Using non-default Ceph user for Cinder Backup service

[Chris Martin]

When configuring Cinder Backup to connect to Ceph, the docs (https://docs.openstack.org/openstack-ansible-os_cinder/latest/configure-cinder.html#backup) direct a deployer to configure the Ceph user by setting `cinder_service_backup_ceph_user`. It appears that the ceph_client role instead gets the Ceph user from `cinder_backup_ceph_client`, a variable which defaults to "cinder-backup" (in /etc/ansible/roles/ceph_client/defaults/main.yml). So, if your Ceph user for Cinder backups is not "cinder-backup", you'll end up with an Ansible error from the "Provision ceph client keyrings" task of the ceph_client role, saying that the cinder-backup user is not in Ceph's keyring.

I worked around this by setting something like `cinder_backup_ceph_client: '{{ cinder_service_backup_ceph_user }}'` in user_variables.yml.

A couple of solutions:

- Set `cinder_backup_ceph_client: '{{ cinder_service_backup_ceph_user }}'` in the vars section of the include_role task, which runs the ceph_client role from the os_cinder role
- Simplify and reference `cinder_service_backup_ceph_user` directly in the ceph_client role.

I'm not sure which style would be more idiomatic for this project.

[Jean-Philippe Evrard (jean-philippe-evrard)]

Both make sense. There was also the idea of wiring with group vars, but if it's possible to avoid a group var for that, that's even better.

I'd be enclined to do a cleanup of the vars later, right now I'd say it would make sense to pass all the required variables to the include_role when we do it, because it's an approach we have taken in the past already:

https://github.com/openstack/openstack-ansible-os_nova/blob/67d9017e27bcc0ece169ada28d83f1ab86db9fcf/tasks/main.yml#L116-L117

This sounds a serious problem though, and I am surprised no-one got the issue before that.

[Jean-Philippe Evrard (jean-philippe-evrard)]

(Or at least I am suprised everyone is using cinder-backup as user)