Moving to confirmed, created an NFS share named test_share with export path of 192.168.0.118:/bef1720c-b108-4a2f-baf7-f5b7d3d7cc61, it is possible to mount the share with read-write level access but not with read-only level access.


With default of no rules we are denied mount access for the share on our Linux vm irco1sd9vm25:
stack@irco1sd9vm01:~/simon$ manila list
+--------------------------------------+----------------+------+-------------+-----------+-----------+-----------------+---------------------------------+-------------------+
| ID                                   | Name           | Size | Share Proto | Status    | Is Public | Share Type Name | Host                            | Availability Zone |
+--------------------------------------+----------------+------+-------------+-----------+-----------+-----------------+---------------------------------+-------------------+
| b223511f-6c04-40bc-bbb6-c2d723f9c385 | test_share     | 1    | NFS         | available | False     | default         | irco1sd9vm01@VMAX#os-manila-sg1 | nova              |            |
+--------------------------------------+----------------+------+-------------+-----------+-----------+----

-------------+---------------------------------+-------------------+
stack@irco1sd9vm01:~/simon$ manila access-list test_share
+----+-------------+-----------+--------------+-------+------------+------------+------------+
| id | access_type | access_to | access_level | state | access_key | created_at | updated_at |
+----+-------------+-----------+--------------+-------+------------+------------+------------+
+----+-------------+-----------+--------------+-------+------------+------------+------------+

stack@irco1sd9vm25:~$ mkdir mnt
stack@irco1sd9vm25:~$ sudo mount -t nfs 192.168.0.118:/bef1720c-b108-4a2f-baf7-f5b7d3d7cc61 mnt/
mount.nfs: access denied by server while mounting 192.168.0.118:/bef1720c-b108-4a2f-baf7-f5b7d3d7cc61



Add a read-write rule with IP 0.0.0.0/0 to the share and we are then allowed to mount the share:

stack@irco1sd9vm01:~/simon$ manila access-allow test_share ip 0.0.0.0/0 --access-level rw
+--------------+--------------------------------------+
| Property     | Value                                |
+--------------+--------------------------------------+
| access_key   | None                                 |
| share_id     | b223511f-6c04-40bc-bbb6-c2d723f9c385 |
| created_at   | 2019-09-27T14:42:15.000000           |
| updated_at   | None                                 |
| access_type  | ip                                   |
| access_to    | 0.0.0.0/0                            |
| access_level | rw                                   |
| state        | queued_to_apply                      |
| id           | b352be58-e13e-4e0e-9305-88ce83c84177 |
| metadata     | {}                                   |
+--------------+--------------------------------------+

stack@irco1sd9vm25:~$ sudo mount -t nfs 192.168.0.118:/bef1720c-b108-4a2f-baf7-f5b7d3d7cc61 mnt/

stack@irco1sd9vm25:~$ mount | grep mnt
192.168.0.118:/bef1720c-b108-4a2f-baf7-f5b7d3d7cc61 on /opt/stack/mnt type nfs (rw,relatime,vers=3,rsize=262144,wsize=262144,namlen=255,hard,proto=tcp,timeo=600,retrans=2,sec=sys,mountaddr=192.168.0.118,mountvers=3,mountport=1234,mountproto=udp,local_lock=none,addr=192.168.0.118)

stack@irco1sd9vm25:~$ cd mnt/
stack@irco1sd9vm25:~/mnt$ ls
lost+found



Remove the read-write access-level and add read-only instead and try to mount again:

stack@irco1sd9vm01:~/simon$ manila access-allow test_share ip 0.0.0.0/0 --access-level ro
+--------------+--------------------------------------+
| Property     | Value                                |
+--------------+--------------------------------------+
| access_key   | None                                 |
| share_id     | b223511f-6c04-40bc-bbb6-c2d723f9c385 |
| created_at   | 2019-09-27T14:49:53.000000           |
| updated_at   | None                                 |
| access_type  | ip                                   |
| access_to    | 0.0.0.0/0                            |
| access_level | ro                                   |
| state        | queued_to_apply                      |
| id           | 2385be0b-abc1-4966-b158-8da8d7504382 |
| metadata     | {}                                   |
+--------------+--------------------------------------+

stack@irco1sd9vm25:~$ sudo mount -t nfs 192.168.0.118:/bef1720c-b108-4a2f-baf7-f5b7d3d7cc61 mnt/
mount.nfs: access denied by server while mounting 192.168.0.118:/bef1720c-b108-4a2f-baf7-f5b7d3d7cc61