RepoMirrors/ceph
1
0
Fork 0
mirror of https://github.com/ceph/ceph synced 2025-01-11 13:41:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

mon: define simple-rados-client-with-blocklist profile

Browse Source 
A mon profile that grants the ability for rados clients to blocklist
others (similar to rbd).

Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
This commit is contained in:
Patrick Donnelly 2021-03-13 09:41:34 -08:00
parent d3d683427d
commit 108f486afe
No known key found for this signature in database
GPG Key ID: 3A2A7E25BEA8AADB
2 changed files with 18 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
doc/rados/operations/user-management.rst
View File

@ -295,6 +295,13 @@ The following entries describe valid capability profiles:
:Description: Gives a user read-only permissions for monitor, OSD, and PG data.
Intended for use by direct librados client applications.
``profile simple-rados-client-with-blocklist`` (Monitor only)
:Description: Gives a user read-only permissions for monitor, OSD, and PG data.
Intended for use by direct librados client applications. Also
includes permission to add blocklist entries to build HA
applications.
``profile fs-client`` (Monitor only)
:Description: Gives a user read-only permissions for monitor, OSD, PG, and MDS

11
src/mon/MonCap.cc
View File

@ -290,6 +290,17 @@ void MonCapGrant::expand_profile(const EntityName& name) const
profile_grants.push_back(MonCapGrant("osd", MON_CAP_R));
profile_grants.push_back(MonCapGrant("pg", MON_CAP_R));
}
if (profile == "simple-rados-client-with-blocklist") {
profile_grants.push_back(MonCapGrant("mon", MON_CAP_R));
profile_grants.push_back(MonCapGrant("osd", MON_CAP_R));
profile_grants.push_back(MonCapGrant("pg", MON_CAP_R));
profile_grants.push_back(MonCapGrant("osd blocklist"));
profile_grants.back().command_args["blocklistop"] = StringConstraint(
StringConstraint::MATCH_TYPE_EQUAL, "add");
profile_grants.back().command_args["addr"] = StringConstraint(
StringConstraint::MATCH_TYPE_REGEX, "^[^/]+/[0-9]+$");
}
if (boost::starts_with(profile, "rbd")) {
profile_grants.push_back(MonCapGrant("mon", MON_CAP_R));
profile_grants.push_back(MonCapGrant("osd", MON_CAP_R));