From 8026e6941cc56ccf20e13a01afc97dca15f6afc8 Mon Sep 17 00:00:00 2001 From: John Mulligan Date: Mon, 27 Jul 2026 21:12:18 -0400 Subject: [PATCH 1/2] cephadm: update smb env to specify writable shared passwd/group files Update environment for smb containers to specify arguments that sambacc will use to configure the containers for a split configuration for users (passwd) and group files. The writable copy will be store in the samba state dir (/var/lib/samba in the container) and be shared across the primary and sidecar containers so that configwatch can pull new users and groups lists from ceph and apply them live. Signed-off-by: John Mulligan --- src/cephadm/cephadmlib/daemons/smb.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/cephadm/cephadmlib/daemons/smb.py b/src/cephadm/cephadmlib/daemons/smb.py index 5a49f1300c0..df4d4f7e9b8 100644 --- a/src/cephadm/cephadmlib/daemons/smb.py +++ b/src/cephadm/cephadmlib/daemons/smb.py @@ -327,6 +327,12 @@ class SambaContainerCommon(ContainerCommon): # variable. This can be dropped once sambacc no longer needs it, # possibly after the next sambacc release. environ['SAMBACC_CTDB'] = 'ctdb-is-experimental' + environ[ + 'SAMBACC_PASSWD_LOCATION' + ] = '/etc/passwd:/var/lib/samba/passwd:/lib/passwd' + environ[ + 'SAMBACC_GROUP_LOCATION' + ] = '/etc/group:/var/lib/samba/group:/lib/group' if self.cfg.ceph_config_entity: environ['SAMBACC_CEPH_ID'] = f'name={self.cfg.ceph_config_entity}' if self.cfg.rank >= 0: From 0a6d0cb043509b4e7b6d067e1c1e0f73e1f33e6e Mon Sep 17 00:00:00 2001 From: John Mulligan Date: Mon, 27 Jul 2026 21:12:32 -0400 Subject: [PATCH 2/2] cephadm: update how smb configwatch sidecar is started In order to update users (and groups) live without AD support we need the configwatch sidecar to be configured for split (altfiles) nsswitch. The capability to configure configwatch for nsswitch was added to sambacc under a special mode of the run subcommand. Switch to starting the confgwatch sidecar using the run subcommand and configuring the appropriate user and nsswitch setup options. Signed-off-by: John Mulligan --- src/cephadm/cephadmlib/daemons/smb.py | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-) diff --git a/src/cephadm/cephadmlib/daemons/smb.py b/src/cephadm/cephadmlib/daemons/smb.py index df4d4f7e9b8..29304bc397b 100644 --- a/src/cephadm/cephadmlib/daemons/smb.py +++ b/src/cephadm/cephadmlib/daemons/smb.py @@ -374,8 +374,11 @@ class SMBDContainer(SambaContainerCommon): args = super().args() args.append('run') if self.cfg.clustered: - auth_kind = 'nsswitch' if self.cfg.domain_member else 'users' - args.append(f'--setup={auth_kind}') + if self.cfg.domain_member: + args.append('--setup=nsswitch') + else: + args.append('--setup=nsswitch_auto') + args.append('--setup=users') args.append('--setup=smb_ctdb') args.append('--wait-for=ctdb') args.append('smbd') @@ -451,11 +454,17 @@ class ConfigWatchContainer(SambaContainerCommon): return 'configwatch' def args(self) -> List[str]: - return super().args() + [ - 'update-config', - '--watch', - f'--signal-pids-dir={_WANT_SIGNAL_DIR}', - ] + args = super().args() + args.append('run') + if self.cfg.clustered: + if self.cfg.domain_member: + args.append('--setup=nsswitch') + else: + args.append('--setup=nsswitch_auto') + args.append('--wait-for=ctdb') + args.append(f'--config-watch-signal-pids-dir={_WANT_SIGNAL_DIR}') + args.append('configwatch') + return args class SMBMetricsContainer(ContainerCommon):