From 652f4902562247591f503d444de25da8edb845a3 Mon Sep 17 00:00:00 2001 From: Loic Dachary Date: Tue, 15 Nov 2016 17:16:37 +0100 Subject: [PATCH] mon,ceph-disk: add lockbox permissions to bootstrap-osd ceph-disk --dmcrypt needs to put a config-key and authorize the OSD to get it back. The corresponding permissions are added to the bootstrap-osd profile in the monitor. When preparing the OSD lockbox, use the bootstrap-osd profile instead of implicitly requiring admin permissions to perform the initial config-key and auth get-or-create operations. Fixes: http://tracker.ceph.com/issues/17849 Signed-off-by: Loic Dachary (cherry picked from commit c1c6224bf8df788cd34e9ba7294a6515a9ab97e3) --- src/ceph-disk/ceph_disk/main.py | 14 ++++++++++++++ src/mon/MonCap.cc | 6 ++++++ 2 files changed, 20 insertions(+) diff --git a/src/ceph-disk/ceph_disk/main.py b/src/ceph-disk/ceph_disk/main.py index 4b79f50cb9bbb..b8c0f1ffece7d 100755 --- a/src/ceph-disk/ceph_disk/main.py +++ b/src/ceph-disk/ceph_disk/main.py @@ -1757,6 +1757,13 @@ class Prepare(object): default='/etc/ceph/dmcrypt-keys', help='directory where dm-crypt keys are stored', ) + parser.add_argument( + '--prepare-key', + metavar='PATH', + help='bootstrap-osd keyring path template (%(default)s)', + default='{statedir}/bootstrap-osd/{cluster}.keyring', + dest='prepare_key_template', + ) return parser @staticmethod @@ -2278,9 +2285,14 @@ class Lockbox(object): key_size = CryptHelpers.get_dmcrypt_keysize(self.args) key = open('/dev/urandom', 'rb').read(key_size / 8) base64_key = base64.b64encode(key) + cluster = self.args.cluster + bootstrap = self.args.prepare_key_template.format(cluster=cluster, + statedir=STATEDIR) command_check_call( [ 'ceph', + '--name', 'client.bootstrap-osd', + '--keyring', bootstrap, 'config-key', 'put', 'dm-crypt/osd/' + self.args.osd_uuid + '/luks', @@ -2290,6 +2302,8 @@ class Lockbox(object): keyring, stderr, ret = command( [ 'ceph', + '--name', 'client.bootstrap-osd', + '--keyring', bootstrap, 'auth', 'get-or-create', 'client.osd-lockbox.' + self.args.osd_uuid, diff --git a/src/mon/MonCap.cc b/src/mon/MonCap.cc index a2540b56411c3..45b66a8bb72d1 100644 --- a/src/mon/MonCap.cc +++ b/src/mon/MonCap.cc @@ -146,10 +146,16 @@ void MonCapGrant::expand_profile(EntityName name) const profile_grants.push_back(MonCapGrant("config-key delete", "key", StringConstraint("", prefix))); } if (profile == "bootstrap-osd") { + string prefix = "dm-crypt/osd"; + profile_grants.push_back(MonCapGrant("config-key put", "key", StringConstraint("", prefix))); profile_grants.push_back(MonCapGrant("mon", MON_CAP_R)); // read monmap profile_grants.push_back(MonCapGrant("osd", MON_CAP_R)); // read osdmap profile_grants.push_back(MonCapGrant("mon getmap")); profile_grants.push_back(MonCapGrant("osd create")); + profile_grants.push_back(MonCapGrant("auth get-or-create")); + profile_grants.back().command_args["entity"] = StringConstraint("", "client."); + prefix = "allow command \"config-key get\" with key=\"dm-crypt/osd/"; + profile_grants.back().command_args["caps_mon"] = StringConstraint("", prefix); profile_grants.push_back(MonCapGrant("auth add")); profile_grants.back().command_args["entity"] = StringConstraint("", "osd."); profile_grants.back().command_args["caps_mon"] = StringConstraint("allow profile osd", ""); -- 2.39.5