_lifecycle/configure.py", line 44, in run_configure_list
2021-11-29 19:26:53.581521 | focal-medium | utils.get_class(func)()
2021-11-29 19:26:53.581540 | focal-medium | File "/home/ubuntu/src/review.opendev.org/openstack/charm-manila-ganesha/build/builds/manila-ganesha/.tox/func-target/lib/python3.8/site-packages/zaza/openstack/charm_tests/manila_ganesha/setup.py", line 40, in setup_ganesha_share_type
2021-11-29 19:26:53.581579 | focal-medium | manila_client.share_types.create(
2021-11-29 19:26:53.581597 | focal-medium | File "/home/ubuntu/src/review.opendev.org/openstack/charm-manila-ganesha/build/builds/manila-ganesha/.tox/func-target/lib/python3.8/site-packages/manilaclient/api_versions.py", line 399, in substitution
2021-11-29 19:26:53.581623 | focal-medium | return method.func(obj, *args, **kwargs)
2021-11-29 19:26:53.581639 | focal-medium | File "/home/ubuntu/src/review.opendev.org/openstack/charm-manila-ganesha/build/builds/manila-ganesha/.tox/func-target/lib/python3.8/site-packages/manilaclient/v2/share_types.py", line 207, in create
2021-11-29 19:26:53.581653 | focal-medium | return self._do_create(
2021-11-29 19:26:53.581667 | focal-medium | File "/home/ubuntu/src/review.opendev.org/openstack/charm-manila-ganesha/build/builds/manila-ganesha/.tox/func-target/lib/python3.8/site-packages/manilaclient/v2/share_types.py", line 169, in _do_create
2021-11-29 19:26:53.581681 | focal-medium | return self._create("/types", body, "share_type")
2021-11-29 19:26:53.581695 | focal-medium | File "/home/ubuntu/src/review.opendev.org/openstack/charm-manila-ganesha/build/builds/manila-ganesha/.tox/func-target/lib/python3.8/site-packages/manilaclient/base.py", line 161, in _create
2021-11-29 19:26:53.581709 | focal-medium | resp, body = self.api.client.post(url, body=body)
2021-11-29 19:26:53.581722 | focal-medium | File "/home/ubuntu/src/review.opendev.org/openstack/charm-manila-ganesha/build/builds/manila-ganesha/.tox/func-target/lib/python3.8/site-packages/manilaclient/common/httpclient.py", line 177, in post
2021-11-29 19:26:53.581736 | focal-medium | return self._cs_request(url, 'POST', **kwargs)
2021-11-29 19:26:53.581772 | focal-medium | File "/home/ubuntu/src/review.opendev.org/openstack/charm-manila-ganesha/build/builds/manila-ganesha/.tox/func-target/lib/python3.8/site-packages/manilaclient/common/httpclient.py", line 133, in _cs_request
2021-11-29 19:26:53.581795 | focal-medium | return self._cs_request_with_retries(
2021-11-29 19:26:53.581833 | focal-medium | File "/home/ubuntu/src/review.opendev.org/openstack/charm-manila-ganesha/build/builds/manila-ganesha/.tox/func-target/lib/python3.8/site-packages/manilaclient/common/httpclient.py", line 150, in _cs_request_with_retries
2021-11-29 19:26:53.581865 | focal-medium | resp, body = self.request(url, method, **kwargs)
2021-11-29 19:26:53.581890 | focal-medium | File "/home/ubuntu/src/review.opendev.org/openstack/charm-manila-ganesha/build/builds/manila-ganesha/.tox/func-target/lib/python3.8/site-packages/manilaclient/common/httpclient.py", line 128, in request
2021-11-29 19:26:53.581922 | focal-medium | raise exceptions.from_response(resp, method, url)
2021-11-29 19:26:53.581942 | focal-medium | manilaclient.common.apiclient.exceptions.Forbidden: Access was denied to this resource. (HTTP 403) (Request-ID: req-a4afca0f-3696-488f-be07-4fcb5f1742c6)

For the manila package, we are still installing an old policy.json file.
Manila moved away from using a policy.json file for RBAC in favor of using a policy.yaml file in the wallaby release [1]. In fact, this policy.yaml file
is only used to override the default policy, which is in the manila code base itself. Therefore the package doesn't need to install any policy files.
[1] https://opendev.org/openstack/manila/src/branch/master/releasenotes/notes/deprecate-json-formatted-policy-file-fd0345f215e6ccd5.yaml

