cephadm: Fix iscsi client caps (allow mgr <service status> calls)

iSCSI daemons need to execute <ceph service status> command

Fixes: https://tracker.ceph.com/issues/48925
Signed-off-by: Juan Miguel Olmo Martínez <jolmomar@redhat.com>
(cherry picked from commit 9b9934f75b648a9ee01848710a6f7150a371e26e)

Conflicts:
	src/pybind/mgr/cephadm/tests/test_services.py: s/blocklist/blacklist

diff --git a/src/pybind/mgr/cephadm/services/iscsi.py b/src/pybind/mgr/cephadm/services/iscsi.py
index 2fce233e3696ab11d857f91c66eeeaaa26c1640e..6b244a42bcbdf3f8086c13609b8c5c0f8c8fe627 100644 (file)
--- a/src/pybind/mgr/cephadm/services/iscsi.py
+++ b/src/pybind/mgr/cephadm/services/iscsi.py
@@ -37,6 +37,7 @@ class IscsiService(CephService):
             'caps': ['mon', 'profile rbd, '
                             'allow command "osd blacklist", '
                             'allow command "config-key get" with "key" prefix "iscsi/"',
+                     'mgr', 'allow command "service status"',
                      'osd', 'allow rwx'],
         })
 

diff --git a/src/pybind/mgr/cephadm/tests/test_services.py b/src/pybind/mgr/cephadm/tests/test_services.py
index cf37b47d9f75ba47b573a1a74649b1e100a94929..b6ab142493b3009d42977a8aeeded2161ae22bab 100644 (file)
--- a/src/pybind/mgr/cephadm/tests/test_services.py
+++ b/src/pybind/mgr/cephadm/tests/test_services.py
@@ -1,6 +1,6 @@
 import pytest
 
-from unittest.mock import MagicMock
+from unittest.mock import MagicMock, call
 
 from cephadm.services.cephadmservice import MonService, MgrService, MdsService, RgwService, \
     RbdMirrorService, CrashService, CephadmService, AuthEntity
@@ -9,6 +9,7 @@ from cephadm.services.nfs import NFSService
 from cephadm.services.osd import RemoveUtil, OSDRemovalQueue, OSDService, OSD, NotFoundError
 from cephadm.services.monitoring import GrafanaService, AlertmanagerService, PrometheusService, \
     NodeExporterService
+from ceph.deployment.service_spec import IscsiServiceSpec
 
 from orchestrator import OrchestratorError
 
@@ -17,6 +18,7 @@ class FakeMgr:
     def __init__(self):
         self.config = ''
         self.check_mon_command = MagicMock(side_effect=self._check_mon_command)
+        self.template = MagicMock()
 
     def _check_mon_command(self, cmd_dict, inbuf=None):
         prefix = cmd_dict.get('prefix')
@@ -74,6 +76,30 @@ class TestCephadmService:
         }
         return cephadm_services
 
+    def test_iscsi_client_caps(self):
+        mgr = FakeMgr()
+        iscsi_service = self._get_services(mgr)['iscsi']
+
+        iscsi_spec = IscsiServiceSpec(service_type='iscsi', service_id="a")
+        iscsi_spec.daemon_type = "iscsi"
+        iscsi_spec.daemon_id = "a"
+        iscsi_spec.spec = MagicMock()
+        iscsi_spec.spec.daemon_type = "iscsi"
+        iscsi_spec.spec.ssl_cert = ''
+
+        iscsi_service.prepare_create(iscsi_spec)
+
+        expected_caps = ['mon',
+                         'profile rbd, allow command "osd blacklist", allow command "config-key get" with "key" prefix "iscsi/"',
+                         'mgr', 'allow command "service status"',
+                         'osd', 'allow rwx']
+
+        expected_call = call({'prefix': 'auth get-or-create',
+                              'entity': 'client.iscsi.a',
+                              'caps': expected_caps})
+
+        assert expected_call in mgr.check_mon_command.mock_calls
+
     def test_get_auth_entity(self):
         mgr = FakeMgr()
         cephadm_services = self._get_services(mgr)