gian/ceph-mirror
1
0
Fork 0
mirror of https://github.com/ceph/ceph synced 2026-08-02 07:03:18 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

mgr/smb: create rgw keys with the rgw profile

Browse Source 
Replace mon 'allow *' and the osd tag cap with the rgw profile. The
profile covers pool creation on first write, which is what the mon cap
was there for.

auth get-or-create refuses an entity that already exists with different
caps, so fall back to auth caps. Anything created before this carries
the old caps and would error on the next apply.

Signed-off-by: Matthew N. Heler <matthew.heler@hotmail.com>
This commit is contained in:
Matthew N. Heler 2026-07-26 10:37:42 -05:00
parent e1d0a209c2
commit 19283e2ca9
1 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/pybind/mgr/smb/rgw_auth.py
View File

@ -33,9 +33,9 @@ class RGWAuthorizer:
if not caps:
caps = [
'mon',
'allow *', # Required for pool creation on first write to empty RGW buckets
'profile rgw', # covers pool creation on first write to empty RGW buckets
'osd',
'allow rwx tag rgw *=*',
'profile rgw',
]
cmd = {
@ -46,5 +46,9 @@ class RGWAuthorizer:
log.info('Requesting RGW authorization: %r', cmd)
ret, _, status = self._mc.mon_command(cmd)
if ret != 0:
raise RGWAuthorizationGrantError(status)
ret, _, status = self._mc.mon_command(
{'prefix': 'auth caps', 'entity': entity, 'caps': caps}
)
if ret != 0:
raise RGWAuthorizationGrantError(status)
log.info('RGW authorization request success: %r', status)