[Test Case]
The manila-ganesha charm tests will be run as they are currently hitting this failure. The charm tests create a manila share, create 2 openstack instances, mount the share to those instances and tests writing/reading the share.

https://opendev.org/openstack/charm-manila-ganesha/src/branch/master/src/tests/tests.yaml
https://github.com/openstack-charmers/zaza-openstack-tests/blob/master/zaza/openstack/charm_tests/manila_ganesha/tests.py
https://github.com/openstack-charmers/zaza-openstack-tests/blob/master/zaza/openstack/charm_tests/manila/tests.py

[Regression Potential]
The default package install is broken with the policy.json that we are installing. Worth noting, the policy.json file was deprecated in the wallaby release and the changes in this SRU are limited to the wallaby+1 release and up (ie. xena+).

The regression potential here is that an upgrade to this new package version will move the deprecated /etc/manila/policy.json /etc/manila/disabled.policy.json.old in it's postinst script. Therefore the deprecated policy.json file will no longer be in force, but will still be available. The policy that will be in force is the default policy that is coded into the manila code base.

[Discussion]
The manila-ganesha charm also requires a change to add ceph mgr capabilities for the manila cephfs driver to allow it to run rados commands.

[Corey Bryant (corey.bryant)]

charm-manila-netapp seems to be hitting the same issue:
https://review.opendev.org/c/openstack/charm-manila-netapp/+/828161
https://openstack-ci-reports.ubuntu.com/artifacts/6a9/828161/9/check/focal-xena/6a9d0b9/job-output.txt

[Corey Bryant (corey.bryant)]

From a locally deployed manila-ganesha unit's /var/log/manila/manila-share.log:

2022-02-22 22:14:06.330 31098 ERROR manila.share.manager [req-3b223d89-3877-4482-8868-69d914b1a15b - - - - -] Error encountered during initialization of driver CephFSDriver@10.5.2.183@cephfsnfs1: manila.exception.ShareBackendException: json_command failed - prefix=fs volume ls, argdict={'format': 'json'} - exception message: [errno -13] access denied: does your client key have mgr caps? See http://docs.ceph.com/en/latest/mgr/administrator/#client-authentication.
2022-02-22 22:14:06.330 31098 ERROR manila.share.manager Traceback (most recent call last):
2022-02-22 22:14:06.330 31098 ERROR manila.share.manager File "/usr/lib/python3/dist-packages/manila/share/drivers/cephfs/driver.py", line 193, in rados_command
2022-02-22 22:14:06.330 31098 ERROR manila.share.manager raise rados.Error(outs, ret)
2022-02-22 22:14:06.330 31098 ERROR manila.share.manager rados.Error: [errno -13] access denied: does your client key have mgr caps? See http://docs.ceph.com/en/latest/mgr/administrator/#client-authentication
2022-02-22 22:14:06.330 31098 ERROR manila.share.manager
2022-02-22 22:14:06.330 31098 ERROR manila.share.manager During handling of the above exception, another exception occurred:
2022-02-22 22:14:06.330 31098 ERROR manila.share.manager
2022-02-22 22:14:06.330 31098 ERROR manila.share.manager Traceback (most recent call last):
2022-02-22 22:14:06.330 31098 ERROR manila.share.manager File "/usr/lib/python3/dist-packages/manila/share/manager.py", line 343, in _driver_setup
2022-02-22 22:14:06.330 31098 ERROR manila.share.manager self.driver.do_setup(ctxt)
2022-02-22 22:14:06.330 31098 ERROR manila.share.manager File "/usr/lib/python3/dist-packages/manila/share/drivers/cephfs/driver.py", line 251, in do_setup
2022-02-22 22:14:06.330 31098 ERROR manila.share.manager volname=self.volname)
2022-02-22 22:14:06.330 31098 ERROR manila.share.manager File "/usr/lib/python3/dist-packages/manila/share/drivers/cephfs/driver.py", line 405, in volname
2022-02-22 22:14:06.330 31098 ERROR manila.share.manager out = rados_command(
2022-02-22 22:14:06.330 31098 ERROR manila.share.manager File "/usr/lib/python3/dist-packages/manila/share/drivers/cephfs/driver.py", line 205, in rados_command
2022-02-22 22:14:06.330 31098 ERROR manila.share.manager raise exception.ShareBackendException(msg)
2022-02-22 22:14:06.330 31098 ERROR manila.share.manager manila.exception.ShareBackendException: json_command failed - prefix=fs volume ls, argdict={'format': 'json'} - exception message: [errno -13] access denied: does your client key have mgr caps? See http://docs.ceph.com/en/latest/mgr/administrator/#client-authentication.
2022-02-22 22:14:06.330 31098 ERROR manila.share.manager

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/charm-manila-ganesha/+/831057

[Corey Bryant (corey.bryant)]

Also part of this bug is removal of policy.json from the package.

