openstack/kolla-ansible
Code Issues Proposed changes

Change ceph_client caps to use profile rbd

Browse Source 
Using profiles in cephx is the recommended way since Mimic,
this also adds support for blacklist ops.

Change-Id: Ib9f65644637a5761c6cd7ca8925afc6bb2b8d5f5
Closes-Bug: #1760065
This commit is contained in:
Michal Nasiadka 2019-10-09 14:17:03 +02:00
parent 19bdba2b85
commit bdc8df0c90
4 changed files with 23 additions and 28 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
ansible/roles/cinder/defaults/main.yml
View File

@ -70,22 +70,20 @@ cinder_backup_pool_pg_num: "{{ ceph_pool_pg_num }}"
cinder_backup_pool_pgp_num: "{{ ceph_pool_pgp_num }}"
ceph_client_cinder_keyring_caps:
mon: 'allow r'
mon: 'profile rbd'
osd: >-
allow class-read object_prefix rbd_children,
allow rwx pool={{ ceph_cinder_pool_name }},
allow rwx pool={{ ceph_cinder_pool_name }}-cache,
allow rwx pool={{ ceph_nova_pool_name }},
allow rwx pool={{ ceph_nova_pool_name }}-cache,
allow rx pool={{ ceph_glance_pool_name }},
allow rx pool={{ ceph_glance_pool_name }}-cache
profile rbd pool={{ ceph_cinder_pool_name }},
profile rbd pool={{ ceph_nova_pool_name }},
profile rbd pool={{ ceph_glance_pool_name }},
profile rbd pool={{ ceph_cinder_pool_name }}-cache,
profile rbd pool={{ ceph_nova_pool_name }}-cache,
profile rbd pool={{ ceph_glance_pool_name }}-cache
ceph_client_cinder_backup_keyring_caps:
mon: 'allow r'
mon: 'profile rbd'
osd: >-
allow class-read object_prefix rbd_children,
allow rwx pool={{ ceph_cinder_backup_pool_name }},
allow rwx pool={{ ceph_cinder_backup_pool_name }}-cache
profile rbd pool={{ ceph_cinder_backup_pool_name }},
profile rbd pool={{ ceph_cinder_backup_pool_name }}-cache
####################

7
ansible/roles/glance/defaults/main.yml
View File

@ -81,11 +81,10 @@ glance_pool_pg_num: "{{ ceph_pool_pg_num }}"
glance_pool_pgp_num: "{{ ceph_pool_pgp_num }}"
ceph_client_glance_keyring_caps:
mon: 'allow r'
mon: 'profile rbd'
osd: >-
allow class-read object_prefix rbd_children,
allow rwx pool={{ ceph_glance_pool_name }},
allow rwx pool={{ ceph_glance_pool_name }}-cache
profile rbd pool={{ ceph_glance_pool_name }},
profile rbd pool={{ ceph_glance_pool_name }}-cache
####################

7
ansible/roles/gnocchi/defaults/main.yml
View File

@ -51,11 +51,10 @@ gnocchi_pool_pg_num: "{{ ceph_pool_pg_num }}"
gnocchi_pool_pgp_num: "{{ ceph_pool_pgp_num }}"
ceph_client_gnocchi_keyring_caps:
mon: 'allow r'
mon: 'profile rbd'
osd: >-
allow class-read object_prefix rbd_children,
allow rwx pool={{ ceph_gnocchi_pool_name }},
allow rwx pool={{ ceph_gnocchi_pool_name }}-cache
profile rbd pool={{ ceph_gnocchi_pool_name }},
profile rbd pool={{ ceph_gnocchi_pool_name }}-cache
####################

15
ansible/roles/nova/defaults/main.yml
View File

@ -175,15 +175,14 @@ nova_pool_pgp_num: "{{ ceph_pool_pgp_num }}"
nova_hw_disk_discard: "unmap"
ceph_client_nova_keyring_caps:
mon: 'allow r, allow command "osd blacklist"'
mon: 'profile rbd'
osd: >-
allow class-read object_prefix rbd_children,
allow rwx pool={{ ceph_cinder_pool_name }},
allow rwx pool={{ ceph_cinder_pool_name }}-cache,
allow rwx pool={{ ceph_nova_pool_name }},
allow rwx pool={{ ceph_nova_pool_name }}-cache,
allow rwx pool={{ ceph_glance_pool_name }},
allow rwx pool={{ ceph_glance_pool_name }}-cache
profile rbd pool={{ ceph_cinder_pool_name }},
profile rbd pool={{ ceph_cinder_pool_name }}-cache,
profile rbd pool={{ ceph_nova_pool_name }},
profile rbd pool={{ ceph_nova_pool_name }}-cache,
profile rbd pool={{ ceph_glance_pool_name }},
profile rbd pool={{ ceph_glance_pool_name }}-cache
####################