ceph_volume_client: allow volumes without namespace isolation #21808
Conversation
|
With this patch, if you authorize an ID, client.john, 'read-write' access to a volume1, and then authorize client.john,'read' access to volume2 that belongs to the same data pool. client.john's OSD caps of data pool would be set to 'read'. The latest changes to OSD data pool caps takes effect. I think the OSD data pool caps should pick the more permissive caps, here 'read-write'. @batrick , what do you think? |
|
Use case for posterity: kubernetes-retired/external-storage#674 |
Ah, I think this is what you were trying to tell me in standup (sorry, my brain doesn't work that well in the morning!).
Given the circumstances, I agree that this is the best option. |
|
@ajarr this will need a QA test too. |
| if namespace_isolated: | ||
| namespace = "{0}{1}".format(self.pool_ns_prefix, volume_path.volume_id) | ||
| log.info("create_volume: {0}, using rados namespace {1} to isolate data.".format(volume_path, namespace)) | ||
| self.fs.setxattr(path, 'ceph.dir.layout.pool_namespace', namespace, 0) |
There was a problem hiding this comment.
@ajarr If namespace is isolated, we set ceph.dir.layout.pool_namespace on path, which will also set ceph.dir.layout.pool (inherited from ancestor) on it. If namespace is not isolated, should we configure ceph.dir.layout.pool on volume path intentionally? I'm afraid if ancestor pool changed, we may have permission issues.
There was a problem hiding this comment.
@cofyc , I looked at kubernetes-retired/external-storage@2913195
makes sense. thanks!
Implemented this. |
I will add that tomorrow. |
ajarr
changed the title
done |
|
Let me know when you're ready to have this go through another round of QA @ajarr |
Fixes: https://tracker.ceph.com/issues/23695 Signed-off-by: Ramana Raja <rraja@redhat.com>
Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
|
@batrick it's ready |
* refs/pull/21808/head: qa: ignore version in auth metadata comp ceph_volume_client: allow volumes without namespace isolation Reviewed-by: Patrick Donnelly <pdonnell@redhat.com>
|
Thanks! |
Fixes: https://tracker.ceph.com/issues/23695
Signed-off-by: Ramana Raja rraja@redhat.com