[Launchpad Janitor (janitor)]

This bug was fixed in the package manila - 1:13.0.1+git2022011217.603e484fb-0ubuntu2

---------------
manila (1:13.0.1+git2022011217.603e484fb-0ubuntu2) jammy; urgency=medium

  [ Corey Bryant ]
  * d/rules: Drop generation of policy.json in favor of policy-in-code
    (LP: #1952763).

  [ Michael Arbet ]
  * Fix cannot stat '/usr/share/manila-common/policy.json'

 -- Corey Bryant <email address hidden> Thu, 24 Feb 2022 14:49:24 -0500

[Sebastian Sporrer (s-sporrer-dlr)]

Patches are needed for focal/xena as well. I can confirm that they work with our setup.

[Corey Bryant (corey.bryant)]

I've uploaded to the impish unapproved queue where the changes are awaiting SRU team review. Once accepted into impish we will backport that version to the xena cloud archive for focal.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/charm-manila/+/833847

[Chris Halse Rogers (raof)]

Some questions:
/etc/manila/policy.json is a conffile, so the usual conffile handling stuff should be done - either mv_conffile or rm_conffile from dpkg-maintscript-helper or (since impish has a new-enough dpkg) use the new remove-on-upgrade flag in deb-conffiles.

Since policy.json *is* a conffile, it could have been modified by the user. Is it the case that *any* policy.json file would result in the package failing to work, or would some user-modified configurations work? Particularly since this seems to be security related, I feel we should be cautious.

I suggest that if *any* policy.json file would result in a non-working package we should be removing policy.json if it is unmodified (rather than renaming it), and maybe throwing up a debconf warning if it has been modified?

If some user-modified policy.json could be expected to work, can we detect whether it will or not?

[Chris Halse Rogers (raof)]

An upload of manila to impish-proposed has been rejected from the upload queue for the following reason: "Needs at least to do proper dpkg-conffile handling, also see questions above".

[Corey Bryant (corey.bryant)]

@Chris, thanks for the review. I've uploaded the package again, and this time I've dropped the mv of the policy.json file. Instead, the only change is to no longer generate the policy.json file. This way, if a user has upgraded, we won't move their policy.json file.

[Chris Halse Rogers (raof)]

Dropping my comments from #ubuntu-release in here for posterity:

RAOF: Oh! I think I see where I'm wrong. /etc/manila/policy.json isn't shipped in the package, it's /usr/share/manila-common/manila.conf which is then munged into /etc/manila/policy.json by pkgos_write_new_conf in the postinst, so it's not a dpkg conffile and so you don't have all that nice machinery available.

RAOF: So, in summary: the package in impish-proposed fixes fresh installs of manila, leaves upgrades broken, and unbreaking upgrades is not trivial.

RAOF: Based on that understanding I'm happy to accept what's in the impish queue as an SRU. You're going to need to fix it in the openstack charm anyway, though, so if you don't want that SRU to go through I'm also happy to reject it ;)

[Corey Bryant (corey.bryant)]

@Chris, thanks for the detailed review! Yes let's please accept it into impish-proposed if you approve.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/charm-manila/+/833847
Committed: https://opendev.org/openstack/charm-manila/commit/bc868245246e68e0ececb48e43028c4ed021a400
Submitter: "Zuul (22348)"
Branch: master

commit bc868245246e68e0ececb48e43028c4ed021a400
Author: Corey Bryant <email address hidden>
Date: Tue Mar 15 15:41:50 2022 +0000

    Remove policy.json file in favor of policy in code

    This is a work-around for a package bug. The policy.json file
    was deprecated in the wallaby release in favor of using a
    policy.yaml file to override the default policy in code.
    Therefore the policy.json file is not needed.

