From d308d313c15bb86e110dfa339ec630100f96fbcd Mon Sep 17 00:00:00 2001 From: Enrico Bocchi Date: Wed, 16 Oct 2024 11:40:26 +0200 Subject: [PATCH] mgr/volumes: Add test for mon caps if auth key has remaining mds/osd caps Signed-off-by: Enrico Bocchi (cherry picked from commit 403d5411364e2fddd70d98a6f120b26e416c1d99) --- qa/tasks/cephfs/test_volumes.py | 58 +++++++++++++++++++++++++++++++++ 1 file changed, 58 insertions(+) diff --git a/qa/tasks/cephfs/test_volumes.py b/qa/tasks/cephfs/test_volumes.py index ed4f109d758..48fba546635 100644 --- a/qa/tasks/cephfs/test_volumes.py +++ b/qa/tasks/cephfs/test_volumes.py @@ -3140,6 +3140,64 @@ class TestSubvolumes(TestVolumesHelper): self._fs_cmd("subvolume", "rm", self.volname, subvolume, "--group_name", group) self._fs_cmd("subvolumegroup", "rm", self.volname, group) + def test_subvolume_deauthorize_with_shared_key(self): + """ + That mon caps are preserved when one cephx key authorized on multiple + subvolumes is deauthorized on any of those. + """ + subvolume1 = self._gen_subvol_name() + subvolume2 = self._gen_subvol_name() + group = self._gen_subvol_grp_name() + authid = "alice" + + # create group + self._fs_cmd("subvolumegroup", "create", self.volname, group) + + # create subvolumes + self._fs_cmd("subvolume", "create", self.volname, subvolume1, "--group_name", group) + self._fs_cmd("subvolume", "create", self.volname, subvolume2, "--group_name", group) + + # authorize alice authID read-write access to both subvolumes + self._fs_cmd("subvolume", "authorize", self.volname, subvolume1, authid, + "--group_name", group) + self._fs_cmd("subvolume", "authorize", self.volname, subvolume2, authid, + "--group_name", group) + + # verify autorized-id has access to both subvolumes + expected_auth_list = [{'alice': 'rw'}] + auth_list1 = json.loads(self._fs_cmd('subvolume', 'authorized_list', self.volname, subvolume1, "--group_name", group)) + self.assertEqual(expected_auth_list, auth_list1) + auth_list2 = json.loads(self._fs_cmd('subvolume', 'authorized_list', self.volname, subvolume2, "--group_name", group)) + self.assertEqual(expected_auth_list, auth_list2) + + # check mon caps for authid + expected_mon_caps = 'allow r' + full_caps = self._raw_cmd("auth", "get", "client.alice", "--format=json-pretty") + self.assertEqual(expected_mon_caps, full_caps[0]['caps']['mon']) + + # deauthorize guest1 authID + self._fs_cmd("subvolume", "deauthorize", self.volname, subvolume2, authid, + "--group_name", group) + + # verify autorized-id has access to subvolume1 only + expected_auth_list = [{'alice': 'rw'}] + auth_list1 = json.loads(self._fs_cmd('subvolume', 'authorized_list', self.volname, subvolume1, "--group_name", group)) + self.assertEqual(expected_auth_list, auth_list1) + auth_list2 = json.loads(self._fs_cmd('subvolume', 'authorized_list', self.volname, subvolume2, "--group_name", group)) + self.assertEqual([], auth_list2) + + # check mon caps still hold for authid + expected_mon_caps = 'allow r' + full_caps = self._raw_cmd("auth", "get", "client.alice", "--format=json-pretty") + self.assertEqual(expected_mon_caps, full_caps[0]['caps']['mon']) + + # cleanup + self._fs_cmd("subvolume", "deauthorize", self.volname, subvolume1, authid, + "--group_name", group) + self._fs_cmd("subvolume", "rm", self.volname, subvolume1, "--group_name", group) + self._fs_cmd("subvolume", "rm", self.volname, subvolume2, "--group_name", group) + self._fs_cmd("subvolumegroup", "rm", self.volname, group) + def test_multitenant_subvolumes(self): """ That subvolume access can be restricted to a tenant. -- 2.39.5