From 454cc8a18c4c3851de5976d3e36e42644dbb1a70 Mon Sep 17 00:00:00 2001 From: Marcus Watts Date: Fri, 17 Sep 2021 05:28:53 -0400 Subject: [PATCH] Fix vault token file access. Put the vault token file in a location that ceph can read. Make it readable only by ceph. On rhel8 (and indeed, any vanilla rhel machine), $HOME is liable to be mode 700. This means the ceph user can't read things in that user's directory. This causes radosgw to emit the confusing message "ERROR: Vault token file ... not found" even though the teuthology log will plainly show it was created and made readable by ceph. Fixes: http://tracker.ceph.com/issues/51539 Signed-off-by: Marcus Watts --- qa/tasks/rgw.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/qa/tasks/rgw.py b/qa/tasks/rgw.py index aa5e1fc3bd1..693d3d4d6d7 100644 --- a/qa/tasks/rgw.py +++ b/qa/tasks/rgw.py @@ -112,7 +112,7 @@ def start_rgw(ctx, config, clients): barbican_role = client_config.get('use-barbican-role', None) pykmip_role = client_config.get('use-pykmip-role', None) - token_path = teuthology.get_testdir(ctx) + '/vault-token' + token_path = '/etc/ceph/vault-root-token' if barbican_role is not None: if not hasattr(ctx, 'barbican'): raise ConfigError('rgw must run after the barbican task') @@ -131,11 +131,11 @@ def start_rgw(ctx, config, clients): raise ConfigError('vault: no "root_token" specified') # create token on file ctx.rgw.vault_role = vault_role - ctx.cluster.only(client).run(args=['echo', '-n', ctx.vault.root_token, run.Raw('>'), token_path]) + ctx.cluster.only(client).run(args=['sudo', 'echo', '-n', ctx.vault.root_token, run.Raw('|'), 'sudo', 'tee', token_path]) log.info("Token file content") ctx.cluster.only(client).run(args=['cat', token_path]) log.info("Restrict access to token file") - ctx.cluster.only(client).run(args=['chmod', '600', token_path]) + ctx.cluster.only(client).run(args=['sudo', 'chmod', '600', token_path]) ctx.cluster.only(client).run(args=['sudo', 'chown', 'ceph', token_path]) rgw_cmd.extend([ @@ -206,7 +206,7 @@ def start_rgw(ctx, config, clients): client=client_with_cluster), ], ) - ctx.cluster.only(client).run(args=['rm', '-f', token_path]) + ctx.cluster.only(client).run(args=['sudo', 'rm', '-f', token_path]) def assign_endpoints(ctx, config, default_cert): role_endpoints = {} -- 2.39.5