mgr/cephadm: fix get_keyring_with_caps

1- Pass caps to 'auth get-or-create'
2- Only try 'auth caps' if the get-or-create failed

Note that the 'auth caps' step can fail if upgrading from 15.2.0 since
'profile mgr' didn't include 'auth caps' until 15.2.1.  We're not
addressing that for now...

Fixes: 7c0d532f3a4839f4199a13773fb5fa8b6fb3f183
Signed-off-by: Sage Weil <sage@newdream.net>

diff --git a/src/pybind/mgr/cephadm/services/cephadmservice.py b/src/pybind/mgr/cephadm/services/cephadmservice.py
index 00c0e960de49aa9fafe4551268ae59bfee01c722..103fcb78c219b16f77aedbf74bac339c2dd882a9 100644 (file)
--- a/src/pybind/mgr/cephadm/services/cephadmservice.py
+++ b/src/pybind/mgr/cephadm/services/cephadmservice.py
@@ -144,12 +144,14 @@ class CephadmService(metaclass=ABCMeta):
         ret, keyring, err = self.mgr.check_mon_command({
             'prefix': 'auth get-or-create',
             'entity': entity,
-        })
-        ret, out, err = self.mgr.check_mon_command({
-            'prefix': 'auth caps',
-            'entity': entity,
             'caps': caps,
         })
+        if err:
+            ret, out, err = self.mgr.check_mon_command({
+                'prefix': 'auth caps',
+                'entity': entity,
+                'caps': caps,
+            })
         return keyring
 
     def _inventory_get_addr(self, hostname: str) -> str:

diff --git a/src/pybind/mgr/cephadm/tests/test_services.py b/src/pybind/mgr/cephadm/tests/test_services.py
index 1f140945bc42c865b5a9797925bdeda2cde582f7..2c3e036a6ef45a75215e462b6a0f9fd073037d4c 100644 (file)
--- a/src/pybind/mgr/cephadm/tests/test_services.py
+++ b/src/pybind/mgr/cephadm/tests/test_services.py
@@ -107,7 +107,8 @@ class TestCephadmService:
                          'osd', 'allow rwx']
 
         expected_call = call({'prefix': 'auth get-or-create',
-                              'entity': 'client.iscsi.a'})
+                              'entity': 'client.iscsi.a',
+                              'caps': expected_caps})
         expected_call2 = call({'prefix': 'auth caps',
                                'entity': 'client.iscsi.a',
                                'caps': expected_caps})