    Closes-Bug: #1952763
    Change-Id: I4b424869a23f28e8eb66ef6bfc42603b863afc40

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/xena
Review: https://review.opendev.org/c/openstack/charm-manila/+/834477

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/charm-manila-ganesha/+/831057
Committed: https://opendev.org/openstack/charm-manila-ganesha/commit/496bfd569b000bdaa7d16b61afdb069ec959c076
Submitter: "Zuul (22348)"
Branch: master

commit 496bfd569b000bdaa7d16b61afdb069ec959c076
Author: Corey Bryant <email address hidden>
Date: Fri Feb 25 21:59:32 2022 +0000

    Add ceph mgr capabilities

    Without this change, manila's cephfs driver results in
    manilaclient.common.apiclient.exceptions.Forbidden:
    Access was denied to this resource. (HTTP 403)
    when running rados commands.

    http://docs.ceph.com/en/latest/mgr/administrator/#client-authentication

    This also picks up the zaza-openstack-tests fix for test share creation
    resulting in 'no valid host'.

    Closes-Bug: #1952763
    Closes-Bug: #1962204
    Depends-On: https://review.opendev.org/c/openstack/charm-manila/+/833847
    Change-Id: I6ad5047fff2f3109a9efe1f03a786ce0412b4161

[Chris Halse Rogers (raof)]

Hello Corey, or anyone else affected,

Accepted manila into impish-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/manila/1:13.0.0-0ubuntu2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-impish to verification-done-impish. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-impish. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/xena
Review: https://review.opendev.org/c/openstack/charm-manila-ganesha/+/834934

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/charm-manila/+/834477
Committed: https://opendev.org/openstack/charm-manila/commit/eb8a69d948a1d8012c0db107331b393d02a41592
Submitter: "Zuul (22348)"
Branch: stable/xena

commit eb8a69d948a1d8012c0db107331b393d02a41592
Author: Corey Bryant <email address hidden>
Date: Tue Mar 15 15:41:50 2022 +0000

    Remove policy.json file in favor of policy in code

    This is a work-around for a package bug. The policy.json file
    was deprecated in the wallaby release in favor of using a
    policy.yaml file to override the default policy in code.
    Therefore the policy.json file is not needed.

    Closes-Bug: #1952763
    Depends-On: https://review.opendev.org/c/openstack/charm-manila/+/833891
    Change-Id: I4b424869a23f28e8eb66ef6bfc42603b863afc40
    (cherry picked from commit bc868245246e68e0ececb48e43028c4ed021a400)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/charm-manila-ganesha/+/834934
Committed: https://opendev.org/openstack/charm-manila-ganesha/commit/20db0877b84ba6cbcf60d78e26cb053aba22ec1e
Submitter: "Zuul (22348)"
Branch: stable/xena

commit 20db0877b84ba6cbcf60d78e26cb053aba22ec1e
Author: Corey Bryant <email address hidden>
Date: Fri Feb 25 21:59:32 2022 +0000

    Add ceph mgr capabilities

    Without this change, manila's cephfs driver results in
    manilaclient.common.apiclient.exceptions.Forbidden:
    Access was denied to this resource. (HTTP 403)
    when running rados commands.

    http://docs.ceph.com/en/latest/mgr/administrator/#client-authentication

    This also picks up the zaza-openstack-tests fix for test share creation
    resulting in 'no valid host'.

    Closes-Bug: #1952763
    Closes-Bug: #1962204
    Depends-On: https://review.opendev.org/c/openstack/charm-manila-ganesha/+/835859
    Change-Id: I6ad5047fff2f3109a9efe1f03a786ce0412b4161
    (cherry picked from commit 496bfd569b000bdaa7d16b61afdb069ec959c076)

[Corey Bryant (corey.bryant)]

focal-xena/proposed verified successfully: https://review.opendev.org/c/openstack/charm-manila-ganesha/+/841328

[Corey Bryant (corey.bryant)]

The verification of the Stable Release Update for manila has completed successfully and the package has now been released to -updates. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Corey Bryant (corey.bryant)]

This bug was fixed in the package manila - 1:13.0.0-0ubuntu2~cloud0
---------------

 manila (1:13.0.0-0ubuntu2~cloud0) focal-xena; urgency=medium
 .
   * New update for the Ubuntu Cloud Archive.
 .
 manila (1:13.0.0-0ubuntu2) impish; urgency=medium
 .
   [ Corey Bryant ]
   * d/gbp.conf: Create stable/xena branch.
   * d/rules: Drop generation of policy.json in favor of policy-in-code
     (LP: #1952763).

