From: Avan Thakkar <athakkar@redhat.com>
Date: Fri, 3 Jul 2026 10:54:49 +0000 (+0530)
Subject: mgr/cephadm: track SMB rgw_creds_uri as a daemon dependency
X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=2063d84c4d9575e940155dd3d17df09ee8e255e7;p=ceph.git

mgr/cephadm: track SMB rgw_creds_uri as a daemon dependency

Add rgw_creds_uri as a Dep.FIELD in get_dependencies and include it in
needs_redeploy_prefixes so a change triggers REDEPLOY.

Also fix _save_pending_rgw_config to use cred_map.get() instead
of a bare dict lookup.

Fixes: https://tracker.ceph.com/issues/77763
Signed-off-by: Avan Thakkar <athakkar@redhat.com>
---

diff --git a/src/pybind/mgr/cephadm/services/smb.py b/src/pybind/mgr/cephadm/services/smb.py
index 79549b55c28..15fba27bdda 100644
--- a/src/pybind/mgr/cephadm/services/smb.py
+++ b/src/pybind/mgr/cephadm/services/smb.py
@@ -208,16 +208,20 @@ class SMBService(CephService):
             ca_cert=ssl_params.ssl_ca_cert or '',
         )
 
-    def _rgw_creds_uri(self, cluster_id: str) -> Optional[str]:
+    @classmethod
+    def _lookup_rgw_creds_uri(
+        cls, mgr: 'CephadmOrchestrator', cluster_id: str
+    ) -> Optional[str]:
         from smb.external import rgw_config_key as _smb_rgw_config_key
         from smb.mon_store import MonKeyConfigStore
-        _rgw_entry = MonKeyConfigStore(self.mgr)[
-            _smb_rgw_config_key(cluster_id)
-        ]
+        _rgw_entry = MonKeyConfigStore(mgr)[_smb_rgw_config_key(cluster_id)]
         if _rgw_entry.exists():
             return _rgw_entry.uri
         return None
 
+    def _rgw_creds_uri(self, cluster_id: str) -> Optional[str]:
+        return self._lookup_rgw_creds_uri(self.mgr, cluster_id)
+
     def generate_config(
         self, daemon_spec: CephadmDaemonDeploySpec
     ) -> Tuple[Dict[str, Any], List[str]]:
@@ -538,6 +542,8 @@ class SMBService(CephService):
             out.append(Dep.META(f'ceph_cluster_config.{ccc.alias}', value))
         # Add features as a dependency
         out.append(Dep.FIELD('features', ','.join(sorted(smb_spec.features or []))))
+        rgw_creds_uri = cls._lookup_rgw_creds_uri(mgr, smb_spec.cluster_id) or ''
+        out.append(Dep.FIELD('rgw_creds_uri', rgw_creds_uri))
         return out
 
     def choose_next_action(
@@ -553,7 +559,15 @@ class SMBService(CephService):
             scheduled_action, daemon_type, spec, curr_deps, last_deps)
         if step.action is utils.Action.RECONFIG:
             sym_diff = set(curr_deps).symmetric_difference(last_deps)
-            if any(d.startswith(Dep.FIELD('features', '')) for d in sym_diff):
+            needs_redeploy_prefixes = (
+                Dep.FIELD('features', ''),
+                Dep.FIELD('rgw_creds_uri', ''),
+            )
+            if any(
+                d.startswith(p)
+                for d in sym_diff
+                for p in needs_redeploy_prefixes
+            ):
                 return replace(step, action=utils.Action.REDEPLOY)
         return step
 
diff --git a/src/pybind/mgr/cephadm/tests/services/test_smb.py b/src/pybind/mgr/cephadm/tests/services/test_smb.py
index c3239066378..f1135771864 100644
--- a/src/pybind/mgr/cephadm/tests/services/test_smb.py
+++ b/src/pybind/mgr/cephadm/tests/services/test_smb.py
@@ -234,5 +234,6 @@ def test_smb_get_dependencies(cephadm_module):
     deps = SMBService.get_dependencies(cephadm_module, spec, spec.service_type)
     assert deps == [
         'smb+meta:ceph_cluster_config.exo=sha256:859b001f76df4d184b858b9c3e323ca8ff85a311414d0405f4484d17aa481ef3',
-        'smb+field:features=domain'
+        'smb+field:features=domain',
+        'smb+field:rgw_creds_uri=rados:mon-config-key:smb/config/foxtrot/config.smb.rgw',
     ]
diff --git a/src/pybind/mgr/smb/handler.py b/src/pybind/mgr/smb/handler.py
index ec081aad4d8..12ea2e06eb3 100644
--- a/src/pybind/mgr/smb/handler.py
+++ b/src/pybind/mgr/smb/handler.py
@@ -1541,7 +1541,14 @@ def _save_pending_rgw_config(
         rgw = sc.resource.rgw
         assert rgw is not None
         assert rgw.credential_ref is not None
-        cred = cred_map[rgw.credential_ref]
+        cred = cred_map.get(rgw.credential_ref)
+        if cred is None:
+            log.error(
+                "share %r references missing RGW credential %r",
+                sc.resource.name,
+                rgw.credential_ref,
+            )
+            continue
         access_key = cred.access_key_id or ''
         secret_key = cred.secret_access_key or ''
         merge_shares[sc.resource.name] = {