mgr/cephadm: fix get_keyring_with_caps

1- Pass caps to 'auth get-or-create'
2- Only try 'auth caps' if the get-or-create failed

Note that the 'auth caps' step can fail if upgrading from 15.2.0 since
'profile mgr' didn't include 'auth caps' until 15.2.1.  We're not
addressing that for now...

Fixes: 7c0d532f3a4839f4199a13773fb5fa8b6fb3f183
Signed-off-by: Sage Weil <sage@newdream.net>
(cherry picked from commit 6127d7f20bc8a6ad02d8ea144584eaf2bfc9590e)

diff --git a/src/pybind/mgr/cephadm/services/cephadmservice.py b/src/pybind/mgr/cephadm/services/cephadmservice.py
index 7cb10f1aa36fd5ddfa6696b5978cfbf4e87b1f47..8376f429fcd1336824826ddec83a7766ca63e968 100644 (file)
--- a/src/pybind/mgr/cephadm/services/cephadmservice.py
+++ b/src/pybind/mgr/cephadm/services/cephadmservice.py
@@ -147,12 +147,14 @@ class CephadmService(metaclass=ABCMeta):
         ret, keyring, err = self.mgr.check_mon_command({
             'prefix': 'auth get-or-create',
             'entity': entity,
-        })
-        ret, out, err = self.mgr.check_mon_command({
-            'prefix': 'auth caps',
-            'entity': entity,
             'caps': caps,
         })
+        if err:
+            ret, out, err = self.mgr.check_mon_command({
+                'prefix': 'auth caps',
+                'entity': entity,
+                'caps': caps,
+            })
         return keyring
 
     def _inventory_get_addr(self, hostname: str) -> str:

diff --git a/src/pybind/mgr/cephadm/tests/test_services.py b/src/pybind/mgr/cephadm/tests/test_services.py
index 1f140945bc42c865b5a9797925bdeda2cde582f7..2c3e036a6ef45a75215e462b6a0f9fd073037d4c 100644 (file)
--- a/src/pybind/mgr/cephadm/tests/test_services.py
+++ b/src/pybind/mgr/cephadm/tests/test_services.py
@@ -107,7 +107,8 @@ class TestCephadmService:
                          'osd', 'allow rwx']
 
         expected_call = call({'prefix': 'auth get-or-create',
-                              'entity': 'client.iscsi.a'})
+                              'entity': 'client.iscsi.a',
+                              'caps': expected_caps})
         expected_call2 = call({'prefix': 'auth caps',
                                'entity': 'client.iscsi.a',
                                'caps': expected_caps})