ACLs are not visible inside container images

[Giulio Fidente]

We are setting some ACLs on the Ceph keyrings but these aren't copied by kolla and aren't available inside the containers.

Even if we made kolla copy the ACLs, it'd be complicated to match the users UID before knowing which image is used for the container.

It would be best to be able to set a mode on the keyrings via ceph-ansible instead.

[John Fulton (jfulton-org)]

Working on this in ceph-ansible https://github.com/ceph/ceph-ansible/issues/1755

[John Fulton (jfulton-org)]

Waiting on PR sent to ceph-ansible https://github.com/ceph/ceph-ansible/pull/1756

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/492303

[John Fulton (jfulton-org)]

ceph-ansible change to support new param has merged [1]. Waiting on merge for new param in tht [2] and new RPM in centos-storage-sig with ceph-ansible change.

[1] https://github.com/ceph/ceph-ansible/pull/1756
[2] https://review.openstack.org/492303

[John Fulton (jfulton-org)]

I spoke too soon: https://github.com/ceph/ceph-ansible/pull/1759

[John Fulton (jfulton-org)]

Second ceph-ansible change to support new param has merged [1]. Waiting on merge for new param in tht [2] and new RPM in centos-storage-sig with ceph-ansible change.

[1] https://github.com/ceph/ceph-ansible/pull/1759
[2] https://review.openstack.org/492303

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/492303
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=6d1c06c6b8cbc1f183fe4de794d30d3000218237
Submitter: Jenkins
Branch: master

commit 6d1c06c6b8cbc1f183fe4de794d30d3000218237
Author: John Fulton <email address hidden>
Date: Wed Aug 9 17:07:40 2017 -0400

    Set file mode permission of Ceph keyrings

    Pass mode parameter to ceph-ansible in place of ACLs parameter
    because ACLs are not for same UID in container as container host
    and because ACLs are not passed by kolla_config.

    Change-Id: I7e3433eab8e2a62963b623531f223d5abd301d16
    Closes-Bug: #1709683

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/tripleo-heat-templates 7.0.0.0rc1 release candidate.