From: Matthew Oliver Date: Fri, 26 Jun 2020 00:15:12 +0000 (+0000) Subject: cephadm: ceph-iscsi remove pool from cap X-Git-Tag: v16.1.0~1892^2 X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=refs%2Fpull%2F35786%2Fhead;p=ceph.git cephadm: ceph-iscsi remove pool from cap When we create a ceph-iscsi daemon/continer in cephadm we create a user and set some caps. Turns out we were a little too restrictive. We were locking down to only access the pool that was given in the spec, which happens to be the pool the iscsi config is stored. But in reality we need to be able to attach any rbd images which could exist in other pools. So this patch removes the `pool=` from the osd cap, so from: osd = allow rwx pool={spec.pool} To: osd = allow rwx Fixes: https://tracker.ceph.com/issues/46138 Signed-off-by: Matthew Oliver --- diff --git a/src/pybind/mgr/cephadm/services/iscsi.py b/src/pybind/mgr/cephadm/services/iscsi.py index 5e63c4788bf1..3447e77c1920 100644 --- a/src/pybind/mgr/cephadm/services/iscsi.py +++ b/src/pybind/mgr/cephadm/services/iscsi.py @@ -27,7 +27,7 @@ class IscsiService(CephadmService): 'caps': ['mon', 'profile rbd, ' 'allow command "osd blacklist", ' 'allow command "config-key get" with "key" prefix "iscsi/"', - 'osd', f'allow rwx pool={spec.pool}'], + 'osd', 'allow rwx'], }) if spec.ssl_cert: