From: Sage Weil <sage@newdream.net>
Date: Fri, 12 Mar 2021 16:15:35 +0000 (-0600)
Subject: mgr/cephadm: fix get_keyring_with_caps
X-Git-Tag: v17.1.0~2610^2~1
X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=6127d7f20bc8a6ad02d8ea144584eaf2bfc9590e;p=ceph.git

mgr/cephadm: fix get_keyring_with_caps

1- Pass caps to 'auth get-or-create'
2- Only try 'auth caps' if the get-or-create failed

Note that the 'auth caps' step can fail if upgrading from 15.2.0 since
'profile mgr' didn't include 'auth caps' until 15.2.1.  We're not
addressing that for now...

Fixes: 7c0d532f3a4839f4199a13773fb5fa8b6fb3f183

Signed-off-by: Sage Weil <sage@newdream.net>
---

diff --git a/src/pybind/mgr/cephadm/services/cephadmservice.py b/src/pybind/mgr/cephadm/services/cephadmservice.py
index 00c0e960de4..103fcb78c21 100644
--- a/src/pybind/mgr/cephadm/services/cephadmservice.py
+++ b/src/pybind/mgr/cephadm/services/cephadmservice.py
@@ -144,12 +144,14 @@ class CephadmService(metaclass=ABCMeta):
         ret, keyring, err = self.mgr.check_mon_command({
             'prefix': 'auth get-or-create',
             'entity': entity,
-        })
-        ret, out, err = self.mgr.check_mon_command({
-            'prefix': 'auth caps',
-            'entity': entity,
             'caps': caps,
         })
+        if err:
+            ret, out, err = self.mgr.check_mon_command({
+                'prefix': 'auth caps',
+                'entity': entity,
+                'caps': caps,
+            })
         return keyring
 
     def _inventory_get_addr(self, hostname: str) -> str:
diff --git a/src/pybind/mgr/cephadm/tests/test_services.py b/src/pybind/mgr/cephadm/tests/test_services.py
index 1f140945bc4..2c3e036a6ef 100644
--- a/src/pybind/mgr/cephadm/tests/test_services.py
+++ b/src/pybind/mgr/cephadm/tests/test_services.py
@@ -107,7 +107,8 @@ class TestCephadmService:
                          'osd', 'allow rwx']
 
         expected_call = call({'prefix': 'auth get-or-create',
-                              'entity': 'client.iscsi.a'})
+                              'entity': 'client.iscsi.a',
+                              'caps': expected_caps})
         expected_call2 = call({'prefix': 'auth caps',
                                'entity': 'client.iscsi.a',
                                'caps': expected_caps})