@@ -29,11 +29,27 @@ recreate_pools() {
2929delete_users () {
3030 (ceph auth del client.volumes || true) > /dev/null 2>&1
3131 (ceph auth del client.images || true) > /dev/null 2>&1
32+
33+ (ceph auth del client.snap_none || true) > /dev/null 2>&1
34+ (ceph auth del client.snap_all || true) > /dev/null 2>&1
35+ (ceph auth del client.snap_pool || true) > /dev/null 2>&1
36+ (ceph auth del client.snap_profile_all || true) > /dev/null 2>&1
37+ (ceph auth del client.snap_profile_pool || true) > /dev/null 2>&1
38+
39+ (ceph auth del client.mon_write || true) > /dev/null 2>&1
3240}
3341
3442create_users () {
3543 ceph auth get-or-create client.volumes mon ' profile rbd' osd ' profile rbd pool=volumes, profile rbd-read-only pool=images' >> $KEYRING
3644 ceph auth get-or-create client.images mon ' profile rbd' osd ' profile rbd pool=images' >> $KEYRING
45+
46+ ceph auth get-or-create client.snap_none mon ' allow r' >> $KEYRING
47+ ceph auth get-or-create client.snap_all mon ' allow r' osd ' allow w' >> $KEYRING
48+ ceph auth get-or-create client.snap_pool mon ' allow r' osd ' allow w pool=images' >> $KEYRING
49+ ceph auth get-or-create client.snap_profile_all mon ' allow r' osd ' profile rbd' >> $KEYRING
50+ ceph auth get-or-create client.snap_profile_pool mon ' allow r' osd ' profile rbd pool=images' >> $KEYRING
51+
52+ ceph auth get-or-create client.mon_write mon ' allow *' >> $KEYRING
3753}
3854
3955expect () {
@@ -142,9 +158,83 @@ test_volumes_access() {
142158 rbd -k $KEYRING --id volumes rm volumes/child
143159}
144160
161+ create_self_managed_snapshot () {
162+ ID=$1
163+ POOL=$2
164+
165+ cat << EOF | CEPH_ARGS="-k $KEYRING " python
166+ import rados
167+
168+ cluster = rados.Rados(conffile="", rados_id="${ID} ")
169+ cluster.connect()
170+ ioctx = cluster.open_ioctx("${POOL} ")
171+
172+ snap_id = ioctx.create_self_managed_snap()
173+ print ("Created snap id {}".format(snap_id))
174+ EOF
175+ }
176+
177+ remove_self_managed_snapshot () {
178+ ID=$1
179+ POOL=$2
180+
181+ cat << EOF | CEPH_ARGS="-k $KEYRING " python
182+ import rados
183+
184+ cluster1 = rados.Rados(conffile="", rados_id="mon_write")
185+ cluster1.connect()
186+ ioctx1 = cluster1.open_ioctx("${POOL} ")
187+
188+ snap_id = ioctx1.create_self_managed_snap()
189+ print ("Created snap id {}".format(snap_id))
190+
191+ cluster2 = rados.Rados(conffile="", rados_id="${ID} ")
192+ cluster2.connect()
193+ ioctx2 = cluster2.open_ioctx("${POOL} ")
194+
195+ ioctx2.remove_self_managed_snap(snap_id)
196+ print ("Removed snap id {}".format(snap_id))
197+ EOF
198+ }
199+
200+ test_remove_self_managed_snapshots () {
201+ # Ensure users cannot create self-managed snapshots w/o permissions
202+ expect 1 create_self_managed_snapshot snap_none images
203+ expect 1 create_self_managed_snapshot snap_none volumes
204+
205+ create_self_managed_snapshot snap_all images
206+ create_self_managed_snapshot snap_all volumes
207+
208+ create_self_managed_snapshot snap_pool images
209+ expect 1 create_self_managed_snapshot snap_pool volumes
210+
211+ create_self_managed_snapshot snap_profile_all images
212+ create_self_managed_snapshot snap_profile_all volumes
213+
214+ create_self_managed_snapshot snap_profile_pool images
215+ expect 1 create_self_managed_snapshot snap_profile_pool volumes
216+
217+ # Ensure users cannot delete self-managed snapshots w/o permissions
218+ expect 1 remove_self_managed_snapshot snap_none images
219+ expect 1 remove_self_managed_snapshot snap_none volumes
220+
221+ remove_self_managed_snapshot snap_all images
222+ remove_self_managed_snapshot snap_all volumes
223+
224+ remove_self_managed_snapshot snap_pool images
225+ expect 1 remove_self_managed_snapshot snap_pool volumes
226+
227+ remove_self_managed_snapshot snap_profile_all images
228+ remove_self_managed_snapshot snap_profile_all volumes
229+
230+ remove_self_managed_snapshot snap_profile_pool images
231+ expect 1 remove_self_managed_snapshot snap_profile_pool volumes
232+ }
233+
145234cleanup () {
146235 rm -f $KEYRING
147236}
237+
148238KEYRING=$( mktemp)
149239trap cleanup EXIT ERR HUP INT QUIT
150240
@@ -157,6 +247,8 @@ test_images_access
157247recreate_pools
158248test_volumes_access
159249
250+ test_remove_self_managed_snapshots
251+
160252delete_pools
161253delete_users
162254
0 commit comments