]> git.apps.os.sepia.ceph.com Git - ceph.git/commit
AuthMonitor: allow "fs authorize" to update caps
authorRishabh Dave <ridave@redhat.com>
Wed, 9 Jun 2021 08:08:57 +0000 (13:38 +0530)
committerRishabh Dave <ridave@redhat.com>
Sun, 30 Jul 2023 17:33:22 +0000 (23:03 +0530)
commit23f1fdbcb3de7b108b597431dd6dd1d6f0deb08b
tree419041d464e0ab727cae18347b7311b600ac00bb
parentf4c01743b7675deb9ae99469d3c7d2352e785045
AuthMonitor: allow "fs authorize" to update caps

When "fs authorize" subcommand is executed for the second time with
different caps, the subcommand exits with error. Modify the behaviour so
that the caps passed every subsequent time is incorporated in to the caps
that are already present in the entity's keyring.

Behaviour before this commit -

$ ./bin/ceph fs authorize a client.x1 / rw
[client.x1]
key = AQBirqxg5KHeFxAAgOm6lHMYych6OTI+y1HJKw==

$ ./bin/ceph fs authorize b client.x1 / rw
Error EINVAL: client.x1 already has fs capabilities that differ from those supplied. To generate a new auth key for client.x1, first remove client.x1 from configuration files, execute 'ceph auth rm client.x1', then execute this command again.

$ ./bin/ceph auth get client.x1
[client.x1]
key = AQBirqxg5KHeFxAAgOm6lHMYych6OTI+y1HJKw==
caps mds = "allow rw fsname=a"
caps mon = "allow r fsname=a"
caps osd = "allow rw tag cephfs data=a"
exported keyring for client.x1

After this commit -

$ ./bin/ceph fs authorize a client.x1 / rw
[client.x1]
key = AQDvrqxgU3I3FBAAJWwF6ZtcOVeHH8TA8CwWmQ==

$ ./bin/ceph fs authorize b client.x1 / rw
updated caps for client.x1

$ ./bin/ceph auth get client.x1
[client.x1]
key = AQDvrqxgU3I3FBAAJWwF6ZtcOVeHH8TA8CwWmQ==
caps mds = "allow rw fsname=a, allow rw fsname=b"
caps mon = "allow r fsname=a, allow r fsname=b"
caps osd = "allow rw tag cephfs data=a, allow rw tag cephfs data=b"
exported keyring for client.x1

Fixes: https://tracker.ceph.com/issues/47264
Signed-off-by: Rishabh Dave <ridave@redhat.com>
MDSAuthCaps: bug fixes

Signed-off-by: Rishabh Dave <ridave@redhat.com>
PendingReleaseNotes
src/mds/MDSAuthCaps.cc
src/mds/MDSAuthCaps.h
src/mon/AuthMonitor.cc
src/mon/AuthMonitor.h
src/mon/MonCap.cc
src/mon/MonCap.h
src/osd/OSDCap.cc
src/osd/OSDCap.h