cephadm: give ceph-iscsi permissions to configfs

[matthewoliver]

The cephadm container mounts the configfs and then bind mounts (-v) it
into the container. Currently the container is not a priviliaged
container which leads to 2 problems:

1. The container can't insert the iscsi_target_mod kernel module; and
2. The container can't write to the configfs as that's only writeable
   by root.

We can get around 1, by preloading the kernel module. I.E add it the
systemd unit file. But that doesn't help with 2.

I've tried mounting the configfs with uid and gid options, but configfs
doesn't use them.

If we make the container a priviliged container then magically both 1
and 2 are solved. We don't need to preload the module so that's one less
workaround. But more importantly, configfs can be written to so we can
create ISCSI targets etc.

So that's what this patch does, it makes iscsi containers privileged
containers by setting the CephContainer --priviliged while creating it.

Fixes: https://tracker.ceph.com/issues/45252
Signed-off-by: Matthew Oliver moliver@suse.com

Checklist

• References tracker ticket
• Updates documentation if necessary
• Includes tests for new functionality or reproducer for bug

---

Show available Jenkins commands

• jenkins retest this please
• jenkins test classic perf
• jenkins test crimson perf
• jenkins test signed
• jenkins test make check
• jenkins test make check arm64
• jenkins test submodules
• jenkins test dashboard
• jenkins test dashboard backend
• jenkins test docs
• jenkins render docs
• jenkins test ceph-volume all
• jenkins test ceph-volume tox

[matthewoliver]

This makes the iscsi container a privileged one, so let's make sure we've considered all the security implications before we merge.

[b-ranto]

lgtm

[sebastian-philipp]

http://pulpito.ceph.com/swagner-2020-05-06_07:37:09-rados-wip-swagner-testing-2020-05-05-1648-distro-basic-smithi/