[Brian Murray (brian-murray)]

This not being verified is blocking the SRU of another update of the manila package.

[Corey Bryant (corey.bryant)]

Brian, I've just uploaded a new manila 1:13.0.2-0ubuntu1 to the impish unapproved queue that includes this bug in its changes file. If it is ok with the SRU team, we'd like to carry both of the outstanding SRUs for manila in impish-proposed. With impish EOL in July, we are ok with carrying these in proposed until then.

[Brian Murray (brian-murray)]

Hello Corey, or anyone else affected,

Accepted manila into impish-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/manila/1:13.0.3-0ubuntu1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-impish to verification-done-impish. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-impish. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Brian Murray (brian-murray)]

Ubuntu 21.10 (Impish Indri) has reached end of life, so this bug will not be fixed for that specific release.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/wallaby
Review: https://review.opendev.org/c/openstack/charm-manila-ganesha/+/851058

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/charm-manila-ganesha/+/851058
Committed: https://opendev.org/openstack/charm-manila-ganesha/commit/63e0c432c28034d2b2f22b36e7b296d214fadd0b
Submitter: "Zuul (22348)"
Branch: stable/wallaby

commit 63e0c432c28034d2b2f22b36e7b296d214fadd0b
Author: Corey Bryant <email address hidden>
Date: Fri Feb 25 21:59:32 2022 +0000

    Add ceph mgr capabilities

    Without this change, manila's cephfs driver results in
    manilaclient.common.apiclient.exceptions.Forbidden:
    Access was denied to this resource. (HTTP 403)
    when running rados commands.

    http://docs.ceph.com/en/latest/mgr/administrator/#client-authentication

    This also picks up the zaza-openstack-tests fix for test share creation
    resulting in 'no valid host'.

    Closes-Bug: #1952763
    Closes-Bug: #1962204
    Depends-On: https://review.opendev.org/c/openstack/charm-manila/+/833847
    Change-Id: I6ad5047fff2f3109a9efe1f03a786ce0412b4161
    (cherry picked from commit 496bfd569b000bdaa7d16b61afdb069ec959c076)

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/21.10
Review: https://review.opendev.org/c/openstack/charm-manila-ganesha/+/856179

[OpenStack Infra (hudson-openstack)]

Change abandoned by "gnuoy <email address hidden>" on branch: stable/21.10
Review: https://review.opendev.org/c/openstack/charm-manila-ganesha/+/856179

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/victoria
Review: https://review.opendev.org/c/openstack/charm-manila-ganesha/+/856180

[OpenStack Infra (hudson-openstack)]

Change abandoned by "gnuoy <email address hidden>" on branch: stable/victoria
Review: https://review.opendev.org/c/openstack/charm-manila-ganesha/+/856180

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/victoria
Review: https://review.opendev.org/c/openstack/charm-manila-ganesha/+/856181

[OpenStack Infra (hudson-openstack)]

Change abandoned by "gnuoy <email address hidden>" on branch: stable/victoria
Review: https://review.opendev.org/c/openstack/charm-manila-ganesha/+/856181

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/victoria
Review: https://review.opendev.org/c/openstack/charm-manila-ganesha/+/856182

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/charm-manila-ganesha/+/856182
Committed: https://opendev.org/openstack/charm-manila-ganesha/commit/8619a83855179ea1033202331a960dd0d5d62976
Submitter: "Zuul (22348)"
Branch: stable/victoria

commit 8619a83855179ea1033202331a960dd0d5d62976
Author: Corey Bryant <email address hidden>
Date: Fri Feb 25 21:59:32 2022 +0000

    Add ceph mgr capabilities

    Without this change, manila's cephfs driver results in
    manilaclient.common.apiclient.exceptions.Forbidden:
    Access was denied to this resource. (HTTP 403)
    when running rados commands.

    http://docs.ceph.com/en/latest/mgr/administrator/#client-authentication

    Closes-Bug: #1952763
    Closes-Bug: #1962204

    Change-Id: I6ad5047fff2f3109a9efe1f03a786ce0412b4161
    (cherry picked from commit 496bfd569b000bdaa7d16b61afdb069ec959c076)